Crate embedded_tls

Embedded-TLS

Embedded-TLS is a Rust-native TLS 1.3 implementation that works in a no-std environment. The Rust crate was formerly known as drogue-tls. The implementation is work in progress, but the example clients should work against the rustls echo server.

The client supports both async and blocking modes. By default, the std feature is enabled, but can be disabled for bare metal usage.

To use the async mode, import embedded_tls::*. To use the blocking mode, import embedded_tls::blocking::*.

Some features and extensions are not yet implemented, have a look at open issues.

Only supports writing/receiving one frame at a time, hence using a frame buffer larger than 16k is not currently needed. You may use a lower frame buffer size, but there is no guarantee that it will be able to parse any TLS 1.3 frame.

Community

• Drogue IoT Matrix Chat Room
• We have bi-weekly calls at 9:00 AM (GMT). Check the calendar to see which week we are having the next call, and feel free to join!
• Drogue IoT Forum
• Drogue IoT YouTube channel
• Follow us on Twitter!

Example

use embedded_tls::*;
use embedded_io_adapters::tokio_1::FromTokio;
use rand::rngs::OsRng;
use tokio::net::TcpStream;

#[tokio::main]
async fn main() {
    let stream = TcpStream::connect("http.sandbox.drogue.cloud:443").await.expect("error creating TCP connection");

    println!("TCP connection opened");
    let mut read_record_buffer = [0; 16384];
    let mut write_record_buffer = [0; 16384];
    let config = TlsConfig::new()
        .with_server_name("http.sandbox.drogue.cloud");
    let mut tls: TlsConnection<FromTokio<TcpStream>, Aes128GcmSha256> =
        TlsConnection::new(FromTokio::new(stream), &mut read_record_buffer, &mut write_record_buffer);

    // Allows disabling cert verification, in case you are using PSK and don't need it, or are just testing.
    // otherwise, use embedded_tls::webpki::CertVerifier, which only works on std for now.
    tls.open::<OsRng, NoVerify>(TlsContext::new(&config, &mut OsRng)).await.expect("error establishing TLS connection");

    println!("TLS session opened");
}

Modules

alert

blocking

read_buffer

Structs

Aes128GcmSha256

Aes256GcmSha384

ManagedSplitState

NoClock

NoVerify

SplitConnectionState

TlsConfig

TlsConnection

Type representing an async TLS connection. An instance of this type can be used to establish a TLS connection, write and read encrypted data over this connection, and closing to free up the underlying resources.

TlsContext

TlsReader

TlsWriter

Enums

Certificate

MaxFragmentLength

Maximum plaintext fragment length

TlsError

Constants

TLS_RECORD_OVERHEAD

Traits

TlsCipherSuite

Represents a TLS 1.3 cipher suite

TlsClock

TlsVerifier

A TLS 1.3 verifier.

Type Aliases

Sha256

SHA-256 hasher.

Sha384

SHA-384 hasher.