Skip to content

build(deps): bump hmac and crypto deps to clean up advisory on block-buffer #1971

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rhammonds-teleport wants to merge 1 commit into
base: master
Choose a base branch
from
Open

build(deps): bump hmac and crypto deps to clean up advisory on block-buffer #1971

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1,067 changes: 493 additions & 574 deletions Cargo.lock
View file
Open in desktop

Large diffs are not rendered by default.

6 changes: 5 additions & 1 deletion crates/ironrdp-acceptor/src/credssp.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,7 +167,11 @@ impl<'a> CredsspSequence<'a> {
self.state = next_state;
let written = if let Some(ts_request) = ts_request {
debug!(?ts_request, "Send");
let length = usize::from(ts_request.buffer_len());
let length = usize::from(
ts_request
.buffer_len()
.map_err(|e| ConnectorError::new("CredSSP", ConnectorErrorKind::Credssp(e)))?,
);
Comment on lines +170 to +174

@github-actions github-actions Bot Oct 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[code-compressor] Duplicated CredsspError-to-ConnectorError mapping closure — low 🟡 — Same shape as the connector change: the PR-added `map_err(|e| ConnectorError::new("CredSSP", ConnectorErrorKind::Credssp(e)))` at line 173 duplicates the identical closure already at line 124 of this file, with the same CredsspError inner type. A per-file private helper reduces the duplication with identical error output; cross-crate sharing is deliberately not proposed to avoid expanding the public API. Optional cleanup; behavior is fully preserved either way.

let unfilled_buffer = output.unfilled_to(length);

ts_request
Expand Down
2 changes: 1 addition & 1 deletion crates/ironrdp-activex/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ ironrdp-session = { path = "../ironrdp-session", version = "0.11" }
ironrdp-svc = { path = "../ironrdp-svc", version = "0.8" }
ironrdp-tls = { path = "../ironrdp-tls", version = "0.2" }
png = "0.18"
sha2 = "0.10"
sha2 = "0.11"
tokio = { version = "1", features = ["io-util", "macros", "rt-multi-thread", "sync"] }
tracing = { version = "0.1", features = ["log"] }
url = "2.5"
Expand Down
2 changes: 1 addition & 1 deletion crates/ironrdp-agent/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ png = "0.18"
bytes = "1"
h2 = "0.4"
http = "1"
md-5 = "0.10"
md-5 = "0.11"
windows = { version = "0.62", features = [
"Win32_Foundation",
"Win32_Security",
Expand Down
4 changes: 2 additions & 2 deletions crates/ironrdp-capture-replay/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ categories.workspace = true

[dependencies]
aes-gcm = "0.10"
hmac = "0.12"
hmac = "0.13"
ironrdp-core = { version = "0.2.1", path = "../ironrdp-core" }
ironrdp-dvc = { version = "0.8.0", path = "../ironrdp-dvc" } # public
ironrdp-egfx = { version = "0.3.0", path = "../ironrdp-egfx" }
Expand All @@ -24,7 +24,7 @@ ironrdp-session = { version = "0.11.0", path = "../ironrdp-session" }
ironrdp-svc = { version = "0.8.0", path = "../ironrdp-svc" }
pcap-parser = "0.17"
png = "0.18"
sha2 = "0.10"
sha2 = "0.11"
thiserror = "2"
zeroize = "1.8"

Expand Down
18 changes: 9 additions & 9 deletions crates/ironrdp-capture-replay/src/tls.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
use aes_gcm::aead::{AeadInPlace as _, KeyInit as _};
use aes_gcm::{Aes128Gcm, Aes256Gcm, Nonce, Tag};
use hmac::{Hmac, Mac};
use hmac::{Hmac, KeyInit, Mac as _};
use sha2::{Sha256, Sha384};

use crate::transport::x224_connection_tpdu_end;
Expand Down Expand Up @@ -434,19 +434,19 @@ fn tls_prf_sha256(secret: &[u8], label: &[u8], seed: &[u8], length: usize) -> Re
let mut label_seed = Vec::with_capacity(label.len() + seed.len());
label_seed.extend_from_slice(label);
label_seed.extend_from_slice(seed);
let mut a = <Hmac<Sha256> as Mac>::new_from_slice(secret)
let mut a = <Hmac<Sha256> as KeyInit>::new_from_slice(secret)
.map_err(|_| ReplayError::UnsupportedTls)?
.chain_update(&label_seed)
.finalize()
.into_bytes()
.to_vec();
let mut output = Vec::with_capacity(length);
while output.len() < length {
let mut hmac = <Hmac<Sha256> as Mac>::new_from_slice(secret).map_err(|_| ReplayError::UnsupportedTls)?;
let mut hmac = <Hmac<Sha256> as KeyInit>::new_from_slice(secret).map_err(|_| ReplayError::UnsupportedTls)?;
hmac.update(&a);
hmac.update(&label_seed);
output.extend_from_slice(&hmac.finalize().into_bytes());
a = <Hmac<Sha256> as Mac>::new_from_slice(secret)
a = <Hmac<Sha256> as KeyInit>::new_from_slice(secret)
.map_err(|_| ReplayError::UnsupportedTls)?
.chain_update(&a)
.finalize()
Expand All @@ -461,19 +461,19 @@ fn tls_prf_sha384(secret: &[u8], label: &[u8], seed: &[u8], length: usize) -> Re
let mut label_seed = Vec::with_capacity(label.len() + seed.len());
label_seed.extend_from_slice(label);
label_seed.extend_from_slice(seed);
let mut a = <Hmac<Sha384> as Mac>::new_from_slice(secret)
let mut a = <Hmac<Sha384> as KeyInit>::new_from_slice(secret)
.map_err(|_| ReplayError::UnsupportedTls)?
.chain_update(&label_seed)
.finalize()
.into_bytes()
.to_vec();
let mut output = Vec::with_capacity(length);
while output.len() < length {
let mut hmac = <Hmac<Sha384> as Mac>::new_from_slice(secret).map_err(|_| ReplayError::UnsupportedTls)?;
let mut hmac = <Hmac<Sha384> as KeyInit>::new_from_slice(secret).map_err(|_| ReplayError::UnsupportedTls)?;
hmac.update(&a);
hmac.update(&label_seed);
output.extend_from_slice(&hmac.finalize().into_bytes());
a = <Hmac<Sha384> as Mac>::new_from_slice(secret)
a = <Hmac<Sha384> as KeyInit>::new_from_slice(secret)
.map_err(|_| ReplayError::UnsupportedTls)?
.chain_update(&a)
.finalize()
Expand Down Expand Up @@ -514,7 +514,7 @@ fn hkdf_expand_sha256(secret: &[u8], info: &[u8], length: usize) -> Result<Vec<u
let mut previous = Vec::new();
let mut output = Vec::with_capacity(length);
for counter in 1..=u8::MAX {
let mut hmac = <Hmac<Sha256> as Mac>::new_from_slice(secret).map_err(|_| ReplayError::UnsupportedTls)?;
let mut hmac = <Hmac<Sha256> as KeyInit>::new_from_slice(secret).map_err(|_| ReplayError::UnsupportedTls)?;
hmac.update(&previous);
hmac.update(info);
hmac.update(&[counter]);
Expand All @@ -532,7 +532,7 @@ fn hkdf_expand_sha384(secret: &[u8], info: &[u8], length: usize) -> Result<Vec<u
let mut previous = Vec::new();
let mut output = Vec::with_capacity(length);
for counter in 1..=u8::MAX {
let mut hmac = <Hmac<Sha384> as Mac>::new_from_slice(secret).map_err(|_| ReplayError::UnsupportedTls)?;
let mut hmac = <Hmac<Sha384> as KeyInit>::new_from_slice(secret).map_err(|_| ReplayError::UnsupportedTls)?;
hmac.update(&previous);
hmac.update(info);
hmac.update(&[counter]);
Expand Down
8 changes: 4 additions & 4 deletions crates/ironrdp-capture-replay/tests/keylog.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ use std::process::Command;

use aes_gcm::aead::{AeadInPlace as _, KeyInit as _};
use aes_gcm::{Aes128Gcm, Nonce};
use hmac::{Hmac, Mac};
use hmac::{Hmac, KeyInit, Mac as _};
use ironrdp_capture_replay::{ReplayError, decrypt_tls, read_capture, replay_capture};
use sha2::Sha256;

Expand Down Expand Up @@ -141,19 +141,19 @@ fn tls12_key_block(master: &[u8], client_random: &[u8], server_random: &[u8]) ->
seed.extend(client_random);
let mut label_seed = b"key expansion".to_vec();
label_seed.extend(seed);
let mut a = <Hmac<Sha256> as Mac>::new_from_slice(master)
let mut a = <Hmac<Sha256> as KeyInit>::new_from_slice(master)
.expect("valid HMAC key")
.chain_update(&label_seed)
.finalize()
.into_bytes()
.to_vec();
let mut key_block = Vec::new();
while key_block.len() < 40 {
let mut hmac = <Hmac<Sha256> as Mac>::new_from_slice(master).expect("valid HMAC key");
let mut hmac = <Hmac<Sha256> as KeyInit>::new_from_slice(master).expect("valid HMAC key");
hmac.update(&a);
hmac.update(&label_seed);
key_block.extend(hmac.finalize().into_bytes());
a = <Hmac<Sha256> as Mac>::new_from_slice(master)
a = <Hmac<Sha256> as KeyInit>::new_from_slice(master)
.expect("valid HMAC key")
.chain_update(&a)
.finalize()
Expand Down
2 changes: 1 addition & 1 deletion crates/ironrdp-client/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ tracing = { version = "0.1", features = ["log"] }

# Async, futures
tokio = { version = "1", features = ["macros", "net", "io-util", "sync", "rt", "time"] }
tokio-tungstenite = "0.29"
tokio-tungstenite = "0.30"
futures-util = { version = "0.3", features = ["sink"] }

# Utils
Expand Down
4 changes: 2 additions & 2 deletions crates/ironrdp-connector/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,13 +26,13 @@ ironrdp-svc = { path = "../ironrdp-svc", version = "0.8" } # public
ironrdp-core = { path = "../ironrdp-core", version = "0.2" } # public
ironrdp-error = { path = "../ironrdp-error", version = "0.2" } # public
ironrdp-pdu = { path = "../ironrdp-pdu", version = "0.9", features = ["std"] } # public
sspi = { version = "0.21", features = ["scard"] }
sspi = { version = "^0.22", features = ["scard"] }

@github-actions github-actions Bot Oct 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[code-compressor] Redundant caret operator in sspi version requirement — low 🟡 — The PR rewrites `sspi = { version = "0.21" ... }` as `version = "^0.22"` here and in crates/ironrdp/Cargo.toml:90, crates/ironrdp-mstsgu/Cargo.toml:100, and ffi/Cargo.toml:23. Caret is Cargo's default requirement operator, so "^0.22" is exactly equivalent to "0.22"; the rest of the workspace (including adjacent lines in these hunks) uses bare requirements. Dropping `^` preserves resolution and the lockfile while matching convention. Purely cosmetic with zero behavior impact.

url = "2.5" # public
rand = { version = "0.9", features = ["std"] } # TODO: dependency injection?
tracing = { version = "0.1", features = ["log"] }
picky-asn1-der = "0.5"
picky-asn1-x509 = "0.15"
picky = "=7.0.0-rc.25" # FIXME: We are pinning with = because the candidate version number counts as the minor number by Cargo, and will be automatically bumped in the Cargo.lock.
picky = "=7.0.0-rc.26" # FIXME: We are pinning with = because the candidate version number counts as the minor number by Cargo, and will be automatically bumped in the Cargo.lock.

[lints]
workspace = true
6 changes: 5 additions & 1 deletion crates/ironrdp-connector/src/credssp.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,7 +262,11 @@ fn extract_user_principal_name(cert: &Certificate) -> Option<String> {
}

fn write_credssp_request(ts_request: credssp::TsRequest, output: &mut WriteBuf) -> ConnectorResult<usize> {
let length = usize::from(ts_request.buffer_len());
let length = usize::from(
ts_request
.buffer_len()
.map_err(|e| ConnectorError::new("CredSSP", ConnectorErrorKind::Credssp(e)))?,
);
Comment on lines +265 to +269

@github-actions github-actions Bot Oct 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[code-compressor] Duplicated CredsspError-to-ConnectorError mapping closure — low 🟡 — The PR-added fallible `buffer_len()` handling introduces `map_err(|e| ConnectorError::new("CredSSP", ConnectorErrorKind::Credssp(e)))` (line 268), duplicating the identical closure at line 165; both wrap a CredsspError. A one-line local helper `fn credssp_error(e: CredsspError) -> ConnectorError` collapses both sites to `.map_err(credssp_error)?` with unchanged error kind, message, and behavior. Optional style cleanup; the added pattern does follow existing convention, so leaving it costs only a few duplicated tokens.


let unfilled_buffer = output.unfilled_to(length);

Expand Down
6 changes: 3 additions & 3 deletions crates/ironrdp-mstsgu/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,13 +97,13 @@ ironrdp-core = { path = "../ironrdp-core", version = "0.2", features = ["std"] }
ironrdp-error = { path = "../ironrdp-error", version = "0.2" }
ironrdp-tls = { path = "../ironrdp-tls", version = "0.2.2" } # public
log = "0.4"
sspi = { version = "0.21", features = ["network_client"] }
tokio-tungstenite = { version = "0.29" }
sspi = { version = "^0.22", features = ["network_client"] }
tokio-tungstenite = { version = "0.30" }
tokio-util = { version = "0.7" }
tokio = { version = "1.52", features = ["macros", "rt", "io-util"] }
tokio-socks = "0.5.3"
uuid = { version = "1", features = ["v4"] } # public, exposed by RpcSyntaxIdentifier
picky = { version = "=7.0.0-rc.25", optional = true }
picky = { version = "=7.0.0-rc.26", optional = true }
picky-asn1-der = { version = "0.5", optional = true }
picky-asn1-x509 = { version = "0.15", optional = true }

Expand Down
4 changes: 2 additions & 2 deletions crates/ironrdp-pdu/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,8 @@ tap = "1"
bit_field = "0.10"
byteorder = "1.5" # TODO: remove
der-parser = "10.0"
hmac = { version = "0.12", default-features = false }
md5 = { package = "md-5", version = "0.10" }
hmac = { version = "0.13", default-features = false }
md5 = { package = "md-5", version = "0.11" }
num-bigint = "0.4"
num-derive.workspace = true # TODO: remove
num-integer = "0.1"
Expand Down
1 change: 1 addition & 0 deletions crates/ironrdp-pdu/src/rdp/client_info.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
use core::fmt;

use bitflags::bitflags;
use hmac::KeyInit as _;
use ironrdp_core::{
Decode, DecodeResult, Encode, EncodeResult, ReadCursor, WriteCursor, cast_length, ensure_fixed_part_size,
ensure_size, invalid_field_err, write_padding,
Expand Down
1 change: 0 additions & 1 deletion crates/ironrdp-pdu/src/rdp/server_license/client_new_license_request/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,6 @@ use ironrdp_core::{
Decode as _, DecodeResult, Encode as _, EncodeResult, ReadCursor, WriteCursor, ensure_size, invalid_field_err,
};
use md5::Digest as _;
use sha1::Digest as _;

use super::{
BasicSecurityHeader, BasicSecurityHeaderFlags, BlobHeader, BlobType, KEY_EXCHANGE_ALGORITHM_RSA,
Expand Down
1 change: 0 additions & 1 deletion crates/ironrdp-pdu/src/rdp/server_license/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ use ironrdp_core::{
use md5::Digest as _;
use num_derive::FromPrimitive;
use num_traits::FromPrimitive as _;
use sha1::Digest as _;

use crate::PduError;
use crate::rdp::headers::{BASIC_SECURITY_HEADER_SIZE, BasicSecurityHeader, BasicSecurityHeaderFlags};
Expand Down
2 changes: 1 addition & 1 deletion crates/ironrdp-rdpeudp-tokio/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ ironrdp-rdpeudp = { path = "../ironrdp-rdpeudp", version = "0.1", features = ["s
ironrdp-tls = { path = "../ironrdp-tls", version = "0.2.2", default-features = false, features = ["rustls-verifier"] } # public
bytes = "1"
tokio = { version = "1", features = ["io-util", "macros", "net", "rt", "sync", "time"] } # public
sha2 = "0.10"
sha2 = "0.11"
# Mirrors `ironrdp-tls`: rustls is reached through `tokio_rustls::rustls` rather
# than declared separately. The crypto provider is not bundled, so the process
# default must be installed before connecting.
Expand Down
2 changes: 1 addition & 1 deletion crates/ironrdp-vmconnect/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ tracing = { version = "0.1", features = ["log"] }

[target.'cfg(windows)'.dependencies]
ironrdp-dvc = { version = "0.8.0", path = "../ironrdp-dvc" } # public
sha2 = "0.10"
sha2 = "0.11"
windows = { version = "0.62", features = [
"Win32_Foundation",
"Win32_Security",
Expand Down
5 changes: 4 additions & 1 deletion crates/ironrdp-vmconnect/src/native_credssp.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,10 @@ where

loop {
let outgoing = sequence.process(incoming.take())?;
let mut encoded = Vec::with_capacity(usize::from(outgoing.buffer_len()));
let buffer_len = outgoing
.buffer_len()
.map_err(|error| custom_err!("compute native CredSSP request length", error))?;
let mut encoded = Vec::with_capacity(usize::from(buffer_len));
outgoing
.encode_ts_request(&mut encoded)
.map_err(|error| custom_err!("encode native CredSSP request", error))?;
Expand Down
2 changes: 1 addition & 1 deletion crates/ironrdp/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@ async-trait = "0.1"
image = { version = "0.25", default-features = false, features = ["png"] }
pico-args = "0.5"
x509-cert = { version = "0.3", default-features = false, features = ["std"] }
sspi = { version = "0.21", features = ["network_client"] }
sspi = { version = "^0.22", features = ["network_client"] }
tracing = { version = "0.1", features = ["log"] }
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
tokio = { version = "1", features = ["macros", "rt", "sync", "time"] }
Expand Down
2 changes: 1 addition & 1 deletion ffi/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ ironrdp-dvc-pipe-proxy.path = "../crates/ironrdp-dvc-pipe-proxy"
ironrdp-core = { path = "../crates/ironrdp-core", features = ["alloc"] }
ironrdp-vmconnect = { path = "../crates/ironrdp-vmconnect" }
ironrdp-rdcleanpath.path = "../crates/ironrdp-rdcleanpath"
sspi = { version = "0.21", features = ["network_client"] }
sspi = { version = "^0.22", features = ["network_client"] }
thiserror = "2"
tracing = { version = "0.1", features = ["log"] }
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
Expand Down
Loading
Loading