pimalaya_stream/
tls.rs

1//! User-facing TLS configuration.
2//!
3//! Consumers construct a [`Tls`] and pass it to a runtime-specific connector
4//! (e.g. [`StreamStd::connect_tls`] / [`StreamStd::upgrade_tls`]); the
5//! underlying TLS backend types (`rustls`, `native-tls`) never escape this
6//! crate.
7//!
8//! ALPN lives on [`Rustls`] rather than [`Tls`] because `native-tls` does
9//! not expose an ALPN option. Protocol crates (`io-imap`, `io-smtp`, ...)
10//! ship `default_alpn()` helpers so config layers can populate
11//! `rustls.alpn` before calling `connect_tls`.
12//!
13//! [`StreamStd::connect_tls`]: crate::std::stream::StreamStd::connect_tls
14//! [`StreamStd::upgrade_tls`]: crate::std::stream::StreamStd::upgrade_tls
15
16use std::path::PathBuf;
17
18/// TLS settings shared by both backends.
19#[derive(Clone, Debug, Default)]
20pub struct Tls {
21    /// TLS backend selector. `None` falls back to the first enabled feature
22    /// in this order: `rustls-ring`, `rustls-aws`, `native-tls`.
23    pub provider: Option<TlsProvider>,
24    /// Rustls-specific options. Ignored when the resolved provider is
25    /// [`TlsProvider::NativeTls`].
26    pub rustls: Rustls,
27    /// Optional extra trust anchor, as a path to a PEM file.
28    pub cert: Option<PathBuf>,
29}
30
31/// TLS backend selector.
32#[derive(Clone, Debug)]
33pub enum TlsProvider {
34    /// The rustls backend.
35    Rustls,
36    /// The platform-backed native-tls backend.
37    NativeTls,
38}
39
40/// Rustls-specific TLS options.
41#[derive(Clone, Debug, Default)]
42pub struct Rustls {
43    /// Crypto provider. `None` falls back to `ring` if enabled, otherwise
44    /// `aws-lc-rs`.
45    pub crypto: Option<RustlsCrypto>,
46    /// ALPN protocol identifiers offered during the handshake (e.g.
47    /// `vec!["imap".into()]`). An empty vec skips ALPN negotiation. Ignored
48    /// by `native-tls`.
49    pub alpn: Vec<String>,
50}
51
52/// Rustls crypto provider selector.
53#[derive(Clone, Debug)]
54pub enum RustlsCrypto {
55    /// The aws-lc-rs crypto provider.
56    Aws,
57    /// The ring crypto provider.
58    Ring,
59}
pimalaya_stream/tls.rs

pimalaya_stream/
tls.rs
