diff --git a/Cargo.lock b/Cargo.lock index 7a1bd03..7419fda 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -19,23 +19,24 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0" [[package]] name = "aws-lc-fips-sys" -version = "0.13.14" +version = "0.14.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3d619165468401dec3caa3366ebffbcb83f2f31883e5b3932f8e2dec2ddc568" +checksum = "118303cd75f63d1933a90c2ceb7e697281ac6acbdbcc490b46419f25a527ab90" dependencies = [ "bindgen", "cc", "cmake", "dunce", "fs_extra", + "pkg-config", "regex", ] [[package]] name = "aws-lc-rs" -version = "1.16.3" +version = "1.18.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ec6fb3fe69024a75fa7e1bfb48aa6cf59706a101658ea01bfd33b2b248a038f" +checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e" dependencies = [ "aws-lc-fips-sys", "aws-lc-sys", @@ -44,14 +45,15 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.40.0" +version = "0.44.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f50037ee5e1e41e7b8f9d161680a725bd1626cb6f8c7e901f91f942850852fe7" +checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483" dependencies = [ "cc", "cmake", "dunce", "fs_extra", + "pkg-config", ] [[package]] @@ -365,8 +367,10 @@ dependencies = [ "hyper-util", "log", "rustls", + "rustls-aws-lc-rs", "rustls-native-certs", "rustls-platform-verifier", + "rustls-ring", "tokio", "tokio-rustls", "tower-service", @@ -550,6 +554,12 @@ version = "0.2.17" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd" +[[package]] +name = "pkg-config" +version = "0.3.34" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548" + [[package]] name = "prettyplease" version = "0.2.37" @@ -644,17 +654,26 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.43" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +version = "0.24.0-dev.1" +source = "git+https://github.com/rustls/rustls.git?branch=main#3925f65934364edafe8d6b20707d9e5e6183648e" dependencies = [ - "aws-lc-rs", - "log", "once_cell", - "ring", "rustls-pki-types", "rustls-webpki", "subtle", + "tracing", + "zeroize", +] + +[[package]] +name = "rustls-aws-lc-rs" +version = "0.1.0-dev.1" +source = "git+https://github.com/rustls/rustls.git?branch=main#3925f65934364edafe8d6b20707d9e5e6183648e" +dependencies = [ + "aws-lc-rs", + "rustls", + "rustls-pki-types", + "subtle", "zeroize", ] @@ -672,18 +691,17 @@ dependencies = [ [[package]] name = "rustls-pki-types" -version = "1.14.0" +version = "1.15.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd" +checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96" dependencies = [ "zeroize", ] [[package]] name = "rustls-platform-verifier" -version = "0.7.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0" +version = "0.8.0" +source = "git+https://github.com/rustls/rustls-platform-verifier.git?rev=df094724adf95136d5d09cf6d54296a3e809fff8#df094724adf95136d5d09cf6d54296a3e809fff8" dependencies = [ "core-foundation", "core-foundation-sys", @@ -703,17 +721,25 @@ dependencies = [ [[package]] name = "rustls-platform-verifier-android" version = "0.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" +source = "git+https://github.com/rustls/rustls-platform-verifier.git?rev=df094724adf95136d5d09cf6d54296a3e809fff8#df094724adf95136d5d09cf6d54296a3e809fff8" + +[[package]] +name = "rustls-ring" +version = "0.1.0-dev.1" +source = "git+https://github.com/rustls/rustls.git?branch=main#3925f65934364edafe8d6b20707d9e5e6183648e" +dependencies = [ + "ring", + "rustls", + "rustls-pki-types", + "subtle", +] [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.104.0-alpha.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "bea702cca24d344fc70973022bf7eb920c224e318466eb49784272337dd24b1a" dependencies = [ - "aws-lc-rs", - "ring", "rustls-pki-types", "untrusted", ] @@ -874,11 +900,12 @@ dependencies = [ [[package]] name = "tokio-rustls" -version = "0.26.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61" +version = "0.27.0" +source = "git+https://github.com/iadev09/tokio-rustls.git?rev=216d8bfa0538e5023c85c4d62a386780ee200395#216d8bfa0538e5023c85c4d62a386780ee200395" dependencies = [ "rustls", + "rustls-aws-lc-rs", + "rustls-ring", "tokio", ] diff --git a/Cargo.toml b/Cargo.toml index 659cb48..78c8c6f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -13,14 +13,14 @@ include = ["Cargo.toml", "LICENSE-MIT", "LICENSE-APACHE", "LICENSE-ISC", "README [features] default = ["native-tokio", "http1", "tls12", "logging", "aws-lc-rs"] -aws-lc-rs = ["rustls/aws_lc_rs"] -fips = ["aws-lc-rs", "rustls/fips"] +aws-lc-rs = ["dep:rustls-aws-lc-rs", "tokio-rustls/aws-lc-rs"] +fips = ["aws-lc-rs", "rustls-aws-lc-rs/fips", "tokio-rustls/fips"] http1 = ["hyper-util/http1"] http2 = ["hyper-util/http2"] -logging = ["log", "tokio-rustls/logging", "rustls/logging"] +logging = ["log", "tokio-rustls/logging", "rustls/tracing"] native-tokio = ["rustls-native-certs"] -ring = ["rustls/ring"] -tls12 = ["tokio-rustls/tls12", "rustls/tls12"] +ring = ["dep:rustls-ring", "tokio-rustls/ring"] +tls12 = ["tokio-rustls/tls12"] webpki-tokio = ["webpki-roots"] [dependencies] @@ -29,10 +29,12 @@ hyper = { version = "1", default-features = false } hyper-util = { version = "0.1", default-features = false, features = ["client-legacy", "tokio"] } log = { version = "0.4.4", optional = true } rustls-native-certs = { version = "0.8", optional = true } -rustls-platform-verifier = { version = "0.7", optional = true } -rustls = { version = "0.23", default-features = false } +rustls-platform-verifier = { git = "https://github.com/rustls/rustls-platform-verifier.git", rev = "df094724adf95136d5d09cf6d54296a3e809fff8", version = "0.8", optional = true } +rustls = { git = "https://github.com/rustls/rustls.git", branch = "main", version = "0.24.0-dev.1", default-features = false, features = ["webpki"] } +rustls-aws-lc-rs = { git = "https://github.com/rustls/rustls.git", branch = "main", version = "0.1.0-dev.1", default-features = false, features = ["aws-lc-sys", "std"], optional = true } +rustls-ring = { git = "https://github.com/rustls/rustls.git", branch = "main", version = "0.1.0-dev.1", default-features = false, features = ["std"], optional = true } tokio = "1.0" -tokio-rustls = { version = "0.26", default-features = false } +tokio-rustls = { git = "https://github.com/iadev09/tokio-rustls.git", rev = "216d8bfa0538e5023c85c4d62a386780ee200395", version = "0.27.0", default-features = false } tower-service = "0.3" webpki-roots = { version = "1", optional = true } @@ -40,7 +42,7 @@ webpki-roots = { version = "1", optional = true } cfg-if = "1" http-body-util = "0.1" hyper-util = { version = "0.1", default-features = false, features = ["server-auto"] } -rustls = { version = "0.23", default-features = false, features = ["tls12"] } +rustls = { git = "https://github.com/rustls/rustls.git", branch = "main", version = "0.24.0-dev.1", default-features = false, features = ["webpki"] } tokio = { version = "1.0", features = ["io-std", "macros", "net", "rt-multi-thread"] } [[example]] diff --git a/examples/client.rs b/examples/client.rs index 713d481..62f66cc 100644 --- a/examples/client.rs +++ b/examples/client.rs @@ -12,6 +12,7 @@ use rustls::pki_types::CertificateDer; use rustls::RootCertStore; use std::str::FromStr; +use std::sync::Arc; use std::{env, io}; fn main() { @@ -28,12 +29,6 @@ fn error(err: String) -> io::Error { #[tokio::main] async fn run_client() -> io::Result<()> { - // Set a process wide default crypto provider. - #[cfg(feature = "ring")] - let _ = rustls::crypto::ring::default_provider().install_default(); - #[cfg(feature = "aws-lc-rs")] - let _ = rustls::crypto::aws_lc_rs::default_provider().install_default(); - // First parameter is target URL (mandatory). let url = match env::args().nth(1) { Some(ref url) => Uri::from_str(url).map_err(|e| error(format!("{e}")))?, @@ -54,14 +49,16 @@ async fn run_client() -> io::Result<()> { let mut roots = RootCertStore::empty(); roots.add_parsable_certificates(certs); // TLS client config using the custom CA store for lookups - rustls::ClientConfig::builder() + rustls::ClientConfig::builder(provider()) .with_root_certificates(roots) .with_no_client_auth() + .map_err(|e| error(e.to_string()))? } // Default TLS client config with native roots - None => rustls::ClientConfig::builder() + None => rustls::ClientConfig::builder(provider()) .with_native_roots()? - .with_no_client_auth(), + .with_no_client_auth() + .map_err(|e| error(e.to_string()))?, }; // Prepare the HTTPS connector let https = hyper_rustls::HttpsConnectorBuilder::new() @@ -97,3 +94,20 @@ async fn run_client() -> io::Result<()> { fut.await } + +fn provider() -> Arc { + #[cfg(feature = "aws-lc-rs")] + { + Arc::new(rustls_aws_lc_rs::DEFAULT_PROVIDER.clone()) + } + + #[cfg(all(not(feature = "aws-lc-rs"), feature = "ring"))] + { + Arc::new(rustls_ring::DEFAULT_PROVIDER.clone()) + } + + #[cfg(not(any(feature = "aws-lc-rs", feature = "ring")))] + { + panic!("enable either the `aws-lc-rs` or `ring` feature") + } +} diff --git a/examples/server.rs b/examples/server.rs index 96d97b4..e1ff9a0 100644 --- a/examples/server.rs +++ b/examples/server.rs @@ -15,6 +15,8 @@ use hyper::body::{Bytes, Incoming}; use hyper::service::service_fn; use hyper_util::rt::{TokioExecutor, TokioIo}; use hyper_util::server::conn::auto::Builder; +use rustls::crypto::Identity; +use rustls::enums::ApplicationProtocol; use rustls::pki_types::pem::PemObject; use rustls::pki_types::{CertificateDer, PrivateKeyDer}; use rustls::ServerConfig; @@ -35,12 +37,6 @@ fn error(err: String) -> io::Error { #[tokio::main] async fn run_server() -> Result<(), Box> { - // Set a process wide default crypto provider. - #[cfg(feature = "ring")] - let _ = rustls::crypto::ring::default_provider().install_default(); - #[cfg(feature = "aws-lc-rs")] - let _ = rustls::crypto::aws_lc_rs::default_provider().install_default(); - // First parameter is port number (optional, defaults to 1337) let port = match env::args().nth(1) { Some(ref p) => p.parse()?, @@ -63,11 +59,16 @@ async fn run_server() -> Result<(), Box> { println!("Starting to serve on https://{addr}"); // Build TLS configuration. - let mut server_config = ServerConfig::builder() + let identity = Arc::new(Identity::from_cert_chain(certs)?); + let mut server_config = ServerConfig::builder(provider()) .with_no_client_auth() - .with_single_cert(certs, key) + .with_single_cert(identity, key) .map_err(|e| error(e.to_string()))?; - server_config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec(), b"http/1.0".to_vec()]; + server_config.alpn_protocols = vec![ + ApplicationProtocol::from(&b"h2"[..]), + ApplicationProtocol::from(&b"http/1.1"[..]), + ApplicationProtocol::from(&b"http/1.0"[..]), + ]; let tls_acceptor = TlsAcceptor::from(Arc::new(server_config)); let service = service_fn(echo); @@ -119,3 +120,15 @@ async fn echo(req: Request) -> Result>, hyper::Er }; Ok(response) } + +fn provider() -> Arc { + #[cfg(feature = "aws-lc-rs")] + { + Arc::new(rustls_aws_lc_rs::DEFAULT_PROVIDER.clone()) + } + + #[cfg(all(not(feature = "aws-lc-rs"), feature = "ring"))] + { + Arc::new(rustls_ring::DEFAULT_PROVIDER.clone()) + } +} diff --git a/src/config.rs b/src/config.rs index 8c77647..e945835 100644 --- a/src/config.rs +++ b/src/config.rs @@ -1,5 +1,15 @@ #[cfg(feature = "rustls-native-certs")] use std::io; +#[cfg(all( + any(feature = "aws-lc-rs", feature = "ring"), + any( + feature = "rustls-platform-verifier", + feature = "rustls-native-certs", + feature = "webpki-roots", + test + ) +))] +use std::sync::Arc; #[cfg(any( feature = "rustls-platform-verifier", @@ -7,6 +17,16 @@ use std::io; feature = "webpki-roots" ))] use rustls::client::WantsClientCert; +#[cfg(all( + any(feature = "aws-lc-rs", feature = "ring"), + any( + feature = "rustls-platform-verifier", + feature = "rustls-native-certs", + feature = "webpki-roots", + test + ) +))] +use rustls::crypto::CryptoProvider; use rustls::{ClientConfig, ConfigBuilder, WantsVerifier}; #[cfg(feature = "rustls-native-certs")] use rustls_native_certs::CertificateResult; @@ -71,7 +91,7 @@ impl ConfigBuilderExt for ConfigBuilder { } #[cfg(feature = "rustls-native-certs")] - #[cfg_attr(not(feature = "logging"), allow(unused_variables))] + #[cfg_attr(not(feature = "logging"), allow(unused_assignments, unused_variables))] fn with_native_roots(self) -> Result, io::Error> { let mut roots = rustls::RootCertStore::empty(); let mut valid_count = 0; @@ -133,3 +153,24 @@ mod sealed { impl Sealed for ConfigBuilder {} } + +#[cfg(all( + any(feature = "aws-lc-rs", feature = "ring"), + any( + feature = "rustls-platform-verifier", + feature = "rustls-native-certs", + feature = "webpki-roots", + test + ) +))] +pub(crate) fn default_provider() -> Arc { + #[cfg(feature = "aws-lc-rs")] + { + Arc::new(rustls_aws_lc_rs::DEFAULT_PROVIDER.clone()) + } + + #[cfg(all(not(feature = "aws-lc-rs"), feature = "ring"))] + { + Arc::new(rustls_ring::DEFAULT_PROVIDER.clone()) + } +} diff --git a/src/connector.rs b/src/connector.rs index 9e3e58d..e15874b 100644 --- a/src/connector.rs +++ b/src/connector.rs @@ -266,7 +266,7 @@ mod tests { allow: Allow, scheme: Scheme, ) -> Result>, BoxError> { - let config_builder = rustls::ClientConfig::builder(); + let config_builder = rustls::ClientConfig::builder(crate::config::default_provider()); cfg_if::cfg_if! { if #[cfg(feature = "rustls-platform-verifier")] { let config_builder = config_builder.try_with_platform_verifier()?; @@ -276,7 +276,7 @@ mod tests { let config_builder = config_builder.with_webpki_roots(); } } - let config = config_builder.with_no_client_auth(); + let config = config_builder.with_no_client_auth()?; let builder = HttpsConnectorBuilder::new().with_tls_config(config); let mut service = match allow { diff --git a/src/connector/builder.rs b/src/connector/builder.rs index 1b4a825..fb034a0 100644 --- a/src/connector/builder.rs +++ b/src/connector/builder.rs @@ -7,10 +7,25 @@ use hyper_util::client::legacy::connect::HttpConnector; feature = "webpki-roots" ))] use rustls::crypto::CryptoProvider; +#[cfg(any( + feature = "http2", + all(test, feature = "http1", any(feature = "aws-lc-rs", feature = "ring")) +))] +use rustls::enums::ApplicationProtocol; use rustls::pki_types::ServerName; use rustls::ClientConfig; use super::{DefaultServerNameResolver, HttpsConnector, ResolveServerName}; +#[cfg(all( + any(feature = "aws-lc-rs", feature = "ring"), + any( + feature = "rustls-platform-verifier", + feature = "rustls-native-certs", + feature = "webpki-roots", + test + ) +))] +use crate::config::default_provider; #[cfg(any( feature = "rustls-native-certs", feature = "webpki-roots", @@ -30,7 +45,6 @@ use crate::config::ConfigBuilderExt; /// /// # #[cfg(all(feature = "webpki-roots", feature = "http1", feature="aws-lc-rs"))] /// # { -/// # let _ = rustls::crypto::aws_lc_rs::default_provider().install_default(); /// let https = HttpsConnectorBuilder::new() /// .with_webpki_roots() /// .https_only() @@ -90,9 +104,9 @@ impl ConnectorBuilder { self, ) -> Result, rustls::Error> { Ok(self.with_tls_config( - ClientConfig::builder() + ClientConfig::builder(default_provider()) .try_with_platform_verifier()? - .with_no_client_auth(), + .with_no_client_auth()?, )) } @@ -105,11 +119,11 @@ impl ConnectorBuilder { provider: impl Into>, ) -> std::io::Result> { Ok(self.with_tls_config( - ClientConfig::builder_with_provider(provider.into()) - .with_safe_default_protocol_versions() - .and_then(|builder| builder.try_with_platform_verifier()) + ClientConfig::builder(provider.into()) + .try_with_platform_verifier() .map_err(std::io::Error::other)? - .with_no_client_auth(), + .with_no_client_auth() + .map_err(std::io::Error::other)?, )) } @@ -123,9 +137,10 @@ impl ConnectorBuilder { ))] pub fn with_native_roots(self) -> std::io::Result> { Ok(self.with_tls_config( - ClientConfig::builder() + ClientConfig::builder(default_provider()) .with_native_roots()? - .with_no_client_auth(), + .with_no_client_auth() + .map_err(std::io::Error::other)?, )) } @@ -138,11 +153,10 @@ impl ConnectorBuilder { provider: impl Into>, ) -> std::io::Result> { Ok(self.with_tls_config( - ClientConfig::builder_with_provider(provider.into()) - .with_safe_default_protocol_versions() - .map_err(std::io::Error::other)? + ClientConfig::builder(provider.into()) .with_native_roots()? - .with_no_client_auth(), + .with_no_client_auth() + .map_err(std::io::Error::other)?, )) } @@ -153,9 +167,10 @@ impl ConnectorBuilder { #[cfg(all(any(feature = "ring", feature = "aws-lc-rs"), feature = "webpki-roots"))] pub fn with_webpki_roots(self) -> ConnectorBuilder { self.with_tls_config( - ClientConfig::builder() + ClientConfig::builder(default_provider()) .with_webpki_roots() - .with_no_client_auth(), + .with_no_client_auth() + .expect("rustls provider configuration is invalid"), ) } @@ -169,10 +184,9 @@ impl ConnectorBuilder { provider: impl Into>, ) -> Result, rustls::Error> { Ok(self.with_tls_config( - ClientConfig::builder_with_provider(provider.into()) - .with_safe_default_protocol_versions()? + ClientConfig::builder(provider.into()) .with_webpki_roots() - .with_no_client_auth(), + .with_no_client_auth()?, )) } } @@ -258,7 +272,7 @@ impl ConnectorBuilder { /// This needs to be called explicitly, no protocol is enabled by default #[cfg(feature = "http2")] pub fn enable_http2(mut self) -> ConnectorBuilder { - self.0.tls_config.alpn_protocols = vec![b"h2".to_vec()]; + self.0.tls_config.alpn_protocols = vec![alpn(b"h2")]; ConnectorBuilder(WantsProtocols3 { inner: self.0, enable_http1: false, @@ -272,9 +286,9 @@ impl ConnectorBuilder { #[cfg(feature = "http2")] pub fn enable_all_versions(mut self) -> ConnectorBuilder { #[cfg(feature = "http1")] - let alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()]; + let alpn_protocols = vec![alpn(b"h2"), alpn(b"http/1.1")]; #[cfg(not(feature = "http1"))] - let alpn_protocols = vec![b"h2".to_vec()]; + let alpn_protocols = vec![alpn(b"h2")]; self.0.tls_config.alpn_protocols = alpn_protocols; ConnectorBuilder(WantsProtocols3 { @@ -343,7 +357,7 @@ impl ConnectorBuilder { /// This needs to be called explicitly, no protocol is enabled by default #[cfg(feature = "http2")] pub fn enable_http2(mut self) -> ConnectorBuilder { - self.0.inner.tls_config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()]; + self.0.inner.tls_config.alpn_protocols = vec![alpn(b"h2"), alpn(b"http/1.1")]; ConnectorBuilder(WantsProtocols3 { inner: self.0.inner, enable_http1: true, @@ -365,6 +379,14 @@ impl ConnectorBuilder { } } +#[cfg(any( + feature = "http2", + all(test, feature = "http1", any(feature = "aws-lc-rs", feature = "ring")) +))] +fn alpn(protocol: &'static [u8]) -> ApplicationProtocol<'static> { + protocol.into() +} + /// State of a builder with HTTP2 (and possibly HTTP1) enabled /// /// At this point a connector can be built, see @@ -398,7 +420,11 @@ impl ConnectorBuilder { mod tests { // Typical usage #[test] - #[cfg(all(feature = "webpki-roots", feature = "http1"))] + #[cfg(all( + feature = "webpki-roots", + feature = "http1", + any(feature = "aws-lc-rs", feature = "ring") + ))] fn test_builder() { ensure_global_state(); let _connector = super::ConnectorBuilder::new() @@ -409,15 +435,16 @@ mod tests { } #[test] - #[cfg(feature = "http1")] + #[cfg(all(feature = "http1", any(feature = "aws-lc-rs", feature = "ring")))] #[should_panic(expected = "ALPN protocols should not be pre-defined")] fn test_reject_predefined_alpn() { ensure_global_state(); let roots = rustls::RootCertStore::empty(); - let mut config_with_alpn = rustls::ClientConfig::builder() + let mut config_with_alpn = rustls::ClientConfig::builder(crate::config::default_provider()) .with_root_certificates(roots) - .with_no_client_auth(); - config_with_alpn.alpn_protocols = vec![b"fancyprotocol".to_vec()]; + .with_no_client_auth() + .unwrap(); + config_with_alpn.alpn_protocols = vec![super::alpn(b"fancyprotocol")]; let _connector = super::ConnectorBuilder::new() .with_tls_config(config_with_alpn) .https_only() @@ -426,13 +453,18 @@ mod tests { } #[test] - #[cfg(all(feature = "http1", feature = "http2"))] + #[cfg(all( + feature = "http1", + feature = "http2", + any(feature = "aws-lc-rs", feature = "ring") + ))] fn test_alpn() { ensure_global_state(); let roots = rustls::RootCertStore::empty(); - let tls_config = rustls::ClientConfig::builder() + let tls_config = rustls::ClientConfig::builder(crate::config::default_provider()) .with_root_certificates(roots) - .with_no_client_auth(); + .with_no_client_auth() + .unwrap(); let connector = super::ConnectorBuilder::new() .with_tls_config(tls_config.clone()) .https_only() @@ -447,7 +479,15 @@ mod tests { .https_only() .enable_http2() .build(); - assert_eq!(&connector.tls_config.alpn_protocols, &[b"h2".to_vec()]); + assert_eq!( + connector + .tls_config + .alpn_protocols + .iter() + .map(|protocol| protocol.as_ref()) + .collect::>(), + vec![b"h2".as_slice()] + ); let connector = super::ConnectorBuilder::new() .with_tls_config(tls_config.clone()) .https_only() @@ -455,8 +495,13 @@ mod tests { .enable_http2() .build(); assert_eq!( - &connector.tls_config.alpn_protocols, - &[b"h2".to_vec(), b"http/1.1".to_vec()] + connector + .tls_config + .alpn_protocols + .iter() + .map(|protocol| protocol.as_ref()) + .collect::>(), + vec![b"h2".as_slice(), b"http/1.1".as_slice()] ); let connector = super::ConnectorBuilder::new() .with_tls_config(tls_config) @@ -464,37 +509,60 @@ mod tests { .enable_all_versions() .build(); assert_eq!( - &connector.tls_config.alpn_protocols, - &[b"h2".to_vec(), b"http/1.1".to_vec()] + connector + .tls_config + .alpn_protocols + .iter() + .map(|protocol| protocol.as_ref()) + .collect::>(), + vec![b"h2".as_slice(), b"http/1.1".as_slice()] ); } #[test] - #[cfg(all(not(feature = "http1"), feature = "http2"))] + #[cfg(all( + not(feature = "http1"), + feature = "http2", + any(feature = "aws-lc-rs", feature = "ring") + ))] fn test_alpn_http2() { let roots = rustls::RootCertStore::empty(); - let tls_config = rustls::ClientConfig::builder() - .with_safe_defaults() + let tls_config = rustls::ClientConfig::builder(crate::config::default_provider()) .with_root_certificates(roots) - .with_no_client_auth(); + .with_no_client_auth() + .unwrap(); let connector = super::ConnectorBuilder::new() .with_tls_config(tls_config.clone()) .https_only() .enable_http2() .build(); - assert_eq!(&connector.tls_config.alpn_protocols, &[b"h2".to_vec()]); + assert_eq!( + connector + .tls_config + .alpn_protocols + .iter() + .map(|protocol| protocol.as_ref()) + .collect::>(), + vec![b"h2".as_slice()] + ); let connector = super::ConnectorBuilder::new() .with_tls_config(tls_config) .https_only() .enable_all_versions() .build(); - assert_eq!(&connector.tls_config.alpn_protocols, &[b"h2".to_vec()]); + assert_eq!( + connector + .tls_config + .alpn_protocols + .iter() + .map(|protocol| protocol.as_ref()) + .collect::>(), + vec![b"h2".as_slice()] + ); } + #[cfg(any(feature = "aws-lc-rs", feature = "ring"))] fn ensure_global_state() { - #[cfg(feature = "ring")] - let _ = rustls::crypto::ring::default_provider().install_default(); - #[cfg(feature = "aws-lc-rs")] - let _ = rustls::crypto::aws_lc_rs::default_provider().install_default(); + let _ = crate::config::default_provider(); } } diff --git a/src/lib.rs b/src/lib.rs index 0b11298..b2b8297 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -41,7 +41,7 @@ mod stream; #[cfg(feature = "logging")] mod log { - #[cfg(any(feature = "rustls-native-certs", feature = "webpki-roots"))] + #[cfg(feature = "rustls-native-certs")] pub(crate) use log::debug; #[cfg(feature = "rustls-native-certs")] pub(crate) use log::warn; @@ -49,9 +49,9 @@ mod log { #[cfg(not(feature = "logging"))] mod log { - #[cfg(any(feature = "rustls-native-certs", feature = "webpki-roots"))] + #[cfg(feature = "rustls-native-certs")] macro_rules! debug ( ($($tt:tt)*) => {{}} ); - #[cfg(any(feature = "rustls-native-certs", feature = "webpki-roots"))] + #[cfg(feature = "rustls-native-certs")] pub(crate) use debug; #[cfg(feature = "rustls-native-certs")] macro_rules! warn_ ( ($($tt:tt)*) => {{}} ); diff --git a/src/stream.rs b/src/stream.rs index 538aa29..0c99248 100644 --- a/src/stream.rs +++ b/src/stream.rs @@ -25,7 +25,10 @@ impl Connection for MaybeHttpsStre Self::Http(s) => s.connected(), Self::Https(s) => { let (tcp, tls) = s.inner().get_ref(); - if tls.alpn_protocol() == Some(b"h2") { + if tls + .alpn_protocol() + .is_some_and(|protocol| protocol.as_ref() == b"h2") + { tcp.inner().connected().negotiated_h2() } else { tcp.inner().connected()