From 94db6b4de8e5bee62989863d3bb00d6377e63b71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sun, 2 Feb 2025 13:03:27 +0100
Subject: [PATCH 01/29] node: fix docstring

---
 scylla/src/cluster/node.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scylla/src/cluster/node.rs b/scylla/src/cluster/node.rs
index 1e66f9be93..f11b31ba7e 100644
--- a/scylla/src/cluster/node.rs
+++ b/scylla/src/cluster/node.rs
@@ -132,8 +132,8 @@ impl Node {
     /// The underlying pool is preserved and notified about the IP change.
     /// # Arguments
     ///
-    /// `node` - previous definition of that node
-    /// `address` - new address to connect to
+    /// - `node` - previous definition of that node
+    /// - `address` - new address to connect to
     pub(crate) fn inherit_with_ip_changed(node: &Node, endpoint: PeerEndpoint) -> Self {
         let address = endpoint.address;
         if let Some(ref pool) = node.pool {

From e365701cdfe7b1703012c527bd731389c638ade0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Wed, 29 Jan 2025 08:40:42 +0100
Subject: [PATCH 02/29] connection_pool: fix outdated comments

ConnectionKeeper is no longer there.
---
 scylla/src/network/connection_pool.rs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scylla/src/network/connection_pool.rs b/scylla/src/network/connection_pool.rs
index 835ac3f211..3b9833b66f 100644
--- a/scylla/src/network/connection_pool.rs
+++ b/scylla/src/network/connection_pool.rs
@@ -328,10 +328,10 @@ impl NodeConnectionPool {
                 response_sender,
             })
             .await
-            .expect("Bug in ConnectionKeeper::use_keyspace sending");
-        // Other end of this channel is in the Refiller, can't be dropped while we have &self to _refiller_handle
+            .expect("Bug in NodeConnectionPool::use_keyspace sending");
+        // Other end of this channel is in the PoolRefiller, can't be dropped while we have &self to _refiller_handle
 
-        response_receiver.await.unwrap() // NodePoolRefiller always responds
+        response_receiver.await.unwrap() // PoolRefiller always responds
     }
 
     // Waits until the pool becomes initialized.

From f2aca039ada93c30f167152a944222e4d39fdfc9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Wed, 29 Jan 2025 10:22:39 +0100
Subject: [PATCH 03/29] connection_pool: impl Default for PoolConfig only for
 tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The impl of Default for PoolConfig is only useful for tests.

Co-authored-by: Karol Baryła <karol.baryla@scylladb.com>
---
 scylla/src/network/connection_pool.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scylla/src/network/connection_pool.rs b/scylla/src/network/connection_pool.rs
index 3b9833b66f..d78b46d209 100644
--- a/scylla/src/network/connection_pool.rs
+++ b/scylla/src/network/connection_pool.rs
@@ -65,6 +65,7 @@ pub(crate) struct PoolConfig {
     pub(crate) keepalive_interval: Option<Duration>,
 }
 
+#[cfg(test)]
 impl Default for PoolConfig {
     fn default() -> Self {
         Self {

From 9d0bab359cbea137f9139a86ec76b3ec8c54afc1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Karol=20Bary=C5=82a?= <karol.baryla@scylladb.com>
Date: Sat, 30 Nov 2024 10:44:02 +0100
Subject: [PATCH 04/29] PoolConfig: remove keepalive_interval

It was only passed around back and forth, but unused apart from that.
The keepalive interval that is used in keepaliver comes from
ConnectionConfig, not PoolConfig.
---
 scylla/src/client/session.rs          |  1 -
 scylla/src/cluster/metadata.rs        | 10 +---------
 scylla/src/cluster/worker.rs          |  1 -
 scylla/src/network/connection_pool.rs |  2 --
 4 files changed, 1 insertion(+), 13 deletions(-)

diff --git a/scylla/src/client/session.rs b/scylla/src/client/session.rs
index dd2efbcaf1..d737c2f45b 100644
--- a/scylla/src/client/session.rs
+++ b/scylla/src/client/session.rs
@@ -1009,7 +1009,6 @@ where
             connection_config,
             pool_size: config.connection_pool_size,
             can_use_shard_aware_port: !config.disallow_shard_aware_port,
-            keepalive_interval: config.keepalive_interval,
         };
 
         let cluster = Cluster::new(
diff --git a/scylla/src/cluster/metadata.rs b/scylla/src/cluster/metadata.rs
index 2ac5ec0feb..e01671c797 100644
--- a/scylla/src/cluster/metadata.rs
+++ b/scylla/src/cluster/metadata.rs
@@ -44,7 +44,7 @@ use std::net::{IpAddr, SocketAddr};
 use std::num::NonZeroUsize;
 use std::str::FromStr;
 use std::sync::Arc;
-use std::time::{Duration, Instant};
+use std::time::Instant;
 use thiserror::Error;
 use tokio::sync::{broadcast, mpsc};
 use tracing::{debug, error, trace, warn};
@@ -70,7 +70,6 @@ type PerKsTableResult<T, E> = PerKsTable<Result<T, E>>;
 /// Allows to read current metadata from the cluster
 pub(crate) struct MetadataReader {
     connection_config: ConnectionConfig,
-    keepalive_interval: Option<Duration>,
 
     control_connection_endpoint: UntranslatedEndpoint,
     control_connection: NodeConnectionPool,
@@ -399,7 +398,6 @@ impl MetadataReader {
         initial_known_nodes: Vec<InternalKnownNode>,
         control_connection_repair_requester: broadcast::Sender<()>,
         mut connection_config: ConnectionConfig,
-        keepalive_interval: Option<Duration>,
         server_event_sender: mpsc::Sender<Event>,
         keyspaces_to_fetch: Vec<String>,
         fetch_schema: bool,
@@ -429,14 +427,12 @@ impl MetadataReader {
         let control_connection = Self::make_control_connection_pool(
             control_connection_endpoint.clone(),
             connection_config.clone(),
-            keepalive_interval,
             control_connection_repair_requester.clone(),
         );
 
         Ok(MetadataReader {
             control_connection_endpoint,
             control_connection,
-            keepalive_interval,
             connection_config,
             known_peers: initial_peers
                 .into_iter()
@@ -550,7 +546,6 @@ impl MetadataReader {
             self.control_connection = Self::make_control_connection_pool(
                 self.control_connection_endpoint.clone(),
                 self.connection_config.clone(),
-                self.keepalive_interval,
                 self.control_connection_repair_requester.clone(),
             );
 
@@ -648,7 +643,6 @@ impl MetadataReader {
                     self.control_connection = Self::make_control_connection_pool(
                         self.control_connection_endpoint.clone(),
                         self.connection_config.clone(),
-                        self.keepalive_interval,
                         self.control_connection_repair_requester.clone(),
                     );
                 }
@@ -659,12 +653,10 @@ impl MetadataReader {
     fn make_control_connection_pool(
         endpoint: UntranslatedEndpoint,
         connection_config: ConnectionConfig,
-        keepalive_interval: Option<Duration>,
         refresh_requester: broadcast::Sender<()>,
     ) -> NodeConnectionPool {
         let pool_config = PoolConfig {
             connection_config,
-            keepalive_interval,
 
             // We want to have only one connection to receive events from
             pool_size: PoolSize::PerHost(NonZeroUsize::new(1).unwrap()),
diff --git a/scylla/src/cluster/worker.rs b/scylla/src/cluster/worker.rs
index 1d047377e1..9d88b79891 100644
--- a/scylla/src/cluster/worker.rs
+++ b/scylla/src/cluster/worker.rs
@@ -124,7 +124,6 @@ impl Cluster {
             known_nodes,
             control_connection_repair_sender,
             pool_config.connection_config.clone(),
-            pool_config.keepalive_interval,
             server_events_sender,
             keyspaces_to_fetch,
             fetch_schema_metadata,
diff --git a/scylla/src/network/connection_pool.rs b/scylla/src/network/connection_pool.rs
index d78b46d209..95f5748034 100644
--- a/scylla/src/network/connection_pool.rs
+++ b/scylla/src/network/connection_pool.rs
@@ -62,7 +62,6 @@ pub(crate) struct PoolConfig {
     pub(crate) connection_config: ConnectionConfig,
     pub(crate) pool_size: PoolSize,
     pub(crate) can_use_shard_aware_port: bool,
-    pub(crate) keepalive_interval: Option<Duration>,
 }
 
 #[cfg(test)]
@@ -72,7 +71,6 @@ impl Default for PoolConfig {
             connection_config: Default::default(),
             pool_size: Default::default(),
             can_use_shard_aware_port: true,
-            keepalive_interval: None,
         }
     }
 }

From 1af784109ca47b3fddd33ac51ad4ba6b41ec8ad3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Wed, 29 Jan 2025 08:37:11 +0100
Subject: [PATCH 05/29] Cargo.toml: bump openssl dep to 0.10.69

This updates openssl to its latest available patch release.
The version that we required had some security vulnerabilities reported.
---
 Cargo.lock.msrv   | 165 ++++++++++++++++++++++++----------------------
 scylla/Cargo.toml |   2 +-
 2 files changed, 88 insertions(+), 79 deletions(-)

diff --git a/Cargo.lock.msrv b/Cargo.lock.msrv
index d594b3b41c..d7463d306f 100644
--- a/Cargo.lock.msrv
+++ b/Cargo.lock.msrv
@@ -4,9 +4,9 @@ version = 3
 
 [[package]]
 name = "addr2line"
-version = "0.21.0"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
+checksum = "6e4503c46a5c0c7844e948c9a4d6acd9f50cccb4de1c48eb9e291ea17470c678"
 dependencies = [
  "gimli",
 ]
@@ -119,9 +119,9 @@ checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
 [[package]]
 name = "backtrace"
-version = "0.3.71"
+version = "0.3.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b05800d2e817c8b3b4b54abd461726265fa9789ae34330622f2db9ee696f9d"
+checksum = "5cc23269a4f8976d0a4d2e7109211a419fe30e8d88d677cd60b6bc79c5732e0a"
 dependencies = [
  "addr2line",
  "cc",
@@ -189,9 +189,12 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.0.97"
+version = "1.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "099a5357d84c4c61eb35fc8eafa9a79a902c2f76911e5747ced4e032edd8d9b4"
+checksum = "13208fcbb66eaeffe09b99fffbe1af420f00a7b35aa99ad683dfc1aa76145229"
+dependencies = [
+ "shlex",
+]
 
 [[package]]
 name = "cfg-if"
@@ -208,7 +211,7 @@ dependencies = [
  "android-tzdata",
  "iana-time-zone",
  "num-traits",
- "windows-targets 0.52.5",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -290,9 +293,9 @@ dependencies = [
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "criterion"
@@ -656,9 +659,9 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.28.1"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
+checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"
 
 [[package]]
 name = "half"
@@ -815,9 +818,9 @@ checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "js-sys"
-version = "0.3.69"
+version = "0.3.70"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
+checksum = "1868808506b929d7b0cfa8f75951347aa71bb21144b7791bae35d9bccfcfe37a"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -840,16 +843,6 @@ version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
 
-[[package]]
-name = "libredox"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
-dependencies = [
- "bitflags 2.5.0",
- "libc",
-]
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.13"
@@ -1047,9 +1040,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.32.2"
+version = "0.36.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
+checksum = "27b64972346851a39438c60b341ebc01bba47464ae329e55cf343eb93964efd9"
 dependencies = [
  "memchr",
 ]
@@ -1068,9 +1061,9 @@ checksum = "0ab1bc2a289d34bd04a330323ac98a1b4bc82c9d9fcb1e66b63caa84da26b575"
 
 [[package]]
 name = "openssl"
-version = "0.10.64"
+version = "0.10.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95a0481286a310808298130d22dd1fef0fa571e05a8f44ec801801e84b216b1f"
+checksum = "f5e534d133a060a3c19daec1eb3e98ec6f4685978834f2dbadfe2ec215bab64e"
 dependencies = [
  "bitflags 2.5.0",
  "cfg-if",
@@ -1094,9 +1087,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.102"
+version = "0.9.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
+checksum = "45abf306cbf99debc8195b66b7346498d7b10c210de50418b5ccd7ceba08c741"
 dependencies = [
  "cc",
  "libc",
@@ -1134,9 +1127,9 @@ checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall",
+ "redox_syscall 0.5.3",
  "smallvec",
- "windows-targets 0.52.5",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -1325,21 +1318,30 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.1"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469052894dcb553421e483e4209ee581a45100d31b4018de03e5a7ad86374a7e"
+checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a908a6e00f1fdd0dfd9c0eb08ce85126f6d8bbda50017e74bc4a4b7d4a926a4"
 dependencies = [
  "bitflags 2.5.0",
 ]
 
 [[package]]
 name = "redox_users"
-version = "0.4.5"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd283d9651eeda4b2a83a43c1c91b266c40fd76ecd39a50a8c630ae69dc72891"
+checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
 dependencies = [
  "getrandom",
- "libredox",
+ "redox_syscall 0.2.16",
  "thiserror 1.0.60",
 ]
 
@@ -1626,6 +1628,12 @@ dependencies = [
  "lazy_static",
 ]
 
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.2"
@@ -2111,19 +2119,20 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.92"
+version = "0.2.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
+checksum = "a82edfc16a6c469f5f44dc7b571814045d60404b55a0ee849f9bcfa2e63dd9b5"
 dependencies = [
  "cfg-if",
+ "once_cell",
  "wasm-bindgen-macro",
 ]
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.92"
+version = "0.2.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
+checksum = "9de396da306523044d3302746f1208fa71d7532227f15e347e2d93e4145dd77b"
 dependencies = [
  "bumpalo",
  "log",
@@ -2136,9 +2145,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.92"
+version = "0.2.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
+checksum = "585c4c91a46b072c92e908d99cb1dcdf95c5218eeb6f3bf1efa991ee7a68cccf"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2146,9 +2155,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.92"
+version = "0.2.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
+checksum = "afc340c74d9005395cf9dd098506f7f44e38f2b4a21c6aaacf9a105ea5e1e836"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2159,15 +2168,15 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.92"
+version = "0.2.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
+checksum = "c62a0a307cb4a311d3a07867860911ca130c3494e8c2719593806c08bc5d0484"
 
 [[package]]
 name = "web-sys"
-version = "0.3.69"
+version = "0.3.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77afa9a11836342370f4817622a2f0f418b134426d91a82dfb48f532d2ec13ef"
+checksum = "9b85cbef8c220a6abc02aefd892dfc0fc23afb1c6a426316ec33253a3877249b"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -2191,11 +2200,11 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.8"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
 dependencies = [
- "windows-sys 0.52.0",
+ "winapi",
 ]
 
 [[package]]
@@ -2210,7 +2219,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.5",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -2228,7 +2237,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.5",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -2248,18 +2257,18 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.5",
- "windows_aarch64_msvc 0.52.5",
- "windows_i686_gnu 0.52.5",
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
  "windows_i686_gnullvm",
- "windows_i686_msvc 0.52.5",
- "windows_x86_64_gnu 0.52.5",
- "windows_x86_64_gnullvm 0.52.5",
- "windows_x86_64_msvc 0.52.5",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
 ]
 
 [[package]]
@@ -2270,9 +2279,9 @@ checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -2282,9 +2291,9 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -2294,15 +2303,15 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
 [[package]]
 name = "windows_i686_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -2312,9 +2321,9 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -2324,9 +2333,9 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -2336,9 +2345,9 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -2348,9 +2357,9 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
diff --git a/scylla/Cargo.toml b/scylla/Cargo.toml
index 2303730864..0a8f0bc48d 100644
--- a/scylla/Cargo.toml
+++ b/scylla/Cargo.toml
@@ -63,7 +63,7 @@ thiserror = "2.0.6"
 itertools = "0.13.0"
 tracing = "0.1.36"
 chrono = { version = "0.4.32", default-features = false, features = ["clock"] }
-openssl = { version = "0.10.32", optional = true }
+openssl = { version = "0.10.69", optional = true }
 tokio-openssl = { version = "0.6.1", optional = true }
 arc-swap = "1.3.0"
 dashmap = "5.2"

From 07ebd7c58c890b9e43128d46b999fd22cd78879a Mon Sep 17 00:00:00 2001
From: Andres Medina <andresnrx@gmail.com>
Date: Tue, 14 Jan 2025 21:30:45 -0800
Subject: [PATCH 06/29] scylla: rename "ssl" feature to "openssl-010"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As openssl crate is still before its 1.0 (stable) release, we need to
prepare for its possible introduces breaking changes. As it's present in
our public API, we hide it behind a versioned feature flag. This way,
if in the future openssl is released in 0.11 or 1.0 version, we'll
simply add the new feature flag and gradually deprecate the old one.

As a side note, openssl crate hasn't issued a major release for 7 years
now, so it's plausible that it's not going to happen (at least soon).

Co-authored-by: Wojciech Przytuła <wojciech.przytula@scylladb.com>
---
 .github/workflows/tls.yml             |  2 +-
 Cargo.lock.msrv                       |  8 ++++----
 docs/source/connecting/tls.md         |  8 ++++----
 examples/Cargo.toml                   |  2 +-
 scylla/Cargo.toml                     |  4 ++--
 scylla/src/client/session.rs          | 10 +++++-----
 scylla/src/client/session_builder.rs  |  4 ++--
 scylla/src/network/connection.rs      | 18 +++++++++---------
 scylla/src/network/connection_pool.rs |  2 +-
 scylla/src/network/mod.rs             |  2 +-
 10 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/tls.yml b/.github/workflows/tls.yml
index 5691900bd1..308018b561 100644
--- a/.github/workflows/tls.yml
+++ b/.github/workflows/tls.yml
@@ -36,7 +36,7 @@ jobs:
     - name: Update rust toolchain
       run: rustup update
     - name: Check
-      run: cargo check --verbose --features "ssl"
+      run: cargo check --verbose --features "openssl-010"
       working-directory: ${{env.working-directory}}
     - name: Run tls example
       run: cargo run --example tls
diff --git a/Cargo.lock.msrv b/Cargo.lock.msrv
index d7463d306f..a798dc52ac 100644
--- a/Cargo.lock.msrv
+++ b/Cargo.lock.msrv
@@ -502,7 +502,7 @@ dependencies = [
  "clap",
  "env_logger",
  "futures",
- "openssl",
+ "openssl-010",
  "rand",
  "rustyline",
  "rustyline-derive",
@@ -1060,7 +1060,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ab1bc2a289d34bd04a330323ac98a1b4bc82c9d9fcb1e66b63caa84da26b575"
 
 [[package]]
-name = "openssl"
+name = "openssl-010"
 version = "0.10.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f5e534d133a060a3c19daec1eb3e98ec6f4685978834f2dbadfe2ec215bab64e"
@@ -1486,7 +1486,7 @@ dependencies = [
  "ntest",
  "num-bigint 0.3.3",
  "num-bigint 0.4.5",
- "openssl",
+ "openssl-010",
  "rand",
  "rand_chacha",
  "rand_pcg",
@@ -1900,7 +1900,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ffab79df67727f6acf57f1ff743091873c24c579b1e2ce4d8f53e47ded4d63d"
 dependencies = [
  "futures-util",
- "openssl",
+ "openssl-010",
  "openssl-sys",
  "tokio",
 ]
diff --git a/docs/source/connecting/tls.md b/docs/source/connecting/tls.md
index 88e472315b..d1c1fe82d5 100644
--- a/docs/source/connecting/tls.md
+++ b/docs/source/connecting/tls.md
@@ -10,12 +10,12 @@ It was chosen because [`rustls`](https://github.com/ctz/rustls) doesn't support
 
 To enable the `tls` feature add in `Cargo.toml`:
 ```toml
-scylla = { version = "0.4", features = ["ssl"] }
+scylla = { version = "0.4", features = ["openssl-010"] }
 openssl = "0.10.32"
 ```
 
 Then install the package with `openssl`:
-* Debian/Ubuntu: 
+* Debian/Ubuntu:
     ```bash
     apt install libssl-dev pkg-config
     ```
@@ -23,7 +23,7 @@ Then install the package with `openssl`:
     ```bash
     dnf install openssl-devel
     ```
-<!-- 
+<!--
  scylla-rust-driver doesn't build on Alpine, some strange cc linker errors in proc-macro-hack 0_o
  TODO: try building and add the section
 
@@ -38,7 +38,7 @@ Then install the package with `openssl`:
     ```
 
 ### Using TLS
-To use tls you will have to create an openssl 
+To use tls you will have to create an openssl
 [`SslContext`](https://docs.rs/openssl/0.10.33/openssl/ssl/struct.SslContext.html)
 and pass it to `SessionBuilder`
 
diff --git a/examples/Cargo.toml b/examples/Cargo.toml
index 5b335fd34f..bfea398d63 100644
--- a/examples/Cargo.toml
+++ b/examples/Cargo.toml
@@ -11,7 +11,7 @@ openssl = "0.10.32"
 rustyline = "9"
 rustyline-derive = "0.6"
 scylla = { path = "../scylla", features = [
-    "ssl",
+    "openssl-010",
     "cloud",
     "chrono-04",
     "time-03",
diff --git a/scylla/Cargo.toml b/scylla/Cargo.toml
index 0a8f0bc48d..6f1ce3f72c 100644
--- a/scylla/Cargo.toml
+++ b/scylla/Cargo.toml
@@ -16,9 +16,9 @@ rustdoc-args = ["--cfg", "docsrs"]
 
 [features]
 default = []
-ssl = ["dep:tokio-openssl", "dep:openssl"]
+openssl-010 = ["dep:tokio-openssl", "dep:openssl"]
 cloud = [
-    "ssl",
+    "openssl-010",
     "scylla-cql/serde",
     "dep:serde_yaml",
     "dep:serde",
diff --git a/scylla/src/client/session.rs b/scylla/src/client/session.rs
index d737c2f45b..600240032f 100644
--- a/scylla/src/client/session.rs
+++ b/scylla/src/client/session.rs
@@ -19,7 +19,7 @@ use crate::errors::{
     RequestError, TracingProtocolError, UseKeyspaceError,
 };
 use crate::frame::response::result;
-#[cfg(feature = "ssl")]
+#[cfg(feature = "openssl-010")]
 use crate::network::SslConfig;
 use crate::network::{Connection, ConnectionConfig, PoolConfig, VerifiedKeyspaceName};
 use crate::observability::driver_tracing::RequestSpan;
@@ -45,7 +45,7 @@ use arc_swap::ArcSwapOption;
 use futures::future::join_all;
 use futures::future::try_join_all;
 use itertools::Itertools;
-#[cfg(feature = "ssl")]
+#[cfg(feature = "openssl-010")]
 use openssl::ssl::SslContext;
 use scylla_cql::frame::response::NonErrorResponse;
 use scylla_cql::serialize::batch::BatchValues;
@@ -167,7 +167,7 @@ pub struct SessionConfig {
     pub keyspace_case_sensitive: bool,
 
     /// Provide our Session with TLS
-    #[cfg(feature = "ssl")]
+    #[cfg(feature = "openssl-010")]
     pub ssl_context: Option<SslContext>,
 
     pub authenticator: Option<Arc<dyn AuthenticatorProvider>>,
@@ -292,7 +292,7 @@ impl SessionConfig {
                 .into_handle(),
             used_keyspace: None,
             keyspace_case_sensitive: false,
-            #[cfg(feature = "ssl")]
+            #[cfg(feature = "openssl-010")]
             ssl_context: None,
             authenticator: None,
             connect_timeout: Duration::from_secs(5),
@@ -989,7 +989,7 @@ where
             tcp_nodelay: config.tcp_nodelay,
             tcp_keepalive_interval: config.tcp_keepalive_interval,
             timestamp_generator: config.timestamp_generator,
-            #[cfg(feature = "ssl")]
+            #[cfg(feature = "openssl-010")]
             ssl_config: config.ssl_context.map(SslConfig::new_with_global_context),
             authenticator: config.authenticator.clone(),
             connect_timeout: config.connect_timeout,
diff --git a/scylla/src/client/session_builder.rs b/scylla/src/client/session_builder.rs
index cc543f3b19..a2eeebb28b 100644
--- a/scylla/src/client/session_builder.rs
+++ b/scylla/src/client/session_builder.rs
@@ -16,7 +16,7 @@ use crate::policies::address_translator::AddressTranslator;
 use crate::policies::host_filter::HostFilter;
 use crate::policies::timestamp_generator::TimestampGenerator;
 use crate::statement::Consistency;
-#[cfg(feature = "ssl")]
+#[cfg(feature = "openssl-010")]
 use openssl::ssl::SslContext;
 use std::borrow::Borrow;
 use std::marker::PhantomData;
@@ -353,7 +353,7 @@ impl GenericSessionBuilder<DefaultMode> {
     /// # Ok(())
     /// # }
     /// ```
-    #[cfg(feature = "ssl")]
+    #[cfg(feature = "openssl-010")]
     pub fn ssl_context(mut self, ssl_context: Option<SslContext>) -> Self {
         self.config.ssl_context = ssl_context;
         self
diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index 4659f3b454..03e790a0f3 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -46,13 +46,13 @@ use scylla_cql::serialize::batch::{BatchValues, BatchValuesIterator};
 use scylla_cql::serialize::raw_batch::RawBatchValuesAdapter;
 use scylla_cql::serialize::row::{RowSerializationContext, SerializedValues};
 use socket2::{SockRef, TcpKeepalive};
-#[cfg(feature = "ssl")]
+#[cfg(feature = "openssl-010")]
 pub(crate) use ssl_config::SslConfig;
 use std::borrow::Cow;
 use std::collections::{BTreeSet, HashMap, HashSet};
 use std::convert::TryFrom;
 use std::net::{IpAddr, SocketAddr};
-#[cfg(feature = "ssl")]
+#[cfg(feature = "openssl-010")]
 use std::pin::Pin;
 use std::sync::atomic::AtomicU64;
 use std::sync::Arc;
@@ -66,7 +66,7 @@ use tokio::io::{split, AsyncRead, AsyncWrite, AsyncWriteExt, BufReader, BufWrite
 use tokio::net::{TcpSocket, TcpStream};
 use tokio::sync::{mpsc, oneshot};
 use tokio::time::Instant;
-#[cfg(feature = "ssl")]
+#[cfg(feature = "openssl-010")]
 use tokio_openssl::SslStream;
 use tracing::{debug, error, trace, warn};
 use uuid::Uuid;
@@ -212,7 +212,7 @@ struct TaskResponse {
     body: Bytes,
 }
 
-#[cfg(feature = "ssl")]
+#[cfg(feature = "openssl-010")]
 mod ssl_config {
     use openssl::{
         error::ErrorStack,
@@ -326,7 +326,7 @@ pub(crate) struct ConnectionConfig {
     pub(crate) tcp_nodelay: bool,
     pub(crate) tcp_keepalive_interval: Option<Duration>,
     pub(crate) timestamp_generator: Option<Arc<dyn TimestampGenerator>>,
-    #[cfg(feature = "ssl")]
+    #[cfg(feature = "openssl-010")]
     pub(crate) ssl_config: Option<SslConfig>,
     pub(crate) connect_timeout: std::time::Duration,
     // should be Some only in control connections,
@@ -353,7 +353,7 @@ impl Default for ConnectionConfig {
             tcp_keepalive_interval: None,
             timestamp_generator: None,
             event_sender: None,
-            #[cfg(feature = "ssl")]
+            #[cfg(feature = "openssl-010")]
             ssl_config: None,
             connect_timeout: std::time::Duration::from_secs(5),
             default_consistency: Default::default(),
@@ -375,7 +375,7 @@ impl Default for ConnectionConfig {
 }
 
 impl ConnectionConfig {
-    #[cfg(feature = "ssl")]
+    #[cfg(feature = "openssl-010")]
     fn is_ssl(&self) -> bool {
         #[cfg(feature = "cloud")]
         if self.cloud_config.is_some() {
@@ -384,7 +384,7 @@ impl ConnectionConfig {
         self.ssl_config.is_some()
     }
 
-    #[cfg(not(feature = "ssl"))]
+    #[cfg(not(feature = "openssl-010"))]
     fn is_ssl(&self) -> bool {
         false
     }
@@ -1351,7 +1351,7 @@ impl Connection {
         router_handle: Arc<RouterHandle>,
         node_address: IpAddr,
     ) -> Result<RemoteHandle<()>, std::io::Error> {
-        #[cfg(feature = "ssl")]
+        #[cfg(feature = "openssl-010")]
         if let Some(ssl_config) = &config.ssl_config {
             let ssl = ssl_config.new_ssl()?;
             let mut stream = SslStream::new(ssl, stream)?;
diff --git a/scylla/src/network/connection_pool.rs b/scylla/src/network/connection_pool.rs
index 95f5748034..005875e87a 100644
--- a/scylla/src/network/connection_pool.rs
+++ b/scylla/src/network/connection_pool.rs
@@ -1222,7 +1222,7 @@ mod tests {
         let connection_config = ConnectionConfig {
             compression: None,
             tcp_nodelay: true,
-            #[cfg(feature = "ssl")]
+            #[cfg(feature = "openssl-010")]
             ssl_config: None,
             ..Default::default()
         };
diff --git a/scylla/src/network/mod.rs b/scylla/src/network/mod.rs
index 308e65a7ab..77d852c0f8 100644
--- a/scylla/src/network/mod.rs
+++ b/scylla/src/network/mod.rs
@@ -5,7 +5,7 @@
 //! - NodeConnectionPool - a manager that keeps a desired number of connections opened to each shard.
 
 mod connection;
-#[cfg(feature = "ssl")]
+#[cfg(feature = "openssl-010")]
 pub(crate) use connection::SslConfig;
 pub(crate) use connection::{Connection, ConnectionConfig, VerifiedKeyspaceName};
 

From d26e66b1a50d9d4ba86e860c53a6d371dd360c2d Mon Sep 17 00:00:00 2001
From: Andres Medina <andresnrx@gmail.com>
Date: Wed, 15 Jan 2025 21:22:31 -0800
Subject: [PATCH 07/29] codewide: wrap openssl usage with generic TLS wrappers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This allows for future TLS providers to be added, including rustls.

Co-authored-by: Wojciech Przytuła <wojciech.przytula@scylladb.com>
---
 docs/source/connecting/tls.md         |   2 +-
 examples/tls.rs                       |   4 +-
 scylla/Cargo.toml                     |   3 +-
 scylla/src/client/session.rs          |  33 ++++--
 scylla/src/client/session_builder.rs  |  22 ++--
 scylla/src/cloud/config.rs            |  78 ++++++++------
 scylla/src/cloud/mod.rs               |  55 +++++-----
 scylla/src/errors.rs                  |   3 +
 scylla/src/lib.rs                     |   2 +-
 scylla/src/network/connection.rs      | 143 +++++++++++++++++---------
 scylla/src/network/connection_pool.rs |  10 +-
 scylla/src/network/mod.rs             |   6 +-
 12 files changed, 226 insertions(+), 135 deletions(-)

diff --git a/docs/source/connecting/tls.md b/docs/source/connecting/tls.md
index d1c1fe82d5..bcd279f1ee 100644
--- a/docs/source/connecting/tls.md
+++ b/docs/source/connecting/tls.md
@@ -59,7 +59,7 @@ context_builder.set_verify(SslVerifyMode::PEER);
 
 let session: Session = SessionBuilder::new()
     .known_node("127.0.0.1:9142") // The the port is now 9142
-    .ssl_context(Some(context_builder.build()))
+    .tls_context(Some(context_builder.build()))
     .build()
     .await?;
 
diff --git a/examples/tls.rs b/examples/tls.rs
index 87334a2a9c..bd2fa845e6 100644
--- a/examples/tls.rs
+++ b/examples/tls.rs
@@ -1,6 +1,7 @@
 use anyhow::Result;
 use futures::TryStreamExt as _;
 use scylla::client::session::Session;
+use scylla::client::session::TlsContext;
 use scylla::client::session_builder::SessionBuilder;
 use std::env;
 use std::fs;
@@ -9,6 +10,7 @@ use std::path::PathBuf;
 use openssl::ssl::{SslContextBuilder, SslMethod, SslVerifyMode};
 
 // How to run scylla instance with TLS:
+// FIXME(wprzytula): Adjust to rustls.
 //
 // Edit your scylla.yaml file and add paths to certificates
 // ex:
@@ -46,7 +48,7 @@ async fn main() -> Result<()> {
 
     let session: Session = SessionBuilder::new()
         .known_node(uri)
-        .ssl_context(Some(context_builder.build()))
+        .tls_context(Some(TlsContext::OpenSsl010(context_builder.build())))
         .build()
         .await?;
 
diff --git a/scylla/Cargo.toml b/scylla/Cargo.toml
index 6f1ce3f72c..05e15f1c45 100644
--- a/scylla/Cargo.toml
+++ b/scylla/Cargo.toml
@@ -16,7 +16,7 @@ rustdoc-args = ["--cfg", "docsrs"]
 
 [features]
 default = []
-openssl-010 = ["dep:tokio-openssl", "dep:openssl"]
+openssl-010 = ["dep:tokio-openssl", "dep:openssl", "__tls"]
 cloud = [
     "openssl-010",
     "scylla-cql/serde",
@@ -39,6 +39,7 @@ full-serialization = [
     "num-bigint-04",
     "bigdecimal-04",
 ]
+__tls = []
 
 [dependencies]
 scylla-macros = { version = "0.7.0", path = "../scylla-macros" }
diff --git a/scylla/src/client/session.rs b/scylla/src/client/session.rs
index 600240032f..e4a577a6db 100644
--- a/scylla/src/client/session.rs
+++ b/scylla/src/client/session.rs
@@ -19,8 +19,8 @@ use crate::errors::{
     RequestError, TracingProtocolError, UseKeyspaceError,
 };
 use crate::frame::response::result;
-#[cfg(feature = "openssl-010")]
-use crate::network::SslConfig;
+#[cfg(feature = "__tls")]
+use crate::network::TlsConfig;
 use crate::network::{Connection, ConnectionConfig, PoolConfig, VerifiedKeyspaceName};
 use crate::observability::driver_tracing::RequestSpan;
 use crate::observability::history::{self, HistoryListener};
@@ -45,8 +45,6 @@ use arc_swap::ArcSwapOption;
 use futures::future::join_all;
 use futures::future::try_join_all;
 use itertools::Itertools;
-#[cfg(feature = "openssl-010")]
-use openssl::ssl::SslContext;
 use scylla_cql::frame::response::NonErrorResponse;
 use scylla_cql::serialize::batch::BatchValues;
 use scylla_cql::serialize::row::{SerializeRow, SerializedValues};
@@ -144,6 +142,21 @@ where
     }
 }
 
+#[cfg(feature = "__tls")]
+#[derive(Clone)] // Cheaply clonable - reference counted.
+#[non_exhaustive]
+pub enum TlsContext {
+    #[cfg(feature = "openssl-010")]
+    OpenSsl010(openssl::ssl::SslContext),
+}
+
+#[cfg(feature = "openssl-010")]
+impl From<openssl::ssl::SslContext> for TlsContext {
+    fn from(value: openssl::ssl::SslContext) -> Self {
+        TlsContext::OpenSsl010(value)
+    }
+}
+
 /// Configuration options for [`Session`].
 /// Can be created manually, but usually it's easier to use
 /// [SessionBuilder](super::session_builder::SessionBuilder)
@@ -167,8 +180,8 @@ pub struct SessionConfig {
     pub keyspace_case_sensitive: bool,
 
     /// Provide our Session with TLS
-    #[cfg(feature = "openssl-010")]
-    pub ssl_context: Option<SslContext>,
+    #[cfg(feature = "__tls")]
+    pub tls_context: Option<TlsContext>,
 
     pub authenticator: Option<Arc<dyn AuthenticatorProvider>>,
 
@@ -292,8 +305,8 @@ impl SessionConfig {
                 .into_handle(),
             used_keyspace: None,
             keyspace_case_sensitive: false,
-            #[cfg(feature = "openssl-010")]
-            ssl_context: None,
+            #[cfg(feature = "__tls")]
+            tls_context: None,
             authenticator: None,
             connect_timeout: Duration::from_secs(5),
             connection_pool_size: Default::default(),
@@ -989,8 +1002,8 @@ where
             tcp_nodelay: config.tcp_nodelay,
             tcp_keepalive_interval: config.tcp_keepalive_interval,
             timestamp_generator: config.timestamp_generator,
-            #[cfg(feature = "openssl-010")]
-            ssl_config: config.ssl_context.map(SslConfig::new_with_global_context),
+            #[cfg(feature = "__tls")]
+            tls_config: config.tls_context.map(TlsConfig::new_with_global_context),
             authenticator: config.authenticator.clone(),
             connect_timeout: config.connect_timeout,
             event_sender: None,
diff --git a/scylla/src/client/session_builder.rs b/scylla/src/client/session_builder.rs
index a2eeebb28b..f2fc8b01d8 100644
--- a/scylla/src/client/session_builder.rs
+++ b/scylla/src/client/session_builder.rs
@@ -9,6 +9,8 @@ use super::session::{
 };
 use super::{Compression, PoolSize, SelfIdentity};
 use crate::authentication::{AuthenticatorProvider, PlainTextAuthenticator};
+#[cfg(feature = "__tls")]
+use crate::client::session::TlsContext;
 #[cfg(feature = "cloud")]
 use crate::cloud::{CloudConfig, CloudConfigError};
 use crate::errors::NewSessionError;
@@ -16,8 +18,6 @@ use crate::policies::address_translator::AddressTranslator;
 use crate::policies::host_filter::HostFilter;
 use crate::policies::timestamp_generator::TimestampGenerator;
 use crate::statement::Consistency;
-#[cfg(feature = "openssl-010")]
-use openssl::ssl::SslContext;
 use std::borrow::Borrow;
 use std::marker::PhantomData;
 use std::net::SocketAddr;
@@ -326,10 +326,12 @@ impl GenericSessionBuilder<DefaultMode> {
         self
     }
 
-    /// ssl feature
-    /// Provide SessionBuilder with SslContext from openssl crate that will be
-    /// used to create an ssl connection to the database.
-    /// If set to None SSL connection won't be used.
+    /// TLS feature
+    ///
+    /// Provide SessionBuilder with TlsContext that will be
+    /// used to create a TLS connection to the database.
+    /// If set to None TLS connection won't be used.
+    ///
     /// Default is None.
     ///
     /// # Example
@@ -347,15 +349,15 @@ impl GenericSessionBuilder<DefaultMode> {
     ///
     /// let session: Session = SessionBuilder::new()
     ///     .known_node("127.0.0.1:9042")
-    ///     .ssl_context(Some(context_builder.build()))
+    ///     .tls_context(Some(context_builder.build()))
     ///     .build()
     ///     .await?;
     /// # Ok(())
     /// # }
     /// ```
-    #[cfg(feature = "openssl-010")]
-    pub fn ssl_context(mut self, ssl_context: Option<SslContext>) -> Self {
-        self.config.ssl_context = ssl_context;
+    #[cfg(feature = "__tls")]
+    pub fn tls_context(mut self, tls_context: Option<impl Into<TlsContext>>) -> Self {
+        self.config.tls_context = tls_context.map(|t| t.into());
         self
     }
 }
diff --git a/scylla/src/cloud/config.rs b/scylla/src/cloud/config.rs
index e90b76fdbc..3718c7c509 100644
--- a/scylla/src/cloud/config.rs
+++ b/scylla/src/cloud/config.rs
@@ -1,12 +1,10 @@
 use std::{collections::HashMap, io};
 
-use openssl::{
-    pkey::{PKey, Private},
-    x509::X509,
-};
 use scylla_cql::{frame::types::SerialConsistency, Consistency};
 use thiserror::Error;
 
+use crate::network::TlsError;
+
 #[non_exhaustive]
 #[derive(Debug, Error)]
 pub enum CloudConfigError {
@@ -23,7 +21,7 @@ pub enum CloudConfigError {
     Validation(String),
 
     #[error("Error during key/cert parsing: {0}")]
-    Ssl(#[from] openssl::error::ErrorStack),
+    Tls(#[from] TlsError),
 }
 
 /// Configuration for creating a session to a serverless cluster.
@@ -74,21 +72,36 @@ impl CloudConfig {
 /// to connect to cloud nodes.
 #[derive(Debug)]
 pub(crate) struct AuthInfo {
-    key: PKey<Private>,
-    cert: X509,
+    tls: TlsInfo,
     #[allow(unused)]
     username: Option<String>,
     #[allow(unused)]
     password: Option<String>,
 }
 
-impl AuthInfo {
-    pub(crate) fn get_key(&self) -> &PKey<Private> {
-        &self.key
+#[derive(Debug)]
+pub(crate) enum TlsInfo {
+    #[cfg(feature = "openssl-010")]
+    OpenSsl010 {
+        key: openssl::pkey::PKey<openssl::pkey::Private>,
+        cert: openssl::x509::X509,
+    },
+}
+
+impl TlsInfo {
+    fn from_pem(cert: &[u8], key: &[u8]) -> Result<Self, TlsError> {
+        #[cfg(feature = "openssl-010")]
+        {
+            let cert = openssl::x509::X509::from_pem(cert)?;
+            let key = openssl::pkey::PKey::private_key_from_pem(key)?;
+            Ok(TlsInfo::OpenSsl010 { key, cert })
+        }
     }
+}
 
-    pub(crate) fn get_cert(&self) -> &X509 {
-        &self.cert
+impl AuthInfo {
+    pub(crate) fn get_tls(&self) -> &TlsInfo {
+        &self.tls
     }
 
     #[allow(unused)]
@@ -102,10 +115,11 @@ impl AuthInfo {
     }
 }
 
-/// Contains cloud datacenter configuration for creating TLS connections to its nodes.  
+/// Contains cloud datacenter configuration for creating TLS connections to its nodes.
 #[derive(Debug)]
 pub(crate) struct Datacenter {
-    certificate_authority: X509,
+    #[cfg(feature = "openssl-010")]
+    openssl_ca: openssl::x509::X509,
     server: String,
     #[allow(unused)]
     tls_server_name: Option<String>,
@@ -116,8 +130,9 @@ pub(crate) struct Datacenter {
 }
 
 impl Datacenter {
-    pub(crate) fn get_certificate_authority(&self) -> &X509 {
-        &self.certificate_authority
+    #[cfg(feature = "openssl-010")]
+    pub(crate) fn openssl_ca(&self) -> &openssl::x509::X509 {
+        &self.openssl_ca
     }
 
     pub(crate) fn get_server(&self) -> &str {
@@ -151,13 +166,11 @@ pub(crate) struct Context {
 }
 
 mod deserialize {
-    use super::CloudConfigError;
+    use super::{CloudConfigError, TlsError, TlsInfo};
     use base64::{engine::general_purpose, Engine as _};
     use scylla_cql::{frame::types::SerialConsistency, Consistency};
     use std::{collections::HashMap, fs::File, io::Read, path::Path};
 
-    use openssl::{pkey::PKey, x509::X509};
-
     use serde::Deserialize;
     use tracing::warn;
     use url::Url;
@@ -417,13 +430,10 @@ mod deserialize {
                 auth_info.clientKeyPath.as_deref(),
             )?;
 
-            let cert = X509::from_pem(&cert_pem[..]).map_err(CloudConfigError::Ssl)?;
-
-            let key = PKey::private_key_from_pem(&key_pem[..]).map_err(CloudConfigError::Ssl)?;
+            let tls = TlsInfo::from_pem(cert_pem.as_ref(), key_pem.as_ref())?;
 
             Ok(super::AuthInfo {
-                key,
-                cert,
+                tls,
                 username: auth_info.username,
                 password: auth_info.password,
             })
@@ -517,11 +527,13 @@ mod deserialize {
                 datacenter.certificateAuthorityPath.as_deref(),
             )?;
 
-            let certificate_authority =
-                X509::from_pem(&cert_pem[..]).map_err(CloudConfigError::Ssl)?;
+            #[cfg(feature = "openssl-010")]
+            let openssl_ca =
+                openssl::x509::X509::from_pem(&cert_pem[..]).map_err(TlsError::from)?;
 
             Ok(super::Datacenter {
-                certificate_authority,
+                #[cfg(feature = "openssl-010")]
+                openssl_ca,
                 server: datacenter.server,
                 node_domain,
                 insecure_skip_tls_verify: datacenter.insecureSkipTlsVerify.unwrap_or(false),
@@ -551,6 +563,7 @@ mod deserialize {
     #[cfg(test)]
     mod tests {
         use crate::cloud::config::deserialize::Parameters;
+        use crate::cloud::config::TlsInfo;
         use crate::test_utils::setup_tracing;
 
         use super::super::CloudConfig;
@@ -835,8 +848,15 @@ mod deserialize {
 
                 let auth_info = validated_config.auth_infos.get("one").unwrap();
 
+                #[allow(irrefutable_let_patterns)]
+                // in case multiple tls backends are enabled at the same timeg
+                let TlsInfo::OpenSsl010 { ref cert, .. } = auth_info.tls
+                else {
+                    panic!("openssl TLS info should have been configured")
+                };
+
                 assert_eq!(
-                    auth_info.cert,
+                    *cert,
                     X509::from_pem(
                         &general_purpose::STANDARD
                             .decode(TEST_CA.as_bytes())
@@ -851,7 +871,7 @@ mod deserialize {
 
                 let datacenter = validated_config.datacenters.get("eu-west-1").unwrap();
                 assert_eq!(
-                    datacenter.certificate_authority,
+                    datacenter.openssl_ca,
                     X509::from_pem(
                         &general_purpose::STANDARD
                             .decode(TEST_CA.as_bytes())
diff --git a/scylla/src/cloud/mod.rs b/scylla/src/cloud/mod.rs
index 8e773890d8..7331127326 100644
--- a/scylla/src/cloud/mod.rs
+++ b/scylla/src/cloud/mod.rs
@@ -4,27 +4,24 @@ use std::net::SocketAddr;
 
 pub use config::CloudConfig;
 pub use config::CloudConfigError;
-use openssl::{
-    error::ErrorStack,
-    ssl::{SslContext, SslMethod, SslVerifyMode},
-};
 use tracing::warn;
 use uuid::Uuid;
 
-use crate::network::{ConnectionConfig, SslConfig};
+use crate::client::session::TlsContext;
+use crate::network::{ConnectionConfig, TlsConfig, TlsError};
 
-pub(crate) fn set_ssl_config_for_scylla_cloud_host(
+pub(crate) fn set_tls_config_for_scylla_cloud_host(
     host_id: Option<Uuid>,
     dc: Option<&str>,
     proxy_address: SocketAddr,
     connection_config: &mut ConnectionConfig,
-) -> Result<(), ErrorStack> {
-    if connection_config.ssl_config.is_some() {
-        // This can only happen if the user builds SessionConfig by hand, as SessionBuilder in cloud mode prevents setting custom SslContext.
+) -> Result<(), TlsError> {
+    if connection_config.tls_config.is_some() {
+        // This can only happen if the user builds SessionConfig by hand, as SessionBuilder in cloud mode prevents setting custom TlsContext.
         warn!(
-            "Overriding user-provided SslContext with Scylla Cloud SslContext due \
+            "Overriding user-provided TlsContext with Scylla Cloud TlsContext due \
                 to CloudConfig being provided. This is certainly an API misuse - Cloud \
-                may not be combined with user's own SSL config."
+                may not be combined with user's own TLS config."
         )
     }
 
@@ -35,25 +32,29 @@ pub(crate) fn set_ssl_config_for_scylla_cloud_host(
     let datacenter = dc.and_then(|dc| cloud_config.get_datacenters().get(dc));
     if let Some(datacenter) = datacenter {
         let domain_name = datacenter.get_node_domain();
-        let ca = datacenter.get_certificate_authority();
         let auth_info = cloud_config.get_current_auth_info();
-        let key = auth_info.get_key();
-        let cert = auth_info.get_cert();
 
-        let ssl_context = {
-            let mut builder = SslContext::builder(SslMethod::tls())?;
-            builder.set_verify(if datacenter.get_insecure_skip_tls_verify() {
-                SslVerifyMode::NONE
-            } else {
-                SslVerifyMode::PEER
-            });
-            builder.cert_store_mut().add_cert(ca.clone())?;
-            builder.set_certificate(cert)?;
-            builder.set_private_key(key)?;
-            builder.build()
+        let tls_context = match auth_info.get_tls() {
+            #[cfg(feature = "openssl-010")]
+            config::TlsInfo::OpenSsl010 { key, cert } => {
+                use openssl::ssl::{SslContext, SslMethod, SslVerifyMode};
+                let mut builder = SslContext::builder(SslMethod::tls())?;
+                builder.set_verify(if datacenter.get_insecure_skip_tls_verify() {
+                    SslVerifyMode::NONE
+                } else {
+                    SslVerifyMode::PEER
+                });
+                let ca = datacenter.openssl_ca();
+                builder.cert_store_mut().add_cert(ca.clone())?;
+                builder.set_certificate(cert)?;
+                builder.set_private_key(key)?;
+                let context = builder.build();
+                TlsContext::OpenSsl010(context)
+            }
         };
-        let ssl_config = SslConfig::new_for_sni(ssl_context, domain_name, host_id);
-        connection_config.ssl_config = Some(ssl_config);
+
+        let tls_config = TlsConfig::new_for_sni(tls_context, domain_name, host_id);
+        connection_config.tls_config = Some(tls_config);
     } else {
         warn!("Datacenter {:?} of node {:?} with addr {} not described in cloud config. Proceeding without setting SNI for the node, which will most probably result in nonworking connections,.",
                dc, host_id, proxy_address);
diff --git a/scylla/src/errors.rs b/scylla/src/errors.rs
index 8488c6d774..844ca5a583 100644
--- a/scylla/src/errors.rs
+++ b/scylla/src/errors.rs
@@ -1,5 +1,8 @@
 //! This module contains various errors which can be returned by [`Session`](crate::client::session::Session).
 
+#[cfg(feature = "__tls")]
+pub use crate::network::TlsError;
+
 // Re-export DbError type and types that it depends on
 // so they can be found in `scylla::errors`.
 pub use scylla_cql::frame::response::error::{DbError, OperationType, WriteType};
diff --git a/scylla/src/lib.rs b/scylla/src/lib.rs
index e6a9eb8b35..44d6d5d5c0 100644
--- a/scylla/src/lib.rs
+++ b/scylla/src/lib.rs
@@ -82,7 +82,7 @@
 //!     .query_unpaged("SELECT a, b FROM ks.tab", &[])
 //!     .await?
 //!     .into_rows_result()?;
-//!     
+//!
 //! for row in query_rows.rows()? {
 //!     // Parse row as int and text \
 //!     let (int_val, text_val): (i32, &str) = row?;
diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index 03e790a0f3..cd8ae6e97a 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -46,13 +46,11 @@ use scylla_cql::serialize::batch::{BatchValues, BatchValuesIterator};
 use scylla_cql::serialize::raw_batch::RawBatchValuesAdapter;
 use scylla_cql::serialize::row::{RowSerializationContext, SerializedValues};
 use socket2::{SockRef, TcpKeepalive};
-#[cfg(feature = "openssl-010")]
-pub(crate) use ssl_config::SslConfig;
 use std::borrow::Cow;
 use std::collections::{BTreeSet, HashMap, HashSet};
 use std::convert::TryFrom;
 use std::net::{IpAddr, SocketAddr};
-#[cfg(feature = "openssl-010")]
+#[cfg(feature = "__tls")]
 use std::pin::Pin;
 use std::sync::atomic::AtomicU64;
 use std::sync::Arc;
@@ -62,12 +60,14 @@ use std::{
     cmp::Ordering,
     net::{Ipv4Addr, Ipv6Addr},
 };
+#[cfg(feature = "__tls")]
+pub use tls_config::TlsError;
+#[cfg(feature = "__tls")]
+pub(crate) use tls_config::{Tls, TlsConfig};
 use tokio::io::{split, AsyncRead, AsyncWrite, AsyncWriteExt, BufReader, BufWriter};
 use tokio::net::{TcpSocket, TcpStream};
 use tokio::sync::{mpsc, oneshot};
 use tokio::time::Instant;
-#[cfg(feature = "openssl-010")]
-use tokio_openssl::SslStream;
 use tracing::{debug, error, trace, warn};
 use uuid::Uuid;
 
@@ -212,35 +212,72 @@ struct TaskResponse {
     body: Bytes,
 }
 
-#[cfg(feature = "openssl-010")]
-mod ssl_config {
-    use openssl::{
-        error::ErrorStack,
-        ssl::{Ssl, SslContext},
-    };
+#[cfg(feature = "__tls")]
+mod tls_config {
+    #[cfg(not(any(feature = "openssl-010")))]
+    compile_error!(
+        r#""__tls" feature requires a TLS backend: at least one of ["openssl-010"] is needed"#
+    );
+
+    use std::io;
+
     #[cfg(feature = "cloud")]
     use uuid::Uuid;
 
-    /// This struct encapsulates all Ssl-regarding configuration and helps pass it tidily through the code.
+    use crate::client::session::TlsContext;
+
+    /// This struct encapsulates all TLS-regarding configuration and helps pass it tidily through the code.
     //
-    // There are 3 possible options for SslConfig, whose behaviour is somewhat subtle.
-    // Option 1: No ssl configuration. Then it is None every time.
-    // Option 2: User-provided global SslContext. Then, a SslConfig is created upon Session creation
+    // There are 3 possible options for TlsConfig, whose behaviour is somewhat subtle.
+    // Option 1: No TLS configuration. Then it is None every time.
+    // Option 2: User-provided global TlsContext. Then, a TlsConfig is created upon Session creation
     // and henceforth stored in the ConnectionConfig.
-    // Option 3: Serverless Cloud. The Option<SslConfig> remains None in ConnectionConfig until it reaches
-    // NodeConnectionPool::new(). Inside that function, the field is mutated to contain SslConfig specific
-    // for the particular node. (The SslConfig must be different, because SNIs differ for different nodes.)
-    // Thenceforth, all connections to that node share the same SslConfig.
+    // Option 3: Serverless Cloud. The Option<TlsConfig> remains None in ConnectionConfig until it reaches
+    // NodeConnectionPool::new(). Inside that function, the field is mutated to contain TlsConfig specific
+    // for the particular node. (The TlsConfig must be different, because SNIs differ for different nodes.)
+    // Thenceforth, all connections to that node share the same TlsConfig.
     #[derive(Clone)]
-    pub(crate) struct SslConfig {
-        context: SslContext,
+    pub(crate) struct TlsConfig {
+        context: TlsContext,
         #[cfg(feature = "cloud")]
         sni: Option<String>,
     }
 
-    impl SslConfig {
-        // Used in case when the user provided their own SslContext to be used in all connections.
-        pub(crate) fn new_with_global_context(context: SslContext) -> Self {
+    pub(crate) enum Tls {
+        #[cfg(feature = "openssl-010")]
+        OpenSsl010(openssl::ssl::Ssl),
+    }
+
+    /// A wrapper around a TLS error.
+    ///
+    /// The original error came from one of the supported TLS backends.
+    #[derive(Debug, thiserror::Error)]
+    #[error(transparent)]
+    #[non_exhaustive]
+    pub enum TlsError {
+        #[cfg(feature = "openssl-010")]
+        OpenSsl010(openssl::error::ErrorStack),
+    }
+
+    impl From<TlsError> for io::Error {
+        fn from(value: TlsError) -> Self {
+            match value {
+                #[cfg(feature = "openssl-010")]
+                TlsError::OpenSsl010(e) => e.into(),
+            }
+        }
+    }
+
+    #[cfg(feature = "openssl-010")]
+    impl From<openssl::error::ErrorStack> for TlsError {
+        fn from(error: openssl::error::ErrorStack) -> Self {
+            TlsError::OpenSsl010(error)
+        }
+    }
+
+    impl TlsConfig {
+        // Used in case when the user provided their own TlsContext to be used in all connections.
+        pub(crate) fn new_with_global_context(context: TlsContext) -> Self {
             Self {
                 context,
                 #[cfg(feature = "cloud")]
@@ -251,7 +288,7 @@ mod ssl_config {
         // Used in case of Serverless Cloud connections.
         #[cfg(feature = "cloud")]
         pub(crate) fn new_for_sni(
-            context: SslContext,
+            context: TlsContext,
             domain_name: &str,
             host_id: Option<Uuid>,
         ) -> Self {
@@ -266,15 +303,22 @@ mod ssl_config {
             }
         }
 
-        // Produces a new Ssl object that is able to wrap a TCP stream.
-        pub(crate) fn new_ssl(&self) -> Result<Ssl, ErrorStack> {
-            #[allow(unused_mut)]
-            let mut ssl = Ssl::new(&self.context)?;
-            #[cfg(feature = "cloud")]
-            if let Some(sni) = self.sni.as_ref() {
-                ssl.set_hostname(sni)?;
-            }
-            Ok(ssl)
+        // Produces a new Tls object that is able to wrap a TCP stream.
+        pub(crate) fn new_tls(&self) -> Result<Tls, TlsError> {
+            let tls = match &self.context {
+                #[cfg(feature = "openssl-010")]
+                TlsContext::OpenSsl010(context) => {
+                    #[allow(unused_mut)]
+                    let mut ssl = openssl::ssl::Ssl::new(context)?;
+                    #[cfg(feature = "cloud")]
+                    if let Some(sni) = self.sni.as_ref() {
+                        ssl.set_hostname(sni)?;
+                    }
+                    Tls::OpenSsl010(ssl)
+                }
+            };
+
+            Ok(tls)
         }
     }
 }
@@ -326,8 +370,8 @@ pub(crate) struct ConnectionConfig {
     pub(crate) tcp_nodelay: bool,
     pub(crate) tcp_keepalive_interval: Option<Duration>,
     pub(crate) timestamp_generator: Option<Arc<dyn TimestampGenerator>>,
-    #[cfg(feature = "openssl-010")]
-    pub(crate) ssl_config: Option<SslConfig>,
+    #[cfg(feature = "__tls")]
+    pub(crate) tls_config: Option<TlsConfig>,
     pub(crate) connect_timeout: std::time::Duration,
     // should be Some only in control connections,
     pub(crate) event_sender: Option<mpsc::Sender<Event>>,
@@ -353,8 +397,8 @@ impl Default for ConnectionConfig {
             tcp_keepalive_interval: None,
             timestamp_generator: None,
             event_sender: None,
-            #[cfg(feature = "openssl-010")]
-            ssl_config: None,
+            #[cfg(feature = "__tls")]
+            tls_config: None,
             connect_timeout: std::time::Duration::from_secs(5),
             default_consistency: Default::default(),
             authenticator: None,
@@ -375,17 +419,17 @@ impl Default for ConnectionConfig {
 }
 
 impl ConnectionConfig {
-    #[cfg(feature = "openssl-010")]
-    fn is_ssl(&self) -> bool {
+    #[cfg(feature = "__tls")]
+    fn is_tls(&self) -> bool {
         #[cfg(feature = "cloud")]
         if self.cloud_config.is_some() {
             return true;
         }
-        self.ssl_config.is_some()
+        self.tls_config.is_some()
     }
 
-    #[cfg(not(feature = "openssl-010"))]
-    fn is_ssl(&self) -> bool {
+    #[cfg(not(feature = "__tls"))]
+    fn is_tls(&self) -> bool {
         false
     }
 }
@@ -1351,10 +1395,13 @@ impl Connection {
         router_handle: Arc<RouterHandle>,
         node_address: IpAddr,
     ) -> Result<RemoteHandle<()>, std::io::Error> {
-        #[cfg(feature = "openssl-010")]
-        if let Some(ssl_config) = &config.ssl_config {
-            let ssl = ssl_config.new_ssl()?;
-            let mut stream = SslStream::new(ssl, stream)?;
+        #[cfg(feature = "__tls")]
+        if let Some(tls_config) = &config.tls_config {
+            let mut stream = match tls_config.new_tls()? {
+                #[cfg(feature = "openssl-010")]
+                Tls::OpenSsl010(ssl) => tokio_openssl::SslStream::new(ssl, stream)?,
+            };
+
             let _pin = Pin::new(&mut stream).connect().await;
 
             let (task, handle) = Self::router(
@@ -1835,7 +1882,7 @@ pub(super) async fn open_connection(
     // Get OPTIONS SUPPORTED by the cluster.
     let mut supported = connection.get_options().await?;
 
-    let shard_aware_port_key = match config.is_ssl() {
+    let shard_aware_port_key = match config.is_tls() {
         true => options::SCYLLA_SHARD_AWARE_PORT_SSL,
         false => options::SCYLLA_SHARD_AWARE_PORT,
     };
diff --git a/scylla/src/network/connection_pool.rs b/scylla/src/network/connection_pool.rs
index 005875e87a..bbe66a25d2 100644
--- a/scylla/src/network/connection_pool.rs
+++ b/scylla/src/network/connection_pool.rs
@@ -1,5 +1,5 @@
 #[cfg(feature = "cloud")]
-use crate::cloud::set_ssl_config_for_scylla_cloud_host;
+use crate::cloud::set_tls_config_for_scylla_cloud_host;
 use crate::utils::pretty::CommaSeparatedDisplayer;
 
 use super::connection::{
@@ -191,9 +191,9 @@ impl NodeConnectionPool {
                     ..
                 }) => (Some(host_id), address.into_inner(), datacenter.as_deref()),
             };
-            set_ssl_config_for_scylla_cloud_host(host_id, dc, address, &mut pool_config.connection_config)
+            set_tls_config_for_scylla_cloud_host(host_id, dc, address, &mut pool_config.connection_config)
                 .unwrap_or_else(|err| warn!(
-                    "SslContext for SNI connection to Scylla Cloud node {{ host_id={:?}, dc={:?} at {} }} could not be set up: {}\n Proceeding with attempting probably nonworking connection",
+                    "TlsContext for SNI connection to Scylla Cloud node {{ host_id={:?}, dc={:?} at {} }} could not be set up: {}\n Proceeding with attempting probably nonworking connection",
                     host_id,
                     dc,
                     address,
@@ -1222,8 +1222,8 @@ mod tests {
         let connection_config = ConnectionConfig {
             compression: None,
             tcp_nodelay: true,
-            #[cfg(feature = "openssl-010")]
-            ssl_config: None,
+            #[cfg(feature = "__tls")]
+            tls_config: None,
             ..Default::default()
         };
 
diff --git a/scylla/src/network/mod.rs b/scylla/src/network/mod.rs
index 77d852c0f8..f05b7646e0 100644
--- a/scylla/src/network/mod.rs
+++ b/scylla/src/network/mod.rs
@@ -5,8 +5,10 @@
 //! - NodeConnectionPool - a manager that keeps a desired number of connections opened to each shard.
 
 mod connection;
-#[cfg(feature = "openssl-010")]
-pub(crate) use connection::SslConfig;
+#[cfg(feature = "__tls")]
+pub(crate) use connection::TlsConfig;
+#[cfg(feature = "__tls")]
+pub use connection::TlsError;
 pub(crate) use connection::{Connection, ConnectionConfig, VerifiedKeyspaceName};
 
 mod connection_pool;

From 75d444aac8834c616014e71b089c5d40e1e0e28f Mon Sep 17 00:00:00 2001
From: Andres Medina <andresnrx@gmail.com>
Date: Mon, 27 Jan 2025 09:22:12 -0800
Subject: [PATCH 08/29] connection: don't ignore openssl connection error

otherwise the error shows up too late in a non-terminal way whereas
the error is terminal
---
 scylla/src/network/connection.rs | 38 ++++++++++++++++++--------------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index cd8ae6e97a..05b768cc1e 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -50,8 +50,6 @@ use std::borrow::Cow;
 use std::collections::{BTreeSet, HashMap, HashSet};
 use std::convert::TryFrom;
 use std::net::{IpAddr, SocketAddr};
-#[cfg(feature = "__tls")]
-use std::pin::Pin;
 use std::sync::atomic::AtomicU64;
 use std::sync::Arc;
 use std::sync::Mutex as StdMutex;
@@ -1397,24 +1395,30 @@ impl Connection {
     ) -> Result<RemoteHandle<()>, std::io::Error> {
         #[cfg(feature = "__tls")]
         if let Some(tls_config) = &config.tls_config {
-            let mut stream = match tls_config.new_tls()? {
+            let handle = match tls_config.new_tls()? {
                 #[cfg(feature = "openssl-010")]
-                Tls::OpenSsl010(ssl) => tokio_openssl::SslStream::new(ssl, stream)?,
-            };
+                Tls::OpenSsl010(ssl) => {
+                    let mut stream = tokio_openssl::SslStream::new(ssl, stream)?;
+                    std::pin::Pin::new(&mut stream)
+                        .connect()
+                        .await
+                        .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e))?;
+                    let (task, handle) = Self::router(
+                        config,
+                        stream,
+                        receiver,
+                        error_sender,
+                        orphan_notification_receiver,
+                        router_handle,
+                        node_address,
+                    )
+                    .remote_handle();
 
-            let _pin = Pin::new(&mut stream).connect().await;
+                    tokio::task::spawn(task);
+                    handle
+                }
+            };
 
-            let (task, handle) = Self::router(
-                config,
-                stream,
-                receiver,
-                error_sender,
-                orphan_notification_receiver,
-                router_handle,
-                node_address,
-            )
-            .remote_handle();
-            tokio::task::spawn(task);
             return Ok(handle);
         }
 

From d3374317e58c45241bbbc73c4841c1fa26f126e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Karol=20Bary=C5=82a?= <karol.baryla@scylladb.com>
Date: Sat, 30 Nov 2024 11:14:51 +0100
Subject: [PATCH 09/29] network: introduce Host{Connection,Pool}Config

The idea is that `{Connection,Pool}Config` is the same for all
connections, whereas `Host{Connection,Pool}Config` is customized for
a specific endpoint. This commit leverages type system to better convey
this difference.
---
 scylla/src/network/connection.rs      | 111 ++++++++++++++++++++++----
 scylla/src/network/connection_pool.rs |  44 ++++++++--
 2 files changed, 133 insertions(+), 22 deletions(-)

diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index 05b768cc1e..be3b07cff1 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -85,7 +85,7 @@ pub(crate) struct Connection {
     _worker_handle: RemoteHandle<()>,
 
     connect_address: SocketAddr,
-    config: ConnectionConfig,
+    config: HostConnectionConfig,
     features: ConnectionFeatures,
     router_handle: Arc<RouterHandle>,
 }
@@ -387,6 +387,87 @@ pub(crate) struct ConnectionConfig {
     pub(crate) identity: SelfIdentity<'static>,
 }
 
+impl ConnectionConfig {
+    pub(crate) fn to_host_connection_config(&self) -> HostConnectionConfig {
+        HostConnectionConfig {
+            compression: self.compression,
+            tcp_nodelay: self.tcp_nodelay,
+            tcp_keepalive_interval: self.tcp_keepalive_interval,
+            timestamp_generator: self.timestamp_generator.clone(),
+            #[cfg(feature = "__tls")]
+            tls_config: self.tls_config.clone(),
+            connect_timeout: self.connect_timeout,
+            event_sender: self.event_sender.clone(),
+            default_consistency: self.default_consistency,
+            #[cfg(feature = "cloud")]
+            cloud_config: self.cloud_config.clone(),
+            authenticator: self.authenticator.clone(),
+            address_translator: self.address_translator.clone(),
+            enable_write_coalescing: self.enable_write_coalescing,
+            keepalive_interval: self.keepalive_interval,
+            keepalive_timeout: self.keepalive_timeout,
+            tablet_sender: self.tablet_sender.clone(),
+            identity: self.identity.clone(),
+        }
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct HostConnectionConfig {
+    pub(crate) compression: Option<Compression>,
+    pub(crate) tcp_nodelay: bool,
+    pub(crate) tcp_keepalive_interval: Option<Duration>,
+    pub(crate) timestamp_generator: Option<Arc<dyn TimestampGenerator>>,
+    #[cfg(feature = "__tls")]
+    pub(crate) tls_config: Option<TlsConfig>,
+    pub(crate) connect_timeout: std::time::Duration,
+    // should be Some only in control connections,
+    pub(crate) event_sender: Option<mpsc::Sender<Event>>,
+    pub(crate) default_consistency: Consistency,
+    #[cfg(feature = "cloud")]
+    pub(crate) cloud_config: Option<Arc<CloudConfig>>,
+    pub(crate) authenticator: Option<Arc<dyn AuthenticatorProvider>>,
+    pub(crate) address_translator: Option<Arc<dyn AddressTranslator>>,
+    pub(crate) enable_write_coalescing: bool,
+
+    pub(crate) keepalive_interval: Option<Duration>,
+    pub(crate) keepalive_timeout: Option<Duration>,
+    pub(crate) tablet_sender: Option<mpsc::Sender<(TableSpec<'static>, RawTablet)>>,
+
+    pub(crate) identity: SelfIdentity<'static>,
+}
+
+#[cfg(test)]
+impl Default for HostConnectionConfig {
+    fn default() -> Self {
+        Self {
+            compression: None,
+            tcp_nodelay: true,
+            tcp_keepalive_interval: None,
+            timestamp_generator: None,
+            event_sender: None,
+            #[cfg(feature = "__tls")]
+            tls_config: None,
+            connect_timeout: std::time::Duration::from_secs(5),
+            default_consistency: Default::default(),
+            authenticator: None,
+            address_translator: None,
+            #[cfg(feature = "cloud")]
+            cloud_config: None,
+            enable_write_coalescing: true,
+
+            // Note: this is different than SessionConfig default values.
+            keepalive_interval: None,
+            keepalive_timeout: None,
+
+            tablet_sender: None,
+
+            identity: SelfIdentity::default(),
+        }
+    }
+}
+
+#[cfg(test)]
 impl Default for ConnectionConfig {
     fn default() -> Self {
         Self {
@@ -416,7 +497,7 @@ impl Default for ConnectionConfig {
     }
 }
 
-impl ConnectionConfig {
+impl HostConnectionConfig {
     #[cfg(feature = "__tls")]
     fn is_tls(&self) -> bool {
         #[cfg(feature = "cloud")]
@@ -442,7 +523,7 @@ impl Connection {
     async fn new(
         addr: SocketAddr,
         source_port: Option<u16>,
-        config: ConnectionConfig,
+        config: HostConnectionConfig,
     ) -> Result<(Self, ErrorReceiver), ConnectionError> {
         let stream_connector = match source_port {
             Some(p) => {
@@ -1385,7 +1466,7 @@ impl Connection {
     }
 
     async fn run_router(
-        config: ConnectionConfig,
+        config: HostConnectionConfig,
         stream: TcpStream,
         receiver: mpsc::Receiver<Task>,
         error_sender: tokio::sync::oneshot::Sender<ConnectionError>,
@@ -1437,7 +1518,7 @@ impl Connection {
     }
 
     async fn router(
-        config: ConnectionConfig,
+        config: HostConnectionConfig,
         stream: (impl AsyncRead + AsyncWrite),
         receiver: mpsc::Receiver<Task>,
         error_sender: tokio::sync::oneshot::Sender<ConnectionError>,
@@ -1505,7 +1586,7 @@ impl Connection {
     async fn reader(
         mut read_half: (impl AsyncRead + Unpin),
         handler_map: &StdMutex<ResponseHandlerMap>,
-        config: ConnectionConfig,
+        config: HostConnectionConfig,
     ) -> Result<(), BrokenConnectionError> {
         loop {
             let (params, opcode, body) = frame::read_response_frame(&mut read_half)
@@ -1872,7 +1953,7 @@ async fn maybe_translated_addr(
 pub(super) async fn open_connection(
     endpoint: UntranslatedEndpoint,
     source_port: Option<u16>,
-    config: &ConnectionConfig,
+    config: &HostConnectionConfig,
 ) -> Result<(Connection, ErrorReceiver), ConnectionError> {
     /* Translate the address, if applicable. */
     let addr = maybe_translated_addr(endpoint, config.address_translator.as_deref()).await?;
@@ -1991,13 +2072,13 @@ pub(super) async fn open_connection_to_shard_aware_port(
     endpoint: UntranslatedEndpoint,
     shard: Shard,
     sharder: Sharder,
-    connection_config: &ConnectionConfig,
+    config: &HostConnectionConfig,
 ) -> Result<(Connection, ErrorReceiver), ConnectionError> {
     // Create iterator over all possible source ports for this shard
     let source_port_iter = sharder.iter_source_ports_for_shard(shard);
 
     for port in source_port_iter {
-        let connect_result = open_connection(endpoint.clone(), Some(port), connection_config).await;
+        let connect_result = open_connection(endpoint.clone(), Some(port), config).await;
 
         match connect_result {
             Err(err) if err.is_address_unavailable_for_use() => continue, // If we can't use this port, try the next one
@@ -2265,7 +2346,7 @@ mod tests {
     use tokio::select;
     use tokio::sync::mpsc;
 
-    use super::{open_connection, ConnectionConfig};
+    use super::{open_connection, HostConnectionConfig};
     use crate::cluster::metadata::UntranslatedEndpoint;
     use crate::cluster::node::ResolvedContactPoint;
     use crate::query::Query;
@@ -2311,7 +2392,7 @@ mod tests {
                 datacenter: None,
             }),
             None,
-            &ConnectionConfig::default(),
+            &HostConnectionConfig::default(),
         )
         .await
         .unwrap();
@@ -2436,9 +2517,9 @@ mod tests {
                     datacenter: None,
                 }),
                 None,
-                &ConnectionConfig {
+                &HostConnectionConfig {
                     enable_write_coalescing: enable_coalescing,
-                    ..ConnectionConfig::default()
+                    ..HostConnectionConfig::default()
                 },
             )
             .await
@@ -2523,7 +2604,7 @@ mod tests {
 
         let proxy_addr = SocketAddr::new(scylla_proxy::get_exclusive_local_address(), 9042);
 
-        let config = ConnectionConfig::default();
+        let config = HostConnectionConfig::default();
 
         let (startup_tx, mut startup_rx) = mpsc::unbounded_channel();
 
@@ -2610,7 +2691,7 @@ mod tests {
             RequestReaction::drop_frame(),
         );
 
-        let config = ConnectionConfig {
+        let config = HostConnectionConfig {
             keepalive_interval: Some(Duration::from_millis(500)),
             keepalive_timeout: Some(Duration::from_secs(1)),
             ..Default::default()
diff --git a/scylla/src/network/connection_pool.rs b/scylla/src/network/connection_pool.rs
index bbe66a25d2..bde63be7d2 100644
--- a/scylla/src/network/connection_pool.rs
+++ b/scylla/src/network/connection_pool.rs
@@ -4,7 +4,7 @@ use crate::utils::pretty::CommaSeparatedDisplayer;
 
 use super::connection::{
     open_connection, open_connection_to_shard_aware_port, Connection, ConnectionConfig,
-    ErrorReceiver, VerifiedKeyspaceName,
+    ErrorReceiver, HostConnectionConfig, VerifiedKeyspaceName,
 };
 
 use crate::errors::{
@@ -75,6 +75,34 @@ impl Default for PoolConfig {
     }
 }
 
+impl PoolConfig {
+    fn to_host_pool_config(&self) -> HostPoolConfig {
+        HostPoolConfig {
+            connection_config: self.connection_config.to_host_connection_config(),
+            pool_size: self.pool_size,
+            can_use_shard_aware_port: self.can_use_shard_aware_port,
+        }
+    }
+}
+
+#[derive(Clone)]
+struct HostPoolConfig {
+    pub(crate) connection_config: HostConnectionConfig,
+    pub(crate) pool_size: PoolSize,
+    pub(crate) can_use_shard_aware_port: bool,
+}
+
+#[cfg(test)]
+impl Default for HostPoolConfig {
+    fn default() -> Self {
+        Self {
+            connection_config: Default::default(),
+            pool_size: Default::default(),
+            can_use_shard_aware_port: true,
+        }
+    }
+}
+
 enum MaybePoolConnections {
     // The pool is being filled for the first time
     Initializing,
@@ -170,6 +198,7 @@ impl std::fmt::Debug for NodeConnectionPool {
 impl NodeConnectionPool {
     pub(crate) fn new(
         endpoint: UntranslatedEndpoint,
+        // TODO: pass &PoolConfig (by shared reference)
         #[allow(unused_mut)] mut pool_config: PoolConfig, // `mut` needed only with "cloud" feature
         current_keyspace: Option<VerifiedKeyspaceName>,
         pool_empty_notifier: broadcast::Sender<()>,
@@ -202,11 +231,13 @@ impl NodeConnectionPool {
             );
         }
 
+        let host_pool_config = pool_config.to_host_pool_config();
+
         let arced_endpoint = Arc::new(RwLock::new(endpoint));
 
         let refiller = PoolRefiller::new(
             arced_endpoint.clone(),
-            pool_config,
+            host_pool_config,
             current_keyspace,
             pool_updated_notify.clone(),
             pool_empty_notifier,
@@ -427,7 +458,7 @@ impl RefillDelayStrategy {
 
 struct PoolRefiller {
     // Following information identify the pool and do not change
-    pool_config: PoolConfig,
+    pool_config: HostPoolConfig,
 
     // Following information is subject to updates on topology refresh
     endpoint: Arc<RwLock<UntranslatedEndpoint>>,
@@ -488,7 +519,7 @@ struct UseKeyspaceRequest {
 impl PoolRefiller {
     pub(crate) fn new(
         endpoint: Arc<RwLock<UntranslatedEndpoint>>,
-        pool_config: PoolConfig,
+        pool_config: HostPoolConfig,
         current_keyspace: Option<VerifiedKeyspaceName>,
         pool_updated_notify: Arc<Notify>,
         pool_empty_notifier: broadcast::Sender<()>,
@@ -1195,8 +1226,7 @@ struct OpenedConnectionEvent {
 
 #[cfg(test)]
 mod tests {
-    use super::super::connection::open_connection_to_shard_aware_port;
-    use super::ConnectionConfig;
+    use super::super::connection::{open_connection_to_shard_aware_port, HostConnectionConfig};
     use crate::cluster::metadata::UntranslatedEndpoint;
     use crate::cluster::node::ResolvedContactPoint;
     use crate::routing::{ShardCount, Sharder};
@@ -1219,7 +1249,7 @@ mod tests {
             .next()
             .unwrap();
 
-        let connection_config = ConnectionConfig {
+        let connection_config = HostConnectionConfig {
             compression: None,
             tcp_nodelay: true,
             #[cfg(feature = "__tls")]

From 5634fbecf4cddcdcbec4aa422ca8f6125e6498c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sat, 1 Feb 2025 17:04:07 +0100
Subject: [PATCH 10/29] connection: simplify HostConnectionConfig::is_tls()

---
 scylla/src/network/connection.rs | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index be3b07cff1..188af4cee3 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -498,17 +498,12 @@ impl Default for ConnectionConfig {
 }
 
 impl HostConnectionConfig {
-    #[cfg(feature = "__tls")]
     fn is_tls(&self) -> bool {
-        #[cfg(feature = "cloud")]
-        if self.cloud_config.is_some() {
-            return true;
+        #[cfg(feature = "__tls")]
+        {
+            self.tls_config.is_some()
         }
-        self.tls_config.is_some()
-    }
-
-    #[cfg(not(feature = "__tls"))]
-    fn is_tls(&self) -> bool {
+        #[cfg(not(feature = "__tls"))]
         false
     }
 }

From a101e7f0c4b9a252a99d3922136a6023f703dee6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sat, 1 Feb 2025 21:26:26 +0100
Subject: [PATCH 11/29] cloud: refactor `set_ssl_config_for_scylla_cloud_host`

This step improves types safety and prepares for next steps.
---
 scylla/src/cloud/mod.rs               | 31 ++++++++++-----------------
 scylla/src/network/connection_pool.rs | 21 ++++++++++++------
 2 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/scylla/src/cloud/mod.rs b/scylla/src/cloud/mod.rs
index 7331127326..de89ecf7f0 100644
--- a/scylla/src/cloud/mod.rs
+++ b/scylla/src/cloud/mod.rs
@@ -8,27 +8,14 @@ use tracing::warn;
 use uuid::Uuid;
 
 use crate::client::session::TlsContext;
-use crate::network::{ConnectionConfig, TlsConfig, TlsError};
+use crate::network::{TlsConfig, TlsError};
 
-pub(crate) fn set_tls_config_for_scylla_cloud_host(
+pub(crate) fn make_tls_config_for_scylla_cloud_host(
     host_id: Option<Uuid>,
     dc: Option<&str>,
     proxy_address: SocketAddr,
-    connection_config: &mut ConnectionConfig,
-) -> Result<(), TlsError> {
-    if connection_config.tls_config.is_some() {
-        // This can only happen if the user builds SessionConfig by hand, as SessionBuilder in cloud mode prevents setting custom TlsContext.
-        warn!(
-            "Overriding user-provided TlsContext with Scylla Cloud TlsContext due \
-                to CloudConfig being provided. This is certainly an API misuse - Cloud \
-                may not be combined with user's own TLS config."
-        )
-    }
-
-    let cloud_config = connection_config
-        .cloud_config
-        .as_deref()
-        .expect("BUG: CloudConfig presence in ConnectionConfig should have been checked before calling this function");
+    cloud_config: &CloudConfig,
+) -> Result<Option<TlsConfig>, TlsError> {
     let datacenter = dc.and_then(|dc| cloud_config.get_datacenters().get(dc));
     if let Some(datacenter) = datacenter {
         let domain_name = datacenter.get_node_domain();
@@ -53,11 +40,15 @@ pub(crate) fn set_tls_config_for_scylla_cloud_host(
             }
         };
 
-        let tls_config = TlsConfig::new_for_sni(tls_context, domain_name, host_id);
-        connection_config.tls_config = Some(tls_config);
+        Ok(Some(TlsConfig::new_for_sni(
+            tls_context,
+            domain_name,
+            host_id,
+        )))
     } else {
         warn!("Datacenter {:?} of node {:?} with addr {} not described in cloud config. Proceeding without setting SNI for the node, which will most probably result in nonworking connections,.",
                dc, host_id, proxy_address);
+        // FIXME: Consider returning error here.
+        Ok(None)
     }
-    Ok(())
 }
diff --git a/scylla/src/network/connection_pool.rs b/scylla/src/network/connection_pool.rs
index bde63be7d2..2bd352919e 100644
--- a/scylla/src/network/connection_pool.rs
+++ b/scylla/src/network/connection_pool.rs
@@ -1,5 +1,5 @@
 #[cfg(feature = "cloud")]
-use crate::cloud::set_tls_config_for_scylla_cloud_host;
+use crate::cloud::make_tls_config_for_scylla_cloud_host;
 use crate::utils::pretty::CommaSeparatedDisplayer;
 
 use super::connection::{
@@ -207,7 +207,16 @@ impl NodeConnectionPool {
         let pool_updated_notify = Arc::new(Notify::new());
 
         #[cfg(feature = "cloud")]
-        if pool_config.connection_config.cloud_config.is_some() {
+        if let Some(ref cloud_config) = pool_config.connection_config.cloud_config {
+            if pool_config.connection_config.tls_config.is_some() {
+                // This can only happen if the user builds SessionConfig by hand, as SessionBuilder in cloud mode prevents setting custom TlsContext.
+                warn!(
+                    "Overriding user-provided TlsContext with Scylla Cloud TlsContext due \
+                        to CloudConfig being provided. This is certainly an API misuse - Cloud \
+                        may not be combined with user's own TLS config."
+                )
+            }
+
             let (host_id, address, dc) = match endpoint {
                 UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
                     address,
@@ -220,15 +229,15 @@ impl NodeConnectionPool {
                     ..
                 }) => (Some(host_id), address.into_inner(), datacenter.as_deref()),
             };
-            set_tls_config_for_scylla_cloud_host(host_id, dc, address, &mut pool_config.connection_config)
-                .unwrap_or_else(|err| warn!(
+
+            pool_config.connection_config.tls_config = make_tls_config_for_scylla_cloud_host(host_id, dc, address, cloud_config)
+                .inspect_err(|err| warn!(
                     "TlsContext for SNI connection to Scylla Cloud node {{ host_id={:?}, dc={:?} at {} }} could not be set up: {}\n Proceeding with attempting probably nonworking connection",
                     host_id,
                     dc,
                     address,
                     err
-                )
-            );
+                )).ok().flatten();
         }
 
         let host_pool_config = pool_config.to_host_pool_config();

From 632b03f5ad79f380ecdbaa0230b6f8db572a4998 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sat, 1 Feb 2025 21:53:52 +0100
Subject: [PATCH 12/29] cloud: refactor `make_tls_config_for_scylla_cloud_host`

This just changes the style from `if let` to `let else` for better
readability.

This commit should be viewed without whitespace difference.
---
 scylla/src/cloud/mod.rs | 63 ++++++++++++++++++++---------------------
 1 file changed, 31 insertions(+), 32 deletions(-)

diff --git a/scylla/src/cloud/mod.rs b/scylla/src/cloud/mod.rs
index de89ecf7f0..572eabd8fc 100644
--- a/scylla/src/cloud/mod.rs
+++ b/scylla/src/cloud/mod.rs
@@ -16,39 +16,38 @@ pub(crate) fn make_tls_config_for_scylla_cloud_host(
     proxy_address: SocketAddr,
     cloud_config: &CloudConfig,
 ) -> Result<Option<TlsConfig>, TlsError> {
-    let datacenter = dc.and_then(|dc| cloud_config.get_datacenters().get(dc));
-    if let Some(datacenter) = datacenter {
-        let domain_name = datacenter.get_node_domain();
-        let auth_info = cloud_config.get_current_auth_info();
-
-        let tls_context = match auth_info.get_tls() {
-            #[cfg(feature = "openssl-010")]
-            config::TlsInfo::OpenSsl010 { key, cert } => {
-                use openssl::ssl::{SslContext, SslMethod, SslVerifyMode};
-                let mut builder = SslContext::builder(SslMethod::tls())?;
-                builder.set_verify(if datacenter.get_insecure_skip_tls_verify() {
-                    SslVerifyMode::NONE
-                } else {
-                    SslVerifyMode::PEER
-                });
-                let ca = datacenter.openssl_ca();
-                builder.cert_store_mut().add_cert(ca.clone())?;
-                builder.set_certificate(cert)?;
-                builder.set_private_key(key)?;
-                let context = builder.build();
-                TlsContext::OpenSsl010(context)
-            }
-        };
-
-        Ok(Some(TlsConfig::new_for_sni(
-            tls_context,
-            domain_name,
-            host_id,
-        )))
-    } else {
+    let Some(datacenter) = dc.and_then(|dc| cloud_config.get_datacenters().get(dc)) else {
         warn!("Datacenter {:?} of node {:?} with addr {} not described in cloud config. Proceeding without setting SNI for the node, which will most probably result in nonworking connections,.",
                dc, host_id, proxy_address);
         // FIXME: Consider returning error here.
-        Ok(None)
-    }
+        return Ok(None);
+    };
+
+    let domain_name = datacenter.get_node_domain();
+    let auth_info = cloud_config.get_current_auth_info();
+
+    let tls_context = match auth_info.get_tls() {
+        #[cfg(feature = "openssl-010")]
+        config::TlsInfo::OpenSsl010 { key, cert } => {
+            use openssl::ssl::{SslContext, SslMethod, SslVerifyMode};
+            let mut builder = SslContext::builder(SslMethod::tls())?;
+            builder.set_verify(if datacenter.get_insecure_skip_tls_verify() {
+                SslVerifyMode::NONE
+            } else {
+                SslVerifyMode::PEER
+            });
+            let ca = datacenter.openssl_ca();
+            builder.cert_store_mut().add_cert(ca.clone())?;
+            builder.set_certificate(cert)?;
+            builder.set_private_key(key)?;
+            let context = builder.build();
+            TlsContext::OpenSsl010(context)
+        }
+    };
+
+    Ok(Some(TlsConfig::new_for_sni(
+        tls_context,
+        domain_name,
+        host_id,
+    )))
 }

From 17622216cf47801a21df637f62d0691cf15d6f4e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sat, 1 Feb 2025 22:00:41 +0100
Subject: [PATCH 13/29] cloud: make `make_tls_config_for_scylla_cloud_host`
 method on CloudConfig

It makes great sense, because the CloudConfig is the subject of the
operation.
---
 scylla/src/cloud/config.rs            | 48 +++++++++++++++++++++++++-
 scylla/src/cloud/mod.rs               | 49 ---------------------------
 scylla/src/network/connection_pool.rs |  4 +--
 3 files changed, 48 insertions(+), 53 deletions(-)

diff --git a/scylla/src/cloud/config.rs b/scylla/src/cloud/config.rs
index 3718c7c509..741f42282f 100644
--- a/scylla/src/cloud/config.rs
+++ b/scylla/src/cloud/config.rs
@@ -1,9 +1,13 @@
+use std::net::SocketAddr;
 use std::{collections::HashMap, io};
 
 use scylla_cql::{frame::types::SerialConsistency, Consistency};
 use thiserror::Error;
+use tracing::warn;
+use uuid::Uuid;
 
-use crate::network::TlsError;
+use crate::client::session::TlsContext;
+use crate::network::{TlsConfig, TlsError};
 
 #[non_exhaustive]
 #[derive(Debug, Error)]
@@ -66,6 +70,48 @@ impl CloudConfig {
             "BUG: Validation should have prevented current context's auth info pointing to unknown auth_info",
         )
     }
+
+    pub(crate) fn make_tls_config_for_scylla_cloud_host(
+        &self,
+        host_id: Option<Uuid>,
+        dc: Option<&str>,
+        proxy_address: SocketAddr,
+    ) -> Result<Option<TlsConfig>, TlsError> {
+        let Some(datacenter) = dc.and_then(|dc| self.get_datacenters().get(dc)) else {
+            warn!("Datacenter {:?} of node {:?} with addr {} not described in cloud config. Proceeding without setting SNI for the node, which will most probably result in nonworking connections,.",
+                   dc, host_id, proxy_address);
+            // FIXME: Consider returning error here.
+            return Ok(None);
+        };
+
+        let domain_name = datacenter.get_node_domain();
+        let auth_info = self.get_current_auth_info();
+
+        let tls_context = match auth_info.get_tls() {
+            #[cfg(feature = "openssl-010")]
+            TlsInfo::OpenSsl010 { key, cert } => {
+                use openssl::ssl::{SslContext, SslMethod, SslVerifyMode};
+                let mut builder = SslContext::builder(SslMethod::tls())?;
+                builder.set_verify(if datacenter.get_insecure_skip_tls_verify() {
+                    SslVerifyMode::NONE
+                } else {
+                    SslVerifyMode::PEER
+                });
+                let ca = datacenter.openssl_ca();
+                builder.cert_store_mut().add_cert(ca.clone())?;
+                builder.set_certificate(cert)?;
+                builder.set_private_key(key)?;
+                let context = builder.build();
+                TlsContext::OpenSsl010(context)
+            }
+        };
+
+        Ok(Some(TlsConfig::new_for_sni(
+            tls_context,
+            domain_name,
+            host_id,
+        )))
+    }
 }
 
 /// Contains all authentication info for creating TLS connections using SNI proxy
diff --git a/scylla/src/cloud/mod.rs b/scylla/src/cloud/mod.rs
index 572eabd8fc..56dc42eb52 100644
--- a/scylla/src/cloud/mod.rs
+++ b/scylla/src/cloud/mod.rs
@@ -1,53 +1,4 @@
 mod config;
 
-use std::net::SocketAddr;
-
 pub use config::CloudConfig;
 pub use config::CloudConfigError;
-use tracing::warn;
-use uuid::Uuid;
-
-use crate::client::session::TlsContext;
-use crate::network::{TlsConfig, TlsError};
-
-pub(crate) fn make_tls_config_for_scylla_cloud_host(
-    host_id: Option<Uuid>,
-    dc: Option<&str>,
-    proxy_address: SocketAddr,
-    cloud_config: &CloudConfig,
-) -> Result<Option<TlsConfig>, TlsError> {
-    let Some(datacenter) = dc.and_then(|dc| cloud_config.get_datacenters().get(dc)) else {
-        warn!("Datacenter {:?} of node {:?} with addr {} not described in cloud config. Proceeding without setting SNI for the node, which will most probably result in nonworking connections,.",
-               dc, host_id, proxy_address);
-        // FIXME: Consider returning error here.
-        return Ok(None);
-    };
-
-    let domain_name = datacenter.get_node_domain();
-    let auth_info = cloud_config.get_current_auth_info();
-
-    let tls_context = match auth_info.get_tls() {
-        #[cfg(feature = "openssl-010")]
-        config::TlsInfo::OpenSsl010 { key, cert } => {
-            use openssl::ssl::{SslContext, SslMethod, SslVerifyMode};
-            let mut builder = SslContext::builder(SslMethod::tls())?;
-            builder.set_verify(if datacenter.get_insecure_skip_tls_verify() {
-                SslVerifyMode::NONE
-            } else {
-                SslVerifyMode::PEER
-            });
-            let ca = datacenter.openssl_ca();
-            builder.cert_store_mut().add_cert(ca.clone())?;
-            builder.set_certificate(cert)?;
-            builder.set_private_key(key)?;
-            let context = builder.build();
-            TlsContext::OpenSsl010(context)
-        }
-    };
-
-    Ok(Some(TlsConfig::new_for_sni(
-        tls_context,
-        domain_name,
-        host_id,
-    )))
-}
diff --git a/scylla/src/network/connection_pool.rs b/scylla/src/network/connection_pool.rs
index 2bd352919e..98c426bbb1 100644
--- a/scylla/src/network/connection_pool.rs
+++ b/scylla/src/network/connection_pool.rs
@@ -1,5 +1,3 @@
-#[cfg(feature = "cloud")]
-use crate::cloud::make_tls_config_for_scylla_cloud_host;
 use crate::utils::pretty::CommaSeparatedDisplayer;
 
 use super::connection::{
@@ -230,7 +228,7 @@ impl NodeConnectionPool {
                 }) => (Some(host_id), address.into_inner(), datacenter.as_deref()),
             };
 
-            pool_config.connection_config.tls_config = make_tls_config_for_scylla_cloud_host(host_id, dc, address, cloud_config)
+            pool_config.connection_config.tls_config = cloud_config.make_tls_config_for_scylla_cloud_host(host_id, dc, address)
                 .inspect_err(|err| warn!(
                     "TlsContext for SNI connection to Scylla Cloud node {{ host_id={:?}, dc={:?} at {} }} could not be set up: {}\n Proceeding with attempting probably nonworking connection",
                     host_id,

From 1d0264da779fcacc3ee1060132aca18f0179135d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sat, 1 Feb 2025 21:00:21 +0100
Subject: [PATCH 14/29] connection: introduce TlsProvider
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TlsProvider is the last abstraction about TLS in the driver.
The full picture looks like this:

┌─←─ TlsContext (openssl::SslContext / rustls::ClientConfig)
│
├─←─ CloudConfig (powered by either TLS backend)
│
│ gets wrapped in
│
↳ TlsProvider (same for all connections)
   │
   │ produces
   │
   ↳ TlsConfig (specific for the particular connection)
      │
      │ produces
      │
      ↳ Tls (wrapper over TCP stream which adds encryption)
---
 scylla/src/client/session.rs          |  28 ++++++-
 scylla/src/network/connection.rs      | 110 ++++++++++++++++++++++++--
 scylla/src/network/connection_pool.rs |  44 +----------
 scylla/src/network/mod.rs             |   4 +-
 4 files changed, 138 insertions(+), 48 deletions(-)

diff --git a/scylla/src/client/session.rs b/scylla/src/client/session.rs
index e4a577a6db..766b80a087 100644
--- a/scylla/src/client/session.rs
+++ b/scylla/src/client/session.rs
@@ -20,7 +20,7 @@ use crate::errors::{
 };
 use crate::frame::response::result;
 #[cfg(feature = "__tls")]
-use crate::network::TlsConfig;
+use crate::network::TlsProvider;
 use crate::network::{Connection, ConnectionConfig, PoolConfig, VerifiedKeyspaceName};
 use crate::observability::driver_tracing::RequestSpan;
 use crate::observability::history::{self, HistoryListener};
@@ -56,6 +56,8 @@ use std::num::NonZeroU32;
 use std::sync::Arc;
 use std::time::Duration;
 use tokio::time::timeout;
+#[cfg(feature = "cloud")]
+use tracing::warn;
 use tracing::{debug, error, trace, trace_span, Instrument};
 use uuid::Uuid;
 
@@ -996,6 +998,28 @@ where
         }
 
         let (tablet_sender, tablet_receiver) = tokio::sync::mpsc::channel(TABLET_CHANNEL_SIZE);
+        #[cfg(feature = "__tls")]
+        let tls_provider = 'provider: {
+            #[cfg(feature = "cloud")]
+            if let Some(cloud_config) = config.cloud_config.clone() {
+                if config.tls_context.is_some() {
+                    // This can only happen if the user builds SessionConfig by hand, as SessionBuilder in cloud mode prevents setting custom TlsContext.
+                    warn!(
+                        "Overriding user-provided TlsContext with Scylla Cloud TlsContext due \
+                            to CloudConfig being provided. This is certainly an API misuse - Cloud \
+                            may not be combined with user's own TLS config."
+                    )
+                }
+
+                let provider = TlsProvider::new_cloud(cloud_config);
+                break 'provider Some(provider);
+            }
+            if let Some(tls_context) = config.tls_context {
+                let provider = TlsProvider::new_with_global_context(tls_context);
+                break 'provider Some(provider);
+            }
+            None
+        };
 
         let connection_config = ConnectionConfig {
             compression: config.compression,
@@ -1003,7 +1027,7 @@ where
             tcp_keepalive_interval: config.tcp_keepalive_interval,
             timestamp_generator: config.timestamp_generator,
             #[cfg(feature = "__tls")]
-            tls_config: config.tls_context.map(TlsConfig::new_with_global_context),
+            tls_provider,
             authenticator: config.authenticator.clone(),
             connect_timeout: config.connect_timeout,
             event_sender: None,
diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index 188af4cee3..d1d14513b3 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -61,7 +61,7 @@ use std::{
 #[cfg(feature = "__tls")]
 pub use tls_config::TlsError;
 #[cfg(feature = "__tls")]
-pub(crate) use tls_config::{Tls, TlsConfig};
+pub(crate) use tls_config::{Tls, TlsConfig, TlsProvider};
 use tokio::io::{split, AsyncRead, AsyncWrite, AsyncWriteExt, BufReader, BufWriter};
 use tokio::net::{TcpSocket, TcpStream};
 use tokio::sync::{mpsc, oneshot};
@@ -212,17 +212,108 @@ struct TaskResponse {
 
 #[cfg(feature = "__tls")]
 mod tls_config {
+    //! This module contains abstractions related to the TLS layer of driver connections.
+    //!
+    //! The full picture looks like this:
+    //!
+    //! ┌─←─ TlsContext (openssl::SslContext / rustls::ClientConfig)
+    //! │
+    //! ├─←─ CloudConfig (powered by either TLS backend)
+    //! │
+    //! │ gets wrapped in
+    //! │
+    //! ↳TlsProvider (same for all connections)
+    //!   │
+    //!   │ produces
+    //!   │
+    //!   ↳TlsConfig (specific for the particular connection)
+    //!     │
+    //!     │ produces
+    //!     │
+    //!     ↳Tls (wrapper over TCP stream which adds encryption)
+
     #[cfg(not(any(feature = "openssl-010")))]
     compile_error!(
         r#""__tls" feature requires a TLS backend: at least one of ["openssl-010"] is needed"#
     );
 
     use std::io;
+    #[cfg(feature = "cloud")]
+    use std::sync::Arc;
 
+    #[cfg(feature = "cloud")]
+    use tracing::warn;
     #[cfg(feature = "cloud")]
     use uuid::Uuid;
 
     use crate::client::session::TlsContext;
+    #[cfg(feature = "cloud")]
+    use crate::cloud::CloudConfig;
+    #[cfg(feature = "cloud")]
+    use crate::cluster::metadata::PeerEndpoint;
+    use crate::cluster::metadata::UntranslatedEndpoint;
+    #[cfg(feature = "cloud")]
+    use crate::cluster::node::ResolvedContactPoint;
+
+    /// Abstraction capable of producing TlsConfig for connections on-demand.
+    #[derive(Clone)] // Cheaply clonable (reference-counted)
+    pub(crate) enum TlsProvider {
+        GlobalContext(TlsContext),
+        #[cfg(feature = "cloud")]
+        ScyllaCloud(Arc<CloudConfig>),
+    }
+
+    impl TlsProvider {
+        // Used in case when the user provided their own TlsContext to be used in all connections.
+        pub(crate) fn new_with_global_context(context: TlsContext) -> Self {
+            Self::GlobalContext(context)
+        }
+
+        // Used in the cloud case.
+        #[cfg(feature = "cloud")]
+        pub(crate) fn new_cloud(cloud_config: Arc<CloudConfig>) -> Self {
+            Self::ScyllaCloud(cloud_config)
+        }
+
+        pub(crate) fn make_tls_config(
+            &self,
+            #[allow(unused)] endpoint: &UntranslatedEndpoint,
+        ) -> Option<TlsConfig> {
+            match self {
+                TlsProvider::GlobalContext(context) => {
+                    Some(TlsConfig::new_with_global_context(context.clone()))
+                }
+                #[cfg(feature = "cloud")]
+                TlsProvider::ScyllaCloud(cloud_config) => {
+                    let (host_id, address, dc) = match *endpoint {
+                        UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
+                            address,
+                            ref datacenter,
+                        }) => (None, address, datacenter.as_deref()), // FIXME: Pass DC in ContactPoint
+                        UntranslatedEndpoint::Peer(PeerEndpoint {
+                            host_id,
+                            address,
+                            ref datacenter,
+                            ..
+                        }) => (Some(host_id), address.into_inner(), datacenter.as_deref()),
+                    };
+
+                    cloud_config.make_tls_config_for_scylla_cloud_host(host_id, dc, address)
+                        // inspect_err() is stable since 1.76.
+                        // TODO: use inspect_err once we bump MSRV to at least 1.76.
+                        .map_err(|err| {
+                            warn!(
+                                "TlsProvider for SNI connection to Scylla Cloud node {{ host_id={:?}, dc={:?} at {} }} could not be set up: {}\n Proceeding with attempting probably nonworking connection",
+                                host_id,
+                                dc,
+                                address,
+                                err
+                            );
+                        }).ok().flatten()
+                }
+            }
+        }
+    }
 
     /// This struct encapsulates all TLS-regarding configuration and helps pass it tidily through the code.
     //
@@ -369,7 +460,7 @@ pub(crate) struct ConnectionConfig {
     pub(crate) tcp_keepalive_interval: Option<Duration>,
     pub(crate) timestamp_generator: Option<Arc<dyn TimestampGenerator>>,
     #[cfg(feature = "__tls")]
-    pub(crate) tls_config: Option<TlsConfig>,
+    pub(crate) tls_provider: Option<TlsProvider>,
     pub(crate) connect_timeout: std::time::Duration,
     // should be Some only in control connections,
     pub(crate) event_sender: Option<mpsc::Sender<Event>>,
@@ -388,14 +479,23 @@ pub(crate) struct ConnectionConfig {
 }
 
 impl ConnectionConfig {
-    pub(crate) fn to_host_connection_config(&self) -> HostConnectionConfig {
+    pub(crate) fn to_host_connection_config(
+        &self,
+        #[allow(unused)] endpoint: &UntranslatedEndpoint,
+    ) -> HostConnectionConfig {
+        #[cfg(feature = "__tls")]
+        let tls_config = self
+            .tls_provider
+            .as_ref()
+            .and_then(|provider| provider.make_tls_config(endpoint));
+
         HostConnectionConfig {
             compression: self.compression,
             tcp_nodelay: self.tcp_nodelay,
             tcp_keepalive_interval: self.tcp_keepalive_interval,
             timestamp_generator: self.timestamp_generator.clone(),
             #[cfg(feature = "__tls")]
-            tls_config: self.tls_config.clone(),
+            tls_config,
             connect_timeout: self.connect_timeout,
             event_sender: self.event_sender.clone(),
             default_consistency: self.default_consistency,
@@ -477,7 +577,7 @@ impl Default for ConnectionConfig {
             timestamp_generator: None,
             event_sender: None,
             #[cfg(feature = "__tls")]
-            tls_config: None,
+            tls_provider: None,
             connect_timeout: std::time::Duration::from_secs(5),
             default_consistency: Default::default(),
             authenticator: None,
diff --git a/scylla/src/network/connection_pool.rs b/scylla/src/network/connection_pool.rs
index 98c426bbb1..0db3ad3522 100644
--- a/scylla/src/network/connection_pool.rs
+++ b/scylla/src/network/connection_pool.rs
@@ -15,8 +15,6 @@ use crate::cluster::metadata::{PeerEndpoint, UntranslatedEndpoint};
 #[cfg(feature = "cloud")]
 use crate::cluster::node::resolve_hostname;
 
-#[cfg(feature = "cloud")]
-use crate::cluster::node::ResolvedContactPoint;
 use crate::cluster::NodeAddr;
 
 use arc_swap::ArcSwap;
@@ -74,9 +72,9 @@ impl Default for PoolConfig {
 }
 
 impl PoolConfig {
-    fn to_host_pool_config(&self) -> HostPoolConfig {
+    fn to_host_pool_config(&self, endpoint: &UntranslatedEndpoint) -> HostPoolConfig {
         HostPoolConfig {
-            connection_config: self.connection_config.to_host_connection_config(),
+            connection_config: self.connection_config.to_host_connection_config(endpoint),
             pool_size: self.pool_size,
             can_use_shard_aware_port: self.can_use_shard_aware_port,
         }
@@ -197,48 +195,14 @@ impl NodeConnectionPool {
     pub(crate) fn new(
         endpoint: UntranslatedEndpoint,
         // TODO: pass &PoolConfig (by shared reference)
-        #[allow(unused_mut)] mut pool_config: PoolConfig, // `mut` needed only with "cloud" feature
+        pool_config: PoolConfig,
         current_keyspace: Option<VerifiedKeyspaceName>,
         pool_empty_notifier: broadcast::Sender<()>,
     ) -> Self {
         let (use_keyspace_request_sender, use_keyspace_request_receiver) = mpsc::channel(1);
         let pool_updated_notify = Arc::new(Notify::new());
 
-        #[cfg(feature = "cloud")]
-        if let Some(ref cloud_config) = pool_config.connection_config.cloud_config {
-            if pool_config.connection_config.tls_config.is_some() {
-                // This can only happen if the user builds SessionConfig by hand, as SessionBuilder in cloud mode prevents setting custom TlsContext.
-                warn!(
-                    "Overriding user-provided TlsContext with Scylla Cloud TlsContext due \
-                        to CloudConfig being provided. This is certainly an API misuse - Cloud \
-                        may not be combined with user's own TLS config."
-                )
-            }
-
-            let (host_id, address, dc) = match endpoint {
-                UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
-                    address,
-                    ref datacenter,
-                }) => (None, address, datacenter.as_deref()), // FIXME: Pass DC in ContactPoint
-                UntranslatedEndpoint::Peer(PeerEndpoint {
-                    host_id,
-                    address,
-                    ref datacenter,
-                    ..
-                }) => (Some(host_id), address.into_inner(), datacenter.as_deref()),
-            };
-
-            pool_config.connection_config.tls_config = cloud_config.make_tls_config_for_scylla_cloud_host(host_id, dc, address)
-                .inspect_err(|err| warn!(
-                    "TlsContext for SNI connection to Scylla Cloud node {{ host_id={:?}, dc={:?} at {} }} could not be set up: {}\n Proceeding with attempting probably nonworking connection",
-                    host_id,
-                    dc,
-                    address,
-                    err
-                )).ok().flatten();
-        }
-
-        let host_pool_config = pool_config.to_host_pool_config();
+        let host_pool_config = pool_config.to_host_pool_config(&endpoint);
 
         let arced_endpoint = Arc::new(RwLock::new(endpoint));
 
diff --git a/scylla/src/network/mod.rs b/scylla/src/network/mod.rs
index f05b7646e0..7763d37a42 100644
--- a/scylla/src/network/mod.rs
+++ b/scylla/src/network/mod.rs
@@ -5,10 +5,12 @@
 //! - NodeConnectionPool - a manager that keeps a desired number of connections opened to each shard.
 
 mod connection;
-#[cfg(feature = "__tls")]
+#[cfg(feature = "cloud")]
 pub(crate) use connection::TlsConfig;
 #[cfg(feature = "__tls")]
 pub use connection::TlsError;
+#[cfg(feature = "__tls")]
+pub(crate) use connection::TlsProvider;
 pub(crate) use connection::{Connection, ConnectionConfig, VerifiedKeyspaceName};
 
 mod connection_pool;

From 2adf08e00ed25171c633885a9b5513b1dd12e516 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sun, 2 Feb 2025 17:35:59 +0100
Subject: [PATCH 15/29] connection_pool: pass &PoolConfig to
 NodeConnectionPool::new()

As HostPoolConfig is created by cloning required fields of PoolConfig
anyway, there's no point in taking PoolConfig by move.
---
 scylla/src/cluster/metadata.rs        | 2 +-
 scylla/src/cluster/node.rs            | 2 +-
 scylla/src/cluster/state.rs           | 2 +-
 scylla/src/network/connection_pool.rs | 3 +--
 scylla/src/routing/locator/test.rs    | 7 +------
 5 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/scylla/src/cluster/metadata.rs b/scylla/src/cluster/metadata.rs
index e01671c797..af66be8d04 100644
--- a/scylla/src/cluster/metadata.rs
+++ b/scylla/src/cluster/metadata.rs
@@ -666,7 +666,7 @@ impl MetadataReader {
             can_use_shard_aware_port: false,
         };
 
-        NodeConnectionPool::new(endpoint, pool_config, None, refresh_requester)
+        NodeConnectionPool::new(endpoint, &pool_config, None, refresh_requester)
     }
 }
 
diff --git a/scylla/src/cluster/node.rs b/scylla/src/cluster/node.rs
index f11b31ba7e..2b332fe882 100644
--- a/scylla/src/cluster/node.rs
+++ b/scylla/src/cluster/node.rs
@@ -96,7 +96,7 @@ impl Node {
     /// `rack` - optional rack name
     pub(crate) fn new(
         peer: PeerEndpoint,
-        pool_config: PoolConfig,
+        pool_config: &PoolConfig,
         keyspace_name: Option<VerifiedKeyspaceName>,
         enabled: bool,
     ) -> Self {
diff --git a/scylla/src/cluster/state.rs b/scylla/src/cluster/state.rs
index e205332236..193818ef69 100644
--- a/scylla/src/cluster/state.rs
+++ b/scylla/src/cluster/state.rs
@@ -96,7 +96,7 @@ impl ClusterState {
                     peer_tokens = tokens;
                     Arc::new(Node::new(
                         peer_endpoint,
-                        pool_config.clone(),
+                        pool_config,
                         used_keyspace.clone(),
                         is_enabled,
                     ))
diff --git a/scylla/src/network/connection_pool.rs b/scylla/src/network/connection_pool.rs
index 0db3ad3522..a4c5bc5d3e 100644
--- a/scylla/src/network/connection_pool.rs
+++ b/scylla/src/network/connection_pool.rs
@@ -194,8 +194,7 @@ impl std::fmt::Debug for NodeConnectionPool {
 impl NodeConnectionPool {
     pub(crate) fn new(
         endpoint: UntranslatedEndpoint,
-        // TODO: pass &PoolConfig (by shared reference)
-        pool_config: PoolConfig,
+        pool_config: &PoolConfig,
         current_keyspace: Option<VerifiedKeyspaceName>,
         pool_empty_notifier: broadcast::Sender<()>,
     ) -> Self {
diff --git a/scylla/src/routing/locator/test.rs b/scylla/src/routing/locator/test.rs
index e0205c101e..a14d9f3632 100644
--- a/scylla/src/routing/locator/test.rs
+++ b/scylla/src/routing/locator/test.rs
@@ -182,12 +182,7 @@ pub(crate) fn create_ring(metadata: &Metadata) -> impl Iterator<Item = (Token, A
     let mut ring: Vec<(Token, Arc<Node>)> = Vec::new();
 
     for peer in &metadata.peers {
-        let node = Arc::new(Node::new(
-            peer.to_peer_endpoint(),
-            pool_config.clone(),
-            None,
-            true,
-        ));
+        let node = Arc::new(Node::new(peer.to_peer_endpoint(), &pool_config, None, true));
 
         for token in &peer.tokens {
             ring.push((*token, node.clone()));

From b7d7584c83510b8d97039857dd55942fcad4b805 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sun, 2 Feb 2025 17:43:35 +0100
Subject: [PATCH 16/29] metadata: MetadataReader: create PoolConfig only once

Before, PoolConfig would be re-created for each attempt to recreate the
control connection pool. It's redundant, because each time it would be
exactly the same, and it requires cloning ConnectionConfig.

Now, PoolConfig is only created once and stored in MetadataReader.
Before, only ConnectionConfig would be stored.
---
 scylla/src/cluster/metadata.rs | 36 +++++++++++++++++-----------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/scylla/src/cluster/metadata.rs b/scylla/src/cluster/metadata.rs
index af66be8d04..da977bdf95 100644
--- a/scylla/src/cluster/metadata.rs
+++ b/scylla/src/cluster/metadata.rs
@@ -69,7 +69,7 @@ type PerKsTableResult<T, E> = PerKsTable<Result<T, E>>;
 
 /// Allows to read current metadata from the cluster
 pub(crate) struct MetadataReader {
-    connection_config: ConnectionConfig,
+    control_connection_pool_config: PoolConfig,
 
     control_connection_endpoint: UntranslatedEndpoint,
     control_connection: NodeConnectionPool,
@@ -424,16 +424,27 @@ impl MetadataReader {
         // - send received events via server_event_sender
         connection_config.event_sender = Some(server_event_sender);
 
+        let control_connection_pool_config = PoolConfig {
+            connection_config,
+
+            // We want to have only one connection to receive events from
+            pool_size: PoolSize::PerHost(NonZeroUsize::new(1).unwrap()),
+
+            // The shard-aware port won't be used with PerHost pool size anyway,
+            // so explicitly disable it here
+            can_use_shard_aware_port: false,
+        };
+
         let control_connection = Self::make_control_connection_pool(
             control_connection_endpoint.clone(),
-            connection_config.clone(),
+            &control_connection_pool_config,
             control_connection_repair_requester.clone(),
         );
 
         Ok(MetadataReader {
+            control_connection_pool_config,
             control_connection_endpoint,
             control_connection,
-            connection_config,
             known_peers: initial_peers
                 .into_iter()
                 .map(UntranslatedEndpoint::ContactPoint)
@@ -545,7 +556,7 @@ impl MetadataReader {
             self.control_connection_endpoint = peer.clone();
             self.control_connection = Self::make_control_connection_pool(
                 self.control_connection_endpoint.clone(),
-                self.connection_config.clone(),
+                &self.control_connection_pool_config,
                 self.control_connection_repair_requester.clone(),
             );
 
@@ -642,7 +653,7 @@ impl MetadataReader {
 
                     self.control_connection = Self::make_control_connection_pool(
                         self.control_connection_endpoint.clone(),
-                        self.connection_config.clone(),
+                        &self.control_connection_pool_config,
                         self.control_connection_repair_requester.clone(),
                     );
                 }
@@ -652,21 +663,10 @@ impl MetadataReader {
 
     fn make_control_connection_pool(
         endpoint: UntranslatedEndpoint,
-        connection_config: ConnectionConfig,
+        pool_config: &PoolConfig,
         refresh_requester: broadcast::Sender<()>,
     ) -> NodeConnectionPool {
-        let pool_config = PoolConfig {
-            connection_config,
-
-            // We want to have only one connection to receive events from
-            pool_size: PoolSize::PerHost(NonZeroUsize::new(1).unwrap()),
-
-            // The shard-aware port won't be used with PerHost pool size anyway,
-            // so explicitly disable it here
-            can_use_shard_aware_port: false,
-        };
-
-        NodeConnectionPool::new(endpoint, &pool_config, None, refresh_requester)
+        NodeConnectionPool::new(endpoint, pool_config, None, refresh_requester)
     }
 }
 

From 698858668753799e1ef07a2d69d113fc1a2b3142 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sat, 1 Feb 2025 22:35:43 +0100
Subject: [PATCH 17/29] cloud: use AddressTranslator instead of hand-crafted
 logic

It seems that when I originally wrote serverless, for some reason I
hand-crafted address translation logic specifically for serverless,
making it fully separate from the standard AddressTranslator trait.

In this commit I successfully implement cloud address translation inside
the standard AddressTranslator framework, decluttering PoolRefiller
logic from cloud-related code. CloudConfig becomes an AddressTranslator
itself, so it needn't be passed separately anymore. This further reduces
code complication arising from cloud-related codepaths.
---
 scylla/src/client/session.rs          | 22 +++++++-
 scylla/src/cloud/config.rs            | 60 ++++++++++++++++++++++
 scylla/src/errors.rs                  |  4 ++
 scylla/src/network/connection_pool.rs | 74 +--------------------------
 4 files changed, 87 insertions(+), 73 deletions(-)

diff --git a/scylla/src/client/session.rs b/scylla/src/client/session.rs
index 766b80a087..af12ec85fb 100644
--- a/scylla/src/client/session.rs
+++ b/scylla/src/client/session.rs
@@ -998,6 +998,26 @@ where
         }
 
         let (tablet_sender, tablet_receiver) = tokio::sync::mpsc::channel(TABLET_CHANNEL_SIZE);
+
+        #[allow(unused_labels)] // Triggers when `cloud` feature is disabled.
+        let address_translator = 'translator: {
+            #[cfg(feature = "cloud")]
+            if let Some(translator) = config.cloud_config.clone() {
+                if config.address_translator.is_some() {
+                    // This can only happen if the user builds SessionConfig by hand, as SessionBuilder in cloud mode prevents setting custom AddressTranslator.
+                    warn!(
+                        "Overriding user-provided AddressTranslator with Scylla Cloud AddressTranslator due \
+                            to CloudConfig being provided. This is certainly an API misuse - Cloud \
+                            may not be combined with user's own AddressTranslator."
+                    )
+                }
+
+                break 'translator Some(translator as Arc<dyn AddressTranslator>);
+            }
+
+            config.address_translator
+        };
+
         #[cfg(feature = "__tls")]
         let tls_provider = 'provider: {
             #[cfg(feature = "cloud")]
@@ -1032,7 +1052,7 @@ where
             connect_timeout: config.connect_timeout,
             event_sender: None,
             default_consistency: Default::default(),
-            address_translator: config.address_translator,
+            address_translator,
             #[cfg(feature = "cloud")]
             cloud_config: config.cloud_config,
             enable_write_coalescing: config.enable_write_coalescing,
diff --git a/scylla/src/cloud/config.rs b/scylla/src/cloud/config.rs
index 741f42282f..62b6bb2164 100644
--- a/scylla/src/cloud/config.rs
+++ b/scylla/src/cloud/config.rs
@@ -1,13 +1,19 @@
 use std::net::SocketAddr;
+use std::sync::Arc;
 use std::{collections::HashMap, io};
 
+use async_trait::async_trait;
 use scylla_cql::{frame::types::SerialConsistency, Consistency};
 use thiserror::Error;
 use tracing::warn;
 use uuid::Uuid;
 
 use crate::client::session::TlsContext;
+use crate::cluster::metadata::UntranslatedPeer;
+use crate::cluster::node::resolve_hostname;
+use crate::errors::TranslationError;
 use crate::network::{TlsConfig, TlsError};
+use crate::policies::address_translator::AddressTranslator;
 
 #[non_exhaustive]
 #[derive(Debug, Error)]
@@ -114,6 +120,60 @@ impl CloudConfig {
     }
 }
 
+#[async_trait]
+impl AddressTranslator for CloudConfig {
+    async fn translate_address(
+        &self,
+        untranslated_peer: &UntranslatedPeer,
+    ) -> Result<SocketAddr, TranslationError> {
+        // If we operate in the serverless Cloud, then we substitute every node's address
+        // with the address of the proxy in the datacenter that the node resides in.
+        let UntranslatedPeer {
+            host_id,
+            untranslated_address,
+            ref datacenter,
+            ..
+        } = *untranslated_peer;
+
+        let Some(dc) = datacenter.as_deref() else {
+            warn!( // FIXME: perhaps error! would fit here better?
+                "Datacenter for node {} is empty in the Metadata fetched from the Cloud cluster; ; therefore address \
+                    broadcast by the node was left as address to open connection to.",
+                host_id
+            );
+            // FIXME: Is this acceptable to do such fallback?
+            return Ok(untranslated_address);
+        };
+
+        let Some(dc_config) = self.get_datacenters().get(dc) else {
+            warn!( // FIXME: perhaps error! would fit here better?
+                "Datacenter {} that node {} resides in not found in the Cloud config; ; therefore address \
+                    broadcast by the node was left as address to open connection to.",
+                dc, host_id
+            );
+            // FIXME: Is this acceptable to do such fallback?
+            return Ok(untranslated_address);
+        };
+
+        let hostname = dc_config.get_server();
+        let resolved = resolve_hostname(hostname).await
+            // inspect_err() is stable since 1.76.
+            // TODO: use inspect_err once we bump MSRV to at least 1.76.
+            .map_err(|err| {
+                warn!(
+                    "Couldn't resolve address: {} of datacenter {} that node {} resides in; therefore address \
+                        broadcast by the node was left as address to open connection to.",
+                    hostname, dc, host_id
+                );
+                err
+            })
+            .map_err(Arc::new)
+            .map_err(TranslationError::IoError)?;
+
+        Ok(resolved)
+    }
+}
+
 /// Contains all authentication info for creating TLS connections using SNI proxy
 /// to connect to cloud nodes.
 #[derive(Debug)]
diff --git a/scylla/src/errors.rs b/scylla/src/errors.rs
index 844ca5a583..c6c3790b48 100644
--- a/scylla/src/errors.rs
+++ b/scylla/src/errors.rs
@@ -608,6 +608,10 @@ pub enum TranslationError {
         translated_addr_str: &'static str,
         reason: AddrParseError,
     },
+
+    /// An I/O error occurred during address translation.
+    #[error("An I/O error occurred during address translation: {0}")]
+    IoError(Arc<std::io::Error>),
 }
 
 /// An error that occurred during connection setup request execution.
diff --git a/scylla/src/network/connection_pool.rs b/scylla/src/network/connection_pool.rs
index a4c5bc5d3e..a6bea1c760 100644
--- a/scylla/src/network/connection_pool.rs
+++ b/scylla/src/network/connection_pool.rs
@@ -12,9 +12,6 @@ use crate::routing::{Shard, ShardCount, Sharder};
 
 use crate::cluster::metadata::{PeerEndpoint, UntranslatedEndpoint};
 
-#[cfg(feature = "cloud")]
-use crate::cluster::node::resolve_hostname;
-
 use crate::cluster::NodeAddr;
 
 use arc_swap::ArcSwap;
@@ -850,84 +847,17 @@ impl PoolRefiller {
         }
     }
 
-    #[cfg(not(feature = "cloud"))]
-    fn maybe_translate_for_serverless(
-        &self,
-        endpoint: UntranslatedEndpoint,
-    ) -> impl Future<Output = UntranslatedEndpoint> {
-        // We are not in serverless Cloud, so no modifications are necessary here.
-        async move { endpoint }
-    }
-
-    #[cfg(feature = "cloud")]
-    fn maybe_translate_for_serverless(
-        &self,
-        mut endpoint: UntranslatedEndpoint,
-    ) -> impl Future<Output = UntranslatedEndpoint> {
-        let cloud_config = self.pool_config.connection_config.cloud_config.clone();
-        async move {
-            if let Some(cloud_config) = cloud_config {
-                // If we operate in the serverless Cloud, then we substitute every node's address
-                // with the address of the proxy in the datacenter that the node resides in.
-                if let UntranslatedEndpoint::Peer(PeerEndpoint {
-                    host_id,
-                    ref mut address,
-                    ref datacenter,
-                    ..
-                }) = endpoint
-                {
-                    if let Some(dc) = datacenter.as_deref() {
-                        if let Some(dc_config) = cloud_config.get_datacenters().get(dc) {
-                            let hostname = dc_config.get_server();
-                            if let Ok(resolved) = resolve_hostname(hostname).await {
-                                *address = NodeAddr::Untranslatable(resolved)
-                            } else {
-                                warn!(
-                                        "Couldn't resolve address: {} of datacenter {} that node {} resides in; therefore address \
-                                         broadcast by the node was left as address to open connection to.",
-                                        hostname, dc, host_id
-                                    );
-                            }
-                        } else {
-                            warn!( // FIXME: perhaps error! would fit here better?
-                                    "Datacenter {} that node {} resides in not found in the Cloud config; ; therefore address \
-                                     broadcast by the node was left as address to open connection to.",
-                                    dc, host_id
-                                );
-                        }
-                    } else {
-                        warn!( // FIXME: perhaps error! would fit here better?
-                                "Datacenter for node {} is empty in the Metadata fetched from the Cloud cluster; ; therefore address \
-                                 broadcast by the node was left as address to open connection to.",
-                                host_id
-                            );
-                    }
-                }
-                endpoint
-            } else {
-                // We are not in serverless Cloud, so no modifications are necessary here.
-                endpoint
-            }
-        }
-    }
-
     // Starts opening a new connection in the background. The result of connecting
     // will be available on `ready_connections`. If the shard is specified and
     // the shard aware port is available, it will attempt to connect directly
     // to the shard using the port.
     fn start_opening_connection(&self, shard: Option<Shard>) {
         let cfg = self.pool_config.connection_config.clone();
-        let endpoint = self.endpoint.read().unwrap().clone();
-
-        // If we operate in the serverless Cloud, then we substitute every node's address
-        // with the address of the proxy in the datacenter that the node resides in.
-        // As this may may involve resolving a hostname, the whole operation is async.
-        let endpoint_fut = self.maybe_translate_for_serverless(endpoint);
+        let mut endpoint = self.endpoint.read().unwrap().clone();
 
         let fut = match (self.sharder.clone(), self.shard_aware_port, shard) {
             (Some(sharder), Some(port), Some(shard)) => async move {
                 let shard_aware_endpoint = {
-                    let mut endpoint = endpoint_fut.await;
                     endpoint.set_port(port);
                     endpoint
                 };
@@ -946,7 +876,7 @@ impl PoolRefiller {
             }
             .boxed(),
             _ => async move {
-                let non_shard_aware_endpoint = endpoint_fut.await;
+                let non_shard_aware_endpoint = endpoint;
                 let result = open_connection(non_shard_aware_endpoint, None, &cfg).await;
                 OpenedConnectionEvent {
                     result,

From f07556a06c79571f1f0dc8dfd658526362b3161c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sat, 1 Feb 2025 22:37:58 +0100
Subject: [PATCH 18/29] connection: remove CloudConfig from ConnectionConfig

It's no longer necessary, as CloudConfig is now passed inside
TlsProvider.
---
 scylla/src/client/session.rs     |  4 +---
 scylla/src/network/connection.rs | 12 ------------
 2 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/scylla/src/client/session.rs b/scylla/src/client/session.rs
index af12ec85fb..906eff056b 100644
--- a/scylla/src/client/session.rs
+++ b/scylla/src/client/session.rs
@@ -1021,7 +1021,7 @@ where
         #[cfg(feature = "__tls")]
         let tls_provider = 'provider: {
             #[cfg(feature = "cloud")]
-            if let Some(cloud_config) = config.cloud_config.clone() {
+            if let Some(cloud_config) = config.cloud_config {
                 if config.tls_context.is_some() {
                     // This can only happen if the user builds SessionConfig by hand, as SessionBuilder in cloud mode prevents setting custom TlsContext.
                     warn!(
@@ -1053,8 +1053,6 @@ where
             event_sender: None,
             default_consistency: Default::default(),
             address_translator,
-            #[cfg(feature = "cloud")]
-            cloud_config: config.cloud_config,
             enable_write_coalescing: config.enable_write_coalescing,
             keepalive_interval: config.keepalive_interval,
             keepalive_timeout: config.keepalive_timeout,
diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index d1d14513b3..ce35190168 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -3,8 +3,6 @@ use crate::batch::{Batch, BatchStatement};
 use crate::client::pager::{NextRowError, QueryPager};
 use crate::client::Compression;
 use crate::client::SelfIdentity;
-#[cfg(feature = "cloud")]
-use crate::cloud::CloudConfig;
 use crate::cluster::metadata::{PeerEndpoint, UntranslatedEndpoint, UntranslatedPeer};
 use crate::cluster::NodeAddr;
 use crate::errors::{
@@ -465,8 +463,6 @@ pub(crate) struct ConnectionConfig {
     // should be Some only in control connections,
     pub(crate) event_sender: Option<mpsc::Sender<Event>>,
     pub(crate) default_consistency: Consistency,
-    #[cfg(feature = "cloud")]
-    pub(crate) cloud_config: Option<Arc<CloudConfig>>,
     pub(crate) authenticator: Option<Arc<dyn AuthenticatorProvider>>,
     pub(crate) address_translator: Option<Arc<dyn AddressTranslator>>,
     pub(crate) enable_write_coalescing: bool,
@@ -499,8 +495,6 @@ impl ConnectionConfig {
             connect_timeout: self.connect_timeout,
             event_sender: self.event_sender.clone(),
             default_consistency: self.default_consistency,
-            #[cfg(feature = "cloud")]
-            cloud_config: self.cloud_config.clone(),
             authenticator: self.authenticator.clone(),
             address_translator: self.address_translator.clone(),
             enable_write_coalescing: self.enable_write_coalescing,
@@ -524,8 +518,6 @@ pub(crate) struct HostConnectionConfig {
     // should be Some only in control connections,
     pub(crate) event_sender: Option<mpsc::Sender<Event>>,
     pub(crate) default_consistency: Consistency,
-    #[cfg(feature = "cloud")]
-    pub(crate) cloud_config: Option<Arc<CloudConfig>>,
     pub(crate) authenticator: Option<Arc<dyn AuthenticatorProvider>>,
     pub(crate) address_translator: Option<Arc<dyn AddressTranslator>>,
     pub(crate) enable_write_coalescing: bool,
@@ -552,8 +544,6 @@ impl Default for HostConnectionConfig {
             default_consistency: Default::default(),
             authenticator: None,
             address_translator: None,
-            #[cfg(feature = "cloud")]
-            cloud_config: None,
             enable_write_coalescing: true,
 
             // Note: this is different than SessionConfig default values.
@@ -582,8 +572,6 @@ impl Default for ConnectionConfig {
             default_consistency: Default::default(),
             authenticator: None,
             address_translator: None,
-            #[cfg(feature = "cloud")]
-            cloud_config: None,
             enable_write_coalescing: true,
 
             // Note: this is different than SessionConfig default values.

From 6edde3ef336d81790b90e66cc5ce0c574a447950 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sun, 2 Feb 2025 13:04:02 +0100
Subject: [PATCH 19/29] metadata: derive Debug for UntranslatedPeer

---
 scylla/src/cluster/metadata.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scylla/src/cluster/metadata.rs b/scylla/src/cluster/metadata.rs
index da977bdf95..f6e46f6086 100644
--- a/scylla/src/cluster/metadata.rs
+++ b/scylla/src/cluster/metadata.rs
@@ -170,6 +170,7 @@ impl Peer {
 /// Data used to issue connections to a node that is possibly subject to address translation.
 ///
 /// Built from `PeerEndpoint` if its `NodeAddr` variant implies address translation possibility.
+#[derive(Debug)]
 #[non_exhaustive] // <- so that we can add more fields in a backwards-compatible way
 pub struct UntranslatedPeer {
     pub host_id: Uuid,

From 258cf89b47e81bfb5b6316dd0097b2907a5ec67f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sun, 2 Feb 2025 13:10:20 +0100
Subject: [PATCH 20/29] metadata: expose only getters for UntranslatedPeer

If in the future we choose to store data differently in
UntranslatedPeer, we will now have freedom to do so, only preserving the
getters. Otherwise, we would have to retain legacy fields in such case.
---
 scylla/src/client/session_builder.rs      |  4 +--
 scylla/src/cluster/metadata.rs            | 36 +++++++++++++++++++----
 scylla/src/policies/address_translator.rs |  8 ++---
 3 files changed, 37 insertions(+), 11 deletions(-)

diff --git a/scylla/src/client/session_builder.rs b/scylla/src/client/session_builder.rs
index f2fc8b01d8..89519bfc14 100644
--- a/scylla/src/client/session_builder.rs
+++ b/scylla/src/client/session_builder.rs
@@ -282,9 +282,9 @@ impl GenericSessionBuilder<DefaultMode> {
     /// impl AddressTranslator for IdentityTranslator {
     ///     async fn translate_address(
     ///         &self,
-    ///         untranslated_peer: &UntranslatedPeer
+    ///         untranslated_peer: &UntranslatedPeer,
     ///     ) -> Result<SocketAddr, TranslationError> {
-    ///         Ok(untranslated_peer.untranslated_address)
+    ///         Ok(untranslated_peer.untranslated_address())
     ///     }
     /// }
     ///
diff --git a/scylla/src/cluster/metadata.rs b/scylla/src/cluster/metadata.rs
index f6e46f6086..2c5f6226f1 100644
--- a/scylla/src/cluster/metadata.rs
+++ b/scylla/src/cluster/metadata.rs
@@ -171,12 +171,38 @@ impl Peer {
 ///
 /// Built from `PeerEndpoint` if its `NodeAddr` variant implies address translation possibility.
 #[derive(Debug)]
-#[non_exhaustive] // <- so that we can add more fields in a backwards-compatible way
 pub struct UntranslatedPeer {
-    pub host_id: Uuid,
-    pub untranslated_address: SocketAddr,
-    pub datacenter: Option<String>,
-    pub rack: Option<String>,
+    pub(crate) host_id: Uuid,
+    pub(crate) untranslated_address: SocketAddr,
+    pub(crate) datacenter: Option<String>,
+    pub(crate) rack: Option<String>,
+}
+
+impl UntranslatedPeer {
+    /// The unique identifier of the node in the cluster.
+    #[inline]
+    pub fn host_id(&self) -> Uuid {
+        self.host_id
+    }
+
+    /// The address of the node in the cluster as broadcast by the node itself.
+    /// It may be subject to address translation.
+    #[inline]
+    pub fn untranslated_address(&self) -> SocketAddr {
+        self.untranslated_address
+    }
+
+    /// The datacenter the node resides in.
+    #[inline]
+    pub fn datacenter(&self) -> Option<&str> {
+        self.datacenter.as_deref()
+    }
+
+    /// The rack the node resides in.
+    #[inline]
+    pub fn rack(&self) -> Option<&str> {
+        self.rack.as_deref()
+    }
 }
 
 #[derive(Clone, Debug, PartialEq, Eq)]
diff --git a/scylla/src/policies/address_translator.rs b/scylla/src/policies/address_translator.rs
index db88068092..75f9631afe 100644
--- a/scylla/src/policies/address_translator.rs
+++ b/scylla/src/policies/address_translator.rs
@@ -37,10 +37,10 @@ impl AddressTranslator for HashMap<SocketAddr, SocketAddr> {
         &self,
         untranslated_peer: &UntranslatedPeer,
     ) -> Result<SocketAddr, TranslationError> {
-        match self.get(&untranslated_peer.untranslated_address) {
+        match self.get(&untranslated_peer.untranslated_address()) {
             Some(&translated_addr) => Ok(translated_addr),
             None => Err(TranslationError::NoRuleForAddress(
-                untranslated_peer.untranslated_address,
+                untranslated_peer.untranslated_address(),
             )),
         }
     }
@@ -56,7 +56,7 @@ impl AddressTranslator for HashMap<&'static str, &'static str> {
     ) -> Result<SocketAddr, TranslationError> {
         for (&rule_addr_str, &translated_addr_str) in self.iter() {
             if let Ok(rule_addr) = SocketAddr::from_str(rule_addr_str) {
-                if rule_addr == untranslated_peer.untranslated_address {
+                if rule_addr == untranslated_peer.untranslated_address() {
                     return SocketAddr::from_str(translated_addr_str).map_err(|reason| {
                         TranslationError::InvalidAddressInRule {
                             translated_addr_str,
@@ -67,7 +67,7 @@ impl AddressTranslator for HashMap<&'static str, &'static str> {
             }
         }
         Err(TranslationError::NoRuleForAddress(
-            untranslated_peer.untranslated_address,
+            untranslated_peer.untranslated_address(),
         ))
     }
 }

From ca2f799a2ca5efa0abbd6c38631a79325eabca84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sun, 2 Feb 2025 13:13:12 +0100
Subject: [PATCH 21/29] metadata: UntranslatedPeer holds borrowed &str

As address translation should not need ownership of neither datacenter
nor rack, let's not require cloning them.
---
 scylla/src/cluster/metadata.rs   | 12 ++++++------
 scylla/src/network/connection.rs |  4 ++--
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/scylla/src/cluster/metadata.rs b/scylla/src/cluster/metadata.rs
index 2c5f6226f1..231f03d65a 100644
--- a/scylla/src/cluster/metadata.rs
+++ b/scylla/src/cluster/metadata.rs
@@ -171,14 +171,14 @@ impl Peer {
 ///
 /// Built from `PeerEndpoint` if its `NodeAddr` variant implies address translation possibility.
 #[derive(Debug)]
-pub struct UntranslatedPeer {
+pub struct UntranslatedPeer<'a> {
     pub(crate) host_id: Uuid,
     pub(crate) untranslated_address: SocketAddr,
-    pub(crate) datacenter: Option<String>,
-    pub(crate) rack: Option<String>,
+    pub(crate) datacenter: Option<&'a str>,
+    pub(crate) rack: Option<&'a str>,
 }
 
-impl UntranslatedPeer {
+impl UntranslatedPeer<'_> {
     /// The unique identifier of the node in the cluster.
     #[inline]
     pub fn host_id(&self) -> Uuid {
@@ -195,13 +195,13 @@ impl UntranslatedPeer {
     /// The datacenter the node resides in.
     #[inline]
     pub fn datacenter(&self) -> Option<&str> {
-        self.datacenter.as_deref()
+        self.datacenter
     }
 
     /// The rack the node resides in.
     #[inline]
     pub fn rack(&self) -> Option<&str> {
-        self.rack.as_deref()
+        self.rack
     }
 }
 
diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index ce35190168..e25c4187eb 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -2008,8 +2008,8 @@ async fn maybe_translated_addr(
                         .translate_address(&UntranslatedPeer {
                             host_id,
                             untranslated_address: addr,
-                            datacenter,
-                            rack,
+                            datacenter: datacenter.as_deref(),
+                            rack: rack.as_deref(),
                         })
                         .await;
                     if let Err(ref err) = res {

From 3eba2c4701cc8e1b24a6151c4971505c67b37fbf Mon Sep 17 00:00:00 2001
From: Andres Medina <andresnrx@gmail.com>
Date: Thu, 16 Jan 2025 19:52:00 -0800
Subject: [PATCH 22/29] connection: support rustls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rustls is now supported as ordinary TLS provider, for far only for the
non-cloud case.

Co-authored-by: Wojciech Przytuła <wojciech.przytula@scylladb.com>
---
 Cargo.lock.msrv                  | 276 ++++++++++++++++++++++++++++++-
 scylla/Cargo.toml                |   3 +
 scylla/src/client/session.rs     |   9 +
 scylla/src/network/connection.rs |  34 +++-
 4 files changed, 316 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock.msrv b/Cargo.lock.msrv
index a798dc52ac..091e824f13 100644
--- a/Cargo.lock.msrv
+++ b/Cargo.lock.msrv
@@ -117,6 +117,31 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
+[[package]]
+name = "aws-lc-rs"
+version = "1.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c2b7ddaa2c56a367ad27a094ad8ef4faacf8a617c2575acb2ba88949df999ca"
+dependencies = [
+ "aws-lc-sys",
+ "paste",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71b2ddd3ada61a305e1d8bb6c005d1eaa7d14d903681edfc400406d523a9b491"
+dependencies = [
+ "bindgen",
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "paste",
+]
+
 [[package]]
 name = "backtrace"
 version = "0.3.73"
@@ -151,6 +176,29 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "bindgen"
+version = "0.69.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
+dependencies = [
+ "bitflags 2.5.0",
+ "cexpr",
+ "clang-sys",
+ "itertools 0.10.5",
+ "lazy_static",
+ "lazycell",
+ "log",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "syn 2.0.90",
+ "which",
+]
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -193,9 +241,20 @@ version = "1.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13208fcbb66eaeffe09b99fffbe1af420f00a7b35aa99ad683dfc1aa76145229"
 dependencies = [
+ "jobserver",
+ "libc",
  "shlex",
 ]
 
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.0"
@@ -241,6 +300,17 @@ dependencies = [
  "half",
 ]
 
+[[package]]
+name = "clang-sys"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
 [[package]]
 name = "clap"
 version = "3.2.25"
@@ -291,6 +361,15 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "cmake"
+version = "0.1.53"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e24a03c8b52922d68a1589ad61032f2c1aa5a8158d2aa0d93c6e9534944bbad6"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -442,6 +521,12 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
 [[package]]
 name = "either"
 version = "1.11.0"
@@ -502,7 +587,7 @@ dependencies = [
  "clap",
  "env_logger",
  "futures",
- "openssl-010",
+ "openssl",
  "rand",
  "rustyline",
  "rustyline-derive",
@@ -557,6 +642,12 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
 [[package]]
 name = "futures"
 version = "0.3.30"
@@ -663,6 +754,12 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"
 
+[[package]]
+name = "glob"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
+
 [[package]]
 name = "half"
 version = "2.4.1"
@@ -716,6 +813,15 @@ version = "0.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "12cb882ccb290b8646e554b157ab0b71e64e8d5bef775cd66b6531e52d302669"
 
+[[package]]
+name = "home"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "humantime"
 version = "2.1.0"
@@ -816,6 +922,15 @@ version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
+[[package]]
+name = "jobserver"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48d1dbcbbeb6a7fec7e059840aa538bd62aaccf972c7346c4d9d2059312853d0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "js-sys"
 version = "0.3.70"
@@ -831,12 +946,28 @@ version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
 [[package]]
 name = "libc"
 version = "0.2.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ae743338b92ff9146ce83992f766a31066a91a8c84a45e0e9f21e7cf6de6d346"
 
+[[package]]
+name = "libloading"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34"
+dependencies = [
+ "cfg-if",
+ "windows-targets 0.48.5",
+]
+
 [[package]]
 name = "libm"
 version = "0.2.8"
@@ -898,6 +1029,12 @@ dependencies = [
  "autocfg",
 ]
 
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
 [[package]]
 name = "miniz_oxide"
 version = "0.7.2"
@@ -940,6 +1077,16 @@ dependencies = [
  "memoffset",
 ]
 
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
 [[package]]
 name = "ntest"
 version = "0.9.3"
@@ -1060,7 +1207,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ab1bc2a289d34bd04a330323ac98a1b4bc82c9d9fcb1e66b63caa84da26b575"
 
 [[package]]
-name = "openssl-010"
+name = "openssl"
 version = "0.10.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f5e534d133a060a3c19daec1eb3e98ec6f4685978834f2dbadfe2ec215bab64e"
@@ -1132,6 +1279,12 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.1"
@@ -1196,6 +1349,16 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
+[[package]]
+name = "prettyplease"
+version = "0.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64d1ec885c64d0457d564db4ec299b2dae3f9c02808b8ad9c3a089c591b18033"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.90",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "3.1.0"
@@ -1389,12 +1552,33 @@ version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 
+[[package]]
+name = "ring"
+version = "0.17.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom",
+ "libc",
+ "spin",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "rustc-demangle"
 version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
 [[package]]
 name = "rustix"
 version = "0.38.34"
@@ -1408,6 +1592,39 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.23.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "934b404430bb06b3fae2cba809eb45a1ab1aecd64491213d7c3301b88393f8d1"
+dependencies = [
+ "aws-lc-rs",
+ "log",
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "917ce264624a4b4db1c364dcc35bfca9ded014d0a958cd47ad3e960e988ea51c"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.102.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "rustyline"
 version = "9.1.2"
@@ -1486,10 +1703,11 @@ dependencies = [
  "ntest",
  "num-bigint 0.3.3",
  "num-bigint 0.4.5",
- "openssl-010",
+ "openssl",
  "rand",
  "rand_chacha",
  "rand_pcg",
+ "rustls",
  "scylla-cql",
  "scylla-macros",
  "scylla-proxy",
@@ -1502,6 +1720,7 @@ dependencies = [
  "time",
  "tokio",
  "tokio-openssl",
+ "tokio-rustls",
  "tracing",
  "tracing-subscriber",
  "url",
@@ -1674,6 +1893,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.0"
@@ -1710,6 +1935,12 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "syn"
 version = "1.0.109"
@@ -1900,11 +2131,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ffab79df67727f6acf57f1ff743091873c24c579b1e2ce4d8f53e47ded4d63d"
 dependencies = [
  "futures-util",
- "openssl-010",
+ "openssl",
  "openssl-sys",
  "tokio",
 ]
 
+[[package]]
+name = "tokio-rustls"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f6d0975eaace0cf0fcadee4e4aaa5da15b5c079146f2cffb67c113be122bf37"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
 [[package]]
 name = "toml_datetime"
 version = "0.6.5"
@@ -2056,6 +2297,12 @@ version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
 
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
 [[package]]
 name = "url"
 version = "2.5.0"
@@ -2182,6 +2429,18 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -2240,6 +2499,15 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.48.5"
diff --git a/scylla/Cargo.toml b/scylla/Cargo.toml
index 05e15f1c45..faa7ef7a9d 100644
--- a/scylla/Cargo.toml
+++ b/scylla/Cargo.toml
@@ -17,6 +17,7 @@ rustdoc-args = ["--cfg", "docsrs"]
 [features]
 default = []
 openssl-010 = ["dep:tokio-openssl", "dep:openssl", "__tls"]
+rustls-023 = ["dep:tokio-rustls", "dep:rustls", "__tls"]
 cloud = [
     "openssl-010",
     "scylla-cql/serde",
@@ -66,6 +67,8 @@ tracing = "0.1.36"
 chrono = { version = "0.4.32", default-features = false, features = ["clock"] }
 openssl = { version = "0.10.69", optional = true }
 tokio-openssl = { version = "0.6.1", optional = true }
+tokio-rustls = { version = "0.26", optional = true }
+rustls = { version = "0.23", optional = true }
 arc-swap = "1.3.0"
 dashmap = "5.2"
 lz4_flex = { version = "0.11.1" }
diff --git a/scylla/src/client/session.rs b/scylla/src/client/session.rs
index 906eff056b..618c378918 100644
--- a/scylla/src/client/session.rs
+++ b/scylla/src/client/session.rs
@@ -150,6 +150,8 @@ where
 pub enum TlsContext {
     #[cfg(feature = "openssl-010")]
     OpenSsl010(openssl::ssl::SslContext),
+    #[cfg(feature = "rustls-023")]
+    Rustls023(Arc<rustls::ClientConfig>),
 }
 
 #[cfg(feature = "openssl-010")]
@@ -159,6 +161,13 @@ impl From<openssl::ssl::SslContext> for TlsContext {
     }
 }
 
+#[cfg(feature = "rustls-023")]
+impl From<Arc<rustls::ClientConfig>> for TlsContext {
+    fn from(value: Arc<rustls::ClientConfig>) -> Self {
+        TlsContext::Rustls023(value)
+    }
+}
+
 /// Configuration options for [`Session`].
 /// Can be created manually, but usually it's easier to use
 /// [SessionBuilder](super::session_builder::SessionBuilder)
diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index e25c4187eb..0ddbeecb3e 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -230,9 +230,9 @@ mod tls_config {
     //!     │
     //!     ↳Tls (wrapper over TCP stream which adds encryption)
 
-    #[cfg(not(any(feature = "openssl-010")))]
+    #[cfg(not(any(feature = "openssl-010", feature = "rustls-023")))]
     compile_error!(
-        r#""__tls" feature requires a TLS backend: at least one of ["openssl-010"] is needed"#
+        r#""__tls" feature requires a TLS backend: at least one of ["openssl-010", "rustls-023"] is needed"#
     );
 
     use std::io;
@@ -333,6 +333,10 @@ mod tls_config {
     pub(crate) enum Tls {
         #[cfg(feature = "openssl-010")]
         OpenSsl010(openssl::ssl::Ssl),
+        #[cfg(feature = "rustls-023")]
+        Rustls023 {
+            connector: tokio_rustls::TlsConnector,
+        },
     }
 
     /// A wrapper around a TLS error.
@@ -403,6 +407,12 @@ mod tls_config {
                     }
                     Tls::OpenSsl010(ssl)
                 }
+                #[cfg(feature = "rustls-023")]
+                TlsContext::Rustls023(config) => {
+                    let connector = tokio_rustls::TlsConnector::from(config.clone());
+
+                    Tls::Rustls023 { connector }
+                }
             };
 
             Ok(tls)
@@ -1567,6 +1577,26 @@ impl Connection {
                         .connect()
                         .await
                         .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e))?;
+
+                    let (task, handle) = Self::router(
+                        config,
+                        stream,
+                        receiver,
+                        error_sender,
+                        orphan_notification_receiver,
+                        router_handle,
+                        node_address,
+                    )
+                    .remote_handle();
+
+                    tokio::task::spawn(task);
+                    handle
+                }
+                #[cfg(feature = "rustls-023")]
+                Tls::Rustls023 { connector } => {
+                    use rustls::pki_types::ServerName;
+                    let server_name = ServerName::IpAddress(node_address.into());
+                    let stream = connector.connect(server_name, stream).await?;
                     let (task, handle) = Self::router(
                         config,
                         stream,

From 1bb3946c004208c80e9b5fb4aac2fb58e41b3626 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sun, 2 Feb 2025 21:01:17 +0100
Subject: [PATCH 23/29] cloud: support rustls

rustls is now supported in cloud, too. The choice between rustls and
openssl is done based on enabled features:
- if openssl-010 feature is enabled, openssl is used for cloud;
- else if rustls-023 feature is enabled, rustls is used for cloud;
- else compile error is raised.

It is subject to discussion in the PR is such logic based on features
is acceptable.

Co-authored-by: Andres Medina <andresnrx@gmail.com>
---
 Cargo.lock.msrv                  |  4 +-
 scylla/Cargo.toml                |  2 +-
 scylla/src/cloud/config.rs       | 94 ++++++++++++++++++++++++++++++++
 scylla/src/cloud/mod.rs          |  8 +++
 scylla/src/network/connection.rs | 60 +++++++++++++++++++-
 5 files changed, 162 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock.msrv b/Cargo.lock.msrv
index 091e824f13..f7744f4388 100644
--- a/Cargo.lock.msrv
+++ b/Cargo.lock.msrv
@@ -756,9 +756,9 @@ checksum = "40ecd4077b5ae9fd2e9e169b102c6c330d0605168eb0e8bf79952b256dbefffd"
 
 [[package]]
 name = "glob"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
+checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
 
 [[package]]
 name = "half"
diff --git a/scylla/Cargo.toml b/scylla/Cargo.toml
index faa7ef7a9d..ac7557bfdd 100644
--- a/scylla/Cargo.toml
+++ b/scylla/Cargo.toml
@@ -19,7 +19,7 @@ default = []
 openssl-010 = ["dep:tokio-openssl", "dep:openssl", "__tls"]
 rustls-023 = ["dep:tokio-rustls", "dep:rustls", "__tls"]
 cloud = [
-    "openssl-010",
+    "__tls",
     "scylla-cql/serde",
     "dep:serde_yaml",
     "dep:serde",
diff --git a/scylla/src/cloud/config.rs b/scylla/src/cloud/config.rs
index 62b6bb2164..48c2df7a22 100644
--- a/scylla/src/cloud/config.rs
+++ b/scylla/src/cloud/config.rs
@@ -110,6 +110,28 @@ impl CloudConfig {
                 let context = builder.build();
                 TlsContext::OpenSsl010(context)
             }
+            #[cfg(all(not(feature = "openssl-010"), feature = "rustls-023"))]
+            TlsInfo::Rustls023 { cert_chain, key } => {
+                use rustls::ClientConfig;
+                use std::sync::Arc;
+
+                let mut root_store = rustls::RootCertStore::empty();
+                root_store.add(datacenter.rustls_ca().clone())?;
+                let builder = ClientConfig::builder();
+                let builder = if datacenter.get_insecure_skip_tls_verify() {
+                    let supported = builder.crypto_provider().signature_verification_algorithms;
+                    builder
+                        .dangerous()
+                        .with_custom_certificate_verifier(Arc::new(NoCertificateVerification {
+                            supported,
+                        }))
+                } else {
+                    builder.with_root_certificates(root_store)
+                };
+
+                let config = builder.with_client_auth_cert(cert_chain.clone(), key.clone_key())?;
+                TlsContext::Rustls023(Arc::new(config))
+            }
         };
 
         Ok(Some(TlsConfig::new_for_sni(
@@ -192,6 +214,11 @@ pub(crate) enum TlsInfo {
         key: openssl::pkey::PKey<openssl::pkey::Private>,
         cert: openssl::x509::X509,
     },
+    #[cfg(all(not(feature = "openssl-010"), feature = "rustls-023"))]
+    Rustls023 {
+        cert_chain: Vec<rustls::pki_types::CertificateDer<'static>>,
+        key: rustls::pki_types::PrivateKeyDer<'static>,
+    },
 }
 
 impl TlsInfo {
@@ -202,6 +229,15 @@ impl TlsInfo {
             let key = openssl::pkey::PKey::private_key_from_pem(key)?;
             Ok(TlsInfo::OpenSsl010 { key, cert })
         }
+
+        #[cfg(all(not(feature = "openssl-010"), feature = "rustls-023"))]
+        {
+            use rustls::pki_types::pem::PemObject;
+            let key = rustls::pki_types::PrivateKeyDer::from_pem_slice(key)?;
+            let cert_chain: Vec<_> = rustls::pki_types::CertificateDer::pem_slice_iter(cert)
+                .collect::<Result<_, _>>()?;
+            Ok(TlsInfo::Rustls023 { cert_chain, key })
+        }
     }
 }
 
@@ -226,6 +262,8 @@ impl AuthInfo {
 pub(crate) struct Datacenter {
     #[cfg(feature = "openssl-010")]
     openssl_ca: openssl::x509::X509,
+    #[cfg(all(not(feature = "openssl-010"), feature = "rustls-023"))]
+    rustls_ca: rustls::pki_types::CertificateDer<'static>,
     server: String,
     #[allow(unused)]
     tls_server_name: Option<String>,
@@ -241,6 +279,11 @@ impl Datacenter {
         &self.openssl_ca
     }
 
+    #[cfg(all(not(feature = "openssl-010"), feature = "rustls-023"))]
+    pub(crate) fn rustls_ca(&self) -> &rustls::pki_types::CertificateDer<'static> {
+        &self.rustls_ca
+    }
+
     pub(crate) fn get_server(&self) -> &str {
         &self.server
     }
@@ -637,9 +680,18 @@ mod deserialize {
             let openssl_ca =
                 openssl::x509::X509::from_pem(&cert_pem[..]).map_err(TlsError::from)?;
 
+            #[cfg(all(not(feature = "openssl-010"), feature = "rustls-023"))]
+            let rustls_ca = {
+                use rustls::pki_types::pem::PemObject as _;
+                rustls::pki_types::CertificateDer::from_pem_slice(cert_pem.as_ref())
+                    .map_err(TlsError::from)?
+            };
+
             Ok(super::Datacenter {
                 #[cfg(feature = "openssl-010")]
                 openssl_ca,
+                #[cfg(all(not(feature = "openssl-010"), feature = "rustls-023"))]
+                rustls_ca,
                 server: datacenter.server,
                 node_domain,
                 insecure_skip_tls_verify: datacenter.insecureSkipTlsVerify.unwrap_or(false),
@@ -994,3 +1046,45 @@ mod deserialize {
         }
     }
 }
+
+#[cfg(all(not(feature = "openssl-010"), feature = "rustls-023"))]
+#[derive(Debug)]
+struct NoCertificateVerification {
+    supported: rustls::crypto::WebPkiSupportedAlgorithms,
+}
+
+#[cfg(all(not(feature = "openssl-010"), feature = "rustls-023"))]
+impl rustls::client::danger::ServerCertVerifier for NoCertificateVerification {
+    fn verify_server_cert(
+        &self,
+        _end_entity: &rustls::pki_types::CertificateDer<'_>,
+        _intermediates: &[rustls::pki_types::CertificateDer<'_>],
+        _server_name: &rustls::pki_types::ServerName<'_>,
+        _ocsp_response: &[u8],
+        _now: rustls::pki_types::UnixTime,
+    ) -> Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
+        Ok(rustls::client::danger::ServerCertVerified::assertion())
+    }
+
+    fn verify_tls12_signature(
+        &self,
+        _message: &[u8],
+        _cert: &rustls::pki_types::CertificateDer<'_>,
+        _dss: &rustls::DigitallySignedStruct,
+    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
+        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
+    }
+
+    fn verify_tls13_signature(
+        &self,
+        _message: &[u8],
+        _cert: &rustls::pki_types::CertificateDer<'_>,
+        _dss: &rustls::DigitallySignedStruct,
+    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
+        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
+    }
+
+    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
+        self.supported.supported_schemes()
+    }
+}
diff --git a/scylla/src/cloud/mod.rs b/scylla/src/cloud/mod.rs
index 56dc42eb52..3beb8ac776 100644
--- a/scylla/src/cloud/mod.rs
+++ b/scylla/src/cloud/mod.rs
@@ -2,3 +2,11 @@ mod config;
 
 pub use config::CloudConfig;
 pub use config::CloudConfigError;
+
+#[cfg(all(
+    feature = "cloud",
+    not(any(feature = "rustls-023", feature = "openssl-010"))
+))]
+compile_error!(
+    r#""cloud" feature requires a TLS backend: at least one of ["rustls-023", "openssl-010"] is needed"#
+);
diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index 0ddbeecb3e..7482687a96 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -336,6 +336,8 @@ mod tls_config {
         #[cfg(feature = "rustls-023")]
         Rustls023 {
             connector: tokio_rustls::TlsConnector,
+            #[cfg(feature = "cloud")]
+            sni: Option<rustls::pki_types::ServerName<'static>>,
         },
     }
 
@@ -348,6 +350,12 @@ mod tls_config {
     pub enum TlsError {
         #[cfg(feature = "openssl-010")]
         OpenSsl010(openssl::error::ErrorStack),
+        #[cfg(feature = "rustls-023")]
+        InvalidName(rustls::pki_types::InvalidDnsNameError),
+        #[cfg(feature = "rustls-023")]
+        PemParse(rustls::pki_types::pem::Error),
+        #[cfg(feature = "rustls-023")]
+        Rustls023(rustls::Error),
     }
 
     impl From<TlsError> for io::Error {
@@ -355,6 +363,12 @@ mod tls_config {
             match value {
                 #[cfg(feature = "openssl-010")]
                 TlsError::OpenSsl010(e) => e.into(),
+                #[cfg(feature = "rustls-023")]
+                TlsError::InvalidName(e) => io::Error::new(io::ErrorKind::Other, e),
+                #[cfg(feature = "rustls-023")]
+                TlsError::PemParse(e) => io::Error::new(io::ErrorKind::Other, e),
+                #[cfg(feature = "rustls-023")]
+                TlsError::Rustls023(e) => io::Error::new(io::ErrorKind::Other, e),
             }
         }
     }
@@ -366,6 +380,27 @@ mod tls_config {
         }
     }
 
+    #[cfg(feature = "rustls-023")]
+    impl From<rustls::pki_types::InvalidDnsNameError> for TlsError {
+        fn from(error: rustls::pki_types::InvalidDnsNameError) -> Self {
+            TlsError::InvalidName(error)
+        }
+    }
+
+    #[cfg(feature = "rustls-023")]
+    impl From<rustls::pki_types::pem::Error> for TlsError {
+        fn from(error: rustls::pki_types::pem::Error) -> Self {
+            TlsError::PemParse(error)
+        }
+    }
+
+    #[cfg(feature = "rustls-023")]
+    impl From<rustls::Error> for TlsError {
+        fn from(error: rustls::Error) -> Self {
+            TlsError::Rustls023(error)
+        }
+    }
+
     impl TlsConfig {
         // Used in case when the user provided their own TlsContext to be used in all connections.
         pub(crate) fn new_with_global_context(context: TlsContext) -> Self {
@@ -410,8 +445,19 @@ mod tls_config {
                 #[cfg(feature = "rustls-023")]
                 TlsContext::Rustls023(config) => {
                     let connector = tokio_rustls::TlsConnector::from(config.clone());
-
-                    Tls::Rustls023 { connector }
+                    #[cfg(feature = "cloud")]
+                    let sni = self
+                        .sni
+                        .as_deref()
+                        .map(rustls::pki_types::ServerName::try_from)
+                        .transpose()?
+                        .map(|s| s.to_owned());
+
+                    Tls::Rustls023 {
+                        connector,
+                        #[cfg(feature = "cloud")]
+                        sni,
+                    }
                 }
             };
 
@@ -1593,8 +1639,16 @@ impl Connection {
                     handle
                 }
                 #[cfg(feature = "rustls-023")]
-                Tls::Rustls023 { connector } => {
+                Tls::Rustls023 {
+                    connector,
+                    #[cfg(feature = "cloud")]
+                    sni,
+                } => {
                     use rustls::pki_types::ServerName;
+                    #[cfg(feature = "cloud")]
+                    let server_name =
+                        sni.unwrap_or_else(|| ServerName::IpAddress(node_address.into()));
+                    #[cfg(not(feature = "cloud"))]
                     let server_name = ServerName::IpAddress(node_address.into());
                     let stream = connector.connect(server_name, stream).await?;
                     let (task, handle) = Self::router(

From 3214319b54c4574dae354da915c4eaf63f228832 Mon Sep 17 00:00:00 2001
From: Andres Medina <andresnrx@gmail.com>
Date: Sun, 19 Jan 2025 02:37:02 -0800
Subject: [PATCH 24/29] document rustls where relevant
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Wojciech Przytuła <wojciech.przytula@scylladb.com>
---
 README.md                     |  2 +-
 docs/source/connecting/tls.md | 24 ++++++++++++++++--------
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index e9f701fa66..b466d0fec1 100644
--- a/README.md
+++ b/README.md
@@ -51,7 +51,7 @@ The driver supports the following:
 * Batch statements
 * Configurable load balancing policies
 * Driver-side metrics
-* TLS support - install openssl if you want to use it https://docs.rs/openssl/0.10.32/openssl/#automatic
+* TLS support. Supports either [OpenSSL](https://docs.rs/openssl/0.10.32/openssl/#automatic) or rustls
 * Configurable retry policies
 * Authentication support
 * CQL tracing
diff --git a/docs/source/connecting/tls.md b/docs/source/connecting/tls.md
index bcd279f1ee..8653dc3c30 100644
--- a/docs/source/connecting/tls.md
+++ b/docs/source/connecting/tls.md
@@ -1,14 +1,18 @@
 # TLS
 
-Driver uses the [`openssl`](https://github.com/sfackler/rust-openssl) crate for TLS functionality.\
-It was chosen because [`rustls`](https://github.com/ctz/rustls) doesn't support certificates for ip addresses
-(see [issue](https://github.com/briansmith/webpki/issues/54)), which is a common use case for Scylla.
+Driver uses either the
+[`openssl`](https://github.com/sfackler/rust-openssl) crate or the
+[`rustls`](https://github.com/rustls/rustls) crate for TLS functionality.
+
+Both of this features are behind their respective feature flag.
 
 
 ### Enabling feature
-`openssl` is not a pure Rust library so you need enable a feature and install the proper package.
 
-To enable the `tls` feature add in `Cargo.toml`:
+**_NOTE:_** `openssl` is not a pure Rust library, so you need to **both** enable a feature **and** install the proper package.
+
+To enable use of TLS using `openssl`, add in `Cargo.toml`:
+
 ```toml
 scylla = { version = "0.4", features = ["openssl-010"] }
 openssl = "0.10.32"
@@ -38,9 +42,13 @@ Then install the package with `openssl`:
     ```
 
 ### Using TLS
-To use tls you will have to create an openssl
+To use TLS you will have to a `TlsContext`. For convenience, both an
+openssl
 [`SslContext`](https://docs.rs/openssl/0.10.33/openssl/ssl/struct.SslContext.html)
-and pass it to `SessionBuilder`
+and a rustls
+[`ClientConfig`](https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html)
+can be automatically converted to a `TlsContext` when passing to
+`SessionBuilder`.
 
 For example, if database certificate is in the file `ca.crt`:
 ```rust
@@ -67,4 +75,4 @@ let session: Session = SessionBuilder::new()
 # }
 ```
 
-See the full [example](https://github.com/scylladb/scylla-rust-driver/blob/main/examples/tls.rs) for more details
+See the full [openssl example](https://github.com/scylladb/scylla-rust-driver/blob/main/examples/tls.rs) and [rustls example](https://github.com/scylladb/scylla-rust-driver/blob/main/examples/tls-rustls.rs) for more details.

From 2eb47883b002636ba1b1fba51ed76af50cd2f795 Mon Sep 17 00:00:00 2001
From: Andres Medina <andresnrx@gmail.com>
Date: Sun, 19 Jan 2025 02:51:44 -0800
Subject: [PATCH 25/29] add rustls example
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Wojciech Przytuła <wojciech.przytula@scylladb.com>
---
 Cargo.lock.msrv        |  1 +
 examples/Cargo.toml    |  5 +++
 examples/tls-rustls.rs | 98 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 104 insertions(+)
 create mode 100644 examples/tls-rustls.rs

diff --git a/Cargo.lock.msrv b/Cargo.lock.msrv
index f7744f4388..2b950933e0 100644
--- a/Cargo.lock.msrv
+++ b/Cargo.lock.msrv
@@ -589,6 +589,7 @@ dependencies = [
  "futures",
  "openssl",
  "rand",
+ "rustls",
  "rustyline",
  "rustyline-derive",
  "scylla",
diff --git a/examples/Cargo.toml b/examples/Cargo.toml
index bfea398d63..8970424370 100644
--- a/examples/Cargo.toml
+++ b/examples/Cargo.toml
@@ -12,6 +12,7 @@ rustyline = "9"
 rustyline-derive = "0.6"
 scylla = { path = "../scylla", features = [
     "openssl-010",
+    "rustls-023",
     "cloud",
     "chrono-04",
     "time-03",
@@ -30,6 +31,7 @@ stats_alloc = "0.1"
 clap = { version = "3.2.4", features = ["derive"] }
 rand = "0.8.5"
 env_logger = "0.10"
+rustls = "0.23"
 
 [[example]]
 name = "auth"
@@ -123,6 +125,9 @@ path = "query_history.rs"
 name = "cloud"
 path = "cloud.rs"
 
+[[example]]
+name = "tls-rustls"
+path = "tls-rustls.rs"
 
 [[example]]
 name = "execution_profile"
diff --git a/examples/tls-rustls.rs b/examples/tls-rustls.rs
new file mode 100644
index 0000000000..18e6270f29
--- /dev/null
+++ b/examples/tls-rustls.rs
@@ -0,0 +1,98 @@
+use std::{env, sync::Arc};
+
+use anyhow::Result;
+use futures::TryStreamExt as _;
+
+use rustls::pki_types::{pem::PemObject, CertificateDer};
+use scylla::client::{session::Session, session_builder::SessionBuilder};
+
+// How to run scylla instance with TLS:
+//
+// Edit your scylla.yaml file and add paths to certificates
+// ex:
+// client_encryption_options:
+//     enabled: true
+//     certificate: /etc/scylla/db.crt
+//     keyfile: /etc/scylla/db.key
+//
+// If using docker mount your scylla.yaml file and your cert files with option
+// --volume $(pwd)/tls.yaml:/etc/scylla/scylla.yaml
+//
+// If python returns permission error 13 use "Z" flag
+// --volume $(pwd)/tls.yaml:/etc/scylla/scylla.yaml:Z
+//
+// In your Rust program connect to port 9142 if it wasn't changed.
+// Create new rustls ConfigBuilder.
+// Optionally, configure RootCertStore with your ca.crt.
+// Build it and add to scylla-rust-driver's SessionBuilder.
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    // Create connection
+    let uri = env::var("SCYLLA_URI").unwrap_or_else(|_| "127.0.0.1:9142".to_string());
+
+    println!("Connecting to {} ...", uri);
+
+    let rustls_ca = CertificateDer::from_pem_file("./test/tls/ca.crt")?;
+    let mut root_store = rustls::RootCertStore::empty();
+    root_store.add(rustls_ca)?;
+
+    let session: Session = SessionBuilder::new()
+        .known_node(uri)
+        .tls_context(Some(Arc::new(
+            rustls::ClientConfig::builder()
+                .with_root_certificates(root_store)
+                .with_no_client_auth(),
+        )))
+        .build()
+        .await?;
+
+    session.query_unpaged("CREATE KEYSPACE IF NOT EXISTS examples_ks WITH REPLICATION = {'class' : 'NetworkTopologyStrategy', 'replication_factor' : 1}", &[]).await?;
+
+    session
+        .query_unpaged(
+            "CREATE TABLE IF NOT EXISTS examples_ks.tls (a int, b int, c text, primary key (a, b))",
+            &[],
+        )
+        .await?;
+
+    session
+        .query_unpaged(
+            "INSERT INTO examples_ks.tls (a, b, c) VALUES (?, ?, ?)",
+            (3, 4, "def"),
+        )
+        .await?;
+
+    session
+        .query_unpaged(
+            "INSERT INTO examples_ks.tls (a, b, c) VALUES (1, 2, 'abc')",
+            &[],
+        )
+        .await?;
+
+    let prepared = session
+        .prepare("INSERT INTO examples_ks.tls (a, b, c) VALUES (?, 7, ?)")
+        .await?;
+    session
+        .execute_unpaged(&prepared, (42_i32, "I'm prepared!"))
+        .await?;
+    session
+        .execute_unpaged(&prepared, (43_i32, "I'm prepared 2!"))
+        .await?;
+    session
+        .execute_unpaged(&prepared, (44_i32, "I'm prepared 3!"))
+        .await?;
+
+    // Rows can be parsed as tuples
+    let mut iter = session
+        .query_iter("SELECT a, b, c FROM examples_ks.tls", &[])
+        .await?
+        .rows_stream::<(i32, i32, String)>()?;
+    while let Some((a, b, c)) = iter.try_next().await? {
+        println!("a, b, c: {}, {}, {}", a, b, c);
+    }
+
+    println!("Ok.");
+
+    Ok(())
+}

From e7e62e715e71f9e9782776b358d089992dbf4914 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Mon, 3 Feb 2025 11:14:36 +0100
Subject: [PATCH 26/29] examples: rename tls.rs -> tls-openssl.rs

This is analogous to tls-rustls.rs example.
---
 docs/source/connecting/tls.md       | 2 +-
 examples/Cargo.toml                 | 8 ++++----
 examples/{tls.rs => tls-openssl.rs} | 0
 3 files changed, 5 insertions(+), 5 deletions(-)
 rename examples/{tls.rs => tls-openssl.rs} (100%)

diff --git a/docs/source/connecting/tls.md b/docs/source/connecting/tls.md
index 8653dc3c30..00fffe0cba 100644
--- a/docs/source/connecting/tls.md
+++ b/docs/source/connecting/tls.md
@@ -75,4 +75,4 @@ let session: Session = SessionBuilder::new()
 # }
 ```
 
-See the full [openssl example](https://github.com/scylladb/scylla-rust-driver/blob/main/examples/tls.rs) and [rustls example](https://github.com/scylladb/scylla-rust-driver/blob/main/examples/tls-rustls.rs) for more details.
+See the full [openssl example](https://github.com/scylladb/scylla-rust-driver/blob/main/examples/tls-openssl.rs) and [rustls example](https://github.com/scylladb/scylla-rust-driver/blob/main/examples/tls-rustls.rs) for more details.
diff --git a/examples/Cargo.toml b/examples/Cargo.toml
index 8970424370..3535ae32f9 100644
--- a/examples/Cargo.toml
+++ b/examples/Cargo.toml
@@ -49,10 +49,6 @@ path = "logging.rs"
 name = "logging_log"
 path = "logging_log.rs"
 
-[[example]]
-name = "tls"
-path = "tls.rs"
-
 [[example]]
 name = "cqlsh-rs"
 path = "cqlsh-rs.rs"
@@ -125,6 +121,10 @@ path = "query_history.rs"
 name = "cloud"
 path = "cloud.rs"
 
+[[example]]
+name = "tls-openssl"
+path = "tls-openssl.rs"
+
 [[example]]
 name = "tls-rustls"
 path = "tls-rustls.rs"
diff --git a/examples/tls.rs b/examples/tls-openssl.rs
similarity index 100%
rename from examples/tls.rs
rename to examples/tls-openssl.rs

From c3a42a643f2c2b857c6ea4827ff72bdc347afc0f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sun, 2 Feb 2025 13:15:14 +0100
Subject: [PATCH 27/29] connection[_pool]: propagate UntranslatedEndpoint
 borrowing

As address translation no longer needs owned Strings, it's enough to
pass references to UntranslatedEndpoint to `open_connection` & friends.

Note that, unfortunately, we can't fully elide the clone in
`start_opening_connection()`, because the endpoint may be mutated (in
the shard-aware case) for the purpose of opening a connection to the
shard-aware port. Nonetheless, now the limitation that requires us to
clone is in internal code, not in the user-facing API, which is better
for us.
---
 scylla/src/network/connection.rs      | 30 +++++++++++++++------------
 scylla/src/network/connection_pool.rs | 25 +++++++++-------------
 2 files changed, 27 insertions(+), 28 deletions(-)

diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index 7482687a96..a912d0ce11 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -2074,16 +2074,16 @@ impl Connection {
 }
 
 async fn maybe_translated_addr(
-    endpoint: UntranslatedEndpoint,
+    endpoint: &UntranslatedEndpoint,
     address_translator: Option<&dyn AddressTranslator>,
 ) -> Result<SocketAddr, TranslationError> {
-    match endpoint {
-        UntranslatedEndpoint::ContactPoint(addr) => Ok(addr.address),
+    match *endpoint {
+        UntranslatedEndpoint::ContactPoint(ref addr) => Ok(addr.address),
         UntranslatedEndpoint::Peer(PeerEndpoint {
             host_id,
             address,
-            datacenter,
-            rack,
+            ref datacenter,
+            ref rack,
         }) => match address {
             NodeAddr::Translatable(addr) => {
                 // In this case, addr is subject to AddressTranslator.
@@ -2118,7 +2118,7 @@ async fn maybe_translated_addr(
 ///
 /// At the beginning, translates node's address, if it is subject to address translation.
 pub(super) async fn open_connection(
-    endpoint: UntranslatedEndpoint,
+    endpoint: &UntranslatedEndpoint,
     source_port: Option<u16>,
     config: &HostConnectionConfig,
 ) -> Result<(Connection, ErrorReceiver), ConnectionError> {
@@ -2236,7 +2236,7 @@ pub(super) async fn open_connection(
 }
 
 pub(super) async fn open_connection_to_shard_aware_port(
-    endpoint: UntranslatedEndpoint,
+    endpoint: &UntranslatedEndpoint,
     shard: Shard,
     sharder: Sharder,
     config: &HostConnectionConfig,
@@ -2245,7 +2245,7 @@ pub(super) async fn open_connection_to_shard_aware_port(
     let source_port_iter = sharder.iter_source_ports_for_shard(shard);
 
     for port in source_port_iter {
-        let connect_result = open_connection(endpoint.clone(), Some(port), config).await;
+        let connect_result = open_connection(endpoint, Some(port), config).await;
 
         match connect_result {
             Err(err) if err.is_address_unavailable_for_use() => continue, // If we can't use this port, try the next one
@@ -2554,7 +2554,7 @@ mod tests {
         let addr: SocketAddr = resolve_hostname(&uri).await;
 
         let (connection, _) = super::open_connection(
-            UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
+            &UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
                 address: addr,
                 datacenter: None,
             }),
@@ -2679,7 +2679,7 @@ mod tests {
 
         let subtest = |enable_coalescing: bool, ks: String| async move {
             let (connection, _) = super::open_connection(
-                UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
+                &UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
                     address: addr,
                     datacenter: None,
                 }),
@@ -2811,8 +2811,12 @@ mod tests {
             .unwrap();
 
         // We must interrupt the driver's full connection opening, because our proxy does not interact further after Startup.
+        let endpoint = UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
+            address: proxy_addr,
+            datacenter: None,
+        });
         let (startup_without_lwt_optimisation, _shard) = select! {
-            _ = open_connection(UntranslatedEndpoint::ContactPoint(ResolvedContactPoint{address: proxy_addr, datacenter: None}), None, &config) => unreachable!(),
+            _ = open_connection(&endpoint, None, &config) => unreachable!(),
             startup = startup_rx.recv() => startup.unwrap(),
         };
 
@@ -2820,7 +2824,7 @@ mod tests {
             .change_request_rules(Some(make_rules(options_with_lwt_optimisation_support)));
 
         let (startup_with_lwt_optimisation, _shard) = select! {
-            _ = open_connection(UntranslatedEndpoint::ContactPoint(ResolvedContactPoint{address: proxy_addr, datacenter: None}), None, &config) => unreachable!(),
+            _ = open_connection(&endpoint, None, &config) => unreachable!(),
             startup = startup_rx.recv() => startup.unwrap(),
         };
 
@@ -2879,7 +2883,7 @@ mod tests {
 
         // Setup connection normally, without obstruction
         let (conn, mut error_receiver) = open_connection(
-            UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
+            &UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
                 address: proxy_addr,
                 datacenter: None,
             }),
diff --git a/scylla/src/network/connection_pool.rs b/scylla/src/network/connection_pool.rs
index a6bea1c760..90e5e7410b 100644
--- a/scylla/src/network/connection_pool.rs
+++ b/scylla/src/network/connection_pool.rs
@@ -862,7 +862,7 @@ impl PoolRefiller {
                     endpoint
                 };
                 let result = open_connection_to_shard_aware_port(
-                    shard_aware_endpoint,
+                    &shard_aware_endpoint,
                     shard,
                     sharder.clone(),
                     &cfg,
@@ -877,7 +877,7 @@ impl PoolRefiller {
             .boxed(),
             _ => async move {
                 let non_shard_aware_endpoint = endpoint;
-                let result = open_connection(non_shard_aware_endpoint, None, &cfg).await;
+                let result = open_connection(&non_shard_aware_endpoint, None, &cfg).await;
                 OpenedConnectionEvent {
                     result,
                     requested_shard: None,
@@ -1162,20 +1162,15 @@ mod tests {
         // to the right shard
         let sharder = Sharder::new(ShardCount::new(3).unwrap(), 12);
 
+        let endpoint = UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
+            address: connect_address,
+            datacenter: None,
+        });
+
         // Open the connections
-        let mut conns = Vec::new();
-
-        for _ in 0..connections_number {
-            conns.push(open_connection_to_shard_aware_port(
-                UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
-                    address: connect_address,
-                    datacenter: None,
-                }),
-                0,
-                sharder.clone(),
-                &connection_config,
-            ));
-        }
+        let conns = (0..connections_number).map(|_| {
+            open_connection_to_shard_aware_port(&endpoint, 0, sharder.clone(), &connection_config)
+        });
 
         let joined = futures::future::join_all(conns).await;
 

From 37d91f5f01a31b8eec3db588a52fb027f9c668e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sun, 2 Feb 2025 13:28:25 +0100
Subject: [PATCH 28/29] rename feature: cloud -> unstable-cloud

As the Serverless Cloud is a highly unstable feature, it must be marked
as such in order not to break API after 1.0 in case we need to introduce
breaking changes to the feature.
---
 examples/Cargo.toml                  |  2 +-
 scylla/Cargo.toml                    |  2 +-
 scylla/src/client/session.rs         | 18 ++++++-------
 scylla/src/client/session_builder.rs | 16 +++++------
 scylla/src/cloud/mod.rs              |  4 +--
 scylla/src/cluster/node.rs           |  8 +++---
 scylla/src/lib.rs                    |  2 +-
 scylla/src/network/connection.rs     | 40 ++++++++++++++--------------
 scylla/src/network/mod.rs            |  2 +-
 9 files changed, 47 insertions(+), 47 deletions(-)

diff --git a/examples/Cargo.toml b/examples/Cargo.toml
index 3535ae32f9..d97ab30ec3 100644
--- a/examples/Cargo.toml
+++ b/examples/Cargo.toml
@@ -13,7 +13,7 @@ rustyline-derive = "0.6"
 scylla = { path = "../scylla", features = [
     "openssl-010",
     "rustls-023",
-    "cloud",
+    "unstable-cloud",
     "chrono-04",
     "time-03",
     "num-bigint-03",
diff --git a/scylla/Cargo.toml b/scylla/Cargo.toml
index ac7557bfdd..c6038e145d 100644
--- a/scylla/Cargo.toml
+++ b/scylla/Cargo.toml
@@ -18,7 +18,7 @@ rustdoc-args = ["--cfg", "docsrs"]
 default = []
 openssl-010 = ["dep:tokio-openssl", "dep:openssl", "__tls"]
 rustls-023 = ["dep:tokio-rustls", "dep:rustls", "__tls"]
-cloud = [
+unstable-cloud = [
     "__tls",
     "scylla-cql/serde",
     "dep:serde_yaml",
diff --git a/scylla/src/client/session.rs b/scylla/src/client/session.rs
index 618c378918..94a844be43 100644
--- a/scylla/src/client/session.rs
+++ b/scylla/src/client/session.rs
@@ -8,9 +8,9 @@ use super::{Compression, PoolSize, SelfIdentity};
 use crate::authentication::AuthenticatorProvider;
 use crate::batch::batch_values;
 use crate::batch::{Batch, BatchStatement};
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 use crate::cloud::CloudConfig;
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 use crate::cluster::node::CloudEndpoint;
 use crate::cluster::node::{InternalKnownNode, KnownNode, NodeRef};
 use crate::cluster::{Cluster, ClusterNeatDebug, ClusterState};
@@ -56,7 +56,7 @@ use std::num::NonZeroU32;
 use std::sync::Arc;
 use std::time::Duration;
 use tokio::time::timeout;
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 use tracing::warn;
 use tracing::{debug, error, trace, trace_span, Instrument};
 use uuid::Uuid;
@@ -252,7 +252,7 @@ pub struct SessionConfig {
     pub host_filter: Option<Arc<dyn HostFilter>>,
 
     /// If the driver is to connect to ScyllaCloud, there is a config for it.
-    #[cfg(feature = "cloud")]
+    #[cfg(feature = "unstable-cloud")]
     pub cloud_config: Option<Arc<CloudConfig>>,
 
     /// If true, the driver will inject a small delay before flushing data
@@ -332,7 +332,7 @@ impl SessionConfig {
             address_translator: None,
             host_filter: None,
             refresh_metadata_on_auto_schema_agreement: true,
-            #[cfg(feature = "cloud")]
+            #[cfg(feature = "unstable-cloud")]
             cloud_config: None,
             enable_write_coalescing: true,
             tracing_info_fetch_attempts: NonZeroU32::new(10).unwrap(),
@@ -977,7 +977,7 @@ where
     pub async fn connect(config: SessionConfig) -> Result<Self, NewSessionError> {
         let known_nodes = config.known_nodes;
 
-        #[cfg(feature = "cloud")]
+        #[cfg(feature = "unstable-cloud")]
         let cloud_known_nodes: Option<Vec<InternalKnownNode>> =
             if let Some(ref cloud_config) = config.cloud_config {
                 let cloud_servers = cloud_config
@@ -995,7 +995,7 @@ where
                 None
             };
 
-        #[cfg(not(feature = "cloud"))]
+        #[cfg(not(feature = "unstable-cloud"))]
         let cloud_known_nodes: Option<Vec<InternalKnownNode>> = None;
 
         let known_nodes = cloud_known_nodes
@@ -1010,7 +1010,7 @@ where
 
         #[allow(unused_labels)] // Triggers when `cloud` feature is disabled.
         let address_translator = 'translator: {
-            #[cfg(feature = "cloud")]
+            #[cfg(feature = "unstable-cloud")]
             if let Some(translator) = config.cloud_config.clone() {
                 if config.address_translator.is_some() {
                     // This can only happen if the user builds SessionConfig by hand, as SessionBuilder in cloud mode prevents setting custom AddressTranslator.
@@ -1029,7 +1029,7 @@ where
 
         #[cfg(feature = "__tls")]
         let tls_provider = 'provider: {
-            #[cfg(feature = "cloud")]
+            #[cfg(feature = "unstable-cloud")]
             if let Some(cloud_config) = config.cloud_config {
                 if config.tls_context.is_some() {
                     // This can only happen if the user builds SessionConfig by hand, as SessionBuilder in cloud mode prevents setting custom TlsContext.
diff --git a/scylla/src/client/session_builder.rs b/scylla/src/client/session_builder.rs
index 89519bfc14..acaa921d02 100644
--- a/scylla/src/client/session_builder.rs
+++ b/scylla/src/client/session_builder.rs
@@ -1,6 +1,6 @@
 //! SessionBuilder provides an easy way to create new Sessions
 
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 use super::execution_profile::ExecutionProfile;
 use super::execution_profile::ExecutionProfileHandle;
 #[allow(deprecated)]
@@ -11,7 +11,7 @@ use super::{Compression, PoolSize, SelfIdentity};
 use crate::authentication::{AuthenticatorProvider, PlainTextAuthenticator};
 #[cfg(feature = "__tls")]
 use crate::client::session::TlsContext;
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 use crate::cloud::{CloudConfig, CloudConfigError};
 use crate::errors::NewSessionError;
 use crate::policies::address_translator::AddressTranslator;
@@ -22,7 +22,7 @@ use std::borrow::Borrow;
 use std::marker::PhantomData;
 use std::net::SocketAddr;
 use std::num::NonZeroU32;
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 use std::path::Path;
 use std::sync::Arc;
 use std::time::Duration;
@@ -44,15 +44,15 @@ impl SessionBuilderKind for DefaultMode {}
 
 pub type SessionBuilder = GenericSessionBuilder<DefaultMode>;
 
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 #[derive(Clone)]
 pub enum CloudMode {}
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 impl sealed::Sealed for CloudMode {}
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 impl SessionBuilderKind for CloudMode {}
 
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 pub type CloudSessionBuilder = GenericSessionBuilder<CloudMode>;
 
 /// SessionBuilder is used to create new Session instances
@@ -365,7 +365,7 @@ impl GenericSessionBuilder<DefaultMode> {
 // NOTE: this `impl` block contains configuration options specific for **Cloud** [`Session`].
 // This means that if an option fits both non-Cloud and Cloud `Session`s, it should NOT be put
 // here, but rather in `impl<K> GenericSessionBuilder<K>` block.
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 impl CloudSessionBuilder {
     /// Creates a new SessionBuilder with default configuration,
     /// based on provided path to Scylla Cloud Config yaml.
diff --git a/scylla/src/cloud/mod.rs b/scylla/src/cloud/mod.rs
index 3beb8ac776..ebce81f520 100644
--- a/scylla/src/cloud/mod.rs
+++ b/scylla/src/cloud/mod.rs
@@ -4,9 +4,9 @@ pub use config::CloudConfig;
 pub use config::CloudConfigError;
 
 #[cfg(all(
-    feature = "cloud",
+    feature = "unstable-cloud",
     not(any(feature = "rustls-023", feature = "openssl-010"))
 ))]
 compile_error!(
-    r#""cloud" feature requires a TLS backend: at least one of ["rustls-023", "openssl-010"] is needed"#
+    r#""unstable-cloud" feature requires a TLS backend: at least one of ["rustls-023", "openssl-010"] is needed"#
 );
diff --git a/scylla/src/cluster/node.rs b/scylla/src/cluster/node.rs
index 2b332fe882..8ed38a1e8f 100644
--- a/scylla/src/cluster/node.rs
+++ b/scylla/src/cluster/node.rs
@@ -238,7 +238,7 @@ pub enum KnownNode {
 pub(crate) enum InternalKnownNode {
     Hostname(String),
     Address(SocketAddr),
-    #[cfg(feature = "cloud")]
+    #[cfg(feature = "unstable-cloud")]
     CloudEndpoint(CloudEndpoint),
 }
 
@@ -252,7 +252,7 @@ impl From<KnownNode> for InternalKnownNode {
 }
 
 /// Describes a database server in the serverless Scylla Cloud.
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 #[derive(Clone, PartialEq, Eq, PartialOrd, Ord, Debug)]
 pub(crate) struct CloudEndpoint {
     pub(crate) hostname: String,
@@ -263,7 +263,7 @@ pub(crate) struct CloudEndpoint {
 #[derive(Debug, Clone)]
 pub(crate) struct ResolvedContactPoint {
     pub(crate) address: SocketAddr,
-    #[cfg_attr(not(feature = "cloud"), allow(unused))]
+    #[cfg_attr(not(feature = "unstable-cloud"), allow(unused))]
     pub(crate) datacenter: Option<String>,
 }
 
@@ -313,7 +313,7 @@ pub(crate) async fn resolve_contact_points(
                 address: *address,
                 datacenter: None,
             }),
-            #[cfg(feature = "cloud")]
+            #[cfg(feature = "unstable-cloud")]
             InternalKnownNode::CloudEndpoint(CloudEndpoint {
                 hostname,
                 datacenter,
diff --git a/scylla/src/lib.rs b/scylla/src/lib.rs
index 44d6d5d5c0..bd11c6cdcf 100644
--- a/scylla/src/lib.rs
+++ b/scylla/src/lib.rs
@@ -255,7 +255,7 @@ pub mod deserialize {
 
 pub mod authentication;
 pub mod client;
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 pub mod cloud;
 
 pub mod cluster;
diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index a912d0ce11..faec43e8e1 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -236,28 +236,28 @@ mod tls_config {
     );
 
     use std::io;
-    #[cfg(feature = "cloud")]
+    #[cfg(feature = "unstable-cloud")]
     use std::sync::Arc;
 
-    #[cfg(feature = "cloud")]
+    #[cfg(feature = "unstable-cloud")]
     use tracing::warn;
-    #[cfg(feature = "cloud")]
+    #[cfg(feature = "unstable-cloud")]
     use uuid::Uuid;
 
     use crate::client::session::TlsContext;
-    #[cfg(feature = "cloud")]
+    #[cfg(feature = "unstable-cloud")]
     use crate::cloud::CloudConfig;
-    #[cfg(feature = "cloud")]
+    #[cfg(feature = "unstable-cloud")]
     use crate::cluster::metadata::PeerEndpoint;
     use crate::cluster::metadata::UntranslatedEndpoint;
-    #[cfg(feature = "cloud")]
+    #[cfg(feature = "unstable-cloud")]
     use crate::cluster::node::ResolvedContactPoint;
 
     /// Abstraction capable of producing TlsConfig for connections on-demand.
     #[derive(Clone)] // Cheaply clonable (reference-counted)
     pub(crate) enum TlsProvider {
         GlobalContext(TlsContext),
-        #[cfg(feature = "cloud")]
+        #[cfg(feature = "unstable-cloud")]
         ScyllaCloud(Arc<CloudConfig>),
     }
 
@@ -268,7 +268,7 @@ mod tls_config {
         }
 
         // Used in the cloud case.
-        #[cfg(feature = "cloud")]
+        #[cfg(feature = "unstable-cloud")]
         pub(crate) fn new_cloud(cloud_config: Arc<CloudConfig>) -> Self {
             Self::ScyllaCloud(cloud_config)
         }
@@ -281,7 +281,7 @@ mod tls_config {
                 TlsProvider::GlobalContext(context) => {
                     Some(TlsConfig::new_with_global_context(context.clone()))
                 }
-                #[cfg(feature = "cloud")]
+                #[cfg(feature = "unstable-cloud")]
                 TlsProvider::ScyllaCloud(cloud_config) => {
                     let (host_id, address, dc) = match *endpoint {
                         UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
@@ -326,7 +326,7 @@ mod tls_config {
     #[derive(Clone)]
     pub(crate) struct TlsConfig {
         context: TlsContext,
-        #[cfg(feature = "cloud")]
+        #[cfg(feature = "unstable-cloud")]
         sni: Option<String>,
     }
 
@@ -336,7 +336,7 @@ mod tls_config {
         #[cfg(feature = "rustls-023")]
         Rustls023 {
             connector: tokio_rustls::TlsConnector,
-            #[cfg(feature = "cloud")]
+            #[cfg(feature = "unstable-cloud")]
             sni: Option<rustls::pki_types::ServerName<'static>>,
         },
     }
@@ -406,13 +406,13 @@ mod tls_config {
         pub(crate) fn new_with_global_context(context: TlsContext) -> Self {
             Self {
                 context,
-                #[cfg(feature = "cloud")]
+                #[cfg(feature = "unstable-cloud")]
                 sni: None,
             }
         }
 
         // Used in case of Serverless Cloud connections.
-        #[cfg(feature = "cloud")]
+        #[cfg(feature = "unstable-cloud")]
         pub(crate) fn new_for_sni(
             context: TlsContext,
             domain_name: &str,
@@ -420,7 +420,7 @@ mod tls_config {
         ) -> Self {
             Self {
                 context,
-                #[cfg(feature = "cloud")]
+                #[cfg(feature = "unstable-cloud")]
                 sni: Some(if let Some(host_id) = host_id {
                     format!("{}.{}", host_id, domain_name)
                 } else {
@@ -436,7 +436,7 @@ mod tls_config {
                 TlsContext::OpenSsl010(context) => {
                     #[allow(unused_mut)]
                     let mut ssl = openssl::ssl::Ssl::new(context)?;
-                    #[cfg(feature = "cloud")]
+                    #[cfg(feature = "unstable-cloud")]
                     if let Some(sni) = self.sni.as_ref() {
                         ssl.set_hostname(sni)?;
                     }
@@ -445,7 +445,7 @@ mod tls_config {
                 #[cfg(feature = "rustls-023")]
                 TlsContext::Rustls023(config) => {
                     let connector = tokio_rustls::TlsConnector::from(config.clone());
-                    #[cfg(feature = "cloud")]
+                    #[cfg(feature = "unstable-cloud")]
                     let sni = self
                         .sni
                         .as_deref()
@@ -455,7 +455,7 @@ mod tls_config {
 
                     Tls::Rustls023 {
                         connector,
-                        #[cfg(feature = "cloud")]
+                        #[cfg(feature = "unstable-cloud")]
                         sni,
                     }
                 }
@@ -1641,14 +1641,14 @@ impl Connection {
                 #[cfg(feature = "rustls-023")]
                 Tls::Rustls023 {
                     connector,
-                    #[cfg(feature = "cloud")]
+                    #[cfg(feature = "unstable-cloud")]
                     sni,
                 } => {
                     use rustls::pki_types::ServerName;
-                    #[cfg(feature = "cloud")]
+                    #[cfg(feature = "unstable-cloud")]
                     let server_name =
                         sni.unwrap_or_else(|| ServerName::IpAddress(node_address.into()));
-                    #[cfg(not(feature = "cloud"))]
+                    #[cfg(not(feature = "unstable-cloud"))]
                     let server_name = ServerName::IpAddress(node_address.into());
                     let stream = connector.connect(server_name, stream).await?;
                     let (task, handle) = Self::router(
diff --git a/scylla/src/network/mod.rs b/scylla/src/network/mod.rs
index 7763d37a42..5e90255f20 100644
--- a/scylla/src/network/mod.rs
+++ b/scylla/src/network/mod.rs
@@ -5,7 +5,7 @@
 //! - NodeConnectionPool - a manager that keeps a desired number of connections opened to each shard.
 
 mod connection;
-#[cfg(feature = "cloud")]
+#[cfg(feature = "unstable-cloud")]
 pub(crate) use connection::TlsConfig;
 #[cfg(feature = "__tls")]
 pub use connection::TlsError;

From a59b80d3d2fa10d641cd32f4c53e3edb8a060395 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Przytu=C5=82a?= <wojciech.przytula@scylladb.com>
Date: Sun, 2 Feb 2025 21:52:41 +0100
Subject: [PATCH 29/29] network: extract tls module from connection

As the tls module got quite large, it makes sense to extract it to the
network supermodule.
---
 scylla/src/client/session.rs     |   2 +-
 scylla/src/cloud/config.rs       |   2 +-
 scylla/src/errors.rs             |   2 +-
 scylla/src/network/connection.rs | 264 +------------------------------
 scylla/src/network/mod.rs        |  16 +-
 scylla/src/network/tls.rs        | 254 +++++++++++++++++++++++++++++
 6 files changed, 269 insertions(+), 271 deletions(-)
 create mode 100644 scylla/src/network/tls.rs

diff --git a/scylla/src/client/session.rs b/scylla/src/client/session.rs
index 94a844be43..17b88f0abe 100644
--- a/scylla/src/client/session.rs
+++ b/scylla/src/client/session.rs
@@ -20,7 +20,7 @@ use crate::errors::{
 };
 use crate::frame::response::result;
 #[cfg(feature = "__tls")]
-use crate::network::TlsProvider;
+use crate::network::tls::TlsProvider;
 use crate::network::{Connection, ConnectionConfig, PoolConfig, VerifiedKeyspaceName};
 use crate::observability::driver_tracing::RequestSpan;
 use crate::observability::history::{self, HistoryListener};
diff --git a/scylla/src/cloud/config.rs b/scylla/src/cloud/config.rs
index 48c2df7a22..6d03dc20bf 100644
--- a/scylla/src/cloud/config.rs
+++ b/scylla/src/cloud/config.rs
@@ -12,7 +12,7 @@ use crate::client::session::TlsContext;
 use crate::cluster::metadata::UntranslatedPeer;
 use crate::cluster::node::resolve_hostname;
 use crate::errors::TranslationError;
-use crate::network::{TlsConfig, TlsError};
+use crate::network::tls::{TlsConfig, TlsError};
 use crate::policies::address_translator::AddressTranslator;
 
 #[non_exhaustive]
diff --git a/scylla/src/errors.rs b/scylla/src/errors.rs
index c6c3790b48..ce3eac175a 100644
--- a/scylla/src/errors.rs
+++ b/scylla/src/errors.rs
@@ -1,7 +1,7 @@
 //! This module contains various errors which can be returned by [`Session`](crate::client::session::Session).
 
 #[cfg(feature = "__tls")]
-pub use crate::network::TlsError;
+pub use crate::network::tls::TlsError;
 
 // Re-export DbError type and types that it depends on
 // so they can be found in `scylla::errors`.
diff --git a/scylla/src/network/connection.rs b/scylla/src/network/connection.rs
index faec43e8e1..617fdf4762 100644
--- a/scylla/src/network/connection.rs
+++ b/scylla/src/network/connection.rs
@@ -1,3 +1,5 @@
+#[cfg(feature = "__tls")]
+use super::tls::{Tls, TlsConfig, TlsProvider};
 use crate::authentication::AuthenticatorProvider;
 use crate::batch::{Batch, BatchStatement};
 use crate::client::pager::{NextRowError, QueryPager};
@@ -56,10 +58,6 @@ use std::{
     cmp::Ordering,
     net::{Ipv4Addr, Ipv6Addr},
 };
-#[cfg(feature = "__tls")]
-pub use tls_config::TlsError;
-#[cfg(feature = "__tls")]
-pub(crate) use tls_config::{Tls, TlsConfig, TlsProvider};
 use tokio::io::{split, AsyncRead, AsyncWrite, AsyncWriteExt, BufReader, BufWriter};
 use tokio::net::{TcpSocket, TcpStream};
 use tokio::sync::{mpsc, oneshot};
@@ -208,264 +206,6 @@ struct TaskResponse {
     body: Bytes,
 }
 
-#[cfg(feature = "__tls")]
-mod tls_config {
-    //! This module contains abstractions related to the TLS layer of driver connections.
-    //!
-    //! The full picture looks like this:
-    //!
-    //! ┌─←─ TlsContext (openssl::SslContext / rustls::ClientConfig)
-    //! │
-    //! ├─←─ CloudConfig (powered by either TLS backend)
-    //! │
-    //! │ gets wrapped in
-    //! │
-    //! ↳TlsProvider (same for all connections)
-    //!   │
-    //!   │ produces
-    //!   │
-    //!   ↳TlsConfig (specific for the particular connection)
-    //!     │
-    //!     │ produces
-    //!     │
-    //!     ↳Tls (wrapper over TCP stream which adds encryption)
-
-    #[cfg(not(any(feature = "openssl-010", feature = "rustls-023")))]
-    compile_error!(
-        r#""__tls" feature requires a TLS backend: at least one of ["openssl-010", "rustls-023"] is needed"#
-    );
-
-    use std::io;
-    #[cfg(feature = "unstable-cloud")]
-    use std::sync::Arc;
-
-    #[cfg(feature = "unstable-cloud")]
-    use tracing::warn;
-    #[cfg(feature = "unstable-cloud")]
-    use uuid::Uuid;
-
-    use crate::client::session::TlsContext;
-    #[cfg(feature = "unstable-cloud")]
-    use crate::cloud::CloudConfig;
-    #[cfg(feature = "unstable-cloud")]
-    use crate::cluster::metadata::PeerEndpoint;
-    use crate::cluster::metadata::UntranslatedEndpoint;
-    #[cfg(feature = "unstable-cloud")]
-    use crate::cluster::node::ResolvedContactPoint;
-
-    /// Abstraction capable of producing TlsConfig for connections on-demand.
-    #[derive(Clone)] // Cheaply clonable (reference-counted)
-    pub(crate) enum TlsProvider {
-        GlobalContext(TlsContext),
-        #[cfg(feature = "unstable-cloud")]
-        ScyllaCloud(Arc<CloudConfig>),
-    }
-
-    impl TlsProvider {
-        // Used in case when the user provided their own TlsContext to be used in all connections.
-        pub(crate) fn new_with_global_context(context: TlsContext) -> Self {
-            Self::GlobalContext(context)
-        }
-
-        // Used in the cloud case.
-        #[cfg(feature = "unstable-cloud")]
-        pub(crate) fn new_cloud(cloud_config: Arc<CloudConfig>) -> Self {
-            Self::ScyllaCloud(cloud_config)
-        }
-
-        pub(crate) fn make_tls_config(
-            &self,
-            #[allow(unused)] endpoint: &UntranslatedEndpoint,
-        ) -> Option<TlsConfig> {
-            match self {
-                TlsProvider::GlobalContext(context) => {
-                    Some(TlsConfig::new_with_global_context(context.clone()))
-                }
-                #[cfg(feature = "unstable-cloud")]
-                TlsProvider::ScyllaCloud(cloud_config) => {
-                    let (host_id, address, dc) = match *endpoint {
-                        UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
-                            address,
-                            ref datacenter,
-                        }) => (None, address, datacenter.as_deref()), // FIXME: Pass DC in ContactPoint
-                        UntranslatedEndpoint::Peer(PeerEndpoint {
-                            host_id,
-                            address,
-                            ref datacenter,
-                            ..
-                        }) => (Some(host_id), address.into_inner(), datacenter.as_deref()),
-                    };
-
-                    cloud_config.make_tls_config_for_scylla_cloud_host(host_id, dc, address)
-                        // inspect_err() is stable since 1.76.
-                        // TODO: use inspect_err once we bump MSRV to at least 1.76.
-                        .map_err(|err| {
-                            warn!(
-                                "TlsProvider for SNI connection to Scylla Cloud node {{ host_id={:?}, dc={:?} at {} }} could not be set up: {}\n Proceeding with attempting probably nonworking connection",
-                                host_id,
-                                dc,
-                                address,
-                                err
-                            );
-                        }).ok().flatten()
-                }
-            }
-        }
-    }
-
-    /// This struct encapsulates all TLS-regarding configuration and helps pass it tidily through the code.
-    //
-    // There are 3 possible options for TlsConfig, whose behaviour is somewhat subtle.
-    // Option 1: No TLS configuration. Then it is None every time.
-    // Option 2: User-provided global TlsContext. Then, a TlsConfig is created upon Session creation
-    // and henceforth stored in the ConnectionConfig.
-    // Option 3: Serverless Cloud. The Option<TlsConfig> remains None in ConnectionConfig until it reaches
-    // NodeConnectionPool::new(). Inside that function, the field is mutated to contain TlsConfig specific
-    // for the particular node. (The TlsConfig must be different, because SNIs differ for different nodes.)
-    // Thenceforth, all connections to that node share the same TlsConfig.
-    #[derive(Clone)]
-    pub(crate) struct TlsConfig {
-        context: TlsContext,
-        #[cfg(feature = "unstable-cloud")]
-        sni: Option<String>,
-    }
-
-    pub(crate) enum Tls {
-        #[cfg(feature = "openssl-010")]
-        OpenSsl010(openssl::ssl::Ssl),
-        #[cfg(feature = "rustls-023")]
-        Rustls023 {
-            connector: tokio_rustls::TlsConnector,
-            #[cfg(feature = "unstable-cloud")]
-            sni: Option<rustls::pki_types::ServerName<'static>>,
-        },
-    }
-
-    /// A wrapper around a TLS error.
-    ///
-    /// The original error came from one of the supported TLS backends.
-    #[derive(Debug, thiserror::Error)]
-    #[error(transparent)]
-    #[non_exhaustive]
-    pub enum TlsError {
-        #[cfg(feature = "openssl-010")]
-        OpenSsl010(openssl::error::ErrorStack),
-        #[cfg(feature = "rustls-023")]
-        InvalidName(rustls::pki_types::InvalidDnsNameError),
-        #[cfg(feature = "rustls-023")]
-        PemParse(rustls::pki_types::pem::Error),
-        #[cfg(feature = "rustls-023")]
-        Rustls023(rustls::Error),
-    }
-
-    impl From<TlsError> for io::Error {
-        fn from(value: TlsError) -> Self {
-            match value {
-                #[cfg(feature = "openssl-010")]
-                TlsError::OpenSsl010(e) => e.into(),
-                #[cfg(feature = "rustls-023")]
-                TlsError::InvalidName(e) => io::Error::new(io::ErrorKind::Other, e),
-                #[cfg(feature = "rustls-023")]
-                TlsError::PemParse(e) => io::Error::new(io::ErrorKind::Other, e),
-                #[cfg(feature = "rustls-023")]
-                TlsError::Rustls023(e) => io::Error::new(io::ErrorKind::Other, e),
-            }
-        }
-    }
-
-    #[cfg(feature = "openssl-010")]
-    impl From<openssl::error::ErrorStack> for TlsError {
-        fn from(error: openssl::error::ErrorStack) -> Self {
-            TlsError::OpenSsl010(error)
-        }
-    }
-
-    #[cfg(feature = "rustls-023")]
-    impl From<rustls::pki_types::InvalidDnsNameError> for TlsError {
-        fn from(error: rustls::pki_types::InvalidDnsNameError) -> Self {
-            TlsError::InvalidName(error)
-        }
-    }
-
-    #[cfg(feature = "rustls-023")]
-    impl From<rustls::pki_types::pem::Error> for TlsError {
-        fn from(error: rustls::pki_types::pem::Error) -> Self {
-            TlsError::PemParse(error)
-        }
-    }
-
-    #[cfg(feature = "rustls-023")]
-    impl From<rustls::Error> for TlsError {
-        fn from(error: rustls::Error) -> Self {
-            TlsError::Rustls023(error)
-        }
-    }
-
-    impl TlsConfig {
-        // Used in case when the user provided their own TlsContext to be used in all connections.
-        pub(crate) fn new_with_global_context(context: TlsContext) -> Self {
-            Self {
-                context,
-                #[cfg(feature = "unstable-cloud")]
-                sni: None,
-            }
-        }
-
-        // Used in case of Serverless Cloud connections.
-        #[cfg(feature = "unstable-cloud")]
-        pub(crate) fn new_for_sni(
-            context: TlsContext,
-            domain_name: &str,
-            host_id: Option<Uuid>,
-        ) -> Self {
-            Self {
-                context,
-                #[cfg(feature = "unstable-cloud")]
-                sni: Some(if let Some(host_id) = host_id {
-                    format!("{}.{}", host_id, domain_name)
-                } else {
-                    domain_name.into()
-                }),
-            }
-        }
-
-        // Produces a new Tls object that is able to wrap a TCP stream.
-        pub(crate) fn new_tls(&self) -> Result<Tls, TlsError> {
-            let tls = match &self.context {
-                #[cfg(feature = "openssl-010")]
-                TlsContext::OpenSsl010(context) => {
-                    #[allow(unused_mut)]
-                    let mut ssl = openssl::ssl::Ssl::new(context)?;
-                    #[cfg(feature = "unstable-cloud")]
-                    if let Some(sni) = self.sni.as_ref() {
-                        ssl.set_hostname(sni)?;
-                    }
-                    Tls::OpenSsl010(ssl)
-                }
-                #[cfg(feature = "rustls-023")]
-                TlsContext::Rustls023(config) => {
-                    let connector = tokio_rustls::TlsConnector::from(config.clone());
-                    #[cfg(feature = "unstable-cloud")]
-                    let sni = self
-                        .sni
-                        .as_deref()
-                        .map(rustls::pki_types::ServerName::try_from)
-                        .transpose()?
-                        .map(|s| s.to_owned());
-
-                    Tls::Rustls023 {
-                        connector,
-                        #[cfg(feature = "unstable-cloud")]
-                        sni,
-                    }
-                }
-            };
-
-            Ok(tls)
-        }
-    }
-}
-
 impl<'id: 'map, 'map> SelfIdentity<'id> {
     fn add_startup_options(&'id self, options: &'map mut HashMap<Cow<'id, str>, Cow<'id, str>>) {
         /* Driver identity. */
diff --git a/scylla/src/network/mod.rs b/scylla/src/network/mod.rs
index 5e90255f20..cc1fbb65bf 100644
--- a/scylla/src/network/mod.rs
+++ b/scylla/src/network/mod.rs
@@ -5,15 +5,19 @@
 //! - NodeConnectionPool - a manager that keeps a desired number of connections opened to each shard.
 
 mod connection;
-#[cfg(feature = "unstable-cloud")]
-pub(crate) use connection::TlsConfig;
-#[cfg(feature = "__tls")]
-pub use connection::TlsError;
-#[cfg(feature = "__tls")]
-pub(crate) use connection::TlsProvider;
 pub(crate) use connection::{Connection, ConnectionConfig, VerifiedKeyspaceName};
 
 mod connection_pool;
 
 pub use connection_pool::PoolSize;
 pub(crate) use connection_pool::{NodeConnectionPool, PoolConfig};
+
+#[cfg(feature = "__tls")]
+pub(crate) mod tls;
+
+// #[cfg(feature = "unstable-cloud")]
+// pub(crate) use tls::TlsConfig;
+// #[cfg(feature = "__tls")]
+// pub use tls::TlsError;
+// #[cfg(feature = "__tls")]
+// pub(crate) use tls::TlsProvider;
diff --git a/scylla/src/network/tls.rs b/scylla/src/network/tls.rs
new file mode 100644
index 0000000000..27ae3138f4
--- /dev/null
+++ b/scylla/src/network/tls.rs
@@ -0,0 +1,254 @@
+//! This module contains abstractions related to the TLS layer of driver connections.
+//!
+//! The full picture looks like this:
+//!
+//! ┌─←─ TlsContext (openssl::SslContext / rustls::ClientConfig)
+//! │
+//! ├─←─ CloudConfig (powered by either TLS backend)
+//! │
+//! │ gets wrapped in
+//! │
+//! ↳TlsProvider (same for all connections)
+//!   │
+//!   │ produces
+//!   │
+//!   ↳TlsConfig (specific for the particular connection)
+//!     │
+//!     │ produces
+//!     │
+//!     ↳Tls (wrapper over TCP stream which adds encryption)
+
+#[cfg(not(any(feature = "openssl-010", feature = "rustls-023")))]
+compile_error!(
+    r#""__tls" feature requires a TLS backend: at least one of ["openssl-010", "rustls-023"] is needed"#
+);
+
+use std::io;
+#[cfg(feature = "unstable-cloud")]
+use std::sync::Arc;
+
+#[cfg(feature = "unstable-cloud")]
+use tracing::warn;
+#[cfg(feature = "unstable-cloud")]
+use uuid::Uuid;
+
+use crate::client::session::TlsContext;
+#[cfg(feature = "unstable-cloud")]
+use crate::cloud::CloudConfig;
+#[cfg(feature = "unstable-cloud")]
+use crate::cluster::metadata::PeerEndpoint;
+use crate::cluster::metadata::UntranslatedEndpoint;
+#[cfg(feature = "unstable-cloud")]
+use crate::cluster::node::ResolvedContactPoint;
+
+/// Abstraction capable of producing TlsConfig for connections on-demand.
+#[derive(Clone)] // Cheaply clonable (reference-counted)
+pub(crate) enum TlsProvider {
+    GlobalContext(TlsContext),
+    #[cfg(feature = "unstable-cloud")]
+    ScyllaCloud(Arc<CloudConfig>),
+}
+
+impl TlsProvider {
+    // Used in case when the user provided their own TlsContext to be used in all connections.
+    pub(crate) fn new_with_global_context(context: TlsContext) -> Self {
+        Self::GlobalContext(context)
+    }
+
+    // Used in the cloud case.
+    #[cfg(feature = "unstable-cloud")]
+    pub(crate) fn new_cloud(cloud_config: Arc<CloudConfig>) -> Self {
+        Self::ScyllaCloud(cloud_config)
+    }
+
+    pub(crate) fn make_tls_config(
+        &self,
+        #[allow(unused)] endpoint: &UntranslatedEndpoint,
+    ) -> Option<TlsConfig> {
+        match self {
+            TlsProvider::GlobalContext(context) => {
+                Some(TlsConfig::new_with_global_context(context.clone()))
+            }
+            #[cfg(feature = "unstable-cloud")]
+            TlsProvider::ScyllaCloud(cloud_config) => {
+                let (host_id, address, dc) = match *endpoint {
+                    UntranslatedEndpoint::ContactPoint(ResolvedContactPoint {
+                        address,
+                        ref datacenter,
+                    }) => (None, address, datacenter.as_deref()), // FIXME: Pass DC in ContactPoint
+                    UntranslatedEndpoint::Peer(PeerEndpoint {
+                        host_id,
+                        address,
+                        ref datacenter,
+                        ..
+                    }) => (Some(host_id), address.into_inner(), datacenter.as_deref()),
+                };
+
+                cloud_config.make_tls_config_for_scylla_cloud_host(host_id, dc, address)
+                        // inspect_err() is stable since 1.76.
+                        // TODO: use inspect_err once we bump MSRV to at least 1.76.
+                        .map_err(|err| {
+                            warn!(
+                                "TlsProvider for SNI connection to Scylla Cloud node {{ host_id={:?}, dc={:?} at {} }} could not be set up: {}\n Proceeding with attempting probably nonworking connection",
+                                host_id,
+                                dc,
+                                address,
+                                err
+                            );
+                        }).ok().flatten()
+            }
+        }
+    }
+}
+
+/// This struct encapsulates all TLS-regarding configuration and helps pass it tidily through the code.
+//
+// There are 3 possible options for TlsConfig, whose behaviour is somewhat subtle.
+// Option 1: No TLS configuration. Then it is None every time.
+// Option 2: User-provided global TlsContext. Then, a TlsConfig is created upon Session creation
+// and henceforth stored in the ConnectionConfig.
+// Option 3: Serverless Cloud. The Option<TlsConfig> remains None in ConnectionConfig until it reaches
+// NodeConnectionPool::new(). Inside that function, the field is mutated to contain TlsConfig specific
+// for the particular node. (The TlsConfig must be different, because SNIs differ for different nodes.)
+// Thenceforth, all connections to that node share the same TlsConfig.
+#[derive(Clone)]
+pub(crate) struct TlsConfig {
+    context: TlsContext,
+    #[cfg(feature = "unstable-cloud")]
+    sni: Option<String>,
+}
+
+pub(crate) enum Tls {
+    #[cfg(feature = "openssl-010")]
+    OpenSsl010(openssl::ssl::Ssl),
+    #[cfg(feature = "rustls-023")]
+    Rustls023 {
+        connector: tokio_rustls::TlsConnector,
+        #[cfg(feature = "unstable-cloud")]
+        sni: Option<rustls::pki_types::ServerName<'static>>,
+    },
+}
+
+/// A wrapper around a TLS error.
+///
+/// The original error came from one of the supported TLS backends.
+#[derive(Debug, thiserror::Error)]
+#[error(transparent)]
+#[non_exhaustive]
+pub enum TlsError {
+    #[cfg(feature = "openssl-010")]
+    OpenSsl010(openssl::error::ErrorStack),
+    #[cfg(feature = "rustls-023")]
+    InvalidName(rustls::pki_types::InvalidDnsNameError),
+    #[cfg(feature = "rustls-023")]
+    PemParse(rustls::pki_types::pem::Error),
+    #[cfg(feature = "rustls-023")]
+    Rustls023(rustls::Error),
+}
+
+impl From<TlsError> for io::Error {
+    fn from(value: TlsError) -> Self {
+        match value {
+            #[cfg(feature = "openssl-010")]
+            TlsError::OpenSsl010(e) => e.into(),
+            #[cfg(feature = "rustls-023")]
+            TlsError::InvalidName(e) => io::Error::new(io::ErrorKind::Other, e),
+            #[cfg(feature = "rustls-023")]
+            TlsError::PemParse(e) => io::Error::new(io::ErrorKind::Other, e),
+            #[cfg(feature = "rustls-023")]
+            TlsError::Rustls023(e) => io::Error::new(io::ErrorKind::Other, e),
+        }
+    }
+}
+
+#[cfg(feature = "openssl-010")]
+impl From<openssl::error::ErrorStack> for TlsError {
+    fn from(error: openssl::error::ErrorStack) -> Self {
+        TlsError::OpenSsl010(error)
+    }
+}
+
+#[cfg(feature = "rustls-023")]
+impl From<rustls::pki_types::InvalidDnsNameError> for TlsError {
+    fn from(error: rustls::pki_types::InvalidDnsNameError) -> Self {
+        TlsError::InvalidName(error)
+    }
+}
+
+#[cfg(feature = "rustls-023")]
+impl From<rustls::pki_types::pem::Error> for TlsError {
+    fn from(error: rustls::pki_types::pem::Error) -> Self {
+        TlsError::PemParse(error)
+    }
+}
+
+#[cfg(feature = "rustls-023")]
+impl From<rustls::Error> for TlsError {
+    fn from(error: rustls::Error) -> Self {
+        TlsError::Rustls023(error)
+    }
+}
+
+impl TlsConfig {
+    // Used in case when the user provided their own TlsContext to be used in all connections.
+    pub(crate) fn new_with_global_context(context: TlsContext) -> Self {
+        Self {
+            context,
+            #[cfg(feature = "unstable-cloud")]
+            sni: None,
+        }
+    }
+
+    // Used in case of Serverless Cloud connections.
+    #[cfg(feature = "unstable-cloud")]
+    pub(crate) fn new_for_sni(
+        context: TlsContext,
+        domain_name: &str,
+        host_id: Option<Uuid>,
+    ) -> Self {
+        Self {
+            context,
+            #[cfg(feature = "unstable-cloud")]
+            sni: Some(if let Some(host_id) = host_id {
+                format!("{}.{}", host_id, domain_name)
+            } else {
+                domain_name.into()
+            }),
+        }
+    }
+
+    // Produces a new Tls object that is able to wrap a TCP stream.
+    pub(crate) fn new_tls(&self) -> Result<Tls, TlsError> {
+        let tls = match &self.context {
+            #[cfg(feature = "openssl-010")]
+            TlsContext::OpenSsl010(context) => {
+                #[allow(unused_mut)]
+                let mut ssl = openssl::ssl::Ssl::new(context)?;
+                #[cfg(feature = "unstable-cloud")]
+                if let Some(sni) = self.sni.as_ref() {
+                    ssl.set_hostname(sni)?;
+                }
+                Tls::OpenSsl010(ssl)
+            }
+            #[cfg(feature = "rustls-023")]
+            TlsContext::Rustls023(config) => {
+                let connector = tokio_rustls::TlsConnector::from(config.clone());
+                #[cfg(feature = "unstable-cloud")]
+                let sni = self
+                    .sni
+                    .as_deref()
+                    .map(rustls::pki_types::ServerName::try_from)
+                    .transpose()?
+                    .map(|s| s.to_owned());
+
+                Tls::Rustls023 {
+                    connector,
+                    #[cfg(feature = "unstable-cloud")]
+                    sni,
+                }
+            }
+        };
+
+        Ok(tls)
+    }
+}