Skip to content
This repository has been archived by the owner on Feb 3, 2023. It is now read-only.

Replace native-tls with rustls #1618

Open
lukateras opened this issue Jul 29, 2019 · 2 comments
Open

Replace native-tls with rustls #1618

lukateras opened this issue Jul 29, 2019 · 2 comments

Comments

@lukateras
Copy link
Contributor

lukateras commented Jul 29, 2019

native-tls seems to be one of the few remaining native dependencies. It wraps platform-specific TLS implementations (schannel on Windows, Security framework on macOS, OpenSSL on Linux).

There are several problems with that:

  1. All mentioned TLS implementations are memory unsafe.
  2. Native dependencies make compilation more complex, especially cross-compilation, especially cross-compilation to static executables.

It seems that net crate imports native-tls for reqwest. If that's the case, reqwest optionally supports rustls, pure Rust TLS implementation: seanmonstar/reqwest#378

Advantages:

  • Superior performance [1] [2] [3] [4]
  • Memory safety
  • Trivial to (cross-)compile

Disadvantages:

  • No old TLS versions, fewer ciphers implemented (focus of rustls is on safe defaults): OTOH, for holochain-rust use case, this is probably a good thing, and makes downgrade attacks less effective
  • Did not go through rigorous security audit (although attack surface is smaller)
@lukateras
Copy link
Contributor Author

cc @thedavidmeister

@lukateras
Copy link
Contributor Author

In particular, this currently blocks us from building for aarch64-unknown-linux-musl (statically compiled AArch64 releases), issue seems to be rooted in openssl-sys (neither vendored nor normal builds work for different reasons).

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant