Skip to content

Commit 449f27c

Browse files
duncanistaduncanista
committed
refactor: separate TLS plumbing from crypto provider selection
Introduce tls-core feature for TLS plumbing (rustls, hyper-rustls, tokio-rustls, rustls-native-certs) without a crypto provider. The https and fips features now both build on tls-core and add their respective provider: - https = tls-core + ring - fips = tls-core + aws-lc-rs (via hyper-rustls/fips) This ensures FIPS builds only compile aws-lc-rs without ring, avoiding unnecessary binary bloat from shipping both crypto backends. Updated all cfg(feature = "https") gates to cfg(feature = "tls-core") so TLS code compiles under both https and fips features.
1 parent b47664a commit 449f27c

3 files changed

Lines changed: 22 additions & 20 deletions

File tree

‎libdd-common/Cargo.toml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,14 +45,13 @@ tokio-rustls = { version = "0.26", default-features = false, optional = true }
4545
serde = { version = "1.0", features = ["derive"] }
4646
static_assertions = "1.1.0"
4747
const_format = "0.2.34"
48-
# Use ring as the default crypto provider for non-FIPS builds on all platforms.
49-
# FIPS builds activate aws-lc-rs via the hyper-rustls/fips feature instead.
50-
rustls = { version = "0.23.37", default-features = false, optional = true, features = ["ring"] }
48+
# Declare rustls and hyper-rustls without a crypto provider. The provider is
49+
# selected via features: `https` enables ring, `fips` enables aws-lc-rs.
50+
rustls = { version = "0.23.37", default-features = false, optional = true }
5151
hyper-rustls = { version = "0.27.7", default-features = false, features = [
5252
"native-tokio",
5353
"http1",
5454
"tls12",
55-
"ring",
5655
], optional = true }
5756

5857
[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
@@ -91,13 +90,16 @@ tokio = { version = "1.23", features = ["rt", "macros", "time"] }
9190

9291
[features]
9392
default = ["https"]
94-
https = ["tokio-rustls", "rustls", "hyper-rustls", "rustls-native-certs"]
93+
# TLS plumbing without a crypto provider. Use `https` or `fips` to select one.
94+
tls-core = ["tokio-rustls", "rustls", "hyper-rustls", "rustls-native-certs"]
95+
# Default HTTPS: ring as crypto provider
96+
https = ["tls-core", "rustls/ring", "hyper-rustls/ring"]
9597
use_webpki_roots = ["hyper-rustls/webpki-roots"]
9698
# Enable this feature to enable stubbing of cgroup
9799
# php directly import this crate and uses functions gated by this feature for their test
98100
cgroup_testing = []
99101
# FIPS mode uses the FIPS-compliant cryptographic provider (Unix only)
100-
fips = ["https", "hyper-rustls/fips"]
102+
fips = ["tls-core", "hyper-rustls/fips"]
101103
# Enable reqwest client builder support with file dump debugging
102104
reqwest = ["dep:reqwest", "test-utils"]
103105
# Enable test utilities for use in other crates

‎libdd-common/src/connector/conn_stream.rs‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ pub enum ConnStream {
1717
#[pin]
1818
transport: TokioIo<tokio::net::TcpStream>,
1919
},
20-
#[cfg(feature = "https")]
20+
#[cfg(feature = "tls-core")]
2121
Tls {
2222
#[pin]
2323
transport:
@@ -84,7 +84,7 @@ impl ConnStream {
8484
})
8585
}
8686

87-
#[cfg(feature = "https")]
87+
#[cfg(feature = "tls-core")]
8888
pub fn from_https_connector_with_uri(
8989
c: &mut hyper_rustls::HttpsConnector<connect::HttpConnector>,
9090
uri: hyper::Uri,
@@ -119,7 +119,7 @@ impl hyper::rt::Read for ConnStream {
119119
) -> Poll<std::io::Result<()>> {
120120
match self.project() {
121121
ConnStreamProj::Tcp { transport } => transport.poll_read(cx, buf),
122-
#[cfg(feature = "https")]
122+
#[cfg(feature = "tls-core")]
123123
ConnStreamProj::Tls { transport } => transport.poll_read(cx, buf),
124124
#[cfg(unix)]
125125
ConnStreamProj::Udp { transport } => transport.poll_read(cx, buf),
@@ -133,7 +133,7 @@ impl connect::Connection for ConnStream {
133133
fn connected(&self) -> connect::Connected {
134134
match self {
135135
Self::Tcp { transport } => transport.connected(),
136-
#[cfg(feature = "https")]
136+
#[cfg(feature = "tls-core")]
137137
Self::Tls { transport } => {
138138
let (tcp, _) = transport.inner().get_ref();
139139
tcp.inner().inner().connected()
@@ -154,7 +154,7 @@ impl hyper::rt::Write for ConnStream {
154154
) -> Poll<Result<usize, std::io::Error>> {
155155
match self.project() {
156156
ConnStreamProj::Tcp { transport } => transport.poll_write(cx, buf),
157-
#[cfg(feature = "https")]
157+
#[cfg(feature = "tls-core")]
158158
ConnStreamProj::Tls { transport } => transport.poll_write(cx, buf),
159159
#[cfg(unix)]
160160
ConnStreamProj::Udp { transport } => transport.poll_write(cx, buf),
@@ -169,7 +169,7 @@ impl hyper::rt::Write for ConnStream {
169169
) -> Poll<Result<(), std::io::Error>> {
170170
match self.project() {
171171
ConnStreamProj::Tcp { transport } => transport.poll_shutdown(cx),
172-
#[cfg(feature = "https")]
172+
#[cfg(feature = "tls-core")]
173173
ConnStreamProj::Tls { transport } => transport.poll_shutdown(cx),
174174
#[cfg(unix)]
175175
ConnStreamProj::Udp { transport } => transport.poll_shutdown(cx),
@@ -181,7 +181,7 @@ impl hyper::rt::Write for ConnStream {
181181
fn poll_flush(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Result<(), std::io::Error>> {
182182
match self.project() {
183183
ConnStreamProj::Tcp { transport } => transport.poll_flush(cx),
184-
#[cfg(feature = "https")]
184+
#[cfg(feature = "tls-core")]
185185
ConnStreamProj::Tls { transport } => transport.poll_flush(cx),
186186
#[cfg(unix)]
187187
ConnStreamProj::Udp { transport } => transport.poll_flush(cx),

‎libdd-common/src/connector/mod.rs‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ use conn_stream::{ConnStream, ConnStreamError};
2323
#[derive(Clone)]
2424
pub enum Connector {
2525
Http(connect::HttpConnector),
26-
#[cfg(feature = "https")]
26+
#[cfg(feature = "tls-core")]
2727
Https(hyper_rustls::HttpsConnector<connect::HttpConnector>),
2828
}
2929

@@ -39,7 +39,7 @@ impl Connector {
3939
/// Make sure this function is not called frequently. Fetching the root certificates is an
4040
/// expensive operation. Access the globally cached connector via Connector::default().
4141
fn new() -> Self {
42-
#[cfg(feature = "https")]
42+
#[cfg(feature = "tls-core")]
4343
{
4444
#[cfg(feature = "use_webpki_roots")]
4545
let https_connector_fn = https::build_https_connector_with_webpki_roots;
@@ -51,7 +51,7 @@ impl Connector {
5151
Err(_) => Connector::Http(connect::HttpConnector::new()),
5252
}
5353
}
54-
#[cfg(not(feature = "https"))]
54+
#[cfg(not(feature = "tls-core"))]
5555
{
5656
Connector::Http(connect::HttpConnector::new())
5757
}
@@ -73,15 +73,15 @@ impl Connector {
7373
ConnStream::from_http_connector_with_uri(c, uri).boxed()
7474
}
7575
}
76-
#[cfg(feature = "https")]
76+
#[cfg(feature = "tls-core")]
7777
Self::Https(c) => {
7878
ConnStream::from_https_connector_with_uri(c, uri, require_tls).boxed()
7979
}
8080
}
8181
}
8282
}
8383

84-
#[cfg(feature = "https")]
84+
#[cfg(feature = "tls-core")]
8585
mod https {
8686
#[cfg(feature = "use_webpki_roots")]
8787
use hyper_rustls::ConfigBuilderExt;
@@ -185,7 +185,7 @@ impl tower_service::Service<hyper::Uri> for Connector {
185185
fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
186186
match self {
187187
Connector::Http(c) => c.poll_ready(cx).map_err(|e| e.into()),
188-
#[cfg(feature = "https")]
188+
#[cfg(feature = "tls-core")]
189189
Connector::Https(c) => c.poll_ready(cx),
190190
}
191191
}
@@ -238,7 +238,7 @@ mod tests {
238238
#[test]
239239
#[cfg_attr(miri, ignore)]
240240
#[cfg(feature = "use_webpki_roots")]
241-
#[cfg(feature = "https")]
241+
#[cfg(feature = "tls-core")]
242242
/// Verify that Connector builds an Https connector using webpki certificates
243243
/// even when native root certificates are not available.
244244
fn test_missing_root_certificates_use_webpki_certificates() {

0 commit comments

Comments
 (0)