context

import std::net::tls::context; · source

Each of the two context types owns an OpenSSL SSL_CTX and mints a TlsStream per connection from it. connect and accept are the async entry points: hand over a connected TcpStream and get back a TlsStream once the handshake completes. start_connect and start_accept hand back the TlsHandshake future instead, for callers composing it by hand — under a Futures::timeout, say.

TlsConnector#

type struct TlsConnector {
    ctx:    void*;
    verify: boolean;

    static new() -> Result<TlsConnector, IoError>;
    danger_accept_invalid_certs(mut this) -> TlsConnector;
    with_alpn_h2(mut this) -> TlsConnector;
    async connect(&this, stream: TcpStream, hostname: Str) -> Result<TlsStream, IoError>;
    start_connect(&this, stream: TcpStream, hostname: Str) -> Result<TlsHandshake, IoError>;
    drop(mut &this) -> void;
}

The client side: the TLS client method, with certificate verification against the system store on by default. danger_accept_invalid_certs() is named to be conspicuous at the call site, because it disables verification. with_alpn_h2() offers h2 then http/1.1 during the handshake, and negotiated_alpn() on the resulting stream reports which one the server picked — that is how a client decides between net::http and net::http2 on a single connection. Both are fluent and consume the connector.

TlsAcceptor#

type struct TlsAcceptor {
    ctx: void*;

    static new(cert_path: Str, key_path: Str) -> Result<TlsAcceptor, IoError>;
    async accept(&this, stream: TcpStream) -> Result<TlsStream, IoError>;
    start_accept(&this, stream: TcpStream) -> Result<TlsHandshake, IoError>;
    drop(mut &this) -> void;
}

The server side: the TLS server method loaded with the PEM certificate chain and private key at cert_path and key_path. accept runs the server half of the handshake on an accepted TcpStream.

Because SSL_new takes a reference on the context, a stream outlives its connector or acceptor regardless of which drops first. Both close their context through an inherent drop.