sfackler / hyper-native-tls

hyper-native-tls

Documentation

native-tls support for Hyper 0.10.

Warning

This crate does not support the Tokio-based Hyper 0.11 release. Use the tokio-tls crate instead.

License

Licensed under either of

• Apache License, Version 2.0, (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
• MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

hyper-native-tls's Issues

Status of this crate

From the README:

native-tls support for Hyper. hyper-tls is currently made for async hyper, which isn't released yet.

Is the plan to eventually support Hyper 0.11? If not, should we tell people to use hyper-tls (which is released now)?

let NativeTlsClient::new() map to own error type

The expression:

let ssl = try!(NativeTlsClient::new());

leads to:

the trait `std::convert::From<native_tls::Error>` is not implemented for 'my_crate:error:Error'

Should it not return Result< NativeTlsClient,hyper_native_tls::ServerError> or Result<NativeTlsClient,hyper_native_tls::ClientError> instead of the native_tls::Error?

Else one need to import native_tls crate too, to handle it properly.

Compilation error when used as a dependency

Compilation error when installating tectonic, for which hyper-native-tls is a dep:

error: proc-macro derive panicked
  --> ~/.cargo/registry/src/github.com-1ecc6299db9ec823/tectonic-0.1.5/src/config.rs:30:10
   |
30 | #[derive(Deserialize)]
   |          ^^^^^^^^^^^
   |
   = help: message: proc_macro::__internal::with_parse_sess() called before set_parse_sess()!

Would it be feasible to support PEM certificates?

From what I've seen, Let's Encrypt only offers PEM certificates. These can be converted ¹ to PKCS12 certificates, but it's one annoying little step that we might be able to skip.

If you think it's feasible, I'd be happy to take a first crack at it, so any guidance would be appreciated.

---

1 openssl pkcs12 -export -out mysite.pkcs12 -in mysite.cer -inkey mysite.key -passout pass:hunter2

Not compatible with the latest version of hyper (0.11.2)

As of Hyper version 0.11.2, use hyper::net::HttpsConnector no longer exists. I don't see HttpsConnector anywhere in the hyper documentation anywhere, as a matter of fact, and am not sure of the new way to support this.

If nothing else, the docs will need to be updated to support the new version of hyper, possibly requiring code changes to support it as well.

Couldn't compile for android

Hi I'm trying to compile the lib for android but It gives the following error.

I used >cargo build --target armv7-linux-androideabi --release

The ERROR

error: failed to run custom build command for `openssl-sys v0.9.60`

Caused by:
  process didn't exit successfully: `C:\Users\AmmarMohammed\.cargo\registry\src\github.com-1ecc6299db9ec823\native-tls-0.2.7\target\release\build\openssl-sys-7d532f02768e9fdf\build-script-main` (exit code: 101)
  --- stdout
  cargo:rustc-cfg=const_fn
  cargo:rerun-if-env-changed=ARMV7_LINUX_ANDROIDEABI_OPENSSL_NO_VENDOR
  ARMV7_LINUX_ANDROIDEABI_OPENSSL_NO_VENDOR unset
  cargo:rerun-if-env-changed=OPENSSL_NO_VENDOR
  OPENSSL_NO_VENDOR unset
  CC_armv7-linux-androideabi = None
  CC_armv7_linux_androideabi = None
  TARGET_CC = None
  CC = None
  CFLAGS_armv7-linux-androideabi = None
  CFLAGS_armv7_linux_androideabi = None
  TARGET_CFLAGS = None
  CFLAGS = None
  CRATE_CC_NO_DEFAULTS = None
  DEBUG = Some("false")
  running "perl" "./Configure" "--prefix=C:\\Users\\AmmarMohammed\\.cargo\\registry\\src\\github.com-1ecc6299db9ec823\\native-tls-0.2.7\\target\\armv7-linux-androideabi\\release\\build\\openssl-sys-55a87cbf3177df6e\\out\\openssl-build\\install" "no-dso" "no-ssl3" "no-unit-test" "no-comp" "no-zlib" "no-zlib-dynamic" "no-md2" "no-rc5" "no-weak-ssl-ciphers" "no-camellia" "no-idea" "no-seed" "no-stdio" "no-shared" "linux-armv4" "--target=arm-linux-androideabi" "-O2" "-DANDROID" "-ffunction-sections" "-fdata-sections" "-fPIC" "--target=armv7-linux-androideabi"
  Configuring OpenSSL version 1.1.1i (0x1010109fL) for linux-armv4
  Using os-specific seed configuration
  Creating configdata.pm
  Creating Makefile

  --- stderr
  Can't locate Pod/Usage.pm in @INC (you may need to install the Pod::Usage module) (@INC contains: . /usr/lib/perl5/site_perl /usr/share/perl5/site_perl /usr/lib/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib/perl5/core_perl /usr/share/perl5/core_perl) at configdata.pm line 10067.
  BEGIN failed--compilation aborted at configdata.pm line 10067.
  Compilation failed in require.
  BEGIN failed--compilation aborted.
  thread 'main' panicked at '


  Error configuring OpenSSL build:
      Command: "perl" "./Configure" "--prefix=C:\\Users\\AmmarMohammed\\.cargo\\registry\\src\\github.com-1ecc6299db9ec823\\native-tls-0.2.7\\target\\armv7-linux-androideabi\\release\\build\\openssl-sys-55a87cbf3177df6e\\out\\openssl-build\\install" "no-dso" "no-ssl3" "no-unit-test" "no-comp" "no-zlib" "no-zlib-dynamic" "no-md2" "no-rc5" "no-weak-ssl-ciphers" "no-camellia" "no-idea" "no-seed" "no-stdio" "no-shared" "linux-armv4" "--target=arm-linux-androideabi" "-O2" "-DANDROID" "-ffunction-sections" "-fdata-sections" "-fPIC" "--target=armv7-linux-androideabi"
      Exit status: exit code: 1


      ', C:\Users\AmmarMohammed\.cargo\registry\src\github.com-1ecc6299db9ec823\openssl-src-111.13.0+1.1.1i\src\lib.rs:415:13
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

does not work with hyper's with_proxy_config

This code fails to compile:

extern crate hyper;
extern crate hyper_native_tls;

use hyper::net::HttpsConnector;
use hyper::client::{Client, ProxyConfig};
use hyper_native_tls::NativeTlsClient;

fn main() {
    let ssl = NativeTlsClient::new().unwrap();
    let connector = HttpsConnector::new(ssl);

    let client = Client::with_proxy_config(
        ProxyConfig::new(
            "http", "localhost", 3128, connector, ssl
        )
    );

    let response = client.get("https://httpbin.org").send().unwrap();
    println!("{}", response.headers);
}

What follows is part of the error output:

error[E0277]: the trait bound `hyper_native_tls::TlsStream<hyper::net::HttpStream>: std::fmt::Debug` is not satisfied
  --> src/main.rs:13:9
   |
13 |         ProxyConfig::new(
   |         ^^^^^^^^^^^^^^^^ the trait `std::fmt::Debug` is not implemented for `hyper_native_tls::TlsStream<hyper::net::HttpStream>`
   |
   = note: `hyper_native_tls::TlsStream<hyper::net::HttpStream>` cannot be formatted using `:?`; if it is defined in your crate, add `#[derive(Debug)]` or manually implement it
   = note: required because of the requirements on the impl of `std::fmt::Debug` for `hyper::net::HttpsStream<hyper_native_tls::TlsStream<hyper::net::HttpStream>>`
   = note: required because of the requirements on the impl of `hyper::net::SslClient<hyper::net::HttpsStream<hyper_native_tls::TlsStream<hyper::net::HttpStream>>>` for `hyper_native_tls::NativeTlsClient`
   = note: required by `<hyper::client::ProxyConfig<C, S>>::new`

I asked first on Stack Overflow.

No debug for NativeTlsClient

Is there a specific reason why it doesn't have a debug trait implemented? I know the direct reason is probably TlsConnector doesn't have debug. But is it just because somewhere along the line of structs, one didn't have debug and thus stopped the others from deriving debug automatically and people just didn't care to implement debug? I'm just curious, not really an issue as I don't need it, but it was just something I noticed.

new release

Hi @sfackler !

Do you think you could make a new release? I'd like to use the ability to use custom certificates in reqwest. I have a PR for this, but it uses the github repo as a dependency for now.

relation between https://github.com/hyperium/hyper-tls

Hi,

There seems to be multiple similar efforts towards getting TLS support for hyper.
This cause some dependency redundancy.

For example https://github.com/getsentry/sentry-rust relies on hyper-native-tls, where others rely on hyper-tls.

Maybe we should choose one and make it official and concentrate it afterwards?

Would it be feasible to reload certificates during runtime?

From what I've seen, the certificate file is loaded a single time at construction. Let's Encrypt certificates expire every 90 days. I tend to not restart my server that frequently, which means that the certificate will be the forcing function to restart.

Do you think that this is a desirable feature to reside in this library? If so, I'd be happy to take a first crack at it, so any guidance would be appreciated.