feat(tls): Treat different TLS configs as distinct sessions (#779)

Author: 0x676e67

Cargo.toml

@@ -89,14 +89,14 @@ socket2 = { version = "0.5.10", features = ["all"] }
 percent-encoding = "2.3"
 ipnet = "2.11.0"
 schnellru = { version = "0.2.4", default-features = false }
+ahash = { version = "0.8.11", default-features = false }
 
 ## boring-tls
 boring2 = { version = "5.0.0-alpha.2", features = ["pq-experimental"] }
 tokio-boring2 = { version = "5.0.0-alpha.2", features = ["pq-experimental"] }
 brotli = "8.0.1"
 flate2 = "1.1.2"
 zstd = "0.13.3"
-linked_hash_set = "0.1"
 
 # Optional deps...
 
@@ -151,30 +151,23 @@ libc = "0.2.173"
 hyper = { version = "1.1.0", default-features = false, features = [
     "http1",
     "http2",
-    "client",
     "server",
 ] }
 hyper-util = { version = "0.1.13", features = [
     "http1",
     "http2",
-    "client",
-    "client-legacy",
     "server-auto",
     "server-graceful",
     "tokio",
 ] }
 serde = { version = "1.0", features = ["derive"] }
-flate2 = "1.1.1"
-zstd = "0.13"
-brotli = "8.0.0"
 tokio = { version = "1.0", default-features = false, features = [
     "macros",
     "rt-multi-thread",
 ] }
 futures = { version = "0.3.0", default-features = false, features = ["std"] }
 tower = { version = "0.5.2", default-features = false, features = ["limit"] }
 libc = "0.2"
-
 env_logger = "0.11.8"
 tracing = "0.1"
 tracing-subscriber = "0.3.19"

src/client/client/mod.rs

@@ -54,7 +54,7 @@ use crate::{
     IntoUrl, Method, OriginalHeaders, Proxy,
     connect::{BoxedConnectorLayer, BoxedConnectorService, Conn, Connector, Unnameable},
     core::{
-        client::{Builder, Client as HyperClient, connect::TcpConnectOptions},
+        client::{Builder, Client as NativeClient, connect::TcpConnectOptions},
         ext::RequestConfig,
         rt::{TokioExecutor, tokio::TokioTimer},
     },
@@ -192,7 +192,7 @@ impl ClientBuilder {
                 pool_idle_timeout: Some(Duration::from_secs(90)),
                 pool_max_idle_per_host: usize::MAX,
                 pool_max_size: None,
-                // TODO: Re-enable default duration once hyper's HttpConnector is fixed
+                // TODO: Re-enable default duration once core's HttpConnector is fixed
                 // to no longer error when an option fails.
                 tcp_keepalive: None,
                 tcp_keepalive_interval: None,
@@ -215,7 +215,7 @@ impl ClientBuilder {
                 dns_overrides: HashMap::new(),
                 dns_resolver: None,
                 http_version_pref: HttpVersionPref::All,
-                builder: HyperClient::builder(TokioExecutor::new()),
+                builder: NativeClient::builder(TokioExecutor::new()),
                 https_only: false,
                 http1_config: Http1Config::default(),
                 http2_config: Http2Config::default(),

src/client/request.rs

@@ -31,7 +31,7 @@ use crate::{
     core::{
         client::{config::TransportConfig, connect::TcpConnectOptions},
         ext::{
-            RequestConfig, RequestHttpVersionPref, RequestOriginalHeaders, RequestProxyMatcher,
+            RequestConfig, RequestEnforcedHttpVersion, RequestOriginalHeaders, RequestProxyMatcher,
             RequestTcpConnectOptions, RequestTransportConfig,
         },
     },
@@ -134,13 +134,13 @@ impl Request {
     /// Get the http version.
     #[inline]
     pub fn version(&self) -> Option<&Version> {
-        RequestConfig::<RequestHttpVersionPref>::get(&self.extensions)
+        RequestConfig::<RequestEnforcedHttpVersion>::get(&self.extensions)
     }
 
     /// Get a mutable reference to the http version.
     #[inline(always)]
     pub fn version_mut(&mut self) -> &mut Option<Version> {
-        RequestConfig::<RequestHttpVersionPref>::get_mut(&mut self.extensions)
+        RequestConfig::<RequestEnforcedHttpVersion>::get_mut(&mut self.extensions)
     }
 
     /// Get a mutable reference to the timeout.

src/connect.rs

@@ -32,8 +32,8 @@ use crate::{
     error::{BoxError, TimedOut, map_timeout_to_connector_error},
     proxy::{Intercepted, Matcher as ProxyMatcher},
     tls::{
-        CertStore, HttpsConnector, Identity, KeyLogPolicy, MaybeHttpsStream, TlsConfig,
-        TlsConnector, TlsConnectorBuilder, TlsInfo, TlsVersion,
+        CertStore, EstablishedConn, HttpsConnector, Identity, KeyLogPolicy, MaybeHttpsStream,
+        TlsConfig, TlsConnector, TlsConnectorBuilder, TlsInfo, TlsVersion,
     },
 };
 
@@ -305,7 +305,6 @@ impl Connector {
             #[cfg(feature = "socks")]
             resolver: resolver.clone(),
             http: {
-                // Create a new HttpConnector with the provided resolver
                 let mut http = HttpConnector::new_with_resolver(resolver);
                 http.enforce_http(false);
                 http
@@ -314,8 +313,6 @@ impl Connector {
             verbose: verbose::OFF,
             timeout: None,
             tcp_nodelay: false,
-
-            // TLS connector and its configuration
             tls_info: false,
             tls_builder: TlsConnector::builder(),
         }
@@ -367,7 +364,25 @@ pub(crate) struct ConnectorService {
 }
 
 impl ConnectorService {
-    async fn connect(self, mut req: ConnRequest, is_proxy: bool) -> Result<Conn, BoxError> {
+    /// Constructs an HTTPS connector by wrapping an `HttpConnector`
+    /// with the appropriate TLS configuration.
+    fn build_tls_connector(
+        &self,
+        mut http: HttpConnector,
+        req: &mut ConnRequest,
+    ) -> Result<HttpsConnector<HttpConnector>, BoxError> {
+        let ex_data = req.ex_data();
+        http.set_tcp_connect_options(ex_data.tcp_connect_options().cloned());
+        let tls = match ex_data.tls_config() {
+            Some(cfg) => self.tls_builder.build(cfg.clone())?,
+            None => self.tls.clone(),
+        };
+        Ok(HttpsConnector::with_connector(http, tls))
+    }
+
+    /// Establishes a direct connection to the target URI without using a proxy.
+    /// May perform a plain TCP or a TLS handshake depending on the URI scheme.
+    async fn connect_direct(self, mut req: ConnRequest, is_proxy: bool) -> Result<Conn, BoxError> {
         trace!("connect with maybe proxy: {:?}", is_proxy);
 
         let uri = req.uri().clone();
@@ -380,8 +395,8 @@ impl ConnectorService {
             http.set_nodelay(true);
         }
 
-        let mut connector = self.create_https_connector(http, &mut req)?;
-        let io = connector.call(uri).await?;
+        let mut connector = self.build_tls_connector(http, &mut req)?;
+        let io = connector.call(req).await?;
 
         // If the connection is HTTPS, wrap the TLS stream in a TlsConn for unified handling.
         // For plain HTTP, use the stream directly without additional wrapping.
@@ -403,7 +418,9 @@ impl ConnectorService {
         })
     }
 
-    async fn connect_via_proxy(
+    /// Establishes a connection through a specified proxy.
+    /// Supports both SOCKS and HTTP tunneling proxies.
+    async fn connect_with_proxy(
         self,
         mut req: ConnRequest,
         proxy: Intercepted,
@@ -437,8 +454,9 @@ impl ConnectorService {
 
                 return if uri.scheme() == Some(&Scheme::HTTPS) {
                     trace!("socks HTTPS over proxy");
-                    let mut connector = self.create_https_connector(self.http.clone(), &mut req)?;
-                    let io = connector.call((uri, conn)).await?;
+                    let mut connector = self.build_tls_connector(self.http.clone(), &mut req)?;
+                    let established_conn = EstablishedConn::new(req, conn);
+                    let io = connector.call(established_conn).await?;
 
                     Ok(Conn {
                         inner: self.verbose.wrap(TlsConn {
@@ -460,7 +478,7 @@ impl ConnectorService {
         // Handle HTTPS proxy tunneling connection
         if uri.scheme() == Some(&Scheme::HTTPS) {
             trace!("tunneling HTTPS over HTTP proxy: {:?}", proxy_uri);
-            let mut connector = self.create_https_connector(self.http.clone(), &mut req)?;
+            let mut connector = self.build_tls_connector(self.http.clone(), &mut req)?;
 
             let mut tunnel = proxy::Tunnel::new(proxy_uri, connector.clone());
             if let Some(auth) = proxy.basic_auth() {
@@ -473,10 +491,11 @@ impl ConnectorService {
 
             // We don't wrap this again in an HttpsConnector since that uses Maybe,
             // and we know this is definitely HTTPS.
-            let tunneled = tunnel.call(uri.clone()).await?;
+            let tunneled = tunnel.call(uri).await?;
             let tunneled = TokioIo::new(tunneled);
             let tunneled = TokioIo::new(tunneled);
-            let io = connector.call((uri, tunneled)).await?;
+            let established_conn = EstablishedConn::new(req, tunneled);
+            let io = connector.call(established_conn).await?;
 
             return Ok(Conn {
                 inner: self.verbose.wrap(TlsConn {
@@ -487,44 +506,42 @@ impl ConnectorService {
             });
         }
 
-        // Update the connect URI to the proxy URI
         *req.uri_mut() = proxy_uri;
-
-        self.connect(req, true).await
+        self.connect_direct(req, true).await
     }
 
-    fn create_https_connector(
-        &self,
-        http: HttpConnector,
-        conn_req: &mut ConnRequest,
-    ) -> Result<HttpsConnector<HttpConnector>, BoxError> {
-        let (tcp_opts, tls_cfg, alpn_protocol) = conn_req.take_config_bundle();
-
-        let tls = tls_cfg
-            .map(|cfg| self.tls_builder.build(cfg))
-            .transpose()?
-            .unwrap_or_else(|| self.tls.clone());
+    /// Automatically selects between a direct or proxied connection
+    /// based on the request and configured proxy matchers.
+    /// Applies a timeout if configured.
+    async fn connect_auto(self, req: ConnRequest) -> Result<Conn, BoxError> {
+        debug!("starting new connection: {:?}", req.uri());
 
-        let mut connector = HttpsConnector::with_connector(http, tls);
-        connector.set_alpn_protocol(alpn_protocol);
-        connector.set_tcp_connect_options(tcp_opts);
+        let intercepted = req
+            .ex_data()
+            .proxy_matcher()
+            .and_then(|scheme| scheme.intercept(req.uri()))
+            .or_else(|| {
+                self.proxies
+                    .iter()
+                    .find_map(|prox| prox.intercept(req.uri()))
+            });
 
-        Ok(connector)
-    }
-}
+        let timeout = self.timeout;
+        let fut = async {
+            if let Some(intercepted) = intercepted {
+                self.connect_with_proxy(req, intercepted).await
+            } else {
+                self.connect_direct(req, false).await
+            }
+        };
 
-async fn with_timeout<T, F>(f: F, timeout: Option<Duration>) -> Result<T, BoxError>
-where
-    F: Future<Output = Result<T, BoxError>>,
-{
-    if let Some(to) = timeout {
-        match tokio::time::timeout(to, f).await {
-            Err(_elapsed) => Err(Box::new(TimedOut) as BoxError),
-            Ok(Ok(try_res)) => Ok(try_res),
-            Ok(Err(e)) => Err(e),
+        if let Some(to) = timeout {
+            tokio::time::timeout(to, fut)
+                .await
+                .map_err(|_| BoxError::from(TimedOut))?
+        } else {
+            fut.await
         }
-    } else {
-        f.await
     }
 }
 
@@ -538,26 +555,9 @@ impl Service<ConnRequest> for ConnectorService {
         Poll::Ready(Ok(()))
     }
 
-    fn call(&mut self, mut req: ConnRequest) -> Self::Future {
-        debug!("starting new connection: {:?}", req.uri());
-
-        let intercepted = req
-            .take_proxy_matcher()
-            .and_then(|scheme| scheme.intercept(req.uri()))
-            .or_else(|| {
-                self.proxies
-                    .iter()
-                    .find_map(|prox| prox.intercept(req.uri()))
-            });
-
-        if let Some(intercepted) = intercepted {
-            return Box::pin(with_timeout(
-                self.clone().connect_via_proxy(req, intercepted),
-                self.timeout,
-            ));
-        }
-
-        Box::pin(with_timeout(self.clone().connect(req, false), self.timeout))
+    #[inline(always)]
+    fn call(&mut self, req: ConnRequest) -> Self::Future {
+        Box::pin(self.clone().connect_auto(req))
     }
 }
 
@@ -627,7 +627,7 @@ mod conn {
 
     pin_project! {
         /// Note: the `is_proxy` member means *is plain text HTTP proxy*.
-        /// This tells hyper whether the URI should be written in
+        /// This tells core whether the URI should be written in
         /// * origin-form (`GET /just/a/path HTTP/1.1`), when `is_proxy == false`, or
         /// * absolute-form (`GET http://foo.bar/and/a/path HTTP/1.1`), otherwise.
         pub struct Conn {

src/core/client/connect/http.rs

@@ -606,11 +606,11 @@ impl<'a> ConnectingTcp<'a> {
                 config
                     .tcp_connect_options
                     .as_ref()
-                    .and_then(|opt| opt.local_address_ipv4),
+                    .and_then(|opt| opt.local_ipv4),
                 config
                     .tcp_connect_options
                     .as_ref()
-                    .and_then(|opt| opt.local_address_ipv6),
+                    .and_then(|opt| opt.local_ipv6),
             );
             if fallback_addrs.is_empty() {
                 return ConnectingTcp {
@@ -813,11 +813,11 @@ fn connect(
         &config
             .tcp_connect_options
             .as_ref()
-            .and_then(|opt| opt.local_address_ipv4),
+            .and_then(|opt| opt.local_ipv4),
         &config
             .tcp_connect_options
             .as_ref()
-            .and_then(|opt| opt.local_address_ipv6),
+            .and_then(|opt| opt.local_ipv6),
     )
     .map_err(ConnectError::m("tcp bind local error"))?;