Implement rustls-backed _ssl module

Cargo.toml

@@ -167,6 +167,16 @@ flate2 = { version = "1.1.9", default-features = false }
 base64 = "0.22"
 crc32fast = "1.4"
 
+# TLS backend (pyre-native only).  The interpreter sees opaque, non-inlined
+# entry points so rustls and its crypto provider stay outside Charon/LLBC.
+rustls = { version = "0.23.39", default-features = false, features = ["std", "tls12", "aws_lc_rs"] }
+rustls-pemfile = "2.2"
+x509-parser = "0.18"
+pem-rfc7468 = { version = "1", features = ["alloc"] }
+der = { version = "0.8", features = ["alloc", "pem"] }
+pkcs8 = { version = "0.11", features = ["encryption", "pkcs5", "pem"] }
+rustls-native-certs = "0.8"
+
 # math
 pymath = { version = "0.2.0", features = ["malachite-bigint"] }
 

pyre/pyre-interpreter/src/importing.rs

@@ -681,6 +681,8 @@ pub fn install_builtin_modules() {
         pyre_install_module!(termios);
         pyre_install_module!(_socket);
         #[cfg(not(target_arch = "wasm32"))]
+        pyre_install_module!(_ssl);
+        #[cfg(not(target_arch = "wasm32"))]
         pyre_install_module!(mmap);
         pyre_install_module!(_ctypes);
         #[cfg(not(target_arch = "wasm32"))]

pyre/pyre-interpreter/src/lib.rs

@@ -1124,9 +1124,41 @@ pub fn all_subclass_range_aliases() -> Vec<pyre_object::pyobject::SubclassRangeA
         // too; nothing unconditional follows it, so no id differs per target.
         #[cfg(not(target_arch = "wasm32"))]
         subclass_range_alias(169, typed::<crate::module::posix::W_DirEntry>()),
+        // rustls-backed `_ssl` native payloads.  They are appended after the
+        // last pre-existing native class in the same order `build_gc`
+        // registers them, so no established type id moves.
+        #[cfg(all(not(target_arch = "wasm32"), not(feature = "sandbox")))]
+        subclass_range_alias(170, typed::<crate::module::_ssl::W_SSLContext>()),
+        #[cfg(all(not(target_arch = "wasm32"), not(feature = "sandbox")))]
+        subclass_range_alias(171, typed::<crate::module::_ssl::W_MemoryBIO>()),
+        #[cfg(all(not(target_arch = "wasm32"), not(feature = "sandbox")))]
+        subclass_range_alias(172, typed::<crate::module::_ssl::W_SSLSession>()),
+        #[cfg(all(not(target_arch = "wasm32"), not(feature = "sandbox")))]
+        subclass_range_alias(173, typed::<crate::module::_ssl::W_SSLSocket>()),
+        #[cfg(all(not(target_arch = "wasm32"), not(feature = "sandbox")))]
+        subclass_range_alias(174, typed::<crate::module::_ssl::W_Certificate>()),
     ]
 }
 
+/// The rclass hierarchy present in this interpreter configuration.
+///
+/// `_ssl` owns the final five native hierarchy slots and is compiled out of a
+/// sandbox build. Keep that configuration knowledge here, beside the module
+/// and alias gates, rather than leaking the `sandbox` feature into
+/// `pyre-object`.
+pub fn active_subclass_range_hierarchy() -> &'static [(u32, Option<u32>)] {
+    let hierarchy = pyre_object::pyobject::SUBCLASS_RANGE_HIERARCHY;
+    #[cfg(all(not(target_arch = "wasm32"), feature = "sandbox"))]
+    {
+        const SSL_HIERARCHY_SLOTS: usize = 5;
+        &hierarchy[..hierarchy.len() - SSL_HIERARCHY_SLOTS]
+    }
+    #[cfg(not(all(not(target_arch = "wasm32"), feature = "sandbox")))]
+    {
+        hierarchy
+    }
+}
+
 // ── Print / stderr hooks for wasm (fd-1 / fd-2 capture) ──
 //
 // An embedder installs these to receive everything the interpreter writes to