Struct rustls::server::ServerConfig
source · pub struct ServerConfig {Show 16 fields
pub ignore_client_order: bool,
pub max_fragment_size: Option<usize>,
pub session_storage: Arc<dyn StoresServerSessions>,
pub ticketer: Arc<dyn ProducesTickets>,
pub cert_resolver: Arc<dyn ResolvesServerCert>,
pub alpn_protocols: Vec<Vec<u8>>,
pub key_log: Arc<dyn KeyLog>,
pub enable_secret_extraction: bool,
pub max_early_data_size: u32,
pub send_half_rtt_data: bool,
pub send_tls13_tickets: usize,
pub require_ems: bool,
pub time_provider: Arc<dyn TimeProvider>,
pub cert_compressors: Vec<&'static dyn CertCompressor>,
pub cert_compression_cache: Arc<CompressionCache>,
pub cert_decompressors: Vec<&'static dyn CertDecompressor>,
/* private fields */
}
Expand description
Common configuration for a set of server sessions.
Making one of these is cheap, though one of the inputs may be expensive: gathering trust roots
from the operating system to add to the RootCertStore
passed to a ClientCertVerifier
builder may take on the order of a few hundred milliseconds.
These must be created via the ServerConfig::builder()
or ServerConfig::builder_with_provider()
function.
§Defaults
ServerConfig::max_fragment_size
: the default isNone
(meaning 16kB).ServerConfig::session_storage
: if thestd
feature is enabled, the default stores 256 sessions in memory. If thestd
feature is not enabled, the default is to not store any sessions. In a no-std context, by enabling thehashbrown
feature you may provide your ownsession_storage
usingServerSessionMemoryCache
and acrate::lock::MakeMutex
implementation.ServerConfig::alpn_protocols
: the default is empty – no ALPN protocol is negotiated.ServerConfig::key_log
: key material is not logged.ServerConfig::send_tls13_tickets
: 4 tickets are sent.ServerConfig::cert_compressors
: depends on the crate features, seecompress::default_cert_compressors()
.ServerConfig::cert_compression_cache
: caches the most recently used 4 compressionsServerConfig::cert_decompressors
: depends on the crate features, seecompress::default_cert_decompressors()
.
Fields§
§ignore_client_order: bool
Ignore the client’s ciphersuite order. Instead, choose the top ciphersuite in the server list which is supported by the client.
max_fragment_size: Option<usize>
The maximum size of plaintext input to be emitted in a single TLS record. A value of None is equivalent to the TLS maximum of 16 kB.
rustls enforces an arbitrary minimum of 32 bytes for this field. Out of range values are reported as errors from ServerConnection::new.
Setting this value to a little less than the TCP MSS may improve latency for stream-y workloads.
session_storage: Arc<dyn StoresServerSessions>
How to store client sessions.
ticketer: Arc<dyn ProducesTickets>
How to produce tickets.
cert_resolver: Arc<dyn ResolvesServerCert>
How to choose a server cert and key. This is usually set by ConfigBuilder::with_single_cert or ConfigBuilder::with_cert_resolver. For async applications, see also Acceptor.
alpn_protocols: Vec<Vec<u8>>
Protocol names we support, most preferred first. If empty we don’t do ALPN at all.
key_log: Arc<dyn KeyLog>
How to output key material for debugging. The default does nothing.
enable_secret_extraction: bool
Allows traffic secrets to be extracted after the handshake, e.g. for kTLS setup.
max_early_data_size: u32
Amount of early data to accept for sessions created by this config. Specify 0 to disable early data. The default is 0.
Read the early data via ServerConnection::early_data
.
The units for this are both plaintext bytes, and ciphertext bytes, depending on whether the server accepts a client’s early_data or not. It is therefore recommended to include some slop in this value to account for the unknown amount of ciphertext expansion in the latter case.
send_half_rtt_data: bool
Whether the server should send “0.5RTT” data. This means the server sends data after its first flight of handshake messages, without waiting for the client to complete the handshake.
This can improve TTFB latency for either server-speaks-first protocols,
or client-speaks-first protocols when paired with “0RTT” data. This
comes at the cost of a subtle weakening of the normal handshake
integrity guarantees that TLS provides. Note that the initial
ClientHello
is indirectly authenticated because it is included
in the transcript used to derive the keys used to encrypt the data.
This only applies to TLS1.3 connections. TLS1.2 connections cannot do this optimisation and this setting is ignored for them. It is also ignored for TLS1.3 connections that even attempt client authentication.
This defaults to false. This means the first application data
sent by the server comes after receiving and validating the client’s
handshake up to the Finished
message. This is the safest option.
send_tls13_tickets: usize
How many TLS1.3 tickets to send immediately after a successful handshake.
Because TLS1.3 tickets are single-use, this allows a client to perform multiple resumptions.
The default is 4.
If this is 0, no tickets are sent and clients will not be able to do any resumption.
require_ems: bool
If set to true
, requires the client to support the extended
master secret extraction method defined in RFC 7627.
The default is true
if the “fips” crate feature is enabled,
false
otherwise.
It must be set to true
to meet FIPS requirement mentioned in section
D.Q Transition of the TLS 1.2 KDF to Support the Extended Master
Secret from FIPS 140-3 IG.pdf.
time_provider: Arc<dyn TimeProvider>
Provides the current system time
cert_compressors: Vec<&'static dyn CertCompressor>
How to compress the server’s certificate chain.
If a client supports this extension, and advertises support for one of the compression algorithms included here, the server certificate will be compressed according to RFC8779.
This only applies to TLS1.3 connections. It is ignored for TLS1.2 connections.
cert_compression_cache: Arc<CompressionCache>
Caching for compressed certificates.
This is optional: compress::CompressionCache::Disabled
gives
a cache that does no caching.
cert_decompressors: Vec<&'static dyn CertDecompressor>
How to decompress the clients’s certificate chain.
If this is non-empty, the RFC8779 certificate compression extension is offered when requesting client authentication, and any compressed certificates are transparently decompressed during the handshake.
This only applies to TLS1.3 connections. It is ignored for TLS1.2 connections.
Implementations§
source§impl ServerConfig
impl ServerConfig
sourcepub fn builder() -> ConfigBuilder<Self, WantsVerifier>
pub fn builder() -> ConfigBuilder<Self, WantsVerifier>
Create a builder for a server configuration with
the process-default CryptoProvider
and safe protocol version defaults.
For more information, see the ConfigBuilder
documentation.
sourcepub fn builder_with_protocol_versions(
versions: &[&'static SupportedProtocolVersion],
) -> ConfigBuilder<Self, WantsVerifier>
pub fn builder_with_protocol_versions( versions: &[&'static SupportedProtocolVersion], ) -> ConfigBuilder<Self, WantsVerifier>
Create a builder for a server configuration with
the process-default CryptoProvider
and the provided protocol versions.
Panics if
- the supported versions are not compatible with the provider (eg. the combination of ciphersuites supported by the provider and supported versions lead to zero cipher suites being usable),
- if a
CryptoProvider
cannot be resolved using a combination of the crate features and process default.
For more information, see the ConfigBuilder
documentation.
sourcepub fn builder_with_provider(
provider: Arc<CryptoProvider>,
) -> ConfigBuilder<Self, WantsVersions>
pub fn builder_with_provider( provider: Arc<CryptoProvider>, ) -> ConfigBuilder<Self, WantsVersions>
Create a builder for a server configuration with a specific CryptoProvider
.
This will use the provider’s configured ciphersuites. You must additionally choose
which protocol versions to enable, using with_protocol_versions
or
with_safe_default_protocol_versions
and handling the Result
in case a protocol
version is not supported by the provider’s ciphersuites.
For more information, see the ConfigBuilder
documentation.
sourcepub fn builder_with_details(
provider: Arc<CryptoProvider>,
time_provider: Arc<dyn TimeProvider>,
) -> ConfigBuilder<Self, WantsVersions>
pub fn builder_with_details( provider: Arc<CryptoProvider>, time_provider: Arc<dyn TimeProvider>, ) -> ConfigBuilder<Self, WantsVersions>
Create a builder for a server configuration with no default implementation details.
This API must be used by no_std
users.
You must provide a specific TimeProvider
.
You must provide a specific CryptoProvider
.
This will use the provider’s configured ciphersuites. You must additionally choose
which protocol versions to enable, using with_protocol_versions
or
with_safe_default_protocol_versions
and handling the Result
in case a protocol
version is not supported by the provider’s ciphersuites.
For more information, see the ConfigBuilder
documentation.
sourcepub fn fips(&self) -> bool
pub fn fips(&self) -> bool
Return true
if connections made with this ServerConfig
will
operate in FIPS mode.
This is different from CryptoProvider::fips()
: CryptoProvider::fips()
is concerned only with cryptography, whereas this also covers TLS-level
configuration that NIST recommends.
sourcepub fn crypto_provider(&self) -> &Arc<CryptoProvider>
pub fn crypto_provider(&self) -> &Arc<CryptoProvider>
Return the crypto provider used to construct this client configuration.
Trait Implementations§
source§impl Clone for ServerConfig
impl Clone for ServerConfig
source§fn clone(&self) -> ServerConfig
fn clone(&self) -> ServerConfig
1.0.0 · source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source
. Read moresource§impl Debug for ServerConfig
impl Debug for ServerConfig
impl ConfigSide for ServerConfig
Auto Trait Implementations§
impl Freeze for ServerConfig
impl !RefUnwindSafe for ServerConfig
impl Send for ServerConfig
impl Sync for ServerConfig
impl Unpin for ServerConfig
impl !UnwindSafe for ServerConfig
Blanket Implementations§
source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
source§unsafe fn clone_to_uninit(&self, dst: *mut T)
unsafe fn clone_to_uninit(&self, dst: *mut T)
clone_to_uninit
)