Skip to content

Conversation

@QuietMisdreavus
Copy link
Contributor

Closes #15

This PR adds a new Cargo feature: rustls-webpki. This allows users to use both the rustls TLS stack, as well as the webpki-roots static CA certificates, to enable a truly independent implementation.

The basic idea is that now there are four primary versions of the library:

  1. No TLS support (building with no features)
  2. TLS via native-tls (default, using the tls feature)
  3. TLS via rustls and native CA certificates (using the rustls feature)
  4. TLS via rustls and compiled-in CA certificates from webpki-roots (using the rustls-webpki feature)

The two rustls features build off a new rustls-base feature, which sets up the common code between rustls and rustls-webpki. The two user-facing features then configure the TlsConnector in ProxyConnector::new based on their respective certificate store crates.

One question i have about the initial implementation: Since i introduced a separate cargo feature (rustls-base) to represent the common rustls code, there's a potential situation where someone deliberately sets the rustls-base feature without setting either rustls or rustls-webpki to add certificates to the TLS configuration. This will create a situation where it looks like you can set up a TLS connection to the proxy, but nothing will succeed because there are no certificates loaded into the trust store for the connection. Should we set up a guard in the library code to emit a compile_error!() macro if this happens?

Thanks for setting up this library! I'm looking forward to integrating it with my own. 😁

@tafia
Copy link
Owner

tafia commented Jul 17, 2020

This is awesome!
Would you mind updating the readme with the same comment as the PR reagrding all the features?
Regarding rustls-base, I believe that documenting it is enough.

@QuietMisdreavus
Copy link
Contributor Author

I've added a new section to the readme about the features, and added a comment to the Cargo.toml about rustls-base. What do you think?

@tafia tafia merged commit 3ecaff6 into tafia:master Jul 20, 2020
@tafia
Copy link
Owner

tafia commented Jul 20, 2020

Awesome
Thanks! I'll publish ASAP

@QuietMisdreavus QuietMisdreavus deleted the webpki-roots branch July 21, 2020 18:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

webpki-roots support

2 participants