feat: add rustls-webpki feature #16
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #15
This PR adds a new Cargo feature:
rustls-webpki. This allows users to use both therustlsTLS stack, as well as thewebpki-rootsstatic CA certificates, to enable a truly independent implementation.The basic idea is that now there are four primary versions of the library:
native-tls(default, using thetlsfeature)rustlsand native CA certificates (using therustlsfeature)rustlsand compiled-in CA certificates fromwebpki-roots(using therustls-webpkifeature)The two
rustlsfeatures build off a newrustls-basefeature, which sets up the common code betweenrustlsandrustls-webpki. The two user-facing features then configure theTlsConnectorinProxyConnector::newbased on their respective certificate store crates.One question i have about the initial implementation: Since i introduced a separate cargo feature (
rustls-base) to represent the commonrustlscode, there's a potential situation where someone deliberately sets therustls-basefeature without setting eitherrustlsorrustls-webpkito add certificates to the TLS configuration. This will create a situation where it looks like you can set up a TLS connection to the proxy, but nothing will succeed because there are no certificates loaded into the trust store for the connection. Should we set up a guard in the library code to emit acompile_error!()macro if this happens?Thanks for setting up this library! I'm looking forward to integrating it with my own. 😁