Skip to content

Commit 62c600c

Browse files
cpucpu
committed
docs: 0.15.0 CHANGELOG updates
1 parent 32adae5 commit 62c600c

File tree

1 file changed

+143
-0
lines changed

1 file changed

+143
-0
lines changed

‎CHANGELOG.md

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,148 @@
11
# Changelog
22

3+
## 0.15.0 (2025-03-25)
4+
5+
This release updates to [Rustls 0.23.25][] and increases the project minimum
6+
supported rust version (MSRV) from 1.71 to 1.74 to avoid a Rust compiler bug
7+
provoked by the ECH support in Rustls.
8+
9+
[Rustls 0.23.25]: https://github.com/rustls/rustls/releases/tag/v%2F0.23.25
10+
11+
### Added
12+
13+
* Binary releases:
14+
* Starting with the 0.15.0 release we now publish pre-built `.zip`s for:
15+
Windows (`x86_64` MSVC), Linux (`x86_64` GNU libc), and Apple (`ARM64` and
16+
`x86_64`) and a `.deb` for Debian/Ubuntu `x86_64`. These can be used to
17+
build software using `rustls-ffi` without needing `cargo`/`cargo-c`/`rustc`.
18+
19+
* Post-quantum key exchange with `X25519MLKEM768`.
20+
* Enabled by default at a low priority. See the `prefer-post-quantum` feature
21+
flag to change this behavior.
22+
23+
* New opt-in feature flags:
24+
* Optional support for making the post-quantum key exchange `X25519MLKEM768`
25+
the most-preferred key exchange by enabling the `prefer-post-quantum`
26+
feature flag. Requires the `aws-lc-rs` crypto provider.
27+
* Optional support for [RFC 8879][] certificate compression by enabling the
28+
`cert_compression` feature when building `rustls-ffi`. When enabled
29+
connections will transparently use certificate compression with Brotli or
30+
ZLib based on peer compatibility.
31+
* Optional FIPS-140-3 support using the `aws-lc-rs` provider. Enabled with the
32+
`fips` feature when building `rustls-ffi`. When enabled the `aws-lc-rs`
33+
crypto provider is used in its FIPS compatible mode. See the [Rustls
34+
project documentation][FIPS-docs] for more information on FIPS status.
35+
36+
* Encrypted Client Hello (ECH) support for client connections.
37+
* `rustls_hpke` struct for representing supported HPKE suites.
38+
* `rustls_supported_hpke()` function for returning a const pointer to
39+
a `rustls_hpke` instance if available. Only the `aws-lc-rs` backend returns
40+
a non-`NULL` value at this time.
41+
* `rustls_client_config_builder_enable_ech_grease()` client config
42+
builder function for configuring ECH GREASE using a `rustls_hpke`. This
43+
chooses a supported HPKE suite at random and is an anti-ossification
44+
measure clients may opt-in to when not performing "real" ECH.
45+
* `rustls_client_config_builder_enable_ech()` client config builder function
46+
for configuring ECH using a `rustls_hpke` and a TLS encoded ECH config list.
47+
The encoded ECH config list should be retrieved from DNS using a secure
48+
transport, such as DNS-over-HTTPS. See the `librustls/tests/client.c`
49+
example, and the `ech-fetch.rs` tool, for example usage.
50+
51+
* Additional connection information APIs:
52+
* Negotiated key exchange group, using
53+
`rustls_connection_get_negotiated_key_exchange_group()` for the IANA
54+
registered identifier, and
55+
`rustls_connection_get_negotiated_key_exchange_group_name()` for the name as
56+
a `rustls_str`.
57+
* Determining whether the handshake was a full TLS handshake, a full TLS
58+
handshake with an extra hello retry request (HRR) round-trip, a resumed TLS
59+
or a handshake, using `rustls_connection_handshake_kind()`. This returns
60+
a `rustls_handshake_kind` enum variant, which can be translated to
61+
a `rustls_str` using `rustls_handshake_kind_str()`.
62+
63+
* Support for checking whether a `rustls_certified_key`'s certificate matches
64+
the corresponding private key using `rustls_certified_key_keys_match()`.
65+
66+
* Support for queuing TLS 1.3 key updates using
67+
`rustls_connection_refresh_traffic_keys()`.
68+
69+
* Support for strict handling of CRL expiry using
70+
`rustls_web_pki_server_cert_verifier_enforce_revocation_expiry()` to customize
71+
a `rustls_web_pki_server_cert_verifier_builder` builder instance to reject
72+
CRLs with a next update in the past.
73+
74+
* Support for building `rustls-ffi` without any built in cryptography providers.
75+
This is mainly helpful for users that don't intend to use `aws-lc-rs` or
76+
`*ring*` but instead will bring their own FFI-ready `rustls_crypto_provider`.
77+
78+
* SSLKEYLOG support:
79+
* For simple logging to a file, use
80+
`rustls_server_config_builder_set_key_log_file()` or
81+
`rustls_client_config_builder_set_key_log_file()` with a client/server
82+
config builder to have the `SSLKEYLOGFILE` env var used to log an NSS
83+
formatted key log file appropriate for use with Wireshark and other tools.
84+
* For deeper integration, use `rustls_server_config_builder_set_key_log()` or
85+
`rustls_client_config_builder_set_key_log()` to configure C callbacks to be
86+
invoked to decide which secrets are logged and to do the logging.
87+
* See `librustls/tests/client.c` and `librustls/tests/server.c` for example
88+
usage.
89+
90+
* FIPS-140-3 APIs:
91+
* `rustls_default_fips_provider()` for instantiating a FIPS compatible
92+
`rustls_crypto_provider` (requires "fips" feature enabled).
93+
* `rustls_crypto_provider_fips()` for determining if a `rustls_crypto_provider`
94+
is FIPS compatible or not.
95+
* `rustls_client_config_fips()` for determining if a `rustls_client_config`
96+
was built with a FIPS compatible `rustls_crypto_provider`.
97+
* `rustls_server_config_fips()` for determining if a `rustls_server_config`
98+
was built with a FIPS compatible `rustls_crypto_provider`.
99+
* `rustls_connection_fips()` for determining if a `rustls_connection` was
100+
created from a `rustls_client_config` or `rustls_server_config` that was
101+
built with a FIPS compatible `rustls_crypto_provider`.
102+
103+
* Additional `rustls_result` error variants:
104+
* `RUSTLS_RESULT_CERT_EXPIRED_REVOCATION_LIST`,
105+
`RUSTLS_RESULT_MESSAGE_CERTIFICATE_PAYLOAD_TOO_LARGE`,
106+
`RUSTLS_RESULT_INCONSISTENT_KEYS_KEYS_MISMATCH`,
107+
`RUSTLS_RESULT_INCONSISTENT_KEYS_UNKNOWN`,
108+
`RUSTLS_RESULT_INVALID_ENCRYPTED_CLIENT_HELLO_INVALID_CONFIG_LIST`,
109+
`RUSTLS_RESULT_INVALID_ENCRYPTED_CLIENT_HELLO_NO_COMPATIBLE_CONFIG`,
110+
`RUSTLS_RESULT_INVALID_ENCRYPTED_CLIENT_HELLO_SNI_REQUIRED`.
111+
112+
[RFC 8879]: https://www.rfc-editor.org/rfc/rfc8879
113+
[FIPS-docs]: https://docs.rs/rustls/latest/rustls/manual/_06_fips/index.html
114+
115+
### Changed
116+
117+
* Calling `rustls_server_config_builder_build()` with no certificate/key
118+
configured previously returned `RUSTLS_RESULT_GENERAL`, it now returns
119+
`RUSTLS_RESULT_NO_CERT_RESOLVER`.
120+
121+
* The `rustls_server_connection_get_server_name()` function now returns
122+
a `rustls_str` instead of writing to a user provided buffer with out
123+
parameters.
124+
125+
* The `rustls_server_config_builder_set_persistence()` function is now `void`
126+
instead of returning a `rustls_error`.
127+
128+
* [cargo-c][] is now the only supported method for building `rustls-ffi`. It
129+
supports building both static and shared libraries as well as making `.pc`
130+
pkg-config files per-platform. The pre-existing GNU `Makefile` has been
131+
removed in favour of `cargo-c`. See our README for more information.
132+
133+
* Building the client/server **examples** now requires `cmake`. The GNU Makefile
134+
has been removed in favour of unifying the example build system with `cmake`.
135+
Users only interested in building `rustls-ffi` (not the example applications)
136+
do not require `cmake` unless it is a requirement of their chosen cryptography
137+
provider (e.g. `aws-lc-rs` in fips mode).
138+
139+
[cargo-c]: https://github.com/lu-zero/cargo-c
140+
141+
### Removed
142+
143+
* N/A
144+
145+
3146
## 0.14.1 (2024-11-22)
4147

5148
This release updates to [Rustls 0.23.18][] and increases the project MSRV from

0 commit comments

Comments
 (0)