v1.7.11

Release Summary

• s2n-tls users can now select 39 additional ELB and KMS TLS security policies by name
• s2n-tls Rust bindings now support an asynchronous certificate validation callback.
• s2n-tls-metrics-subscriber reports durations as sum + count, rather than just sum
• Lock-free send and receive added to Rust bindings

What's Changed

• feat(policy): Add ELB, KMS, and service TLS security policies by @alexw91 in #5977
• chore: add simonmarty to the team by @simonmarty in #6089
• fix: cleanup dhparams in failure case by @jmayclin in #6085
• feat(bindings): deprecate & alias Connection::wipe by @jmayclin in #6033
• fix: relax https test to accept all status codes by @jmayclin in #6091
• feat(metrics): skip export when record is zero by @jmayclin in #6087
• feat(bindings): add async cert validation callback by @CarolYeh910 in #6071
• fix: cleanup kms-tls-auth crate by @maddeleine in #6094
• build(deps): update brass-aphid-wire crates by @jmayclin in #6090
• fix: Ensure that TLS1.3 ticket is not accepted on TLS1.2 codepath by @maddeleine in #6081
• feat: Preserve count in handshake/compute duration by @Mark-Simulacrum in #6069
• build(deps): bump the all-gha-updates group across 1 directory with 2 updates by @dependabot[bot] in #6079
• fix: remove unused variable to fix Clang build with Werror by @Octogonapus in #6093
• style: order tls 1.3 cipher suites first by @jmayclin in #6092
• chore(bindings): Address 2 Rustsec advisories by @simonmarty in #6095
• chore: Update gh cli PGP key by @simonmarty in #6102
• chore: bindings bump v.0.3.44 by @maddeleine in #6099
• fix: report Finished and PSK binder mismatches as decrypt_error by @kreed in #6104
• feat: Adds split API on the Rust bindings Connection by @maddeleine in #5774
• fix: disable TLS1.3 resumption when client auth is required by @CarolYeh910 in #6103
• build(cmake): add opt-in discovery for a distribution-packaged AWS-LC by @kaukabrizvi in #6108
• ci: pin macOS CI to openssl@3 to fix OpenSSL 4 build break by @CarolYeh910 in #6113
• revert: new AMI for the kTLS fleet was published with updated PGP key for the github CLI. by @simonmarty in #6109
• fix: re-enable TLS_RSA cipher suites in the Java integration test client by @kaukabrizvi in #6114
• build(deps): bump the all-gha-updates group across 1 directory with 2 updates by @dependabot[bot] in #6098
• feat(rust-examples): add mutual TLS example by @abidedavana in #5995
• fix: prevent trust store switch when s2n_connection_set_config fails by @CarolYeh910 in #6105
• feat: add OpenSSL 4.0 compatibility by @kaukabrizvi in #6111

New Contributors

• @simonmarty made their first contribution in #6089
• @Octogonapus made their first contribution in #6093
• @kreed made their first contribution in #6104
• @abidedavana made their first contribution in #5995

Full Changelog: v1.7.10...v1.7.11