Module tls 

Provider-neutral TLS handshakes, stream I/O and endpoint composition. The optional rustls feature supplies a concrete provider in tls::rustls. Applications select trust stores and credentials through provider configuration.

Client connectors authenticate the peer’s certificate and requested server identity. Server acceptors apply their configured certificate and client-authentication policy. Providers own TLS configuration, trust roots, credentials, protocol versions, ALPN offers and selection, TLS I/O, shutdown and failed-handshake cleanup; application code can retain concrete configuration types without erasing them into a shared options map.

TlsClientEndpoint::new(endpoint, connector, server_name) implements the same connection contract as other endpoints and returns the provider’s TLS connection. TlsServerEndpoint::new(endpoint, acceptor) implements binding and returns TlsListener values; their accept method accepts and handshakes one native scheduler connection. A failed handshake leaves the listener available for another accept. Custom listener types can access the underlying listener and provider directly. Wrap composite binding inside the TLS server endpoint.

The server name used for authentication is independent of the address used for routing. Client providers must verify certificate trust and server identity. TlsSession::negotiated_protocol exposes the selected ALPN bytes. TlsStream<S> supplies sequential reads, buffered writes, flushing, TLS shutdown and transport closure without naming a provider. There is no plaintext fallback. HTTP protocol names and engine selection remain owned by HTTP, outside endpoint/TLS.

For example, application code can configure a provider elsewhere and compose it without naming a TLS backend:

use base_endpoint::{ConnectEndpoint, tls::{TlsClientEndpoint, TlsConnector}};
use base_scheduler::{Cancellation, OperationResult};

async fn secure_connection<S, E, T>(
    scheduler: &S,
    endpoint: E,
    connector: T,
    server_name: &str,
    cancellation: &Cancellation,
) -> OperationResult<T::Connection>
where
    S: Sync,
    E: ConnectEndpoint<S>,
    T: TlsConnector<S, E::Connection>,
{
    TlsClientEndpoint::new(endpoint, connector, server_name)
        .connect(scheduler, cancellation).await
}

Rustls

Enable the optional rustls Cargo feature to use tls::rustls::{RustlsConnector, RustlsAcceptor, RustlsConnection}. The providers accept shared rustls configurations, so applications select certificate trust roots, credentials, client authentication, protocol versions and ALPN. The feature enables rustls’s ring crypto provider and TLS 1.2/1.3 support; configurations may also use another explicitly selected rustls crypto provider. No trust roots are loaded implicitly.

use base_endpoint::{AddressEndpoint, HostEndpoint, tls::{TlsClientEndpoint, TlsServerEndpoint,
    rustls::{RustlsAcceptor, RustlsConnector}}};
use std::sync::Arc;

let client = TlsClientEndpoint::new(
    HostEndpoint::new("example.com", 443),
    RustlsConnector::new(Arc::new(client_config)),
    "example.com",
);
let server = TlsServerEndpoint::new(
    AddressEndpoint::new("127.0.0.1:8443".parse().unwrap()),
    RustlsAcceptor::new(Arc::new(server_config)),
);
// Use the same connect/bind traits as plain endpoints.

Modules

rustls

Rustls client/server providers over Base scheduler stream sockets. Enable the rustls feature, supply an Arc<ClientConfig> or Arc<ServerConfig>, and compose the provider with the generic TLS endpoint adapters.

Structs

TlsClientEndpoint

Compose connection establishment with a TLS client handshake. The server identity is explicit and independent of the underlying endpoint’s routing address.

TlsListener

A listener paired with its configured TLS acceptor. Native scheduler listeners have accept and close conveniences. Other listener representations can use listener and acceptor to perform their own accept operation followed by the same TLS handshake contract.

TlsServerEndpoint

Compose binding with a configured TLS server provider. Binding wraps listeners; each accepted connection performs its own handshake. Wrap a composite endpoint here to support multiple listening addresses.

Traits

TlsAcceptor

An explicitly configured TLS server provider over an owned accepted transport C. Configuration includes the server identity, ALPN selection and any client-authentication policy.

TlsConnector

An explicitly configured TLS client provider over an owned transport C. S supplies any execution or I/O capabilities the provider needs; neither input is required to be a scheduler socket.

TlsSession

Metadata available after a successful TLS handshake. Stream providers can also implement TlsStream for provider-neutral application I/O and orderly shutdown. Retire those operations and send any required TLS close notification before closing the underlying transport.

TlsStream

Sequential TLS application I/O, independent of a particular TLS provider. S supplies explicit execution/I/O capabilities. A stream owns its transport and TLS state; no background task or split reader/writer is implied.