Only permit X25519 based QUIC-TLS key exchanges

[ripatel-fd]

Problem

Some versions of Agave permit a variety of key exchange algorithms.
These increase cryptographic attack surface and are slower than X25519.

Summary of Changes

Reject connection requests with key exchange algorithms other than X25519.

Fixes #

[lijunwangs]

Did we do any cross version compatibility test? Like if an older version of the agave-client talks to the server with this change, does it still work?

[ripatel-fd]

Did we do any cross version compatibility test? Like if an older version of the agave-client talks to the server with this change, does it still work?

I didn't do any specific version compatibility tests. But I'm certain that this change does not introduce compatibility issues.
Since Solana Labs days, solana-streamer has always defaulted to an X25519 based key exchange.
In the very unlikely event issues do arise, they will be caught in Agave's QA procedure. (invalidator, testnet deployments, etc)

[lijunwangs]

Did we do any cross version compatibility test? Like if an older version of the agave-client talks to the server with this change, does it still work?

I didn't do any specific version compatibility tests. But I'm certain that this change does not introduce compatibility issues. Since Solana Labs days, solana-streamer has always defaulted to an X25519 based key exchange. In the very unlikely event issues do arise, they will be caught in Agave's QA procedure. (invalidator, testnet deployments, etc)

I expect it work as well. But we still need to do due diligence testing. I am not sure about coverage of invalidator testing on backward compatibility on this regard. I will launch a GCE cluster and see how it goes

[lijunwangs]

Hi @ripatel-fd could you please rebase with master? Somehow GitHub does not enable to fix the conflict on this PR directly.

Sorry -- it took me some time to turn around to run the test:

I ran old code cluster and use this code as client -- worked as expected
I ran a cluster with this code and a client with old code -- worked as expected.