Add rustls-no-provider

.github/workflows/codecov.yml

@@ -27,7 +27,7 @@ jobs:
         #       | paste -sd ',' -
         run: |
           cargo llvm-cov \
-            --features="arbitrary,async-io,async-std,aws-lc-rs,bloom,direct-log,fast-apple-datapath,futures-io,json-output,lock_tracking,log,platform-verifier,qlog,ring,runtime-async-std,runtime-smol,runtime-tokio,rustls,rustls-aws-lc-rs,rustls-log,rustls-ring,serde,serde_json,smol,tracing" \
+            --features="arbitrary,async-io,async-std,aws-lc-rs,bloom,direct-log,fast-apple-datapath,futures-io,json-output,lock_tracking,log,platform-verifier,qlog,ring,runtime-async-std,runtime-smol,runtime-tokio,rustls,rustls-no-provider,rustls-aws-lc-rs,rustls-log,rustls-ring,serde,serde_json,smol,tracing" \
             --workspace --lcov --output-path lcov.info
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v5

.github/workflows/rust.yml

@@ -126,6 +126,9 @@ jobs:
       - run: RUST_BACKTRACE=1 cargo test --locked --manifest-path quinn-proto/Cargo.toml --no-default-features --features rustls-aws-lc-rs-fips
       - run: RUST_BACKTRACE=1 cargo test --locked --manifest-path quinn/Cargo.toml --no-default-features --features rustls-aws-lc-rs-fips,runtime-tokio
       - run: RUST_BACKTRACE=1 cargo test --locked --manifest-path quinn/Cargo.toml --no-default-features --features rustls-aws-lc-rs-fips,__rustls-post-quantum-test,runtime-tokio
+      # Provider-neutral rustls integration
+      - run: RUST_BACKTRACE=1 cargo check --locked --manifest-path quinn/Cargo.toml --no-default-features --features rustls-no-provider,runtime-tokio
+      - run: RUST_BACKTRACE=1 cargo check --locked --manifest-path quinn-proto/Cargo.toml --no-default-features --features rustls-no-provider
 
   wasm_test:
     name: test wasm32-unknown-unknown

Cargo.toml

@@ -17,6 +17,7 @@ arbitrary = { version = "1.0.1", features = ["derive"] }
 async-io = "2"
 async-std = "1.11"
 assert_matches = "1.1"
+aes-gcm = { version = "0.10", default-features = false, features = ["aes"] }
 aws-lc-rs = { version = "1.9", default-features = false }
 bencher = "0.1.5"
 bytes = "1"

README.md

@@ -26,6 +26,30 @@ The project was founded by [Dirkjan Ochtman](https://github.com/djc) and
 - Future-based async API
 - Minimum supported Rust version of 1.74.1
 
+## TLS and Crypto Features
+
+By default, Quinn enables `rustls-ring`, which uses [rustls][rustls] with the
+[ring][ring] crypto provider. Applications that want a different provider can
+disable default features and select one explicitly.
+
+- `rustls`: alias for `rustls-ring`, kept for backwards compatibility.
+- `rustls-aws-lc-rs`: enables rustls with the [aws-lc-rs]([aws-lc-rs]) provider.
+- `rustls-aws-lc-rs-fips`: enables rustls with [aws-lc-rs][aws-lc-rs] in FIPS mode.
+- `rustls-ring`: enables rustls with the [ring][ring] provider.
+- `rustls-no-provider`: enables Quinn's rustls integration without selecting a
+  rustls crypto provider.
+
+Use `rustls-no-provider` for applications that install a process-wide rustls
+`CryptoProvider` themselves, or that pass Quinn already-built rustls
+configuration values. Code using Quinn's rustls convenience constructors with
+`rustls-no-provider` must install a default provider before constructing those
+configs.
+
+The lower-level `aws-lc-rs` and `ring` features enable Quinn's direct use of
+those crates for transport helpers such as randomized endpoint and server
+configuration constructors. The provider-specific rustls features enable these
+direct features automatically.
+
 ## Overview
 
 - **quinn:** High-level async API based on tokio, see [examples][examples] for usage. This will be used by most developers. (Basic benchmarks are included.)
@@ -115,6 +139,7 @@ crates will always be at least 6 months old at the time of release.
 [quic]: https://quicwg.github.io/
 [issues]: https://github.com/djc/quinn/issues
 [rustls]: https://github.com/ctz/rustls
+[aws-lc-rs]: https://github.com/aws/aws-lc-rs
 [ring]: https://github.com/briansmith/ring
 [talk]: https://paris.rustfest.eu/sessions/a-quic-future-in-rust
 [slides]: https://github.com/djc/talks/blob/ff760845b51ba4836cce82e7f2c640ecb5fd59fa/2018-05-26%20A%20QUIC%20future%20in%20Rust/Quinn-Speaker.pdf

quinn-proto/Cargo.toml

@@ -20,6 +20,8 @@ aws-lc-rs-fips = ["aws-lc-rs", "aws-lc-rs?/fips"]
 bloom = ["dep:fastbloom"]
 # For backwards compatibility, `rustls` forwards to `rustls-ring`
 rustls = ["rustls-ring"]
+# Enable rustls without selecting a crypto provider
+rustls-no-provider = ["dep:rustls", "dep:aes-gcm"]
 # Enable rustls with the `aws-lc-rs` crypto provider
 rustls-aws-lc-rs = ["dep:rustls", "rustls?/aws-lc-rs", "aws-lc-rs"]
 rustls-aws-lc-rs-fips = ["rustls-aws-lc-rs", "aws-lc-rs-fips"]
@@ -43,6 +45,7 @@ __rustls-post-quantum-test =  []
 
 [dependencies]
 arbitrary = { workspace = true, optional = true }
+aes-gcm = { workspace = true, optional = true }
 aws-lc-rs = { workspace = true, optional = true }
 bytes = { workspace = true }
 fastbloom = { workspace = true, optional = true }
@@ -81,4 +84,4 @@ unexpected_cfgs = { level = "warn", check-cfg = ['cfg(fuzzing)'] }
 
 [package.metadata.docs.rs]
 # all non-default features except fips (cannot build on docs.rs environment)
-features = ["rustls-aws-lc-rs", "rustls-ring", "platform-verifier", "log", "rustls-log"]
+features = ["rustls-no-provider", "rustls-aws-lc-rs", "rustls-ring", "platform-verifier", "log", "rustls-log"]

quinn-proto/src/config/mod.rs

@@ -5,7 +5,11 @@ use std::{
     sync::Arc,
 };
 
-#[cfg(any(feature = "rustls-aws-lc-rs", feature = "rustls-ring"))]
+#[cfg(any(
+    feature = "rustls-no-provider",
+    feature = "rustls-aws-lc-rs",
+    feature = "rustls-ring"
+))]
 use rustls::client::WebPkiServerVerifier;
 #[cfg(any(feature = "rustls-aws-lc-rs", feature = "rustls-ring"))]
 use rustls::pki_types::{CertificateDer, PrivateKeyDer};
@@ -16,7 +20,13 @@ use crate::BloomTokenLog;
 #[cfg(not(feature = "bloom"))]
 use crate::NoneTokenLog;
 #[cfg(any(feature = "rustls-aws-lc-rs", feature = "rustls-ring"))]
-use crate::crypto::rustls::{QuicServerConfig, configured_provider};
+use crate::crypto::rustls::QuicServerConfig;
+#[cfg(any(
+    feature = "rustls-no-provider",
+    feature = "rustls-aws-lc-rs",
+    feature = "rustls-ring"
+))]
+use crate::crypto::rustls::configured_provider;
 use crate::{
     DEFAULT_SUPPORTED_VERSIONS, Duration, MAX_CID_SIZE, RandomConnectionIdGenerator, SystemTime,
     TokenLog, TokenMemoryCache, TokenStore, VarInt, VarIntBoundsExceeded,
@@ -618,7 +628,11 @@ impl ClientConfig {
     }
 }
 
-#[cfg(any(feature = "rustls-aws-lc-rs", feature = "rustls-ring"))]
+#[cfg(any(
+    feature = "rustls-no-provider",
+    feature = "rustls-aws-lc-rs",
+    feature = "rustls-ring"
+))]
 impl ClientConfig {
     /// Create a client configuration that trusts the platform's native roots
     #[deprecated(since = "0.11.13", note = "use `try_with_platform_verifier()` instead")]

quinn-proto/src/crypto.rs

@@ -2,8 +2,8 @@
 //!
 //! The protocol logic in Quinn is contained in types that abstract over the actual
 //! cryptographic protocol used. This module contains the traits used for this
-//! abstraction layer as well as a single implementation of these traits that uses
-//! *ring* and rustls to implement the TLS protocol support.
+//! abstraction layer as well as a single implementation of these traits that uses rustls to
+//! implement the TLS protocol support.
 //!
 //! Note that usage of any protocol (version) other than TLS 1.3 does not conform to any
 //! published versions of the specification, and will not be supported in QUIC v1.
@@ -21,7 +21,11 @@ use crate::{
 #[cfg(any(feature = "aws-lc-rs", feature = "ring"))]
 pub(crate) mod ring_like;
 /// TLS interface based on rustls
-#[cfg(any(feature = "rustls-aws-lc-rs", feature = "rustls-ring"))]
+#[cfg(any(
+    feature = "rustls-no-provider",
+    feature = "rustls-aws-lc-rs",
+    feature = "rustls-ring"
+))]
 pub mod rustls;
 
 /// A cryptographic session (commonly TLS)