From fe7538d5d73e4bd5fa36dbae75b02a99328d96c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Linus=20F=C3=A4rnstrand?= Date: Thu, 16 Apr 2026 12:13:16 +0000 Subject: [PATCH] Replace ring with aws-lc-rs across the dependency tree Switches the cryptographic backend so that ring is no longer pulled into shadowsocks-rust on any supported target. * shadowsocks-crypto: use the new aws-lc-rs backend in place of the ring feature * tokio-rustls: select the aws_lc_rs provider instead of ring. * hickory-resolver: use tls-aws-lc-rs, https-aws-lc-rs and h3-aws-lc-rs in place of the *-ring variants. The only remaining ring path in the dependency tree is via quinn-proto on wasm32-unknown-unknown, which aws-lc-rs cannot target and which shadowsocks does not support. --- Cargo.lock | 157 ++++++++++---------------- crates/shadowsocks-service/Cargo.toml | 8 +- crates/shadowsocks/Cargo.toml | 14 ++- 3 files changed, 71 insertions(+), 108 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 384bf63bfe12..82b722e89068 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -240,6 +240,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a054912289d18629dc78375ba2c3726a3afe3ff71b4edba9dedfca0e3446d1fc" dependencies = [ "aws-lc-sys", + "untrusted 0.7.1", "zeroize", ] @@ -261,12 +262,6 @@ version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" -[[package]] -name = "base64ct" -version = "1.8.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d809780667f4410e7c41b07f52439b94d2bdf8528eeedc287fa38d3b7f95d82" - [[package]] name = "bindgen" version = "0.72.1" @@ -325,11 +320,11 @@ dependencies = [ [[package]] name = "block-buffer" -version = "0.10.4" +version = "0.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71" +checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be" dependencies = [ - "generic-array", + "hybrid-array", ] [[package]] @@ -641,6 +636,12 @@ dependencies = [ "cc", ] +[[package]] +name = "cmov" +version = "0.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746" + [[package]] name = "colorchoice" version = "1.0.4" @@ -668,9 +669,9 @@ dependencies = [ [[package]] name = "const-oid" -version = "0.9.6" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8" +checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c" [[package]] name = "constant_time_eq" @@ -796,6 +797,15 @@ dependencies = [ "cipher 0.4.4", ] +[[package]] +name = "ctutils" +version = "0.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +dependencies = [ + "cmov", +] + [[package]] name = "data-encoding" version = "2.9.0" @@ -843,16 +853,6 @@ dependencies = [ "thiserror 2.0.18", ] -[[package]] -name = "der" -version = "0.7.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb" -dependencies = [ - "const-oid", - "zeroize", -] - [[package]] name = "deranged" version = "0.5.5" @@ -892,13 +892,14 @@ checksum = "3c877555693c14d2f84191cfd3ad8582790fc52b5e2274b40b59cf5f5cea25c7" [[package]] name = "digest" -version = "0.10.7" +version = "0.11.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" +checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2" dependencies = [ "block-buffer", - "crypto-common 0.1.7", - "subtle", + "const-oid", + "crypto-common 0.2.1", + "ctutils", ] [[package]] @@ -919,7 +920,7 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -959,16 +960,6 @@ dependencies = [ "syn", ] -[[package]] -name = "ed25519" -version = "2.2.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53" -dependencies = [ - "pkcs8", - "signature", -] - [[package]] name = "either" version = "1.15.0" @@ -1032,7 +1023,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -1466,18 +1457,18 @@ dependencies = [ [[package]] name = "hkdf" -version = "0.12.4" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7" +checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018" dependencies = [ "hmac", ] [[package]] name = "hmac" -version = "0.12.1" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e" +checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f" dependencies = [ "digest", ] @@ -1598,7 +1589,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.5.10", + "socket2 0.6.3", "system-configuration", "tokio", "tower-service", @@ -2149,9 +2140,9 @@ dependencies = [ [[package]] name = "md-5" -version = "0.10.6" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf" +checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98" dependencies = [ "cfg-if", "digest", @@ -2298,7 +2289,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -2494,16 +2485,6 @@ dependencies = [ "futures-io", ] -[[package]] -name = "pkcs8" -version = "0.10.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7" -dependencies = [ - "der", - "spki", -] - [[package]] name = "pkg-config" version = "0.3.32" @@ -2633,7 +2614,7 @@ dependencies = [ "quinn-udp", "rustc-hash", "rustls", - "socket2 0.5.10", + "socket2 0.6.3", "thiserror 2.0.18", "tokio", "tracing", @@ -2671,7 +2652,7 @@ dependencies = [ "cfg_aliases", "libc", "once_cell", - "socket2 0.5.10", + "socket2 0.6.3", "tracing", "windows-sys 0.60.2", ] @@ -2857,23 +2838,10 @@ dependencies = [ "cfg-if", "getrandom 0.2.16", "libc", - "untrusted", + "untrusted 0.9.0", "windows-sys 0.52.0", ] -[[package]] -name = "ring-compat" -version = "0.8.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ccce7bae150b815f0811db41b8312fcb74bffa4cab9cee5429ee00f356dd5bd4" -dependencies = [ - "aead", - "ed25519", - "generic-array", - "pkcs8", - "ring", -] - [[package]] name = "rocksdb" version = "0.24.0" @@ -2950,7 +2918,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -2962,7 +2930,6 @@ dependencies = [ "aws-lc-rs", "log", "once_cell", - "ring", "rustls-pki-types", "rustls-webpki", "subtle", @@ -3009,7 +2976,7 @@ dependencies = [ "security-framework 3.5.1", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -3027,7 +2994,7 @@ dependencies = [ "aws-lc-rs", "ring", "rustls-pki-types", - "untrusted", + "untrusted 0.9.0", ] [[package]] @@ -3219,12 +3186,12 @@ dependencies = [ [[package]] name = "sha1" -version = "0.10.6" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba" +checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214" dependencies = [ "cfg-if", - "cpufeatures 0.2.17", + "cpufeatures 0.3.0", "digest", ] @@ -3269,14 +3236,15 @@ dependencies = [ [[package]] name = "shadowsocks-crypto" -version = "0.6.2" +version = "0.7.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3d038a3d17586f1c1ab3c1c3b9e4d5ef8fba98fb3890ad740c8487038b2e2ca5" +checksum = "9339588f8aee0810546fd7e4dcc219fc4bda2cfd0066dd277b7104d5113fd0c0" dependencies = [ "aead", "aes 0.8.4", "aes-gcm", "aes-gcm-siv", + "aws-lc-rs", "blake3", "bytes", "camellia", @@ -3288,8 +3256,7 @@ dependencies = [ "ghash", "hkdf", "md-5", - "rand 0.9.4", - "ring-compat", + "rand 0.10.1", "sha1", "sm4", "subtle", @@ -3415,12 +3382,6 @@ dependencies = [ "libc", ] -[[package]] -name = "signature" -version = "2.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de" - [[package]] name = "simd-adler32" version = "0.3.8" @@ -3522,16 +3483,6 @@ dependencies = [ "lock_api", ] -[[package]] -name = "spki" -version = "0.7.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d" -dependencies = [ - "base64ct", - "der", -] - [[package]] name = "stable_deref_trait" version = "1.2.1" @@ -3662,7 +3613,7 @@ dependencies = [ "getrandom 0.3.4", "once_cell", "rustix", - "windows-sys 0.60.2", + "windows-sys 0.61.2", ] [[package]] @@ -4093,6 +4044,12 @@ version = "0.2.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861" +[[package]] +name = "untrusted" +version = "0.7.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a" + [[package]] name = "untrusted" version = "0.9.0" @@ -4364,7 +4321,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.48.0", + "windows-sys 0.61.2", ] [[package]] diff --git a/crates/shadowsocks-service/Cargo.toml b/crates/shadowsocks-service/Cargo.toml index 31e43fab9ebf..5d6ee4c7640d 100644 --- a/crates/shadowsocks-service/Cargo.toml +++ b/crates/shadowsocks-service/Cargo.toml @@ -42,15 +42,15 @@ hickory-dns = ["hickory-resolver", "shadowsocks/trust-dns"] trust-dns = ["hickory-dns"] dns-over-tls = [ "hickory-dns", - "hickory-resolver/tls-ring", + "hickory-resolver/tls-aws-lc-rs", "hickory-resolver/webpki-roots", ] dns-over-https = [ "hickory-dns", - "hickory-resolver/https-ring", + "hickory-resolver/https-aws-lc-rs", "hickory-resolver/webpki-roots", ] -dns-over-h3 = ["hickory-dns", "hickory-resolver/h3-ring"] +dns-over-h3 = ["hickory-dns", "hickory-resolver/h3-aws-lc-rs"] # Enable DNS-relay local-dns = ["local", "hickory-dns"] @@ -152,7 +152,7 @@ webpki-roots = { version = "1.0", optional = true } tokio-rustls = { version = "0.26", optional = true, default-features = false, features = [ "logging", "tls12", - "ring", + "aws_lc_rs", ] } rustls-native-certs = { version = "0.8", optional = true } trait-variant = "0.1" diff --git a/crates/shadowsocks/Cargo.toml b/crates/shadowsocks/Cargo.toml index 670cc7c482a4..08f15e363ad2 100644 --- a/crates/shadowsocks/Cargo.toml +++ b/crates/shadowsocks/Cargo.toml @@ -26,10 +26,16 @@ trust-dns = ["hickory-dns"] # WARN: Stream Cipher Protocol is proved to be insecure # https://github.com/shadowsocks/shadowsocks-rust/issues/373 # Users should always avoid using these ciphers in practice -stream-cipher = ["shadowsocks-crypto/v1-stream", "shadowsocks-crypto/ring"] +stream-cipher = [ + "shadowsocks-crypto/v1-stream", + "shadowsocks-crypto/aws-lc", +] # Enable AEAD ciphers -aead-cipher = ["shadowsocks-crypto/v1-aead", "shadowsocks-crypto/ring"] +aead-cipher = [ + "shadowsocks-crypto/v1-aead", + "shadowsocks-crypto/aws-lc", +] # Enable extra AEAD ciphers # WARN: These non-standard AEAD ciphers are not officially supported by shadowsocks community @@ -37,7 +43,7 @@ aead-cipher-extra = ["aead-cipher", "shadowsocks-crypto/v1-aead-extra"] aead-cipher-2022 = [ "shadowsocks-crypto/v2", - "shadowsocks-crypto/ring", + "shadowsocks-crypto/aws-lc", "rand", "aes", "lru_time_cache", @@ -92,7 +98,7 @@ notify = { version = "8.0", optional = true } aes = { version = "0.9", optional = true } blake3 = "1.5" -shadowsocks-crypto = { version = "0.6.0", default-features = false } +shadowsocks-crypto = { version = "0.7.0", default-features = false } [target.'cfg(any(windows, target_os = "linux", target_os = "android", target_os = "freebsd", target_os = "macos", target_os = "ios", target_os = "watchos", target_os = "tvos"))'.dependencies] tokio-tfo = "0.4.3"