You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@opendal.apache.org by er...@apache.org on 2026/06/18 13:35:41 UTC
(opendal) branch feat/reqwest-tls-options updated: Progress
This is an automated email from the ASF dual-hosted git repository.
erickguan pushed a commit to branch feat/reqwest-tls-options
in repository https://gitbox.apache.org/repos/asf/opendal.git
The following commit(s) were added to refs/heads/feat/reqwest-tls-options by this push:
new 0654a6e1b Progress
0654a6e1b is described below
commit 0654a6e1b2956c89a9f495277e191a4e833bc177
Author: Erick Guan <29...@users.noreply.github.com>
AuthorDate: Thu Jun 18 21:35:15 2026 +0800
Progress
---
core/Cargo.lock | 1 +
core/Cargo.toml | 5 +++++
core/http-transports/reqwest/Cargo.toml | 20 +++++++++++++++--
core/http-transports/reqwest/src/lib.rs | 40 ++++++++++++++++++++++++++++-----
4 files changed, 59 insertions(+), 7 deletions(-)
diff --git a/core/Cargo.lock b/core/Cargo.lock
index b05b47a45..952494daf 100644
--- a/core/Cargo.lock
+++ b/core/Cargo.lock
@@ -6516,6 +6516,7 @@ dependencies = [
"opendal-core",
"reqwest",
"rustls 0.23.40",
+ "rustls-platform-verifier",
"webpki-roots 1.0.7",
]
diff --git a/core/Cargo.toml b/core/Cargo.toml
index 6a5c8b67e..4029e314b 100644
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -94,19 +94,24 @@ default = [
"layers-timeout",
]
executors-tokio = ["opendal-core/executors-tokio"]
+# Enable the reqwest HTTP transport without selecting a TLS backend.
http-transport-reqwest = ["dep:opendal-http-transport-reqwest"]
+# Use reqwest with platform TLS via native-tls.
http-transport-reqwest-native-tls = [
"http-transport-reqwest",
"opendal-http-transport-reqwest/native-tls",
]
+# Use reqwest with Rustls, the aws-lc-rs crypto provider, and platform certificate verification.
http-transport-reqwest-rustls = [
"http-transport-reqwest",
"opendal-http-transport-reqwest/rustls",
]
+# Use reqwest with Rustls and no built-in crypto provider.
http-transport-reqwest-rustls-no-provider = [
"http-transport-reqwest",
"opendal-http-transport-reqwest/rustls-no-provider",
]
+# Use reqwest with Rustls, the aws-lc-rs crypto provider, and bundled Mozilla root certificates.
http-transport-reqwest-webpki-roots = [
"http-transport-reqwest",
"opendal-http-transport-reqwest/webpki-roots",
diff --git a/core/http-transports/reqwest/Cargo.toml b/core/http-transports/reqwest/Cargo.toml
index 4e96877d9..e2714483d 100644
--- a/core/http-transports/reqwest/Cargo.toml
+++ b/core/http-transports/reqwest/Cargo.toml
@@ -31,11 +31,26 @@ version = { workspace = true }
all-features = true
[features]
+# Select native-tls as the default TLS backend.
default = ["native-tls"]
+# Use platform TLS via reqwest's native-tls feature.
native-tls = ["reqwest/native-tls"]
-rustls = ["reqwest/rustls"]
+# Use Rustls with the aws-lc-rs crypto provider and platform certificate verification.
+rustls = [
+ "reqwest/rustls-no-provider",
+ "dep:rustls",
+ "rustls/aws-lc-rs",
+ "dep:rustls-platform-verifier",
+]
+# Use Rustls without a built-in crypto provider.
rustls-no-provider = ["reqwest/rustls-no-provider"]
-webpki-roots = ["rustls", "dep:rustls", "dep:webpki-roots"]
+# Use Rustls with the aws-lc-rs crypto provider and bundled Mozilla root certificates.
+webpki-roots = [
+ "reqwest/rustls-no-provider",
+ "dep:rustls",
+ "rustls/aws-lc-rs",
+ "dep:webpki-roots",
+]
[dependencies]
bytes = { workspace = true }
@@ -47,4 +62,5 @@ reqwest = { version = "0.13.4", features = [
"stream",
], default-features = false }
rustls = { version = "0.23", optional = true, default-features = false }
+rustls-platform-verifier = { version = "0.7", optional = true, default-features = false }
webpki-roots = { version = "1", optional = true }
diff --git a/core/http-transports/reqwest/src/lib.rs b/core/http-transports/reqwest/src/lib.rs
index 2faa1e8a7..3cf9d5739 100644
--- a/core/http-transports/reqwest/src/lib.rs
+++ b/core/http-transports/reqwest/src/lib.rs
@@ -107,7 +107,7 @@ fn build_default_client() -> reqwest::Client {
pub enum ReqwestTlsBackend {
/// Platform TLS through reqwest's `native-tls` feature.
NativeTls,
- /// Rustls with the aws-lc-rs crypto provider through reqwest's `rustls` feature.
+ /// Rustls with the aws-lc-rs crypto provider and platform certificate verification.
Rustls,
/// Rustls without a built-in crypto provider through reqwest's `rustls-no-provider` feature.
RustlsNoProvider,
@@ -291,7 +291,7 @@ fn apply_tls_backend(
ReqwestTlsBackend::Rustls => {
#[cfg(feature = "rustls")]
{
- Ok(client_builder.tls_backend_rustls())
+ Ok(client_builder.tls_backend_preconfigured(rustls_tls_config()?))
}
#[cfg(not(feature = "rustls"))]
{
@@ -321,14 +321,44 @@ fn apply_tls_backend(
}
}
+#[cfg(feature = "rustls")]
+fn rustls_tls_config() -> Result<rustls::ClientConfig> {
+ use rustls_platform_verifier::BuilderVerifierExt;
+
+ rustls::ClientConfig::builder_with_provider(
+ rustls::crypto::aws_lc_rs::default_provider().into(),
+ )
+ .with_safe_default_protocol_versions()
+ .map_err(|err| {
+ Error::new(
+ ErrorKind::ConfigInvalid,
+ "rustls protocol version config is invalid",
+ )
+ .set_source(err)
+ })?
+ .with_platform_verifier()
+ .map_err(|err| {
+ Error::new(
+ ErrorKind::ConfigInvalid,
+ "rustls platform verifier config is invalid",
+ )
+ .set_source(err)
+ })
+ .map(|builder| builder.with_no_client_auth())
+}
+
#[cfg(feature = "webpki-roots")]
fn webpki_roots_tls_config() -> rustls::ClientConfig {
let root_store =
rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
- rustls::ClientConfig::builder()
- .with_root_certificates(root_store)
- .with_no_client_auth()
+ rustls::ClientConfig::builder_with_provider(
+ rustls::crypto::aws_lc_rs::default_provider().into(),
+ )
+ .with_safe_default_protocol_versions()
+ .expect("aws-lc-rs provider must support the default rustls protocol versions")
+ .with_root_certificates(root_store)
+ .with_no_client_auth()
}
#[allow(dead_code)]