Skip to content

feat(s2n-quic): allow s2n-quic to use s2n-tls on Windows with MinGW - #3153

Merged
boquan-fang merged 9 commits into
aws:mainfrom
boquan-fang:boquan-fang/s2n-tls-integration
Aug 4, 2026
Merged

feat(s2n-quic): allow s2n-quic to use s2n-tls on Windows with MinGW#3153
boquan-fang merged 9 commits into
aws:mainfrom
boquan-fang:boquan-fang/s2n-tls-integration

Conversation

@boquan-fang

@boquan-fang boquan-fang commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Release Summary:

Allow s2n-quic to build and tests with s2n-tls on Windows as its TLS backend. s2n-quic running on Windows GNU/MinGW toolchain to use s2n-tls as its backend TLS provider by default.

Resolved issues:

related to aws/s2n-tls#4018

Description of changes:

s2n-tls v0.3.40 allows s2n-tls to work on Windows with MinGW toolchain. This PR allows s2n-quic to use s2n-tls as its TLS backend with MinGW toolchain.

The user use provider-tls-s2n and provider-tls-rustls to override TLS backend with either s2n-tls or rustls. If those features are not enabled, then Rustls is the default TLS backend for Windows and s2n-tls is default for Unix and Linux. See changes in https://github.com/aws/s2n-quic/pull/3153/changes#diff-6b8d5705ae18f0ed58dd7a327da48d641287fbc8739baeabb146f734d1e6b16a for details.

New build.rs + s2n_tls_provider / boringssl cfgs. This PR adds a build script to s2n-quic-tests that evaluates the target once and emits two named cfgs describing which optional dependency is available rather than which platform we're on. s2n_tls_provider replaces the any(unix, all(target_os = "windows", target_env = "gnu")) predicate that had been copy-pasted across 10 sites, and boringssl replaces the quiche gate not(all(target_os = "windows", not(target_env = "msvc"))). The gates now read as intent ("this test needs s2n-tls") instead of a platform matrix, and there's a single source of truth to update if the support surface ever changes. The build script also registers both names via cargo::rustc-check-cfg so the unexpected_cfgs lint stays quiet under -D warnings.

Call-outs:

  1. After this PR is merged in, I will need to update the doc of s2n-quic to indicate that it can work with s2n-tls on Windows.
  2. I excludes dc crate from this PR.
  3. I will make s2n-quic running on Windows GNU/MinGW toolchain to use s2n-tls as its backend TLS provider by default.
    The default TLS provider:
Platform Default TLS Provider
Unix and Linux s2n-tls
Windows with MinGW toolchian s2n-tls
Windows with MSVC Rustls

Testing:

I added a new job in ci.yml to run all tests for MinGW Windows: https://github.com/aws/s2n-quic/actions/runs/29284288996/job/86932902570?pr=3153.

The CI set up is very similar to the one that I added for s2n-tls: https://github.com/aws/s2n-tls/blob/main/.github/workflows/ci_windows.yml.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@boquan-fang
boquan-fang force-pushed the boquan-fang/s2n-tls-integration branch 2 times, most recently from e058981 to 8043cb9 Compare July 13, 2026 20:38
@boquan-fang
boquan-fang force-pushed the boquan-fang/s2n-tls-integration branch from 8043cb9 to d1be919 Compare July 13, 2026 20:54
@boquan-fang
boquan-fang marked this pull request as ready for review July 13, 2026 20:56
@boquan-fang
boquan-fang requested a review from a team as a code owner July 13, 2026 20:56
@boquan-fang
boquan-fang force-pushed the boquan-fang/s2n-tls-integration branch from f8da821 to 7fe6cc3 Compare July 14, 2026 18:01
@maddeleine

maddeleine commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Do we have a user who we think will pick up this feature? I'm glad to know this works, but I'm just not really sure what the usecase is here. Is there someone right now who is waiting to s2n-quic with s2n-tls as a backend on mingw? This wasn't in the original issue(aws/s2n-tls#4018) so I'm not sure why we're pushing for it.

@boquan-fang
boquan-fang requested review from WesleyRosenblum and removed request for maddeleine July 17, 2026 17:37
@WesleyRosenblum

Copy link
Copy Markdown
Contributor

Can you check the existing provider-tls-s2n feature, I believe the intension of that was to allow for overriding the TLS implementation used, versus using the default (which is provider-tls-default, turned on by default)

@boquan-fang
boquan-fang force-pushed the boquan-fang/s2n-tls-integration branch 3 times, most recently from fc558df to bd58e6b Compare July 20, 2026 22:04
@boquan-fang

Copy link
Copy Markdown
Contributor Author

@WesleyRosenblum Yes, we should reuse the existing provider-tls-s2n and provider-tls-rustls flag for users to set their TLS backend. With this code change, the s2n-tls will be used regardless if the user import s2n-tls with the provider-tls-s2n feature. If they don't specify any features, then Rustls will be used by default for Windows users and s2n-tls will be used by Linux users. Replying to #3153 (comment).

Comment thread quic/s2n-quic/src/provider/tls.rs Outdated
Comment thread quic/s2n-quic/src/provider/tls.rs Outdated
Comment thread quic/s2n-quic/src/lib.rs Outdated
Comment thread .github/workflows/ci.yml Outdated
Comment thread .github/workflows/ci.yml
Comment thread quic/s2n-quic-tests/src/tests/buffer_limit.rs
Comment thread quic/s2n-quic-tests/src/lib.rs Outdated
Comment thread quic/s2n-quic-tests/src/tests/offload.rs Outdated
* reuse existing feature provider-tls-s2n
* temp disable provider-tls-default
* exclude crates that depends on s2n-quic
* revert changes for tls::default
@boquan-fang
boquan-fang force-pushed the boquan-fang/s2n-tls-integration branch from bd58e6b to ee7eb33 Compare July 21, 2026 22:48
@boquan-fang
boquan-fang force-pushed the boquan-fang/s2n-tls-integration branch from 06faacf to 2d8b5cc Compare July 30, 2026 22:27
Comment thread .github/workflows/ci.yml Outdated
Comment thread quic/s2n-quic-tests/src/tests/dc.rs Outdated
Comment thread quic/s2n-quic-tests/src/tests/offload.rs Outdated
Comment thread quic/s2n-quic-tests/src/lib.rs Outdated
* explicitly set stable
* add comments to specify why we need explicitly use tls
@boquan-fang

Copy link
Copy Markdown
Contributor Author

I will make s2n-quic running on Windows GNU/MinGW toolchain to use s2n-tls as its backend TLS provider by default.

@boquan-fang
boquan-fang force-pushed the boquan-fang/s2n-tls-integration branch from 9767f83 to fb48970 Compare August 4, 2026 17:44
@boquan-fang
boquan-fang merged commit ba34a2a into aws:main Aug 4, 2026
141 of 173 checks passed
@boquan-fang
boquan-fang deleted the boquan-fang/s2n-tls-integration branch August 4, 2026 22:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants