muxtls

Multiplexed streams over TLS/TCP

Features

• TLS-secured client/server transport using rustls + tokio-rustls
• Protocol isolation through the muxtls/1 ALPN identifier
• Multiple independent bidirectional logical streams over one TLS/TCP connection
• Bounded-memory runtime with per-frame, per-stream, and per-connection limits
• Optional protocol keepalive and inbound idle timeouts
• Optional mutual TLS and verified peer certificate access
• Stream-oriented API with async backpressure
• SendStream implements tokio::io::AsyncWrite
• RecvStream implements tokio::io::AsyncRead

Crates

• muxtls-proto: Transport-agnostic wire protocol
  • QUIC-style VarInt
  • Frame definitions and encode/decode routines
  • Protocol error types (ProtoError, ErrorCode)
• muxtls: Async transport implementation
  • TLS over TCP endpoint/connection/stream runtime
  • Stream multiplexing and bounded-memory backpressure
  • Depends on muxtls-proto for wire format

Quick start

[dependencies]
muxtls = "0.3"

API documentation is available on docs.rs.

Wire Format Overview

muxtls uses a four-byte big-endian length prefix followed by a frame encoded by muxtls-proto. Client-initiated stream IDs are even, server-initiated stream IDs are odd, and each side announces IDs monotonically with OPEN_STREAM. See the muxtls-proto/PROTOCOL.md document for the complete version 1 specification and the v1.json file for language-independent conformance vectors.

Supported frame types:

• OPEN_STREAM
• STREAM
• RESET_STREAM
• PING
• CONNECTION_CLOSE

Examples

• cargo run -p muxtls --example echo_server
• cargo run -p muxtls --example echo_client

The examples generate and bypass verification of a development certificate. Use ServerConfig::from_pem_files and ClientConfig::with_native_roots (or explicit custom roots) in deployed services.

For mutual TLS, use the client *_and_client_auth constructors and ServerConfig::from_der_with_client_auth, then inspect the verified certificate chain with Connection::peer_identity.