oa_gateway_adapter

Module tls

Source
Expand description

TLS shared by every adapter that rides a plain TCP stream: OWP terminates it as a server, STOMP originates it as a client. Neither DDS nor loopback use this — DDS’s RTPS transport is UDP, not a stream, so ordinary TLS does not apply to it.

This covers encryption, proving the server’s identity to whoever connects to it, and — opt-in, on top of that — verifying the peer’s identity too: server_tls can require and verify a client certificate (OWP, checking who is connecting to it), and client_tls can present one (STOMP, proving itself to the broker). Neither is on unless configured; a peer or broker that completes a handshake with neither configured is not authenticated, only talking over an encrypted channel.

rustls implements only TLS 1.2 and 1.3, so there is no separate minimum version to configure — this satisfies OMSC-STD-001’s own “TLS 1.2 at a minimum” convention for its secure transport variants by construction.

Structs§

  • ClientTls
    A configured TLS dialer side, plus the name checked in the peer’s certificate.
  • ServerTls
    A configured TLS listener side. Terminates TLS on an accepted connection.

Enums§

Functions§

  • client_tls
    Loads a client TLS configuration that verifies a peer as server_name.
  • client_tls_from_pem
    As client_tls, but parses PEM bytes already in memory rather than reading a file.
  • install_provider 🔒
    Installs the ring crypto provider as the process default, if one is not already installed. Idempotent: a second install attempt is expected once both an OWP and a STOMP adapter configure TLS in the same process, and is silently discarded.
  • root_store_from_pem 🔒
    Parses a PEM bundle of certificate authorities. field names the config key in error messages, e.g. "owp.tls_client_ca".
  • server_tls
    Loads a server certificate and key from cert/key paths, if both are set. Both unset leaves TLS off; exactly one set is a configuration error.
  • server_tls_from_pem
    As server_tls, but parses PEM bytes already in memory rather than reading files — the entry point tests use to avoid touching a filesystem.