I drafted up an interface at: #104

I don't think a distinct easy-client-tls interface as mentioned above is needed anymore. Even "fully fledged" interface is pretty straight forward to set up.
Below is an example of a TCP/TLS client in pseudo code. If you ignore the setup boilerplate, you'll see that the actual TLS client surface area is only two lines long: /* A */ & /* B */

let ip = resolve_addresses("example.com").await?[0];

let tcp_client = TcpSocket::new();
let (tcp_input, tcp_output) = tcp_client.connect(ip, 443).await;

let tls_client = TlsClient::new("example.com", SuspensionPoints::none()); /* A */
let tls_streams = tls_client.streams()?;

forward(tcp_input, tls_streams.public_output);
forward(tls_streams.public_input, tcp_output);

tls_client.resume(); /* B */

tls_streams.private_output.blocking_write_and_flush("GET / HTTP/1.1\r\nHost: example.com\r\n\r\n");
let response = tls_streams.private_input.blocking_read();

println!(response);




/// Pump all data from `src` to `dest` on a background task
fn forward(src: InputStream, dest: OutputStream) -> JoinHandle {
    spawn_blocking(|| {
        loop {
            dest.blocking_splice(src).await?;
        }
    })
}

If you're wondering what the SuspensionPoints & resume stuff is about, I invite you to read the docs on the tls-client resource in the PR. TLDR; it is the least bad solution I could come up with to handle callbacks, which TLS libraries love to use but the CM doesn't support.
Below is a more detailed showcase of these suspensions, this time from the POV of a server:

let id1 = PrivateIdentity::parse(
    fs::read("private1.key"),
    fs::read("public1.crt"),
)?;
let id2 = PrivateIdentity::parse(
    fs::read("private2.key"),
    fs::read("public2.crt"),
)?;

let tcp_server = TcpSocket::new();
tcp_server.bind(443);
tcp_server.listen();

loop {
    let (tcp_client, tcp_input, tcp_output) = tcp_server.accept().await;

    let tls_server = TlsServer::new(SuspensionPoints::ClientHello | SuspensionPoints::Accepted);
    let tls_streams = tls_server.streams()?;

    {
        tls_client.configure_alpn_ids(["h2"]);

        forward(tcp_input, tls_streams.public_output);
        forward(tls_streams.public_input, tcp_output);

        tls_server.resume(); // Accept initiate handshake
    }
    {
        let suspension = wait_suspend(tls_server).await; // Wait for client hello
        assert!(suspension.at() == SuspensionPoints::ClientHello);

        // Select certificate based on SNI:
        match suspension.requested_server_name()? {
            Some("example.com") => {
                tls_server.configure_identities([id1]);
            }
            _ => tls_server.configure_identities([id2]);
        }

        tls_server.resume(); // Continue handshake
    }
    {
        let suspension = wait_suspend(tls_server).await; // Wait for handshake to complete
        assert!(suspension.at() == SuspensionPoints::Accepted);

        println!("Fully connected!");

        tls_server.resume();
    }
    {
        let request = tls_streams.private_input.blocking_read();

        println!(request);
    }
}



async fn wait_suspend(tls: TlsServer) {
    loop {
        let result = tls.suspend();
        if result == Err(NotReady) {
            tls.subscribe().block();
        } else {
            return result;
        }
    }
}

TLS (Transport Layer Security) #100

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions