Support rustls

Cargo.toml

@@ -43,6 +43,7 @@ uuid = ["dep:uuid"]
 time = ["dep:time"]
 lz4 = ["dep:lz4", "dep:clickhouse-rs-cityhash-sys"]
 tls = ["dep:hyper-tls"]
+rustls = ["dep:hyper-rustls"]
 
 [dependencies]
 clickhouse-derive = { version = "0.1.1", path = "derive" }
@@ -51,6 +52,7 @@ thiserror = "1.0.16"
 serde = "1.0.106"
 bytes = "1.5.0"
 tokio = { version = "1.0.1", features = ["rt", "macros"] }
+hyper-rustls = { version = "0.24", features = ["http2"], optional = true }
 hyper = { version = "0.14", features = ["client", "tcp", "http1", "stream"] }
 hyper-tls = { version = "0.5.0", optional = true }
 url = "2.1.1"

README.md

@@ -218,6 +218,7 @@ See [examples](https://github.com/loyd/clickhouse.rs/tree/master/examples).
 ## Feature Flags
 * `lz4` (enabled by default) — enables `Compression::Lz4` and `Compression::Lz4Hc(_)` variants. If enabled, `Compression::Lz4` is used by default for all queries except for `WATCH`.
 * `tls` (enabled by default) — supports urls with the `HTTPS` schema.
+* `rustls` - enables `rustls` TLS backend. You can use it to avoid OpenSSL dependency. As `tls` is enabled by default, you should disable the `default-features` to use `rustls`. Like this: `clickhouse = { version = "x.y.z", default-features = false, features = ["lz4", "rustls"] }`
 * `inserter` — enables `client.inserter()`.
 * `test-util` — adds mocks. See [the example](https://github.com/loyd/clickhouse.rs/tree/master/examples/mock.rs). Use it only in `dev-dependencies`.
 * `watch` — enables `client.watch` functionality. See the corresponding section for details.

src/lib.rs

@@ -9,8 +9,6 @@ extern crate static_assertions;
 use std::{collections::HashMap, sync::Arc, time::Duration};
 
 use hyper::client::connect::HttpConnector;
-#[cfg(feature = "tls")]
-use hyper_tls::HttpsConnector;
 
 pub use clickhouse_derive::Row;
 
@@ -67,11 +65,23 @@ impl Default for Client {
         // TODO: make configurable in `Client::builder()`.
         connector.set_keepalive(Some(TCP_KEEPALIVE));
 
-        #[cfg(feature = "tls")]
-        let connector = HttpsConnector::new_with_connector({
-            connector.enforce_http(false);
-            connector
-        });
+        #[cfg(any(feature = "tls", feature = "rustls"))]
+        connector.enforce_http(false);
+
+        #[cfg(all(feature = "tls", not(feature = "rustls")))]
+        let connector = hyper_tls::HttpsConnector::new_with_connector(connector);
+
+        #[cfg(all(feature = "rustls", not(feature = "tls")))]
+        let connector = hyper_rustls::HttpsConnectorBuilder::new()
+            .with_native_roots()
+            .https_or_http()
+            .enable_http2()
+            .wrap_connector(connector);
+
+        #[cfg(all(feature = "rustls", feature = "tls"))]
+        compile_error!(
+            "The rustls and tls features are mutually exclusive and cannot be enabled together"
+        );
 
         let client = hyper::Client::builder()
             .pool_idle_timeout(POOL_IDLE_TIMEOUT)