Unverified Commit e4ab0a60 authored by Will Childs-Klein's avatar Will Childs-Klein Committed by GitHub
Browse files

Set rustls prefer-post-quantum feature flag (#4255) 

## Motivation and Context

This change sets rustls's `prefer-post-quantum` flag so that SDK calls
send a post-quantum KeyShare in the client Hello during a TLS handshake.
See t/P275548278 for more details.


## Description

In 0.23.27, rustls enabled the `prefer-post-quantum` feature flag by
default. However, [aws-smithy-http-client
disables](https://github.com/smithy-lang/smithy-rs/blob/main/rust-runtime/aws-smithy-http-client/Cargo.toml#L89)
all rustls default features, meaning no post-quantum KeyShare is sent.
This change explicitly enables the `prefer-post-quantum` feature.

Rustls [recently
removed](https://github.com/rustls/rustls/commit/cb273a03363161069c1c4f23b8e498aa7f62183c

)
this feature flag altogether, likely to be released in version 0.24.
Once we depend on that change, we can delete all mention of the feature
flag.

## Testing

I tested this locally against aws-sdk-rust (containing analogous changes
to this PR) with a small proof of concept project whose Cargo.toml looks
like this:

```
[package]
name = "rust-s3-connector"
version = "0.1.0"
edition = "2021"

[dependencies]
aws-types  = { version = "1", path = "/Users/childw/workplace/github/WillChilds-Klein/aws-sdk-rust/sdk/aws-types" }
aws-config = { version = "1", path = "/Users/childw/workplace/github/WillChilds-Klein/aws-sdk-rust/sdk/aws-config" }
aws-sdk-s3 = { version = "1", path = "/Users/childw/workplace/github/WillChilds-Klein/aws-sdk-rust/sdk/s3" }
aws-sdk-kms = { version = "1", path = "/Users/childw/workplace/github/WillChilds-Klein/aws-sdk-rust/sdk/kms" }
aws-smithy-http-client = { version = "1", path = "/Users/childw/workplace/github/WillChilds-Klein/aws-sdk-rust/sdk/aws-smithy-http-client" }
aws-smithy-runtime-api = { version = "1", path = "/Users/childw/workplace/github/WillChilds-Klein/aws-sdk-rust/sdk/aws-smithy-runtime-api" }

tokio = { version = "1", features = ["full"] }
clap = { version = "4.0", features = ["derive"]}
anyhow = "1.0"
```

With this PoC, I confirmed that no PQ keyshare was sent before this
change, and that a PQ keyshare was sent after the change. This resulted
in a successful PQ TLS connection.

## Checklist
<!--- If a checkbox below is not applicable, then please DELETE it
rather than leaving it unchecked -->
- [x] For changes to the smithy-rs codegen or runtime crates, I have
created a changelog entry Markdown file in the `.changelog` directory,
specifying "client," "server," or both in the `applies_to` key.

----

_By submitting this pull request, I confirm that you can use, modify,
copy, and redistribute this contribution, under the terms of your
choice._

---------

Co-authored-by: default avatarLandon James <lnj@amazon.com>
Co-authored-by: default avatarAaron Todd <aajtodd@users.noreply.github.com>
parent c6f5de80

.changelog/1754597579.md

0 → 100644
+10 −0
Original line number Diff line number Diff line 
---

applies_to: ["client", "aws-sdk-rust"]

authors: [WillChilds-Klein]

references: []

breaking: false

new_feature: true

bug_fix: false

---



Enable rustls post-quantum by default.

aws/rust-runtime/Cargo.lock

+1 −1
Original line number Diff line number Diff line
@@ -276,7 +276,7 @@ dependencies = [ 


[[package]]

name = "aws-smithy-http-client"

version = "1.0.6"

version = "1.0.7"

dependencies = [

 "aws-smithy-async",

 "aws-smithy-runtime-api",

rust-runtime/Cargo.lock

+1 −1
Original line number Diff line number Diff line
@@ -424,7 +424,7 @@ version = "0.60.3" 


[[package]]

name = "aws-smithy-http-client"

version = "1.0.6"

version = "1.0.7"

dependencies = [

 "aws-smithy-async",

 "aws-smithy-protocol-test",

rust-runtime/aws-smithy-http-client/Cargo.toml

+6 −6
Original line number Diff line number Diff line
@@ -2,7 +2,7 @@ 
name = "aws-smithy-http-client"

authors = ["AWS Rust SDK Team <aws-sdk-rust@amazon.com>"]

description = "HTTP client abstractions for generated smithy clients"

version = "1.0.6"

version = "1.0.7"

license = "Apache-2.0"

edition = "2021"

repository = "https://github.com/smithy-lang/smithy-rs"
@@ -66,8 +66,8 @@ legacy-test-util = [ 
legacy-rustls-ring = ["dep:legacy-hyper-rustls", "dep:legacy-rustls", "hyper-014"]



rustls-ring = ["dep:rustls", "rustls?/ring", "dep:hyper-rustls", "default-client"]

rustls-aws-lc = ["dep:rustls", "rustls?/aws_lc_rs", "dep:hyper-rustls", "default-client"]

rustls-aws-lc-fips = ["dep:rustls", "rustls?/fips", "dep:hyper-rustls", "default-client"]

rustls-aws-lc = ["dep:rustls", "rustls?/aws_lc_rs", "rustls?/prefer-post-quantum", "dep:hyper-rustls", "default-client"]

rustls-aws-lc-fips = ["dep:rustls", "rustls?/fips", "rustls?/prefer-post-quantum", "dep:hyper-rustls", "default-client"]

s2n-tls = ["dep:s2n-tls", "dep:s2n-tls-hyper", "default-client"]



[dependencies]
@@ -86,12 +86,12 @@ hyper-util = { version = "0.1.10", features = ["http1", "http2"], optional = tru 
http-1x = { package = "http", version = "1" , optional = true }

http-body-1x = { package = "http-body", version = "1", optional = true}

hyper-rustls = { version = "0.27", features = ["http2", "http1", "native-tokio", "tls12"], default-features = false, optional = true }

rustls = { version = "0.23", default-features = false, optional = true }

rustls = { version = "0.23.31", default-features = false, optional = true }

# TODO(hyper1): add a way to enable the fips feature flag in s2n-tls

s2n-tls-hyper = { version = "0.0.4", optional = true }

s2n-tls = { version = "0.3.12", optional = true }

tower = { version = "0.5.2", optional = true }

rustls-pki-types = { version = "1.11.0", features = ["std"], optional = true }

rustls-pki-types = { version = "1.12.0", features = ["std"], optional = true }

rustls-native-certs = { version = "0.8.1", optional = true }

# end hyper 1.x stack deps
@@ -119,7 +119,7 @@ aws-smithy-types = { path = "../aws-smithy-types", features = ["http-body-0-4-x" 
http-body-util = { version = "0.1.2" }

hyper-util = { version = "0.1.7", features = ["full"] }

rustls-pemfile = "2.2.0"

rustls-pki-types = { version = "1.11.0", features = ["std"] }

rustls-pki-types = { version = "1.12.0", features = ["std"] }

tokio = { version = "1", features = ["macros", "rt", "rt-multi-thread", "test-util", "full"] }

tokio-rustls = "0.26.1"