fix(deps): Update VRL and preserve TLS provider selection

Cargo.toml

@@ -482,8 +482,9 @@ rdkafka = { workspace = true, features = ["curl-static", "tokio", "libz", "ssl",
 redis = { version = "0.32.4", default-features = false, features = ["connection-manager", "sentinel", "tokio-comp", "tokio-native-tls-comp"], optional = true }
 regex.workspace = true
 roaring = { version = "0.11.2", default-features = false, features = ["std"], optional = true }
-rumqttc = { package = "rumqttc-v4-next", version = "0.34.0", default-features = false, features = ["use-rustls-no-provider"], optional = true }
-# Keep MQTT on Ring alongside Vector's other Rustls users, including in minimal builds.
+# Select MQTT's provider explicitly because VRL also enables Rustls's AWS-LC provider.
+rumqttc = { package = "rumqttc-v4-next", version = "0.34.0", default-features = false, features = ["use-rustls-ring"], optional = true }
+# GreptimeDB uses tonic TLS, which needs a default provider when VRL enables AWS-LC.
 rustls = { version = "0.23", default-features = false, features = ["logging", "ring", "std", "tls12"], optional = true }
 seahash = { version = "4.1.0", default-features = false }
 smallvec = { version = "1", default-features = false, features = ["union", "serde"] }
@@ -798,7 +799,7 @@ sources-kafka = ["dep:rdkafka"]
 sources-kubernetes_logs = ["vector-lib/file-source", "kubernetes", "transforms-reduce"]
 sources-logstash = ["sources-utils-net-tcp", "tokio-util/net"]
 sources-mongodb_metrics = ["dep:mongodb"]
-sources-mqtt = ["dep:rumqttc", "dep:rustls"]
+sources-mqtt = ["dep:rumqttc"]
 sources-nats = ["dep:async-nats", "dep:nkeys"]
 sources-nginx_metrics = ["dep:nom"]
 sources-okta = ["sources-utils-http-client"]
@@ -997,7 +998,7 @@ sinks-elasticsearch = ["transforms-metric_to_log"]
 sinks-file = ["dep:async-compression"]
 sinks-gcp = ["sinks-gcp-chronicle", "dep:base64", "gcp"]
 sinks-gcp-chronicle = ["gcp"]
-sinks-greptimedb_metrics = ["dep:greptimedb-ingester"]
+sinks-greptimedb_metrics = ["dep:greptimedb-ingester", "dep:rustls"]
 sinks-greptimedb_logs = ["dep:greptimedb-ingester"]
 sinks-honeycomb = []
 sinks-http = []
@@ -1007,7 +1008,7 @@ sinks-kafka = ["dep:rdkafka"]
 sinks-keep = []
 sinks-mezmo = []
 sinks-loki = ["loki-logproto"]
-sinks-mqtt = ["dep:rumqttc", "dep:rustls"]
+sinks-mqtt = ["dep:rumqttc"]
 sinks-nats = ["dep:async-nats", "dep:nkeys"]
 sinks-new_relic_logs = ["sinks-http"]
 sinks-new_relic = []

LICENSE-3rdparty.csv

@@ -72,6 +72,8 @@ atoi,https://github.com/pacman82/atoi-rs,MIT,Markus Klein
 atomic-waker,https://github.com/smol-rs/atomic-waker,Apache-2.0 OR MIT,"Stjepan Glavina <stjepang@gmail.com>, Contributors to futures-rs"
 aws-config,https://github.com/smithy-lang/smithy-rs,Apache-2.0,"AWS Rust SDK Team <aws-sdk-rust@amazon.com>, Russell Cohen <rcoh@amazon.com>"
 aws-credential-types,https://github.com/smithy-lang/smithy-rs,Apache-2.0,AWS Rust SDK Team <aws-sdk-rust@amazon.com>
+aws-lc-rs,https://github.com/aws/aws-lc-rs,ISC AND (Apache-2.0 OR ISC),AWS-LibCrypto
+aws-lc-sys,https://github.com/aws/aws-lc-rs,ISC AND (Apache-2.0 OR ISC) AND Apache-2.0 AND MIT AND BSD-3-Clause AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR ISC OR MIT-0),AWS-LC
 aws-runtime,https://github.com/smithy-lang/smithy-rs,Apache-2.0,AWS Rust SDK Team <aws-sdk-rust@amazon.com>
 aws-sdk-cloudwatch,https://github.com/awslabs/aws-sdk-rust,Apache-2.0,"AWS Rust SDK Team <aws-sdk-rust@amazon.com>, Russell Cohen <rcoh@amazon.com>"
 aws-sdk-cloudwatchlogs,https://github.com/awslabs/aws-sdk-rust,Apache-2.0,"AWS Rust SDK Team <aws-sdk-rust@amazon.com>, Russell Cohen <rcoh@amazon.com>"

changelog.d/vrl_update.enhancement.md

@@ -0,0 +1,3 @@
+Updated VRL to improve assignment performance and use platform certificate verification for `http_request`. MQTT, NATS, and GreptimeDB metrics TLS now select a crypto provider explicitly so they work when multiple Rustls crypto providers are enabled.
+
+authors: pront

src/common/mqtt.rs

@@ -135,10 +135,9 @@ impl MqttConnector {
 #[cfg(test)]
 mod tests {
     #[test]
-    fn tls_crypto_provider_is_unambiguous() {
-        // Rustls panics here if no provider, or both Ring and AWS-LC, are enabled.
-        let _config = rustls::ClientConfig::builder()
-            .with_root_certificates(rustls::RootCertStore::empty())
-            .with_no_client_auth();
+    fn tls_config_uses_explicit_crypto_provider() {
+        // Exercise MQTT's provider selection, including when VRL enables AWS-LC.
+        rumqttc::TlsConfiguration::try_default_rustls()
+            .expect("MQTT TLS should select Ring without a process-wide default provider");
     }
 }

src/nats.rs

@@ -157,6 +157,10 @@ pub(crate) fn from_tls_auth_config(
     auth_config: Option<&NatsAuthConfig>,
     tls_config: Option<&TlsEnableableConfig>,
 ) -> Result<async_nats::ConnectOptions, NatsConfigError> {
+    // async-nats uses the process provider when VRL also enables AWS-LC.
+    // Keep an existing provider if another component already installed one.
+    _ = async_nats::rustls::crypto::ring::default_provider().install_default();
+
     let nats_options = match auth_config {
         None => async_nats::ConnectOptions::new(),
         Some(auth) => auth.to_nats_options()?,
@@ -200,6 +204,16 @@ mod tests {
 
     use super::*;
 
+    #[test]
+    fn tls_crypto_provider_is_available() {
+        from_tls_auth_config("test", None, None).unwrap();
+
+        // Mirror async-nats's TLS builder with VRL's AWS-LC feature also enabled.
+        let _config = async_nats::rustls::ClientConfig::builder()
+            .with_root_certificates(async_nats::rustls::RootCertStore::empty())
+            .with_no_client_auth();
+    }
+
     fn parse_auth(s: &str) -> Result<async_nats::ConnectOptions, crate::Error> {
         serde_yaml::from_str(s)
             .map_err(Into::into)

src/sinks/greptimedb/metrics/service.rs

@@ -67,6 +67,10 @@ fn new_client_from_config(config: &GreptimeDBGrpcServiceConfig) -> crate::Result
         validate_tls_all_or_none(tls_config)?;
         match (ca_file, crt_file, key_file) {
             (Some(ca), Some(crt), Some(key)) => {
+                // Tonic uses the process provider when VRL also enables AWS-LC.
+                // Preserve any provider another component has already installed.
+                _ = rustls::crypto::ring::default_provider().install_default();
+
                 channel_config.client_tls = Some(ClientTlsOption {
                     server_ca_cert_path: ca.to_string_lossy().into_owned(),
                     client_cert_path: crt.to_string_lossy().into_owned(),
@@ -167,3 +171,40 @@ pub(super) fn healthcheck(
     }
     .boxed())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tls_channel_uses_crypto_provider() {
+        let runtime = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .unwrap();
+        let _guard = runtime.enter();
+        let config = GreptimeDBGrpcServiceConfig {
+            endpoint: "localhost:4001".into(),
+            dbname: "public".into(),
+            username: None,
+            password: None,
+            compression: GrpcCompression::None,
+            tls: Some(TlsConfig {
+                ca_file: Some("tests/data/ca/certs/ca.cert.pem".into()),
+                crt_file: Some(
+                    "tests/data/ca/intermediate_client/certs/localhost-chain.cert.pem".into(),
+                ),
+                key_file: Some(
+                    "tests/data/ca/intermediate_client/private/localhost.key.pem".into(),
+                ),
+                ..Default::default()
+            }),
+        };
+
+        // Building the lazy channel configures tonic TLS without contacting a server.
+        let client = new_client_from_config(&config).unwrap();
+        client
+            .find_channel()
+            .expect("GreptimeDB TLS should have a crypto provider");
+    }
+}