7 files changed, 61 insertions, 3 deletions
diff --git a/js/deno.ts b/js/deno.ts
index 4efa641d3..916b7471a 100644
--- a/js/deno.ts
+++ b/js/deno.ts
@@ -75,6 +75,7 @@ export {
 export { truncateSync, truncate } from "./truncate.ts";
 export { FileInfo } from "./file_info.ts";
 export { connect, dial, listen, Listener, Conn } from "./net.ts";
+export { dialTLS } from "./tls.ts";
 export { metrics, Metrics } from "./metrics.ts";
 export { resources } from "./resources.ts";
 export {
diff --git a/js/dispatch.ts b/js/dispatch.ts
index a15da69f4..b5116d68a 100644
--- a/js/dispatch.ts
+++ b/js/dispatch.ts
@@ -60,6 +60,7 @@ export const OP_TRUNCATE = 54;
 export const OP_MAKE_TEMP_DIR = 55;
 export const OP_CWD = 56;
 export const OP_FETCH_ASSET = 57;
+export const OP_DIAL_TLS = 58;
 
 export function asyncMsgFromRust(opId: number, ui8: Uint8Array): void {
   switch (opId) {
@@ -97,6 +98,7 @@ export function asyncMsgFromRust(opId: number, ui8: Uint8Array): void {
     case OP_READ_LINK:
     case OP_TRUNCATE:
     case OP_MAKE_TEMP_DIR:
+    case OP_DIAL_TLS:
       json.asyncMsgFromRust(opId, ui8);
       break;
     default:
diff --git a/js/lib.deno_runtime.d.ts b/js/lib.deno_runtime.d.ts
index fc4e6508f..36e49c9c2 100644
--- a/js/lib.deno_runtime.d.ts
+++ b/js/lib.deno_runtime.d.ts
@@ -999,8 +999,17 @@ declare namespace Deno {
    */
   export function dial(options: DialOptions): Promise<Conn>;
 
-  // @url js/metrics.d.ts
+  export interface DialTLSOptions {
+    port: number;
+    hostname?: string;
+  }
 
+  /**
+   * dialTLS establishes a secure connection over TLS (transport layer security).
+   */
+  export function dialTLS(options: DialTLSOptions): Promise<Conn>;
+
+  // @url js/metrics.d.ts
   export interface Metrics {
     opsDispatched: number;
     opsCompleted: number;
diff --git a/js/net.ts b/js/net.ts
index 28c8cf8e0..4da6da38e 100644
--- a/js/net.ts
+++ b/js/net.ts
@@ -44,7 +44,7 @@ function shutdown(rid: number, how: ShutdownMode): void {
   sendSync(dispatch.OP_SHUTDOWN, { rid, how });
 }
 
-class ConnImpl implements Conn {
+export class ConnImpl implements Conn {
   constructor(
     readonly rid: number,
     readonly remoteAddr: string,
@@ -187,7 +187,6 @@ const dialDefaults = { hostname: "127.0.0.1", transport: "tcp" };
 export async function dial(options: DialOptions): Promise<Conn> {
   options = Object.assign(dialDefaults, options);
   const res = await sendAsync(dispatch.OP_DIAL, options);
-  // TODO(bartlomieju): add remoteAddr and localAddr on Rust side
   return new ConnImpl(res.rid, res.remoteAddr!, res.localAddr!);
 }
 
diff --git a/js/tls.ts b/js/tls.ts
new file mode 100644
index 000000000..ec24b458b
--- /dev/null
+++ b/js/tls.ts
@@ -0,0 +1,21 @@
+// Copyright 2018-2019 the Deno authors. All rights reserved. MIT license.
+import { sendAsync } from "./dispatch_json.ts";
+import * as dispatch from "./dispatch.ts";
+import { Conn, ConnImpl } from "./net.ts";
+
+// TODO(ry) There are many configuration options to add...
+// https://docs.rs/rustls/0.16.0/rustls/struct.ClientConfig.html
+interface DialTLSOptions {
+  port: number;
+  hostname?: string;
+}
+const dialTLSDefaults = { hostname: "127.0.0.1", transport: "tcp" };
+
+/**
+ * dialTLS establishes a secure connection over TLS (transport layer security).
+ */
+export async function dialTLS(options: DialTLSOptions): Promise<Conn> {
+  options = Object.assign(dialTLSDefaults, options);
+  const res = await sendAsync(dispatch.OP_DIAL_TLS, options);
+  return new ConnImpl(res.rid, res.remoteAddr!, res.localAddr!);
+}
diff --git a/js/tls_test.ts b/js/tls_test.ts
new file mode 100644
index 000000000..25900f876
--- /dev/null
+++ b/js/tls_test.ts
@@ -0,0 +1,25 @@
+// Copyright 2018-2019 the Deno authors. All rights reserved. MIT license.
+import { test, testPerm, assert, assertEquals } from "./test_util.ts";
+
+// TODO(ry) The tests in this file use github.com:443, but it would be better to
+// not rely on an internet connection and rather use a localhost TLS server.
+
+test(async function dialTLSNoPerm(): Promise<void> {
+  let err;
+  try {
+    await Deno.dialTLS({ hostname: "github.com", port: 443 });
+  } catch (e) {
+    err = e;
+  }
+  assertEquals(err.kind, Deno.ErrorKind.PermissionDenied);
+  assertEquals(err.name, "PermissionDenied");
+});
+
+testPerm({ net: true }, async function dialTLSBasic(): Promise<void> {
+  const conn = await Deno.dialTLS({ hostname: "github.com", port: 443 });
+  assert(conn.rid > 0);
+  const body = new TextEncoder().encode("GET / HTTP/1.0\r\n\r\n");
+  const writeResult = await conn.write(body);
+  assertEquals(body.length, writeResult);
+  conn.close();
+});
diff --git a/js/unit_tests.ts b/js/unit_tests.ts
index 711a092fd..2da67c40e 100644
--- a/js/unit_tests.ts
+++ b/js/unit_tests.ts
@@ -43,6 +43,7 @@ import "./stat_test.ts";
 import "./symlink_test.ts";
 import "./text_encoding_test.ts";
 import "./timers_test.ts";
+import "./tls_test.ts";
 import "./truncate_test.ts";
 import "./url_test.ts";
 import "./url_search_params_test.ts";