feat(hpx): add OpenSSL TLS backend with full feature parity to BoringSSL

Add a complete OpenSSL TLS backend as an alternative to BoringSSL, enabling
TLS support on platforms where BoringSSL is unavailable. The backend mirrors
the existing BoringSSL implementation with session caching, SNI, ALPN,
hostname verification, mTLS, and keylog support.

Key changes:
- New openssl module with SslConnector-based TLS setup, sharded LRU session
  cache, and Tower Service implementations for Uri, ConnectRequest, and
  EstablishedConn
- TlsVersion Hash impl uses discriminant matching instead of format!() to
  avoid heap allocation on the hot path
- setup_ssl now applies tls_sni and verify_hostname settings for Service<Uri>
- set_bool! macro explicitly discards set_options return value
- unsafe block in setup_ssl2 annotated with # Safety comment
- CertificateCompressionAlgorithm placeholder derives Debug/Clone/Copy with
  clarifying docs
- HandshakeConfigBuilder methods marked #[must_use]
- Cert store rebuild documented with API limitation rationale
- Identity add_to_tls implemented for openssl::ssl::SslConnectorBuilder
- PEM extraction helpers shared between boring and openssl backends
- Integration test for mTLS with combined PEM identity

Author: Akagi201

Cargo.toml

@@ -3,7 +3,7 @@ members = ["bin/*", "crates/*"]
 resolver = "3"
 
 [workspace.package]
-version = "2.4.32"
+version = "2.4.33"
 edition = "2024"
 authors = ["Akagi201 <akagi201@gmail.com>"]
 license = "Apache-2.0"
@@ -184,13 +184,13 @@ all = "warn"
 
 [workspace.dependencies]
 # local crates
-hpx = { path = "crates/hpx", version = "2.4.32" }
+hpx = { path = "crates/hpx", version = "2.4.33" }
 
-hpx-browser = { path = "crates/hpx-browser", version = "2.4.32" }
+hpx-browser = { path = "crates/hpx-browser", version = "2.4.33" }
 
-hpx-dl = { path = "crates/hpx-dl", version = "2.4.32" }
+hpx-dl = { path = "crates/hpx-dl", version = "2.4.33" }
 
-hpx-yawc = { path = "crates/yawc", version = "2.4.32" }
+hpx-yawc = { path = "crates/yawc", version = "2.4.33" }
 
 # external crates
 ahash = "0.8.12"
@@ -242,6 +242,7 @@ md-5 = "0.11.0"
 memchr = "2.8.2"
 mime = "0.3.17"
 mime_guess = "2.0.5"
+openssl = "0.10"
 parking_lot = "0.12.3"
 percent-encoding = "2.3.2"
 pin-project = "1.1.11"
@@ -287,6 +288,7 @@ tempfile = "3.27.0"
 thiserror = "2.0.18"
 tokio = "1.52.1"
 tokio-boring = "5.0.0"
+tokio-openssl = "0.6"
 tokio-rustls = "0.26"
 tokio-socks = "0.5.3"
 tokio-test = "0.4.5"

crates/hpx/Cargo.toml

@@ -148,6 +148,11 @@ stealth = [
     "ws-yawc",
     "zstd",
 ]
+# Enable OpenSSL support.
+openssl-tls = ["dep:openssl", "dep:tokio-openssl"]
+
+# Enable vendored OpenSSL (static linking).
+openssl-vendored = ["openssl-tls", "openssl/vendored"]
 
 ## macOS system proxy
 [target.'cfg(target_os = "macos")'.dependencies]
@@ -264,8 +269,10 @@ hotpath = { workspace = true, optional = true }
 
 ## tracing
 base64 = { workspace = true }
+openssl = { workspace = true, optional = true }
 sha1 = { workspace = true, optional = true }
 sha2 = { workspace = true, optional = true }
+tokio-openssl = { workspace = true, optional = true }
 tracing = { workspace = true, features = ["std"], optional = true }
 
 [dev-dependencies]

crates/hpx/src/client.rs

@@ -22,7 +22,7 @@ pub(crate) use self::conn::{Connected, Connection};
 pub use self::core::http1;
 #[cfg(feature = "http2")]
 pub use self::core::http2;
-#[cfg(feature = "boring")]
+#[cfg(any(feature = "boring", feature = "openssl-tls"))]
 pub(crate) use self::http::ConnectIdentity;
 #[allow(deprecated)]
 pub use self::http::{

crates/hpx/src/client/conn/conn.rs

@@ -140,6 +140,15 @@ impl Connection for TlsConn<TcpStream> {
                 connected
             }
         }
+        #[cfg(all(feature = "openssl-tls", not(feature = "boring")))]
+        {
+            let connected = self.inner.get_ref().connected();
+            if self.inner.ssl().selected_alpn_protocol() == Some(b"h2") {
+                connected.negotiated_h2()
+            } else {
+                connected
+            }
+        }
         #[cfg(all(feature = "rustls-tls", not(feature = "boring")))]
         {
             let (io, session) = self.inner.get_ref();
@@ -150,7 +159,7 @@ impl Connection for TlsConn<TcpStream> {
                 connected
             }
         }
-        #[cfg(not(any(feature = "boring", feature = "rustls-tls")))]
+        #[cfg(not(any(feature = "boring", feature = "openssl-tls", feature = "rustls-tls")))]
         {
             self.inner.get_ref().connected()
         }
@@ -168,6 +177,15 @@ impl Connection for TlsConn<MaybeHttpsStream<TcpStream>> {
                 connected
             }
         }
+        #[cfg(all(feature = "openssl-tls", not(feature = "boring")))]
+        {
+            let connected = self.inner.get_ref().connected();
+            if self.inner.ssl().selected_alpn_protocol() == Some(b"h2") {
+                connected.negotiated_h2()
+            } else {
+                connected
+            }
+        }
         #[cfg(all(feature = "rustls-tls", not(feature = "boring")))]
         {
             let (io, session) = self.inner.get_ref();
@@ -178,7 +196,7 @@ impl Connection for TlsConn<MaybeHttpsStream<TcpStream>> {
                 connected
             }
         }
-        #[cfg(not(any(feature = "boring", feature = "rustls-tls")))]
+        #[cfg(not(any(feature = "boring", feature = "openssl-tls", feature = "rustls-tls")))]
         {
             self.inner.get_ref().connected()
         }
@@ -199,6 +217,15 @@ impl Connection for TlsConn<UnixStream> {
                 connected
             }
         }
+        #[cfg(all(feature = "openssl-tls", not(feature = "boring")))]
+        {
+            let connected = self.inner.get_ref().connected();
+            if self.inner.ssl().selected_alpn_protocol() == Some(b"h2") {
+                connected.negotiated_h2()
+            } else {
+                connected
+            }
+        }
         #[cfg(all(feature = "rustls-tls", not(feature = "boring")))]
         {
             let (io, session) = self.inner.get_ref();
@@ -209,7 +236,7 @@ impl Connection for TlsConn<UnixStream> {
                 connected
             }
         }
-        #[cfg(not(any(feature = "boring", feature = "rustls-tls")))]
+        #[cfg(not(any(feature = "boring", feature = "openssl-tls", feature = "rustls-tls")))]
         {
             self.inner.get_ref().connected()
         }
@@ -228,6 +255,15 @@ impl Connection for TlsConn<MaybeHttpsStream<UnixStream>> {
                 connected
             }
         }
+        #[cfg(all(feature = "openssl-tls", not(feature = "boring")))]
+        {
+            let connected = self.inner.get_ref().connected();
+            if self.inner.ssl().selected_alpn_protocol() == Some(b"h2") {
+                connected.negotiated_h2()
+            } else {
+                connected
+            }
+        }
         #[cfg(all(feature = "rustls-tls", not(feature = "boring")))]
         {
             let (io, session) = self.inner.get_ref();
@@ -238,7 +274,7 @@ impl Connection for TlsConn<MaybeHttpsStream<UnixStream>> {
                 connected
             }
         }
-        #[cfg(not(any(feature = "boring", feature = "rustls-tls")))]
+        #[cfg(not(any(feature = "boring", feature = "openssl-tls", feature = "rustls-tls")))]
         {
             self.inner.get_ref().connected()
         }

crates/hpx/src/client/conn/tls_info.rs

@@ -1,10 +1,12 @@
-#[cfg(any(feature = "boring", feature = "rustls-tls"))]
+#[cfg(any(feature = "boring", feature = "openssl-tls", feature = "rustls-tls"))]
 use bytes::Bytes;
 use tokio::net::TcpStream;
 #[cfg(unix)]
 use tokio::net::UnixStream;
 #[cfg(feature = "boring")]
 use tokio_boring::SslStream;
+#[cfg(all(feature = "openssl-tls", not(feature = "boring")))]
+use tokio_openssl::SslStream;
 #[cfg(feature = "rustls-tls")]
 use tokio_rustls::client::TlsStream;
 
@@ -36,6 +38,24 @@ fn extract_tls_info<S>(ssl_stream: &SslStream<S>) -> TlsInfo {
     }
 }
 
+#[cfg(all(feature = "openssl-tls", not(feature = "boring")))]
+fn extract_tls_info<S>(ssl_stream: &SslStream<S>) -> TlsInfo {
+    let ssl = ssl_stream.ssl();
+    TlsInfo {
+        peer_certificate: ssl
+            .peer_certificate()
+            .and_then(|cert| cert.to_der().ok())
+            .map(Bytes::from),
+        peer_certificate_chain: ssl.peer_cert_chain().map(|chain| {
+            chain
+                .iter()
+                .filter_map(|cert| cert.to_der().ok())
+                .map(Bytes::from)
+                .collect()
+        }),
+    }
+}
+
 // ===== impl TcpStream =====
 
 impl TlsInfoFactory for TcpStream {
@@ -52,6 +72,14 @@ impl TlsInfoFactory for SslStream<TcpStream> {
     }
 }
 
+#[cfg(all(feature = "openssl-tls", not(feature = "boring")))]
+impl TlsInfoFactory for SslStream<TcpStream> {
+    #[inline]
+    fn tls_info(&self) -> Option<TlsInfo> {
+        Some(extract_tls_info(self))
+    }
+}
+
 #[cfg(feature = "rustls-tls")]
 impl TlsInfoFactory for TlsStream<TcpStream> {
     #[inline]
@@ -80,6 +108,14 @@ impl TlsInfoFactory for SslStream<MaybeHttpsStream<TcpStream>> {
     }
 }
 
+#[cfg(all(feature = "openssl-tls", not(feature = "boring")))]
+impl TlsInfoFactory for SslStream<MaybeHttpsStream<TcpStream>> {
+    #[inline]
+    fn tls_info(&self) -> Option<TlsInfo> {
+        Some(extract_tls_info(self))
+    }
+}
+
 #[cfg(feature = "rustls-tls")]
 impl TlsInfoFactory for TlsStream<MaybeHttpsStream<TcpStream>> {
     #[inline]
@@ -108,6 +144,14 @@ impl TlsInfoFactory for SslStream<UnixStream> {
     }
 }
 
+#[cfg(all(unix, feature = "openssl-tls", not(feature = "boring")))]
+impl TlsInfoFactory for SslStream<UnixStream> {
+    #[inline]
+    fn tls_info(&self) -> Option<TlsInfo> {
+        Some(extract_tls_info(self))
+    }
+}
+
 #[cfg(all(unix, feature = "rustls-tls"))]
 impl TlsInfoFactory for TlsStream<UnixStream> {
     #[inline]
@@ -137,6 +181,14 @@ impl TlsInfoFactory for SslStream<MaybeHttpsStream<UnixStream>> {
     }
 }
 
+#[cfg(all(unix, feature = "openssl-tls", not(feature = "boring")))]
+impl TlsInfoFactory for SslStream<MaybeHttpsStream<UnixStream>> {
+    #[inline]
+    fn tls_info(&self) -> Option<TlsInfo> {
+        Some(extract_tls_info(self))
+    }
+}
+
 #[cfg(all(unix, feature = "rustls-tls"))]
 impl TlsInfoFactory for TlsStream<MaybeHttpsStream<UnixStream>> {
     #[inline]

crates/hpx/src/client/http.rs

@@ -22,7 +22,7 @@ use tower::{
     util::{BoxCloneSyncService, BoxCloneSyncServiceLayer, MapErr, Oneshot},
 };
 
-#[cfg(feature = "boring")]
+#[cfg(any(feature = "boring", feature = "openssl-tls"))]
 pub(crate) use self::client::extra::ConnectIdentity;
 pub(crate) use self::client::{ConnectRequest, HttpClient, extra::ConnectExtra};
 #[allow(deprecated)]