From 4b29ee7cf024e1376986c674f36685be903cf644 Mon Sep 17 00:00:00 2001 From: Hannes Mehnert Date: Mon, 28 Oct 2024 21:33:30 +0100 Subject: [PATCH] Update tls doc to 1.0.4. --- doc/index.html | 7 +- doc/tls-async/Tls_async/Session/Fd/index.html | 2 + doc/tls-async/Tls_async/Session/index.html | 12 + .../X509_async/Authenticator/Param/index.html | 15 + .../X509_async/Authenticator/index.html | 21 + .../Tls_async/X509_async/CRL/index.html | 41 ++ .../X509_async/Certificate/index.html | 16 + .../X509_async/Distinguished_name/index.html | 7 + .../X509_async/OCSP/Request/index.html | 22 + .../X509_async/OCSP/Response/index.html | 38 ++ .../Tls_async/X509_async/OCSP/index.html | 6 + .../Tls_async/X509_async/PKCS12/index.html | 17 + .../X509_async/Private_key/index.html | 15 + .../X509_async/Public_key/index.html | 8 + .../X509_async/Signing_request/index.html | 22 + doc/tls-async/Tls_async/X509_async/index.html | 2 + doc/tls-async/Tls_async/index.html | 31 ++ doc/tls-async/index.html | 2 + doc/tls-eio/Tls_eio/index.html | 15 + doc/tls-eio/X509_eio/index.html | 14 + doc/tls-eio/index.html | 2 + doc/tls-lwt/Tls_lwt/Unix/index.html | 22 + doc/tls-lwt/Tls_lwt/index.html | 11 + doc/tls-lwt/X509_lwt/index.html | 14 + doc/tls-lwt/index.html | 2 + doc/tls-miou-unix/Tls_miou_unix/index.html | 8 +- doc/tls-mirage/Tls_mirage/Make/index.html | 20 + doc/tls-mirage/Tls_mirage/X509/index.html | 9 + doc/tls-mirage/Tls_mirage/index.html | 2 + doc/tls-mirage/index.html | 2 + doc/tls/Tls/Ciphersuite/index.html | 513 ++++++++++++++++++ doc/tls/Tls/Config/Ciphers/index.html | 2 + doc/tls/Tls/Config/index.html | 32 ++ doc/tls/Tls/Core/PreSharedKeyID/index.html | 2 + doc/tls/Tls/Core/SessionID/index.html | 2 + doc/tls/Tls/Core/Tracing/index.html | 15 + doc/tls/Tls/Core/index.html | 187 +++++++ doc/tls/Tls/Crypto/Ciphers/index.html | 13 + doc/tls/Tls/Crypto/index.html | 31 ++ doc/tls/Tls/Engine/index.html | 34 ++ doc/tls/Tls/Explorator/index.html | 2 + doc/tls/Tls/Handshake_client/index.html | 14 + doc/tls/Tls/Handshake_client13/index.html | 131 +++++ doc/tls/Tls/Handshake_common/Group/index.html | 2 + .../Tls/Handshake_common/GroupSet/index.html | 2 + doc/tls/Tls/Handshake_common/index.html | 254 +++++++++ doc/tls/Tls/Handshake_crypto/index.html | 23 + doc/tls/Tls/Handshake_crypto13/index.html | 57 ++ doc/tls/Tls/Handshake_server/index.html | 12 + doc/tls/Tls/Handshake_server13/index.html | 123 +++++ doc/tls/Tls/Packet/index.html | 33 ++ doc/tls/Tls/Reader/index.html | 49 ++ doc/tls/Tls/State/index.html | 292 ++++++++++ doc/tls/Tls/Utils/List_set/index.html | 2 + doc/tls/Tls/Utils/index.html | 2 + doc/tls/Tls/Writer/index.html | 15 + doc/tls/Tls/index.html | 2 + doc/tls/index.html | 2 + 58 files changed, 2248 insertions(+), 5 deletions(-) create mode 100644 doc/tls-async/Tls_async/Session/Fd/index.html create mode 100644 doc/tls-async/Tls_async/Session/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/Authenticator/Param/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/Authenticator/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/CRL/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/Certificate/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/Distinguished_name/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/OCSP/Request/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/OCSP/Response/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/OCSP/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/PKCS12/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/Private_key/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/Public_key/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/Signing_request/index.html create mode 100644 doc/tls-async/Tls_async/X509_async/index.html create mode 100644 doc/tls-async/Tls_async/index.html create mode 100644 doc/tls-async/index.html create mode 100644 doc/tls-eio/Tls_eio/index.html create mode 100644 doc/tls-eio/X509_eio/index.html create mode 100644 doc/tls-eio/index.html create mode 100644 doc/tls-lwt/Tls_lwt/Unix/index.html create mode 100644 doc/tls-lwt/Tls_lwt/index.html create mode 100644 doc/tls-lwt/X509_lwt/index.html create mode 100644 doc/tls-lwt/index.html create mode 100644 doc/tls-mirage/Tls_mirage/Make/index.html create mode 100644 doc/tls-mirage/Tls_mirage/X509/index.html create mode 100644 doc/tls-mirage/Tls_mirage/index.html create mode 100644 doc/tls-mirage/index.html create mode 100644 doc/tls/Tls/Ciphersuite/index.html create mode 100644 doc/tls/Tls/Config/Ciphers/index.html create mode 100644 doc/tls/Tls/Config/index.html create mode 100644 doc/tls/Tls/Core/PreSharedKeyID/index.html create mode 100644 doc/tls/Tls/Core/SessionID/index.html create mode 100644 doc/tls/Tls/Core/Tracing/index.html create mode 100644 doc/tls/Tls/Core/index.html create mode 100644 doc/tls/Tls/Crypto/Ciphers/index.html create mode 100644 doc/tls/Tls/Crypto/index.html create mode 100644 doc/tls/Tls/Engine/index.html create mode 100644 doc/tls/Tls/Explorator/index.html create mode 100644 doc/tls/Tls/Handshake_client/index.html create mode 100644 doc/tls/Tls/Handshake_client13/index.html create mode 100644 doc/tls/Tls/Handshake_common/Group/index.html create mode 100644 doc/tls/Tls/Handshake_common/GroupSet/index.html create mode 100644 doc/tls/Tls/Handshake_common/index.html create mode 100644 doc/tls/Tls/Handshake_crypto/index.html create mode 100644 doc/tls/Tls/Handshake_crypto13/index.html create mode 100644 doc/tls/Tls/Handshake_server/index.html create mode 100644 doc/tls/Tls/Handshake_server13/index.html create mode 100644 doc/tls/Tls/Packet/index.html create mode 100644 doc/tls/Tls/Reader/index.html create mode 100644 doc/tls/Tls/State/index.html create mode 100644 doc/tls/Tls/Utils/List_set/index.html create mode 100644 doc/tls/Tls/Utils/index.html create mode 100644 doc/tls/Tls/Writer/index.html create mode 100644 doc/tls/Tls/index.html create mode 100644 doc/tls/index.html diff --git a/doc/index.html b/doc/index.html index 9f457d2e..918437b8 100644 --- a/doc/index.html +++ b/doc/index.html @@ -11,7 +11,12 @@

OCaml package documentation

    -
  1. tls-miou-unix 1.0.3
    2. +
  2. tls 1.0.4
    3. +
  3. tls-async 1.0.4
    4. +
  4. tls-eio 1.0.4
    5. +
  5. tls-lwt 1.0.4
    6. +
  6. tls-miou-unix 1.0.4
    7. +
  7. tls-mirage 1.0.4
diff --git a/doc/tls-async/Tls_async/Session/Fd/index.html b/doc/tls-async/Tls_async/Session/Fd/index.html new file mode 100644 index 00000000..f8c6f2be --- /dev/null +++ b/doc/tls-async/Tls_async/Session/Fd/index.html @@ -0,0 +1,2 @@ + +Fd (tls-async.Tls_async.Session.Fd)

Module Session.Fd

type t = Async.Reader.t * Async.Writer.t
val read : t -> bytes -> [ `Ok of int | `Eof ] Async.Deferred.Or_error.t
val write_full : t -> string -> unit Async.Deferred.Or_error.t
diff --git a/doc/tls-async/Tls_async/Session/index.html b/doc/tls-async/Tls_async/Session/index.html new file mode 100644 index 00000000..3f45592f --- /dev/null +++ b/doc/tls-async/Tls_async/Session/index.html @@ -0,0 +1,12 @@ + +Session (tls-async.Tls_async.Session)

Module Tls_async.Session

Low-level API for working with TLS sessions. Most applications should use the high-level API below

module Fd : sig ... end
type t

Abstract type of a session

Constructors

val server_of_fd : Tls.Config.server -> Fd.t -> t Async.Deferred.Or_error.t

server_of_fd server fd is t, after server-side TLS handshake of fd using server configuration.

val client_of_fd : + Tls.Config.client -> + ?host:[ `host ] Domain_name.t -> + Fd.t -> + t Async.Deferred.Or_error.t

client_of_fd client ~host fd is t, after client-side TLS handshake of fd using client configuration and host.

Common stream operations

val read : t -> bytes -> int Async.Deferred.Or_error.t

read t buffer is length, the number of bytes read into buffer.

val writev : t -> string list -> unit Async.Deferred.Or_error.t

writev t buffers writes the buffers to the session.

val close_tls : t -> unit Async.Deferred.Or_error.t

close t closes the TLS session by sending a close notify to the peer.

val reneg : + ?authenticator:X509.Authenticator.t -> + ?acceptable_cas:X509.Distinguished_name.t list -> + ?cert:Tls.Config.own_cert -> + ?drop:bool -> + t -> + unit Async.Deferred.Or_error.t

reneg ~authenticator ~acceptable_cas ~cert ~drop t renegotiates the session, and blocks until the renegotiation finished. Optionally, a new authenticator and acceptable_cas can be used. The own certificate can be adjusted by cert. If drop is true (the default), application data received before the renegotiation finished is dropped.

val key_update : ?request:bool -> t -> unit Async.Deferred.Or_error.t

key_update ~request t updates the traffic key and requests a traffic key update from the peer if request is provided and true (the default). This is only supported in TLS 1.3.

val epoch : t -> Tls.Core.epoch_data Core.Or_error.t

epoch t returns epoch, which contains information of the active session.

diff --git a/doc/tls-async/Tls_async/X509_async/Authenticator/Param/index.html b/doc/tls-async/Tls_async/X509_async/Authenticator/Param/index.html new file mode 100644 index 00000000..cea9d6c8 --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/Authenticator/Param/index.html @@ -0,0 +1,15 @@ + +Param (tls-async.Tls_async.X509_async.Authenticator.Param)

Module Authenticator.Param

type t
val ca_file : + ?allowed_hashes:Digestif.hash' list -> + ?crls:Core.Filename.t -> + Core.Filename.t -> + unit -> + t
val ca_dir : + ?allowed_hashes:Digestif.hash' list -> + ?crls:Core.Filename.t -> + Core.Filename.t -> + unit -> + t
val cert_fingerprint : Digestif.hash' -> string -> t

The fingerprint can be collected from a browser or by invoking an openssl command like 'openssl x509 -in <pem_file> -noout -fingerprint -sha256'

val key_fingerprint : Digestif.hash' -> string -> t

The fingerprint can be collected from a browser or by invoking an openssl command like 'openssl x509 -in <pem_file> -noout -pubkey | openssl pkey -pubin -outform DER | openssl dgst -sha256'

val time : unit -> Ptime.t option

Async programs often don't use Ptime_clock, so this is provided as a convenience function. Relies on Unix.gettimeofday.

val to_authenticator : + time:(unit -> Ptime.t option) -> + t -> + {Authenticator}7.t Async.Deferred.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/Authenticator/index.html b/doc/tls-async/Tls_async/X509_async/Authenticator/index.html new file mode 100644 index 00000000..07f5089f --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/Authenticator/index.html @@ -0,0 +1,21 @@ + +Authenticator (tls-async.Tls_async.X509_async.Authenticator)

Module X509_async.Authenticator

type t = + ?ip:Ipaddr.t -> + host:[ `host ] Domain_name.t option -> + X509.Certificate.t list -> + X509.Validation.r
val chain_of_trust : + time:(unit -> Ptime.t option) -> + ?crls:X509.CRL.t list -> + ?allowed_hashes:Digestif.hash' list -> + X509.Certificate.t list -> + t
val key_fingerprint : + time:(unit -> Ptime.t option) -> + hash:Digestif.hash' -> + fingerprint:string -> + t
val cert_fingerprint : + time:(unit -> Ptime.t option) -> + hash:Digestif.hash' -> + fingerprint:string -> + t
val of_string : + string -> + ((unit -> Ptime.t option) -> t, [> `Msg of string ]) Stdlib.result
module Param : sig ... end
diff --git a/doc/tls-async/Tls_async/X509_async/CRL/index.html b/doc/tls-async/Tls_async/X509_async/CRL/index.html new file mode 100644 index 00000000..697420f9 --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/CRL/index.html @@ -0,0 +1,41 @@ + +CRL (tls-async.Tls_async.X509_async.CRL)

Module X509_async.CRL

type t = X509.CRL.t
val encode_der : t -> string
val issuer : t -> X509.Distinguished_name.t
val this_update : t -> Ptime.t
val next_update : t -> Ptime.t option
type revoked_cert = X509.CRL.revoked_cert = {
  1. serial : string;
  2. date : Ptime.t;
  3. extensions : X509.Extension.t;
}
val reason : revoked_cert -> X509.Extension.reason option
val revoked_certificates : t -> revoked_cert list
val extensions : t -> X509.Extension.t
val crl_number : t -> int option
val signature_algorithm : + t -> + (X509.Key_type.signature_scheme * Digestif.hash') option
val validate : + t -> + ?allowed_hashes:Digestif.hash' list -> + X509.Public_key.t -> + (unit, [> X509.Validation.signature_error ]) Stdlib.result
type verification_error = [
  1. | `Bad_encoding of X509.Distinguished_name.t * string * string
  2. | `Bad_signature of X509.Distinguished_name.t * string
  3. | `Hash_not_allowed of + X509.Distinguished_name.t + * [ `MD5 | `SHA1 | `SHA224 | `SHA256 | `SHA384 | `SHA512 ]
  4. | `Issuer_subject_mismatch of + X509.Distinguished_name.t * X509.Distinguished_name.t
  5. | `Msg of string
  6. | `Next_update_scheduled of X509.Distinguished_name.t * Ptime.t * Ptime.t
  7. | `Not_yet_valid of X509.Distinguished_name.t * Ptime.t * Ptime.t
  8. | `Unsupported_algorithm of X509.Distinguished_name.t * string
  9. | `Unsupported_keytype of X509.Distinguished_name.t * X509.Public_key.t
]
val pp_verification_error : verification_error Fmt.t
val verify : + t -> + ?allowed_hashes:Digestif.hash' list -> + ?time:Ptime.t -> + X509.Certificate.t -> + (unit, [> verification_error ]) Stdlib.result
val is_revoked : + ?allowed_hashes:Digestif.hash' list -> + issuer:X509.Certificate.t -> + cert:X509.Certificate.t -> + t list -> + bool
val decode_der : contents:string -> t Core.Or_error.t
val revoke : + ?digest:Digestif.hash' -> + issuer:Distinguished_name.t -> + this_update:Ptime.t -> + ?next_update:Ptime.t -> + ?extensions:Extension.t -> + revoked_cert list -> + Private_key.t -> + t Core.Or_error.t
val revoke_certificate : + revoked_cert -> + this_update:Ptime.t -> + ?next_update:Ptime.t -> + t -> + Private_key.t -> + t Core.Or_error.t
val revoke_certificates : + revoked_cert list -> + this_update:Ptime.t -> + ?next_update:Ptime.t -> + t -> + Private_key.t -> + t Core.Or_error.t
val of_pem_dir : directory:Core.Filename.t -> t list Async.Deferred.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/Certificate/index.html b/doc/tls-async/Tls_async/X509_async/Certificate/index.html new file mode 100644 index 00000000..c0e7b46d --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/Certificate/index.html @@ -0,0 +1,16 @@ + +Certificate (tls-async.Tls_async.X509_async.Certificate)

Module X509_async.Certificate

val decode_pkcs1_digest_info : + string -> + ([ `MD5 | `SHA1 | `SHA224 | `SHA256 | `SHA384 | `SHA512 ] * string, + [> `Msg of string ]) + Stdlib.result
val encode_pkcs1_digest_info : + ([ `MD5 | `SHA1 | `SHA224 | `SHA256 | `SHA384 | `SHA512 ] * string) -> + string
type t = X509.Certificate.t
val pp : t Fmt.t
val encode_der : t -> string
val fold_decode_pem_multiple : + ('a -> (t, [> `Msg of string ]) Stdlib.result -> 'a) -> + 'a -> + string -> + 'a
val encode_pem_multiple : t list -> string
val encode_pem : t -> string
val supports_keytype : t -> X509.Key_type.t -> bool
val public_key : t -> X509.Public_key.t
val signature_algorithm : + t -> + (X509.Key_type.signature_scheme * Digestif.hash') option
val hostnames : t -> X509.Host.Set.t
val supports_hostname : t -> [ `host ] Domain_name.t -> bool
val ips : t -> Ipaddr.Set.t
val supports_ip : t -> Ipaddr.t -> bool
val fingerprint : Digestif.hash' -> t -> string
val subject : t -> X509.Distinguished_name.t
val issuer : t -> X509.Distinguished_name.t
val serial : t -> string
val validity : t -> Ptime.t * Ptime.t
val extensions : t -> X509.Extension.t
val decode_pem_multiple : contents:string -> t list Core.Or_error.t
val decode_pem : contents:string -> t Core.Or_error.t
val decode_der : contents:string -> t Core.Or_error.t
val of_pem_file : Core.Filename.t -> t list Async.Deferred.Or_error.t
val of_pem_directory : + directory:Core.Filename.t -> + t list Async.Deferred.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/Distinguished_name/index.html b/doc/tls-async/Tls_async/X509_async/Distinguished_name/index.html new file mode 100644 index 00000000..9b884819 --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/Distinguished_name/index.html @@ -0,0 +1,7 @@ + +Distinguished_name (tls-async.Tls_async.X509_async.Distinguished_name)

Module X509_async.Distinguished_name

type attribute = X509.Distinguished_name.attribute =
  1. | CN of string
  2. | Serialnumber of string
  3. | C of string
  4. | L of string
  5. | ST of string
  6. | O of string
  7. | OU of string
  8. | T of string
  9. | DNQ of string
  10. | Mail of string
  11. | DC of string
  12. | Given_name of string
  13. | Surname of string
  14. | Initials of string
  15. | Pseudonym of string
  16. | Generation of string
  17. | Street of string
  18. | Userid of string
  19. | Other of Asn.oid * string
module Relative_distinguished_name = + X509.Distinguished_name.Relative_distinguished_name
type t = Relative_distinguished_name.t list
val equal : t -> t -> bool
val make_pp : + format:[ `OSF | `OpenSSL | `RFC4514 ] -> + ?spacing:[ `Loose | `Medium | `Tight ] -> + unit -> + t Fmt.t
val pp : t Fmt.t
val common_name : t -> string option
val encode_der : t -> string
val decode_der : contents:string -> t Core.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/OCSP/Request/index.html b/doc/tls-async/Tls_async/X509_async/OCSP/Request/index.html new file mode 100644 index 00000000..307fb720 --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/OCSP/Request/index.html @@ -0,0 +1,22 @@ + +Request (tls-async.Tls_async.X509_async.OCSP.Request)

Module OCSP.Request

type t = X509.OCSP.Request.t
val pp : t Fmt.t
val validate : + t -> + ?allowed_hashes:Digestif.hash' list -> + X509.Public_key.t -> + (unit, + [> `Bad_encoding of X509.Distinguished_name.t * string * string + | `Bad_signature of X509.Distinguished_name.t * string + | `Hash_not_allowed of + X509.Distinguished_name.t + * [ `MD5 | `SHA1 | `SHA224 | `SHA256 | `SHA384 | `SHA512 ] + | `Msg of string + | `No_signature + | `Unsupported_algorithm of X509.Distinguished_name.t * string + | `Unsupported_keytype of X509.Distinguished_name.t * X509.Public_key.t ]) + Stdlib.result
val requestor_name : t -> X509.General_name.b option
val cert_ids : t -> X509.OCSP.cert_id list
val encode_der : t -> string
val create : + ?certs:Certificate.t list -> + ?digest:Digestif.hash' -> + ?requestor_name:General_name.b -> + ?key:Private_key.t -> + cert_id list -> + t Core.Or_error.t
val decode_der : contents:string -> t Core.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/OCSP/Response/index.html b/doc/tls-async/Tls_async/X509_async/OCSP/Response/index.html new file mode 100644 index 00000000..40e98e04 --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/OCSP/Response/index.html @@ -0,0 +1,38 @@ + +Response (tls-async.Tls_async.X509_async.OCSP.Response)

Module OCSP.Response

type status = [
  1. | `InternalError
  2. | `MalformedRequest
  3. | `SigRequired
  4. | `Successful
  5. | `TryLater
  6. | `Unauthorized
]
val pp_status : status Fmt.t
type cert_status = [
  1. | `Good
  2. | `Revoked of Ptime.t * X509.Extension.reason option
  3. | `Unknown
]
val pp_cert_status : cert_status Fmt.t
type single_response = X509.OCSP.Response.single_response
val create_single_response : + ?next_update:Ptime.t -> + ?single_extensions:X509.Extension.t -> + X509.OCSP.cert_id -> + cert_status -> + Ptime.t -> + single_response
val pp_single_response : single_response Fmt.t
val single_response_cert_id : single_response -> X509.OCSP.cert_id
val single_response_status : single_response -> cert_status
type responder_id = [
  1. | `ByKey of string
  2. | `ByName of X509.Distinguished_name.t
]
val create_responder_id : X509.Public_key.t -> responder_id
val pp_responder_id : responder_id Fmt.t
type t = X509.OCSP.Response.t
val create : + [ `InternalError + | `MalformedRequest + | `SigRequired + | `TryLater + | `Unauthorized ] -> + t
val pp : t Fmt.t
val status : t -> status
val responder_id : t -> (responder_id, [> `Msg of string ]) Stdlib.result
val encode_der : t -> string
val validate : + t -> + ?allowed_hashes:Digestif.hash' list -> + ?now:Ptime.t -> + X509.Public_key.t -> + (unit, + [> `Bad_encoding of X509.Distinguished_name.t * string * string + | `Bad_signature of X509.Distinguished_name.t * string + | `Hash_not_allowed of + X509.Distinguished_name.t + * [ `MD5 | `SHA1 | `SHA224 | `SHA256 | `SHA384 | `SHA512 ] + | `Msg of string + | `No_signature + | `Time_invalid + | `Unsupported_algorithm of X509.Distinguished_name.t * string + | `Unsupported_keytype of X509.Distinguished_name.t * X509.Public_key.t ]) + Stdlib.result
val create_success : + ?digest:Digestif.hash' -> + ?certs:Certificate.t list -> + ?response_extensions:Extension.t -> + Private_key.t -> + responder_id -> + Ptime.t -> + single_response list -> + t Core.Or_error.t
val responses : t -> single_response list Core.Or_error.t
val decode_der : contents:string -> t Core.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/OCSP/index.html b/doc/tls-async/Tls_async/X509_async/OCSP/index.html new file mode 100644 index 00000000..8208e7d3 --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/OCSP/index.html @@ -0,0 +1,6 @@ + +OCSP (tls-async.Tls_async.X509_async.OCSP)

Module X509_async.OCSP

type cert_id = X509.OCSP.cert_id
val create_cert_id : + ?hash:[ `MD5 | `SHA1 | `SHA224 | `SHA256 | `SHA384 | `SHA512 ] -> + X509.Certificate.t -> + string -> + cert_id
val cert_id_serial : cert_id -> string
val pp_cert_id : cert_id Fmt.t
module Request : sig ... end
module Response : sig ... end
diff --git a/doc/tls-async/Tls_async/X509_async/PKCS12/index.html b/doc/tls-async/Tls_async/X509_async/PKCS12/index.html new file mode 100644 index 00000000..8c7063fa --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/PKCS12/index.html @@ -0,0 +1,17 @@ + +PKCS12 (tls-async.Tls_async.X509_async.PKCS12)

Module X509_async.PKCS12

type t = X509.PKCS12.t
val encode_der : t -> string
val create : + ?mac:[ `SHA1 | `SHA224 | `SHA256 | `SHA384 | `SHA512 ] -> + ?algorithm:[ `AES128_CBC | `AES192_CBC | `AES256_CBC ] -> + ?iterations:int -> + string -> + X509.Certificate.t list -> + X509.Private_key.t -> + t
val decode_der : contents:string -> t Core.Or_error.t
val verify : + string -> + t -> + [ `Certificate of Certificate.t + | `Crl of CRL.t + | `Decrypted_private_key of Private_key.t + | `Private_key of Private_key.t ] + list + Core.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/Private_key/index.html b/doc/tls-async/Tls_async/X509_async/Private_key/index.html new file mode 100644 index 00000000..4bf073a6 --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/Private_key/index.html @@ -0,0 +1,15 @@ + +Private_key (tls-async.Tls_async.X509_async.Private_key)

Module X509_async.Private_key

type t = [
  1. | `ED25519 of Mirage_crypto_ec.Ed25519.priv
  2. | `P256 of Mirage_crypto_ec.P256.Dsa.priv
  3. | `P384 of Mirage_crypto_ec.P384.Dsa.priv
  4. | `P521 of Mirage_crypto_ec.P521.Dsa.priv
  5. | `RSA of Mirage_crypto_pk.Rsa.priv
]
val generate : ?seed:string -> ?bits:int -> X509.Key_type.t -> t
val of_octets : + string -> + X509.Key_type.t -> + (t, [> `Msg of string ]) Stdlib.result
val of_string : + ?seed_or_data:[ `Data | `Seed ] -> + ?bits:int -> + X509.Key_type.t -> + string -> + (t, [> `Msg of string ]) Stdlib.result
val key_type : t -> X509.Key_type.t
val public : t -> X509.Public_key.t
val encode_der : t -> string
val encode_pem : t -> string
val sign : + Digestif.hash' -> + ?scheme:Key_type.signature_scheme -> + t -> + [ `Digest of string | `Message of string ] -> + string Core.Or_error.t
val decode_der : contents:string -> t Core.Or_error.t
val decode_pem : contents:string -> t Core.Or_error.t
val of_pem_file : Core.Filename.t -> t Async.Deferred.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/Public_key/index.html b/doc/tls-async/Tls_async/X509_async/Public_key/index.html new file mode 100644 index 00000000..0a755eab --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/Public_key/index.html @@ -0,0 +1,8 @@ + +Public_key (tls-async.Tls_async.X509_async.Public_key)

Module X509_async.Public_key

type t = [
  1. | `ED25519 of Mirage_crypto_ec.Ed25519.pub
  2. | `P256 of Mirage_crypto_ec.P256.Dsa.pub
  3. | `P384 of Mirage_crypto_ec.P384.Dsa.pub
  4. | `P521 of Mirage_crypto_ec.P521.Dsa.pub
  5. | `RSA of Mirage_crypto_pk.Rsa.pub
]
val pp : t Fmt.t
val id : t -> string
val fingerprint : ?hash:Digestif.hash' -> t -> string
val key_type : t -> X509.Key_type.t
val encode_der : t -> string
val encode_pem : t -> string
val verify : + Digestif.hash' -> + ?scheme:Key_type.signature_scheme -> + signature:string -> + t -> + [ `Digest of string | `Message of string ] -> + unit Core.Or_error.t
val decode_der : contents:string -> t Core.Or_error.t
val decode_pem : contents:string -> t Core.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/Signing_request/index.html b/doc/tls-async/Tls_async/X509_async/Signing_request/index.html new file mode 100644 index 00000000..309af300 --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/Signing_request/index.html @@ -0,0 +1,22 @@ + +Signing_request (tls-async.Tls_async.X509_async.Signing_request)

Module X509_async.Signing_request

type t = X509.Signing_request.t
val encode_der : t -> string
val encode_pem : t -> string
module Ext = X509.Signing_request.Ext
type request_info = X509.Signing_request.request_info = {
  1. subject : X509.Distinguished_name.t;
  2. public_key : X509.Public_key.t;
  3. extensions : Ext.t;
}
val info : t -> request_info
val signature_algorithm : + t -> + (X509.Key_type.signature_scheme * Digestif.hash') option
val hostnames : t -> X509.Host.Set.t
val decode_der : + ?allowed_hashes:Digestif.hash' list -> + string -> + t Core.Or_error.t
val decode_pem : string -> t Core.Or_error.t
val create : + Distinguished_name.t -> + ?digest:Digestif.hash' -> + ?extensions:Ext.t -> + Private_key.t -> + t Core.Or_error.t
val sign : + ?allowed_hashes:Digestif.hash' list -> + ?digest:Digestif.hash' -> + ?serial:string -> + ?extensions:Extension.t -> + t -> + Private_key.t -> + Distinguished_name.t -> + valid_from:Ptime.t -> + valid_until:Ptime.t -> + Certificate.t Core.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/index.html b/doc/tls-async/Tls_async/X509_async/index.html new file mode 100644 index 00000000..5806d8f1 --- /dev/null +++ b/doc/tls-async/Tls_async/X509_async/index.html @@ -0,0 +1,2 @@ + +X509_async (tls-async.Tls_async.X509_async)

Module Tls_async.X509_async

Helper functions for Async_unix-specific IO operations commonly used with X509 certificates, such as loading from a Unix filesystem

include module type of struct include X509 end
module Host = X509.Host
module Key_type = X509.Key_type
module General_name = X509.General_name
module Extension = X509.Extension
module Validation = X509.Validation
module Authenticator : sig ... end
module Private_key : sig ... end
module Public_key : sig ... end
module Certificate : sig ... end
module Distinguished_name : sig ... end
module CRL : sig ... end
module OCSP : sig ... end
module PKCS12 : sig ... end
module Signing_request : sig ... end
diff --git a/doc/tls-async/Tls_async/index.html b/doc/tls-async/Tls_async/index.html new file mode 100644 index 00000000..b9dc7cc8 --- /dev/null +++ b/doc/tls-async/Tls_async/index.html @@ -0,0 +1,31 @@ + +Tls_async (tls-async.Tls_async)

Module Tls_async

module Session : sig ... end

Low-level API for working with TLS sessions. Most applications should use the high-level API below

module X509_async : sig ... end

Helper functions for Async_unix-specific IO operations commonly used with X509 certificates, such as loading from a Unix filesystem

val listen : + ?buffer_age_limit:Async.Writer.buffer_age_limit -> + ?max_connections:int -> + ?max_accepts_per_batch:int -> + ?backlog:int -> + ?socket: + ([ `Unconnected ], [< Async.Socket.Address.t ] as 'address) Async.Socket.t -> + on_handler_error:[ `Call of 'address -> exn -> unit | `Ignore | `Raise ] -> + Tls.Config.server -> + ('address, 'listening_on) Async.Tcp.Where_to_listen.t -> + ('address -> + Session.t -> + Async.Reader.t -> + Async.Writer.t -> + unit Async.Deferred.t) -> + ('address, 'listening_on) Async.Tcp.Server.t Async.Deferred.t

listen creates a Tcp.Server.t with the requested parameters, including those specified in Tls.Config.server. The handler function exposes the low-level Session.t to accommodate cases like interrogating a client certificate

type 'a io_handler = Async.Reader.t -> Async.Writer.t -> 'a Async.Deferred.t
type 'a tls_handler = Session.t -> 'a io_handler
val upgrade_server_handler : + config:Tls.Config.server -> + 'a tls_handler -> + 'a io_handler

upgrade_server_handler is what listen calls to handle each client. It is exposed so that low-level end-users of the library can use tls-async inside of code that manages Tcp services directly.

The tls_handler argument will be called with the client Tls session, reader and writer to be used for cleartext data.

The outer reader and writer will read encrypted data from and write encrypted data to the connected socket.

val connect : + ?socket:([ `Unconnected ], 'addr) Async.Socket.t -> + (Tls.Config.client -> + 'addr Async.Tcp.Where_to_connect.t -> + host:[ `host ] Domain_name.t option -> + (Session.t * Async.Reader.t * Async.Writer.t) Async.Deferred.Or_error.t) + Async.Tcp.Aliases.with_connect_options

connect behaves similarly to Tcp.connect, exposing a cleartext reader and writer. Callers should ensure they close the Writer.t and wait for the unit Deferred.t returned by `Closed_and_flushed_downstream to completely shut down the TLS connection

host is used for peer name verification and should generally be provided. Passing None will disable peer name verification unless peer_name was provided in the Tls.Config.client. If both are present host overwrites peer_name.

val upgrade_client_to_tls : + Tls.Config.client -> + host:[ `host ] Domain_name.t option -> + Async.Reader.t -> + Async.Writer.t -> + (Session.t * Async.Reader.t * Async.Writer.t) Async.Deferred.Or_error.t

upgrade_client_to_tls upgrades an existing reader/writer to TLS, returning a cleartext reader and writer. Callers should ensure they close the Writer.t and wait for the unit Deferred.t returned by `Closed_and_flushed_downstream to completely shut down the TLS connection

host is used for peer name verification and should generally be provided. Passing None will disable peer name verification unless peer_name was provided in the Tls.Config.client. If both are present host overwrites peer_name.

diff --git a/doc/tls-async/index.html b/doc/tls-async/index.html new file mode 100644 index 00000000..667a478c --- /dev/null +++ b/doc/tls-async/index.html @@ -0,0 +1,2 @@ + +index (tls-async.index)

tls-async index

Library tls-async

The entry point of this library is the module: Tls_async.

diff --git a/doc/tls-eio/Tls_eio/index.html b/doc/tls-eio/Tls_eio/index.html new file mode 100644 index 00000000..e88b968b --- /dev/null +++ b/doc/tls-eio/Tls_eio/index.html @@ -0,0 +1,15 @@ + +Tls_eio (tls-eio.Tls_eio)

Module Tls_eio

Effectful operations using Eio for pure TLS.

The pure TLS is state and buffer in, state and buffer out. This module uses Eio for communication over the network.

exception Tls_alert of Tls.Packet.alert_type

Tls_alert exception received from the other endpoint

exception Tls_failure of Tls.Engine.failure

Tls_failure exception while processing incoming data

type t = [ `Tls | Eio.Flow.two_way_ty | Eio.Resource.close_ty ] Eio.Std.r

Constructors

val server_of_flow : + Tls.Config.server -> + [> Eio.Flow.two_way_ty | Eio.Resource.close_ty ] Eio.Std.r -> + t

server_of_flow server flow is t, after server-side TLS handshake of flow using server configuration.

You must ensure a RNG is installed while using TLS, e.g. using Mirage_crypto_rng_eio. Ideally, this would be part of the server config so you couldn't forget it, but for now you'll get a runtime error if you forget.

val client_of_flow : + Tls.Config.client -> + ?host:[ `host ] Domain_name.t -> + [> Eio.Flow.two_way_ty | Eio.Resource.close_ty ] Eio.Std.r -> + t

client_of_flow client ~host fd is t, after client-side TLS handshake of flow using client configuration and host.

You must ensure a RNG is installed while using TLS, e.g. using Mirage_crypto_rng_eio. Ideally, this would be part of the client config so you couldn't forget it, but for now you'll get a runtime error if you forget.

Control of TLS features

val reneg : + ?authenticator:X509.Authenticator.t -> + ?acceptable_cas:X509.Distinguished_name.t list -> + ?cert:Tls.Config.own_cert -> + ?drop:bool -> + t -> + unit

reneg ~authenticator ~acceptable_cas ~cert ~drop t renegotiates the session, and blocks until the renegotiation finished. Optionally, a new authenticator and acceptable_cas can be used. The own certificate can be adjusted by cert. If drop is true (the default), application data received before the renegotiation finished is dropped.

val key_update : ?request:bool -> t -> unit

key_update ~request t updates the traffic key and requests a traffic key update from the peer if request is provided and true (the default). This is only supported in TLS 1.3.

val epoch : t -> (Tls.Core.epoch_data, unit) Stdlib.result

epoch t returns epoch, which contains information of the active session.

diff --git a/doc/tls-eio/X509_eio/index.html b/doc/tls-eio/X509_eio/index.html new file mode 100644 index 00000000..acdf737f --- /dev/null +++ b/doc/tls-eio/X509_eio/index.html @@ -0,0 +1,14 @@ + +X509_eio (tls-eio.X509_eio)

Module X509_eio

X.509 certificate handling using Eio.

val private_of_pems : + cert:_ Eio.Path.t -> + priv_key:_ Eio.Path.t -> + Tls.Config.certchain

private_of_pems ~cert ~priv_key is priv, after reading the private key and certificate chain from the given PEM-encoded files.

val certs_of_pem : _ Eio.Path.t -> X509.Certificate.t list

certs_of_pem file is certificates, which are read from the PEM-encoded file.

val certs_of_pem_dir : _ Eio.Path.t -> X509.Certificate.t list

certs_of_pem_dir dir is certificates, which are read from all PEM-encoded files in dir.

val authenticator : + ?allowed_hashes:Digestif.hash' list -> + ?crls:_ Eio.Path.t -> + [ `Ca_file of _ Eio.Path.t + | `Ca_dir of _ Eio.Path.t + | `Key_fingerprint of Digestif.hash' * string + | `Hex_key_fingerprint of Digestif.hash' * string + | `Cert_fingerprint of Digestif.hash' * string + | `Hex_cert_fingerprint of Digestif.hash' * string ] -> + X509.Authenticator.t

authenticator methods constructs an authenticator using the specified method and data.

diff --git a/doc/tls-eio/index.html b/doc/tls-eio/index.html new file mode 100644 index 00000000..4fca7632 --- /dev/null +++ b/doc/tls-eio/index.html @@ -0,0 +1,2 @@ + +index (tls-eio.index)

tls-eio index

Library tls-eio

This library exposes the following toplevel modules:

diff --git a/doc/tls-lwt/Tls_lwt/Unix/index.html b/doc/tls-lwt/Tls_lwt/Unix/index.html new file mode 100644 index 00000000..5b55cb1f --- /dev/null +++ b/doc/tls-lwt/Tls_lwt/Unix/index.html @@ -0,0 +1,22 @@ + +Unix (tls-lwt.Tls_lwt.Unix)

Module Tls_lwt.Unix

Low-level API

Unix API

It is the responsibility of the client to handle error conditions. The underlying file descriptors are not closed.

type t

Abstract type of a session

Constructors

val server_of_fd : Tls.Config.server -> Lwt_unix.file_descr -> t Lwt.t

server_of_fd server fd is t, after server-side TLS handshake of fd using server configuration.

val server_of_channels : + Tls.Config.server -> + (Lwt_io.input_channel * Lwt_io.output_channel) -> + t Lwt.t

server_of_channels server (ic, oc) is t, after server-side TLS handshake on the input/output channels ic, oc using server configuration.

val client_of_fd : + Tls.Config.client -> + ?host:[ `host ] Domain_name.t -> + Lwt_unix.file_descr -> + t Lwt.t

client_of_fd client ~host fd is t, after client-side TLS handshake of fd using client configuration and host.

val client_of_channels : + Tls.Config.client -> + ?host:[ `host ] Domain_name.t -> + (Lwt_io.input_channel * Lwt_io.output_channel) -> + t Lwt.t

client_of_channels client ~host (ic, oc) is t, after client-side TLS handshake over the input/output channels ic, oc using client configuration and host.

val accept : + Tls.Config.server -> + Lwt_unix.file_descr -> + (t * Lwt_unix.sockaddr) Lwt.t

accept server fd is t, sockaddr, after accepting a client on fd and upgrading to a TLS connection.

val connect : Tls.Config.client -> (string * int) -> t Lwt.t

connect client (host, port) is t, after successful connection to host on port and TLS upgrade.

Common stream operations

val read : t -> ?off:int -> bytes -> int Lwt.t

read t ~off buffer is length, the number of bytes read into buffer. It fills buffer starting at off (default is 0).

val write : t -> string -> unit Lwt.t

write t buffer writes the buffer to the session.

val writev : t -> string list -> unit Lwt.t

writev t buffers writes the buffers to the session.

val read_bytes : t -> Lwt_bytes.t -> int -> int -> int Lwt.t

read_bytes t bytes offset len is read_bytes, the amount of bytes read.

val write_bytes : t -> Lwt_bytes.t -> int -> int -> unit Lwt.t

write_bytes t bytes offset length writes length bytes of bytes starting at offset to the session.

val shutdown : t -> [ `read | `write | `read_write ] -> unit Lwt.t

shutdown t direction closes the direction of the TLS session t. If `read_write or `write is closed, a TLS close_notify is sent to the other endpoint. If this results in a fully closed session (or an errorneous session), the underlying file descriptor is closed.

val close : t -> unit Lwt.t

close t closes the TLS session and the underlying file descriptor.

val reneg : + ?authenticator:X509.Authenticator.t -> + ?acceptable_cas:X509.Distinguished_name.t list -> + ?cert:Tls.Config.own_cert -> + ?drop:bool -> + t -> + unit Lwt.t

reneg ~authenticator ~acceptable_cas ~cert ~drop t renegotiates the session, and blocks until the renegotiation finished. Optionally, a new authenticator and acceptable_cas can be used. The own certificate can be adjusted by cert. If drop is true (the default), application data received before the renegotiation finished is dropped.

val key_update : ?request:bool -> t -> unit Lwt.t

key_update ~request t updates the traffic key and requests a traffic key update from the peer if request is provided and true (the default). This is only supported in TLS 1.3.

val epoch : t -> (Tls.Core.epoch_data, unit) Stdlib.result

epoch t returns epoch, which contains information of the active session.

diff --git a/doc/tls-lwt/Tls_lwt/index.html b/doc/tls-lwt/Tls_lwt/index.html new file mode 100644 index 00000000..bff85f44 --- /dev/null +++ b/doc/tls-lwt/Tls_lwt/index.html @@ -0,0 +1,11 @@ + +Tls_lwt (tls-lwt.Tls_lwt)

Module Tls_lwt

Effectful operations using Lwt for pure TLS.

The pure TLS is state and buffer in, state and buffer out. This module uses Lwt for communication over the network.

This module implements a high-level API and a low-level API (in Unix). Most applications should use the high-level API described below.

exception Tls_alert of Tls.Packet.alert_type

Tls_alert exception received from the other endpoint

exception Tls_failure of Tls.Engine.failure

Tls_failure exception while processing incoming data

module Unix : sig ... end

Low-level API

High-level API

type ic = Lwt_io.input_channel
type oc = Lwt_io.output_channel
val accept_ext : + Tls.Config.server -> + Lwt_unix.file_descr -> + ((ic * oc) * Lwt_unix.sockaddr) Lwt.t

accept_ext server fd is (ic, oc), sockaddr, the input and output channel from an accepted connection on the given fd, after upgrading to TLS using the server configuration.

val accept : + Tls.Config.own_cert -> + Lwt_unix.file_descr -> + ((ic * oc) * Lwt_unix.sockaddr, [> `Msg of string ]) Stdlib.result Lwt.t

accept own_cert fd is (ic, oc), sockaddr, the input and output channel from the accepted connection on fd, using the default configuration with the given own_cert.

val connect_ext : Tls.Config.client -> (string * int) -> (ic * oc) Lwt.t

connect_ext client (host, port) is ic, oc, the input and output channel of a TLS connection to host on port using the client configuration.

val connect : + X509.Authenticator.t -> + (string * int) -> + (ic * oc, [> `Msg of string ]) Stdlib.result Lwt.t

connect authenticator (host, port) is ic, oc, the input and output channel of a TLS connection to host on port using the default configuration and the authenticator.

val of_t : ?close:(unit -> unit Lwt.t) -> Unix.t -> ic * oc

of_t t is ic, oc, the input and output channel. close defaults to !Unix.close.

diff --git a/doc/tls-lwt/X509_lwt/index.html b/doc/tls-lwt/X509_lwt/index.html new file mode 100644 index 00000000..413b08e6 --- /dev/null +++ b/doc/tls-lwt/X509_lwt/index.html @@ -0,0 +1,14 @@ + +X509_lwt (tls-lwt.X509_lwt)

Module X509_lwt

X.509 certificate handling using Lwt.

val private_of_pems : + cert:Lwt_io.file_name -> + priv_key:Lwt_io.file_name -> + Tls.Config.certchain Lwt.t

private_of_pems ~cert ~priv_key is priv, after reading the private key and certificate chain from the given PEM-encoded files.

val certs_of_pem : Lwt_io.file_name -> X509.Certificate.t list Lwt.t

certs_of_pem file is certificates, which are read from the PEM-encoded file.

val certs_of_pem_dir : Lwt_io.file_name -> X509.Certificate.t list Lwt.t

certs_of_pem_dir dir is certificates, which are read from all PEM-encoded files in dir.

val authenticator : + ?allowed_hashes:Digestif.hash' list -> + ?crls:Lwt_io.file_name -> + [ `Ca_file of Lwt_io.file_name + | `Ca_dir of Lwt_io.file_name + | `Key_fingerprint of Digestif.hash' * string + | `Hex_key_fingerprint of Digestif.hash' * string + | `Cert_fingerprint of Digestif.hash' * string + | `Hex_cert_fingerprint of Digestif.hash' * string ] -> + X509.Authenticator.t Lwt.t

authenticator methods constructs an authenticator using the specified method and data.

diff --git a/doc/tls-lwt/index.html b/doc/tls-lwt/index.html new file mode 100644 index 00000000..c0ca7800 --- /dev/null +++ b/doc/tls-lwt/index.html @@ -0,0 +1,2 @@ + +index (tls-lwt.index)

tls-lwt index

Library tls-lwt

This library exposes the following toplevel modules:

diff --git a/doc/tls-miou-unix/Tls_miou_unix/index.html b/doc/tls-miou-unix/Tls_miou_unix/index.html index b22fa74a..63285f18 100644 --- a/doc/tls-miou-unix/Tls_miou_unix/index.html +++ b/doc/tls-miou-unix/Tls_miou_unix/index.html @@ -1,11 +1,11 @@ -Tls_miou_unix (tls-miou-unix.Tls_miou_unix)

Module Tls_miou_unix

Effectful operations using Miou for pure TLS.

The pure TLS is state and buffer in, state and buffer out. This module uses Miou (and its Unix layer) for communication over the network.

exception Tls_alert of Tls.Packet.alert_type
exception Tls_failure of Tls.Engine.failure
exception Closed_by_peer
type t

Abstract type of a session.

val file_descr : t -> Miou_unix.file_descr

file_descr returns the underlying file-descriptor used by the given TLS socket.

val read : t -> ?off:int -> ?len:int -> bytes -> int

read fd buf ~off ~len reads up to len bytes (defaults to Bytes.length buf - off from the given TLS socket fd, storing them in byte sequence buf, starting at position off in buf (defaults to 0). It returns the actual number of characters read, between 0 and len (inclusive).

  • raises Unix_error

    raised by the system call Unix.read. The function handles Unix.EINTR, Unix.EAGAIN and Unix.EWOULDBLOCK exceptions and redo the system call.

  • raises Invalid_argument

    if off and len do not designate a valid range of buf.

val really_read : t -> ?off:int -> ?len:int -> bytes -> unit

really_read fd buf ~off ~len reads len bytes (defaults to Bytes.length buf - off) from the given TLS socket fd, storing them in byte sequence buf, starting at position off in buf (defaults to 0). If len = 0, really_read does nothing.

  • raises Unix_error

    raised by the system call Unix.read. The function handles Unix.EINTR, Unix.EAGAIN and Unix.EWOULDBLOCK exceptions and redo the system call.

  • raises End_of_file

    if Unix.read returns 0 before len characters have been read.

  • raises Invalid_argument

    if off and len do not designate a valid range of buf.

val write : t -> ?off:int -> ?len:int -> string -> unit

write t str ~off ~len writes len bytes (defaults to String.length str - off) from byte sequence str, starting at offset off (defaults to 0), to the given TLS socket fd.

  • raises Unix_error

    raised by the syscall call Unix.write. The function handles Unix.EINTR, Unix.EAGAIN and Unix.EWOULDBLOCK exceptions and redo the system call.

  • raises Closed_by_peer

    if t is connected to a peer whose reading end is closed. Similar to the EPIPE error for pipe/socket connected.

  • raises Invalid_argument

    if off and len do not designate a valid range of buf.

val close : t -> unit

close flow closes the TLS session and the underlying file-descriptor.

val shutdown : t -> [ `read | `write | `read_write ] -> unit

shutdown t direction closes the direction of the TLS session t. If `read_write or `write is closed, a TLS close-notify is sent to the other endpoint. If this results in a fully-closed session (or an errorneous session), the underlying file descriptor is closed.

val client_of_fd : - Tls.Config.client -> +Tls_miou_unix (tls-miou-unix.Tls_miou_unix)

Module Tls_miou_unix

Effectful operations using Miou for pure TLS.

The pure TLS is state and buffer in, state and buffer out. This module uses Miou (and its Unix layer) for communication over the network.

exception Tls_alert of Tls.Packet.alert_type
exception Tls_failure of Tls.Engine.failure
exception Closed_by_peer
type t

Abstract type of a session.

val file_descr : t -> Miou_unix.file_descr

file_descr returns the underlying file-descriptor used by the given TLS socket.

val read : t -> ?off:int -> ?len:int -> bytes -> int

read fd buf ~off ~len reads up to len bytes (defaults to Bytes.length buf - off from the given TLS socket fd, storing them in byte sequence buf, starting at position off in buf (defaults to 0). It returns the actual number of characters read, between 0 and len (inclusive).

  • raises Unix_error

    raised by the system call Unix.read. The function handles Unix.EINTR, Unix.EAGAIN and Unix.EWOULDBLOCK exceptions and redo the system call.

  • raises Invalid_argument

    if off and len do not designate a valid range of buf.

val really_read : t -> ?off:int -> ?len:int -> bytes -> unit

really_read fd buf ~off ~len reads len bytes (defaults to Bytes.length buf - off) from the given TLS socket fd, storing them in byte sequence buf, starting at position off in buf (defaults to 0). If len = 0, really_read does nothing.

  • raises Unix_error

    raised by the system call Unix.read. The function handles Unix.EINTR, Unix.EAGAIN and Unix.EWOULDBLOCK exceptions and redo the system call.

  • raises End_of_file

    if Unix.read returns 0 before len characters have been read.

  • raises Invalid_argument

    if off and len do not designate a valid range of buf.

val write : t -> ?off:int -> ?len:int -> string -> unit

write t str ~off ~len writes len bytes (defaults to String.length str - off) from byte sequence str, starting at offset off (defaults to 0), to the given TLS socket fd.

  • raises Unix_error

    raised by the syscall call Unix.write. The function handles Unix.EINTR, Unix.EAGAIN and Unix.EWOULDBLOCK exceptions and redo the system call.

  • raises Closed_by_peer

    if t is connected to a peer whose reading end is closed. Similar to the EPIPE error for pipe/socket connected.

  • raises Invalid_argument

    if off and len do not designate a valid range of buf.

val close : t -> unit

close flow closes the TLS session and the underlying file-descriptor.

val shutdown : t -> [ `read | `write | `read_write ] -> unit

shutdown t direction closes the direction of the TLS session t. If `read_write or `write is closed, a TLS close-notify is sent to the other endpoint. If this results in a fully-closed session (or an errorneous session), the underlying file descriptor is closed.

val client_of_fd : + Tls.Config.client -> ?read_buffer_size:int -> ?host:[ `host ] Domain_name.t -> Miou_unix.file_descr -> t

client_of_flow client ~host fd is t, after client-side TLS handshake of fd using client configuration and host.

  • raises End_of_file

    if we are not able to complete the handshake.

val server_of_fd : - Tls.Config.server -> + Tls.Config.server -> ?read_buffer_size:int -> Miou_unix.file_descr -> - t

server_of_fd server fd is t, after server-side TLS handshake of fd using server configuration.

  • raises End_of_file

    if we are not able to complete the handshake.

val connect : X509.Authenticator.t -> (string * int) -> t

connect authenticator (host, port) is t, a connected TLS connection to host on port using the default configuration and the authenticator.

val epoch : t -> Tls.Core.epoch_data option

epoch t returns epoch, which contains information of the active session.

+ t

server_of_fd server fd is t, after server-side TLS handshake of fd using server configuration.

  • raises End_of_file

    if we are not able to complete the handshake.

val connect : X509.Authenticator.t -> (string * int) -> t

connect authenticator (host, port) is t, a connected TLS connection to host on port using the default configuration and the authenticator.

val epoch : t -> Tls.Core.epoch_data option

epoch t returns epoch, which contains information of the active session.

diff --git a/doc/tls-mirage/Tls_mirage/Make/index.html b/doc/tls-mirage/Tls_mirage/Make/index.html new file mode 100644 index 00000000..9161ecf1 --- /dev/null +++ b/doc/tls-mirage/Tls_mirage/Make/index.html @@ -0,0 +1,20 @@ + +Make (tls-mirage.Tls_mirage.Make)

Module Tls_mirage.Make

TLS module given a flow

Parameters

module F : Mirage_flow.S

Signature

type error = [
  1. | `Tls_alert of Tls.Packet.alert_type
  2. | `Tls_failure of Tls.Engine.failure
  3. | `Read of F.error
  4. | `Write of F.write_error
]

possible errors: incoming alert, processing failure, or a problem in the underlying flow.

type write_error = [
  1. | `Closed
  2. | error
]

The type for write errors.

we provide the FLOW interface

include Mirage_flow.S + with type error := error + and type write_error := write_error
val pp_error : error Fmt.t
val pp_write_error : write_error Fmt.t
type flow
val read : flow -> (Cstruct.t Mirage_flow.or_eof, error) Stdlib.result Lwt.t
val write : flow -> Cstruct.t -> (unit, write_error) Stdlib.result Lwt.t
val writev : flow -> Cstruct.t list -> (unit, write_error) Stdlib.result Lwt.t
val shutdown : flow -> [ `read | `read_write | `write ] -> unit Lwt.t
val close : flow -> unit Lwt.t
val underlying : flow -> F.flow

underlying t returns the underlying flow. This is useful to extract information such as src and dst of that flow.

val reneg : + ?authenticator:X509.Authenticator.t -> + ?acceptable_cas:X509.Distinguished_name.t list -> + ?cert:Tls.Config.own_cert -> + ?drop:bool -> + flow -> + (unit, [ write_error | `Msg of string ]) Stdlib.result Lwt.t

reneg ~authenticator ~acceptable_cas ~cert ~drop t renegotiates the session, and blocks until the renegotiation finished. Optionally, a new authenticator and acceptable_cas can be used. The own certificate can be adjusted by cert. If drop is true (the default), application data received before the renegotiation finished is dropped.

val key_update : + ?request:bool -> + flow -> + (unit, [ write_error | `Msg of string ]) Stdlib.result Lwt.t

key_update ~request t updates the traffic key and requests a traffic key update from the peer if request is provided and true (the default). This is only supported in TLS 1.3.

val client_of_flow : + Tls.Config.client -> + ?host:[ `host ] Domain_name.t -> + F.flow -> + (flow, write_error) Stdlib.result Lwt.t

client_of_flow client ~host flow upgrades the existing connection to TLS using the client configuration, using host as peer name.

val server_of_flow : + Tls.Config.server -> + F.flow -> + (flow, write_error) Stdlib.result Lwt.t

server_of_flow server flow upgrades the flow to a TLS connection using the server configuration.

val epoch : flow -> (Tls.Core.epoch_data, unit) Stdlib.result

epoch flow extracts information of the established session.

diff --git a/doc/tls-mirage/Tls_mirage/X509/index.html b/doc/tls-mirage/Tls_mirage/X509/index.html new file mode 100644 index 00000000..910c1d31 --- /dev/null +++ b/doc/tls-mirage/Tls_mirage/X509/index.html @@ -0,0 +1,9 @@ + +X509 (tls-mirage.Tls_mirage.X509)

Module Tls_mirage.X509

X.509 handling given a key value store and a clock

Parameters

module KV : Mirage_kv.RO
module C : Mirage_clock.PCLOCK

Signature

val authenticator : + ?allowed_hashes:Digestif.hash' list -> + ?crl:string -> + KV.t -> + X509.Authenticator.t Lwt.t

authenticator ~allowed_hashes ~crl store creates an authenticator, using the given certificate authorities in the store as value for key "ca_roots.crt". If allowed_hashes is provided, only these hash algorithms are allowed for signatures of the certificate chain. If crl is provided, the corresponding file is read and used as revocation list (DER encoded). Both options only apply if `CAs is used.

val certificate : + KV.t -> + [< `Default | `Name of string ] -> + Tls.Config.certchain Lwt.t

certificate store typ unmarshals a certificate chain and private key material from the store.

diff --git a/doc/tls-mirage/Tls_mirage/index.html b/doc/tls-mirage/Tls_mirage/index.html new file mode 100644 index 00000000..ae16221c --- /dev/null +++ b/doc/tls-mirage/Tls_mirage/index.html @@ -0,0 +1,2 @@ + +Tls_mirage (tls-mirage.Tls_mirage)

Module Tls_mirage

Effectful operations using Mirage for pure TLS.

module Make (F : Mirage_flow.S) : sig ... end

TLS module given a flow

module X509 (KV : Mirage_kv.RO) (C : Mirage_clock.PCLOCK) : sig ... end

X.509 handling given a key value store and a clock

diff --git a/doc/tls-mirage/index.html b/doc/tls-mirage/index.html new file mode 100644 index 00000000..e2548bbe --- /dev/null +++ b/doc/tls-mirage/index.html @@ -0,0 +1,2 @@ + +index (tls-mirage.index)

tls-mirage index

Library tls-mirage

The entry point of this library is the module: Tls_mirage.

diff --git a/doc/tls/Tls/Ciphersuite/index.html b/doc/tls/Tls/Ciphersuite/index.html new file mode 100644 index 00000000..5551c2b2 --- /dev/null +++ b/doc/tls/Tls/Ciphersuite/index.html @@ -0,0 +1,513 @@ + +Ciphersuite (tls.Tls.Ciphersuite)

Module Tls.Ciphersuite

Ciphersuite definitions and some helper functions.

type key_exchange_algorithm_dhe = [
  1. | `FFDHE
  2. | `ECDHE
]

sum type of all possible key exchange methods

type key_exchange_algorithm = [
  1. | key_exchange_algorithm_dhe
  2. | `RSA
]
val pp_key_exchange_algorithm_dhe : + Stdlib.Format.formatter -> + [< `ECDHE | `FFDHE ] -> + unit
val pp_key_exchange_algorithm : + Stdlib.Format.formatter -> + [< `ECDHE | `FFDHE | `RSA ] -> + unit
val required_usage : + [< `ECDHE | `FFDHE | `RSA ] -> + [> `Digital_signature | `Key_encipherment ]

required_usage kex is usage which a certificate must have if it is used in the given kex method

type block_cipher =
  1. | TRIPLE_DES_EDE_CBC
  2. | AES_128_CBC
  3. | AES_256_CBC
val pp_block_cipher : Stdlib.Format.formatter -> block_cipher -> unit
type aead_cipher =
  1. | AES_128_CCM
  2. | AES_256_CCM
  3. | AES_128_GCM
  4. | AES_256_GCM
  5. | CHACHA20_POLY1305
val pp_aead_cipher : Stdlib.Format.formatter -> aead_cipher -> unit
type payload_protection13 = [
  1. | `AEAD of aead_cipher
]
val pp_payload_protection13 : + Stdlib.Format.formatter -> + [< `AEAD of aead_cipher ] -> + unit
type payload_protection = [
  1. | payload_protection13
  2. | `Block of block_cipher * Digestif.hash'
]
val pp_hash : + Stdlib.Format.formatter -> + [< `MD5 | `SHA1 | `SHA224 | `SHA256 | `SHA384 | `SHA512 ] -> + unit
val pp_payload_protection : + Stdlib.Format.formatter -> + [< `AEAD of aead_cipher + | `Block of + block_cipher * [< `MD5 | `SHA1 | `SHA224 | `SHA256 | `SHA384 | `SHA512 ] ] -> + unit
val kn_13 : aead_cipher -> int * int
val key_length : + unit option -> + [< `AEAD of aead_cipher | `Block of block_cipher * Digestif.hash' ] -> + int * int * int

key_length iv payload_protection is (key size, IV size, mac size) where key IV, and mac sizes are the required bytes for the given payload_protection

type ciphersuite13 = [
  1. | `AES_128_GCM_SHA256
  2. | `AES_256_GCM_SHA384
  3. | `CHACHA20_POLY1305_SHA256
  4. | `AES_128_CCM_SHA256
]
val privprot13 : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 ] -> + aead_cipher
val hash13 : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 ] -> + [> `SHA256 | `SHA384 ]
val any_ciphersuite_to_ciphersuite13 : + Packet.any_ciphersuite -> + [> `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 ] + option
type ciphersuite = [
  1. | ciphersuite13
  2. | `DHE_RSA_WITH_AES_128_GCM_SHA256
  3. | `DHE_RSA_WITH_AES_256_GCM_SHA384
  4. | `DHE_RSA_WITH_AES_256_CCM
  5. | `DHE_RSA_WITH_AES_128_CCM
  6. | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
  7. | `DHE_RSA_WITH_AES_256_CBC_SHA256
  8. | `DHE_RSA_WITH_AES_128_CBC_SHA256
  9. | `DHE_RSA_WITH_AES_256_CBC_SHA
  10. | `DHE_RSA_WITH_AES_128_CBC_SHA
  11. | `DHE_RSA_WITH_3DES_EDE_CBC_SHA
  12. | `ECDHE_RSA_WITH_AES_128_GCM_SHA256
  13. | `ECDHE_RSA_WITH_AES_256_GCM_SHA384
  14. | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
  15. | `ECDHE_RSA_WITH_AES_256_CBC_SHA384
  16. | `ECDHE_RSA_WITH_AES_128_CBC_SHA256
  17. | `ECDHE_RSA_WITH_AES_256_CBC_SHA
  18. | `ECDHE_RSA_WITH_AES_128_CBC_SHA
  19. | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  20. | `RSA_WITH_AES_256_CBC_SHA256
  21. | `RSA_WITH_AES_128_CBC_SHA256
  22. | `RSA_WITH_AES_256_CBC_SHA
  23. | `RSA_WITH_AES_128_CBC_SHA
  24. | `RSA_WITH_3DES_EDE_CBC_SHA
  25. | `RSA_WITH_AES_128_GCM_SHA256
  26. | `RSA_WITH_AES_256_GCM_SHA384
  27. | `RSA_WITH_AES_256_CCM
  28. | `RSA_WITH_AES_128_CCM
  29. | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
  30. | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  31. | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA
  32. | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
  33. | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
  34. | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  35. | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  36. | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
]
val ciphersuite_to_ciphersuite13 : ciphersuite -> ciphersuite13 option
val any_ciphersuite_to_ciphersuite : + Packet.any_ciphersuite -> + [> `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 ] + option
val ciphersuite_to_any_ciphersuite : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 ] -> + Packet.any_ciphersuite
val get_keytype_kex_privprot : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 ] -> + [> `EC | `RSA ] + * [> `ECDHE | `FFDHE | `RSA ] + * [> `AEAD of aead_cipher + | `Block of block_cipher * [> `SHA1 | `SHA256 | `SHA384 ] ]

get_kex_privprot ciphersuite is (kex, privacy_protection) where it dissects the ciphersuite into a pair containing the key exchange method kex, and its privacy_protection

val ciphersuite_kex : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 ] -> + [> `ECDHE | `FFDHE | `RSA ]

ciphersuite_kex ciphersuite is kex, first projection of get_kex_privprot

val ciphersuite_privprot : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 ] -> + [> `AEAD of aead_cipher + | `Block of block_cipher * [> `SHA1 | `SHA256 | `SHA384 ] ]

ciphersuite_privprot ciphersuite is privprot, second projection of get_kex_privprot

val ciphersuite_keytype : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 ] -> + [> `EC | `RSA ]
val pp_ciphersuite : + Stdlib.Format.formatter -> + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 AES_128_CCM_SHA256 AES_128_GCM_SHA256 AES_256_GCM_SHA384 CHACHA20_POLY1305_SHA256 ] -> + unit
val pp_any_ciphersuite : + Stdlib.Format.formatter -> + Packet.any_ciphersuite -> + unit
val ciphersuite_fs : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 ] -> + bool
val ecdhe_only : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 AES_128_CCM_SHA256 AES_128_GCM_SHA256 AES_256_GCM_SHA384 CHACHA20_POLY1305_SHA256 ] -> + bool
val dhe_only : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 AES_128_CCM_SHA256 AES_128_GCM_SHA256 AES_256_GCM_SHA384 CHACHA20_POLY1305_SHA256 ] -> + bool
val ecdhe : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 AES_128_CCM_SHA256 AES_128_GCM_SHA256 AES_256_GCM_SHA384 CHACHA20_POLY1305_SHA256 ] -> + bool
val ciphersuite_tls12_only : + [> `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 ] -> + bool
val ciphersuite_tls13 : [> ciphersuite13 ] -> bool
diff --git a/doc/tls/Tls/Config/Ciphers/index.html b/doc/tls/Tls/Config/Ciphers/index.html new file mode 100644 index 00000000..0804037e --- /dev/null +++ b/doc/tls/Tls/Config/Ciphers/index.html @@ -0,0 +1,2 @@ + +Ciphers (tls.Tls.Config.Ciphers)

Module Config.Ciphers

Cipher selection

Cipher selection related utilities.

Cipher selection

val default : Ciphersuite.ciphersuite list

default is a list of ciphersuites this library uses by default.

val supported : Ciphersuite.ciphersuite list

supported is a list of ciphersuites this library supports (larger than default).

fs is a list of ciphersuites which provide forward secrecy (sublist of default).

val http2 : Ciphersuite.ciphersuite list

http2 is a list of ciphersuites which are allowed to be used with HTTP2: not a member of bad cipher suites. These are only ephemeral key exchanges with AEAD ciphers.

fs_of ciphers selects all ciphersuites which provide forward secrecy from ciphers.

diff --git a/doc/tls/Tls/Config/index.html b/doc/tls/Tls/Config/index.html new file mode 100644 index 00000000..3110b7f3 --- /dev/null +++ b/doc/tls/Tls/Config/index.html @@ -0,0 +1,32 @@ + +Config (tls.Tls.Config)

Module Tls.Config

Configuration of the TLS stack

Config type

type certchain = X509.Certificate.t list * X509.Private_key.t

certificate chain and private key of the first certificate

type own_cert = [
  1. | `None
  2. | `Single of certchain
  3. | `Multiple of certchain list
  4. | `Multiple_default of certchain * certchain list
]

polymorphic variant of own certificates

type session_cache = Core.SessionID.t -> Core.epoch_data option
type ticket_cache = {
  1. lookup : string -> (Core.psk13 * Core.epoch_data) option;
  2. ticket_granted : Core.psk13 -> Core.epoch_data -> unit;
  3. lifetime : int32;
  4. timestamp : unit -> Ptime.t;
}
type config = private {
  1. ciphers : Ciphersuite.ciphersuite list;
    (*

    ordered list (regarding preference) of supported cipher suites

    *)
  2. protocol_versions : Core.tls_version * Core.tls_version;
    (*

    supported protocol versions (min, max)

    *)
  3. signature_algorithms : Core.signature_algorithm list;
    (*

    ordered list of supported signature algorithms (regarding preference)

    *)
  4. use_reneg : bool;
    (*

    endpoint should accept renegotiation requests

    *)
  5. authenticator : X509.Authenticator.t option;
    (*

    optional X509 authenticator

    *)
  6. peer_name : [ `host ] Domain_name.t option;
    (*

    optional name of other endpoint (used for SNI RFC4366)

    *)
  7. own_certificates : own_cert;
    (*

    optional default certificate chain and other certificate chains

    *)
  8. acceptable_cas : X509.Distinguished_name.t list;
    (*

    ordered list of acceptable certificate authorities

    *)
  9. session_cache : session_cache;
  10. ticket_cache : ticket_cache option;
  11. cached_session : Core.epoch_data option;
  12. cached_ticket : (Core.psk13 * Core.epoch_data) option;
  13. alpn_protocols : string list;
    (*

    optional ordered list of accepted alpn_protocols

    *)
  14. groups : Core.group list;
    (*

    the first FFDHE will be used for TLS 1.2 and below if a DHE ciphersuite is used

    *)
  15. zero_rtt : int32;
  16. ip : Ipaddr.t option;
}

configuration parameters

val ciphers13 : config -> Ciphersuite.ciphersuite13 list

ciphers13 config are the ciphersuites for TLS 1.3 in the configuration.

type client

opaque type of a client configuration

type server

opaque type of a server configuration

Constructors

val client : + authenticator:X509.Authenticator.t -> + ?peer_name:[ `host ] Domain_name.t -> + ?ciphers:Ciphersuite.ciphersuite list -> + ?version:(Core.tls_version * Core.tls_version) -> + ?signature_algorithms:Core.signature_algorithm list -> + ?reneg:bool -> + ?certificates:own_cert -> + ?cached_session:Core.epoch_data -> + ?cached_ticket:(Core.psk13 * Core.epoch_data) -> + ?ticket_cache:ticket_cache -> + ?alpn_protocols:string list -> + ?groups:Core.group list -> + ?ip:Ipaddr.t -> + unit -> + (client, [> `Msg of string ]) Stdlib.result

client authenticator ?peer_name ?ciphers ?version ?hashes ?reneg ?certificates ?alpn_protocols is client configuration with the given parameters. Returns an error if the configuration is invalid.

val server : + ?ciphers:Ciphersuite.ciphersuite list -> + ?version:(Core.tls_version * Core.tls_version) -> + ?signature_algorithms:Core.signature_algorithm list -> + ?reneg:bool -> + ?certificates:own_cert -> + ?acceptable_cas:X509.Distinguished_name.t list -> + ?authenticator:X509.Authenticator.t -> + ?session_cache:session_cache -> + ?ticket_cache:ticket_cache -> + ?alpn_protocols:string list -> + ?groups:Core.group list -> + ?zero_rtt:int32 -> + ?ip:Ipaddr.t -> + unit -> + (server, [> `Msg of string ]) Stdlib.result

server ?ciphers ?version ?hashes ?reneg ?certificates ?acceptable_cas ?authenticator ?alpn_protocols is server configuration with the given parameters. Returns an error if the configuration is invalid.

val peer : client -> [ `host ] Domain_name.t -> client

peer client name is client with name as peer_name

Note on ALPN protocol selection

Both client and server constructors accept an alpn_protocols list. The list for server should be given in a descending order of preference. In the case of protocol selection, the server will iterate its list and select the first element that the client's list also advertises.

For example, if the client advertises ["foo"; "bar"; "baz"] and the server has ["bar"; "foo"], "bar" will be selected as the protocol of the handshake.

Utility functions

val default_signature_algorithms : Core.signature_algorithm list

default_signature_algorithms is a list of signature algorithms used by default

val supported_signature_algorithms : Core.signature_algorithm list

supported_signature_algorithms is a list of supported signature algorithms by this library

val min_dh_size : int

min_dh_size is minimal diffie hellman group size in bits (currently 1024)

val supported_groups : Core.group list

supported_groups are the Diffie-Hellman groups supported in this library.

val elliptic_curve : Core.group -> bool

elliptic_curve group is true if group is an elliptic curve, false otherwise.

val min_rsa_key_size : int

min_rsa_key_size is minimal RSA modulus key size in bits (currently 1024)

module Ciphers : sig ... end

Cipher selection

Internal use only

val of_client : client -> config

of_client client is a client configuration for client

val of_server : server -> config

of_server server is a server configuration for server

val with_authenticator : config -> X509.Authenticator.t -> config

with_authenticator config auth is config with auth as authenticator

val with_own_certificates : config -> own_cert -> config

with_own_certificates config cert is config with cert as own_cert

val with_acceptable_cas : config -> X509.Distinguished_name.t list -> config

with_acceptable_cas config cas is config with cas as accepted_cas

diff --git a/doc/tls/Tls/Core/PreSharedKeyID/index.html b/doc/tls/Tls/Core/PreSharedKeyID/index.html new file mode 100644 index 00000000..dc525d1d --- /dev/null +++ b/doc/tls/Tls/Core/PreSharedKeyID/index.html @@ -0,0 +1,2 @@ + +PreSharedKeyID (tls.Tls.Core.PreSharedKeyID)

Module Core.PreSharedKeyID

type t = string
val compare : Stdlib.String.t -> Stdlib.String.t -> int
val hash : 'a -> int
val equal : Stdlib.String.t -> Stdlib.String.t -> bool
diff --git a/doc/tls/Tls/Core/SessionID/index.html b/doc/tls/Tls/Core/SessionID/index.html new file mode 100644 index 00000000..ea39ae46 --- /dev/null +++ b/doc/tls/Tls/Core/SessionID/index.html @@ -0,0 +1,2 @@ + +SessionID (tls.Tls.Core.SessionID)

Module Core.SessionID

type t = string
val compare : Stdlib.String.t -> Stdlib.String.t -> int
val hash : 'a -> int
val equal : Stdlib.String.t -> Stdlib.String.t -> bool
diff --git a/doc/tls/Tls/Core/Tracing/index.html b/doc/tls/Tls/Core/Tracing/index.html new file mode 100644 index 00000000..6ce50960 --- /dev/null +++ b/doc/tls/Tls/Core/Tracing/index.html @@ -0,0 +1,15 @@ + +Tracing (tls.Tls.Core.Tracing)

Module Core.Tracing

include Logs.LOG
val msg : Logs.level -> 'a Logs.log
val app : 'a Logs.log
val err : 'a Logs.log
val warn : 'a Logs.log
val info : 'a Logs.log
val debug : 'a Logs.log
val kmsg : (unit -> 'b) -> Logs.level -> ('a, 'b) Logs.msgf -> 'b
val on_error : + ?level:Logs.level -> + ?header:string -> + ?tags:Logs.Tag.set -> + pp:(Stdlib.Format.formatter -> 'b -> unit) -> + use:('b -> 'a) -> + ('a, 'b) Stdlib.result -> + 'a
val on_error_msg : + ?level:Logs.level -> + ?header:string -> + ?tags:Logs.Tag.set -> + use:(unit -> 'a) -> + ('a, [ `Msg of string ]) Stdlib.result -> + 'a
val cs : tag:string -> string -> unit
val hs : tag:string -> tls_handshake -> unit
diff --git a/doc/tls/Tls/Core/index.html b/doc/tls/Tls/Core/index.html new file mode 100644 index 00000000..5ca15e5a --- /dev/null +++ b/doc/tls/Tls/Core/index.html @@ -0,0 +1,187 @@ + +Core (tls.Tls.Core)

Module Tls.Core

Core type definitions

val let* : + ('a, 'b) Stdlib.result -> + ('a -> ('c, 'b) Stdlib.result) -> + ('c, 'b) Stdlib.result
val guard : bool -> 'a -> (unit, 'b) Stdlib.result
val split_str : ?start:int -> string -> int -> string * string
val map_reader_error : + ('a, 'b) Stdlib.result -> + ('a, [> `Fatal of 'b ]) Stdlib.result
type tls13 = [
  1. | `TLS_1_3
]
val pp_tls13 : Stdlib.Format.formatter -> [< `TLS_1_3 ] -> unit
type tls_before_13 = [
  1. | `TLS_1_0
  2. | `TLS_1_1
  3. | `TLS_1_2
]
val pp_tls_before_13 : + Stdlib.Format.formatter -> + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 ] -> + unit
type tls_version = [
  1. | tls13
  2. | tls_before_13
]
val pp_tls_version : + Stdlib.Format.formatter -> + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] -> + unit
val pair_of_tls_version : + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] -> + int * int
val compare_tls_version : + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] -> + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] -> + int
val next : + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] -> + [> `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] option
val all_versions : + ([< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 TLS_1_1 TLS_1_2 TLS_1_3 ] as 'a + * [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ]) -> + 'b list
val tls_version_of_pair : + (int * int) -> + [> `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] option
type tls_any_version = [
  1. | tls_version
  2. | `SSL_3
  3. | `TLS_1_X of int
]
val pp_tls_any_version : + Stdlib.Format.formatter -> + [< `SSL_3 | `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 | `TLS_1_X of int ] -> + unit
val any_version_to_version : + [> tls_version ] -> + [> `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] option
val version_eq : + [> tls_version ] -> + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] -> + bool
val version_ge : + [< `SSL_3 | `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 | `TLS_1_X of 'a ] -> + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] -> + bool
val tls_any_version_of_pair : + (int * int) -> + [> `SSL_3 | `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 | `TLS_1_X of int ] + option
val pair_of_tls_any_version : + [< `SSL_3 | `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 | `TLS_1_X of int ] -> + int * int
val max_protocol_version : ('a * 'b) -> 'c
val min_protocol_version : ('a * 'b) -> 'c
type tls_hdr = {
  1. content_type : Packet.content_type;
  2. version : tls_any_version;
}
val pp_tls_hdr : Stdlib.Format.formatter -> tls_hdr -> unit
module SessionID : sig ... end
module PreSharedKeyID : sig ... end
type psk_identity = (string * int32) * string
val binders_len : ('a * string) list -> int
type group = [
  1. | `FFDHE2048
  2. | `FFDHE3072
  3. | `FFDHE4096
  4. | `FFDHE6144
  5. | `FFDHE8192
  6. | `X25519
  7. | `P256
  8. | `P384
  9. | `P521
]
val pp_group : + Stdlib.Format.formatter -> + [< `FFDHE2048 + | `FFDHE3072 + | `FFDHE4096 + | `FFDHE6144 + | `FFDHE8192 + | `P256 + | `P384 + | `P521 + | `X25519 ] -> + unit
val named_group_to_group : + Packet.named_group -> + [> `FFDHE2048 + | `FFDHE3072 + | `FFDHE4096 + | `FFDHE6144 + | `FFDHE8192 + | `P256 + | `P384 + | `P521 + | `X25519 ] + option
val group_to_named_group : + [< `FFDHE2048 + | `FFDHE3072 + | `FFDHE4096 + | `FFDHE6144 + | `FFDHE8192 + | `P256 + | `P384 + | `P521 + | `X25519 ] -> + Packet.named_group
val group_to_impl : + [< `FFDHE2048 + | `FFDHE3072 + | `FFDHE4096 + | `FFDHE6144 + | `FFDHE8192 + | `P256 + | `P384 + | `P521 + | `X25519 ] -> + [> `Finite_field of Mirage_crypto_pk.Dh.group + | `P256 + | `P384 + | `P521 + | `X25519 ]
type signature_algorithm = [
  1. | `RSA_PKCS1_MD5
  2. | `RSA_PKCS1_SHA1
  3. | `RSA_PKCS1_SHA224
  4. | `RSA_PKCS1_SHA256
  5. | `RSA_PKCS1_SHA384
  6. | `RSA_PKCS1_SHA512
  7. | `ECDSA_SECP256R1_SHA1
  8. | `ECDSA_SECP256R1_SHA256
  9. | `ECDSA_SECP384R1_SHA384
  10. | `ECDSA_SECP521R1_SHA512
  11. | `RSA_PSS_RSAENC_SHA256
  12. | `RSA_PSS_RSAENC_SHA384
  13. | `RSA_PSS_RSAENC_SHA512
  14. | `ED25519
]
val hash_of_signature_algorithm : + [< `ECDSA_SECP256R1_SHA1 + | `ECDSA_SECP256R1_SHA256 + | `ECDSA_SECP384R1_SHA384 + | `ECDSA_SECP521R1_SHA512 + | `ED25519 + | `RSA_PKCS1_MD5 + | `RSA_PKCS1_SHA1 + | `RSA_PKCS1_SHA224 + | `RSA_PKCS1_SHA256 + | `RSA_PKCS1_SHA384 + | `RSA_PKCS1_SHA512 + | `RSA_PSS_RSAENC_SHA256 + | `RSA_PSS_RSAENC_SHA384 + | `RSA_PSS_RSAENC_SHA512 ] -> + [> `MD5 | `SHA1 | `SHA224 | `SHA256 | `SHA384 | `SHA512 ]
val signature_scheme_of_signature_algorithm : + [< `ECDSA_SECP256R1_SHA1 + | `ECDSA_SECP256R1_SHA256 + | `ECDSA_SECP384R1_SHA384 + | `ECDSA_SECP521R1_SHA512 + | `ED25519 + | `RSA_PKCS1_MD5 + | `RSA_PKCS1_SHA1 + | `RSA_PKCS1_SHA224 + | `RSA_PKCS1_SHA256 + | `RSA_PKCS1_SHA384 + | `RSA_PKCS1_SHA512 + | `RSA_PSS_RSAENC_SHA256 + | `RSA_PSS_RSAENC_SHA384 + | `RSA_PSS_RSAENC_SHA512 ] -> + [> `ECDSA | `ED25519 | `RSA_PKCS1 | `RSA_PSS ]
val pp_signature_algorithm : + Stdlib.Format.formatter -> + [< `ECDSA_SECP256R1_SHA1 + | `ECDSA_SECP256R1_SHA256 + | `ECDSA_SECP384R1_SHA384 + | `ECDSA_SECP521R1_SHA512 + | `ED25519 + | `RSA_PKCS1_MD5 + | `RSA_PKCS1_SHA1 + | `RSA_PKCS1_SHA224 + | `RSA_PKCS1_SHA256 + | `RSA_PKCS1_SHA384 + | `RSA_PKCS1_SHA512 + | `RSA_PSS_RSAENC_SHA256 + | `RSA_PSS_RSAENC_SHA384 + | `RSA_PSS_RSAENC_SHA512 ECDSA_SECP256R1_SHA1 ECDSA_SECP256R1_SHA256 ECDSA_SECP384R1_SHA384 ECDSA_SECP521R1_SHA512 ] -> + unit
val rsa_sigalg : + [< `ECDSA_SECP256R1_SHA1 + | `ECDSA_SECP256R1_SHA256 + | `ECDSA_SECP384R1_SHA384 + | `ECDSA_SECP521R1_SHA512 + | `ED25519 + | `RSA_PKCS1_MD5 + | `RSA_PKCS1_SHA1 + | `RSA_PKCS1_SHA224 + | `RSA_PKCS1_SHA256 + | `RSA_PKCS1_SHA384 + | `RSA_PKCS1_SHA512 + | `RSA_PSS_RSAENC_SHA256 + | `RSA_PSS_RSAENC_SHA384 + | `RSA_PSS_RSAENC_SHA512 ] -> + bool
val tls13_sigalg : + [< `ECDSA_SECP256R1_SHA1 + | `ECDSA_SECP256R1_SHA256 + | `ECDSA_SECP384R1_SHA384 + | `ECDSA_SECP521R1_SHA512 + | `ED25519 + | `RSA_PKCS1_MD5 + | `RSA_PKCS1_SHA1 + | `RSA_PKCS1_SHA224 + | `RSA_PKCS1_SHA256 + | `RSA_PKCS1_SHA384 + | `RSA_PKCS1_SHA512 + | `RSA_PSS_RSAENC_SHA256 + | `RSA_PSS_RSAENC_SHA384 + | `RSA_PSS_RSAENC_SHA512 ] -> + bool
val pk_matches_sa : + [> `ED25519 of 'a | `P256 of 'b | `P384 of 'c | `P521 of 'd | `RSA of 'e ] -> + [< `ECDSA_SECP256R1_SHA1 + | `ECDSA_SECP256R1_SHA256 + | `ECDSA_SECP384R1_SHA384 + | `ECDSA_SECP521R1_SHA512 + | `ED25519 + | `RSA_PKCS1_MD5 + | `RSA_PKCS1_SHA1 + | `RSA_PKCS1_SHA224 + | `RSA_PKCS1_SHA256 + | `RSA_PKCS1_SHA384 + | `RSA_PKCS1_SHA512 + | `RSA_PSS_RSAENC_SHA256 + | `RSA_PSS_RSAENC_SHA384 + | `RSA_PSS_RSAENC_SHA512 ECDSA_SECP256R1_SHA1 ECDSA_SECP256R1_SHA256 ECDSA_SECP384R1_SHA384 ECDSA_SECP521R1_SHA512 ED25519 ] -> + bool
type client_extension = [
  1. | `Hostname of [ `host ] Domain_name.t
  2. | `MaxFragmentLength of Packet.max_fragment_length
  3. | `SupportedGroups of Packet.named_group list
  4. | `SecureRenegotiation of string
  5. | `Padding of int
  6. | `SignatureAlgorithms of signature_algorithm list
  7. | `ExtendedMasterSecret
  8. | `ALPN of string list
  9. | `KeyShare of (Packet.named_group * string) list
  10. | `EarlyDataIndication
  11. | `PreSharedKeys of psk_identity list
  12. | `SupportedVersions of tls_any_version list
  13. | `PostHandshakeAuthentication
  14. | `Cookie of string
  15. | `PskKeyExchangeModes of Packet.psk_key_exchange_mode list
  16. | `ECPointFormats
  17. | `UnknownExtension of int * string
]
type server13_extension = [
  1. | `KeyShare of group * string
  2. | `PreSharedKey of int
  3. | `SelectedVersion of tls_version
]
type server_extension = [
  1. | server13_extension
  2. | `Hostname
  3. | `MaxFragmentLength of Packet.max_fragment_length
  4. | `SecureRenegotiation of string
  5. | `ExtendedMasterSecret
  6. | `ALPN of string
  7. | `ECPointFormats
  8. | `UnknownExtension of int * string
]
type encrypted_extension = [
  1. | `Hostname
  2. | `MaxFragmentLength of Packet.max_fragment_length
  3. | `SupportedGroups of group list
  4. | `ALPN of string
  5. | `EarlyDataIndication
  6. | `UnknownExtension of int * string
]
type hello_retry_extension = [
  1. | `SelectedGroup of group
  2. | `Cookie of string
  3. | `SelectedVersion of tls_version
  4. | `UnknownExtension of int * string
]
type client_hello = {
  1. client_version : tls_any_version;
  2. client_random : string;
  3. sessionid : SessionID.t option;
  4. ciphersuites : Packet.any_ciphersuite list;
  5. extensions : client_extension list;
}
type server_hello = {
  1. server_version : tls_version;
  2. server_random : string;
  3. sessionid : SessionID.t option;
  4. ciphersuite : Ciphersuite.ciphersuite;
  5. extensions : server_extension list;
}
type dh_parameters = {
  1. dh_p : string;
  2. dh_g : string;
  3. dh_Ys : string;
}
type hello_retry = {
  1. retry_version : tls_version;
  2. ciphersuite : Ciphersuite.ciphersuite13;
  3. sessionid : SessionID.t option;
  4. selected_group : group;
  5. extensions : hello_retry_extension list;
}
type session_ticket_extension = [
  1. | `EarlyDataIndication of int32
  2. | `UnknownExtension of int * string
]
type session_ticket = {
  1. lifetime : int32;
  2. age_add : int32;
  3. nonce : string;
  4. ticket : string;
  5. extensions : session_ticket_extension list;
}
type certificate_request_extension = [
  1. | `SignatureAlgorithms of signature_algorithm list
  2. | `CertificateAuthorities of X509.Distinguished_name.t list
  3. | `UnknownExtension of int * string
]
type tls_handshake =
  1. | HelloRequest
  2. | HelloRetryRequest of hello_retry
  3. | EncryptedExtensions of encrypted_extension list
  4. | ServerHelloDone
  5. | ClientHello of client_hello
  6. | ServerHello of server_hello
  7. | Certificate of string
  8. | ServerKeyExchange of string
  9. | CertificateRequest of string
  10. | ClientKeyExchange of string
  11. | CertificateVerify of string
  12. | Finished of string
  13. | SessionTicket of session_ticket
  14. | KeyUpdate of Packet.key_update_request_type
  15. | EndOfEarlyData
val pp_handshake : Stdlib.Format.formatter -> tls_handshake -> unit
val src : Logs.src
module Tracing : sig ... end
type master_secret = string

the master secret of a TLS connection

type psk13 = {
  1. identifier : string;
  2. obfuscation : int32;
  3. secret : string;
  4. lifetime : int32;
  5. early_data : int32;
  6. issued_at : Ptime.t;
}
type epoch_state = [
  1. | `ZeroRTT
  2. | `Established
]
type epoch_data = {
  1. side : [ `Client | `Server ];
  2. state : epoch_state;
  3. protocol_version : tls_version;
  4. ciphersuite : Ciphersuite.ciphersuite;
  5. peer_random : string;
  6. peer_certificate_chain : X509.Certificate.t list;
  7. peer_certificate : X509.Certificate.t option;
  8. peer_name : [ `host ] Domain_name.t option;
  9. trust_anchor : X509.Certificate.t option;
  10. received_certificates : X509.Certificate.t list;
  11. own_random : string;
  12. own_certificate : X509.Certificate.t list;
  13. own_private_key : X509.Private_key.t option;
  14. own_name : [ `host ] Domain_name.t option;
  15. master_secret : master_secret;
  16. exporter_master_secret : master_secret;
  17. session_id : SessionID.t;
  18. extended_ms : bool;
  19. alpn_protocol : string option;
  20. tls_unique : string option;
}

information about an open session

val supports_key_usage : + ?not_present:bool -> + X509.Extension.key_usage -> + X509.Certificate.t -> + bool
val supports_extended_key_usage : + ?not_present:bool -> + X509.Extension.extended_key_usage -> + X509.Certificate.t -> + bool
diff --git a/doc/tls/Tls/Crypto/Ciphers/index.html b/doc/tls/Tls/Crypto/Ciphers/index.html new file mode 100644 index 00000000..8308ee73 --- /dev/null +++ b/doc/tls/Tls/Crypto/Ciphers/index.html @@ -0,0 +1,13 @@ + +Ciphers (tls.Tls.Crypto.Ciphers)

Module Crypto.Ciphers

type keyed =
  1. | K_CBC : 'k State.cbc_cipher * (string -> 'k) -> keyed
val get_block : Ciphersuite.block_cipher -> keyed
type aead_keyed =
  1. | K_AEAD : 'k State.aead_cipher * (string -> 'k) * bool -> aead_keyed
val get_aead_cipher : + secret:string -> + nonce:State.nonce -> + Ciphersuite.aead_cipher -> + State.cipher_st
val get_cipher : + secret:string -> + hmac_secret:State.hmac_key -> + iv_mode:State.iv_mode -> + nonce:State.nonce -> + [< `AEAD of Ciphersuite.aead_cipher + | `Block of Ciphersuite.block_cipher * Digestif.hash' ] -> + State.cipher_st
diff --git a/doc/tls/Tls/Crypto/index.html b/doc/tls/Tls/Crypto/index.html new file mode 100644 index 00000000..57fde825 --- /dev/null +++ b/doc/tls/Tls/Crypto/index.html @@ -0,0 +1,31 @@ + +Crypto (tls.Tls.Crypto)

Module Tls.Crypto

val dh_params_pack : Mirage_crypto_pk.Dh.group -> string -> Core.dh_parameters
val dh_params_unpack : + Core.dh_parameters -> + (Mirage_crypto_pk.Dh.group * string, [> `Msg of string ]) Stdlib.result
module Ciphers : sig ... end
val sequence_buf : int64 -> string
val aead_nonce : string -> int64 -> string
val adata_1_3 : int -> string
val pseudo_header : + int64 -> + Packet.content_type -> + (int * int) -> + int -> + string
val mac : Digestif.hash' -> string -> string -> string -> string
val cbc_block : (module Mirage_crypto.Block.CBC with type key = 'a) -> int
val cbc_pad : int -> string -> string
val cbc_unpad : string -> string option
val tag_len : (module Mirage_crypto.AEAD with type key = 'a) -> int
val encrypt_aead : + cipher:(module Mirage_crypto.AEAD with type key = 'a) -> + key:'a0 -> + nonce:string -> + ?adata:string -> + string -> + string
val decrypt_aead : + cipher:(module Mirage_crypto.AEAD with type key = 'a) -> + key:'a0 -> + nonce:string -> + ?adata:string -> + string -> + string option
val encrypt_cbc : + cipher:(module Mirage_crypto.Block.CBC with type key = 'a) -> + key:'a0 -> + iv:string -> + string -> + string * string
val decrypt_cbc : + cipher:(module Mirage_crypto.Block.CBC with type key = 'a) -> + key:'a0 -> + iv:string -> + string -> + (string * string) option
diff --git a/doc/tls/Tls/Engine/index.html b/doc/tls/Tls/Engine/index.html new file mode 100644 index 00000000..1715ada2 --- /dev/null +++ b/doc/tls/Tls/Engine/index.html @@ -0,0 +1,34 @@ + +Engine (tls.Tls.Engine)

Module Tls.Engine

Transport layer security

TLS is an implementation of transport layer security in OCaml. TLS is a widely used security protocol which establishes an end-to-end secure channel (with optional (mutual) authentication) between two endpoints. It uses TCP/IP as transport. This library supports all four versions of TLS: 1.3, RFC8446, 1.2, RFC5246, 1.1, RFC4346, and 1.0, RFC2246. SSL, the previous protocol definition, is not supported.

TLS is algorithmically agile: protocol version, key exchange algorithm, symmetric cipher, and message authentication code are negotiated upon connection.

This library implements several extensions of TLS, AES ciphers, TLS extensions (such as server name indication, SNI), Renegotiation extension, Session Hash and Extended Master Secret Extension.

This library does not contain insecure cipher suites (such as single DES, export ciphers, ...). It does not expose the server time in the server random, requires secure renegotiation.

This library consists of a core, implemented in a purely functional matter (Engine, this module), and effectful parts: Tls_lwt and Tls_mirage.

v1.0.4

Abstract state type

type state

The abstract type of a TLS state.

Constructors

val client : Config.client -> state * string

client client is tls * out where tls is the initial state, and out the initial client hello

val server : Config.server -> state

server server is tls where tls is the initial server state

Protocol failures

type error = [
  1. | `AuthenticationFailure of X509.Validation.validation_error
  2. | `NoConfiguredCiphersuite of Ciphersuite.ciphersuite list
  3. | `NoConfiguredVersions of Core.tls_version list
  4. | `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list
  5. | `NoMatchingCertificateFound of string
  6. | `CouldntSelectCertificate
]

failures which can be mitigated by reconfiguration

type fatal = [
  1. | `Protocol_version of + [ `None_supported of Core.tls_any_version list + | `Unknown_record of int * int + | `Bad_record of Core.tls_any_version ]
  2. | `Unexpected of + [ `Content_type of int + | `Message of string + | `Handshake of Core.tls_handshake ]
  3. | `Decode of string
  4. | `Handshake of + [ `Message of string + | `Fragments + | `BadDH of string + | `BadECDH of Mirage_crypto_ec.error ]
  5. | `Bad_certificate of string
  6. | `Missing_extension of string
  7. | `Bad_mac
  8. | `Record_overflow of int
  9. | `Unsupported_extension
  10. | `Inappropriate_fallback
  11. | `No_application_protocol
]

failures from received garbage or lack of features

type failure = [
  1. | `Error of error
  2. | `Fatal of fatal
  3. | `Alert of Packet.alert_type
]

type of failures

val alert_of_failure : failure -> Packet.alert_level * Packet.alert_type

alert_of_failure failure is alert, the TLS alert type for this failure.

val string_of_failure : failure -> string

string_of_failure failure is string, the string representation of the failure.

val pp_failure : failure Fmt.t

pp_failure failure pretty-prints failure.

Protocol handling

type ret = + (state + * [ `Eof ] option + * [ `Response of string option ] + * [ `Data of string option ], + failure * [ `Response of string ]) + Stdlib.result

result type of handle_tls: either failed to handle the incoming buffer (`Fail) with failure and potentially a message to send to the other endpoint, or sucessful operation (`Ok) with a new state, an end of file (`Eof), or an incoming (`Alert). Possibly some `Response to the other endpoint is needed, and potentially some `Data for the application was received.

val handle_tls : state -> string -> ret

handle_tls state buffer is ret, depending on incoming state and buffer, the result is the appropriate ret

val handshake_in_progress : state -> bool

handshake_in_progrss state is a predicate which indicates whether there is a handshake in progress or scheduled.

val send_application_data : state -> string list -> (state * string) option

send_application_data tls outs is Some (tls', out) where tls' is the new tls state, and out the cstruct to send over the wire (encrypted outs) when the TLS session is ready. When the TLS session is not ready it is None.

val send_close_notify : state -> state * string

send_close_notify tls is tls' * out where tls' is the new tls state, and out the (possible encrypted) close notify alert.

val reneg : + ?authenticator:X509.Authenticator.t -> + ?acceptable_cas:X509.Distinguished_name.t list -> + ?cert:Config.own_cert -> + state -> + (state * string) option

reneg ~authenticator ~acceptable_cas ~cert tls initiates a renegotation on tls, using the provided authenticator. It is tls' * out where tls' is the new tls state, and out either a client hello or hello request (depending on which communication endpoint tls is).

val key_update : + ?request:bool -> + state -> + (state * string, failure) Stdlib.result

key_update ~request state initiates a KeyUpdate (TLS 1.3 only). If request is provided and true (the default), the KeyUpdate message contains a request that the peer should update their traffic key as well.

Session information

val epoch : state -> (Core.epoch_data, unit) Stdlib.result

epoch state is epoch, which contains the session information. If there's no established session yet, an error is returned.

val export_key_material : + Core.epoch_data -> + ?context:string -> + string -> + int -> + string

export_key_material epoch_data ?context label length is the RFC 5705 exported key material of length bytes using label and, if provided, context.

val channel_binding : + Core.epoch_data -> + [ `Tls_exporter | `Tls_unique | `Tls_server_endpoint ] -> + (string, [ `Msg of string ]) Stdlib.result

channel_binding epoch_data mode is the RFC 5929 and RFC 9266 specified channel binding. Please note that `Tls_unique will error for TLS 1.3 sessions, and `Tls_exporter is not recommended for TLS < 1.3 sessions (unless the uniqueness is ensured via another path).

diff --git a/doc/tls/Tls/Explorator/index.html b/doc/tls/Tls/Explorator/index.html new file mode 100644 index 00000000..15bab10b --- /dev/null +++ b/doc/tls/Tls/Explorator/index.html @@ -0,0 +1,2 @@ + +Explorator (tls.Tls.Explorator)

Module Tls.Explorator

diff --git a/doc/tls/Tls/Handshake_client/index.html b/doc/tls/Tls/Handshake_client/index.html new file mode 100644 index 00000000..4010433b --- /dev/null +++ b/doc/tls/Tls/Handshake_client/index.html @@ -0,0 +1,14 @@ + +Handshake_client (tls.Tls.Handshake_client)

Module Tls.Handshake_client

val default_client_hello : + Config.config -> + Core.client_hello * Core.tls_version * (Core.group * State.dh_secret) list
val handle_change_cipher_spec : + State.client_handshake_state -> + State.handshake_state -> + string -> + (State.handshake_return, State.failure) Stdlib.result
val handle_handshake : + State.client_handshake_state -> + State.handshake_state -> + string -> + (State.handshake_return, State.failure) Stdlib.result
val answer_hello_request : + State.handshake_state -> + (State.handshake_return, State.failure) Stdlib.result
diff --git a/doc/tls/Tls/Handshake_client13/index.html b/doc/tls/Tls/Handshake_client13/index.html new file mode 100644 index 00000000..1b7f9089 --- /dev/null +++ b/doc/tls/Tls/Handshake_client13/index.html @@ -0,0 +1,131 @@ + +Handshake_client13 (tls.Tls.Handshake_client13)

Module Tls.Handshake_client13

val answer_server_hello : + State.handshake_state -> + Core.client_hello -> + Core.server_hello -> + (Core.group + * [< `Finite_field of Mirage_crypto_pk.Dh.secret + | `P256 of Mirage_crypto_ec.P256.Dh.secret + | `P384 of Mirage_crypto_ec.P384.Dh.secret + | `P521 of Mirage_crypto_ec.P521.Dh.secret + | `X25519 of Mirage_crypto_ec.X25519.secret ]) + list -> + string -> + string -> + (State.handshake_state + * [> `Change_dec of State.crypto_context + | `Change_enc of State.crypto_context ] + list, + [> `Fatal of + [> `Handshake of + [> `BadDH of string + | `BadECDH of Mirage_crypto_ec.error + | `Fragments + | `Message of string ] ] ]) + Stdlib.result
val answer_hello_retry_request : + State.handshake_state -> + Core.client_hello -> + Core.hello_retry -> + 'a -> + string -> + Stdlib.String.t -> + (State.handshake_state * [> `Record of Packet.content_type * string ] list, + [> `Fatal of [> `Handshake of [> `Message of string ] ] ]) + Stdlib.result
val answer_encrypted_extensions : + State.handshake_state -> + State.session_data13 -> + string -> + string -> + [> `ALPN of string ] list -> + string -> + string -> + (State.handshake_state * 'a list, 'b) Stdlib.result
val answer_certificate : + State.handshake_state -> + State.session_data13 -> + string -> + string -> + Core.signature_algorithm list option -> + (string * 'a) list -> + string -> + string -> + (State.handshake_state * 'b list, + [> `Error of + [> `AuthenticationFailure of X509.Validation.validation_error ] + | `Fatal of [> `Bad_certificate of string ] ]) + Stdlib.result
val answer_certificate_verify : + State.handshake_state -> + State.session_data13 -> + string -> + string -> + Core.signature_algorithm list option -> + string -> + string -> + Stdlib.String.t -> + (State.handshake_state * 'a list, + [> `Error of + [> `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list ] + | `Fatal of + [> `Bad_certificate of string + | `Decode of string + | `Handshake of [> `Message of string ] ] ]) + Stdlib.result
val answer_certificate_request : + State.handshake_state -> + State.session_data13 -> + string -> + string -> + [> `SignatureAlgorithms of Core.signature_algorithm list ] list -> + string -> + string -> + (State.handshake_state * 'a list, 'b) Stdlib.result
val answer_finished : + State.handshake_state -> + State.session_data13 -> + string -> + string -> + Core.signature_algorithm list option -> + Stdlib.String.t -> + string -> + Stdlib.String.t -> + (State.handshake_state + * [> `Change_dec of State.crypto_context + | `Change_enc of State.crypto_context + | `Record of Packet.content_type * string ] + list, + [> `Error of + [> `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list ] + | `Fatal of + [> `Bad_certificate of string + | `Handshake of [> `Fragments | `Message of string ] ] ]) + Stdlib.result
val answer_session_ticket : + State.handshake_state -> + Core.session_ticket -> + (State.handshake_state * 'a list, 'b) Stdlib.result
val handle_key_update : + State.handshake_state -> + Packet.key_update_request_type -> + (State.handshake_state + * [> `Change_dec of State.crypto_context + | `Change_enc of State.crypto_context + | `Record of Packet.content_type * string ] + list, + [> `Fatal of [> `Handshake of [> `Fragments | `Message of string ] ] ]) + Stdlib.result
val handle_handshake : + State.client13_handshake_state -> + State.handshake_state -> + string -> + (State.handshake_state + * [> `Change_dec of State.crypto_context + | `Change_enc of State.crypto_context + | `Record of Packet.content_type * string ] + list, + [> `Error of + [> `AuthenticationFailure of X509.Validation.validation_error + | `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list ] + | `Fatal of + [> `Bad_certificate of string + | `Decode of string + | `Handshake of + [> `BadDH of string + | `BadECDH of Mirage_crypto_ec.error + | `Fragments + | `Message of string ] + | `Unexpected of [> `Handshake of Core.tls_handshake ] ] ]) + Stdlib.result
diff --git a/doc/tls/Tls/Handshake_common/Group/index.html b/doc/tls/Tls/Handshake_common/Group/index.html new file mode 100644 index 00000000..08f837b0 --- /dev/null +++ b/doc/tls/Tls/Handshake_common/Group/index.html @@ -0,0 +1,2 @@ + +Group (tls.Tls.Handshake_common.Group)

Module Handshake_common.Group

val compare : 'a -> 'a -> int
diff --git a/doc/tls/Tls/Handshake_common/GroupSet/index.html b/doc/tls/Tls/Handshake_common/GroupSet/index.html new file mode 100644 index 00000000..021a3ba2 --- /dev/null +++ b/doc/tls/Tls/Handshake_common/GroupSet/index.html @@ -0,0 +1,2 @@ + +GroupSet (tls.Tls.Handshake_common.GroupSet)

Module Handshake_common.GroupSet

type elt = Group.t
type t = Stdlib__Set.Make(Group).t
val empty : t
val add : elt -> t -> t
val singleton : elt -> t
val remove : elt -> t -> t
val union : t -> t -> t
val inter : t -> t -> t
val disjoint : t -> t -> bool
val diff : t -> t -> t
val cardinal : t -> int
val elements : t -> elt list
val min_elt : t -> elt
val min_elt_opt : t -> elt option
val max_elt : t -> elt
val max_elt_opt : t -> elt option
val choose : t -> elt
val choose_opt : t -> elt option
val find : elt -> t -> elt
val find_opt : elt -> t -> elt option
val find_first : (elt -> bool) -> t -> elt
val find_first_opt : (elt -> bool) -> t -> elt option
val find_last : (elt -> bool) -> t -> elt
val find_last_opt : (elt -> bool) -> t -> elt option
val iter : (elt -> unit) -> t -> unit
val fold : (elt -> 'acc -> 'acc) -> t -> 'acc -> 'acc
val map : (elt -> elt) -> t -> t
val filter : (elt -> bool) -> t -> t
val filter_map : (elt -> elt option) -> t -> t
val partition : (elt -> bool) -> t -> t * t
val split : elt -> t -> t * bool * t
val is_empty : t -> bool
val mem : elt -> t -> bool
val equal : t -> t -> bool
val compare : t -> t -> int
val subset : t -> t -> bool
val for_all : (elt -> bool) -> t -> bool
val exists : (elt -> bool) -> t -> bool
val to_list : t -> elt list
val of_list : elt list -> t
val to_seq_from : elt -> t -> elt Stdlib.Seq.t
val to_seq : t -> elt Stdlib.Seq.t
val to_rev_seq : t -> elt Stdlib.Seq.t
val add_seq : elt Stdlib.Seq.t -> t -> t
val of_seq : elt Stdlib.Seq.t -> t
diff --git a/doc/tls/Tls/Handshake_common/index.html b/doc/tls/Tls/Handshake_common/index.html new file mode 100644 index 00000000..8dfed82b --- /dev/null +++ b/doc/tls/Tls/Handshake_common/index.html @@ -0,0 +1,254 @@ + +Handshake_common (tls.Tls.Handshake_common)

Module Tls.Handshake_common

val src : Logs.src
module Log : Logs.LOG
val trace_cipher : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 AES_128_CCM_SHA256 AES_128_GCM_SHA256 AES_256_GCM_SHA384 CHACHA20_POLY1305_SHA256 ] -> + unit
val empty : 'a list -> bool
val change_cipher_spec : Packet.content_type * string
val hostname : Core.client_hello -> [ `host ] Domain_name.t option
val groups : + Core.client_hello -> + [> `FFDHE2048 + | `FFDHE3072 + | `FFDHE4096 + | `FFDHE6144 + | `FFDHE8192 + | `P256 + | `P384 + | `P521 + | `X25519 ] + list
val find_matching : + [ `host ] Domain_name.t -> + (X509.Certificate.t list * 'a) list -> + (X509.Certificate.t list * 'a) option
val agreed_cert : + [< `Multiple of + (X509.Certificate.t list + * [> `ED25519 of 'b + | `P256 of 'c + | `P384 of 'd + | `P521 of 'e + | `RSA of 'f ] as 'a) + list + | `Multiple_default of + (X509.Certificate.t list * 'g) * (X509.Certificate.t list * 'h) list + | `None + | `Single of X509.Certificate.t list * 'g ] -> + ?f:(X509.Certificate.t -> bool) -> + ?signature_algorithms: + [< `ECDSA_SECP256R1_SHA1 + | `ECDSA_SECP256R1_SHA256 + | `ECDSA_SECP384R1_SHA384 + | `ECDSA_SECP521R1_SHA512 + | `ED25519 + | `RSA_PKCS1_MD5 + | `RSA_PKCS1_SHA1 + | `RSA_PKCS1_SHA224 + | `RSA_PKCS1_SHA256 + | `RSA_PKCS1_SHA384 + | `RSA_PKCS1_SHA512 + | `RSA_PSS_RSAENC_SHA256 + | `RSA_PSS_RSAENC_SHA384 + | `RSA_PSS_RSAENC_SHA512 ECDSA_SECP256R1_SHA1 ECDSA_SECP256R1_SHA256 ECDSA_SECP384R1_SHA384 ECDSA_SECP521R1_SHA512 ED25519 ] + list -> + [ `host ] Domain_name.t option -> + (X509.Certificate.t list * 'g, + [> `Error of + [> `CouldntSelectCertificate | `NoMatchingCertificateFound of string ] ]) + Stdlib.result
val get_secure_renegotiation : + [> `SecureRenegotiation of 'a ] list -> + 'b option
val get_alpn_protocols : Core.client_hello -> string list option
val alpn_protocol : + Config.config -> + Core.client_hello -> + (string option, [> `Fatal of [> `No_application_protocol ] ]) Stdlib.result
val get_alpn_protocol : Core.server_hello -> string option
val empty_common_session_data : State.common_session_data
val empty_session : State.session_data
val common_session_data_of_epoch : + Core.epoch_data -> + State.common_session_data -> + State.common_session_data
val session_of_epoch : Core.epoch_data -> State.session_data
val supported_protocol_version : + ([< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] + * [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ]) -> + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] as 'a -> + 'b option
val to_client_ext_type : + [< `ALPN of 'a + | `Cookie of 'b + | `Draft of 'c + | `ECPointFormats + | `EarlyDataIndication + | `ExtendedMasterSecret + | `Hostname of 'd + | `KeyShare of 'e + | `MaxFragmentLength of 'f + | `Padding of 'g + | `PostHandshakeAuthentication + | `PreSharedKeys of 'h + | `PskKeyExchangeModes of 'i + | `SecureRenegotiation of 'j + | `SignatureAlgorithms of 'k + | `SupportedGroups of 'l + | `SupportedVersions of 'm + | `UnknownExtension of 'n ] -> + [> `ALPN + | `Cookie + | `Draft + | `ECPointFormats + | `EarlyDataIndication + | `ExtendedMasterSecret + | `Hostname + | `KeyShare + | `MaxFragmentLength + | `Padding + | `PostHandshakeAuthentication + | `PreSharedKey + | `PskKeyExchangeMode + | `SecureRenegotiation + | `SignatureAlgorithms + | `SupportedGroups + | `SupportedVersion + | `UnknownExtension ]
val to_server_ext_type : + [< `ALPN of 'a + | `Draft of 'b + | `ECPointFormats + | `EarlyDataIndication + | `ExtendedMasterSecret + | `Hostname + | `KeyShare of 'c + | `MaxFragmentLength of 'd + | `PreSharedKey of 'e + | `SecureRenegotiation of 'f + | `SelectedVersion of 'g + | `UnknownExtension of 'h ] -> + [> `ALPN + | `Draft + | `ECPointFormats + | `EarlyDataIndication + | `ExtendedMasterSecret + | `Hostname + | `KeyShare + | `MaxFragmentLength + | `PreSharedKey + | `SecureRenegotiation + | `SupportedVersion + | `UnknownExtension ]
val extension_types : + ('a -> [> `UnknownExtension ] as 'b) -> + 'a list -> + 'c list
val server_exts_subset_of_client : + [< `ALPN of 'a + | `Draft of 'b + | `ECPointFormats + | `EarlyDataIndication + | `ExtendedMasterSecret + | `Hostname + | `KeyShare of 'c + | `MaxFragmentLength of 'd + | `PreSharedKey of 'e + | `SecureRenegotiation of 'f + | `SelectedVersion of 'g + | `UnknownExtension of 'h ] + list -> + [< `ALPN of 'i + | `Cookie of 'j + | `Draft of 'k + | `ECPointFormats + | `EarlyDataIndication + | `ExtendedMasterSecret + | `Hostname of 'l + | `KeyShare of 'm + | `MaxFragmentLength of 'n + | `Padding of 'o + | `PostHandshakeAuthentication + | `PreSharedKeys of 'p + | `PskKeyExchangeModes of 'q + | `SecureRenegotiation of 'r + | `SignatureAlgorithms of 's + | `SupportedGroups of 't + | `SupportedVersions of 'u + | `UnknownExtension of 'v ] + list -> + bool
module Group : sig ... end
module GroupSet : sig ... end
val of_list : GroupSet.elt list -> GroupSet.t
val client_hello_valid : + [< `SSL_3 | `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 | `TLS_1_X of 'a ] -> + Core.client_hello -> + (unit, + [> `Fatal of + [> `Handshake of [> `Message of string ] + | `Missing_extension of string ] ]) + Stdlib.result
val server_hello_valid : Core.server_hello -> bool
val to_sign_1_3 : string option -> string
val signature : + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] -> + ?context_string:string -> + Stdlib.String.t -> + Core.signature_algorithm list option -> + Core.signature_algorithm list -> + X509.Private_key.t -> + (string, + [> `Error of + [> `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list ] + | `Fatal of + [> `Bad_certificate of string | `Handshake of [> `Message of string ] ] ]) + Stdlib.result
val peer_key : + X509.Certificate.t option -> + (X509.Public_key.t, [> `Fatal of [> `Bad_certificate of string ] ]) + Stdlib.result
val verify_digitally_signed : + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] -> + ?context_string:string -> + Core.signature_algorithm list -> + string -> + Stdlib.String.t -> + X509.Certificate.t option -> + (unit, + [> `Error of + [> `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list ] + | `Fatal of + [> `Bad_certificate of string + | `Decode of string + | `Handshake of [> `Message of string ] ] ]) + Stdlib.result
val validate_chain : + (?ip:'a -> + host:'b -> + X509.Certificate.t list -> + (('c list * 'd) option, 'e) Stdlib.result) + option -> + string list -> + 'a option -> + 'f -> + (X509.Certificate.t option * X509.Certificate.t list * 'c list * 'g option, + [> `Error of [> `AuthenticationFailure of 'e ] + | `Fatal of [> `Bad_certificate of string ] ]) + Stdlib.result
val output_key_update : + request:bool -> + State.state -> + (State.state * (Packet.content_type * string), + [> `Fatal of [> `Handshake of [> `Message of string ] ] ]) + Stdlib.result
diff --git a/doc/tls/Tls/Handshake_crypto/index.html b/doc/tls/Tls/Handshake_crypto/index.html new file mode 100644 index 00000000..891c9f29 --- /dev/null +++ b/doc/tls/Tls/Handshake_crypto/index.html @@ -0,0 +1,23 @@ + +Handshake_crypto (tls.Tls.Handshake_crypto)

Module Tls.Handshake_crypto

val derive_master_secret : + Core.tls_before_13 -> + State.session_data -> + string -> + string list -> + Core.master_secret
val finished : + Core.tls_before_13 -> + Ciphersuite.ciphersuite -> + string -> + string -> + string list -> + string
val pseudo_random_function : + Core.tls_before_13 -> + Ciphersuite.ciphersuite -> + int -> + string -> + string -> + string -> + string

pseudo_random_function version cipher length secret label seed

diff --git a/doc/tls/Tls/Handshake_crypto13/index.html b/doc/tls/Tls/Handshake_crypto13/index.html new file mode 100644 index 00000000..4bf9d008 --- /dev/null +++ b/doc/tls/Tls/Handshake_crypto13/index.html @@ -0,0 +1,57 @@ + +Handshake_crypto13 (tls.Tls.Handshake_crypto13)

Module Tls.Handshake_crypto13

val cdiv : int -> int -> int
val left_pad_dh : Mirage_crypto_pk.Dh.group -> string -> string
val not_all_zero : + (string, [> `Fatal of [> `Handshake of [> `BadDH of string ] ] ] as 'a) + Stdlib.result -> + (string, 'a) Stdlib.result
val dh_shared : + [< `Finite_field of Mirage_crypto_pk.Dh.secret + | `P256 of Mirage_crypto_ec.P256.Dh.secret + | `P384 of Mirage_crypto_ec.P384.Dh.secret + | `P521 of Mirage_crypto_ec.P521.Dh.secret + | `X25519 of Mirage_crypto_ec.X25519.secret ] -> + string -> + (string, + [> `Fatal of + [> `Handshake of + [> `BadDH of string | `BadECDH of Mirage_crypto_ec.error ] ] ]) + Stdlib.result
val dh_gen_key : + [< `FFDHE2048 + | `FFDHE3072 + | `FFDHE4096 + | `FFDHE6144 + | `FFDHE8192 + | `P256 + | `P384 + | `P521 + | `X25519 ] -> + [> `Finite_field of Mirage_crypto_pk.Dh.secret + | `P256 of Mirage_crypto_ec.P256.Dh.secret + | `P384 of Mirage_crypto_ec.P384.Dh.secret + | `P521 of Mirage_crypto_ec.P521.Dh.secret + | `X25519 of Mirage_crypto_ec.X25519.secret ] + * string
val trace : string -> string -> unit
val pp_hash_k_n : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 ] -> + Ciphersuite.aead_cipher * [> `SHA256 | `SHA384 ] * int * int
val hkdflabel : string -> string -> int -> string
val derive_secret_no_hash : + Digestif.hash' -> + string -> + ?length:int -> + ?ctx:string -> + string -> + string
val derive_secret : State.kdf -> string -> Stdlib.String.t -> string
val derive : State.kdf -> string -> State.kdf
val traffic_key : + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 ] -> + string -> + string * string
val ctx : State.kdf -> string -> string -> State.crypto_context
val early_traffic : + State.kdf -> + Stdlib.String.t -> + string * State.crypto_context
val hs_ctx : + State.kdf -> + Stdlib.String.t -> + string * State.crypto_context * string * State.crypto_context
val app_ctx : + State.kdf -> + Stdlib.String.t -> + string * State.crypto_context * string * State.crypto_context
val app_secret_n_1 : State.kdf -> string -> string * State.crypto_context
val exporter : State.kdf -> Stdlib.String.t -> string
val resumption : State.kdf -> Stdlib.String.t -> string
val res_secret : Digestif.hash' -> string -> string -> string
val finished : Digestif.hash' -> string -> Stdlib.String.t -> string
diff --git a/doc/tls/Tls/Handshake_server/index.html b/doc/tls/Tls/Handshake_server/index.html new file mode 100644 index 00000000..f71f106f --- /dev/null +++ b/doc/tls/Tls/Handshake_server/index.html @@ -0,0 +1,12 @@ + +Handshake_server (tls.Tls.Handshake_server)

Module Tls.Handshake_server

val hello_request : + State.handshake_state -> + (State.handshake_return, State.failure) Stdlib.result
val handle_change_cipher_spec : + State.server_handshake_state -> + State.handshake_state -> + string -> + (State.handshake_return, State.failure) Stdlib.result
val handle_handshake : + State.server_handshake_state -> + State.handshake_state -> + string -> + (State.handshake_return, State.failure) Stdlib.result
diff --git a/doc/tls/Tls/Handshake_server13/index.html b/doc/tls/Tls/Handshake_server13/index.html new file mode 100644 index 00000000..15af97fd --- /dev/null +++ b/doc/tls/Tls/Handshake_server13/index.html @@ -0,0 +1,123 @@ + +Handshake_server13 (tls.Tls.Handshake_server13)

Module Tls.Handshake_server13

val answer_client_hello : + hrr:bool -> + State.handshake_state -> + Core.client_hello -> + Stdlib.String.t -> + (State.handshake_state + * [> `Change_dec of State.crypto_context + | `Change_enc of State.crypto_context + | `Record of Packet.content_type * string ] + list, + [> `Error of + [> `CouldntSelectCertificate + | `NoConfiguredCiphersuite of + [> `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 ] + list + | `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list + | `NoMatchingCertificateFound of string ] + | `Fatal of + [> `Bad_certificate of string + | `Handshake of + [> `BadDH of string + | `BadECDH of Mirage_crypto_ec.error + | `Fragments + | `Message of string ] + | `Missing_extension of string + | `No_application_protocol ] ]) + Stdlib.result
val answer_client_certificate : + State.handshake_state -> + string -> + State.session_data13 -> + string -> + State.crypto_context -> + Core.session_ticket option -> + string -> + string -> + (State.handshake_state * 'a list, + [> `Error of + [> `AuthenticationFailure of X509.Validation.validation_error ] + | `Fatal of + [> `Bad_certificate of string + | `Decode of string + | `Handshake of [> `Message of string ] ] ]) + Stdlib.result
val answer_client_certificate_verify : + State.handshake_state -> + string -> + State.session_data13 -> + string -> + State.crypto_context -> + Core.session_ticket option -> + string -> + Stdlib.String.t -> + (State.handshake_state * 'a list, + [> `Error of + [> `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list ] + | `Fatal of + [> `Bad_certificate of string + | `Decode of string + | `Handshake of [> `Message of string ] ] ]) + Stdlib.result
val answer_client_finished : + State.handshake_state -> + Stdlib.String.t -> + string -> + 'a -> + Core.session_ticket option -> + string -> + Stdlib.String.t -> + (State.handshake_state * [> `Change_dec of 'a ] list, + [> `Fatal of [> `Handshake of [> `Fragments | `Message of string ] ] ]) + Stdlib.result
val handle_end_of_early_data : + State.handshake_state -> + string -> + 'a -> + State.crypto_context -> + Core.session_ticket option -> + string -> + string -> + (State.handshake_state * [> `Change_dec of 'a ] list, + [> `Fatal of [> `Handshake of [> `Message of string ] ] ]) + Stdlib.result
val handle_key_update : + State.handshake_state -> + Packet.key_update_request_type -> + (State.handshake_state + * [> `Change_dec of State.crypto_context + | `Change_enc of State.crypto_context + | `Record of Packet.content_type * string ] + list, + [> `Fatal of [> `Handshake of [> `Fragments | `Message of string ] ] ]) + Stdlib.result
val handle_handshake : + State.server13_handshake_state -> + State.handshake_state -> + Stdlib.String.t -> + (State.handshake_state + * [> `Change_dec of State.crypto_context + | `Change_enc of State.crypto_context + | `Record of Packet.content_type * string ] + list, + [> `Error of + [> `AuthenticationFailure of X509.Validation.validation_error + | `CouldntSelectCertificate + | `NoConfiguredCiphersuite of + [> `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 ] + list + | `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list + | `NoMatchingCertificateFound of string ] + | `Fatal of + [> `Bad_certificate of string + | `Decode of string + | `Handshake of + [> `BadDH of string + | `BadECDH of Mirage_crypto_ec.error + | `Fragments + | `Message of string ] + | `Missing_extension of string + | `No_application_protocol + | `Unexpected of [> `Handshake of Core.tls_handshake ] ] ]) + Stdlib.result
diff --git a/doc/tls/Tls/Packet/index.html b/doc/tls/Tls/Packet/index.html new file mode 100644 index 00000000..b68d8218 --- /dev/null +++ b/doc/tls/Tls/Packet/index.html @@ -0,0 +1,33 @@ + +Packet (tls.Tls.Packet)

Module Tls.Packet

Magic numbers of the TLS protocol.

val get_uint24_len : off:int -> string -> int
val set_uint24_len : off:int -> bytes -> int -> unit
type content_type =
  1. | CHANGE_CIPHER_SPEC
  2. | ALERT
  3. | HANDSHAKE
  4. | APPLICATION_DATA
val content_type_to_int : content_type -> int
val int_to_content_type : int -> content_type option
val content_type_to_string : content_type -> string
val pp_content_type : Stdlib.Format.formatter -> content_type -> unit
type alert_level =
  1. | WARNING
  2. | FATAL
val pp_alert_level : Stdlib.Format.formatter -> alert_level -> unit
val alert_level_to_int : alert_level -> int
val int_to_alert_level : int -> alert_level option
type alert_type =
  1. | CLOSE_NOTIFY
  2. | UNEXPECTED_MESSAGE
  3. | BAD_RECORD_MAC
  4. | RECORD_OVERFLOW
  5. | HANDSHAKE_FAILURE
  6. | BAD_CERTIFICATE
  7. | CERTIFICATE_EXPIRED
  8. | DECODE_ERROR
  9. | PROTOCOL_VERSION
  10. | INAPPROPRIATE_FALLBACK
  11. | USER_CANCELED
  12. | NO_RENEGOTIATION
  13. | MISSING_EXTENSION
  14. | UNSUPPORTED_EXTENSION
  15. | UNRECOGNIZED_NAME
  16. | NO_APPLICATION_PROTOCOL
  17. | UNKNOWN of int
val alert_type_to_string : alert_type -> string
val alert_type_to_int : alert_type -> int
val int_to_alert_type : int -> alert_type
val pp_alert : Stdlib.Format.formatter -> (alert_level * alert_type) -> unit
type handshake_type =
  1. | HELLO_REQUEST
  2. | CLIENT_HELLO
  3. | SERVER_HELLO
  4. | HELLO_VERIFY_REQUEST
  5. | SESSION_TICKET
  6. | END_OF_EARLY_DATA
  7. | ENCRYPTED_EXTENSIONS
  8. | CERTIFICATE
  9. | SERVER_KEY_EXCHANGE
  10. | CERTIFICATE_REQUEST
  11. | SERVER_HELLO_DONE
  12. | CERTIFICATE_VERIFY
  13. | CLIENT_KEY_EXCHANGE
  14. | FINISHED
  15. | CERTIFICATE_URL
  16. | CERTIFICATE_STATUS
  17. | SUPPLEMENTAL_DATA
  18. | KEY_UPDATE
  19. | MESSAGE_HASH
val handshake_type_to_int : handshake_type -> int
val int_to_handshake_type : int -> handshake_type option
type client_certificate_type =
  1. | RSA_SIGN
  2. | ECDSA_SIGN
val client_certificate_type_to_int : client_certificate_type -> int
val int_to_client_certificate_type : int -> client_certificate_type option
type compression_method =
  1. | NULL
val compression_method_to_int : compression_method -> int
val int_to_compression_method : int -> compression_method option
type extension_type =
  1. | SERVER_NAME
  2. | MAX_FRAGMENT_LENGTH
  3. | SUPPORTED_GROUPS
  4. | EC_POINT_FORMATS
  5. | SIGNATURE_ALGORITHMS
  6. | APPLICATION_LAYER_PROTOCOL_NEGOTIATION
  7. | PADDING
  8. | EXTENDED_MASTER_SECRET
  9. | SESSION_TICKET
  10. | PRE_SHARED_KEY
  11. | EARLY_DATA
  12. | SUPPORTED_VERSIONS
  13. | COOKIE
  14. | PSK_KEY_EXCHANGE_MODES
  15. | CERTIFICATE_AUTHORITIES
  16. | POST_HANDSHAKE_AUTH
  17. | KEY_SHARE
  18. | RENEGOTIATION_INFO
val extension_type_to_int : extension_type -> int
val int_to_extension_type : int -> extension_type option
val extension_type_to_string : extension_type -> string
type max_fragment_length =
  1. | TWO_9
  2. | TWO_10
  3. | TWO_11
  4. | TWO_12
val max_fragment_length_to_int : max_fragment_length -> int
val int_to_max_fragment_length : int -> max_fragment_length option
type psk_key_exchange_mode =
  1. | PSK_KE
  2. | PSK_KE_DHE
val psk_key_exchange_mode_to_int : psk_key_exchange_mode -> int
val int_to_psk_key_exchange_mode : int -> psk_key_exchange_mode option
type signature_alg =
  1. | RSA_PKCS1_MD5
  2. | RSA_PKCS1_SHA1
  3. | RSA_PKCS1_SHA224
  4. | RSA_PKCS1_SHA256
  5. | RSA_PKCS1_SHA384
  6. | RSA_PKCS1_SHA512
  7. | ECDSA_SECP256R1_SHA1
  8. | ECDSA_SECP256R1_SHA256
  9. | ECDSA_SECP384R1_SHA384
  10. | ECDSA_SECP521R1_SHA512
  11. | RSA_PSS_RSAENC_SHA256
  12. | RSA_PSS_RSAENC_SHA384
  13. | RSA_PSS_RSAENC_SHA512
  14. | ED25519
  15. | ED448
  16. | RSA_PSS_PSS_SHA256
  17. | RSA_PSS_PSS_SHA384
  18. | RSA_PSS_PSS_SHA512
val signature_alg_to_int : signature_alg -> int
val int_to_signature_alg : int -> signature_alg option
val to_signature_alg : + [< `ECDSA_SECP256R1_SHA1 + | `ECDSA_SECP256R1_SHA256 + | `ECDSA_SECP384R1_SHA384 + | `ECDSA_SECP521R1_SHA512 + | `ED25519 + | `RSA_PKCS1_MD5 + | `RSA_PKCS1_SHA1 + | `RSA_PKCS1_SHA224 + | `RSA_PKCS1_SHA256 + | `RSA_PKCS1_SHA384 + | `RSA_PKCS1_SHA512 + | `RSA_PSS_RSAENC_SHA256 + | `RSA_PSS_RSAENC_SHA384 + | `RSA_PSS_RSAENC_SHA512 ] -> + signature_alg
val of_signature_alg : + signature_alg -> + [> `ECDSA_SECP256R1_SHA1 + | `ECDSA_SECP256R1_SHA256 + | `ECDSA_SECP384R1_SHA384 + | `ECDSA_SECP521R1_SHA512 + | `ED25519 + | `RSA_PKCS1_MD5 + | `RSA_PKCS1_SHA1 + | `RSA_PKCS1_SHA224 + | `RSA_PKCS1_SHA256 + | `RSA_PKCS1_SHA384 + | `RSA_PKCS1_SHA512 + | `RSA_PSS_RSAENC_SHA256 + | `RSA_PSS_RSAENC_SHA384 + | `RSA_PSS_RSAENC_SHA512 ] + option
type ec_curve_type =
  1. | NAMED_CURVE
val ec_curve_type_to_int : ec_curve_type -> int
val int_to_ec_curve_type : int -> ec_curve_type option
type named_group =
  1. | SECP256R1
  2. | SECP384R1
  3. | SECP521R1
  4. | X25519
  5. | X448
  6. | FFDHE2048
  7. | FFDHE3072
  8. | FFDHE4096
  9. | FFDHE6144
  10. | FFDHE8192
val named_group_to_int : named_group -> int
val int_to_named_group : int -> named_group option
type any_ciphersuite =
  1. | TLS_RSA_WITH_3DES_EDE_CBC_SHA
  2. | TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  3. | TLS_RSA_WITH_AES_128_CBC_SHA
  4. | TLS_DHE_RSA_WITH_AES_128_CBC_SHA
  5. | TLS_RSA_WITH_AES_256_CBC_SHA
  6. | TLS_DHE_RSA_WITH_AES_256_CBC_SHA
  7. | TLS_RSA_WITH_AES_128_CBC_SHA256
  8. | TLS_RSA_WITH_AES_256_CBC_SHA256
  9. | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
  10. | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
  11. | TLS_RSA_WITH_AES_128_GCM_SHA256
  12. | TLS_RSA_WITH_AES_256_GCM_SHA384
  13. | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
  14. | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
  15. | TLS_EMPTY_RENEGOTIATION_INFO_SCSV
  16. | TLS_AES_128_GCM_SHA256
  17. | TLS_AES_256_GCM_SHA384
  18. | TLS_CHACHA20_POLY1305_SHA256
  19. | TLS_AES_128_CCM_SHA256
  20. | TLS_FALLBACK_SCSV
  21. | TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
  22. | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  23. | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
  24. | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  25. | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  26. | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  27. | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
  28. | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
  29. | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  30. | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
  31. | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  32. | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  33. | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  34. | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  35. | TLS_RSA_WITH_AES_128_CCM
  36. | TLS_RSA_WITH_AES_256_CCM
  37. | TLS_DHE_RSA_WITH_AES_128_CCM
  38. | TLS_DHE_RSA_WITH_AES_256_CCM
  39. | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
  40. | TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
  41. | TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256

enum of all TLS ciphersuites

val any_ciphersuite_to_int : any_ciphersuite -> int
val int_to_any_ciphersuite : int -> any_ciphersuite option
type key_update_request_type =
  1. | UPDATE_NOT_REQUESTED
  2. | UPDATE_REQUESTED
val key_update_request_type_to_int : key_update_request_type -> int
val int_to_key_update_request_type : int -> key_update_request_type option
val helloretryrequest : string
val downgrade12 : string
val downgrade11 : string
diff --git a/doc/tls/Tls/Reader/index.html b/doc/tls/Tls/Reader/index.html new file mode 100644 index 00000000..5dd574f5 --- /dev/null +++ b/doc/tls/Tls/Reader/index.html @@ -0,0 +1,49 @@ + +Reader (tls.Tls.Reader)

Module Tls.Reader

val parse_version : + string -> + (Core.tls_version, [> `Decode of string ]) Stdlib.result
val parse_any_version : + string -> + (Core.tls_any_version, [> `Decode of string ]) Stdlib.result
val parse_record : + string -> + ([ `Record of (Core.tls_hdr * string) * string | `Fragment of string ], + [> `Unexpected of [> `Content_type of int ] + | `Protocol_version of [> `Unknown_record of int * int ] + | `Record_overflow of int ]) + Stdlib.result
val parse_handshake_frame : string -> string option * string
val parse_handshake : + string -> + (Core.tls_handshake, [> `Decode of string ]) Stdlib.result
val parse_alert : + string -> + (Core.tls_alert, [> `Decode of string ]) Stdlib.result
val parse_change_cipher_spec : + string -> + (unit, [> `Decode of string ]) Stdlib.result
val parse_certificate_request : + string -> + (Packet.client_certificate_type list * string list, [> `Decode of string ]) + Stdlib.result
val parse_certificate_request_1_2 : + string -> + (Packet.client_certificate_type list + * Core.signature_algorithm list + * string list, + [> `Decode of string ]) + Stdlib.result
val parse_certificate_request_1_3 : + string -> + (string option * Core.certificate_request_extension list, + [> `Decode of string ]) + Stdlib.result
val parse_certificates : + string -> + (string list, [> `Decode of string ]) Stdlib.result
val parse_certificates_1_3 : + string -> + (string * (string * 'a list) list, [> `Decode of string ]) Stdlib.result
val parse_client_dh_key_exchange : + string -> + (string, [> `Decode of string ]) Stdlib.result
val parse_client_ec_key_exchange : + string -> + (string, [> `Decode of string ]) Stdlib.result
val parse_dh_parameters : + string -> + (Core.dh_parameters * string * string, [> `Decode of string ]) Stdlib.result
val parse_ec_parameters : + string -> + ([ `X25519 | `P256 | `P384 | `P521 ] * string * string * string, + [> `Decode of string ]) + Stdlib.result
val parse_digitally_signed : + string -> + (string, [> `Decode of string ]) Stdlib.result
val parse_digitally_signed_1_2 : + string -> + (Core.signature_algorithm * string, [> `Decode of string ]) Stdlib.result
diff --git a/doc/tls/Tls/State/index.html b/doc/tls/Tls/State/index.html new file mode 100644 index 00000000..d2132766 --- /dev/null +++ b/doc/tls/Tls/State/index.html @@ -0,0 +1,292 @@ + +State (tls.Tls.State)

Module Tls.State

type hmac_key = string
type iv_mode =
  1. | Iv of string
  2. | Random_iv
type 'k cbc_cipher = (module Mirage_crypto.Block.CBC with type key = 'k)
type 'k cbc_state = {
  1. cipher : 'k cbc_cipher;
  2. cipher_secret : 'k;
  3. iv_mode : iv_mode;
  4. hmac : Digestif.hash';
  5. hmac_secret : hmac_key;
}
type nonce = string
type 'k aead_cipher = (module Mirage_crypto.AEAD with type key = 'k)
type 'k aead_state = {
  1. cipher : 'k aead_cipher;
  2. cipher_secret : 'k;
  3. nonce : nonce;
  4. explicit_nonce : bool;
}
type cipher_st =
  1. | CBC : 'k cbc_state -> cipher_st
  2. | AEAD : 'k aead_state -> cipher_st
type crypto_context = {
  1. sequence : int64;
  2. cipher_st : cipher_st;
}
type hs_log = string list
type dh_secret = [
  1. | `Finite_field of Mirage_crypto_pk.Dh.secret
  2. | `P256 of Mirage_crypto_ec.P256.Dh.secret
  3. | `P384 of Mirage_crypto_ec.P384.Dh.secret
  4. | `P521 of Mirage_crypto_ec.P521.Dh.secret
  5. | `X25519 of Mirage_crypto_ec.X25519.secret
]
type reneg_params = string * string
type common_session_data = {
  1. server_random : string;
  2. client_random : string;
  3. peer_certificate_chain : X509.Certificate.t list;
  4. peer_certificate : X509.Certificate.t option;
  5. trust_anchor : X509.Certificate.t option;
  6. received_certificates : X509.Certificate.t list;
  7. own_certificate : X509.Certificate.t list;
  8. own_private_key : X509.Private_key.t option;
  9. own_name : [ `host ] Domain_name.t option;
  10. client_auth : bool;
  11. master_secret : Core.master_secret;
  12. alpn_protocol : string option;
}
type session_data = {
  1. common_session_data : common_session_data;
  2. client_version : Core.tls_any_version;
  3. ciphersuite : Ciphersuite.ciphersuite;
  4. group : Core.group option;
  5. renegotiation : reneg_params;
  6. session_id : string;
  7. extended_ms : bool;
  8. tls_unique : string;
}
type server_handshake_state =
  1. | AwaitClientHello
  2. | AwaitClientHelloRenegotiate
  3. | AwaitClientCertificate_RSA of session_data * hs_log
  4. | AwaitClientCertificate_DHE of session_data * dh_secret * hs_log
  5. | AwaitClientKeyExchange_RSA of session_data * hs_log
  6. | AwaitClientKeyExchange_DHE of session_data * dh_secret * hs_log
  7. | AwaitClientCertificateVerify of session_data + * crypto_context + * crypto_context + * hs_log
  8. | AwaitClientChangeCipherSpec of session_data + * crypto_context + * crypto_context + * hs_log
  9. | AwaitClientChangeCipherSpecResume of session_data + * crypto_context + * string + * hs_log
  10. | AwaitClientFinished of session_data * hs_log
  11. | AwaitClientFinishedResume of session_data * string * hs_log
  12. | Established
type client_handshake_state =
  1. | ClientInitial
  2. | AwaitServerHello of Core.client_hello * (Core.group * dh_secret) list * hs_log
  3. | AwaitServerHelloRenegotiate of session_data * Core.client_hello * hs_log
  4. | AwaitCertificate_RSA of session_data * hs_log
  5. | AwaitCertificate_DHE of session_data * hs_log
  6. | AwaitServerKeyExchange_DHE of session_data * hs_log
  7. | AwaitCertificateRequestOrServerHelloDone of session_data + * string + * string + * hs_log
  8. | AwaitServerHelloDone of session_data + * Core.signature_algorithm list option + * string + * string + * hs_log
  9. | AwaitServerChangeCipherSpec of session_data * crypto_context * string * hs_log
  10. | AwaitServerChangeCipherSpecResume of session_data + * crypto_context + * crypto_context + * hs_log
  11. | AwaitServerFinished of session_data * string * hs_log
  12. | AwaitServerFinishedResume of session_data * hs_log
  13. | Established
type kdf = {
  1. secret : string;
  2. cipher : Ciphersuite.ciphersuite13;
  3. hash : Digestif.hash';
}
type session_data13 = {
  1. common_session_data13 : common_session_data;
  2. ciphersuite13 : Ciphersuite.ciphersuite13;
  3. master_secret : kdf;
  4. exporter_master_secret : string;
  5. resumption_secret : string;
  6. state : Core.epoch_state;
  7. resumed : bool;
  8. client_app_secret : string;
  9. server_app_secret : string;
}
type client13_handshake_state =
  1. | AwaitServerHello13 of Core.client_hello + * (Core.group * dh_secret) list + * string
  2. | AwaitServerEncryptedExtensions13 of session_data13 * string * string * string
  3. | AwaitServerCertificateRequestOrCertificate13 of session_data13 + * string + * string + * string
  4. | AwaitServerCertificate13 of session_data13 + * string + * string + * Core.signature_algorithm list option + * string
  5. | AwaitServerCertificateVerify13 of session_data13 + * string + * string + * Core.signature_algorithm list option + * string
  6. | AwaitServerFinished13 of session_data13 + * string + * string + * Core.signature_algorithm list option + * string
  7. | Established13
type server13_handshake_state =
  1. | AwaitClientHelloHRR13
  2. | AwaitClientCertificate13 of session_data13 + * string + * crypto_context + * Core.session_ticket option + * string
  3. | AwaitClientCertificateVerify13 of session_data13 + * string + * crypto_context + * Core.session_ticket option + * string
  4. | AwaitClientFinished13 of string + * crypto_context + * Core.session_ticket option + * string
  5. | AwaitEndOfEarlyData13 of string + * crypto_context + * crypto_context + * Core.session_ticket option + * string
  6. | Established13
type handshake_machina_state =
  1. | Client of client_handshake_state
  2. | Server of server_handshake_state
  3. | Client13 of client13_handshake_state
  4. | Server13 of server13_handshake_state
type handshake_state = {
  1. session : [ `TLS of session_data | `TLS13 of session_data13 ] list;
  2. protocol_version : Core.tls_version;
  3. early_data_left : int32;
  4. machina : handshake_machina_state;
  5. config : Config.config;
  6. hs_fragment : string;
}
type crypto_state = crypto_context option
type record = Packet.content_type * string
type rec_resp = [
  1. | `Change_enc of crypto_context
  2. | `Change_dec of crypto_context
  3. | `Record of record
]
type handshake_return = handshake_state * rec_resp list
type state = {
  1. handshake : handshake_state;
  2. decryptor : crypto_state;
  3. encryptor : crypto_state;
  4. fragment : string;
  5. read_closed : bool;
  6. write_closed : bool;
}
type error = [
  1. | `AuthenticationFailure of X509.Validation.validation_error
  2. | `NoConfiguredCiphersuite of Ciphersuite.ciphersuite list
  3. | `NoConfiguredVersions of Core.tls_version list
  4. | `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list
  5. | `NoMatchingCertificateFound of string
  6. | `CouldntSelectCertificate
]
val pp_error : + Stdlib.Format.formatter -> + [< `AuthenticationFailure of X509.Validation.validation_error + | `CouldntSelectCertificate + | `NoConfiguredCiphersuite of + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 AES_128_CCM_SHA256 AES_128_GCM_SHA256 AES_256_GCM_SHA384 CHACHA20_POLY1305_SHA256 ] + list + | `NoConfiguredSignatureAlgorithm of + [< `ECDSA_SECP256R1_SHA1 + | `ECDSA_SECP256R1_SHA256 + | `ECDSA_SECP384R1_SHA384 + | `ECDSA_SECP521R1_SHA512 + | `ED25519 + | `RSA_PKCS1_MD5 + | `RSA_PKCS1_SHA1 + | `RSA_PKCS1_SHA224 + | `RSA_PKCS1_SHA256 + | `RSA_PKCS1_SHA384 + | `RSA_PKCS1_SHA512 + | `RSA_PSS_RSAENC_SHA256 + | `RSA_PSS_RSAENC_SHA384 + | `RSA_PSS_RSAENC_SHA512 ECDSA_SECP256R1_SHA1 ECDSA_SECP256R1_SHA256 ECDSA_SECP384R1_SHA384 ECDSA_SECP521R1_SHA512 ] + list + | `NoConfiguredVersions of + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] list + | `NoMatchingCertificateFound of string ] -> + unit
type fatal = [
  1. | `Protocol_version of + [ `None_supported of Core.tls_any_version list + | `Unknown_record of int * int + | `Bad_record of Core.tls_any_version ]
  2. | `Unexpected of + [ `Content_type of int + | `Message of string + | `Handshake of Core.tls_handshake ]
  3. | `Decode of string
  4. | `Handshake of + [ `Message of string + | `Fragments + | `BadDH of string + | `BadECDH of Mirage_crypto_ec.error ]
  5. | `Bad_certificate of string
  6. | `Missing_extension of string
  7. | `Bad_mac
  8. | `Record_overflow of int
  9. | `Unsupported_extension
  10. | `Inappropriate_fallback
  11. | `No_application_protocol
]
val pp_protocol_version : + Stdlib.Format.formatter -> + [< `Bad_record of + [< `SSL_3 + | `TLS_1_0 + | `TLS_1_1 + | `TLS_1_2 + | `TLS_1_3 + | `TLS_1_X of int ] + | `None_supported of + [< `SSL_3 | `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 | `TLS_1_X of int ] + list + | `Unknown_record of int * int ] -> + unit
val pp_unexpected : + Stdlib.Format.formatter -> + [< `Content_type of int + | `Handshake of Core.tls_handshake + | `Message of string ] -> + unit
val pp_handshake_error : + Stdlib.Format.formatter -> + [< `BadDH of string + | `BadECDH of Mirage_crypto_ec.error + | `Fragments + | `Message of string ] -> + unit
val pp_fatal : + Stdlib.Format.formatter -> + [< `Bad_certificate of string + | `Bad_mac + | `Decode of string + | `Handshake of + [< `BadDH of string + | `BadECDH of Mirage_crypto_ec.error + | `Fragments + | `Message of string ] + | `Inappropriate_fallback + | `Missing_extension of string + | `No_application_protocol + | `Protocol_version of + [< `Bad_record of + [< `SSL_3 + | `TLS_1_0 + | `TLS_1_1 + | `TLS_1_2 + | `TLS_1_3 + | `TLS_1_X of int ] + | `None_supported of + [< `SSL_3 | `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 | `TLS_1_X of int ] + list + | `Unknown_record of int * int ] + | `Record_overflow of int + | `Unexpected of + [< `Content_type of int + | `Handshake of Core.tls_handshake + | `Message of string ] + | `Unsupported_extension ] -> + unit
type failure = [
  1. | `Error of error
  2. | `Fatal of fatal
  3. | `Alert of Packet.alert_type
]
val pp_failure : + Stdlib.Format.formatter -> + [< `Alert of Packet.alert_type + | `Error of + [< `AuthenticationFailure of X509.Validation.validation_error + | `CouldntSelectCertificate + | `NoConfiguredCiphersuite of + [< `AES_128_CCM_SHA256 + | `AES_128_GCM_SHA256 + | `AES_256_GCM_SHA384 + | `CHACHA20_POLY1305_SHA256 + | `DHE_RSA_WITH_3DES_EDE_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA + | `DHE_RSA_WITH_AES_128_CBC_SHA256 + | `DHE_RSA_WITH_AES_128_CCM + | `DHE_RSA_WITH_AES_128_GCM_SHA256 + | `DHE_RSA_WITH_AES_256_CBC_SHA + | `DHE_RSA_WITH_AES_256_CBC_SHA256 + | `DHE_RSA_WITH_AES_256_CCM + | `DHE_RSA_WITH_AES_256_GCM_SHA384 + | `DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA + | `ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + | `ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA + | `ECDHE_RSA_WITH_AES_128_CBC_SHA256 + | `ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | `ECDHE_RSA_WITH_AES_256_CBC_SHA + | `ECDHE_RSA_WITH_AES_256_CBC_SHA384 + | `ECDHE_RSA_WITH_AES_256_GCM_SHA384 + | `ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + | `RSA_WITH_3DES_EDE_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA + | `RSA_WITH_AES_128_CBC_SHA256 + | `RSA_WITH_AES_128_CCM + | `RSA_WITH_AES_128_GCM_SHA256 + | `RSA_WITH_AES_256_CBC_SHA + | `RSA_WITH_AES_256_CBC_SHA256 + | `RSA_WITH_AES_256_CCM + | `RSA_WITH_AES_256_GCM_SHA384 AES_128_CCM_SHA256 AES_128_GCM_SHA256 AES_256_GCM_SHA384 CHACHA20_POLY1305_SHA256 ] + list + | `NoConfiguredSignatureAlgorithm of + [< `ECDSA_SECP256R1_SHA1 + | `ECDSA_SECP256R1_SHA256 + | `ECDSA_SECP384R1_SHA384 + | `ECDSA_SECP521R1_SHA512 + | `ED25519 + | `RSA_PKCS1_MD5 + | `RSA_PKCS1_SHA1 + | `RSA_PKCS1_SHA224 + | `RSA_PKCS1_SHA256 + | `RSA_PKCS1_SHA384 + | `RSA_PKCS1_SHA512 + | `RSA_PSS_RSAENC_SHA256 + | `RSA_PSS_RSAENC_SHA384 + | `RSA_PSS_RSAENC_SHA512 ECDSA_SECP256R1_SHA1 ECDSA_SECP256R1_SHA256 ECDSA_SECP384R1_SHA384 ECDSA_SECP521R1_SHA512 ] + list + | `NoConfiguredVersions of + [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] list + | `NoMatchingCertificateFound of string ] + | `Fatal of + [< `Bad_certificate of string + | `Bad_mac + | `Decode of string + | `Handshake of + [< `BadDH of string + | `BadECDH of Mirage_crypto_ec.error + | `Fragments + | `Message of string ] + | `Inappropriate_fallback + | `Missing_extension of string + | `No_application_protocol + | `Protocol_version of + [< `Bad_record of + [< `SSL_3 + | `TLS_1_0 + | `TLS_1_1 + | `TLS_1_2 + | `TLS_1_3 + | `TLS_1_X of int ] + | `None_supported of + [< `SSL_3 + | `TLS_1_0 + | `TLS_1_1 + | `TLS_1_2 + | `TLS_1_3 + | `TLS_1_X of int ] + list + | `Unknown_record of int * int ] + | `Record_overflow of int + | `Unexpected of + [< `Content_type of int + | `Handshake of Core.tls_handshake + | `Message of string ] + | `Unsupported_extension ] ] -> + unit
val common_data_to_epoch : + common_session_data -> + bool -> + [ `host ] Domain_name.t option -> + Core.epoch_data
val epoch_of_session : + bool -> + [ `host ] Domain_name.t option -> + Core.tls_version -> + [< `TLS of session_data | `TLS13 of session_data13 ] -> + Core.epoch_data
val epoch_of_hs : handshake_state -> Core.epoch_data option
diff --git a/doc/tls/Tls/Utils/List_set/index.html b/doc/tls/Tls/Utils/List_set/index.html new file mode 100644 index 00000000..2fcd3dfc --- /dev/null +++ b/doc/tls/Tls/Utils/List_set/index.html @@ -0,0 +1,2 @@ + +List_set (tls.Tls.Utils.List_set)

Module Utils.List_set

val subset : ?compare:('a -> 'a -> int) -> 'b list -> 'a list -> bool
val is_proper_set : 'a list -> bool
diff --git a/doc/tls/Tls/Utils/index.html b/doc/tls/Tls/Utils/index.html new file mode 100644 index 00000000..7953499d --- /dev/null +++ b/doc/tls/Tls/Utils/index.html @@ -0,0 +1,2 @@ + +Utils (tls.Tls.Utils)

Module Tls.Utils

module List_set : sig ... end
val map_find : f:('a -> 'b option) -> 'c list -> 'd option
val init_and_last : 'a list -> ('b list * 'c) option
val first_match : 'a list -> 'b list -> 'c option
val sub_equal : off:int -> len:int -> string -> string -> bool
diff --git a/doc/tls/Tls/Writer/index.html b/doc/tls/Tls/Writer/index.html new file mode 100644 index 00000000..fdeedbdd --- /dev/null +++ b/doc/tls/Tls/Writer/index.html @@ -0,0 +1,15 @@ + +Writer (tls.Tls.Writer)

Module Tls.Writer

val assemble_protocol_version : ?buf:bytes -> Core.tls_version -> string
val assemble_handshake : Core.tls_handshake -> string
val assemble_message_hash : int -> string
val assemble_hdr : Core.tls_version -> (Packet.content_type * string) -> string
val assemble_alert : ?level:Packet.alert_level -> Packet.alert_type -> string
val assemble_change_cipher_spec : string
val assemble_dh_parameters : Core.dh_parameters -> string
val assemble_ec_parameters : Core.group -> string -> string
val assemble_client_dh_key_exchange : string -> string
val assemble_client_ec_key_exchange : string -> string
val assemble_digitally_signed : string -> string
val assemble_digitally_signed_1_2 : + Core.signature_algorithm -> + string -> + string
val assemble_certificate_request : + Packet.client_certificate_type list -> + string list -> + string
val assemble_certificate_request_1_2 : + Packet.client_certificate_type list -> + Core.signature_algorithm list -> + string list -> + string
val assemble_certificate_request_1_3 : + ?context:string -> + Core.certificate_request_extension list -> + string
val assemble_certificates : string list -> string
val assemble_certificates_1_3 : string -> string list -> string
diff --git a/doc/tls/Tls/index.html b/doc/tls/Tls/index.html new file mode 100644 index 00000000..9140b480 --- /dev/null +++ b/doc/tls/Tls/index.html @@ -0,0 +1,2 @@ + +Tls (tls.Tls)

Module Tls

module Ciphersuite : sig ... end

Ciphersuite definitions and some helper functions.

module Config : sig ... end

Configuration of the TLS stack

module Core : sig ... end

Core type definitions

module Crypto : sig ... end
module Engine : sig ... end

Transport layer security

module Explorator : sig ... end
module Handshake_client : sig ... end
module Handshake_client13 : sig ... end
module Handshake_common : sig ... end
module Handshake_crypto : sig ... end
module Handshake_crypto13 : sig ... end
module Handshake_server : sig ... end
module Handshake_server13 : sig ... end
module Packet : sig ... end

Magic numbers of the TLS protocol.

module Reader : sig ... end
module State : sig ... end
module Utils : sig ... end
module Writer : sig ... end
diff --git a/doc/tls/index.html b/doc/tls/index.html new file mode 100644 index 00000000..cb1b0fc0 --- /dev/null +++ b/doc/tls/index.html @@ -0,0 +1,2 @@ + +index (tls.index)

tls index

Library tls

The entry point of this library is the module: Tls.