feat(tls): implement TLS module for secure connections #1273
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sytten
reviewed
Dec 5, 2025
chessbyte
force-pushed
the
feat/tls-module
branch
from
dafeb0f to
44f3cbf
Compare
chessbyte
force-pushed
the
feat/tls-module
branch
2 times, most recently
from
824bdaf to
2319678
Compare
richarddavison
requested changes
Dec 11, 2025
Collaborator
richarddavison
left a comment
richarddavison
left a comment
There was a problem hiding this comment.
I think we can reduce duplication a bit by using the Socket from llrt_net as an inner field on TLSSocket
Contributor
Author
|
@richarddavison @Sytten tried to address your concerns in 2nd commit
|
chessbyte
commented
Dec 11, 2025
chessbyte
force-pushed
the
feat/tls-module
branch
from
1b4f0db to
df5ec4c
Compare
Add client-side TLS support with the following features: - tls.connect() for creating secure outbound connections - tls.createSecureContext() for reusable TLS configurations - TLSSocket class with full event support (secureConnect, data, end, close, error, keylog) - Custom CA certificates for private PKI - Client certificate authentication (mTLS) for zero-trust environments - ALPN protocol negotiation for HTTP/2 support - TLS version control (minVersion/maxVersion) - SNI (Server Name Indication) support - keylog event for TLS debugging with Wireshark - getCiphers(), checkServerIdentity(), rootCertificates This implementation focuses on Lambda-relevant client-side functionality. Server-side APIs (createServer, Server class) are intentionally omitted as they are not applicable to serverless environments. Fixes awslabs#1 Fixes awslabs#1102
- Consolidate TLSSocket with llrt_net by sharing common types (ReadyState, LOCALHOST, get_hostname, rw_join) from llrt_net - Merge SecureContextOptions into BuildClientConfigOptions to reduce duplication between tls and http modules - Replace custom hex_encode with llrt_encoding::bytes_to_hex_string - Use [].concat() pattern for string formatting in keylog.rs - Capture actual cipher/protocol info from TLS connection after handshake instead of returning hardcoded values - Add clarifying comment for servername SNI requirement
- Add min_version/max_version options to filter TLS protocol versions - Add ciphers option to filter cipher suites using OpenSSL-style names - Implement reverse mapping from OpenSSL cipher names to rustls suites - Update build_client_config to apply cipher and version filtering
chessbyte
force-pushed
the
feat/tls-module
branch
from
6e27ae8 to
f5e0a36
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue # (if available)
Fixes #1
Fixes #1102
Description of changes
Add client-side TLS support with the following features:
This implementation focuses on Lambda-relevant client-side functionality. Server-side APIs (createServer, Server class) are intentionally omitted as they are not applicable to serverless environments.
Checklist
tests/unitand/or in Rust for my feature if neededmake fixto format JS and apply Clippy auto fixesmake checktypes/directoryBy submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.