Use rustls for TLS

.github/workflows/ci.yml

@@ -65,6 +65,39 @@ jobs:
  - name: Unit tests (tls)
  run: cargo test --features tls
 
+ tls-platforms:
+ name: tls (${{ matrix.os }})
+ runs-on: ${{ matrix.os }}
+ strategy:
+ fail-fast: false
+ matrix:
+ os: [macos-latest, windows-latest]
+ steps:
+ - uses: actions/checkout@v4
+
+ - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+
+ - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+
+ # Exercises native root loading plus the shared WebPKI verifier on each OS.
+ - name: Unit tests (tls)
+ run: cargo test --features tls
+
+ msrv:
+ name: msrv (rust 1.75)
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+
+ - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+ with:
+ toolchain: 1.75.0
+
+ - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+
+ - name: Check (tls)
+ run: cargo check --features tls
+
  integration:
  runs-on: ubuntu-latest
  strategy:

Cargo.toml

@@ -36,13 +36,23 @@ thrift = "0.23"
 byteorder = "1.5"
 chrono = "0.4"
 log = "0.4"
-native-tls = { version = "0.2", optional = true }
+# thrift 0.23 allows any uuid 1.x; 1.21+ raises MSRV to Rust 1.85.
+uuid = "=1.20.0"
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"], optional = true }
+rustls-pemfile = { version = "2.2", optional = true }
+rustls-native-certs = { version = "0.8.4", optional = true }
+# Keep Cargo 1.75 from resolving zeroize 1.9, whose manifest uses edition 2024.
+zeroize = { version = "=1.8.2", optional = true }
+
+[target.'cfg(any(target_vendor="apple"))'.dependencies]
+# rustls-native-certs 0.8 allows 3.x; 3.7 raises MSRV to Rust 1.85.
+security-framework = { version = "=3.5.1", optional = true }
 
 [dev-dependencies]
 env_logger = "0.11"
 
 [features]
 default = []
-# TLS support via the platform-native TLS stack (SecureTransport /
-#SChannel / OpenSSL). Adds `use_ssl` & friends to SessionConfig.
-tls = ["dep:native-tls"]
+# TLS 1.2/1.3 via rustls, using the ring crypto provider and platform
+#trust roots with consistent WebPKI verification. Adds `use_ssl` & friends to SessionConfig.
+tls = ["dep:rustls", "dep:rustls-pemfile", "dep:rustls-native-certs", "dep:zeroize", "dep:security-framework"]

README.md

@@ -183,7 +183,11 @@ let config = SessionConfig { enable_rpc_compression: true, ..Default::default()
 
 It must match the **server** setting `dn_rpc_thrift_compression_enable` (default `false`). The server speaks exactly one protocol — there is no per-connection negotiation, so a mismatch in either direction fails at the first RPC with a transport error.
 
-**TLS** is behind the `tls` cargo feature (platform-native TLS via [`native-tls`](https://crates.io/crates/native-tls)):
+**TLS** is behind the `tls` cargo feature. It uses [`rustls`](https://crates.io/crates/rustls)
+with the `ring` crypto provider and supports TLS 1.2/1.3. Server certificates are
+verified consistently with rustls/WebPKI on every platform. The native trust roots
+are loaded with [`rustls-native-certs`](https://crates.io/crates/rustls-native-certs),
+and a CA supplied through `ca_cert_path` is added to those roots.
 
 ```toml
 iotdb-client-rust = { version = "0.1", features = ["tls"] }
@@ -200,6 +204,10 @@ let config = SessionConfig {
 // or: TableSession::builder().use_ssl(true).ca_cert_path("ca.pem")...
 ```
 
+`accept_invalid_certs` disables certificate-chain and hostname verification,
+but TLS handshake signatures are still cryptographically verified. It should
+only be used with controlled test servers.
+
 For **mutual TLS** (server has `thrift_ssl_client_auth=true`), add a PEM client certificate and its PKCS#8 key — the analogue of the Node.js `sslOptions.cert`/`sslOptions.key`:
 
 ```rust

README_ZH.md

@@ -183,7 +183,11 @@ let config = SessionConfig { enable_rpc_compression: true, ..Default::default()
 
 必须与**服务端**配置 `dn_rpc_thrift_compression_enable`（默认 `false`）一致。服务端只讲一种协议——没有按连接协商的机制，任意方向的不匹配都会在第一个 RPC 上以传输错误失败。
 
-**TLS** 位于 `tls` cargo feature 之后（基于 [`native-tls`](https://crates.io/crates/native-tls) 的平台原生 TLS）：
+**TLS** 位于 `tls` cargo feature 之后。其底层使用
+[`rustls`](https://crates.io/crates/rustls) 和 `ring` 密码学 provider，支持
+TLS 1.2/1.3。所有平台均使用 rustls/WebPKI 执行一致的服务端证书校验；系统信任根通过
+[`rustls-native-certs`](https://crates.io/crates/rustls-native-certs) 加载，
+`ca_cert_path` 指定的 CA 会追加到这些信任根中。
 
 ```toml
 iotdb-client-rust = { version = "0.1", features = ["tls"] }
@@ -200,6 +204,9 @@ let config = SessionConfig {
 // 或：TableSession::builder().use_ssl(true).ca_cert_path("ca.pem")...
 ```
 
+`accept_invalid_certs` 会关闭证书链和主机名校验，但 TLS 握手签名仍会经过密码学校验。
+该选项只应对受控的测试服务使用。
+
 **双向 TLS**（服务端 `thrift_ssl_client_auth=true`）需额外提供 PEM 客户端证书及其 PKCS#8 私钥 —— 对应 Node.js 的 `sslOptions.cert`/`sslOptions.key`：
 
 ```rust