silk.tls.server_protocol.

Serve TLS 1.3 on a silk.net.tcp_server engine, with the certificate chain and private key loaded from PEM text.

When to use#

Use TlsProtocol to run any silk.net.tcp_server protocol over TLS, as the HTTPS mode of silk.http.serve does. Load the certificate chain and the private key one time with TlsServerConfig.fromPem, and share the config across all connections and workers.

Details#

Each connection runs one silk.tls.server Server: the handshake, the record layer, KeyUpdate and close_notify all come from it. The protocol decrypts the bytes that arrive and gives them to the inner protocol, and encrypts what the inner protocol writes. When the inner protocol closes the connection, it sends close_notify first. The server offers ALPN http/1.1 without requiring it.

The private key is an ECDSA P-256 or P-384 key, in a PRIVATE KEY (PKCS #8) or EC PRIVATE KEY (SEC 1) block.

Errors#

  • TlsConfigError from TlsServerConfig.fromPem for PEM text that it cannot use.

  • A TLS error on a connection closes that connection without an alert.

  • OutOfMemoryError if a buffer cannot grow.

Gotchas#

The server does not check its own chain. Give the leaf certificate first. Secrets are not erased.

Import as TlsProtocol with import silk.tls.server_protocol { TlsProtocol }.

Public declarations: 4.

TlsConfigError#

silk
pub enum TlsConfigError

Why TlsServerConfig.fromPem cannot use its input.

NoCertificate#

silk
NoCertificate

The certificate text holds no CERTIFICATE block.

InvalidPem#

silk
InvalidPem

A PEM block is malformed, or its base64 is not valid.

UnsupportedKey#

silk
UnsupportedKey

The key text holds no PRIVATE KEY or EC PRIVATE KEY block with a P-256 or P-384 key.

ChainTooLarge#

silk
ChainTooLarge

The chain is larger than the server allows.

InvalidCertificate#

silk
InvalidCertificate

The leaf certificate cannot be decoded.

KeyMismatch#

silk
KeyMismatch

The public key of the leaf certificate is not the public key of the private key.

Implementation Debug for TlsConfigError#

silk
impl Debug for TlsConfigError

Operation debug#

silk
effect fn debug(self: &Self, formatter: &mut Formatter) -> () ! WriterError ? &mut Writer

Writes the name of the variant, such as NoCertificate.

TlsServerConfig#

silk
pub struct TlsServerConfig

The certificate chain and the private key of a server. One config serves every connection and every worker.

Implementation TlsServerConfig#

silk
impl TlsServerConfig

Associated function fromPem#

silk
pub effect fn fromPem(certificates: &[u8], privateKey: &[u8]) -> TlsServerConfig
  ! TlsConfigError | OutOfMemoryError ? &mut Allocator

Reads the certificate chain from the CERTIFICATE blocks of certificates, leaf first, and the private key from the first PRIVATE KEY (PKCS #8) or EC PRIVATE KEY (SEC 1) block of privateKey.

Details#

It makes one silk.tls.server Server to check the chain and the key, so a config that loads serves every connection.

Errors#

  • NoCertificate, InvalidPem, UnsupportedKey, ChainTooLarge, InvalidCertificate or KeyMismatch for input it cannot use.

  • OutOfMemoryError if the chain cannot be stored.

TlsProtocol#

silk
pub struct TlsProtocol<P>

A silk.net.tcp_server protocol that serves TLS 1.3 and runs inner over the decrypted bytes.

Details#

For each connection it makes a silk.tls.server Server and the state of inner. Bytes that arrive are decrypted and given to inner, and what inner writes is encrypted. When inner closes the connection, the server sends close_notify first.

Implementation TlsProtocol<P>#

silk
impl<P> TlsProtocol<P>

Associated function make#

silk
pub fn make(config: TlsServerConfig, inner: P) -> TlsProtocol<P>

Returns a protocol that serves inner over TLS with config.

TlsSession#

silk
pub struct TlsSession<S>

The state of one connection of a TlsProtocol.

Implementation Protocol<TlsSession<S>> for TlsProtocol<P>#

silk
impl<S, P: Protocol<S>> Protocol<TlsSession<S>> for TlsProtocol<P>

Operation open#

silk
effect fn open(self: &Self) -> TlsSession<S> ! OutOfMemoryError ? &mut Allocator

Operation receive#

silk
effect fn receive(
    self: &Self,
    state: &mut TlsSession<S>,
    input: &mut [u8],
    ended: bool,
    output: &mut List<u8>,
  ) -> Received ! OutOfMemoryError ? &mut Allocator

Category: TLS and certificates.

Profiles: aarch64-apple-darwin, aarch64-unknown-linux-gnu, aarch64-unknown-linux-gnu-no-libc, x86_64-unknown-linux-gnu, x86_64-unknown-linux-gnu-no-libc, wasm32-unknown-unknown, wasm32-wasip1, wasm32-wasip2, x86_64-pc-windows-msvc, wasm64-unknown-unknown.

View the source of this page