feat(tls): add an async-tls-rustls-no-provider backend

Cargo.toml

@@ -41,6 +41,7 @@ resumable-upload = ["dep:md5", "dep:sha2", "serde/derive"]
 # selected at runtime with `ClientBuilder::tls_backend`.
 async-tls-rustls-aws-lc-rs = ["_async", "dep:hyper-rustls", "dep:rustls", "dep:rustls-native-certs", "dep:webpki-roots", "hyper-rustls/aws-lc-rs", "rustls/aws_lc_rs"]
 async-tls-rustls-ring = ["_async", "dep:hyper-rustls", "dep:rustls", "dep:rustls-native-certs", "dep:webpki-roots", "hyper-rustls/ring", "rustls/ring"]
+async-tls-rustls-no-provider = ["_async", "dep:hyper-rustls", "dep:rustls", "dep:rustls-native-certs", "dep:webpki-roots"]
 async-tls-native = ["_async", "dep:hyper-tls", "hyper-tls/alpn"]
 blocking-tls-rustls-ring = ["_blocking", "dep:rustls", "dep:rustls-native-certs", "dep:webpki-root-certs", "ureq/rustls", "ureq/platform-verifier"]
 blocking-tls-rustls-aws-lc-rs = ["_blocking", "dep:rustls", "dep:rustls-native-certs", "dep:webpki-root-certs", "ureq/rustls-no-provider", "ureq/rustls-webpki-roots", "ureq/platform-verifier", "rustls/aws_lc_rs"]

src/async_client/builder.rs

@@ -54,6 +54,7 @@ const DEFAULT_MAX_RESPONSE_BODY_BYTES: usize = 8 * 1024 * 1024;
     doc(cfg(any(
         feature = "async-tls-rustls-ring",
         feature = "async-tls-rustls-aws-lc-rs",
+        feature = "async-tls-rustls-no-provider",
         feature = "async-tls-native"
     )))
 )]

src/async_client/mod.rs

@@ -36,6 +36,7 @@ use transport::TransportClient;
     doc(cfg(any(
         feature = "async-tls-rustls-ring",
         feature = "async-tls-rustls-aws-lc-rs",
+        feature = "async-tls-rustls-no-provider",
         feature = "async-tls-native"
     )))
 )]

src/async_client/request.rs

@@ -63,6 +63,7 @@ enum ContentLengthSource {
     doc(cfg(any(
         feature = "async-tls-rustls-ring",
         feature = "async-tls-rustls-aws-lc-rs",
+        feature = "async-tls-rustls-no-provider",
         feature = "async-tls-native"
     )))
 )]

src/async_client/transport.rs

@@ -1,6 +1,7 @@
 #[cfg(any(
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 use std::sync::Arc;
 use std::time::Duration;
@@ -9,61 +10,70 @@ use http::{Request, Response as HttpResponse};
 use hyper::body::Incoming;
 #[cfg(any(
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 use hyper_rustls::HttpsConnectorBuilder;
 #[cfg(any(
     feature = "async-tls-native",
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 use hyper_util::client::legacy::Client as HyperClient;
 #[cfg(any(
     feature = "async-tls-native",
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 use hyper_util::rt::TokioExecutor;
 #[cfg(any(
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 use tracing::warn;
 
 use super::proxy::ProxyConnector;
 #[cfg(any(
     feature = "async-tls-rustls-ring",
     feature = "async-tls-rustls-aws-lc-rs",
-    feature = "async-tls-native"
+    feature = "async-tls-native",
+    feature = "async-tls-rustls-no-provider"
 ))]
 use super::transport_error::classify_transport_error;
 use crate::async_client::body::ReqBody;
 use crate::core::error::Error;
 #[cfg(any(
     feature = "async-tls-native",
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 use crate::core::error::transport_error;
 use crate::core::execution::RequestExecutionState;
 use crate::core::util::duration_millis_ceil;
 #[cfg(any(
     feature = "async-tls-rustls-ring",
     feature = "async-tls-rustls-aws-lc-rs",
-    feature = "async-tls-native"
+    feature = "async-tls-native",
+    feature = "async-tls-rustls-no-provider"
 ))]
 use crate::tls::tls_config_error;
 use crate::tls::{TlsBackend, TlsOptions};
 #[cfg(any(
     feature = "async-tls-native",
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 use crate::tls::{TlsClientIdentity, TlsRootCertificate, TlsRootStore, TlsVersion};
 #[cfg(any(
     feature = "async-tls-rustls-ring",
     feature = "async-tls-rustls-aws-lc-rs",
-    feature = "async-tls-native"
+    feature = "async-tls-native",
+    feature = "async-tls-rustls-no-provider"
 ))]
 use crate::tls::{parse_pem_certificate_blocks, tls_version_bounds};
 
@@ -80,10 +90,18 @@ const DEFAULT_TLS_BACKEND: TlsBackend = TlsBackend::RustlsAwsLcRs;
     feature = "async-tls-native"
 ))]
 const DEFAULT_TLS_BACKEND: TlsBackend = TlsBackend::NativeTls;
+#[cfg(all(
+    not(feature = "async-tls-rustls-ring"),
+    not(feature = "async-tls-rustls-aws-lc-rs"),
+    not(feature = "async-tls-native"),
+    feature = "async-tls-rustls-no-provider"
+))]
+const DEFAULT_TLS_BACKEND: TlsBackend = TlsBackend::RustlsNoProvider;
 #[cfg(not(any(
     feature = "async-tls-rustls-ring",
     feature = "async-tls-rustls-aws-lc-rs",
-    feature = "async-tls-native"
+    feature = "async-tls-native",
+    feature = "async-tls-rustls-no-provider"
 )))]
 const DEFAULT_TLS_BACKEND: TlsBackend = TlsBackend::RustlsRing;
 
@@ -93,7 +111,8 @@ pub(super) fn default_tls_backend() -> TlsBackend {
 
 #[cfg(any(
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 fn add_custom_rustls_root_certificates(
     tls_backend: TlsBackend,
@@ -145,7 +164,8 @@ fn add_custom_rustls_root_certificates(
 
 #[cfg(any(
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 fn build_rustls_root_store(
     tls_backend: TlsBackend,
@@ -214,7 +234,8 @@ fn build_rustls_root_store(
 
 #[cfg(any(
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 pub(crate) fn configured_rustls_protocol_versions(
     tls_backend: TlsBackend,
@@ -237,7 +258,8 @@ pub(crate) fn configured_rustls_protocol_versions(
 
 #[cfg(any(
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 fn build_rustls_tls_config(
     tls_backend: TlsBackend,
@@ -310,12 +332,14 @@ fn build_rustls_tls_config(
 
 #[cfg(any(
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 type RustlsHttpsConnector = hyper_rustls::HttpsConnector<ProxyConnector>;
 #[cfg(any(
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 type RustlsHyperClient = HyperClient<RustlsHttpsConnector, ReqBody>;
 
@@ -328,7 +352,8 @@ type NativeHyperClient = HyperClient<NativeHttpsConnector, ReqBody>;
 pub(super) enum TransportClient {
     #[cfg(any(
         feature = "async-tls-rustls-ring",
-        feature = "async-tls-rustls-aws-lc-rs"
+        feature = "async-tls-rustls-aws-lc-rs",
+        feature = "async-tls-rustls-no-provider"
     ))]
     Rustls(RustlsHyperClient),
     #[cfg(feature = "async-tls-native")]
@@ -343,13 +368,15 @@ impl TransportClient {
         #[cfg(any(
             feature = "async-tls-native",
             feature = "async-tls-rustls-ring",
-            feature = "async-tls-rustls-aws-lc-rs"
+            feature = "async-tls-rustls-aws-lc-rs",
+            feature = "async-tls-rustls-no-provider"
         ))]
         {
             match self {
                 #[cfg(any(
                     feature = "async-tls-rustls-ring",
-                    feature = "async-tls-rustls-aws-lc-rs"
+                    feature = "async-tls-rustls-aws-lc-rs",
+                    feature = "async-tls-rustls-no-provider"
                 ))]
                 Self::Rustls(client) => client
                     .request(request)
@@ -365,7 +392,8 @@ impl TransportClient {
         #[cfg(not(any(
             feature = "async-tls-native",
             feature = "async-tls-rustls-ring",
-            feature = "async-tls-rustls-aws-lc-rs"
+            feature = "async-tls-rustls-aws-lc-rs",
+            feature = "async-tls-rustls-no-provider"
         )))]
         {
             let _ = self;
@@ -381,14 +409,16 @@ pub(super) enum TransportRequestError {
     #[cfg(any(
         feature = "async-tls-rustls-ring",
         feature = "async-tls-rustls-aws-lc-rs",
-        feature = "async-tls-native"
+        feature = "async-tls-native",
+        feature = "async-tls-rustls-no-provider"
     ))]
     Transport(hyper_util::client::legacy::Error),
     Timeout,
     #[cfg(not(any(
         feature = "async-tls-rustls-ring",
         feature = "async-tls-rustls-aws-lc-rs",
-        feature = "async-tls-native"
+        feature = "async-tls-native",
+        feature = "async-tls-rustls-no-provider"
     )))]
     TlsBackendUnavailable {
         backend: &'static str,
@@ -405,7 +435,8 @@ impl TransportRequestError {
             #[cfg(any(
                 feature = "async-tls-rustls-ring",
                 feature = "async-tls-rustls-aws-lc-rs",
-                feature = "async-tls-native"
+                feature = "async-tls-native",
+                feature = "async-tls-rustls-no-provider"
             ))]
             Self::Transport(source) => transport_error(
                 classify_transport_error(&source),
@@ -419,7 +450,8 @@ impl TransportRequestError {
             #[cfg(not(any(
                 feature = "async-tls-rustls-ring",
                 feature = "async-tls-rustls-aws-lc-rs",
-                feature = "async-tls-native"
+                feature = "async-tls-native",
+                feature = "async-tls-rustls-no-provider"
             )))]
             Self::TlsBackendUnavailable { backend } => Error::TlsBackendUnavailable { backend },
         }
@@ -428,7 +460,8 @@ impl TransportRequestError {
 
 #[cfg(any(
     feature = "async-tls-rustls-ring",
-    feature = "async-tls-rustls-aws-lc-rs"
+    feature = "async-tls-rustls-aws-lc-rs",
+    feature = "async-tls-rustls-no-provider"
 ))]
 fn build_rustls_transport(
     tls_config: rustls::ClientConfig,
@@ -527,6 +560,48 @@ fn build_rustls_aws_lc_rs_transport(
     })
 }
 
+#[cfg(feature = "async-tls-rustls-no-provider")]
+fn build_rustls_no_provider_transport(
+    connector: ProxyConnector,
+    tls_options: &TlsOptions,
+    pool_idle_timeout: Duration,
+    pool_max_idle_per_host: usize,
+    http2_only: bool,
+) -> crate::Result<TransportClient> {
+    let provider = rustls::crypto::CryptoProvider::get_default()
+        .cloned()
+        .ok_or_else(|| Error::TlsBackendInit {
+            backend: TlsBackend::RustlsNoProvider.as_str(),
+            message: "no rustls CryptoProvider is installed as the process-wide default; \
+                install one (e.g. rustls-graviola) via \
+                rustls::crypto::CryptoProvider::install_default(...) before building a client \
+                with the async-tls-rustls-no-provider backend"
+                .to_string(),
+        })?;
+    let tls_config = build_rustls_tls_config(TlsBackend::RustlsNoProvider, provider, tls_options)?;
+
+    Ok(build_rustls_transport(
+        tls_config,
+        connector,
+        pool_idle_timeout,
+        pool_max_idle_per_host,
+        http2_only,
+    ))
+}
+
+#[cfg(not(feature = "async-tls-rustls-no-provider"))]
+fn build_rustls_no_provider_transport(
+    _connector: ProxyConnector,
+    _tls_options: &TlsOptions,
+    _pool_idle_timeout: Duration,
+    _pool_max_idle_per_host: usize,
+    _http2_only: bool,
+) -> crate::Result<TransportClient> {
+    Err(Error::TlsBackendUnavailable {
+        backend: TlsBackend::RustlsNoProvider.as_str(),
+    })
+}
+
 #[cfg(feature = "async-tls-native")]
 fn native_tls_protocol(version: TlsVersion) -> hyper_tls::native_tls::Protocol {
     match version {
@@ -723,6 +798,13 @@ pub(super) fn build_transport_client(
             pool_max_idle_per_host,
             http2_only,
         ),
+        TlsBackend::RustlsNoProvider => build_rustls_no_provider_transport(
+            connector,
+            tls_options,
+            pool_idle_timeout,
+            pool_max_idle_per_host,
+            http2_only,
+        ),
         TlsBackend::NativeTls => build_native_tls_transport(
             connector,
             tls_options,

src/blocking_client/transport.rs

@@ -47,6 +47,8 @@ pub(super) fn backend_is_available(backend: TlsBackend) -> bool {
         TlsBackend::RustlsRing => cfg!(feature = "blocking-tls-rustls-ring"),
         TlsBackend::RustlsAwsLcRs => cfg!(feature = "blocking-tls-rustls-aws-lc-rs"),
         TlsBackend::NativeTls => cfg!(feature = "blocking-tls-native"),
+        // `async-tls-rustls-no-provider` has no blocking `ureq` counterpart.
+        TlsBackend::RustlsNoProvider => false,
     }
 }
 
@@ -179,6 +181,13 @@ fn build_sync_tls_config(
     let provider = match backend {
         TlsBackend::RustlsRing | TlsBackend::RustlsAwsLcRs => ureq::tls::TlsProvider::Rustls,
         TlsBackend::NativeTls => ureq::tls::TlsProvider::NativeTls,
+        // Unreachable in practice: `backend_is_available` above already
+        // rejects `RustlsNoProvider`, which has no blocking `ureq` counterpart.
+        TlsBackend::RustlsNoProvider => {
+            return Err(crate::error::Error::TlsBackendUnavailable {
+                backend: backend.as_str(),
+            });
+        }
     };
 
     let mut tls_config_builder = ureq::tls::TlsConfig::builder().provider(provider);

src/core/util/transport_error.rs

@@ -40,6 +40,7 @@ pub(crate) fn is_tls_error(error: &(dyn std::error::Error + 'static)) -> bool {
         #[cfg(any(
             feature = "async-tls-rustls-ring",
             feature = "async-tls-rustls-aws-lc-rs",
+            feature = "async-tls-rustls-no-provider",
             feature = "blocking-tls-rustls-ring",
             feature = "blocking-tls-rustls-aws-lc-rs"
         ))]

src/http/response.rs

@@ -215,6 +215,7 @@ mod blocking_stream;
     doc(cfg(any(
         feature = "async-tls-rustls-ring",
         feature = "async-tls-rustls-aws-lc-rs",
+        feature = "async-tls-rustls-no-provider",
         feature = "async-tls-native"
     )))
 )]

src/http/response/async_stream.rs

@@ -448,6 +448,7 @@ impl std::fmt::Debug for StreamBody {
     doc(cfg(any(
         feature = "async-tls-rustls-ring",
         feature = "async-tls-rustls-aws-lc-rs",
+        feature = "async-tls-rustls-no-provider",
         feature = "async-tls-native"
     )))
 )]