Struct Ssl

pub struct Ssl(/* private fields */);

The state of an SSL/TLS session.

Ssl objects are created from an SslContext, which provides configuration defaults. These defaults can be overridden on a per-Ssl basis, however.

Implementations

impl Ssl

pub fn new_ex_index<T>() -> Result<Index<Ssl, T>, ErrorStack>

where T: 'static + Sync + Send,

Returns a new extra data index.

Each invocation of this function is guaranteed to return a distinct index. These can be used to store data in the context that can be retrieved later by callbacks, for example.

This corresponds to SSL_get_ex_new_index.

pub fn new(ctx: &SslContext) -> Result<Ssl, ErrorStack>

Creates a new Ssl.

This corresponds to SSL_new.

pub fn new_from_ref(ctx: &SslContextRef) -> Result<Ssl, ErrorStack>

Creates a new Ssl.

This function does the same as [Self:new] except that it takes &SslContextRef.

This corresponds to SSL_new.

pub fn setup_connect<S>(self, stream: S) -> MidHandshakeSslStream<S>

where S: Read + Write,

Initiates a client-side TLS handshake, returning a MidHandshakeSslStream.

This method is guaranteed to return without calling any callback defined in the internal Ssl or SslContext.

See SslStreamBuilder::setup_connect for more details.

Warning

BoringSSL’s default configuration is insecure. It is highly recommended to use SslConnector rather than Ssl directly, as it manages that configuration.

pub fn connect<S>(self, stream: S) -> Result<SslStream<S>, HandshakeError<S>>

where S: Read + Write,

Attempts a client-side TLS handshake.

This is a convenience method which combines Self::setup_connect and MidHandshakeSslStream::handshake.

Warning

OpenSSL’s default configuration is insecure. It is highly recommended to use SslConnector rather than Ssl directly, as it manages that configuration.

pub fn setup_accept<S>(self, stream: S) -> MidHandshakeSslStream<S>

where S: Read + Write,

Initiates a server-side TLS handshake.

This method is guaranteed to return without calling any callback defined in the internal Ssl or SslContext.

See SslStreamBuilder::setup_accept for more details.

Warning

BoringSSL’s default configuration is insecure. It is highly recommended to use SslAcceptor rather than Ssl directly, as it manages that configuration.

pub fn accept<S>(self, stream: S) -> Result<SslStream<S>, HandshakeError<S>>

where S: Read + Write,

Attempts a server-side TLS handshake.

This is a convenience method which combines Self::setup_accept and MidHandshakeSslStream::handshake.

Warning

OpenSSL’s default configuration is insecure. It is highly recommended to use SslAcceptor rather than Ssl directly, as it manages that configuration.

Methods from Deref<Target = SslRef>

pub fn set_async_custom_verify_callback<F>( &mut self, mode: SslVerifyMode, callback: F, )

where F: Fn(&mut SslRef) -> Result<Pin<Box<dyn Future<Output = Result<Box<dyn FnOnce(&mut SslRef) -> Result<(), SslAlert>>, SslAlert>> + Send>>, SslAlert> + Send + Sync + 'static,

pub fn set_task_waker(&mut self, waker: Option<Waker>)

Sets the task waker to be used in async callbacks installed on this Ssl.

pub fn set_curves_list(&mut self, curves: &str) -> Result<(), ErrorStack>

This corresponds to SSL_set1_curves_list.

pub fn curve(&self) -> Option<SslCurve>

Returns the SslCurve used for this SslRef.

This corresponds to SSL_get_curve_id.

pub fn error_code(&self, ret: i32) -> ErrorCode

Returns an ErrorCode value for the most recent operation on this SslRef.

This corresponds to SSL_get_error.

pub fn set_verify(&mut self, mode: SslVerifyMode)

Like SslContextBuilder::set_verify.

This corresponds to SSL_set_verify.

pub fn set_verify_depth(&mut self, depth: u32)

Sets the certificate verification depth.

If the peer’s certificate chain is longer than this value, verification will fail.

This corresponds to SSL_set_verify_depth.

pub fn verify_mode(&self) -> SslVerifyMode

Returns the verify mode that was set using set_verify.

This corresponds to SSL_get_verify_mode.

pub fn set_verify_callback<F>(&mut self, mode: SslVerifyMode, callback: F)

where F: Fn(bool, &mut X509StoreContextRef) -> bool + 'static + Sync + Send,

Like SslContextBuilder::set_verify_callback.

Warning: This callback does not replace the default certificate verification process and is, instead, called multiple times in the course of that process. It is very difficult to implement this callback correctly, without inadvertently relying on implementation details or making incorrect assumptions about when the callback is called.

Instead, use SslContextBuilder::set_custom_verify_callback to customize certificate verification. Those callbacks can inspect the peer-sent chain, call X509StoreContextRef::verify_cert and inspect the result, or perform other operations more straightforwardly.

Panics

This method panics if this Ssl is associated with a RPK context.

This corresponds to SSL_set_verify.

pub fn set_verify_cert_store( &mut self, cert_store: X509Store, ) -> Result<(), ErrorStack>

Sets a custom certificate store for verifying peer certificates.

This corresponds to SSL_set0_verify_cert_store.

pub fn set_custom_verify_callback<F>( &mut self, mode: SslVerifyMode, callback: F, )

where F: Fn(&mut SslRef) -> Result<(), SslVerifyError> + 'static + Sync + Send,

Like SslContextBuilder::set_custom_verify_callback.

Panics

This method panics if this Ssl is associated with a RPK context.

This corresponds to SSL_set_custom_verify.

pub fn set_tmp_dh(&mut self, dh: &DhRef<Params>) -> Result<(), ErrorStack>

Like SslContextBuilder::set_tmp_dh.

This corresponds to SSL_set_tmp_dh.

pub fn set_tmp_ecdh(&mut self, key: &EcKeyRef<Params>) -> Result<(), ErrorStack>

Like SslContextBuilder::set_tmp_ecdh.

This corresponds to SSL_set_tmp_ecdh.

pub fn set_permute_extensions(&mut self, enabled: bool)

Configures whether ClientHello extensions should be permuted.

This corresponds to SSL_set_permute_extensions.

Note: This is gated to non-fips because the fips feature builds with a separate version of BoringSSL which doesn’t yet include these APIs. Once the submoduled fips commit is upgraded, these gates can be removed.

pub fn set_alpn_protos(&mut self, protocols: &[u8]) -> Result<(), ErrorStack>

Like SslContextBuilder::set_alpn_protos.

This corresponds to SSL_set_alpn_protos.

pub fn ciphers(&self) -> &StackRef<SslCipher>

Returns the stack of available SslCiphers for SSL, sorted by preference.

This corresponds to SSL_get_ciphers.

pub fn current_cipher(&self) -> Option<&SslCipherRef>

Returns the current cipher if the session is active.

This corresponds to SSL_get_current_cipher.

pub fn state_string(&self) -> &'static str

Returns a short string describing the state of the session.

This corresponds to SSL_state_string.

pub fn state_string_long(&self) -> &'static str

Returns a longer string describing the state of the session.

This corresponds to SSL_state_string_long.

pub fn set_hostname(&mut self, hostname: &str) -> Result<(), ErrorStack>

Sets the host name to be sent to the server for Server Name Indication (SNI).

It has no effect for a server-side connection.

This corresponds to SSL_set_tlsext_host_name.

pub fn peer_certificate(&self) -> Option<X509>

Returns the peer’s certificate, if present.

This corresponds to SSL_get_peer_certificate.

pub fn peer_cert_chain(&self) -> Option<&StackRef<X509>>

Returns the certificate chain of the peer, if present.

On the client side, the chain includes the leaf certificate, but on the server side it does not. Fun!

This corresponds to SSL_get_peer_certificate.

pub fn certificate(&self) -> Option<&X509Ref>

Like [SslContext::certificate].

This corresponds to SSL_get_certificate.

pub fn private_key(&self) -> Option<&PKeyRef<Private>>

Like [SslContext::private_key].

This corresponds to SSL_get_privatekey.

pub fn version(&self) -> &str

👎Deprecated since 0.10.5: renamed to version_str

pub fn version2(&self) -> Option<SslVersion>

Returns the protocol version of the session.

This corresponds to SSL_version.

pub fn version_str(&self) -> &'static str

Returns a string describing the protocol version of the session.

This corresponds to SSL_get_version.

pub fn set_min_proto_version( &mut self, version: Option<SslVersion>, ) -> Result<(), ErrorStack>

Sets the minimum supported protocol version.

If version is None, the default minimum version is used. For BoringSSL this defaults to TLS 1.0.

This corresponds to SSL_set_min_proto_version.

pub fn set_max_proto_version( &mut self, version: Option<SslVersion>, ) -> Result<(), ErrorStack>

Sets the maximum supported protocol version.

If version is None, the default maximum version is used. For BoringSSL this is TLS 1.3.

This corresponds to SSL_set_max_proto_version.

pub fn min_proto_version(&mut self) -> Option<SslVersion>

Gets the minimum supported protocol version.

This corresponds to SSL_get_min_proto_version.

pub fn max_proto_version(&self) -> Option<SslVersion>

Gets the maximum supported protocol version.

This corresponds to SSL_get_max_proto_version.

pub fn selected_alpn_protocol(&self) -> Option<&[u8]>

Returns the protocol selected via Application Layer Protocol Negotiation (ALPN).

The protocol’s name is returned is an opaque sequence of bytes. It is up to the client to interpret it.

This corresponds to SSL_get0_alpn_selected.

pub fn set_tlsext_use_srtp(&mut self, protocols: &str) -> Result<(), ErrorStack>

Enables the DTLS extension “use_srtp” as defined in RFC5764.

This corresponds to SSL_set_tlsext_use_srtp.

pub fn srtp_profiles(&self) -> Option<&StackRef<SrtpProtectionProfile>>

Gets all SRTP profiles that are enabled for handshake via set_tlsext_use_srtp

DTLS extension “use_srtp” as defined in RFC5764 has to be enabled.

This corresponds to SSL_get_strp_profiles.

pub fn selected_srtp_profile(&self) -> Option<&SrtpProtectionProfileRef>

Gets the SRTP profile selected by handshake.

DTLS extension “use_srtp” as defined in RFC5764 has to be enabled.

This corresponds to SSL_get_selected_srtp_profile.

pub fn pending(&self) -> usize

Returns the number of bytes remaining in the currently processed TLS record.

If this is greater than 0, the next call to read will not call down to the underlying stream.

This corresponds to SSL_pending.

pub fn servername(&self, type_: NameType) -> Option<&str>

Returns the servername sent by the client via Server Name Indication (SNI).

It is only useful on the server side.

Note

While the SNI specification requires that servernames be valid domain names (and therefore ASCII), OpenSSL does not enforce this restriction. If the servername provided by the client is not valid UTF-8, this function will return None. The servername_raw method returns the raw bytes and does not have this restriction.

This corresponds to SSL_get_servername.

pub fn servername_raw(&self, type_: NameType) -> Option<&[u8]>

Returns the servername sent by the client via Server Name Indication (SNI).

It is only useful on the server side.

Note

Unlike servername, this method does not require the name be valid UTF-8.

This corresponds to SSL_get_servername.

pub fn set_ssl_context(&mut self, ctx: &SslContextRef) -> Result<(), ErrorStack>

Changes the context corresponding to the current connection.

It is most commonly used in the Server Name Indication (SNI) callback.

This corresponds to SSL_set_SSL_CTX.

pub fn ssl_context(&self) -> &SslContextRef

Returns the context corresponding to the current connection.

This corresponds to SSL_get_SSL_CTX.

pub fn verify_param_mut(&mut self) -> &mut X509VerifyParamRef

Returns a mutable reference to the X509 verification configuration.

This corresponds to SSL_get0_param.

pub fn param_mut(&mut self) -> &mut X509VerifyParamRef

See Self::verify_param_mut.

pub fn verify_result(&self) -> Result<(), X509VerifyError>

Returns the certificate verification result.

This corresponds to SSL_get_verify_result.

pub fn session(&self) -> Option<&SslSessionRef>

Returns a shared reference to the SSL session.

This corresponds to SSL_get_session.

pub fn client_random(&self, buf: &mut [u8]) -> usize

Copies the client_random value sent by the client in the TLS handshake into a buffer.

Returns the number of bytes copied, or if the buffer is empty, the size of the client_random value.

This corresponds to SSL_get_client_random.

pub fn server_random(&self, buf: &mut [u8]) -> usize

Copies the server_random value sent by the server in the TLS handshake into a buffer.

Returns the number of bytes copied, or if the buffer is empty, the size of the server_random value.

This corresponds to SSL_get_server_random.

pub fn export_keying_material( &self, out: &mut [u8], label: &str, context: Option<&[u8]>, ) -> Result<(), ErrorStack>

Derives keying material for application use in accordance to RFC 5705.

This corresponds to SSL_export_keying_material.

pub unsafe fn set_session( &mut self, session: &SslSessionRef, ) -> Result<(), ErrorStack>

Sets the session to be used.

This should be called before the handshake to attempt to reuse a previously established session. If the server is not willing to reuse the session, a new one will be transparently negotiated.

Safety

The caller of this method is responsible for ensuring that the session is associated with the same SslContext as this Ssl.

This corresponds to SSL_set_session.

pub fn session_reused(&self) -> bool

Determines if the session provided to set_session was successfully reused.

This corresponds to SSL_session_reused.

pub fn set_status_type(&mut self, type_: StatusType) -> Result<(), ErrorStack>

Sets the status response a client wishes the server to reply with.

This corresponds to SSL_set_tlsext_status_type.

pub fn ocsp_status(&self) -> Option<&[u8]>

Returns the server’s OCSP response, if present.

This corresponds to SSL_get_tlsext_status_ocsp_resp.

pub fn set_ocsp_status(&mut self, response: &[u8]) -> Result<(), ErrorStack>

Sets the OCSP response to be returned to the client.

This corresponds to SSL_set_tlsext_status_ocsp_resp.

pub fn is_server(&self) -> bool

Determines if this Ssl is configured for server-side or client-side use.

This corresponds to SSL_is_server.

pub fn set_ex_data<T>(&mut self, index: Index<Ssl, T>, data: T)

Sets the extra data at the specified index.

This can be used to provide data to callbacks registered with the context. Use the Ssl::new_ex_index method to create an Index.

Note that if this method is called multiple times with the same index, any previous value stored in the SslContextBuilder will be leaked.

This corresponds to SSL_set_ex_data.

pub fn replace_ex_data<T>(&mut self, index: Index<Ssl, T>, data: T) -> Option<T>

Sets or overwrites the extra data at the specified index.

This can be used to provide data to callbacks registered with the context. Use the Ssl::new_ex_index method to create an Index.

Any previous value will be dropped and replaced by the new one.

This corresponds to SSL_set_ex_data.

pub fn ex_data<T>(&self, index: Index<Ssl, T>) -> Option<&T>

Returns a reference to the extra data at the specified index.

This corresponds to SSL_get_ex_data.

pub fn ex_data_mut<T>(&mut self, index: Index<Ssl, T>) -> Option<&mut T>

Returns a mutable reference to the extra data at the specified index.

This corresponds to SSL_get_ex_data.

pub fn finished(&self, buf: &mut [u8]) -> usize

Copies the contents of the last Finished message sent to the peer into the provided buffer.

The total size of the message is returned, so this can be used to determine the size of the buffer required.

This corresponds to SSL_get_finished.

pub fn peer_finished(&self, buf: &mut [u8]) -> usize

Copies the contents of the last Finished message received from the peer into the provided buffer.

The total size of the message is returned, so this can be used to determine the size of the buffer required.

This corresponds to SSL_get_peer_finished.

pub fn is_init_finished(&self) -> bool

Determines if the initial handshake has been completed.

This corresponds to SSL_is_init_finished.

pub fn set_mtu(&mut self, mtu: u32) -> Result<(), ErrorStack>

Sets the MTU used for DTLS connections.

This corresponds to SSL_set_mtu.

pub fn set_certificate(&mut self, cert: &X509Ref) -> Result<(), ErrorStack>

Sets the certificate.

This corresponds to SSL_use_certificate.

pub fn set_client_ca_list(&mut self, list: Stack<X509Name>)

Sets the list of CA names sent to the client.

The CA certificates must still be added to the trust root - they are not automatically set as trusted by this method.

This corresponds to SSL_set_client_CA_list.

pub fn set_private_key<T>(&mut self, key: &PKeyRef<T>) -> Result<(), ErrorStack>

where T: HasPrivate,

Sets the private key.

This corresponds to SSL_use_PrivateKey.

pub fn set_mode(&mut self, mode: SslMode) -> SslMode

Enables all modes set in mode in SSL. Returns a bitmask representing the resulting enabled modes.

This corresponds to SSL_set_mode.

pub fn clear_mode(&mut self, mode: SslMode) -> SslMode

Disables all modes set in mode in SSL. Returns a bitmask representing the resulting enabled modes.

This corresponds to SSL_clear_mode.

pub fn add_chain_cert(&mut self, cert: &X509Ref) -> Result<(), ErrorStack>

Appends cert to the chain associated with the current certificate of SSL.

This corresponds to SSL_add1_chain_cert.

Trait Implementations

impl AsMut<SslRef> for Ssl

fn as_mut(&mut self) -> &mut SslRef

Converts this type into a mutable reference of the (usually inferred) input type.

impl AsRef<SslRef> for Ssl

fn as_ref(&self) -> &SslRef

Converts this type into a shared reference of the (usually inferred) input type.

impl Borrow<SslRef> for Ssl

fn borrow(&self) -> &SslRef

Immutably borrows from an owned value.

impl BorrowMut<SslRef> for Ssl

fn borrow_mut(&mut self) -> &mut SslRef

Mutably borrows from an owned value.

impl Debug for Ssl

fn fmt(&self, fmt: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Deref for Ssl

type Target = SslRef

The resulting type after dereferencing.

fn deref(&self) -> &SslRef

Dereferences the value.

impl DerefMut for Ssl

fn deref_mut(&mut self) -> &mut SslRef

Mutably dereferences the value.

impl Drop for Ssl

fn drop(&mut self)

Executes the destructor for this type.

impl ForeignType for Ssl

type CType = ssl_st

The raw C type.

type Ref = SslRef

The type representing a reference to this type.

unsafe fn from_ptr(ptr: *mut ssl_st) -> Ssl

Constructs an instance of this type from its raw type.

fn as_ptr(&self) -> *mut ssl_st

Returns a raw pointer to the wrapped value.

fn into_ptr(self) -> *mut Self::CType

Consumes the wrapper and returns the raw pointer.

impl Send for Ssl

impl Sync for Ssl