From 64aa7d127c145d036ff87aa4c8593f7a4aacce11 Mon Sep 17 00:00:00 2001 From: Steve Fan <29133953+stevefan1999-personal@users.noreply.github.com> Date: Mon, 28 Oct 2024 22:35:31 +0800 Subject: [PATCH] add webpki roots option for rustls no provider setup (#2447) --- Cargo.toml | 9 ++++++--- src/async_impl/client.rs | 24 ++++++++++++------------ src/blocking/client.rs | 8 ++++---- tests/badssl.rs | 4 ++-- 4 files changed, 24 insertions(+), 21 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index e38e68a9f..a2eb6b94f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -43,10 +43,13 @@ native-tls-vendored = ["native-tls", "native-tls-crate?/vendored"] rustls-tls = ["rustls-tls-webpki-roots"] rustls-tls-no-provider = ["rustls-tls-manual-roots-no-provider"] -rustls-tls-manual-roots = ["__rustls", "__rustls-ring"] -rustls-tls-webpki-roots = ["dep:webpki-roots", "hyper-rustls?/webpki-tokio", "__rustls", "__rustls-ring"] -rustls-tls-native-roots = ["dep:rustls-native-certs", "hyper-rustls?/native-tokio", "__rustls", "__rustls-ring"] rustls-tls-manual-roots-no-provider = ["__rustls"] +rustls-tls-webpki-roots-no-provider = ["dep:webpki-roots", "hyper-rustls?/webpki-tokio", "__rustls"] +rustls-tls-native-roots-no-provider = ["dep:rustls-native-certs", "hyper-rustls?/native-tokio", "__rustls"] + +rustls-tls-manual-roots = ["rustls-tls-manual-roots-no-provider", "__rustls-ring"] +rustls-tls-webpki-roots = ["rustls-tls-webpki-roots-no-provider", "__rustls-ring"] +rustls-tls-native-roots = ["rustls-tls-native-roots-no-provider", "__rustls-ring"] blocking = ["dep:futures-channel", "futures-channel?/sink", "futures-util/io", "futures-util/sink", "tokio/sync"] diff --git a/src/async_impl/client.rs b/src/async_impl/client.rs index 6e21908a3..318217836 100644 --- a/src/async_impl/client.rs +++ b/src/async_impl/client.rs @@ -116,9 +116,9 @@ struct Config { root_certs: Vec, #[cfg(feature = "__tls")] tls_built_in_root_certs: bool, - #[cfg(feature = "rustls-tls-webpki-roots")] + #[cfg(feature = "rustls-tls-webpki-roots-no-provider")] tls_built_in_certs_webpki: bool, - #[cfg(feature = "rustls-tls-native-roots")] + #[cfg(feature = "rustls-tls-native-roots-no-provider")] tls_built_in_certs_native: bool, #[cfg(feature = "__rustls")] crls: Vec, @@ -215,9 +215,9 @@ impl ClientBuilder { root_certs: Vec::new(), #[cfg(feature = "__tls")] tls_built_in_root_certs: true, - #[cfg(feature = "rustls-tls-webpki-roots")] + #[cfg(feature = "rustls-tls-webpki-roots-no-provider")] tls_built_in_certs_webpki: true, - #[cfg(feature = "rustls-tls-native-roots")] + #[cfg(feature = "rustls-tls-native-roots-no-provider")] tls_built_in_certs_native: true, #[cfg(any(feature = "native-tls", feature = "__rustls"))] identity: None, @@ -511,12 +511,12 @@ impl ClientBuilder { cert.add_to_rustls(&mut root_cert_store)?; } - #[cfg(feature = "rustls-tls-webpki-roots")] + #[cfg(feature = "rustls-tls-webpki-roots-no-provider")] if config.tls_built_in_certs_webpki { root_cert_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned()); } - #[cfg(feature = "rustls-tls-native-roots")] + #[cfg(feature = "rustls-tls-native-roots-no-provider")] if config.tls_built_in_certs_native { let mut valid_count = 0; let mut invalid_count = 0; @@ -1490,12 +1490,12 @@ impl ClientBuilder { pub fn tls_built_in_root_certs(mut self, tls_built_in_root_certs: bool) -> ClientBuilder { self.config.tls_built_in_root_certs = tls_built_in_root_certs; - #[cfg(feature = "rustls-tls-webpki-roots")] + #[cfg(feature = "rustls-tls-webpki-roots-no-provider")] { self.config.tls_built_in_certs_webpki = tls_built_in_root_certs; } - #[cfg(feature = "rustls-tls-native-roots")] + #[cfg(feature = "rustls-tls-native-roots-no-provider")] { self.config.tls_built_in_certs_native = tls_built_in_root_certs; } @@ -1506,8 +1506,8 @@ impl ClientBuilder { /// Sets whether to load webpki root certs with rustls. /// /// If the feature is enabled, this value is `true` by default. - #[cfg(feature = "rustls-tls-webpki-roots")] - #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-webpki-roots")))] + #[cfg(feature = "rustls-tls-webpki-roots-no-provider")] + #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-webpki-roots-no-provider")))] pub fn tls_built_in_webpki_certs(mut self, enabled: bool) -> ClientBuilder { self.config.tls_built_in_certs_webpki = enabled; self @@ -1516,8 +1516,8 @@ impl ClientBuilder { /// Sets whether to load native root certs with rustls. /// /// If the feature is enabled, this value is `true` by default. - #[cfg(feature = "rustls-tls-native-roots")] - #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-native-roots")))] + #[cfg(feature = "rustls-tls-native-roots-no-provider")] + #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-native-roots-no-provider")))] pub fn tls_built_in_native_certs(mut self, enabled: bool) -> ClientBuilder { self.config.tls_built_in_certs_native = enabled; self diff --git a/src/blocking/client.rs b/src/blocking/client.rs index 9a447e2d5..7b5cafff1 100644 --- a/src/blocking/client.rs +++ b/src/blocking/client.rs @@ -659,8 +659,8 @@ impl ClientBuilder { /// Sets whether to load webpki root certs with rustls. /// /// If the feature is enabled, this value is `true` by default. - #[cfg(feature = "rustls-tls-webpki-roots")] - #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-webpki-roots")))] + #[cfg(feature = "rustls-tls-webpki-roots-no-provider")] + #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-webpki-roots-no-provider")))] pub fn tls_built_in_webpki_certs(self, enabled: bool) -> ClientBuilder { self.with_inner(move |inner| inner.tls_built_in_webpki_certs(enabled)) } @@ -668,8 +668,8 @@ impl ClientBuilder { /// Sets whether to load native root certs with rustls. /// /// If the feature is enabled, this value is `true` by default. - #[cfg(feature = "rustls-tls-native-roots")] - #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-native-roots")))] + #[cfg(feature = "rustls-tls-native-roots-no-provider")] + #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-native-roots-no-provider")))] pub fn tls_built_in_native_certs(self, enabled: bool) -> ClientBuilder { self.with_inner(move |inner| inner.tls_built_in_native_certs(enabled)) } diff --git a/tests/badssl.rs b/tests/badssl.rs index 28d284324..7aa75fd9b 100644 --- a/tests/badssl.rs +++ b/tests/badssl.rs @@ -20,8 +20,8 @@ async fn test_badssl_modern() { } #[cfg(any( - feature = "rustls-tls-webpki-roots", - feature = "rustls-tls-native-roots" + feature = "rustls-tls-webpki-roots-no-provider", + feature = "rustls-tls-native-roots-no-provider" ))] #[tokio::test] async fn test_rustls_badssl_modern() {