rustunnel/droid-wiki/systems/tls-stack.md

TLS stack

The TLS stack in src/tls.rs configures rustls for both server (listener) and client (connector) roles with mutual TLS.

Purpose

Provide safe, fail-closed TLS configuration builders that load certificates and keys, validate certificate identities, and support both secure and insecure (lab-only) modes.

Key abstractions

Type/Function	File	Description
build_server_config	src/tls.rs	Build a rustls ServerConfig with client certificate verification
build_client_config	src/tls.rs	Build a rustls ClientConfig with server certificate verification
build_server_config_insecure	src/tls.rs	Build a server config that skips client cert verification
build_client_config_insecure	src/tls.rs	Build a client config that skips server cert verification
load_certs	src/tls.rs	Load PEM-encoded certificates from a file
load_key	src/tls.rs	Load a PEM-encoded private key from a file
validate_cert_identity	src/tls.rs	Check SANs and CN against an expected hostname
check_cert_not_expired	src/tls.rs	Verify certificate validity period
cert_fingerprint_sha256	src/tls.rs	Compute SHA-256 fingerprint of a certificate
InsecureServerCertVerifier	src/tls.rs	Dangerous verifier that accepts any certificate

How it works

Server config building:

1. Load the server certificate chain and private key.
2. Load the CA certificate into a RootCertStore.
3. Build a WebPkiClientVerifier from the root store.
4. Use ServerConfig::builder().with_client_cert_verifier(...).with_single_cert(...).

Client config building:

1. Load the client certificate chain and private key.
2. Load the CA certificate into a RootCertStore.
3. Use ClientConfig::builder().with_root_certificates(...).with_client_auth_cert(...).

Identity validation uses x509-parser to extract Subject Alternative Names and the subject CN, matching against the expected hostname or IP address.

Key source files

File	Purpose
src/tls.rs	TLS configuration, certificate loading, identity validation