tls-listener

Fixed

• Add cfg cond for unix on UnixListener (#64)

Full Changelog: v0.11.1...v0.11.2

Fixed

• Add cfg cond for unix on UnixListener (#64)

What's Changed

• feat: Add listener() method by @tmccombs in #55
• Add axum example by @SabrinaJewson in #54
• Use .listener() in the axum example by @SabrinaJewson in #56
• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #59
• feat: accept_generator fn by @tmccombs in #60
• Axum support by @tmccombs in #61
• chore: Prepare for 0.11.1 release by @tmccombs in #62

Full Changelog: v0.11.0...v0.11.1

Features

• Add listener() method

• Accept_generator fn

• Add AsyncListener trait

• Axum support

What's Changed

• Breaking change: Minimum supported version of tokio-rustls is 0.26
• Updated to edition 2021

Full Changelog: v0.10.3...v0.11.0

What's Changed

• Update thiserror requirement from 1.0.30 to 2.0.3 by @dependabot in #48
• Doc fixes by @tmccombs in #50
• Auto publish by @tmccombs in #51

Full Changelog: v0.10.2...v0.10.3-1

What's Changed

• Stop automatically pulling in aws-lc as a dependency by @OverShifted in #46

New Contributors

• @OverShifted made their first contribution in #46

Full Changelog: v0.10.1...v0.10.2

What's Changed

• Allow using tokio-rustls 0.26 by @tmccombs in #45

Full Changelog: v0.10.0...v0.10.1

Security Advisory

Versions prior to this using the default configuration are vulnerable to a Slowloris attack.

This version mitigates the vulnerability.

Previous versions can mitigate the vulnerability by increasing the value passed to Builder::max_handshakes to a large
number (such as usize::MAX). Decreasing the handshake_timeout can also help, although it is still strongly recommended
to increase the max_handshakes more than the current default.

Changes

• [breaking] Change poll_accept not to have a limit on the number of pending handshakes in the queue,
  so that connections that are not making progress towards completing the handshake will not block other
  connections from being accepted. This replaces Builder::max_handshakes with Builder::accept_batch_size.

Security Advisory

Versions prior to this using the default configuration are vulnerable to a Slowloris attack.

This version mitigates the vulnerability.

Previous versions can mitigate the vulnerability by increasing the value passed to Builder::max_handshakes to a large number (such as usize::MAX). Decreasing the handshake_timeout can also help, although it is still strongly recommended to increase the max_handshakes more than the current default.

Changes

• [breaking] Change poll_accept not to have a limit on the number of pending handshakes in the queue, so that connections that are not making progress towards completing the handshake will not block other connections from being accepted. This replaces Builder::max_handshakes with Builder::accept_batch_size.

Miscellaneous Tasks

• Update tokio-rustls

Features

• [breaking] Remove until & remove option from accept
  • BREAKING CHANGE: remove until from AsyncAccept trait. Use StreamExt.take_until on the TlsListener instead.
  • BREAKING CHANGE: accept fn on AsyncAccept trait no longer returns an Option
  • BREAKING CHANGE: accept fn on TlsListener no longer returns an Option

Upgrade

• [breaking] Update to hyper 1.0
  • BREAKING CHANGE: Removed hyper-h1 and hyper-h2 features

This is a backwards incompatible release. The main change is that accepting a new connection now returns a tuple of the new connection, and the peer address. The AsyncAccept trait was also changed similarly. The Error enum was also changed to provide more details about the error. And if the handshake times out, it now returns an error instead of silently waiting for the next connection.

Features

• [breaking] Add a new error type for handshake timeouts

  • BREAKING CHANGE: Adds a new variant to the Error Enum
  • BREAKING CHANGE: The Error enum is now non_exhaustive
  • BREAKING CHANGE: Now returns an error if a handshake times out

• [breaking] Yield remote address upon accepting a connection, and include it in errors.

  • BREAKING CHANGE: The enum variant Error::ListenerError is now struct-like instead of tuple-like, and is non_exhaustive like the enum itself.
  • BREAKING CHANGE: Error now has three type parameters, not two.
  • BREAKING CHANGE: TlsListener::accept and <TlsListener as Stream>::next yields a tuple of (connection, remote address), not just the connection.
  • BREAKING CHANGE: AsyncAccept now has an associated type Address, which poll_accept must now return along with the accepted connection.

• [breaking] More changes for including peer address in response

  • BREAKING CHANGE: AsyncAccept::Error must implement std::error::Error
  • BREAKING CHANGE: TlsAcceptError is now a struct form variant.

Changed

• Increase tokio-rustls version to 0.24.0

Added

• Added additional tests and examples
• Re-export tls engine crates as public modules.

Changed

• Increased default handshake timeout to 10 seconds (technically a breaking change)

Added

• Support for openssl

Fixed

• Fixed compilation on non-unix environments, where tokio-net doesn't include unix sockets
• SpawningHandshakes will abort the tasks for pending connections when the linked futures are dropped. This should allow timeouts to cause the connectionto be closed.

Added

• Added [AsyncAccept::until] method, that creates a new AsyncAccept that will stop accepting connections after another future finishes.
• Added hyper submodule to add additional support for hyper. Specifically, a newtype for the hyper Accept trait for AsyncAccept.
• Added SpawningHandshakes struct behind the rt feature flag. This allows you to perform multiple handshakes in parallel with a multi-threaded runtime.

Changed

• Backwards incompatible: AsyncAccept::poll_accept now returns, Poll<Option<Result<...>>> instead of Poll<Result<...>>. This allows the incoming stream of connections to stop, for example, if a graceful shutdown has been initiated. impls provided by this crate have been updated, but custom implementations of AsyncAccept, or direct usage of the trait may break.
• Removed unnecessary type bounds (see #14). Potentially a breaking change, although I'd be suprised if any real code was affected.

• Added TlsListener::replace_accept_pin() function to allow replacing the listener certificate at runtime, when the listener is pinned.

Added

• Added TlsListener::replace_acceptor() function to allow replacing the listener certificate at runtime.

Changed

• The implementation of AsyncTls for tokio_native_tls::TlsAcceptor now requires the connection type to implement Send. This in turn allows TlsListener to be Send when using the native-tls feature. Technically, this is a breaking change. However, in practice it is unlikely to break existing code and makes using TlsListener much easier to use when native-tls is enabled.

NOTE: This release contains several breaking changes.

Added

• Support for native-tls.

Changed

• The TLS backend is now configurable. Both rustls and native-tls are supported. Other backends can also be used by implementing the AsyncTls trait.
  • You must now supply either the rustls or native-tls features to get support for a tls backend.
  • Unfortunately, the machinery for this required adding an additional type parameter to TlsListener.
• The TlsListener stream now returns a tls_listener::Error instead of std::io::Error type.
• Signatures of TcpListener::new() and builder() have changed to now take an argument of the TLS type rather than a rustls::ServerConfig, to update existing calls, replace builder(config) with builder(Arc::new(config).into()).

Fixed

• Crate will now compile when linked against a target that doesn't explicitly enable the tokio/time and hyper/tcp features.