Skip to content
Unverified Commit e4ab0a60 authored by Will Childs-Klein's avatar Will Childs-Klein Committed by GitHub
Browse files

Set rustls prefer-post-quantum feature flag (#4255)

## Motivation and Context

This change sets rustls's `prefer-post-quantum` flag so that SDK calls
send a post-quantum KeyShare in the client Hello during a TLS handshake.
See t/P275548278 for more details.


## Description

In 0.23.27, rustls enabled the `prefer-post-quantum` feature flag by
default. However, [aws-smithy-http-client
disables](https://github.com/smithy-lang/smithy-rs/blob/main/rust-runtime/aws-smithy-http-client/Cargo.toml#L89)
all rustls default features, meaning no post-quantum KeyShare is sent.
This change explicitly enables the `prefer-post-quantum` feature.

Rustls [recently
removed](https://github.com/rustls/rustls/commit/cb273a03363161069c1c4f23b8e498aa7f62183c

)
this feature flag altogether, likely to be released in version 0.24.
Once we depend on that change, we can delete all mention of the feature
flag.

## Testing

I tested this locally against aws-sdk-rust (containing analogous changes
to this PR) with a small proof of concept project whose Cargo.toml looks
like this:

```
[package]
name = "rust-s3-connector"
version = "0.1.0"
edition = "2021"

[dependencies]
aws-types  = { version = "1", path = "/Users/childw/workplace/github/WillChilds-Klein/aws-sdk-rust/sdk/aws-types" }
aws-config = { version = "1", path = "/Users/childw/workplace/github/WillChilds-Klein/aws-sdk-rust/sdk/aws-config" }
aws-sdk-s3 = { version = "1", path = "/Users/childw/workplace/github/WillChilds-Klein/aws-sdk-rust/sdk/s3" }
aws-sdk-kms = { version = "1", path = "/Users/childw/workplace/github/WillChilds-Klein/aws-sdk-rust/sdk/kms" }
aws-smithy-http-client = { version = "1", path = "/Users/childw/workplace/github/WillChilds-Klein/aws-sdk-rust/sdk/aws-smithy-http-client" }
aws-smithy-runtime-api = { version = "1", path = "/Users/childw/workplace/github/WillChilds-Klein/aws-sdk-rust/sdk/aws-smithy-runtime-api" }

tokio = { version = "1", features = ["full"] }
clap = { version = "4.0", features = ["derive"]}
anyhow = "1.0"
```

With this PoC, I confirmed that no PQ keyshare was sent before this
change, and that a PQ keyshare was sent after the change. This resulted
in a successful PQ TLS connection.

## Checklist
<!--- If a checkbox below is not applicable, then please DELETE it
rather than leaving it unchecked -->
- [x] For changes to the smithy-rs codegen or runtime crates, I have
created a changelog entry Markdown file in the `.changelog` directory,
specifying "client," "server," or both in the `applies_to` key.

----

_By submitting this pull request, I confirm that you can use, modify,
copy, and redistribute this contribution, under the terms of your
choice._

---------

Co-authored-by: default avatarLandon James <lnj@amazon.com>
Co-authored-by: default avatarAaron Todd <aajtodd@users.noreply.github.com>
parent c6f5de80
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment