Merge 9117d3e531 into 7bc80994b7

litellm-rust/Cargo.lock

@@ -1223,6 +1223,7 @@ dependencies = [
  "litellm-core",
  "pyo3",
  "reqwest",
+ "rustls 0.23.42",
  "serde",
  "serde_json",
  "sha2 0.10.9",

litellm-rust/Cargo.toml

@@ -20,6 +20,7 @@ pyo3 = "0.29.0"
 pyo3-async-runtimes = { version = "0.29.0", features = ["tokio-runtime"] }
 rand = "0.8"
 reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls", "http2", "stream"] }
+rustls = { version = "0.23", default-features = false, features = ["ring"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 sha2 = "0.10"

litellm-rust/crates/ai-gateway/Cargo.toml

@@ -18,6 +18,7 @@ litellm-core = { workspace = true, features = ["bedrock-auth"] }
 # reqwest (rustls + json) is used by io/ocr and ships realtime logs to the
 # Python proxy callbacks API.
 reqwest.workspace = true
+rustls = { workspace = true, optional = true }
 # `sync` powers the bounded mpsc channel the realtime logger drains.
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "net", "time", "sync"] }
 tokio-tungstenite.workspace = true
@@ -34,7 +35,7 @@ pyo3 = { workspace = true, features = ["auto-initialize"], optional = true }
 
 [features]
 default = []
-server = ["dep:axum", "dep:subtle", "dep:sha2"]
+server = ["dep:axum", "dep:subtle", "dep:sha2", "dep:rustls"]
 # Build the gateway's config from the proxy YAML via an embedded Python
 # interpreter (links libpython; requires `litellm` importable at runtime).
 python-config = ["dep:pyo3"]

litellm-rust/crates/ai-gateway/src/main.rs

@@ -26,8 +26,16 @@ use litellm_ai_gateway::python;
 const DEFAULT_HOST: &str = "127.0.0.1";
 const DEFAULT_PORT: u16 = 4001;
 
+fn install_rustls_crypto_provider() {
+    rustls::crypto::ring::default_provider()
+        .install_default()
+        .expect("failed to install rustls crypto provider");
+}
+
 #[tokio::main]
 async fn main() {
+    install_rustls_crypto_provider();
+
     // Trim before storing so it matches the trimmed bearer token in `auth`
     // (avoids a silent auth failure when the env var has surrounding whitespace).
     let master_key: Option<Arc<str>> = std::env::var("LITELLM_MASTER_KEY")
@@ -160,3 +168,14 @@ fn build_router_from_env() -> Router {
     };
     Router::new(vec![deployment])
 }
+
+#[cfg(test)]
+mod tests {
+    use super::install_rustls_crypto_provider;
+
+    #[test]
+    fn tls_client_initializes() {
+        install_rustls_crypto_provider();
+        let _ = rustls::ClientConfig::builder();
+    }
+}