noxtls 0.2.20

TLS/DTLS protocol and connection state machine for the noxtls Rust stack.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

// Copyright (c) 2019-2026, Argenox Technologies LLC
// All rights reserved.
//
// SPDX-License-Identifier: GPL-2.0-only OR LicenseRef-Argenox-Commercial-License
//
// This file is part of the NoxTLS Library.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by the
// Free Software Foundation; version 2 of the License.
//
// Alternatively, this file may be used under the terms of a commercial
// license from Argenox Technologies LLC.
//
// See `noxtls/LICENSE` and `noxtls/LICENSE.md` in this repository for full details.
// CONTACT: info@argenox.com

#![cfg_attr(not(feature = "std"), no_std)]
#![forbid(unsafe_code)]
#![allow(clippy::incompatible_msrv)]
#![allow(clippy::redundant_guards)]
#![allow(clippy::needless_borrow)]
#![allow(clippy::type_complexity)]
#![allow(clippy::useless_vec)]

//! User-facing TLS and DTLS protocol surface for the NoxTLS Rust port.
//!
//! This crate wires together a modeled `protocol` handshake and record layer, deterministic key-share
//! helpers for interop, optional PSK ticket persistence, and re-exports `noxtls_io::transport` adapters
//! for blocking, async, and embedded I/O profiles.

#[cfg(not(feature = "std"))]
#[macro_use]
extern crate alloc;

mod internal_alloc;
mod platform_bridge;
mod protocol;

#[cfg(feature = "adapter-embedded-io-async")]
pub mod client_async;
#[cfg(feature = "adapter-embedded-io-async")]
pub mod server_async;

pub use noxtls_io::transport;

/// Portable platform hooks (time, future RNG/storage traits).
pub use noxtls_platform as platform;

pub use platform_bridge::{
    noxtls_cert_validation_time_now, noxtls_fill_random, noxtls_hmac_drbg_from_entropy,
};

#[cfg(feature = "adapter-embedded-io-async")]
pub use client_async::{noxtls_connect_tls13_async, AsyncTls13Client, AsyncTlsClientConfig};
#[cfg(feature = "adapter-embedded-io-async")]
pub use server_async::{
    noxtls_accept_tls13_async, noxtls_server_random, AsyncTls13Connection, AsyncTlsServerConfig,
};

pub use protocol::{
    noxtls_apply_dtls13_ack_ranges, noxtls_derive_deterministic_p256_private,
    noxtls_derive_deterministic_x25519_private, noxtls_derive_tls13_p256_shared_secret,
    noxtls_derive_tls13_x25519_shared_secret, noxtls_dtls13_aes128gcm_record_size,
    noxtls_encode_dtls12_handshake_fragments, noxtls_encode_dtls13_ack,
    noxtls_encode_dtls13_record_header, noxtls_encode_dtls13_record_packet,
    noxtls_encode_dtls_record_header, noxtls_encode_dtls_record_packet,
    noxtls_hkdf_extract_for_hash, noxtls_hkdf_extract_with_salt_for_hash,
    noxtls_open_dtls13_aes128gcm_record, noxtls_open_dtls13_unified_aes128gcm_record,
    noxtls_p256_generate_private_key_with_entropy, noxtls_parse_dtls12_handshake_fragment,
    noxtls_parse_dtls13_ack, noxtls_parse_dtls13_record_header, noxtls_parse_dtls13_record_packet,
    noxtls_parse_dtls_record_header, noxtls_parse_dtls_record_packet,
    noxtls_parse_tls13_ocsp_staple_info, noxtls_reassemble_dtls12_handshake_fragments,
    noxtls_seal_dtls13_aes128gcm_record, noxtls_seal_dtls13_unified_aes128gcm_record,
    noxtls_tls13_client_hello_offers_supported_key_exchange, noxtls_tls13_expand_label_for_hash,
    noxtls_tls13_key_share_group_supported, noxtls_tls13_signature_algorithm_supported,
    noxtls_verify_tls13_ocsp_staple, noxtls_x25519_generate_private_key_with_entropy,
    split_tls13_handshake_payload, AlertDescription, AlertLevel, CipherSuite,
    ClientHelloExtensions, ClientHelloInfo, Connection, Dtls13AckRange, Dtls13Flight,
    Dtls13RecordHeader, Dtls13TransportEvent, DtlsEpochReplayTracker, DtlsFlightRecord,
    DtlsFlightRetransmitTracker, DtlsOperationalPolicy, DtlsOperationalProfile, DtlsRecordHeader,
    DtlsReplayWindow, ExternalKeyHandle, ExternalKeyProvider, HandshakeState, HashAlgorithm,
    KeyDecryptAlgorithm, KeyDecryptRequest, KeyDeriveAlgorithm, KeyDeriveRequest, KeySignAlgorithm,
    KeySignRequest, ProtectedRecord, RecordContentType, ResumptionTicket, SoftwareKeyProvider,
    TicketStore, TicketUsagePolicy, Tls13EarlyDataOperationalPolicy,
    Tls13EarlyDataOperationalProfile, Tls13EarlyDataReplayState, Tls13EarlyDataTelemetry,
    Tls13OcspStapleInfo, Tls13OcspStapleVerification, Tls13OcspStapleVerifier,
    Tls13QuicInitialSecrets, Tls13QuicNextTrafficSecrets, Tls13QuicPacketProtectionKeys,
    Tls13QuicTrafficSecretSnapshot, Tls13ServerIdentity, Tls13ServerIdentityKey, TlsRecordDeframer,
    TlsRole, TlsVersion, NOXTLS_TLS13_NAMED_GROUP_BRAINPOOLP256R1TLS13,
    NOXTLS_TLS13_NAMED_GROUP_BRAINPOOLP384R1TLS13, NOXTLS_TLS13_NAMED_GROUP_BRAINPOOLP512R1TLS13,
    NOXTLS_TLS13_NAMED_GROUP_MLKEM768, NOXTLS_TLS13_NAMED_GROUP_SECP256R1,
    NOXTLS_TLS13_NAMED_GROUP_SECP256R1_MLKEM768_HYBRID, NOXTLS_TLS13_NAMED_GROUP_SECP384R1,
    NOXTLS_TLS13_NAMED_GROUP_SECP384R1_MLKEM1024_HYBRID, NOXTLS_TLS13_NAMED_GROUP_SECP521R1,
    NOXTLS_TLS13_NAMED_GROUP_X25519, NOXTLS_TLS13_NAMED_GROUP_X25519_MLKEM768_HYBRID,
    NOXTLS_TLS13_NAMED_GROUP_X448, TLS13_QUIC_EXPORTER_LABEL_CLIENT_1RTT,
    TLS13_QUIC_EXPORTER_LABEL_SERVER_1RTT, TLS_MAX_RECORD_PAYLOAD_LEN, TLS_RECORD_HEADER_LEN,
};

pub use noxtls_x509::{
    noxtls_certificate_chain_pem_to_der_blocks, noxtls_certificate_matches_hostname,
    noxtls_certificate_pem_to_der, noxtls_ec_private_key_pem_to_der_sec1,
    noxtls_p256_private_key_from_pem_pkcs8, noxtls_p256_private_key_from_pem_sec1,
    noxtls_p256_private_key_from_pkcs8_der, noxtls_p384_private_key_from_pem_pkcs8,
    noxtls_p384_private_key_from_pem_sec1, noxtls_p384_private_key_from_pkcs8_der,
    noxtls_p521_private_key_from_pem_pkcs8, noxtls_p521_private_key_from_pem_sec1,
    noxtls_p521_private_key_from_pkcs8_der, noxtls_parse_certificate,
    noxtls_parse_pkcs8_private_key_info_der, noxtls_pem_to_der, noxtls_pem_to_der_blocks,
    noxtls_private_key_pem_to_der_pkcs8, noxtls_rsa_private_key_from_pem_pkcs1,
    noxtls_rsa_private_key_from_pem_pkcs8, noxtls_rsa_private_key_from_pkcs1_der,
    noxtls_rsa_private_key_from_pkcs8_der, noxtls_rsa_pss_private_key_from_pem_pkcs8,
    noxtls_rsa_pss_private_key_from_pkcs8_der, noxtls_validate_certificate_chain, Certificate,
    Pkcs8PrivateKeyInfoDerParts, ValidationError,
};

#[cfg(feature = "std")]
pub use noxtls_x509::noxtls_pem_file_to_der_blocks;

#[cfg(feature = "provider-psa")]
pub use noxtls_psa::{
    AeadEncryptRequest as PsaAeadEncryptRequest, AeadEncryptResponse as PsaAeadEncryptResponse,
    FfiPsaBackend, KeyDecryptRequest as PsaKeyDecryptRequest,
    KeyDeriveRequest as PsaKeyDeriveRequest, KeySignRequest as PsaKeySignRequest, PsaCryptoBackend,
    PsaDecryptAlgorithm, PsaDeriveAlgorithm, PsaError, PsaExternalKeyHandle, PsaProvider,
    PsaResultCode, PsaSignAlgorithm, PsaSoftwareBackend, PsaSoftwareProvider,
};

#[cfg(feature = "provider-psa")]
pub use protocol::PsaExternalKeyProvider;