Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/rustls/rustls
A modern TLS library in Rust
https://github.com/rustls/rustls
cryptography rust ssl tls
Last synced: 12 days ago
JSON representation
A modern TLS library in Rust
- Host: GitHub
- URL: https://github.com/rustls/rustls
- Owner: rustls
- License: other
- Created: 2016-05-02T20:50:44.000Z (over 8 years ago)
- Default Branch: main
- Last Pushed: 2024-10-25T15:34:37.000Z (14 days ago)
- Last Synced: 2024-10-27T00:45:55.977Z (13 days ago)
- Topics: cryptography, rust, ssl, tls
- Language: Rust
- Homepage:
- Size: 11.6 MB
- Stars: 6,102
- Watchers: 85
- Forks: 642
- Open Issues: 108
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Audit: audit/TLS-01-report.pdf
- Security: SECURITY.md
- Roadmap: ROADMAP.md
Awesome Lists containing this project
- awesome-rust-cn - ctz/rustls
- awesome-rust - rustls/rustls
- awesome-rust-cn - rustls/rustls
- awesome-rust - rustls/rustls - Implementation of TLS (Libraries / Cryptography)
- my-awesome - rustls/rustls - 10 star:6.1k fork:0.6k A modern TLS library in Rust (Rust)
- StarryDivineSky - rustls/rustls
- fucking-awesome-rust - rustls/rustls - Implementation of TLS (Libraries / Cryptography)
- fucking-awesome-rust - rustls/rustls - Implementation of TLS (Libraries / Cryptography)
README
Rustls is a modern TLS library written in Rust.
# Status
Rustls is used in production at many organizations and projects. We aim to maintain
reasonable API surface stability but the API may evolve as we make changes to accommodate
new features or performance improvements.
We have a [roadmap](ROADMAP.md) for our future plans. We also have [benchmarks](BENCHMARKING.md) to
prevent performance regressions and to let you evaluate rustls on your target hardware.
If you'd like to help out, please see [CONTRIBUTING.md](CONTRIBUTING.md).
[](https://github.com/rustls/rustls/actions/workflows/build.yml?query=branch%3Amain)
[](https://codecov.io/gh/rustls/rustls/)
[](https://docs.rs/rustls/)
[](https://discord.gg/MCSB76RU96)
[](https://www.bestpractices.dev/projects/9034)
## Changelog
The detailed list of changes in each release can be found at
https://github.com/rustls/rustls/releases.
# Documentation
https://docs.rs/rustls/
# Approach
Rustls is a TLS library that aims to provide a good level of cryptographic security,
requires no configuration to achieve that security, and provides no unsafe features or
obsolete cryptography by default.
Rustls implements TLS1.2 and TLS1.3 for both clients and servers. See [the full
list of protocol features](https://docs.rs/rustls/latest/rustls/manual/_04_features/index.html).
### Platform support
While Rustls itself is platform independent, by default it uses [`aws-lc-rs`] for implementing
the cryptography in TLS. See [the aws-lc-rs FAQ][aws-lc-rs-platforms-faq] for more details of the
platform/architecture support constraints in aws-lc-rs.
[`ring`] is also available via the `ring` crate feature: see
[the supported `ring` target platforms][ring-target-platforms].
By providing a custom instance of the [`crypto::CryptoProvider`] struct, you
can replace all cryptography dependencies of rustls. This is a route to being portable
to a wider set of architectures and environments, or compliance requirements. See the
[`crypto::CryptoProvider`] documentation for more details.
Specifying `default-features = false` when depending on rustls will remove the
dependency on aws-lc-rs.
Rustls requires Rust 1.63 or later. It has an optional dependency on zlib-rs which requires 1.75 or later.
[ring-target-platforms]: https://github.com/briansmith/ring/blob/2e8363b433fa3b3962c877d9ed2e9145612f3160/include/ring-core/target.h#L18-L64
[`crypto::CryptoProvider`]: https://docs.rs/rustls/latest/rustls/crypto/struct.CryptoProvider.html
[`ring`]: https://crates.io/crates/ring
[aws-lc-rs-platforms-faq]: https://aws.github.io/aws-lc-rs/faq.html#can-i-run-aws-lc-rs-on-x-platform-or-architecture
[`aws-lc-rs`]: https://crates.io/crates/aws-lc-rs
### Cryptography providers
Since Rustls 0.22 it has been possible to choose the provider of the cryptographic primitives
that Rustls uses. This may be appealing if you have specific platform, compliance or feature
requirements that aren't met by the default provider, [`aws-lc-rs`].
Users that wish to customize the provider in use can do so when constructing `ClientConfig`
and `ServerConfig` instances using the `with_crypto_provider` method on the respective config
builder types. See the [`crypto::CryptoProvider`] documentation for more details.
#### Built-in providers
Rustls ships with two built-in providers controlled with associated feature flags:
* [`aws-lc-rs`] - enabled by default, available with the `aws_lc_rs` feature flag enabled.
* [`ring`] - available with the `ring` feature flag enabled.
See the documentation for [`crypto::CryptoProvider`] for details on how providers are
selected.
#### Third-party providers
The community has also started developing third-party providers for Rustls:
* [`rustls-mbedtls-provider`] - a provider that uses [`mbedtls`] for cryptography.
* [`boring-rustls-provider`] - a work-in-progress provider that uses [`boringssl`] for
cryptography.
* [`rustls-rustcrypto`] - an experimental provider that uses the crypto primitives
from [`RustCrypto`] for cryptography.
* [`rustls-post-quantum`]: an experimental provider that adds support for post-quantum
key exchange to the default aws-lc-rs provider.
* [`rustls-wolfcrypt-provider`] - a work-in-progress provider that uses [`wolfCrypt`] for cryptography.
[`rustls-mbedtls-provider`]: https://github.com/fortanix/rustls-mbedtls-provider
[`mbedtls`]: https://github.com/Mbed-TLS/mbedtls
[`boring-rustls-provider`]: https://github.com/janrueth/boring-rustls-provider
[`boringssl`]: https://github.com/google/boringssl
[`rustls-rustcrypto`]: https://github.com/RustCrypto/rustls-rustcrypto
[`RustCrypto`]: https://github.com/RustCrypto
[`rustls-post-quantum`]: https://crates.io/crates/rustls-post-quantum
[`rustls-wolfcrypt-provider`]: https://github.com/wolfSSL/rustls-wolfcrypt-provider
[`wolfCrypt`]: https://www.wolfssl.com/products/wolfcrypt
#### Custom provider
We also provide a simple example of writing your own provider in the [`custom-provider`]
example. This example implements a minimal provider using parts of the [`RustCrypto`]
ecosystem.
See the [Making a custom CryptoProvider] section of the documentation for more information
on this topic.
[`custom-provider`]: https://github.com/rustls/rustls/tree/main/provider-example/
[`RustCrypto`]: https://github.com/RustCrypto
[Making a custom CryptoProvider]: https://docs.rs/rustls/latest/rustls/crypto/struct.CryptoProvider.html#making-a-custom-cryptoprovider
# Example code
Our [examples] directory contains demos that show how to handle I/O using the
[`stream::Stream`] helper, as well as more complex asynchronous I/O using [`mio`].
If you're already using Tokio for an async runtime you may prefer to use
[`tokio-rustls`] instead of interacting with rustls directly.
The [`mio`] based examples are the most complete, and discussed below. Users
new to Rustls may prefer to look at the simple client/server examples before
diving in to the more complex MIO examples.
[examples]: examples/
[`stream::Stream`]: https://docs.rs/rustls/latest/rustls/struct.Stream.html
[`mio`]: https://docs.rs/mio/latest/mio/
[`tokio-rustls`]: https://docs.rs/tokio-rustls/latest/tokio_rustls/
## Client example program
The MIO client example program is named `tlsclient-mio`. The interface looks like:
```tlsclient-mio
Connects to the TLS server at hostname:PORT. The default PORT
is 443. By default, this reads a request from stdin (to EOF)
before making the connection. --http replaces this with a
basic HTTP GET request for /.
If --cafile is not supplied, a built-in set of CA certificates
are used from the webpki-roots crate.
Usage:
tlsclient-mio [options] [--suite SUITE ...] [--proto PROTO ...] [--protover PROTOVER ...]
tlsclient-mio (--version | -v)
tlsclient-mio (--help | -h)
Options:
-p, --port PORT Connect to PORT [default: 443].
--http Send a basic HTTP GET request for /.
--cafile CAFILE Read root certificates from CAFILE.
--auth-key KEY Read client authentication key from KEY.
--auth-certs CERTS Read client authentication certificates from CERTS.
CERTS must match up with KEY.
--protover VERSION Disable default TLS version list, and use
VERSION instead. May be used multiple times.
--suite SUITE Disable default cipher suite list, and use
SUITE instead. May be used multiple times.
--proto PROTOCOL Send ALPN extension containing PROTOCOL.
May be used multiple times to offer several protocols.
--no-tickets Disable session ticket support.
--no-sni Disable server name indication support.
--insecure Disable certificate verification.
--verbose Emit log output.
--max-frag-size M Limit outgoing messages to M bytes.
--version, -v Show tool version.
--help, -h Show this screen.
```
Some sample runs:
```
$ cargo run --bin tlsclient-mio -- --http mozilla-modern.badssl.com
HTTP/1.1 200 OK
Server: nginx/1.6.2 (Ubuntu)
Date: Wed, 01 Jun 2016 18:44:00 GMT
Content-Type: text/html
Content-Length: 644
(...)
```
or
```
$ cargo run --bin tlsclient-mio -- --http expired.badssl.com
TLS error: InvalidCertificate(Expired)
Connection closed
```
## Server example program
The MIO server example program is named `tlsserver-mio`. The interface looks like:
```tlsserver-mio
Runs a TLS server on :PORT. The default PORT is 443.
`echo' mode means the server echoes received data on each connection.
`http' mode means the server blindly sends a HTTP response on each
connection.
`forward' means the server forwards plaintext to a connection made to
localhost:fport.
`--certs' names the full certificate chain, `--key' provides the
RSA private key.
Usage:
tlsserver-mio --certs CERTFILE --key KEYFILE [--suite SUITE ...] [--proto PROTO ...] [--protover PROTOVER ...] [options] echo
tlsserver-mio --certs CERTFILE --key KEYFILE [--suite SUITE ...] [--proto PROTO ...] [--protover PROTOVER ...] [options] http
tlsserver-mio --certs CERTFILE --key KEYFILE [--suite SUITE ...] [--proto PROTO ...] [--protover PROTOVER ...] [options] forward
tlsserver-mio (--version | -v)
tlsserver-mio (--help | -h)
Options:
-p, --port PORT Listen on PORT [default: 443].
--certs CERTFILE Read server certificates from CERTFILE.
This should contain PEM-format certificates
in the right order (the first certificate should
certify KEYFILE, the last should be a root CA).
--key KEYFILE Read private key from KEYFILE. This should be a RSA
private key or PKCS8-encoded private key, in PEM format.
--ocsp OCSPFILE Read DER-encoded OCSP response from OCSPFILE and staple
to certificate. Optional.
--auth CERTFILE Enable client authentication, and accept certificates
signed by those roots provided in CERTFILE.
--crl CRLFILE ... Perform client certificate revocation checking using the DER-encoded
CRLFILE. May be used multiple times.
--require-auth Send a fatal alert if the client does not complete client
authentication.
--no-resumption Disable stateful session resumption.
--tickets Support tickets (stateless resumption).
--max-early-data BYTES Support receiving BYTES many bytes with 0RTT
--protover VERSION Disable default TLS version list, and use
VERSION instead. May be used multiple times.
--suite SUITE Disable default cipher suite list, and use
SUITE instead. May be used multiple times.
--proto PROTOCOL Negotiate PROTOCOL using ALPN.
May be used multiple times.
--verbose Emit log output.
--version, -v Show tool version.
--help, -h Show this screen.
```
Here's a sample run; we start a TLS echo server, then connect to it with
`openssl` and `tlsclient-mio`:
```
$ cargo run --bin tlsserver-mio -- --certs test-ca/rsa-2048/end.fullchain --key test-ca/rsa-2048/end.key -p 8443 echo &
$ echo hello world | openssl s_client -ign_eof -quiet -connect localhost:8443
depth=2 CN = ponytown RSA CA
verify error:num=19:self signed certificate in certificate chain
hello world
^C
$ echo hello world | cargo run --bin tlsclient-mio -- --cafile test-ca/rsa-2048/ca.cert -p 8443 localhost
hello world
^C
```
# License
Rustls is distributed under the following three licenses:
- Apache License version 2.0.
- MIT license.
- ISC license.
These are included as LICENSE-APACHE, LICENSE-MIT and LICENSE-ISC
respectively. You may use this software under the terms of any
of these licenses, at your option.
# Project Membership
- Joe Birr-Pixton ([@ctz], Project Founder - full-time funded by [Prossimo])
- Dirkjan Ochtman ([@djc], Co-maintainer)
- Daniel McCarney ([@cpu], Co-maintainer - full-time funded by [Prossimo])
- Josh Aas ([@bdaehlie], Project Management)
[@ctz]: https://github.com/ctz
[@djc]: https://github.com/djc
[@cpu]: https://github.com/cpu
[@bdaehlie]: https://github.com/bdaehlie
[Prossimo]: https://www.memorysafety.org/initiative/rustls/
# Code of conduct
This project adopts the [Rust Code of Conduct](https://www.rust-lang.org/policies/code-of-conduct).
Please email [email protected] to report any instance of misconduct, or if you
have any comments or questions on the Code of Conduct.