Crate embedded_tls
source ·Expand description
Embedded-TLS is a Rust-native TLS 1.3 implementation that works in a no-std environment. The implementation is work in progress, but the example clients should work against the rustls echo server.
The client supports both async and blocking modes. By default, the async and std features are enabled. The async feature requires Rust nightly, while the blocking feature works on Rust stable.
To use the async mode, import embedded_tls::*. To use the blocking mode, import embedded_tls::blocking::*.
Some features like certificate validation are still not implemented, have a look at open issues. Only supports writing/receiving one frame at a time, hence using a frame buffer larger than 16k is not currently needed. You may use a lower frame buffer size, but there is no guarantee that it will be able to parse any TLS 1.3 frame.
Usage of this crate should fit in 20 kB of RAM assuming a frame buffer of 16 kB (max TLS record size). This is not including the space used to hold the CA and any client certificates.
Some memory usage statistics for async operation:
- TlsConnection: frame_buffer size + 2kB for the rest. This can probably be reduced with some additional tuning.
- Handshake stack usage: currently at 2 kB
- Write stack usage: currently at 560 B
- Read stack usage: currently at 232 B
NOTE: This is very fresh and is probably not meeting all parts of the TLS 1.3 spec. If you find anything you’d like to get implemented, feel free to raise an issue.
Example
use embedded_tls::*;
use embedded_io::adapters::FromTokio;
use rand::rngs::OsRng;
use tokio::net::TcpStream;
#[tokio::main]
async fn main() {
let stream = TcpStream::connect("http.sandbox.drogue.cloud:443").await.expect("error creating TCP connection");
println!("TCP connection opened");
let mut read_record_buffer = [0; 16384];
let mut write_record_buffer = [0; 16384];
let config = TlsConfig::new()
.with_server_name("http.sandbox.drogue.cloud");
let mut tls: TlsConnection<FromTokio<TcpStream>, Aes128GcmSha256> =
TlsConnection::new(FromTokio::new(stream), &mut read_record_buffer, &mut write_record_buffer);
// Allows disabling cert verification, in case you are using PSK and don't need it, or are just testing.
// otherwise, use embedded_tls::webpki::CertVerifier, which only works on std for now.
tls.open::<OsRng, NoVerify>(TlsContext::new(&config, &mut OsRng)).await.expect("error establishing TLS connection");
println!("TLS session opened");
}