Move TLS client config defaults into quinn-proto

The default client config setup contains low-level rustls code that is
better off in quinn-proto. This also makes the OS store roots and
certificate transparency easily available to quinn-proto users, and
makes it easy to use them by using Cargo-level features.

quinn-proto/Cargo.toml

@@ -18,14 +18,20 @@ maintenance = { status = "experimental" }
 
 [features]
 default = ["tls-rustls"]
+# Use Google's list of CT logs to enable certificate transparency checks
+certificate-transparency = ["ct-logs"]
 tls-rustls = ["rustls", "webpki", "ring"]
+# Trust the contents of the OS certificate store by default
+native-certs = ["rustls-native-certs"]
 
 [dependencies]
 bytes = "0.5.2"
+ct-logs = { version = "0.6", optional = true }
 err-derive = "0.2.3"
 rand = "0.7"
 ring = { version = "0.16.7", optional = true }
 rustls = { version = "0.17", features = ["quic"], optional = true }
+rustls-native-certs = { version = "0.3", optional = true }
 slab = "0.4"
 tracing = "0.1.10"
 webpki = { version = "0.21", optional = true }

quinn-proto/src/crypto/rustls.rs

@@ -185,6 +185,23 @@ impl crypto::ClientConfig<TlsSession> for Arc<rustls::ClientConfig> {
         let mut cfg = rustls::ClientConfig::new();
         cfg.versions = vec![rustls::ProtocolVersion::TLSv1_3];
         cfg.enable_early_data = true;
+        #[cfg(feature = "native-certs")]
+        match rustls_native_certs::load_native_certs() {
+            Ok(x) => {
+                cfg.root_store = x;
+            }
+            Err((Some(x), e)) => {
+                cfg.root_store = x;
+                tracing::warn!("couldn't load some default trust roots: {}", e);
+            }
+            Err((None, e)) => {
+                tracing::warn!("couldn't load any default trust roots: {}", e);
+            }
+        }
+        #[cfg(feature = "certificate-transparency")]
+        {
+            cfg.ct_logs = Some(&ct_logs::LOGS);
+        }
         Arc::new(cfg)
     }
 

quinn/Cargo.toml

@@ -15,9 +15,11 @@ edition = "2018"
 all-features = true
 
 [features]
-default = ["native-certs", "ct-logs"]
+default = ["native-certs", "certificate-transparency"]
+# Use Google's list of CT logs to enable certificate transparency checks
+certificate-transparency = ["proto/certificate-transparency"]
 # Trust the contents of the OS certificate store by default
-native-certs = [ "rustls-native-certs" ]
+native-certs = ["proto/native-certs"]
 
 [badges]
 codecov = { repository = "djc/quinn" }
@@ -26,14 +28,12 @@ azure-devops = { project = "dochtman/Projects", pipeline = "Quinn", build = "1"
 
 [dependencies]
 bytes = "0.5.2"
-ct-logs = { version = "0.6", optional = true }
 err-derive = "0.2.3"
 futures = "0.3.1"
 libc = "0.2.49"
 mio = "0.6"
 proto = { package = "quinn-proto", path = "../quinn-proto", version = "0.5.0" }
 rustls = { version = "0.17", features = ["quic"] }
-rustls-native-certs = { version = "0.3", optional = true }
 tracing = "0.1.10"
 tokio = { version = "0.2.6", features = ["rt-core", "io-driver", "time"] }
 webpki = "0.21"

quinn/src/builders.rs

@@ -226,25 +226,6 @@ impl ClientConfigBuilder {
 
 impl Default for ClientConfigBuilder {
     fn default() -> Self {
-        let mut x = ClientConfig::default();
-        let crypto = Arc::make_mut(&mut x.crypto);
-        #[cfg(feature = "native-certs")]
-        match rustls_native_certs::load_native_certs() {
-            Ok(x) => {
-                crypto.root_store = x;
-            }
-            Err((Some(x), e)) => {
-                crypto.root_store = x;
-                tracing::warn!("couldn't load some default trust roots: {}", e);
-            }
-            Err((None, e)) => {
-                tracing::warn!("couldn't load any default trust roots: {}", e);
-            }
-        }
-        #[cfg(feature = "ct-logs")]
-        {
-            crypto.ct_logs = Some(&ct_logs::LOGS);
-        }
-        Self::new(x)
+        Self::new(ClientConfig::default())
     }
 }