Separate default-tls and native-tls features

To allow for the default-tls to change to a different backend by default, this adds a new `native-tls` optional feature. Any TLS feature that was only available using native-tls now requires the `native-tls` feature to be enabled.
seanmonstar · Dec 20, 2019 · 143649d · 143649d
1 parent 18fd9a6
commit 143649d
Show file tree

Hide file tree

Showing 7 changed files with 125 additions and 52 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -55,6 +55,7 @@ jobs:
           - windows / stable-i686-gnu
           - "feat.: default-tls disabled"
           - "feat.: rustls-tls"
+          - "feat.: native-tls"
           - "feat.: default-tls and rustls-tls"
           - "feat.: cookies"
           - "feat.: blocking"
@@ -100,6 +101,8 @@ jobs:
             features: "--no-default-features"
           - name: "feat.: rustls-tls"
             features: "--no-default-features --features rustls-tls"
+          - name: "feat.: native-tls"
+            features: "--features native-tls"
           - name: "feat.: default-tls and rustls-tls"
             features: "--features rustls-tls"
           - name: "feat.: cookies"
@@ -141,6 +144,47 @@ jobs:
           command: test
           args: ${{ matrix.features }} ${{ matrix.test-features }} -- --test-threads=1
 
+  # Separate build job to just `cargo check` with various feature
+  # combinations enabled.
+  features:
+    name: features checking
+    needs: [style]
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        name:
+          - "check: native-tls"
+          - "check: native-tls + default-tls"
+          - "check: native-tls + rustls-tls"
+          - "check: native-tls + rustls-tls + default-tls"
+        include:
+          - name: "check: native-tls"
+            features: "native-tls"
+          - name: "check: native-tls + default-tls"
+            features: "native-tls,default-tls"
+          - name: "check: native-tls + rustls-tls"
+            features: "native-tls,rustls-tls"
+          - name: "check: native-tls + rustls-tls + default-tls"
+            features: "native-tls,rustls-tls,default-tls"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v1
+
+      - name: Install rust
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: nightly
+          profile: minimal
+          override: true
+
+      - name: Check
+        uses: actions-rs/cargo@v1
+        with:
+          command: check
+          args: --profile test --no-default-features --features ${{ matrix.features }}
+
+
   # Separate build job for nightly because of the missing feature for allowed failures at
   # job level. See `jobs.build.strategy.matrix`.
   nightly:

diff --git a/Cargo.toml b/Cargo.toml
@@ -20,8 +20,13 @@ default = ["default-tls"]
 
 tls = []
 
-default-tls = ["hyper-tls", "native-tls", "tls", "tokio-tls"]
-default-tls-vendored = ["default-tls", "native-tls/vendored"]
+# Note: this doesn't enable the 'native-tls' feature, which adds specific
+# functionality for it.
+default-tls = ["hyper-tls", "native-tls-crate", "tls", "tokio-tls"]
+
+# Enables native-tls specific functionality not available by default.
+native-tls = ["default-tls"]
+native-tls-vendored = ["native-tls", "native-tls-crate/vendored"]
 
 rustls-tls = ["hyper-rustls", "tokio-rustls", "webpki-roots", "rustls", "tls"]
 
@@ -74,7 +79,7 @@ serde_urlencoded = "0.6.1"
 
 ## default-tls
 hyper-tls = { version = "0.4", optional = true }
-native-tls = { version = "0.2", optional = true }
+native-tls-crate = { version = "0.2", optional = true, package = "native-tls" }
 tokio-tls = { version = "0.3.0", optional = true }
 
 # rustls-tls

diff --git a/src/async_impl/client.rs b/src/async_impl/client.rs
@@ -13,8 +13,8 @@ use http::header::{
 use http::Uri;
 use http::uri::Scheme;
 use hyper::client::ResponseFuture;
-#[cfg(feature = "default-tls")]
-use native_tls::TlsConnector;
+#[cfg(feature = "native-tls-crate")]
+use native_tls_crate::TlsConnector;
 use std::future::Future;
 use std::pin::Pin;
 use std::task::{Context, Poll};
@@ -60,7 +60,7 @@ struct Config {
     // NOTE: When adding a new field, update `fmt::Debug for ClientBuilder`
     gzip: bool,
     headers: HeaderMap,
-    #[cfg(feature = "default-tls")]
+    #[cfg(feature = "native-tls")]
     hostname_verification: bool,
     #[cfg(feature = "tls")]
     certs_verification: bool,
@@ -106,7 +106,7 @@ impl ClientBuilder {
             config: Config {
                 gzip: cfg!(feature = "gzip"),
                 headers,
-                #[cfg(feature = "default-tls")]
+                #[cfg(feature = "native-tls")]
                 hostname_verification: true,
                 #[cfg(feature = "tls")]
                 certs_verification: true,
@@ -160,15 +160,24 @@ impl ClientBuilder {
                 #[cfg(feature = "default-tls")]
                 TlsBackend::Default => {
                     let mut tls = TlsConnector::builder();
-                    tls.danger_accept_invalid_hostnames(!config.hostname_verification);
+
+                    #[cfg(feature = "native-tls")]
+                    {
+                        tls.danger_accept_invalid_hostnames(!config.hostname_verification);
+                    }
+
                     tls.danger_accept_invalid_certs(!config.certs_verification);
 
                     for cert in config.root_certs {
                         cert.add_to_native_tls(&mut tls);
                     }
 
-                    if let Some(id) = config.identity {
-                        id.add_to_native_tls(&mut tls)?;
+
+                    #[cfg(feature = "native-tls")]
+                    {
+                        if let Some(id) = config.identity {
+                            id.add_to_native_tls(&mut tls)?;
+                        }
                     }
 
                     Connector::new_default_tls(
@@ -511,8 +520,8 @@ impl ClientBuilder {
     ///
     /// # Optional
     ///
-    /// This requires the optional `default-tls` or `rustls-tls` feature to be
-    /// enabled.
+    /// This requires the optional `default-tls`, `native-tls`, or `rustls-tls`
+    /// feature to be enabled.
     #[cfg(feature = "tls")]
     pub fn add_root_certificate(mut self, cert: Certificate) -> ClientBuilder {
         self.config.root_certs.push(cert);
@@ -523,7 +532,7 @@ impl ClientBuilder {
     ///
     /// # Optional
     ///
-    /// This requires the optional `default-tls` or `rustls-tls` feature to be
+    /// This requires the optional `native-tls` or `rustls-tls` feature to be
     /// enabled.
     #[cfg(feature = "tls")]
     pub fn identity(mut self, identity: Identity) -> ClientBuilder {
@@ -544,8 +553,8 @@ impl ClientBuilder {
     ///
     /// # Optional
     ///
-    /// This requires the optional `default-tls` feature to be enabled.
-    #[cfg(feature = "default-tls")]
+    /// This requires the optional `native-tls` feature to be enabled.
+    #[cfg(feature = "native-tls")]
     pub fn danger_accept_invalid_hostnames(
         mut self,
         accept_invalid_hostname: bool,
@@ -568,8 +577,8 @@ impl ClientBuilder {
     ///
     /// # Optional
     ///
-    /// This requires the optional `default-tls` or `rustls-tls` feature to be
-    /// enabled.
+    /// This requires the optional `default-tls`, `native-tls`, or `rustls-tls`
+    /// feature to be enabled.
     #[cfg(feature = "tls")]
     pub fn danger_accept_invalid_certs(mut self, accept_invalid_certs: bool) -> ClientBuilder {
         self.config.certs_verification = !accept_invalid_certs;
@@ -583,9 +592,9 @@ impl ClientBuilder {
     ///
     /// # Optional
     ///
-    /// This requires the optional `default-tls` feature to be enabled.
-    #[cfg(feature = "default-tls")]
-    pub fn use_default_tls(mut self) -> ClientBuilder {
+    /// This requires the optional `native-tls` feature to be enabled.
+    #[cfg(feature = "native-tls")]
+    pub fn use_native_tls(mut self) -> ClientBuilder {
         self.config.tls = TlsBackend::Default;
         self
     }
@@ -888,7 +897,7 @@ impl Config {
             f.field("tcp_nodelay", &true);
         }
 
-        #[cfg(feature = "default-tls")]
+        #[cfg(feature = "native-tls")]
         {
             if !self.hostname_verification {
                 f.field("danger_accept_invalid_hostnames", &true);
@@ -902,7 +911,7 @@ impl Config {
             }
         }
 
-        #[cfg(all(feature = "default-tls", feature = "rustls-tls"))]
+        #[cfg(all(feature = "native-tls-crate", feature = "rustls-tls"))]
         {
             f.field("tls_backend", &self.tls);
         }

diff --git a/src/blocking/client.rs b/src/blocking/client.rs
@@ -331,8 +331,8 @@ impl ClientBuilder {
     ///
     /// # Optional
     ///
-    /// This requires the optional `default-tls` or `rustls-tls` feature to be
-    /// enabled.
+    /// This requires the optional `default-tls`, `native-tls`, or `rustls-tls`
+    /// feature to be enabled.
     #[cfg(feature = "tls")]
     pub fn add_root_certificate(self, cert: Certificate) -> ClientBuilder {
         self.with_inner(move |inner| inner.add_root_certificate(cert))
@@ -349,12 +349,12 @@ impl ClientBuilder {
     /// // read a local PKCS12 bundle
     /// let mut buf = Vec::new();
     ///
-    /// #[cfg(feature = "default-tls")]
+    /// #[cfg(feature = "native-tls")]
     /// File::open("my-ident.pfx")?.read_to_end(&mut buf)?;
     /// #[cfg(feature = "rustls-tls")]
     /// File::open("my-ident.pem")?.read_to_end(&mut buf)?;
     ///
-    /// #[cfg(feature = "default-tls")]
+    /// #[cfg(feature = "native-tls")]
     /// // create an Identity from the PKCS#12 archive
     /// let pkcs12 = reqwest::Identity::from_pkcs12_der(&buf, "my-privkey-password")?;
     /// #[cfg(feature = "rustls-tls")]
@@ -384,7 +384,10 @@ impl ClientBuilder {
     /// hostname verification is not used, any valid certificate for any
     /// site will be trusted for use from any other. This introduces a
     /// significant vulnerability to man-in-the-middle attacks.
-    #[cfg(feature = "default-tls")]
+    /// # Optional
+    ///
+    /// This requires the optional `native-tls` feature to be enabled.
+    #[cfg(feature = "native-tls")]
     pub fn danger_accept_invalid_hostnames(self, accept_invalid_hostname: bool) -> ClientBuilder {
         self.with_inner(|inner| inner.danger_accept_invalid_hostnames(accept_invalid_hostname))
     }
@@ -412,10 +415,10 @@ impl ClientBuilder {
     ///
     /// # Optional
     ///
-    /// This requires the optional `default-tls` feature to be enabled.
-    #[cfg(feature = "default-tls")]
-    pub fn use_default_tls(self) -> ClientBuilder {
-        self.with_inner(move |inner| inner.use_default_tls())
+    /// This requires the optional `native-tls` feature to be enabled.
+    #[cfg(feature = "native-tls")]
+    pub fn use_native_tls(self) -> ClientBuilder {
+        self.with_inner(move |inner| inner.use_native_tls())
     }
 
     /// Force using the Rustls TLS backend.

diff --git a/src/connect.rs b/src/connect.rs
@@ -3,8 +3,8 @@ use http::uri::{Scheme, Authority};
 use http::Uri;
 use hyper::client::connect::{Connected, Connection};
 use tokio::io::{AsyncRead, AsyncWrite};
-#[cfg(feature = "default-tls")]
-use native_tls::{TlsConnector, TlsConnectorBuilder};
+#[cfg(feature = "native-tls-crate")]
+use native_tls_crate::{TlsConnector, TlsConnectorBuilder};
 #[cfg(feature = "tls")]
 use http::header::HeaderValue;
 use bytes::{Buf, BufMut};