{"record":{"id":"6a254bc0ec0ee39b","repo":"cloudflare/pingora","slug":"no-tls-feature-was-specified","errorCode":null,"errorMessage":"No tls feature was specified","messagePattern":"No tls feature was specified","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pingora-core/src/protocols/tls/noop_tls/mod.rs","lineNumber":102,"sourceCode":"    impl TlsSettings {\n        pub fn build(&self) -> Acceptor {\n            Acceptor\n        }\n\n        pub fn intermediate(_: &str, _: &str) -> Result<Self> {\n            Ok(Self)\n        }\n\n        pub fn enable_h2(&mut self) {}\n\n        pub fn set_offload_threadpool(&mut self, _: usize, _: usize) {}\n\n        pub fn set_offload_threadpool_from_server_conf(&mut self, _: &ServerConf) {}\n    }\n\n    impl Acceptor {\n        pub async fn tls_handshake<S: AsyncRead + AsyncWrite>(&self, _: S) -> Result<SslStream<S>> {\n            unimplemented!(\"No tls feature was specified\")\n        }\n    }\n}\n\npub mod stream {\n    use std::{\n        pin::Pin,\n        task::{Context, Poll},\n    };\n\n    use async_trait::async_trait;\n    use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};\n\n    use crate::protocols::{\n        GetProxyDigest, GetSocketDigest, GetTimingDigest, Peek, Shutdown, Ssl, UniqueID,\n    };\n\n    /// A TLS session over a stream.","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/cloudflare/pingora/blob/0046038bd402bc82912da862dadf9a479f31e9f1/pingora-core/src/protocols/tls/noop_tls/mod.rs#L84-L120","documentation":"pingora-core compiles even without any TLS provider feature (openssl, boringssl, rustls, s2n) by substituting the no-op TLS stubs in protocols/tls/noop_tls. The stubs keep the type surface compiling but cannot perform real crypto, so the stub listeners::Acceptor::tls_handshake() panics with unimplemented!(\"No tls feature was specified\") the first time a TLS connection is accepted. Note the asymmetry: the no-op outbound connector silently returns a fake stream, while the inbound accept path panics.","triggerScenarios":"A binary built from pingora-core with no TLS feature enabled creates an Acceptor via TlsSettings::intermediate(cert, key).build() and accepts a connection: the accept path calls Acceptor::tls_handshake() (noop_tls/mod.rs:102) and panics immediately.","commonSituations":"Declaring the pingora dependency with default-features = false without re-enabling a TLS feature; a workspace refactor where feature unification from another crate previously pulled openssl in and later dropped it; running the TLS example binaries without cargo run -F openssl.","solutions":["Enable exactly one TLS provider feature, e.g. pingora-core = { version = \"0.8\", features = [\"openssl\"] } (alternatives: rustls, boringssl, s2n)","Verify what is compiled in: cargo tree -e features | grep -E 'openssl|rustls|boringssl|s2n'","If TLS is genuinely not needed, remove the TLS acceptor/listener setup so the stub Acceptor is never reached"],"exampleFix":"// before\npingora-core = { version = \"0.8\", default-features = false }\n\n// after\npingora-core = { version = \"0.8\", default-features = false, features = [\"rustls\"] }\n// or simply keep the default openssl provider:\npingora-core = \"0.8\"","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never strip pingora's default features without explicitly enabling openssl, rustls, boringssl, or s2n","After dependency changes run cargo tree -e features and confirm a TLS provider still reaches pingora-core","Add a CI integration test that completes one loopback TLS handshake through your listener so a missing provider fails the build, not production","Remember the no-op outbound connector silently returns a fake stream: smoke-test upstream HTTPS too, not just termination"],"tags":["rust","tls","cargo-features","compile-config","pingora"],"backgroundTag":"missing-cargo-feature","analyzedSha":"0046038bd402bc82912da862dadf9a479f31e9f1","analyzedAt":"2026-08-16T21:33:22.341Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}