Migrate to rustls

[howardjohn]

This PR moves from usage of boring as a crypto library and TLS library, to using rustls. Rustls is the standard TLS library in the rust ecosystem.

Rustls offers a pluggable crypto interface. There are ~3 providers (2 in core, 1 external): ring, aws_lc_rs, and boring. The latter two provider FIPS certified builds (though I think aws_lc only has in progress builds); ring has no FIPS certified builds though I think they are working towards one. In this model, the TLS aspects (which are a large portion of the code involved) are handled purely by rustls's code, written in safe rust. Just the crypto primitives are offloaded to these various libraries (which are all ultimately varying degrees of openssl forks, as I understand it).

This offers a few benefits:

• For vendors, the ability to plug in alternative crypto modules
• Better performance (~10% improvement)
• Standardize with rest of rust ecosystem. Ever library integrates with rustls; we need to make our own shims for everything today like tonic, etc

Fixes #797
Fixes #641
Helps with #149
Fixes #110

[istio-testing]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[bleggett]

Suggested change

	BORING_BSSL_FIPS_PATH = { value = "vendor/boringssl-fips/linux_x86_64", force = true, relative = true }
	BORING_BSSL_FIPS_PATH = { value = "vendor/boringssl-fips/linux_x86_64", force = true, relative = true }

Does this also fix: #399 ?

I haven't checked, but one of the minor annoyances before was we couldn't conditionally set this variable in build.rs per-arch/platform, because boring-sys was doing stuff in its own build.rs that both

A) didn't work with vendoring
B) defeated cargo's "recompute" logic making it impossible to override in our build.rs

which means the build has to sed this for multiarch builds, and those of us on linux_arm64 have to locally munge this file constantly.

[howardjohn]

I don't think so unless you buid with ring instead of boring which sidesteps the issue

[howardjohn]

Oh I forgot a bit part of this - I am proposing we default Istio builds to ring as well.. that decision can be decoupled from the broader PR though

[ilrudie]

Big plus 1 for moving to rustls!

[bleggett]

Seems happy building locally with both FIPS and non-FIPS variants on arm64 (with the vendored lib move mentioned in comments).

[hzxuzhonghu]

Will this repo actively maintained, and who takes charge

[howardjohn]

I am working to get this actively maintained (TBD by who). Note this is an off by default feature; the default Istio builds do not use it.

[hzxuzhonghu]

It has nothing todo with default or not. Every dependency should be actively maintained. So I get it, you own this crate

[bleggett]

I'm happy with this approach, LGTM.

[hzxuzhonghu]

It has nothing todo with default or not. Every dependency should be actively maintained. So I get it, you own this crate