From d10d9335e80ccd94183fa6a950cba68fcbfeae48 Mon Sep 17 00:00:00 2001 From: Evan Pierce Date: Mon, 13 Jul 2026 11:05:21 -0700 Subject: [PATCH] aws-lc-rs feature Signed-off-by: Evan Pierce --- Cargo.toml | 7 +++++-- README.md | 10 ++++++++-- src/client.rs | 26 +++++++++++++------------- src/lib.rs | 4 ++-- src/openssl_tls/transport.rs | 4 ++-- 5 files changed, 30 insertions(+), 21 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index e52d4a2..3b1fac0 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -13,10 +13,13 @@ documentation = "https://docs.rs/etcd-client/" keywords = ["etcd", "v3", "api", "client", "async"] [features] -tls = ["tonic/tls-ring"] +tls = ["tls-ring"] +tls-ring = ["_tls", "tonic/tls-ring"] +tls-aws-lc = ["_tls", "tonic/tls-aws-lc"] +_tls = [] tls-openssl = ["openssl", "hyper-openssl", "hyper", "hyper-util"] tls-openssl-vendored = ["tls-openssl", "openssl/vendored"] -tls-roots = ["tls", "tonic/tls-native-roots"] +tls-roots = ["_tls", "tonic/tls-native-roots"] pub-response-field = ["visible"] build-server = ["pub-response-field"] raw-channel = [] diff --git a/README.md b/README.md index 1387051..d7cd607 100644 --- a/README.md +++ b/README.md @@ -86,9 +86,15 @@ Examples can be found in [`examples`](./examples). ## Feature Flags -- `tls`: Enables the `rustls`-based TLS connection. Not enabled by default. +- `tls`: Enables the `rustls`-based TLS connection using the `ring` libcrypto provider. + Alias for `tls-ring`. Not enabled by default. +- `tls-ring`: Enables the `rustls`-based TLS connection using the `ring` libcrypto provider. + Not enabled by default. +- `tls-aws-lc`: Enables the `rustls`-based TLS connection using the `aws-lc-rs` libcrypto + provider. Not enabled by default. - `tls-roots`: Adds system trust roots to `rustls`-based TLS connection using the - `rustls-native-certs` crate. Not enabled by default. + `rustls-native-certs` crate. Provider-neutral: combine with `tls`/`tls-ring` or + `tls-aws-lc`. Not enabled by default. - `pub-response-field`: Exposes structs used to create regular `etcd-client` responses including internal protobuf representations. Useful for mocking. Not enabled by default. - `tls-openssl`: Enables the `openssl`-based TLS connections. This would make your binary diff --git a/src/client.rs b/src/client.rs index 623e82f..a051ef9 100644 --- a/src/client.rs +++ b/src/client.rs @@ -39,7 +39,7 @@ use crate::rpc::maintenance::{ use crate::rpc::watch::{WatchClient, WatchOptions, WatchStream}; #[cfg(feature = "tls-openssl")] use crate::OpenSslResult; -#[cfg(feature = "tls")] +#[cfg(feature = "_tls")] use crate::TlsOptions; use http::uri::Uri; use tonic::metadata::{Ascii, MetadataValue}; @@ -159,7 +159,7 @@ impl Client { fn build_endpoint(url: &str, options: &ConnectOptions) -> Result { use tonic::transport::Channel as TonicChannel; let mut endpoint = if url.starts_with(HTTP_PREFIX) { - #[cfg(feature = "tls")] + #[cfg(feature = "_tls")] if options.tls.is_some() { return Err(Error::InvalidArgs(String::from( "TLS options are only supported with HTTPS URLs", @@ -168,23 +168,23 @@ impl Client { TonicChannel::builder(url.parse()?) } else if url.starts_with(HTTPS_PREFIX) { - #[cfg(not(any(feature = "tls", feature = "tls-openssl")))] + #[cfg(not(any(feature = "_tls", feature = "tls-openssl")))] return Err(Error::InvalidArgs(String::from( - "HTTPS URLs are only supported with the feature \"tls\"", + "HTTPS URLs are only supported with one of the features \"tls\", \"tls-ring\" or \"tls-aws-lc\"", ))); - #[cfg(all(feature = "tls-openssl", not(feature = "tls")))] + #[cfg(all(feature = "tls-openssl", not(feature = "_tls")))] { TonicChannel::builder(url.parse()?) } - #[cfg(feature = "tls")] + #[cfg(feature = "_tls")] { let tls = options.tls.clone().unwrap_or_default(); TonicChannel::builder(url.parse()?).tls_config(tls)? } } else { - #[cfg(feature = "tls")] + #[cfg(feature = "_tls")] { let tls = options.tls.clone(); @@ -200,7 +200,7 @@ impl Client { } } - #[cfg(all(feature = "tls-openssl", not(feature = "tls")))] + #[cfg(all(feature = "tls-openssl", not(feature = "_tls")))] { let pfx = if options.otls.as_ref().is_some() { HTTPS_PREFIX @@ -211,7 +211,7 @@ impl Client { TonicChannel::builder(e.parse()?) } - #[cfg(all(not(feature = "tls"), not(feature = "tls-openssl")))] + #[cfg(all(not(feature = "_tls"), not(feature = "tls-openssl")))] { let e = HTTP_PREFIX.to_owned() + url; TonicChannel::builder(e.parse()?) @@ -803,7 +803,7 @@ pub struct ConnectOptions { connect_timeout: Option, /// TCP keepalive. tcp_keepalive: Option, - #[cfg(feature = "tls")] + #[cfg(feature = "_tls")] tls: Option, #[cfg(feature = "tls-openssl")] otls: Option>, @@ -822,8 +822,8 @@ impl ConnectOptions { /// Sets TLS options. /// /// Notes that this function have to work with `HTTPS` URLs. - #[cfg_attr(docsrs, doc(cfg(feature = "tls")))] - #[cfg(feature = "tls")] + #[cfg_attr(docsrs, doc(cfg(any(feature = "tls-ring", feature = "tls-aws-lc"))))] + #[cfg(feature = "_tls")] #[inline] pub fn with_tls(mut self, tls: TlsOptions) -> Self { self.tls = Some(tls); @@ -899,7 +899,7 @@ impl ConnectOptions { timeout: None, connect_timeout: None, tcp_keepalive: None, - #[cfg(feature = "tls")] + #[cfg(feature = "_tls")] tls: None, #[cfg(feature = "tls-openssl")] otls: None, diff --git a/src/lib.rs b/src/lib.rs index 3089ca6..aafb8e0 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -110,8 +110,8 @@ pub use crate::rpc::watch::{ }; pub use crate::rpc::{KeyValue, ResponseHeader}; -#[cfg(feature = "tls")] -#[cfg_attr(docsrs, doc(cfg(feature = "tls")))] +#[cfg(feature = "_tls")] +#[cfg_attr(docsrs, doc(cfg(any(feature = "tls-ring", feature = "tls-aws-lc"))))] pub use tonic::transport::{Certificate, ClientTlsConfig as TlsOptions, Identity}; #[cfg(feature = "tls-openssl")] diff --git a/src/openssl_tls/transport.rs b/src/openssl_tls/transport.rs index f5dd206..4fd9fb4 100644 --- a/src/openssl_tls/transport.rs +++ b/src/openssl_tls/transport.rs @@ -45,9 +45,9 @@ impl OpenSslConnector { } } -#[cfg(feature = "tls")] +#[cfg(feature = "_tls")] compile_error!(concat!( - "**You should only enable one of `tls` and `tls-openssl`.** Reason: ", + "**You should only enable one of `tls`/`tls-ring`/`tls-aws-lc` and `tls-openssl`.** Reason: ", "For now, `tls-openssl` would take over the transport layer (sockets) to implement TLS based connection. ", "As a result, once using with `tonic`'s internal TLS implementation (which based on `rustls`), ", "we may create TLS tunnels over TLS tunnels or directly fail because of some sorts of misconfiguration.")