aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/s2n/bindings/rust/bench/benches/throughput.rs

@@ -6,8 +6,8 @@ use bench::OpenSslConnection;
 #[cfg(feature = "rustls")]
 use bench::RustlsConnection;
 use bench::{
-    CipherSuite, ConnectedBuffer, CryptoConfig, HandshakeType, KXGroup, Mode, S2NConnection,
-    SigType, TlsConnPair, TlsConnection, PROFILER_FREQUENCY,
+    harness::TlsBenchConfig, CipherSuite, ConnectedBuffer, CryptoConfig, HandshakeType, KXGroup,
+    Mode, S2NConnection, SigType, TlsConnPair, TlsConnection, PROFILER_FREQUENCY,
 };
 use criterion::{
     criterion_group, criterion_main, measurement::WallTime, BatchSize, BenchmarkGroup, Criterion,
@@ -17,14 +17,17 @@ use pprof::criterion::{Output, PProfProfiler};
 use std::error::Error;
 use strum::IntoEnumIterator;
 
-fn bench_throughput_for_library<T: TlsConnection>(
+fn bench_throughput_for_library<T>(
     bench_group: &mut BenchmarkGroup<WallTime>,
     shared_buf: &mut [u8],
     cipher_suite: CipherSuite,
-) {
+) where
+    T: TlsConnection,
+    T::Config: TlsBenchConfig,
+{
     let crypto_config = CryptoConfig::new(cipher_suite, KXGroup::default(), SigType::default());
-    let client_config = T::make_config(Mode::Client, crypto_config, HandshakeType::default());
-    let server_config = T::make_config(Mode::Server, crypto_config, HandshakeType::default());
+    let client_config = T::Config::make_config(Mode::Client, crypto_config, HandshakeType::default());
+    let server_config = T::Config::make_config(Mode::Server, crypto_config, HandshakeType::default());
 
     bench_group.bench_function(T::name(), |b| {
         b.iter_batched_ref(

data/aws-crt-ffi/crt/s2n/bindings/rust/bench/src/harness.rs

@@ -140,6 +140,17 @@ impl CryptoConfig {
     }
 }
 
+/// The TlsBenchConfig trait allows us to map benchmarking parameters to
+/// a configuration object
+pub trait TlsBenchConfig: Sized {
+    fn make_config(
+        mode: Mode,
+        crypto_config: CryptoConfig,
+        handshake_type: HandshakeType,
+    ) -> Result<Self, Box<dyn Error>>;
+}
+
+/// The TlsConnection object can be created from a corresponding config type.
 pub trait TlsConnection: Sized {
     /// Library-specific config struct
     type Config;
@@ -147,42 +158,12 @@ pub trait TlsConnection: Sized {
     /// Name of the connection type
     fn name() -> String;
 
-    /// Default connection (client or server)
-    fn default(mode: Mode) -> Result<Self, Box<dyn Error>> {
-        Self::new(
-            mode,
-            CryptoConfig::default(),
-            HandshakeType::default(),
-            ConnectedBuffer::default(),
-        )
-    }
-
-    /// Make a config with given parameters
-    fn make_config(
-        mode: Mode,
-        crypto_config: CryptoConfig,
-        handshake_type: HandshakeType,
-    ) -> Result<Self::Config, Box<dyn Error>>;
-
     /// Make connection from existing config and buffer
     fn new_from_config(
         config: &Self::Config,
         connected_buffer: ConnectedBuffer,
     ) -> Result<Self, Box<dyn Error>>;
 
-    /// Initialize buffers, configs, and connections (pre-handshake)
-    fn new(
-        mode: Mode,
-        crypto_config: CryptoConfig,
-        handshake_type: HandshakeType,
-        buffer: ConnectedBuffer,
-    ) -> Result<Self, Box<dyn Error>> {
-        Self::new_from_config(
-            &Self::make_config(mode, crypto_config, handshake_type)?,
-            buffer,
-        )
-    }
-
     /// Run one handshake step: receive msgs from other connection, process, and send new msgs
     fn handshake(&mut self) -> Result<(), Box<dyn Error>>;
 
@@ -217,49 +198,49 @@ pub struct TlsConnPair<C: TlsConnection, S: TlsConnection> {
     server: S,
 }
 
-impl<C: TlsConnection, S: TlsConnection> Default for TlsConnPair<C, S> {
-    fn default() -> Self {
-        Self::new(
-            CryptoConfig::default(),
-            HandshakeType::default(),
-            ConnectedBuffer::default(),
-        )
-        .unwrap()
-    }
-}
-
 impl<C: TlsConnection, S: TlsConnection> TlsConnPair<C, S> {
-    /// Wrap two TlsConnections into a TlsConnPair
-    pub fn wrap(client: C, server: S) -> Self {
-        assert!(
-            client.connected_buffer() == &server.connected_buffer().clone_inverse(),
-            "connected buffers don't match"
-        );
+    pub fn new(client_config: &C::Config, server_config: &S::Config) -> TlsConnPair<C, S> {
+        let connected_buffer = ConnectedBuffer::default();
+        let client = C::new_from_config(&client_config, connected_buffer.clone_inverse()).unwrap();
+        let server = S::new_from_config(&server_config, connected_buffer).unwrap();
         Self { client, server }
     }
+}
 
-    /// Take back ownership of individual connections in the TlsConnPair
-    pub fn split(self) -> (C, S) {
-        (self.client, self.server)
+impl<C, S> Default for TlsConnPair<C, S>
+where
+    C: TlsConnection,
+    S: TlsConnection,
+    C::Config: TlsBenchConfig,
+    S::Config: TlsBenchConfig,
+{
+    fn default() -> Self {
+        Self::new_bench_pair(CryptoConfig::default(), HandshakeType::default()).unwrap()
     }
+}
 
+impl<C, S> TlsConnPair<C, S>
+where
+    C: TlsConnection,
+    S: TlsConnection,
+    C::Config: TlsBenchConfig,
+    S::Config: TlsBenchConfig,
+{
     /// Initialize buffers, configs, and connections (pre-handshake)
-    pub fn new(
+    pub fn new_bench_pair(
         crypto_config: CryptoConfig,
         handshake_type: HandshakeType,
-        connected_buffer: ConnectedBuffer,
     ) -> Result<Self, Box<dyn Error>> {
         // do an initial handshake to generate the session ticket
         if handshake_type == HandshakeType::Resumption {
-            let server_config = S::make_config(Mode::Server, crypto_config, handshake_type)?;
-            let client_config = C::make_config(Mode::Client, crypto_config, handshake_type)?;
+            let server_config =
+                S::Config::make_config(Mode::Server, crypto_config, handshake_type)?;
+            let client_config =
+                C::Config::make_config(Mode::Client, crypto_config, handshake_type)?;
 
             // handshake the client and server connections. This will result in
             // session ticket getting stored in client_config
-            let buffer = ConnectedBuffer::default();
-            let client = C::new_from_config(&client_config, buffer.clone_inverse())?;
-            let server = S::new_from_config(&server_config, buffer)?;
-            let mut pair = TlsConnPair { client, server };
+            let mut pair = TlsConnPair::<C, S>::new(&client_config, &server_config);
             pair.handshake()?;
             // NewSessionTicket messages are part of the application data and sent
             // after the handshake is complete, so we must trigger an additional
@@ -267,30 +248,38 @@ impl<C: TlsConnection, S: TlsConnection> TlsConnPair<C, S> {
             // gets received and stored in the config
             pair.round_trip_transfer(&mut [0]).unwrap();
 
-            // new_from_config will check if a session ticket is available,
-            // and set it on the connection. This results in the session ticket
-            // in client_config (from the previous handshake) getting set on
-            // the client connection.
-            let client = C::new_from_config(&client_config, connected_buffer.clone_inverse())?;
-            let server = S::new_from_config(&server_config, connected_buffer)?;
-
-            return Ok(Self { client, server });
+            // new_from_config is called interally by the TlsConnPair::new
+            // method and will check if a session ticket is available and set it
+            // on the connection. This results in the session ticket in
+            // client_config (from the previous handshake) getting set on the
+            // client connection.
+            return Ok(TlsConnPair::<C, S>::new(&client_config, &server_config));
         }
 
-        Ok(Self {
-            client: C::new(
-                Mode::Client,
-                crypto_config,
-                handshake_type,
-                connected_buffer.clone_inverse(),
-            )?,
-            server: S::new(
-                Mode::Server,
-                crypto_config,
-                handshake_type,
-                connected_buffer,
-            )?,
-        })
+        Ok(TlsConnPair::<C, S>::new(
+            &C::Config::make_config(Mode::Client, crypto_config, handshake_type).unwrap(),
+            &S::Config::make_config(Mode::Server, crypto_config, handshake_type).unwrap(),
+        ))
+    }
+}
+
+impl<C, S> TlsConnPair<C, S>
+where
+    C: TlsConnection,
+    S: TlsConnection,
+{
+    /// Wrap two TlsConnections into a TlsConnPair
+    pub fn wrap(client: C, server: S) -> Self {
+        assert!(
+            client.connected_buffer() == &server.connected_buffer().clone_inverse(),
+            "connected buffers don't match"
+        );
+        Self { client, server }
+    }
+
+    /// Take back ownership of individual connections in the TlsConnPair
+    pub fn split(self) -> (C, S) {
+        (self.client, self.server)
     }
 
     /// Run handshake on connections
@@ -454,24 +443,33 @@ mod tests {
         test_type::<OpenSslConnection, OpenSslConnection>();
     }
 
-    fn test_type<C: TlsConnection, S: TlsConnection>() {
+    fn test_type<C, S>()
+    where
+        S: TlsConnection,
+        C: TlsConnection,
+        C::Config: TlsBenchConfig,
+        S::Config: TlsBenchConfig,
+    {
         println!("{} client --- {} server", C::name(), S::name());
         handshake_configs::<C, S>();
         transfer::<C, S>();
     }
 
-    fn handshake_configs<C: TlsConnection, S: TlsConnection>() {
+    fn handshake_configs<C, S>()
+    where
+        S: TlsConnection,
+        C: TlsConnection,
+        C::Config: TlsBenchConfig,
+        S::Config: TlsBenchConfig,
+    {
         for handshake_type in HandshakeType::iter() {
             for cipher_suite in CipherSuite::iter() {
                 for kx_group in KXGroup::iter() {
                     for sig_type in SigType::iter() {
                         let crypto_config = CryptoConfig::new(cipher_suite, kx_group, sig_type);
-                        let mut conn_pair = TlsConnPair::<C, S>::new(
-                            crypto_config,
-                            handshake_type,
-                            ConnectedBuffer::default(),
-                        )
-                        .unwrap();
+                        let mut conn_pair =
+                            TlsConnPair::<C, S>::new_bench_pair(crypto_config, handshake_type)
+                                .unwrap();
 
                         assert!(!conn_pair.handshake_completed());
                         conn_pair.handshake().unwrap();
@@ -485,14 +483,17 @@ mod tests {
         }
     }
 
-    fn session_resumption<C: TlsConnection, S: TlsConnection>() {
+    fn session_resumption<C, S>()
+    where
+        S: TlsConnection,
+        C: TlsConnection,
+        C::Config: TlsBenchConfig,
+        S::Config: TlsBenchConfig,
+    {
         println!("testing with client:{} server:{}", C::name(), S::name());
-        let mut conn_pair = TlsConnPair::<C, S>::new(
-            CryptoConfig::default(),
-            HandshakeType::Resumption,
-            ConnectedBuffer::default(),
-        )
-        .unwrap();
+        let mut conn_pair =
+            TlsConnPair::<C, S>::new_bench_pair(CryptoConfig::default(), HandshakeType::Resumption)
+                .unwrap();
         conn_pair.handshake().unwrap();
         let (_, server) = conn_pair.split();
         assert!(server.resumed_connection());
@@ -518,18 +519,21 @@ mod tests {
         session_resumption::<OpenSslConnection, RustlsConnection>();
     }
 
-    fn transfer<C: TlsConnection, S: TlsConnection>() {
+    fn transfer<C, S>()
+    where
+        S: TlsConnection,
+        C: TlsConnection,
+        C::Config: TlsBenchConfig,
+        S::Config: TlsBenchConfig,
+    {
         // use a large buffer to test across TLS record boundaries
         let mut buf = [0x56u8; 1000000];
         for cipher_suite in CipherSuite::iter() {
             let crypto_config =
                 CryptoConfig::new(cipher_suite, KXGroup::default(), SigType::default());
-            let mut conn_pair = TlsConnPair::<C, S>::new(
-                crypto_config,
-                HandshakeType::default(),
-                ConnectedBuffer::default(),
-            )
-            .unwrap();
+            let mut conn_pair =
+                TlsConnPair::<C, S>::new_bench_pair(crypto_config, HandshakeType::default())
+                    .unwrap();
             conn_pair.handshake().unwrap();
             conn_pair.round_trip_transfer(&mut buf).unwrap();
         }

data/aws-crt-ffi/crt/s2n/bindings/rust/bench/src/openssl.rs

@@ -4,7 +4,7 @@
 use crate::{
     get_cert_path,
     harness::{
-        CipherSuite, ConnectedBuffer, CryptoConfig, HandshakeType, KXGroup, Mode, TlsConnection,
+        CipherSuite, ConnectedBuffer, CryptoConfig, HandshakeType, KXGroup, Mode, TlsConnection, TlsBenchConfig,
     },
     PemType::*,
 };
@@ -42,29 +42,13 @@ pub struct OpenSslConfig {
     session_ticket_storage: SessionTicketStorage,
 }
 
-impl TlsConnection for OpenSslConnection {
-    type Config = OpenSslConfig;
-
-    fn name() -> String {
-        let version_num = openssl::version::number() as u64;
-        let patch: u8 = (version_num >> 4) as u8;
-        let fix = (version_num >> 12) as u8;
-        let minor = (version_num >> 20) as u8;
-        let major = (version_num >> 28) as u8;
-        format!(
-            "openssl{}.{}.{}{}",
-            major,
-            minor,
-            fix,
-            (b'a' + patch - 1) as char
-        )
-    }
+impl TlsBenchConfig for OpenSslConfig {
 
     fn make_config(
         mode: Mode,
         crypto_config: CryptoConfig,
         handshake_type: HandshakeType,
-    ) -> Result<Self::Config, Box<dyn Error>> {
+    ) -> Result<Self, Box<dyn Error>> {
         let cipher_suite = match crypto_config.cipher_suite {
             CipherSuite::AES_128_GCM_SHA256 => "TLS_AES_128_GCM_SHA256",
             CipherSuite::AES_256_GCM_SHA384 => "TLS_AES_256_GCM_SHA384",
@@ -139,11 +123,31 @@ impl TlsConnection for OpenSslConnection {
                 }
             }
         }
-        Ok(Self::Config {
+        Ok(Self {
             config: builder.build(),
             session_ticket_storage,
         })
     }
+}
+
+impl TlsConnection for OpenSslConnection {
+    type Config = OpenSslConfig;
+
+    fn name() -> String {
+        let version_num = openssl::version::number() as u64;
+        let patch: u8 = (version_num >> 4) as u8;
+        let fix = (version_num >> 12) as u8;
+        let minor = (version_num >> 20) as u8;
+        let major = (version_num >> 28) as u8;
+        format!(
+            "openssl{}.{}.{}{}",
+            major,
+            minor,
+            fix,
+            (b'a' + patch - 1) as char
+        )
+    }
+
 
     fn new_from_config(
         config: &Self::Config,

data/aws-crt-ffi/crt/s2n/bindings/rust/bench/src/rustls.rs

@@ -4,7 +4,7 @@
 use crate::{
     harness::{
         read_to_bytes, CipherSuite, ConnectedBuffer, CryptoConfig, HandshakeType, KXGroup, Mode,
-        TlsConnection,
+        TlsConnection, TlsBenchConfig,
     },
     PemType::{self, *},
     SigType,
@@ -31,6 +31,23 @@ pub struct RustlsConnection {
 }
 
 impl RustlsConnection {
+    pub fn connection(&self) -> &Connection {
+        &self.connection
+    }
+
+        /// Treat `WouldBlock` as an `Ok` value for when blocking is expected
+        fn ignore_block<T: Default>(res: Result<T, std::io::Error>) -> Result<T, std::io::Error> {
+            match res {
+                Ok(t) => Ok(t),
+                Err(err) => match err.kind() {
+                    std::io::ErrorKind::WouldBlock => Ok(T::default()),
+                    _ => Err(err),
+                },
+            }
+        }
+}
+
+impl RustlsConfig {
     fn get_root_cert_store(sig_type: SigType) -> Result<RootCertStore, Box<dyn Error>> {
         let root_cert =
             Certificate(certs(&mut BufReader::new(&*read_to_bytes(CACert, sig_type)))?.remove(0));
@@ -55,21 +72,6 @@ impl RustlsConnection {
             pkcs8_private_keys(&mut BufReader::new(&*read_to_bytes(pem_type, sig_type)))?.remove(0),
         ))
     }
-
-    /// Treat `WouldBlock` as an `Ok` value for when blocking is expected
-    fn ignore_block<T: Default>(res: Result<T, std::io::Error>) -> Result<T, std::io::Error> {
-        match res {
-            Ok(t) => Ok(t),
-            Err(err) => match err.kind() {
-                std::io::ErrorKind::WouldBlock => Ok(T::default()),
-                _ => Err(err),
-            },
-        }
-    }
-
-    pub fn connection(&self) -> &Connection {
-        &self.connection
-    }
 }
 
 /// Clients and servers have different config types in Rustls, so wrap them in an enum
@@ -78,18 +80,12 @@ pub enum RustlsConfig {
     Server(Arc<ServerConfig>),
 }
 
-impl TlsConnection for RustlsConnection {
-    type Config = RustlsConfig;
-
-    fn name() -> String {
-        "rustls".to_string()
-    }
-
+impl TlsBenchConfig for RustlsConfig {
     fn make_config(
         mode: Mode,
         crypto_config: CryptoConfig,
         handshake_type: HandshakeType,
-    ) -> Result<Self::Config, Box<dyn Error>> {
+    ) -> Result<Self, Box<dyn Error>> {
         let cipher_suite = match crypto_config.cipher_suite {
             CipherSuite::AES_128_GCM_SHA256 => TLS13_AES_128_GCM_SHA256,
             CipherSuite::AES_256_GCM_SHA384 => TLS13_AES_256_GCM_SHA384,
@@ -150,6 +146,14 @@ impl TlsConnection for RustlsConnection {
             }
         }
     }
+}
+
+impl TlsConnection for RustlsConnection {
+    type Config = RustlsConfig;
+
+    fn name() -> String {
+        "rustls".to_string()
+    }
 
     fn new_from_config(
         config: &Self::Config,

data/aws-crt-ffi/crt/s2n/bindings/rust/bench/src/s2n_tls.rs

@@ -63,60 +63,12 @@ pub struct S2NConfig {
     ticket_storage: SessionTicketStorage,
 }
 
-pub struct S2NConnection {
-    // Pin<Box<T>> is to ensure long-term *mut to IO buffers remains valid
-    connected_buffer: Pin<Box<ConnectedBuffer>>,
-    connection: Connection,
-    handshake_completed: bool,
-}
-
-impl S2NConnection {
-    /// Unsafe callback for custom IO C API
-    ///
-    /// s2n-tls IO is usually used with file descriptors to a TCP socket, but we
-    /// reduce overhead and outside noise with a local buffer for benchmarking
-    unsafe extern "C" fn send_cb(context: *mut c_void, data: *const u8, len: u32) -> c_int {
-        let context = &mut *(context as *mut ConnectedBuffer);
-        let data = core::slice::from_raw_parts(data, len as _);
-        context.write(data).unwrap() as _
-    }
-
-    /// Unsafe callback for custom IO C API
-    unsafe extern "C" fn recv_cb(context: *mut c_void, data: *mut u8, len: u32) -> c_int {
-        let context = &mut *(context as *mut ConnectedBuffer);
-        let data = core::slice::from_raw_parts_mut(data, len as _);
-        context.flush().unwrap();
-        match context.read(data) {
-            Err(err) => {
-                // s2n-tls requires the callback to set errno if blocking happens
-                if let ErrorKind::WouldBlock = err.kind() {
-                    errno::set_errno(errno::Errno(libc::EWOULDBLOCK));
-                    -1
-                } else {
-                    panic!("{err:?}");
-                }
-            }
-            Ok(len) => len as _,
-        }
-    }
-
-    pub fn connection(&self) -> &Connection {
-        &self.connection
-    }
-}
-
-impl TlsConnection for S2NConnection {
-    type Config = S2NConfig;
-
-    fn name() -> String {
-        "s2n-tls".to_string()
-    }
-
+impl crate::harness::TlsBenchConfig for S2NConfig {
     fn make_config(
         mode: Mode,
         crypto_config: CryptoConfig,
         handshake_type: HandshakeType,
-    ) -> Result<Self::Config, Box<dyn Error>> {
+    ) -> Result<Self, Box<dyn Error>> {
         // these security policies negotiate the given cipher suite and key
         // exchange group as their top choice
         let security_policy = match (crypto_config.cipher_suite, crypto_config.kx_group) {
@@ -198,6 +150,56 @@ impl TlsConnection for S2NConnection {
             ticket_storage: session_ticket_storage,
         })
     }
+}
+
+pub struct S2NConnection {
+    // Pin<Box<T>> is to ensure long-term *mut to IO buffers remains valid
+    connected_buffer: Pin<Box<ConnectedBuffer>>,
+    connection: Connection,
+    handshake_completed: bool,
+}
+
+impl S2NConnection {
+    /// Unsafe callback for custom IO C API
+    ///
+    /// s2n-tls IO is usually used with file descriptors to a TCP socket, but we
+    /// reduce overhead and outside noise with a local buffer for benchmarking
+    unsafe extern "C" fn send_cb(context: *mut c_void, data: *const u8, len: u32) -> c_int {
+        let context = &mut *(context as *mut ConnectedBuffer);
+        let data = core::slice::from_raw_parts(data, len as _);
+        context.write(data).unwrap() as _
+    }
+
+    /// Unsafe callback for custom IO C API
+    unsafe extern "C" fn recv_cb(context: *mut c_void, data: *mut u8, len: u32) -> c_int {
+        let context = &mut *(context as *mut ConnectedBuffer);
+        let data = core::slice::from_raw_parts_mut(data, len as _);
+        context.flush().unwrap();
+        match context.read(data) {
+            Err(err) => {
+                // s2n-tls requires the callback to set errno if blocking happens
+                if let ErrorKind::WouldBlock = err.kind() {
+                    errno::set_errno(errno::Errno(libc::EWOULDBLOCK));
+                    -1
+                } else {
+                    panic!("{err:?}");
+                }
+            }
+            Ok(len) => len as _,
+        }
+    }
+
+    pub fn connection(&self) -> &Connection {
+        &self.connection
+    }
+}
+
+impl TlsConnection for S2NConnection {
+    type Config = S2NConfig;
+
+    fn name() -> String {
+        "s2n-tls".to_string()
+    }
 
     fn new_from_config(
         config: &Self::Config,

data/aws-crt-ffi/crt/s2n/bindings/rust/generate/Cargo.toml

@@ -10,3 +10,4 @@ publish = false
 [dependencies]
 bindgen = "0.65"
 glob = "0.3"
+regex = "=1.9.6" # newer versions require rust 1.65, see https://github.com/aws/s2n-tls/issues/4242

data/aws-crt-ffi/crt/s2n/bindings/rust/integration/Cargo.toml

@@ -22,3 +22,6 @@ harness = false
 [[bench]]
 name = "s2nd"
 harness = false
+
+[dev-dependencies]
+regex = "=1.9.6" # newer versions require rust 1.65, see https://github.com/aws/s2n-tls/issues/4242

data/aws-crt-ffi/crt/s2n/bindings/rust/s2n-tls/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "s2n-tls"
 description = "A C99 implementation of the TLS/SSL protocols"
-version = "0.0.38"
+version = "0.0.40"
 authors = ["AWS s2n"]
 edition = "2021"
 rust-version = "1.63.0"
@@ -19,7 +19,7 @@ testing = ["bytes"]
 bytes = { version = "1", optional = true }
 errno = { version = "0.3" }
 libc = "0.2"
-s2n-tls-sys = { version = "=0.0.38", path = "../s2n-tls-sys", features = ["internal"] }
+s2n-tls-sys = { version = "=0.0.40", path = "../s2n-tls-sys", features = ["internal"] }
 pin-project-lite = "0.2"
 hex = "0.4"
 

data/aws-crt-ffi/crt/s2n/bindings/rust/s2n-tls/src/connection.rs

@@ -901,6 +901,15 @@ impl Connection {
             .into_result()?;
         Ok(self)
     }
+
+    pub fn quic_process_post_handshake_message(&mut self) -> Result<&mut Self, Error> {
+        let mut blocked = s2n_blocked_status::NOT_BLOCKED;
+        unsafe {
+            s2n_recv_quic_post_handshake_message(self.connection.as_ptr(), &mut blocked)
+                .into_result()
+        }?;
+        Ok(self)
+    }
 }
 
 impl AsRef<Connection> for Connection {

data/aws-crt-ffi/crt/s2n/bindings/rust/s2n-tls-sys/templates/Cargo.template

@@ -1,7 +1,7 @@
 [package]
 name = "s2n-tls-sys"
 description = "A C99 implementation of the TLS/SSL protocols"
-version = "0.0.38"
+version = "0.0.40"
 authors = ["AWS s2n"]
 edition = "2021"
 rust-version = "1.63.0"
@@ -43,6 +43,7 @@ cc = { version = "1.0", features = ["parallel"] }
 cmake = { version = "0.1", optional = true }
 
 [dev-dependencies]
+jobserver = "=0.1.26" # newer versions require rust 1.66, see https://github.com/aws/s2n-tls/issues/4241
 # Build the vendored version to make it easy to test in dev
 #
 # NOTE: The version of the `openssl-sys` crate is not the same as OpenSSL itself.