wasi-tls: Add OpenSSL backend #12228
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Wasmtime currently supports two wasi-tls providers: rustls & native-tls.
Having multiple backend implementations in a single place helps with being able to quickly iterate on the WIT interface and validate that we're not codifying some rustls-specific behavior/feature into the spec.
@rvolosatovs is looking at implementing wasi-tls for Python. But as predicted,
native-tlsis quickly showing its shortcomings. For example: it can't read the negotiated TLS version, which is needed to implement Python'sSSLSocket.version().This PR adds a third backend: OpenSSL. The
opensslcrate exposes a much larger API surface thannative-tlsdoes and will most likely be enough for wasi-tls' future needs.Depending on how restrictive the
wasmtime-wasi-tls-nativetlsimplementation ends up being, we might consider removing it altogether. For the time being it still works fine, so I've kept it.What matters to me is that we can demonstrate having two distinct TLS implementations working on all the three major platforms. As long as that criteria is being satisfied, I don't think it really matters whether that's
rustls+nativetlsorrustls+openssl.