From 9807877e3a00ea9a0da826d3885c4e771eb152b8 Mon Sep 17 00:00:00 2001 From: Steve Fan <29133953+stevefan1999-personal@users.noreply.github.com> Date: Tue, 15 Oct 2024 17:56:46 +0800 Subject: [PATCH] add webpki roots option for rustls no provider setup --- Cargo.toml | 9 ++++++--- src/async_impl/client.rs | 24 ++++++++++++------------ src/blocking/client.rs | 8 ++++---- tests/badssl.rs | 4 ++-- 4 files changed, 24 insertions(+), 21 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index e38e68a9f..a2eb6b94f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -43,10 +43,13 @@ native-tls-vendored = ["native-tls", "native-tls-crate?/vendored"] rustls-tls = ["rustls-tls-webpki-roots"] rustls-tls-no-provider = ["rustls-tls-manual-roots-no-provider"] -rustls-tls-manual-roots = ["__rustls", "__rustls-ring"] -rustls-tls-webpki-roots = ["dep:webpki-roots", "hyper-rustls?/webpki-tokio", "__rustls", "__rustls-ring"] -rustls-tls-native-roots = ["dep:rustls-native-certs", "hyper-rustls?/native-tokio", "__rustls", "__rustls-ring"] rustls-tls-manual-roots-no-provider = ["__rustls"] +rustls-tls-webpki-roots-no-provider = ["dep:webpki-roots", "hyper-rustls?/webpki-tokio", "__rustls"] +rustls-tls-native-roots-no-provider = ["dep:rustls-native-certs", "hyper-rustls?/native-tokio", "__rustls"] + +rustls-tls-manual-roots = ["rustls-tls-manual-roots-no-provider", "__rustls-ring"] +rustls-tls-webpki-roots = ["rustls-tls-webpki-roots-no-provider", "__rustls-ring"] +rustls-tls-native-roots = ["rustls-tls-native-roots-no-provider", "__rustls-ring"] blocking = ["dep:futures-channel", "futures-channel?/sink", "futures-util/io", "futures-util/sink", "tokio/sync"] diff --git a/src/async_impl/client.rs b/src/async_impl/client.rs index 095adf4d8..3d3f0ea6b 100644 --- a/src/async_impl/client.rs +++ b/src/async_impl/client.rs @@ -114,9 +114,9 @@ struct Config { root_certs: Vec, #[cfg(feature = "__tls")] tls_built_in_root_certs: bool, - #[cfg(feature = "rustls-tls-webpki-roots")] + #[cfg(feature = "rustls-tls-webpki-roots-no-provider")] tls_built_in_certs_webpki: bool, - #[cfg(feature = "rustls-tls-native-roots")] + #[cfg(feature = "rustls-tls-native-roots-no-provider")] tls_built_in_certs_native: bool, #[cfg(feature = "__tls")] min_tls_version: Option, @@ -211,9 +211,9 @@ impl ClientBuilder { root_certs: Vec::new(), #[cfg(feature = "__tls")] tls_built_in_root_certs: true, - #[cfg(feature = "rustls-tls-webpki-roots")] + #[cfg(feature = "rustls-tls-webpki-roots-no-provider")] tls_built_in_certs_webpki: true, - #[cfg(feature = "rustls-tls-native-roots")] + #[cfg(feature = "rustls-tls-native-roots-no-provider")] tls_built_in_certs_native: true, #[cfg(any(feature = "native-tls", feature = "__rustls"))] identity: None, @@ -505,12 +505,12 @@ impl ClientBuilder { cert.add_to_rustls(&mut root_cert_store)?; } - #[cfg(feature = "rustls-tls-webpki-roots")] + #[cfg(feature = "rustls-tls-webpki-roots-no-provider")] if config.tls_built_in_certs_webpki { root_cert_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned()); } - #[cfg(feature = "rustls-tls-native-roots")] + #[cfg(feature = "rustls-tls-native-roots-no-provider")] if config.tls_built_in_certs_native { let mut valid_count = 0; let mut invalid_count = 0; @@ -1435,12 +1435,12 @@ impl ClientBuilder { pub fn tls_built_in_root_certs(mut self, tls_built_in_root_certs: bool) -> ClientBuilder { self.config.tls_built_in_root_certs = tls_built_in_root_certs; - #[cfg(feature = "rustls-tls-webpki-roots")] + #[cfg(feature = "rustls-tls-webpki-roots-no-provider")] { self.config.tls_built_in_certs_webpki = tls_built_in_root_certs; } - #[cfg(feature = "rustls-tls-native-roots")] + #[cfg(feature = "rustls-tls-native-roots-no-provider")] { self.config.tls_built_in_certs_native = tls_built_in_root_certs; } @@ -1451,8 +1451,8 @@ impl ClientBuilder { /// Sets whether to load webpki root certs with rustls. /// /// If the feature is enabled, this value is `true` by default. - #[cfg(feature = "rustls-tls-webpki-roots")] - #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-webpki-roots")))] + #[cfg(feature = "rustls-tls-webpki-roots-no-provider")] + #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-webpki-roots-no-provider")))] pub fn tls_built_in_webpki_certs(mut self, enabled: bool) -> ClientBuilder { self.config.tls_built_in_certs_webpki = enabled; self @@ -1461,8 +1461,8 @@ impl ClientBuilder { /// Sets whether to load native root certs with rustls. /// /// If the feature is enabled, this value is `true` by default. - #[cfg(feature = "rustls-tls-native-roots")] - #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-native-roots")))] + #[cfg(feature = "rustls-tls-native-roots-no-provider")] + #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-native-roots-no-provider")))] pub fn tls_built_in_native_certs(mut self, enabled: bool) -> ClientBuilder { self.config.tls_built_in_certs_native = enabled; self diff --git a/src/blocking/client.rs b/src/blocking/client.rs index d4b973ee6..7e8980d4d 100644 --- a/src/blocking/client.rs +++ b/src/blocking/client.rs @@ -630,8 +630,8 @@ impl ClientBuilder { /// Sets whether to load webpki root certs with rustls. /// /// If the feature is enabled, this value is `true` by default. - #[cfg(feature = "rustls-tls-webpki-roots")] - #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-webpki-roots")))] + #[cfg(feature = "rustls-tls-webpki-roots-no-provider")] + #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-webpki-roots-no-provider")))] pub fn tls_built_in_webpki_certs(self, enabled: bool) -> ClientBuilder { self.with_inner(move |inner| inner.tls_built_in_webpki_certs(enabled)) } @@ -639,8 +639,8 @@ impl ClientBuilder { /// Sets whether to load native root certs with rustls. /// /// If the feature is enabled, this value is `true` by default. - #[cfg(feature = "rustls-tls-native-roots")] - #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-native-roots")))] + #[cfg(feature = "rustls-tls-native-roots-no-provider")] + #[cfg_attr(docsrs, doc(cfg(feature = "rustls-tls-native-roots-no-provider")))] pub fn tls_built_in_native_certs(self, enabled: bool) -> ClientBuilder { self.with_inner(move |inner| inner.tls_built_in_native_certs(enabled)) } diff --git a/tests/badssl.rs b/tests/badssl.rs index 28d284324..7aa75fd9b 100644 --- a/tests/badssl.rs +++ b/tests/badssl.rs @@ -20,8 +20,8 @@ async fn test_badssl_modern() { } #[cfg(any( - feature = "rustls-tls-webpki-roots", - feature = "rustls-tls-native-roots" + feature = "rustls-tls-webpki-roots-no-provider", + feature = "rustls-tls-native-roots-no-provider" ))] #[tokio::test] async fn test_rustls_badssl_modern() {