From 207c2e6e4c1bec43204c3b8a46fcbbff67d54b3f Mon Sep 17 00:00:00 2001 From: link2xt Date: Fri, 5 Jun 2026 19:34:08 +0200 Subject: [PATCH] feat: switch to aws-lc-rs cryptography provider for Rustls aws-lc-rs is the default provider for Rustls. We have been using ring as the default provider to avoid duplicate dependency because iroh supports only ring in 0.35.0, but with version 1.0 it will be possible to select other crypto providers and we can switch to using more common default. This change also enables "tls12" feature explicitly, otherwise if there is no other dependency requiring it, only TLS 1.3 will be supported and we want to keep supporting TLS 1.2. --- Cargo.lock | 72 ++++++++++++++++++++++++++++++++++++++++--- Cargo.toml | 2 +- src/net/tls.rs | 9 ++++-- src/net/tls/danger.rs | 8 ++--- 4 files changed, 79 insertions(+), 12 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index aa5350683..af2bec252 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -391,6 +391,28 @@ version = "1.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26" +[[package]] +name = "aws-lc-rs" +version = "1.17.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00" +dependencies = [ + "aws-lc-sys", + "zeroize", +] + +[[package]] +name = "aws-lc-sys" +version = "0.41.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4" +dependencies = [ + "cc", + "cmake", + "dunce", + "fs_extra", +] + [[package]] name = "backon" version = "1.5.0" @@ -763,10 +785,13 @@ dependencies = [ [[package]] name = "cc" -version = "1.2.14" +version = "1.2.63" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c3d1b2e905a3a7b00a6141adb0e4c0bb941d11caf55349d863942a1cc44e3c9" +checksum = "556e016178bb5662a08681bbe0f00f8e17631781a4dfc8c45e466e4b185ec27f" dependencies = [ + "find-msvc-tools", + "jobserver", + "libc", "shlex", ] @@ -920,6 +945,15 @@ dependencies = [ "digest", ] +[[package]] +name = "cmake" +version = "0.1.58" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678" +dependencies = [ + "cc", +] + [[package]] name = "cobs" version = "0.2.3" @@ -1726,6 +1760,12 @@ dependencies = [ "zeroize", ] +[[package]] +name = "dunce" +version = "1.0.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813" + [[package]] name = "dyn-clone" version = "1.0.18" @@ -2051,6 +2091,12 @@ dependencies = [ "windows-sys 0.59.0", ] +[[package]] +name = "find-msvc-tools" +version = "0.1.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582" + [[package]] name = "fixedbitset" version = "0.5.7" @@ -2108,6 +2154,12 @@ dependencies = [ name = "format-flowed" version = "1.0.0" +[[package]] +name = "fs_extra" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c" + [[package]] name = "funty" version = "2.0.0" @@ -3234,6 +3286,16 @@ version = "1.0.10" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c" +[[package]] +name = "jobserver" +version = "0.1.34" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33" +dependencies = [ + "getrandom 0.3.3", + "libc", +] + [[package]] name = "js-sys" version = "0.3.77" @@ -5228,6 +5290,7 @@ version = "0.23.37" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4" dependencies = [ + "aws-lc-rs", "log", "once_cell", "ring", @@ -5273,6 +5336,7 @@ version = "0.103.13" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" dependencies = [ + "aws-lc-rs", "ring", "rustls-pki-types", "untrusted", @@ -5695,9 +5759,9 @@ dependencies = [ [[package]] name = "shlex" -version = "1.3.0" +version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64" +checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba" [[package]] name = "signal-hook-registry" diff --git a/Cargo.toml b/Cargo.toml index 392ac463f..205907fd6 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -101,7 +101,7 @@ tagger = "4.3.4" textwrap = "0.16.2" thiserror = { workspace = true } tokio-io-timeout = "1.2.1" -tokio-rustls = { version = "0.26.2", default-features = false } +tokio-rustls = { version = "0.26.2", default-features = false, features = ["aws-lc-rs", "tls12"] } tokio-stream = { version = "0.1.17", features = ["fs"] } astral-tokio-tar = { version = "0.6.2", default-features = false } tokio-util = { workspace = true } diff --git a/src/net/tls.rs b/src/net/tls.rs index cd8629e9f..870fe1a8a 100644 --- a/src/net/tls.rs +++ b/src/net/tls.rs @@ -126,9 +126,12 @@ pub async fn wrap_rustls<'a>( let root_cert_store = rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned()); - let mut config = rustls::ClientConfig::builder() - .with_root_certificates(root_cert_store) - .with_no_client_auth(); + let mut config = rustls::ClientConfig::builder_with_provider(Arc::new( + rustls::crypto::aws_lc_rs::default_provider(), + )) + .with_safe_default_protocol_versions()? + .with_root_certificates(root_cert_store) + .with_no_client_auth(); config.alpn_protocols = if alpn.is_empty() { vec![] } else { diff --git a/src/net/tls/danger.rs b/src/net/tls/danger.rs index e757680be..809dd820d 100644 --- a/src/net/tls/danger.rs +++ b/src/net/tls/danger.rs @@ -51,7 +51,7 @@ impl rustls::client::danger::ServerCertVerifier for CustomCertificateVerifier { let spki = parsed_certificate.subject_public_key_info(); - let provider = rustls::crypto::ring::default_provider(); + let provider = rustls::crypto::aws_lc_rs::default_provider(); if let ServerName::DnsName(dns_name) = server_name && dns_name.as_ref().starts_with("_") @@ -97,7 +97,7 @@ impl rustls::client::danger::ServerCertVerifier for CustomCertificateVerifier { cert: &CertificateDer<'_>, dss: &rustls::DigitallySignedStruct, ) -> Result { - let provider = rustls::crypto::ring::default_provider(); + let provider = rustls::crypto::aws_lc_rs::default_provider(); let supported_schemes = &provider.signature_verification_algorithms; rustls::crypto::verify_tls12_signature(message, cert, dss, supported_schemes) } @@ -108,13 +108,13 @@ impl rustls::client::danger::ServerCertVerifier for CustomCertificateVerifier { cert: &CertificateDer<'_>, dss: &rustls::DigitallySignedStruct, ) -> Result { - let provider = rustls::crypto::ring::default_provider(); + let provider = rustls::crypto::aws_lc_rs::default_provider(); let supported_schemes = &provider.signature_verification_algorithms; rustls::crypto::verify_tls13_signature(message, cert, dss, supported_schemes) } fn supported_verify_schemes(&self) -> Vec { - let provider = rustls::crypto::ring::default_provider(); + let provider = rustls::crypto::aws_lc_rs::default_provider(); provider .signature_verification_algorithms .supported_schemes()