Module client 

Available on crate feature tls only.

TLS implementation agnostic client types

ClientHello is used in Rama as the implementation agnostic type to convey what client hello was set by the incoming TLS Connection, if the server middleware is configured to store it.

By being implementation agnostic we have the advantage to be able to bridge easily between different implementations. Making it possible to run for example a Rustls proxy service but establish connections using BoringSSL.

Structs

ClientAuthData

Raw private key and certificate data to facilitate client authentication.

ClientHello

When a client first connects to a server, it is required to send the ClientHello as its first message.

DistrustedServerKeys

Reject server chains that contain any of a set of distrusted public keys.

DynTlsServerCertChainPolicy

A shared, type-erased TlsServerCertChainPolicy, as enforced by a TLS client. Every policy converts into one.

NegotiatedTlsAlgorithms

Algorithms selected by a TLS handshake.

NegotiatedTlsParameters

TLS parameters reported by either endpoint and stored in connection extensions. QUIC can expose this while the handshake progresses; optional values may become available later and do not imply handshake completion.

ServerCertChain

A server certificate chain handed to a TlsServerCertChainPolicy.

ServerChainCertificate

One certificate of a ServerCertChain.

TlsClientAuth

Client certificate authentication material (mTLS).

TlsClientConfig

A backend agnostic builder for the common TLS configs.

TlsComponentIdentity

Owning instance identity for components whose policy follows a shared object.

TlsConnectionReuse

Reuse rules published by the connector that performed a TLS handshake.

TlsDerivedPolicy

Caller policy for settings derived while opening an origin connection.

TlsPoolId

Compact, process-local identity of request-level TLS overrides.

TlsPoolIdBuilder

Build a backend-independent identity with shared presence and field encoding.

TlsServerAuthenticatedAliases

Additional server names the peer certificate of one established connection was verified for, under the same effective trust and pin policy as its primary.

TlsServerAuthentication

Server identity authenticated by the effective TLS verification policy.

TlsServerCertPinSet

One alternative group of server leaf pins, optionally scoped to server names.

TlsServerCertPins

Server leaf certificate pin sets accepted by a TLS client.

TlsServerName

Server identity used for certificate verification and, for DNS names, SNI.

TlsServerTrust

Server trust policy used with ServerVerifyMode::Auto.

TlsServerTrustAnchors

DER-encoded certificates used as TLS client server trust anchors.

TlsServerVerify

How the server certificate is verified.

TlsSessionProfileScope

Stable emulation profile identity for TLS session resumption.

TlsStoreServerCertChain

Whether to capture the peer certificate chain into NegotiatedTlsParameters.

TlsStoreServerHello

Whether to capture the server’s ServerHello into NegotiatedTlsParameters.

Enums

ClientAuth

The kind of client auth to be used.

ClientHandshake

Session offer for a new TLS connection, independent of ticket retention.

ClientHelloExtension

Extensions that can be set in a ClientHello message by a TLS client.

ClientHelloHandshakePrefix

Outcome of incrementally classifying a (possibly partial) TLS ClientHello handshake, for fail-fast protocol peeking.

ECHClientHello

Client Hello contents send by ech

ServerCertChainKind

How a ServerCertChain was obtained.

ServerTrustSource

Source of trust for normal server-certificate verification.

ServerVerifyMode

Mode of server verification by a (tls) client

TlsServerCertPin

A single accepted server leaf pin.

TlsServerIdentity

A server certificate identity resolved from a Host.

Traits

TlsClientConfigProvider

Classify the request overrides understood by a fixed TLS configuration provider.

TlsPoolComponent

Explicit pooling identity for a custom TLS configuration component.

TlsServerCertChainPolicy

A reject-only check of the server certificate chain.

Functions

client_hello_extension_is_connection_bound

Returns whether a ClientHello extension payload belongs to one connection.

extract_sni_from_client_hello_handshake

Parse a ClientHello from the raw incoming “wire” client handshake bytes to find the SNI Host value.

extract_sni_from_client_hello_record

Parse a ClientHello from the raw “wire” bytes to find the SNI Host value.

http_alpn_override

Resolve an explicit target HTTP version to an ALPN offer override.

merge_client_hello_lists

Merge extension lists A and B, with B overwriting any conflict with A, and otherwise push it to the back.

negotiated_http_version

Interpret negotiated ALPN for HTTP and validate the version policy.

parse_client_hello

Parse a ClientHello from the raw “wire” bytes.

parse_client_hello_handshake

Parse a ClientHello from the raw handshake “wire” bytes.

parse_client_hello_handshake_prefix

Incrementally classify a (possibly partial) TLS ClientHello handshake.

parse_client_hello_message_prefix

Incrementally classify a (possibly partial) bare TLS ClientHello handshake message: the handshake header and body with no TLS record layer in front, as QUIC carries in its CRYPTO stream (RFC 9001 §4.1).