Skip to content

Commit 2fe9760

Browse files
theawlesstheawless
committed
feat: add rustls-no-provider-no-roots feature
Add a feature flag to use rustls without a crypto provider and without rustls-platform-verifier, for users who provide their own crypto provider and certificates via tls_certs_only(). This avoids pulling in platform-native dependencies that are problematic for cross-compilation and environments like Android where JNI initialization is required. Closes #2948 Closes #2968
1 parent 5f9c231 commit 2fe9760

14 files changed

Lines changed: 61 additions & 14 deletions

File tree

‎Cargo.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,9 @@ default-tls = ["rustls"]
4242

4343
http2 = ["dep:h2", "hyper/http2", "hyper-util/http2", "hyper-rustls?/http2"]
4444

45-
rustls = ["__rustls-aws-lc-rs", "dep:rustls-platform-verifier", "__rustls"]
46-
rustls-no-provider = ["dep:rustls-platform-verifier", "__rustls"]
45+
rustls = ["__rustls-aws-lc-rs", "__rustls-platform-verifier", "__rustls"]
46+
rustls-no-provider = ["__rustls-platform-verifier", "__rustls"]
47+
rustls-no-provider-no-roots = ["__rustls"]
4748

4849
native-tls = ["__native-tls", "__native-tls-alpn"]
4950
native-tls-no-alpn = ["__native-tls"]
@@ -89,6 +90,7 @@ __tls = ["dep:rustls-pki-types", "tokio/io-util"]
8990
# Enables common rustls code.
9091
__rustls = ["dep:hyper-rustls", "dep:tokio-rustls", "dep:rustls", "__tls"]
9192
__rustls-aws-lc-rs = ["hyper-rustls?/aws-lc-rs", "tokio-rustls?/aws-lc-rs", "rustls?/aws-lc-rs", "quinn?/rustls-aws-lc-rs"]
93+
__rustls-platform-verifier = ["dep:rustls-platform-verifier"]
9294

9395
# Enables common native-tls code.
9496
__native-tls = ["dep:hyper-tls", "dep:native-tls-crate", "__tls", "dep:tokio-native-tls"]

‎src/async_impl/client.rs‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -748,6 +748,8 @@ impl ClientBuilder {
748748
));
749749
}
750750

751+
#[cfg(feature = "__rustls-platform-verifier")]
752+
{
751753
let verifier = if config.root_certs.is_empty() {
752754
rustls_platform_verifier::Verifier::new(provider.clone())
753755
.map_err(crate::error::builder)?
@@ -776,6 +778,12 @@ impl ClientBuilder {
776778
config_builder
777779
.dangerous()
778780
.with_custom_certificate_verifier(Arc::new(verifier))
781+
}
782+
783+
#[cfg(not(feature = "__rustls-platform-verifier"))]
784+
return Err(crate::error::builder(
785+
"no TLS root certificates configured, use tls_certs_only()",
786+
));
779787
} else {
780788
if config.crls.is_empty() {
781789
config_builder.with_root_certificates(crate::tls::rustls_store(
@@ -3104,7 +3112,7 @@ impl fmt::Debug for Pending {
31043112

31053113
#[cfg(test)]
31063114
mod tests {
3107-
#![cfg(not(feature = "rustls-no-provider"))]
3115+
#![cfg(not(any(feature = "rustls-no-provider", feature = "rustls-no-provider-no-roots")))]
31083116

31093117
#[tokio::test]
31103118
async fn execute_request_rejects_invalid_urls() {

‎src/async_impl/request.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -662,7 +662,7 @@ impl TryFrom<Request> for HttpRequest<Body> {
662662

663663
#[cfg(test)]
664664
mod tests {
665-
#![cfg(not(feature = "rustls-no-provider"))]
665+
#![cfg(not(any(feature = "rustls-no-provider", feature = "rustls-no-provider-no-roots")))]
666666

667667
use super::*;
668668
#[cfg(feature = "query")]

‎src/lib.rs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,11 @@
193193
//! - **default-tls** *(enabled by default)*: Provides TLS support to connect
194194
//! over HTTPS.
195195
//! - **rustls**: Enables TLS functionality provided by `rustls`.
196+
//! Uses `rustls-platform-verifier` for certificate verification by default.
196197
//! - **rustls-no-provider**: Enables TLS provided by `rustls` without specifying a crypto provider.
198+
//! - **rustls-no-provider-no-roots**: Enables TLS provided by `rustls` without a crypto provider
199+
//! or `rustls-platform-verifier`. You must provide both a crypto provider and call
200+
//! `tls_certs_only()` to provide certificates.
197201
//! - **native-tls**: Enables TLS functionality provided by `native-tls`.
198202
//! - **native-tls-vendored**: Enables the `vendored` feature of `native-tls`.
199203
//! - **native-tls-no-alpn**: Enables `native-tls` without its `alpn` feature.

‎tests/badssl.rs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
#![cfg(not(target_arch = "wasm32"))]
2-
#![cfg(not(feature = "rustls-no-provider"))]
2+
#![cfg(not(any(
3+
feature = "rustls-no-provider",
4+
feature = "rustls-no-provider-no-roots"
5+
)))]
36

47
#[cfg(all(feature = "__tls"))]
58
#[tokio::test]

‎tests/ci.rs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
#![cfg(not(target_arch = "wasm32"))]
2-
#![cfg(not(feature = "rustls-no-provider"))]
2+
#![cfg(not(any(
3+
feature = "rustls-no-provider",
4+
feature = "rustls-no-provider-no-roots"
5+
)))]
36
mod support;
47
use support::server;
58

‎tests/client.rs‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -462,7 +462,13 @@ fn update_json_content_type_if_set_manually() {
462462
assert_eq!("application/json", req.headers().get(CONTENT_TYPE).unwrap());
463463
}
464464

465-
#[cfg(all(feature = "__tls", not(feature = "rustls-no-provider")))]
465+
#[cfg(all(
466+
feature = "__tls",
467+
not(any(
468+
feature = "rustls-no-provider",
469+
feature = "rustls-no-provider-no-roots"
470+
))
471+
))]
466472
#[tokio::test]
467473
async fn test_tls_info() {
468474
let resp = reqwest::Client::builder()

‎tests/connector_layers.rs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
#![cfg(not(target_arch = "wasm32"))]
2-
#![cfg(not(feature = "rustls-no-provider"))]
2+
#![cfg(not(any(
3+
feature = "rustls-no-provider",
4+
feature = "rustls-no-provider-no-roots"
5+
)))]
36
mod support;
47

58
use std::time::Duration;

‎tests/not_tcp.rs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
#![cfg(not(target_arch = "wasm32"))]
2-
#![cfg(not(feature = "rustls-no-provider"))]
2+
#![cfg(not(any(
3+
feature = "rustls-no-provider",
4+
feature = "rustls-no-provider-no-roots"
5+
)))]
36
#![cfg(unix)]
47

58
mod support;

‎tests/proxy.rs‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
#![cfg(not(target_arch = "wasm32"))]
2-
#![cfg(not(feature = "rustls-no-provider"))]
2+
#![cfg(not(any(
3+
feature = "rustls-no-provider",
4+
feature = "rustls-no-provider-no-roots"
5+
)))]
36
mod support;
47
use support::server;
58

0 commit comments

Comments
 (0)