diff --git a/doc/index.html b/doc/index.html index 400bda67..49d4b554 100644 --- a/doc/index.html +++ b/doc/index.html @@ -11,10 +11,9 @@

OCaml package documentation

    -
  1. tls 0.17.4
    2. -
  2. tls-async 0.17.4
    3. -
  3. tls-lwt 0.17.4
    4. -
  4. tls-mirage 0.17.4
    5. +
  5. tls 0.17.5
    6. +
  6. tls-lwt 0.17.5
    7. +
  7. tls-mirage 0.17.5
diff --git a/doc/odoc.support/odoc.css b/doc/odoc.support/odoc.css index c23517ba..71148de3 100644 --- a/doc/odoc.support/odoc.css +++ b/doc/odoc.support/odoc.css @@ -1,7 +1,7 @@ @charset "UTF-8"; /* Copyright (c) 2016 The odoc contributors. All rights reserved. Distributed under the ISC license, see terms at the end of the file. - odoc 2.4.1 */ + odoc 2.4.2 */ /* Fonts */ /* noticia-text-regular - latin */ diff --git a/doc/tls-async/Tls_async/Session/Fd/index.html b/doc/tls-async/Tls_async/Session/Fd/index.html deleted file mode 100644 index c0e47008..00000000 --- a/doc/tls-async/Tls_async/Session/Fd/index.html +++ /dev/null @@ -1,2 +0,0 @@ - -Fd (tls-async.Tls_async.Session.Fd)

Module Session.Fd

type t = Async.Reader.t * Async.Writer.t
val read : t -> Cstruct.t -> [ `Ok of int | `Eof ] Async.Deferred.Or_error.t
val write_full : t -> Cstruct.t -> unit Async.Deferred.Or_error.t
diff --git a/doc/tls-async/Tls_async/Session/index.html b/doc/tls-async/Tls_async/Session/index.html deleted file mode 100644 index 99544d58..00000000 --- a/doc/tls-async/Tls_async/Session/index.html +++ /dev/null @@ -1,12 +0,0 @@ - -Session (tls-async.Tls_async.Session)

Module Tls_async.Session

Low-level API for working with TLS sessions. Most applications should use the high-level API below

module Fd : sig ... end
type t

Abstract type of a session

Constructors

val server_of_fd : Tls.Config.server -> Fd.t -> t Async.Deferred.Or_error.t

server_of_fd server fd is t, after server-side TLS handshake of fd using server configuration.

val client_of_fd : - Tls.Config.client -> - ?host:[ `host ] Domain_name.t -> - Fd.t -> - t Async.Deferred.Or_error.t

client_of_fd client ~host fd is t, after client-side TLS handshake of fd using client configuration and host.

Common stream operations

val read : t -> Cstruct.t -> int Async.Deferred.Or_error.t

read t buffer is length, the number of bytes read into buffer.

val writev : t -> Cstruct.t list -> unit Async.Deferred.Or_error.t

writev t buffers writes the buffers to the session.

val close_tls : t -> unit Async.Deferred.Or_error.t

close t closes the TLS session by sending a close notify to the peer.

val reneg : - ?authenticator:X509.Authenticator.t -> - ?acceptable_cas:X509.Distinguished_name.t list -> - ?cert:Tls.Config.own_cert -> - ?drop:bool -> - t -> - unit Async.Deferred.Or_error.t

reneg ~authenticator ~acceptable_cas ~cert ~drop t renegotiates the session, and blocks until the renegotiation finished. Optionally, a new authenticator and acceptable_cas can be used. The own certificate can be adjusted by cert. If drop is true (the default), application data received before the renegotiation finished is dropped.

val key_update : ?request:bool -> t -> unit Async.Deferred.Or_error.t

key_update ~request t updates the traffic key and requests a traffic key update from the peer if request is provided and true (the default). This is only supported in TLS 1.3.

val epoch : t -> Tls.Core.epoch_data Core.Or_error.t

epoch t returns epoch, which contains information of the active session.

diff --git a/doc/tls-async/Tls_async/X509_async/Authenticator/Param/index.html b/doc/tls-async/Tls_async/X509_async/Authenticator/Param/index.html deleted file mode 100644 index d4a79acd..00000000 --- a/doc/tls-async/Tls_async/X509_async/Authenticator/Param/index.html +++ /dev/null @@ -1,15 +0,0 @@ - -Param (tls-async.Tls_async.X509_async.Authenticator.Param)

Module Authenticator.Param

type t
val ca_file : - ?allowed_hashes:Mirage_crypto.Hash.hash list -> - ?crls:Core.Filename.t -> - Core.Filename.t -> - unit -> - t
val ca_dir : - ?allowed_hashes:Mirage_crypto.Hash.hash list -> - ?crls:Core.Filename.t -> - Core.Filename.t -> - unit -> - t
val cert_fingerprint : Mirage_crypto.Hash.hash -> string -> t

The fingerprint can be collected from a browser or by invoking an openssl command like 'openssl x509 -in <pem_file> -noout -fingerprint -sha256'

val key_fingerprint : Mirage_crypto.Hash.hash -> string -> t

The fingerprint can be collected from a browser or by invoking an openssl command like 'openssl x509 -in <pem_file> -noout -pubkey | openssl pkey -pubin -outform DER | openssl dgst -sha256'

val time : unit -> Ptime.t option

Async programs often don't use Ptime_clock, so this is provided as a convenience function. Relies on Unix.gettimeofday.

val to_authenticator : - time:(unit -> Ptime.t option) -> - t -> - {Authenticator}7.t Async.Deferred.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/Authenticator/index.html b/doc/tls-async/Tls_async/X509_async/Authenticator/index.html deleted file mode 100644 index 81578ac9..00000000 --- a/doc/tls-async/Tls_async/X509_async/Authenticator/index.html +++ /dev/null @@ -1,21 +0,0 @@ - -Authenticator (tls-async.Tls_async.X509_async.Authenticator)

Module X509_async.Authenticator

type t = - ?ip:Ipaddr.t -> - host:[ `host ] Domain_name.t option -> - X509.Certificate.t list -> - X509.Validation.r
val chain_of_trust : - time:(unit -> Ptime.t option) -> - ?crls:X509.CRL.t list -> - ?allowed_hashes:Mirage_crypto.Hash.hash list -> - X509.Certificate.t list -> - t
val server_key_fingerprint : - time:(unit -> Ptime.t option) -> - hash:Mirage_crypto.Hash.hash -> - fingerprint:Cstruct.t -> - t
val server_cert_fingerprint : - time:(unit -> Ptime.t option) -> - hash:Mirage_crypto.Hash.hash -> - fingerprint:Cstruct.t -> - t
val of_string : - string -> - ((unit -> Ptime.t option) -> t, [> `Msg of string ]) Stdlib.result
module Param : sig ... end
diff --git a/doc/tls-async/Tls_async/X509_async/CRL/index.html b/doc/tls-async/Tls_async/X509_async/CRL/index.html deleted file mode 100644 index 7844a22b..00000000 --- a/doc/tls-async/Tls_async/X509_async/CRL/index.html +++ /dev/null @@ -1,39 +0,0 @@ - -CRL (tls-async.Tls_async.X509_async.CRL)

Module X509_async.CRL

type t = X509.CRL.t
val encode_der : t -> Cstruct.t
val issuer : t -> X509.Distinguished_name.t
val this_update : t -> Ptime.t
val next_update : t -> Ptime.t option
type revoked_cert = X509.CRL.revoked_cert = {
  1. serial : Z.t;
  2. date : Ptime.t;
  3. extensions : X509.Extension.t;
}
val reason : revoked_cert -> X509.Extension.reason option
val revoked_certificates : t -> revoked_cert list
val extensions : t -> X509.Extension.t
val crl_number : t -> int option
val signature_algorithm : - t -> - (X509.Key_type.signature_scheme * Mirage_crypto.Hash.hash) option
val validate : - t -> - ?allowed_hashes:Mirage_crypto.Hash.hash list -> - X509.Public_key.t -> - (unit, [> X509.Validation.signature_error ]) Stdlib.result
type verification_error = [
  1. | `Bad_encoding of X509.Distinguished_name.t * string * Cstruct.t
  2. | `Bad_signature of X509.Distinguished_name.t * string
  3. | `Hash_not_allowed of X509.Distinguished_name.t * Mirage_crypto.Hash.hash
  4. | `Issuer_subject_mismatch of - X509.Distinguished_name.t * X509.Distinguished_name.t
  5. | `Msg of string
  6. | `Next_update_scheduled of X509.Distinguished_name.t * Ptime.t * Ptime.t
  7. | `Not_yet_valid of X509.Distinguished_name.t * Ptime.t * Ptime.t
  8. | `Unsupported_algorithm of X509.Distinguished_name.t * string
  9. | `Unsupported_keytype of X509.Distinguished_name.t * X509.Public_key.t
]
val pp_verification_error : verification_error Fmt.t
val verify : - t -> - ?allowed_hashes:Mirage_crypto.Hash.hash list -> - ?time:Ptime.t -> - X509.Certificate.t -> - (unit, [> verification_error ]) Stdlib.result
val is_revoked : - ?allowed_hashes:Mirage_crypto.Hash.hash list -> - issuer:X509.Certificate.t -> - cert:X509.Certificate.t -> - t list -> - bool
val decode_der : contents:string -> t Core.Or_error.t
val revoke : - ?digest:Mirage_crypto.Hash.hash -> - issuer:Distinguished_name.t -> - this_update:Ptime.t -> - ?next_update:Ptime.t -> - ?extensions:Extension.t -> - revoked_cert list -> - Private_key.t -> - t Core.Or_error.t
val revoke_certificate : - revoked_cert -> - this_update:Ptime.t -> - ?next_update:Ptime.t -> - t -> - Private_key.t -> - t Core.Or_error.t
val revoke_certificates : - revoked_cert list -> - this_update:Ptime.t -> - ?next_update:Ptime.t -> - t -> - Private_key.t -> - t Core.Or_error.t
val of_pem_dir : directory:Core.Filename.t -> t list Async.Deferred.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/Certificate/index.html b/doc/tls-async/Tls_async/X509_async/Certificate/index.html deleted file mode 100644 index 4d3da038..00000000 --- a/doc/tls-async/Tls_async/X509_async/Certificate/index.html +++ /dev/null @@ -1,10 +0,0 @@ - -Certificate (tls-async.Tls_async.X509_async.Certificate)

Module X509_async.Certificate

val decode_pkcs1_digest_info : - Cstruct.t -> - (Mirage_crypto.Hash.hash * Cstruct.t, [> `Msg of string ]) Stdlib.result
val encode_pkcs1_digest_info : - (Mirage_crypto.Hash.hash * Cstruct.t) -> - Cstruct.t
type t = X509.Certificate.t
val pp : t Fmt.t
val encode_der : t -> Cstruct.t
val encode_pem_multiple : t list -> Cstruct.t
val encode_pem : t -> Cstruct.t
val supports_keytype : t -> X509.Key_type.t -> bool
val public_key : t -> X509.Public_key.t
val signature_algorithm : - t -> - (X509.Key_type.signature_scheme * Mirage_crypto.Hash.hash) option
val hostnames : t -> X509.Host.Set.t
val supports_hostname : t -> [ `host ] Domain_name.t -> bool
val ips : t -> Ipaddr.Set.t
val supports_ip : t -> Ipaddr.t -> bool
val fingerprint : Mirage_crypto.Hash.hash -> t -> Cstruct.t
val subject : t -> X509.Distinguished_name.t
val issuer : t -> X509.Distinguished_name.t
val serial : t -> Z.t
val validity : t -> Ptime.t * Ptime.t
val extensions : t -> X509.Extension.t
val decode_pem_multiple : contents:string -> t list Core.Or_error.t
val decode_pem : contents:string -> t Core.Or_error.t
val decode_der : contents:string -> t Core.Or_error.t
val of_pem_file : Core.Filename.t -> t list Async.Deferred.Or_error.t
val of_pem_directory : - directory:Core.Filename.t -> - t list Async.Deferred.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/Distinguished_name/index.html b/doc/tls-async/Tls_async/X509_async/Distinguished_name/index.html deleted file mode 100644 index 80aedefb..00000000 --- a/doc/tls-async/Tls_async/X509_async/Distinguished_name/index.html +++ /dev/null @@ -1,7 +0,0 @@ - -Distinguished_name (tls-async.Tls_async.X509_async.Distinguished_name)

Module X509_async.Distinguished_name

type attribute = X509.Distinguished_name.attribute =
  1. | CN of string
  2. | Serialnumber of string
  3. | C of string
  4. | L of string
  5. | ST of string
  6. | O of string
  7. | OU of string
  8. | T of string
  9. | DNQ of string
  10. | Mail of string
  11. | DC of string
  12. | Given_name of string
  13. | Surname of string
  14. | Initials of string
  15. | Pseudonym of string
  16. | Generation of string
  17. | Street of string
  18. | Userid of string
  19. | Other of Asn.oid * string
module Relative_distinguished_name = - X509.Distinguished_name.Relative_distinguished_name
type t = Relative_distinguished_name.t list
val equal : t -> t -> bool
val make_pp : - format:[ `OSF | `OpenSSL | `RFC4514 ] -> - ?spacing:[ `Loose | `Medium | `Tight ] -> - unit -> - t Fmt.t
val pp : t Fmt.t
val common_name : t -> string option
val encode_der : t -> Cstruct.t
val decode_der : contents:string -> t Core.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/OCSP/Request/index.html b/doc/tls-async/Tls_async/X509_async/OCSP/Request/index.html deleted file mode 100644 index 96d7e78e..00000000 --- a/doc/tls-async/Tls_async/X509_async/OCSP/Request/index.html +++ /dev/null @@ -1,20 +0,0 @@ - -Request (tls-async.Tls_async.X509_async.OCSP.Request)

Module OCSP.Request

type t = X509.OCSP.Request.t
val pp : t Fmt.t
val validate : - t -> - ?allowed_hashes:Mirage_crypto.Hash.hash list -> - X509.Public_key.t -> - (unit, - [> `Bad_encoding of X509.Distinguished_name.t * string * Cstruct.t - | `Bad_signature of X509.Distinguished_name.t * string - | `Hash_not_allowed of X509.Distinguished_name.t * Mirage_crypto.Hash.hash - | `Msg of string - | `No_signature - | `Unsupported_algorithm of X509.Distinguished_name.t * string - | `Unsupported_keytype of X509.Distinguished_name.t * X509.Public_key.t ]) - Stdlib.result
val requestor_name : t -> X509.General_name.b option
val cert_ids : t -> X509.OCSP.cert_id list
val encode_der : t -> Cstruct.t
val create : - ?certs:Certificate.t list -> - ?digest:Mirage_crypto.Hash.hash -> - ?requestor_name:General_name.b -> - ?key:Private_key.t -> - cert_id list -> - t Core.Or_error.t
val decode_der : contents:string -> t Core.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/OCSP/Response/index.html b/doc/tls-async/Tls_async/X509_async/OCSP/Response/index.html deleted file mode 100644 index 353ef025..00000000 --- a/doc/tls-async/Tls_async/X509_async/OCSP/Response/index.html +++ /dev/null @@ -1,36 +0,0 @@ - -Response (tls-async.Tls_async.X509_async.OCSP.Response)

Module OCSP.Response

type status = [
  1. | `InternalError
  2. | `MalformedRequest
  3. | `SigRequired
  4. | `Successful
  5. | `TryLater
  6. | `Unauthorized
]
val pp_status : status Fmt.t
type cert_status = [
  1. | `Good
  2. | `Revoked of Ptime.t * X509.Extension.reason option
  3. | `Unknown
]
val pp_cert_status : cert_status Fmt.t
type single_response = X509.OCSP.Response.single_response
val create_single_response : - ?next_update:Ptime.t -> - ?single_extensions:X509.Extension.t -> - X509.OCSP.cert_id -> - cert_status -> - Ptime.t -> - single_response
val pp_single_response : single_response Fmt.t
val single_response_cert_id : single_response -> X509.OCSP.cert_id
val single_response_status : single_response -> cert_status
type responder_id = [
  1. | `ByKey of Cstruct.t
  2. | `ByName of X509.Distinguished_name.t
]
val create_responder_id : X509.Public_key.t -> responder_id
val pp_responder_id : responder_id Fmt.t
type t = X509.OCSP.Response.t
val create : - [ `InternalError - | `MalformedRequest - | `SigRequired - | `TryLater - | `Unauthorized ] -> - t
val pp : t Fmt.t
val status : t -> status
val responder_id : t -> (responder_id, [> `Msg of string ]) Stdlib.result
val encode_der : t -> Cstruct.t
val validate : - t -> - ?allowed_hashes:Mirage_crypto.Hash.hash list -> - ?now:Ptime.t -> - X509.Public_key.t -> - (unit, - [> `Bad_encoding of X509.Distinguished_name.t * string * Cstruct.t - | `Bad_signature of X509.Distinguished_name.t * string - | `Hash_not_allowed of X509.Distinguished_name.t * Mirage_crypto.Hash.hash - | `Msg of string - | `No_signature - | `Time_invalid - | `Unsupported_algorithm of X509.Distinguished_name.t * string - | `Unsupported_keytype of X509.Distinguished_name.t * X509.Public_key.t ]) - Stdlib.result
val create_success : - ?digest:Mirage_crypto.Hash.hash -> - ?certs:Certificate.t list -> - ?response_extensions:Extension.t -> - Private_key.t -> - responder_id -> - Ptime.t -> - single_response list -> - t Core.Or_error.t
val responses : t -> single_response list Core.Or_error.t
val decode_der : contents:string -> t Core.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/OCSP/index.html b/doc/tls-async/Tls_async/X509_async/OCSP/index.html deleted file mode 100644 index 263442e7..00000000 --- a/doc/tls-async/Tls_async/X509_async/OCSP/index.html +++ /dev/null @@ -1,6 +0,0 @@ - -OCSP (tls-async.Tls_async.X509_async.OCSP)

Module X509_async.OCSP

type cert_id = X509.OCSP.cert_id
val create_cert_id : - ?hash:Mirage_crypto.Hash.hash -> - X509.Certificate.t -> - Z.t -> - cert_id
val cert_id_serial : cert_id -> Z.t
val pp_cert_id : cert_id Fmt.t
module Request : sig ... end
module Response : sig ... end
diff --git a/doc/tls-async/Tls_async/X509_async/PKCS12/index.html b/doc/tls-async/Tls_async/X509_async/PKCS12/index.html deleted file mode 100644 index 073aee84..00000000 --- a/doc/tls-async/Tls_async/X509_async/PKCS12/index.html +++ /dev/null @@ -1,17 +0,0 @@ - -PKCS12 (tls-async.Tls_async.X509_async.PKCS12)

Module X509_async.PKCS12

type t = X509.PKCS12.t
val encode_der : t -> Cstruct.t
val create : - ?mac:[ `SHA1 | `SHA224 | `SHA256 | `SHA384 | `SHA512 ] -> - ?algorithm:[ `AES128_CBC | `AES192_CBC | `AES256_CBC ] -> - ?iterations:int -> - string -> - X509.Certificate.t list -> - X509.Private_key.t -> - t
val decode_der : contents:string -> t Core.Or_error.t
val verify : - string -> - t -> - [ `Certificate of Certificate.t - | `Crl of CRL.t - | `Decrypted_private_key of Private_key.t - | `Private_key of Private_key.t ] - list - Core.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/Private_key/index.html b/doc/tls-async/Tls_async/X509_async/Private_key/index.html deleted file mode 100644 index 7e83fa84..00000000 --- a/doc/tls-async/Tls_async/X509_async/Private_key/index.html +++ /dev/null @@ -1,15 +0,0 @@ - -Private_key (tls-async.Tls_async.X509_async.Private_key)

Module X509_async.Private_key

type t = [
  1. | `ED25519 of Mirage_crypto_ec.Ed25519.priv
  2. | `P224 of Mirage_crypto_ec.P224.Dsa.priv
  3. | `P256 of Mirage_crypto_ec.P256.Dsa.priv
  4. | `P384 of Mirage_crypto_ec.P384.Dsa.priv
  5. | `P521 of Mirage_crypto_ec.P521.Dsa.priv
  6. | `RSA of Mirage_crypto_pk.Rsa.priv
]
val generate : ?seed:Cstruct.t -> ?bits:int -> X509.Key_type.t -> t
val of_cstruct : - Cstruct.t -> - X509.Key_type.t -> - (t, [> `Msg of string ]) Stdlib.result
val of_string : - ?seed_or_data:[ `Data | `Seed ] -> - ?bits:int -> - X509.Key_type.t -> - string -> - (t, [> `Msg of string ]) Stdlib.result
val key_type : t -> X509.Key_type.t
val public : t -> X509.Public_key.t
val encode_der : t -> Cstruct.t
val encode_pem : t -> Cstruct.t
val sign : - Mirage_crypto.Hash.hash -> - ?scheme:Key_type.signature_scheme -> - t -> - [ `Digest of Cstruct.t | `Message of Cstruct.t ] -> - string Core.Or_error.t
val decode_der : contents:string -> t Core.Or_error.t
val decode_pem : contents:string -> t Core.Or_error.t
val of_pem_file : Core.Filename.t -> t Async.Deferred.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/Public_key/index.html b/doc/tls-async/Tls_async/X509_async/Public_key/index.html deleted file mode 100644 index d07e83ca..00000000 --- a/doc/tls-async/Tls_async/X509_async/Public_key/index.html +++ /dev/null @@ -1,8 +0,0 @@ - -Public_key (tls-async.Tls_async.X509_async.Public_key)

Module X509_async.Public_key

type t = [
  1. | `ED25519 of Mirage_crypto_ec.Ed25519.pub
  2. | `P224 of Mirage_crypto_ec.P224.Dsa.pub
  3. | `P256 of Mirage_crypto_ec.P256.Dsa.pub
  4. | `P384 of Mirage_crypto_ec.P384.Dsa.pub
  5. | `P521 of Mirage_crypto_ec.P521.Dsa.pub
  6. | `RSA of Mirage_crypto_pk.Rsa.pub
]
val pp : t Fmt.t
val id : t -> Cstruct.t
val fingerprint : ?hash:Mirage_crypto.Hash.hash -> t -> Cstruct.t
val key_type : t -> X509.Key_type.t
val encode_der : t -> Cstruct.t
val encode_pem : t -> Cstruct.t
val verify : - Mirage_crypto.Hash.hash -> - ?scheme:Key_type.signature_scheme -> - signature:string -> - t -> - [ `Digest of string | `Message of string ] -> - unit Core.Or_error.t
val decode_der : contents:string -> t Core.Or_error.t
val decode_pem : contents:string -> t Core.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/Signing_request/index.html b/doc/tls-async/Tls_async/X509_async/Signing_request/index.html deleted file mode 100644 index c226ede8..00000000 --- a/doc/tls-async/Tls_async/X509_async/Signing_request/index.html +++ /dev/null @@ -1,22 +0,0 @@ - -Signing_request (tls-async.Tls_async.X509_async.Signing_request)

Module X509_async.Signing_request

type t = X509.Signing_request.t
val encode_der : t -> Cstruct.t
val encode_pem : t -> Cstruct.t
module Ext = X509.Signing_request.Ext
type request_info = X509.Signing_request.request_info = {
  1. subject : X509.Distinguished_name.t;
  2. public_key : X509.Public_key.t;
  3. extensions : Ext.t;
}
val info : t -> request_info
val signature_algorithm : - t -> - (X509.Key_type.signature_scheme * Mirage_crypto.Hash.hash) option
val hostnames : t -> X509.Host.Set.t
val decode_der : - ?allowed_hashes:Mirage_crypto.Hash.hash list -> - string -> - t Core.Or_error.t
val decode_pem : string -> t Core.Or_error.t
val create : - Distinguished_name.t -> - ?digest:Mirage_crypto.Hash.hash -> - ?extensions:Ext.t -> - Private_key.t -> - t Core.Or_error.t
val sign : - ?allowed_hashes:Mirage_crypto.Hash.hash list -> - ?digest:Mirage_crypto.Hash.hash -> - ?serial:Z.t -> - ?extensions:Extension.t -> - t -> - Private_key.t -> - Distinguished_name.t -> - valid_from:Ptime.t -> - valid_until:Ptime.t -> - Certificate.t Core.Or_error.t
diff --git a/doc/tls-async/Tls_async/X509_async/index.html b/doc/tls-async/Tls_async/X509_async/index.html deleted file mode 100644 index 92f6c27a..00000000 --- a/doc/tls-async/Tls_async/X509_async/index.html +++ /dev/null @@ -1,2 +0,0 @@ - -X509_async (tls-async.Tls_async.X509_async)

Module Tls_async.X509_async

Helper functions for Async_unix-specific IO operations commonly used with X509 certificates, such as loading from a Unix filesystem

include module type of struct include X509 end
module Host = X509.Host
module Key_type = X509.Key_type
module General_name = X509.General_name
module Extension = X509.Extension
module Validation = X509.Validation
module Authenticator : sig ... end
module Private_key : sig ... end
module Public_key : sig ... end
module Certificate : sig ... end
module Distinguished_name : sig ... end
module CRL : sig ... end
module OCSP : sig ... end
module PKCS12 : sig ... end
module Signing_request : sig ... end
diff --git a/doc/tls-async/Tls_async/index.html b/doc/tls-async/Tls_async/index.html deleted file mode 100644 index 5c197bd0..00000000 --- a/doc/tls-async/Tls_async/index.html +++ /dev/null @@ -1,26 +0,0 @@ - -Tls_async (tls-async.Tls_async)

Module Tls_async

module Session : sig ... end

Low-level API for working with TLS sessions. Most applications should use the high-level API below

module X509_async : sig ... end

Helper functions for Async_unix-specific IO operations commonly used with X509 certificates, such as loading from a Unix filesystem

val listen : - ?buffer_age_limit:Async.Writer.buffer_age_limit -> - ?max_connections:int -> - ?max_accepts_per_batch:int -> - ?backlog:int -> - ?socket: - ([ `Unconnected ], [< Async.Socket.Address.t ] as 'address) Async.Socket.t -> - on_handler_error:[ `Call of 'address -> exn -> unit | `Ignore | `Raise ] -> - Tls.Config.server -> - ('address, 'listening_on) Async.Tcp.Where_to_listen.t -> - ('address -> - Session.t -> - Async.Reader.t -> - Async.Writer.t -> - unit Async.Deferred.t) -> - ('address, 'listening_on) Async.Tcp.Server.t Async.Deferred.t

listen creates a Tcp.Server.t with the requested parameters, including those specified in Tls.Config.server. The handler function exposes the low-level Session.t to accommodate cases like interrogating a client certificate

type 'a io_handler = Async.Reader.t -> Async.Writer.t -> 'a Async.Deferred.t
type 'a tls_handler = Session.t -> 'a io_handler
val upgrade_server_handler : - config:Tls.Config.server -> - 'a tls_handler -> - 'a io_handler

upgrade_server_handler is what listen calls to handle each client. It is exposed so that low-level end-users of the library can use tls-async inside of code that manages Tcp services directly.

The tls_handler argument will be called with the client Tls session, reader and writer to be used for cleartext data.

The outer reader and writer will read encrypted data from and write encrypted data to the connected socket.

val connect : - ?socket:([ `Unconnected ], 'addr) Async.Socket.t -> - (Tls.Config.client -> - 'addr Async.Tcp.Where_to_connect.t -> - host:[ `host ] Domain_name.t option -> - (Session.t * Async.Reader.t * Async.Writer.t) Async.Deferred.Or_error.t) - Async.Tcp.Aliases.with_connect_options

connect behaves similarly to Tcp.connect, exposing a cleartext reader and writer. Callers should ensure they close the Writer.t and wait for the unit Deferred.t returned by `Closed_and_flushed_downstream to completely shut down the TLS connection

host is used for peer name verification and should generally be provided. Passing None will disable peer name verification unless peer_name was provided in the Tls.Config.client. If both are present host overwrites peer_name.

diff --git a/doc/tls-async/index.html b/doc/tls-async/index.html deleted file mode 100644 index 498790e5..00000000 --- a/doc/tls-async/index.html +++ /dev/null @@ -1,2 +0,0 @@ - -index (tls-async.index)

tls-async index

Library tls-async

The entry point of this library is the module: Tls_async.

diff --git a/doc/tls-lwt/Tls_lwt/Unix/index.html b/doc/tls-lwt/Tls_lwt/Unix/index.html index 50621462..35497e11 100644 --- a/doc/tls-lwt/Tls_lwt/Unix/index.html +++ b/doc/tls-lwt/Tls_lwt/Unix/index.html @@ -1,5 +1,5 @@ -Unix (tls-lwt.Tls_lwt.Unix)

Module Tls_lwt.Unix

Low-level API

Unix API

It is the responsibility of the client to handle error conditions. The underlying file descriptors are not closed.

type t

Abstract type of a session

Constructors

val server_of_fd : Tls.Config.server -> Lwt_unix.file_descr -> t Lwt.t

server_of_fd server fd is t, after server-side TLS handshake of fd using server configuration.

val client_of_fd : +Unix (tls-lwt.Tls_lwt.Unix)

Module Tls_lwt.Unix

Low-level API

Unix API

It is the responsibility of the client to handle error conditions. The underlying file descriptors are not closed.

type t

Abstract type of a session

Constructors

val server_of_fd : Tls.Config.server -> Lwt_unix.file_descr -> t Lwt.t

server_of_fd server fd is t, after server-side TLS handshake of fd using server configuration.

val client_of_fd : Tls.Config.client -> ?host:[ `host ] Domain_name.t -> Lwt_unix.file_descr -> diff --git a/doc/tls-lwt/Tls_lwt/index.html b/doc/tls-lwt/Tls_lwt/index.html index 0ff903dd..605e2f3a 100644 --- a/doc/tls-lwt/Tls_lwt/index.html +++ b/doc/tls-lwt/Tls_lwt/index.html @@ -1,5 +1,5 @@ -Tls_lwt (tls-lwt.Tls_lwt)

Module Tls_lwt

Effectful operations using Lwt for pure TLS.

The pure TLS is state and buffer in, state and buffer out. This module uses Lwt for communication over the network.

This module implements a high-level API and a low-level API (in Unix). Most applications should use the high-level API described below.

exception Tls_alert of Tls.Packet.alert_type

Tls_alert exception received from the other endpoint

exception Tls_failure of Tls.Engine.failure

Tls_failure exception while processing incoming data

module Unix : sig ... end

Low-level API

High-level API

type ic = Lwt_io.input_channel
type oc = Lwt_io.output_channel
val accept_ext : +Tls_lwt (tls-lwt.Tls_lwt)

Module Tls_lwt

Effectful operations using Lwt for pure TLS.

The pure TLS is state and buffer in, state and buffer out. This module uses Lwt for communication over the network.

This module implements a high-level API and a low-level API (in Unix). Most applications should use the high-level API described below.

exception Tls_alert of Tls.Packet.alert_type

Tls_alert exception received from the other endpoint

exception Tls_failure of Tls.Engine.failure

Tls_failure exception while processing incoming data

module Unix : sig ... end

Low-level API

High-level API

type ic = Lwt_io.input_channel
type oc = Lwt_io.output_channel
val accept_ext : Tls.Config.server -> Lwt_unix.file_descr -> ((ic * oc) * Lwt_unix.sockaddr) Lwt.t

accept_ext server fd is (ic, oc), sockaddr, the input and output channel from an accepted connection on the given fd, after upgrading to TLS using the server configuration.

val accept : diff --git a/doc/tls-lwt/X509_lwt/index.html b/doc/tls-lwt/X509_lwt/index.html index e5f5fef5..73aec99b 100644 --- a/doc/tls-lwt/X509_lwt/index.html +++ b/doc/tls-lwt/X509_lwt/index.html @@ -1,5 +1,5 @@ -X509_lwt (tls-lwt.X509_lwt)

Module X509_lwt

X.509 certificate handling using Lwt.

val private_of_pems : +X509_lwt (tls-lwt.X509_lwt)

Module X509_lwt

X.509 certificate handling using Lwt.

val private_of_pems : cert:Lwt_io.file_name -> priv_key:Lwt_io.file_name -> Tls.Config.certchain Lwt.t

private_of_pems ~cert ~priv_key is priv, after reading the private key and certificate chain from the given PEM-encoded files.

val certs_of_pem : Lwt_io.file_name -> X509.Certificate.t list Lwt.t

certs_of_pem file is certificates, which are read from the PEM-encoded file.

val certs_of_pem_dir : Lwt_io.file_name -> X509.Certificate.t list Lwt.t

certs_of_pem_dir dir is certificates, which are read from all PEM-encoded files in dir.

val authenticator : diff --git a/doc/tls-lwt/index.html b/doc/tls-lwt/index.html index 3209abd8..c0ca7800 100644 --- a/doc/tls-lwt/index.html +++ b/doc/tls-lwt/index.html @@ -1,2 +1,2 @@ -index (tls-lwt.index)

tls-lwt index

Library tls-lwt

This library exposes the following toplevel modules:

  • Tls_lwt Effectful operations using Lwt for pure TLS.
  • X509_lwt X.509 certificate handling using Lwt.
+index (tls-lwt.index)

tls-lwt index

Library tls-lwt

This library exposes the following toplevel modules:

  • Tls_lwt Effectful operations using Lwt for pure TLS.
  • X509_lwt X.509 certificate handling using Lwt.
diff --git a/doc/tls-mirage/Tls_mirage/Make/index.html b/doc/tls-mirage/Tls_mirage/Make/index.html index ba208a48..9161ecf1 100644 --- a/doc/tls-mirage/Tls_mirage/Make/index.html +++ b/doc/tls-mirage/Tls_mirage/Make/index.html @@ -1,7 +1,7 @@ -Make (tls-mirage.Tls_mirage.Make)

Module Tls_mirage.Make

TLS module given a flow

Parameters

module F : Mirage_flow.S

Signature

type error = [
  1. | `Tls_alert of Tls.Packet.alert_type
  2. | `Tls_failure of Tls.Engine.failure
  3. | `Read of F.error
  4. | `Write of F.write_error
]

possible errors: incoming alert, processing failure, or a problem in the underlying flow.

type write_error = [
  1. | `Closed
  2. | error
]

The type for write errors.

we provide the FLOW interface

include Mirage_flow.S +Make (tls-mirage.Tls_mirage.Make)

Module Tls_mirage.Make

TLS module given a flow

Parameters

module F : Mirage_flow.S

Signature

type error = [
  1. | `Tls_alert of Tls.Packet.alert_type
  2. | `Tls_failure of Tls.Engine.failure
  3. | `Read of F.error
  4. | `Write of F.write_error
]

possible errors: incoming alert, processing failure, or a problem in the underlying flow.

type write_error = [
  1. | `Closed
  2. | error
]

The type for write errors.

we provide the FLOW interface

include Mirage_flow.S with type error := error - and type write_error := write_error
val pp_error : error Fmt.t
val pp_write_error : write_error Fmt.t
type flow
val read : flow -> (Cstruct.t Mirage_flow.or_eof, error) Stdlib.result Lwt.t
val write : flow -> Cstruct.t -> (unit, write_error) Stdlib.result Lwt.t
val writev : flow -> Cstruct.t list -> (unit, write_error) Stdlib.result Lwt.t
val close : flow -> unit Lwt.t
val underlying : flow -> F.flow

underlying t returns the underlying flow. This is useful to extract information such as src and dst of that flow.

val reneg : + and type write_error := write_error
val pp_error : error Fmt.t
val pp_write_error : write_error Fmt.t
type flow
val read : flow -> (Cstruct.t Mirage_flow.or_eof, error) Stdlib.result Lwt.t
val write : flow -> Cstruct.t -> (unit, write_error) Stdlib.result Lwt.t
val writev : flow -> Cstruct.t list -> (unit, write_error) Stdlib.result Lwt.t
val shutdown : flow -> [ `read | `read_write | `write ] -> unit Lwt.t
val close : flow -> unit Lwt.t
val underlying : flow -> F.flow

underlying t returns the underlying flow. This is useful to extract information such as src and dst of that flow.

val reneg : ?authenticator:X509.Authenticator.t -> ?acceptable_cas:X509.Distinguished_name.t list -> ?cert:Tls.Config.own_cert -> diff --git a/doc/tls-mirage/Tls_mirage/X509/index.html b/doc/tls-mirage/Tls_mirage/X509/index.html index af0b5228..a92b34c3 100644 --- a/doc/tls-mirage/Tls_mirage/X509/index.html +++ b/doc/tls-mirage/Tls_mirage/X509/index.html @@ -1,5 +1,5 @@ -X509 (tls-mirage.Tls_mirage.X509)

Module Tls_mirage.X509

X.509 handling given a key value store and a clock

Parameters

module KV : Mirage_kv.RO
module C : Mirage_clock.PCLOCK

Signature

val authenticator : +X509 (tls-mirage.Tls_mirage.X509)

Module Tls_mirage.X509

X.509 handling given a key value store and a clock

Parameters

module KV : Mirage_kv.RO
module C : Mirage_clock.PCLOCK

Signature

val authenticator : ?allowed_hashes:Mirage_crypto.Hash.hash list -> ?crl:string -> KV.t -> diff --git a/doc/tls-mirage/Tls_mirage/index.html b/doc/tls-mirage/Tls_mirage/index.html index 30e0e090..ae16221c 100644 --- a/doc/tls-mirage/Tls_mirage/index.html +++ b/doc/tls-mirage/Tls_mirage/index.html @@ -1,2 +1,2 @@ -Tls_mirage (tls-mirage.Tls_mirage)

Module Tls_mirage

Effectful operations using Mirage for pure TLS.

module Make (F : Mirage_flow.S) : sig ... end

TLS module given a flow

module X509 (KV : Mirage_kv.RO) (C : Mirage_clock.PCLOCK) : sig ... end

X.509 handling given a key value store and a clock

+Tls_mirage (tls-mirage.Tls_mirage)

Module Tls_mirage

Effectful operations using Mirage for pure TLS.

module Make (F : Mirage_flow.S) : sig ... end

TLS module given a flow

module X509 (KV : Mirage_kv.RO) (C : Mirage_clock.PCLOCK) : sig ... end

X.509 handling given a key value store and a clock

diff --git a/doc/tls-mirage/index.html b/doc/tls-mirage/index.html index 7b6f1042..e2548bbe 100644 --- a/doc/tls-mirage/index.html +++ b/doc/tls-mirage/index.html @@ -1,2 +1,2 @@ -index (tls-mirage.index)

tls-mirage index

Library tls-mirage

The entry point of this library is the module: Tls_mirage.

+index (tls-mirage.index)

tls-mirage index

Library tls-mirage

The entry point of this library is the module: Tls_mirage.

diff --git a/doc/tls/Tls/Ciphersuite/index.html b/doc/tls/Tls/Ciphersuite/index.html index 97805084..39207cea 100644 --- a/doc/tls/Tls/Ciphersuite/index.html +++ b/doc/tls/Tls/Ciphersuite/index.html @@ -1,5 +1,5 @@ -Ciphersuite (tls.Tls.Ciphersuite)

Module Tls.Ciphersuite

Ciphersuite definitions and some helper functions.

type key_exchange_algorithm_dhe = [
  1. | `FFDHE
  2. | `ECDHE
]

sum type of all possible key exchange methods

type key_exchange_algorithm = [
  1. | key_exchange_algorithm_dhe
  2. | `RSA
]
val pp_key_exchange_algorithm_dhe : +Ciphersuite (tls.Tls.Ciphersuite)

Module Tls.Ciphersuite

Ciphersuite definitions and some helper functions.

type key_exchange_algorithm_dhe = [
  1. | `FFDHE
  2. | `ECDHE
]

sum type of all possible key exchange methods

type key_exchange_algorithm = [
  1. | key_exchange_algorithm_dhe
  2. | `RSA
]
val pp_key_exchange_algorithm_dhe : Stdlib.Format.formatter -> [< `ECDHE | `FFDHE ] -> unit
val pp_key_exchange_algorithm : diff --git a/doc/tls/Tls/Config/Ciphers/index.html b/doc/tls/Tls/Config/Ciphers/index.html index f253fa8c..0804037e 100644 --- a/doc/tls/Tls/Config/Ciphers/index.html +++ b/doc/tls/Tls/Config/Ciphers/index.html @@ -1,2 +1,2 @@ -Ciphers (tls.Tls.Config.Ciphers)

Module Config.Ciphers

Cipher selection

Cipher selection related utilities.

Cipher selection

val default : Ciphersuite.ciphersuite list

default is a list of ciphersuites this library uses by default.

val supported : Ciphersuite.ciphersuite list

supported is a list of ciphersuites this library supports (larger than default).

fs is a list of ciphersuites which provide forward secrecy (sublist of default).

val http2 : Ciphersuite.ciphersuite list

http2 is a list of ciphersuites which are allowed to be used with HTTP2: not a member of bad cipher suites. These are only ephemeral key exchanges with AEAD ciphers.

fs_of ciphers selects all ciphersuites which provide forward secrecy from ciphers.

+Ciphers (tls.Tls.Config.Ciphers)

Module Config.Ciphers

Cipher selection

Cipher selection related utilities.

Cipher selection

val default : Ciphersuite.ciphersuite list

default is a list of ciphersuites this library uses by default.

val supported : Ciphersuite.ciphersuite list

supported is a list of ciphersuites this library supports (larger than default).

fs is a list of ciphersuites which provide forward secrecy (sublist of default).

val http2 : Ciphersuite.ciphersuite list

http2 is a list of ciphersuites which are allowed to be used with HTTP2: not a member of bad cipher suites. These are only ephemeral key exchanges with AEAD ciphers.

fs_of ciphers selects all ciphersuites which provide forward secrecy from ciphers.

diff --git a/doc/tls/Tls/Config/index.html b/doc/tls/Tls/Config/index.html index 669270b1..ca8d99b0 100644 --- a/doc/tls/Tls/Config/index.html +++ b/doc/tls/Tls/Config/index.html @@ -1,5 +1,5 @@ -Config (tls.Tls.Config)

Module Tls.Config

Configuration of the TLS stack

Config type

type certchain = X509.Certificate.t list * X509.Private_key.t

certificate chain and private key of the first certificate

type own_cert = [
  1. | `None
  2. | `Single of certchain
  3. | `Multiple of certchain list
  4. | `Multiple_default of certchain * certchain list
]

polymorphic variant of own certificates

type session_cache = Core.SessionID.t -> Core.epoch_data option
type ticket_cache = {
  1. lookup : Cstruct.t -> (Core.psk13 * Core.epoch_data) option;
  2. ticket_granted : Core.psk13 -> Core.epoch_data -> unit;
  3. lifetime : int32;
  4. timestamp : unit -> Ptime.t;
}
type config = private {
  1. ciphers : Ciphersuite.ciphersuite list;
    (*

    ordered list (regarding preference) of supported cipher suites

    *)
  2. protocol_versions : Core.tls_version * Core.tls_version;
    (*

    supported protocol versions (min, max)

    *)
  3. signature_algorithms : Core.signature_algorithm list;
    (*

    ordered list of supported signature algorithms (regarding preference)

    *)
  4. use_reneg : bool;
    (*

    endpoint should accept renegotiation requests

    *)
  5. authenticator : X509.Authenticator.t option;
    (*

    optional X509 authenticator

    *)
  6. peer_name : [ `host ] Domain_name.t option;
    (*

    optional name of other endpoint (used for SNI RFC4366)

    *)
  7. own_certificates : own_cert;
    (*

    optional default certificate chain and other certificate chains

    *)
  8. acceptable_cas : X509.Distinguished_name.t list;
    (*

    ordered list of acceptable certificate authorities

    *)
  9. session_cache : session_cache;
  10. ticket_cache : ticket_cache option;
  11. cached_session : Core.epoch_data option;
  12. cached_ticket : (Core.psk13 * Core.epoch_data) option;
  13. alpn_protocols : string list;
    (*

    optional ordered list of accepted alpn_protocols

    *)
  14. groups : Core.group list;
    (*

    the first FFDHE will be used for TLS 1.2 and below if a DHE ciphersuite is used

    *)
  15. zero_rtt : int32;
  16. ip : Ipaddr.t option;
}

configuration parameters

val ciphers13 : config -> Ciphersuite.ciphersuite13 list

ciphers13 config are the ciphersuites for TLS 1.3 in the configuration.

type client

opaque type of a client configuration

type server

opaque type of a server configuration

Constructors

val client : +Config (tls.Tls.Config)

Module Tls.Config

Configuration of the TLS stack

Config type

type certchain = X509.Certificate.t list * X509.Private_key.t

certificate chain and private key of the first certificate

type own_cert = [
  1. | `None
  2. | `Single of certchain
  3. | `Multiple of certchain list
  4. | `Multiple_default of certchain * certchain list
]

polymorphic variant of own certificates

type session_cache = Core.SessionID.t -> Core.epoch_data option
type ticket_cache = {
  1. lookup : Cstruct.t -> (Core.psk13 * Core.epoch_data) option;
  2. ticket_granted : Core.psk13 -> Core.epoch_data -> unit;
  3. lifetime : int32;
  4. timestamp : unit -> Ptime.t;
}
type config = private {
  1. ciphers : Ciphersuite.ciphersuite list;
    (*

    ordered list (regarding preference) of supported cipher suites

    *)
  2. protocol_versions : Core.tls_version * Core.tls_version;
    (*

    supported protocol versions (min, max)

    *)
  3. signature_algorithms : Core.signature_algorithm list;
    (*

    ordered list of supported signature algorithms (regarding preference)

    *)
  4. use_reneg : bool;
    (*

    endpoint should accept renegotiation requests

    *)
  5. authenticator : X509.Authenticator.t option;
    (*

    optional X509 authenticator

    *)
  6. peer_name : [ `host ] Domain_name.t option;
    (*

    optional name of other endpoint (used for SNI RFC4366)

    *)
  7. own_certificates : own_cert;
    (*

    optional default certificate chain and other certificate chains

    *)
  8. acceptable_cas : X509.Distinguished_name.t list;
    (*

    ordered list of acceptable certificate authorities

    *)
  9. session_cache : session_cache;
  10. ticket_cache : ticket_cache option;
  11. cached_session : Core.epoch_data option;
  12. cached_ticket : (Core.psk13 * Core.epoch_data) option;
  13. alpn_protocols : string list;
    (*

    optional ordered list of accepted alpn_protocols

    *)
  14. groups : Core.group list;
    (*

    the first FFDHE will be used for TLS 1.2 and below if a DHE ciphersuite is used

    *)
  15. zero_rtt : int32;
  16. ip : Ipaddr.t option;
}

configuration parameters

val ciphers13 : config -> Ciphersuite.ciphersuite13 list

ciphers13 config are the ciphersuites for TLS 1.3 in the configuration.

type client

opaque type of a client configuration

type server

opaque type of a server configuration

Constructors

val client : authenticator:X509.Authenticator.t -> ?peer_name:[ `host ] Domain_name.t -> ?ciphers:Ciphersuite.ciphersuite list -> diff --git a/doc/tls/Tls/Core/PreSharedKeyID/index.html b/doc/tls/Tls/Core/PreSharedKeyID/index.html index 306f43d2..b3fe2f02 100644 --- a/doc/tls/Tls/Core/PreSharedKeyID/index.html +++ b/doc/tls/Tls/Core/PreSharedKeyID/index.html @@ -1,2 +1,2 @@ -PreSharedKeyID (tls.Tls.Core.PreSharedKeyID)

Module Core.PreSharedKeyID

type t = Cstruct.t
val compare : Cstruct.t -> Cstruct.t -> int
val hash : Cstruct.t -> int
val equal : Cstruct.t -> Cstruct.t -> bool
+PreSharedKeyID (tls.Tls.Core.PreSharedKeyID)

Module Core.PreSharedKeyID

type t = Cstruct.t
val compare : Cstruct.t -> Cstruct.t -> int
val hash : Cstruct.t -> int
val equal : Cstruct.t -> Cstruct.t -> bool
diff --git a/doc/tls/Tls/Core/SessionID/index.html b/doc/tls/Tls/Core/SessionID/index.html index 4725dd2b..52291039 100644 --- a/doc/tls/Tls/Core/SessionID/index.html +++ b/doc/tls/Tls/Core/SessionID/index.html @@ -1,2 +1,2 @@ -SessionID (tls.Tls.Core.SessionID)

Module Core.SessionID

type t = Cstruct.t
val compare : Cstruct.t -> Cstruct.t -> int
val hash : Cstruct.t -> int
val equal : Cstruct.t -> Cstruct.t -> bool
+SessionID (tls.Tls.Core.SessionID)

Module Core.SessionID

type t = Cstruct.t
val compare : Cstruct.t -> Cstruct.t -> int
val hash : Cstruct.t -> int
val equal : Cstruct.t -> Cstruct.t -> bool
diff --git a/doc/tls/Tls/Core/Tracing/index.html b/doc/tls/Tls/Core/Tracing/index.html index a1ae02f5..1190a26b 100644 --- a/doc/tls/Tls/Core/Tracing/index.html +++ b/doc/tls/Tls/Core/Tracing/index.html @@ -1,5 +1,5 @@ -Tracing (tls.Tls.Core.Tracing)

Module Core.Tracing

include Logs.LOG
val msg : Logs.level -> 'a Logs.log
val app : 'a Logs.log
val err : 'a Logs.log
val warn : 'a Logs.log
val info : 'a Logs.log
val debug : 'a Logs.log
val kmsg : (unit -> 'b) -> Logs.level -> ('a, 'b) Logs.msgf -> 'b
val on_error : +Tracing (tls.Tls.Core.Tracing)

Module Core.Tracing

include Logs.LOG
val msg : Logs.level -> 'a Logs.log
val app : 'a Logs.log
val err : 'a Logs.log
val warn : 'a Logs.log
val info : 'a Logs.log
val debug : 'a Logs.log
val kmsg : (unit -> 'b) -> Logs.level -> ('a, 'b) Logs.msgf -> 'b
val on_error : ?level:Logs.level -> ?header:string -> ?tags:Logs.Tag.set -> diff --git a/doc/tls/Tls/Core/index.html b/doc/tls/Tls/Core/index.html index 658cdcea..bc4d96fe 100644 --- a/doc/tls/Tls/Core/index.html +++ b/doc/tls/Tls/Core/index.html @@ -1,5 +1,5 @@ -Core (tls.Tls.Core)

Module Tls.Core

Core type definitions

val (<+>) : Cstruct.t -> Cstruct.t -> Cstruct.t
val let* : +Core (tls.Tls.Core)

Module Tls.Core

Core type definitions

val (<+>) : Cstruct.t -> Cstruct.t -> Cstruct.t
val let* : ('a, 'b) Stdlib.result -> ('a -> ('c, 'b) Stdlib.result) -> ('c, 'b) Stdlib.result
val guard : bool -> 'a -> (unit, 'b) Stdlib.result
val map_reader_error : @@ -176,7 +176,7 @@ | `RSA_PSS_RSAENC_SHA256 | `RSA_PSS_RSAENC_SHA384 | `RSA_PSS_RSAENC_SHA512 ECDSA_SECP256R1_SHA1 ECDSA_SECP256R1_SHA256 ECDSA_SECP384R1_SHA384 ECDSA_SECP521R1_SHA512 ED25519 ] -> - bool
type client_extension = [
  1. | `Hostname of [ `host ] Domain_name.t
  2. | `MaxFragmentLength of Packet.max_fragment_length
  3. | `SupportedGroups of Packet.named_group list
  4. | `SecureRenegotiation of Cstruct.t
  5. | `Padding of int
  6. | `SignatureAlgorithms of signature_algorithm list
  7. | `ExtendedMasterSecret
  8. | `ALPN of string list
  9. | `KeyShare of (Packet.named_group * Cstruct.t) list
  10. | `EarlyDataIndication
  11. | `PreSharedKeys of psk_identity list
  12. | `SupportedVersions of tls_any_version list
  13. | `PostHandshakeAuthentication
  14. | `Cookie of Cstruct.t
  15. | `PskKeyExchangeModes of Packet.psk_key_exchange_mode list
  16. | `ECPointFormats
  17. | `UnknownExtension of int * Cstruct.t
]
type server13_extension = [
  1. | `KeyShare of group * Cstruct.t
  2. | `PreSharedKey of int
  3. | `SelectedVersion of tls_version
]
type server_extension = [
  1. | server13_extension
  2. | `Hostname
  3. | `MaxFragmentLength of Packet.max_fragment_length
  4. | `SecureRenegotiation of Cstruct.t
  5. | `ExtendedMasterSecret
  6. | `ALPN of string
  7. | `ECPointFormats
  8. | `UnknownExtension of int * Cstruct.t
]
type encrypted_extension = [
  1. | `Hostname
  2. | `MaxFragmentLength of Packet.max_fragment_length
  3. | `SupportedGroups of group list
  4. | `ALPN of string
  5. | `EarlyDataIndication
  6. | `UnknownExtension of int * Cstruct.t
]
type hello_retry_extension = [
  1. | `SelectedGroup of group
  2. | `Cookie of Cstruct.t
  3. | `SelectedVersion of tls_version
  4. | `UnknownExtension of int * Cstruct.t
]
type client_hello = {
  1. client_version : tls_any_version;
  2. client_random : Cstruct.t;
  3. sessionid : SessionID.t option;
  4. ciphersuites : Packet.any_ciphersuite list;
  5. extensions : client_extension list;
}
type server_hello = {
  1. server_version : tls_version;
  2. server_random : Cstruct.t;
  3. sessionid : SessionID.t option;
  4. ciphersuite : Ciphersuite.ciphersuite;
  5. extensions : server_extension list;
}
type dh_parameters = {
  1. dh_p : Cstruct.t;
  2. dh_g : Cstruct.t;
  3. dh_Ys : Cstruct.t;
}
type hello_retry = {
  1. retry_version : tls_version;
  2. ciphersuite : Ciphersuite.ciphersuite13;
  3. sessionid : SessionID.t option;
  4. selected_group : group;
  5. extensions : hello_retry_extension list;
}
type session_ticket_extension = [
  1. | `EarlyDataIndication of int32
  2. | `UnknownExtension of int * Cstruct.t
]
type session_ticket = {
  1. lifetime : int32;
  2. age_add : int32;
  3. nonce : Cstruct.t;
  4. ticket : Cstruct.t;
  5. extensions : session_ticket_extension list;
}
type certificate_request_extension = [
  1. | `SignatureAlgorithms of signature_algorithm list
  2. | `CertificateAuthorities of X509.Distinguished_name.t list
  3. | `UnknownExtension of int * Cstruct.t
]
type tls_handshake =
  1. | HelloRequest
  2. | HelloRetryRequest of hello_retry
  3. | EncryptedExtensions of encrypted_extension list
  4. | ServerHelloDone
  5. | ClientHello of client_hello
  6. | ServerHello of server_hello
  7. | Certificate of Cstruct.t
  8. | ServerKeyExchange of Cstruct.t
  9. | CertificateRequest of Cstruct.t
  10. | ClientKeyExchange of Cstruct.t
  11. | CertificateVerify of Cstruct.t
  12. | Finished of Cstruct.t
  13. | SessionTicket of session_ticket
  14. | KeyUpdate of Packet.key_update_request_type
  15. | EndOfEarlyData
val pp_handshake : Stdlib.Format.formatter -> tls_handshake -> unit
val src : Logs.src
module Tracing : sig ... end
type master_secret = Cstruct.t

the master secret of a TLS connection

type psk13 = {
  1. identifier : Cstruct.t;
  2. obfuscation : int32;
  3. secret : Cstruct.t;
  4. lifetime : int32;
  5. early_data : int32;
  6. issued_at : Ptime.t;
}
type epoch_state = [
  1. | `ZeroRTT
  2. | `Established
]
type epoch_data = {
  1. side : [ `Client | `Server ];
  2. state : epoch_state;
  3. protocol_version : tls_version;
  4. ciphersuite : Ciphersuite.ciphersuite;
  5. peer_random : Cstruct.t;
  6. peer_certificate_chain : X509.Certificate.t list;
  7. peer_certificate : X509.Certificate.t option;
  8. peer_name : [ `host ] Domain_name.t option;
  9. trust_anchor : X509.Certificate.t option;
  10. received_certificates : X509.Certificate.t list;
  11. own_random : Cstruct.t;
  12. own_certificate : X509.Certificate.t list;
  13. own_private_key : X509.Private_key.t option;
  14. own_name : [ `host ] Domain_name.t option;
  15. master_secret : master_secret;
  16. exporter_master_secret : master_secret;
  17. session_id : SessionID.t;
  18. extended_ms : bool;
  19. alpn_protocol : string option;
}

information about an open session

val supports_key_usage : + bool
type client_extension = [
  1. | `Hostname of [ `host ] Domain_name.t
  2. | `MaxFragmentLength of Packet.max_fragment_length
  3. | `SupportedGroups of Packet.named_group list
  4. | `SecureRenegotiation of Cstruct.t
  5. | `Padding of int
  6. | `SignatureAlgorithms of signature_algorithm list
  7. | `ExtendedMasterSecret
  8. | `ALPN of string list
  9. | `KeyShare of (Packet.named_group * Cstruct.t) list
  10. | `EarlyDataIndication
  11. | `PreSharedKeys of psk_identity list
  12. | `SupportedVersions of tls_any_version list
  13. | `PostHandshakeAuthentication
  14. | `Cookie of Cstruct.t
  15. | `PskKeyExchangeModes of Packet.psk_key_exchange_mode list
  16. | `ECPointFormats
  17. | `UnknownExtension of int * Cstruct.t
]
type server13_extension = [
  1. | `KeyShare of group * Cstruct.t
  2. | `PreSharedKey of int
  3. | `SelectedVersion of tls_version
]
type server_extension = [
  1. | server13_extension
  2. | `Hostname
  3. | `MaxFragmentLength of Packet.max_fragment_length
  4. | `SecureRenegotiation of Cstruct.t
  5. | `ExtendedMasterSecret
  6. | `ALPN of string
  7. | `ECPointFormats
  8. | `UnknownExtension of int * Cstruct.t
]
type encrypted_extension = [
  1. | `Hostname
  2. | `MaxFragmentLength of Packet.max_fragment_length
  3. | `SupportedGroups of group list
  4. | `ALPN of string
  5. | `EarlyDataIndication
  6. | `UnknownExtension of int * Cstruct.t
]
type hello_retry_extension = [
  1. | `SelectedGroup of group
  2. | `Cookie of Cstruct.t
  3. | `SelectedVersion of tls_version
  4. | `UnknownExtension of int * Cstruct.t
]
type client_hello = {
  1. client_version : tls_any_version;
  2. client_random : Cstruct.t;
  3. sessionid : SessionID.t option;
  4. ciphersuites : Packet.any_ciphersuite list;
  5. extensions : client_extension list;
}
type server_hello = {
  1. server_version : tls_version;
  2. server_random : Cstruct.t;
  3. sessionid : SessionID.t option;
  4. ciphersuite : Ciphersuite.ciphersuite;
  5. extensions : server_extension list;
}
type dh_parameters = {
  1. dh_p : Cstruct.t;
  2. dh_g : Cstruct.t;
  3. dh_Ys : Cstruct.t;
}
type hello_retry = {
  1. retry_version : tls_version;
  2. ciphersuite : Ciphersuite.ciphersuite13;
  3. sessionid : SessionID.t option;
  4. selected_group : group;
  5. extensions : hello_retry_extension list;
}
type session_ticket_extension = [
  1. | `EarlyDataIndication of int32
  2. | `UnknownExtension of int * Cstruct.t
]
type session_ticket = {
  1. lifetime : int32;
  2. age_add : int32;
  3. nonce : Cstruct.t;
  4. ticket : Cstruct.t;
  5. extensions : session_ticket_extension list;
}
type certificate_request_extension = [
  1. | `SignatureAlgorithms of signature_algorithm list
  2. | `CertificateAuthorities of X509.Distinguished_name.t list
  3. | `UnknownExtension of int * Cstruct.t
]
type tls_handshake =
  1. | HelloRequest
  2. | HelloRetryRequest of hello_retry
  3. | EncryptedExtensions of encrypted_extension list
  4. | ServerHelloDone
  5. | ClientHello of client_hello
  6. | ServerHello of server_hello
  7. | Certificate of Cstruct.t
  8. | ServerKeyExchange of Cstruct.t
  9. | CertificateRequest of Cstruct.t
  10. | ClientKeyExchange of Cstruct.t
  11. | CertificateVerify of Cstruct.t
  12. | Finished of Cstruct.t
  13. | SessionTicket of session_ticket
  14. | KeyUpdate of Packet.key_update_request_type
  15. | EndOfEarlyData
val pp_handshake : Stdlib.Format.formatter -> tls_handshake -> unit
val src : Logs.src
module Tracing : sig ... end
type master_secret = Cstruct.t

the master secret of a TLS connection

type psk13 = {
  1. identifier : Cstruct.t;
  2. obfuscation : int32;
  3. secret : Cstruct.t;
  4. lifetime : int32;
  5. early_data : int32;
  6. issued_at : Ptime.t;
}
type epoch_state = [
  1. | `ZeroRTT
  2. | `Established
]
type epoch_data = {
  1. side : [ `Client | `Server ];
  2. state : epoch_state;
  3. protocol_version : tls_version;
  4. ciphersuite : Ciphersuite.ciphersuite;
  5. peer_random : Cstruct.t;
  6. peer_certificate_chain : X509.Certificate.t list;
  7. peer_certificate : X509.Certificate.t option;
  8. peer_name : [ `host ] Domain_name.t option;
  9. trust_anchor : X509.Certificate.t option;
  10. received_certificates : X509.Certificate.t list;
  11. own_random : Cstruct.t;
  12. own_certificate : X509.Certificate.t list;
  13. own_private_key : X509.Private_key.t option;
  14. own_name : [ `host ] Domain_name.t option;
  15. master_secret : master_secret;
  16. exporter_master_secret : master_secret;
  17. session_id : SessionID.t;
  18. extended_ms : bool;
  19. alpn_protocol : string option;
  20. tls_unique : Cstruct.t option;
}

information about an open session

val supports_key_usage : ?not_present:bool -> X509.Extension.key_usage -> X509.Certificate.t -> diff --git a/doc/tls/Tls/Crypto/Ciphers/index.html b/doc/tls/Tls/Crypto/Ciphers/index.html index 11e95863..fc7bd6af 100644 --- a/doc/tls/Tls/Crypto/Ciphers/index.html +++ b/doc/tls/Tls/Crypto/Ciphers/index.html @@ -1,5 +1,5 @@ -Ciphers (tls.Tls.Crypto.Ciphers)

Module Crypto.Ciphers

type keyed =
  1. | K_CBC : 'k State.cbc_cipher * (Cstruct.t -> 'k) -> keyed
val get_block : Ciphersuite.block_cipher -> keyed
type aead_keyed =
  1. | K_AEAD : 'k State.aead_cipher * (Cstruct.t -> 'k) * bool -> aead_keyed
val get_aead_cipher : +Ciphers (tls.Tls.Crypto.Ciphers)

Module Crypto.Ciphers

type keyed =
  1. | K_CBC : 'k State.cbc_cipher * (Cstruct.t -> 'k) -> keyed
val get_block : Ciphersuite.block_cipher -> keyed
type aead_keyed =
  1. | K_AEAD : 'k State.aead_cipher * (Cstruct.t -> 'k) * bool -> aead_keyed
val get_aead_cipher : secret:Cstruct.t -> nonce:State.nonce -> Ciphersuite.aead_cipher -> diff --git a/doc/tls/Tls/Crypto/index.html b/doc/tls/Tls/Crypto/index.html index e3b63b65..5aeb0af7 100644 --- a/doc/tls/Tls/Crypto/index.html +++ b/doc/tls/Tls/Crypto/index.html @@ -1,5 +1,5 @@ -Crypto (tls.Tls.Crypto)

Module Tls.Crypto

val (<+>) : Cstruct.t -> Cstruct.t -> Cstruct.t
val dh_params_pack : +Crypto (tls.Tls.Crypto)

Module Tls.Crypto

val (<+>) : Cstruct.t -> Cstruct.t -> Cstruct.t
val dh_params_pack : Mirage_crypto_pk.Dh.group -> Cstruct.t -> Core.dh_parameters
val dh_params_unpack : diff --git a/doc/tls/Tls/Engine/index.html b/doc/tls/Tls/Engine/index.html index 15554e5b..8d83199e 100644 --- a/doc/tls/Tls/Engine/index.html +++ b/doc/tls/Tls/Engine/index.html @@ -1,5 +1,5 @@ -Engine (tls.Tls.Engine)

Module Tls.Engine

Transport layer security

TLS is an implementation of transport layer security in OCaml. TLS is a widely used security protocol which establishes an end-to-end secure channel (with optional (mutual) authentication) between two endpoints. It uses TCP/IP as transport. This library supports all four versions of TLS: 1.3, RFC8446, 1.2, RFC5246, 1.1, RFC4346, and 1.0, RFC2246. SSL, the previous protocol definition, is not supported.

TLS is algorithmically agile: protocol version, key exchange algorithm, symmetric cipher, and message authentication code are negotiated upon connection.

This library implements several extensions of TLS, AES ciphers, TLS extensions (such as server name indication, SNI), Renegotiation extension, Session Hash and Extended Master Secret Extension.

This library does not contain insecure cipher suites (such as single DES, export ciphers, ...). It does not expose the server time in the server random, requires secure renegotiation.

This library consists of a core, implemented in a purely functional matter (Engine, this module), and effectful parts: Tls_lwt and Tls_mirage.

v0.17.4

Abstract state type

type state

The abstract type of a TLS state.

Constructors

val client : Config.client -> state * Cstruct.t

client client is tls * out where tls is the initial state, and out the initial client hello

val server : Config.server -> state

server server is tls where tls is the initial server state

Protocol failures

type error = [
  1. | `AuthenticationFailure of X509.Validation.validation_error
  2. | `NoConfiguredCiphersuite of Ciphersuite.ciphersuite list
  3. | `NoConfiguredVersions of Core.tls_version list
  4. | `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list
  5. | `NoMatchingCertificateFound of string
  6. | `NoCertificateConfigured
  7. | `CouldntSelectCertificate
]

failures which can be mitigated by reconfiguration

type client_hello_errors = [
  1. | `EmptyCiphersuites
  2. | `NotSetCiphersuites of Packet.any_ciphersuite list
  3. | `NoSupportedCiphersuite of Packet.any_ciphersuite list
  4. | `NotSetExtension of Core.client_extension list
  5. | `NoSignatureAlgorithmsExtension
  6. | `NoGoodSignatureAlgorithms of Core.signature_algorithm list
  7. | `NoKeyShareExtension
  8. | `NoSupportedGroupExtension
  9. | `NotSetSupportedGroup of Packet.named_group list
  10. | `NotSetKeyShare of (Packet.named_group * Cstruct.t) list
  11. | `NotSubsetKeyShareSupportedGroup of +Engine (tls.Tls.Engine)

    Module Tls.Engine

    Transport layer security

    TLS is an implementation of transport layer security in OCaml. TLS is a widely used security protocol which establishes an end-to-end secure channel (with optional (mutual) authentication) between two endpoints. It uses TCP/IP as transport. This library supports all four versions of TLS: 1.3, RFC8446, 1.2, RFC5246, 1.1, RFC4346, and 1.0, RFC2246. SSL, the previous protocol definition, is not supported.

    TLS is algorithmically agile: protocol version, key exchange algorithm, symmetric cipher, and message authentication code are negotiated upon connection.

    This library implements several extensions of TLS, AES ciphers, TLS extensions (such as server name indication, SNI), Renegotiation extension, Session Hash and Extended Master Secret Extension.

    This library does not contain insecure cipher suites (such as single DES, export ciphers, ...). It does not expose the server time in the server random, requires secure renegotiation.

    This library consists of a core, implemented in a purely functional matter (Engine, this module), and effectful parts: Tls_lwt and Tls_mirage.

    v0.17.5

    Abstract state type

    type state

    The abstract type of a TLS state.

    Constructors

    val client : Config.client -> state * Cstruct.t

    client client is tls * out where tls is the initial state, and out the initial client hello

    val server : Config.server -> state

    server server is tls where tls is the initial server state

    Protocol failures

    type error = [
    1. | `AuthenticationFailure of X509.Validation.validation_error
    2. | `NoConfiguredCiphersuite of Ciphersuite.ciphersuite list
    3. | `NoConfiguredVersions of Core.tls_version list
    4. | `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list
    5. | `NoMatchingCertificateFound of string
    6. | `NoCertificateConfigured
    7. | `CouldntSelectCertificate
    ]

    failures which can be mitigated by reconfiguration

    type client_hello_errors = [
    1. | `EmptyCiphersuites
    2. | `NotSetCiphersuites of Packet.any_ciphersuite list
    3. | `NoSupportedCiphersuite of Packet.any_ciphersuite list
    4. | `NotSetExtension of Core.client_extension list
    5. | `NoSignatureAlgorithmsExtension
    6. | `NoGoodSignatureAlgorithms of Core.signature_algorithm list
    7. | `NoKeyShareExtension
    8. | `NoSupportedGroupExtension
    9. | `NotSetSupportedGroup of Packet.named_group list
    10. | `NotSetKeyShare of (Packet.named_group * Cstruct.t) list
    11. | `NotSubsetKeyShareSupportedGroup of Packet.named_group list * (Packet.named_group * Cstruct.t) list
    12. | `Has0rttAfterHRR
    13. | `NoCookie
    ]
    type fatal = [
    1. | `NoSecureRenegotiation
    2. | `NoSupportedGroup
    3. | `NoVersions of Core.tls_any_version list
    4. | `ReaderError of Reader.error
    5. | `NoCertificateReceived
    6. | `NoCertificateVerifyReceived
    7. | `NotRSACertificate
    8. | `KeyTooSmall
    9. | `SignatureVerificationFailed of string
    10. | `SigningFailed of string
    11. | `BadCertificateChain
    12. | `MACMismatch
    13. | `MACUnderflow
    14. | `RecordOverflow of int
    15. | `UnknownRecordVersion of int * int
    16. | `UnknownContentType of int
    17. | `CannotHandleApplicationDataYet
    18. | `NoHeartbeat
    19. | `BadRecordVersion of Core.tls_any_version
    20. | `BadFinished
    21. | `HandshakeFragmentsNotEmpty
    22. | `InsufficientDH
    23. | `InvalidDH
    24. | `BadECDH of Mirage_crypto_ec.error
    25. | `InvalidRenegotiation
    26. | `InvalidClientHello of client_hello_errors
    27. | `InvalidServerHello
    28. | `InvalidRenegotiationVersion of Core.tls_version
    29. | `InappropriateFallback
    30. | `UnexpectedCCS
    31. | `UnexpectedHandshake of Core.tls_handshake
    32. | `InvalidCertificateUsage
    33. | `InvalidCertificateExtendedUsage
    34. | `InvalidSession
    35. | `NoApplicationProtocol
    36. | `HelloRetryRequest
    37. | `InvalidMessage
    38. | `Toomany0rttbytes
    39. | `MissingContentType
    40. | `Downgrade12
    41. | `Downgrade11
    42. | `WriteHalfClosed
    ]

    failures from received garbage or lack of features

    type failure = [
    1. | `Error of error
    2. | `Fatal of fatal
    3. | `Alert of Packet.alert_type
    ]

    type of failures

    val alert_of_failure : failure -> Packet.alert_level * Packet.alert_type

    alert_of_failure failure is alert, the TLS alert type for this failure.

    val string_of_failure : failure -> string

    string_of_failure failure is string, the string representation of the failure.

    val pp_failure : failure Fmt.t

    pp_failure failure pretty-prints failure.

    Protocol handling

    type ret = (state * [ `Eof ] option @@ -9,7 +9,7 @@ Stdlib.result

    result type of handle_tls: either failed to handle the incoming buffer (`Fail) with failure and potentially a message to send to the other endpoint, or sucessful operation (`Ok) with a new state, an end of file (`Eof), or an incoming (`Alert). Possibly some `Response to the other endpoint is needed, and potentially some `Data for the application was received.

    val handle_tls : state -> Cstruct.t -> ret

    handle_tls state buffer is ret, depending on incoming state and buffer, the result is the appropriate ret

    val handshake_in_progress : state -> bool

    handshake_in_progrss state is a predicate which indicates whether there is a handshake in progress or scheduled.

    val send_application_data : state -> Cstruct.t list -> - (state * Cstruct.t) option

    send_application_data tls outs is (tls' * out) option where tls' is the new tls state, and out the cstruct to send over the wire (encrypted outs).

    val send_close_notify : state -> state * Cstruct.t

    send_close_notify tls is tls' * out where tls' is the new tls state, and out the (possible encrypted) close notify alert.

    val reneg : + (state * Cstruct.t) option

    send_application_data tls outs is Some (tls', out) where tls' is the new tls state, and out the cstruct to send over the wire (encrypted outs) when the TLS session is ready. When the TLS session is not ready it is None.

    val send_close_notify : state -> state * Cstruct.t

    send_close_notify tls is tls' * out where tls' is the new tls state, and out the (possible encrypted) close notify alert.

    val reneg : ?authenticator:X509.Authenticator.t -> ?acceptable_cas:X509.Distinguished_name.t list -> ?cert:Config.own_cert -> @@ -22,4 +22,7 @@ ?context:string -> string -> int -> - Cstruct.t

    export_key_material epoch_data ?context label length is the RFC 5705 exported key material of length bytes using label and, if provided, context.

    + Cstruct.t

export_key_material epoch_data ?context label length is the RFC 5705 exported key material of length bytes using label and, if provided, context.

val channel_binding : + Core.epoch_data -> + [ `Tls_exporter | `Tls_unique | `Tls_server_endpoint ] -> + (Cstruct.t, [ `Msg of string ]) Stdlib.result

channel_binding epoch_data mode is the RFC 5929 and RFC 9266 specified channel binding. Please note that `Tls_unique will error for TLS 1.3 sessions, and `Tls_exporter is not recommended for TLS < 1.3 sessions (unless the uniqueness is ensured via another path).

diff --git a/doc/tls/Tls/Explorator/index.html b/doc/tls/Tls/Explorator/index.html index 82da47e5..15bab10b 100644 --- a/doc/tls/Tls/Explorator/index.html +++ b/doc/tls/Tls/Explorator/index.html @@ -1,2 +1,2 @@ -Explorator (tls.Tls.Explorator)

Module Tls.Explorator

+Explorator (tls.Tls.Explorator)

Module Tls.Explorator

diff --git a/doc/tls/Tls/Handshake_client/index.html b/doc/tls/Tls/Handshake_client/index.html index faf988e5..35134968 100644 --- a/doc/tls/Tls/Handshake_client/index.html +++ b/doc/tls/Tls/Handshake_client/index.html @@ -1,5 +1,5 @@ -Handshake_client (tls.Tls.Handshake_client)

Module Tls.Handshake_client

val default_client_hello : +Handshake_client (tls.Tls.Handshake_client)

Module Tls.Handshake_client

val handle_change_cipher_spec : State.client_handshake_state -> diff --git a/doc/tls/Tls/Handshake_client13/index.html b/doc/tls/Tls/Handshake_client13/index.html index 98360ea4..7a15810b 100644 --- a/doc/tls/Tls/Handshake_client13/index.html +++ b/doc/tls/Tls/Handshake_client13/index.html @@ -1,5 +1,5 @@ -Handshake_client13 (tls.Tls.Handshake_client13)

Module Tls.Handshake_client13

val answer_server_hello : +Handshake_client13 (tls.Tls.Handshake_client13)

Module Tls.Handshake_client13

val answer_server_hello : State.handshake_state -> Core.client_hello -> Core.server_hello -> diff --git a/doc/tls/Tls/Handshake_common/Group/index.html b/doc/tls/Tls/Handshake_common/Group/index.html index e973b447..08f837b0 100644 --- a/doc/tls/Tls/Handshake_common/Group/index.html +++ b/doc/tls/Tls/Handshake_common/Group/index.html @@ -1,2 +1,2 @@ -Group (tls.Tls.Handshake_common.Group)

Module Handshake_common.Group

val compare : 'a -> 'a -> int
+Group (tls.Tls.Handshake_common.Group)

Module Handshake_common.Group

val compare : 'a -> 'a -> int
diff --git a/doc/tls/Tls/Handshake_common/GroupSet/index.html b/doc/tls/Tls/Handshake_common/GroupSet/index.html index 376b0fac..22212bae 100644 --- a/doc/tls/Tls/Handshake_common/GroupSet/index.html +++ b/doc/tls/Tls/Handshake_common/GroupSet/index.html @@ -1,2 +1,2 @@ -GroupSet (tls.Tls.Handshake_common.GroupSet)

Module Handshake_common.GroupSet

type elt = Group.t
type t = Stdlib__Set.Make(Group).t
val empty : t
val is_empty : t -> bool
val mem : elt -> t -> bool
val add : elt -> t -> t
val singleton : elt -> t
val remove : elt -> t -> t
val union : t -> t -> t
val inter : t -> t -> t
val disjoint : t -> t -> bool
val diff : t -> t -> t
val compare : t -> t -> int
val equal : t -> t -> bool
val subset : t -> t -> bool
val iter : (elt -> unit) -> t -> unit
val map : (elt -> elt) -> t -> t
val fold : (elt -> 'a -> 'a) -> t -> 'a -> 'a
val for_all : (elt -> bool) -> t -> bool
val exists : (elt -> bool) -> t -> bool
val filter : (elt -> bool) -> t -> t
val filter_map : (elt -> elt option) -> t -> t
val partition : (elt -> bool) -> t -> t * t
val cardinal : t -> int
val elements : t -> elt list
val min_elt : t -> elt
val min_elt_opt : t -> elt option
val max_elt : t -> elt
val max_elt_opt : t -> elt option
val choose : t -> elt
val choose_opt : t -> elt option
val split : elt -> t -> t * bool * t
val find : elt -> t -> elt
val find_opt : elt -> t -> elt option
val find_first : (elt -> bool) -> t -> elt
val find_first_opt : (elt -> bool) -> t -> elt option
val find_last : (elt -> bool) -> t -> elt
val find_last_opt : (elt -> bool) -> t -> elt option
val of_list : elt list -> t
val to_seq_from : elt -> t -> elt Stdlib.Seq.t
val to_seq : t -> elt Stdlib.Seq.t
val to_rev_seq : t -> elt Stdlib.Seq.t
val add_seq : elt Stdlib.Seq.t -> t -> t
val of_seq : elt Stdlib.Seq.t -> t
+GroupSet (tls.Tls.Handshake_common.GroupSet)

Module Handshake_common.GroupSet

type elt = Group.t
type t = Stdlib__Set.Make(Group).t
val empty : t
val is_empty : t -> bool
val mem : elt -> t -> bool
val add : elt -> t -> t
val singleton : elt -> t
val remove : elt -> t -> t
val union : t -> t -> t
val inter : t -> t -> t
val disjoint : t -> t -> bool
val diff : t -> t -> t
val compare : t -> t -> int
val equal : t -> t -> bool
val subset : t -> t -> bool
val iter : (elt -> unit) -> t -> unit
val map : (elt -> elt) -> t -> t
val fold : (elt -> 'a -> 'a) -> t -> 'a -> 'a
val for_all : (elt -> bool) -> t -> bool
val exists : (elt -> bool) -> t -> bool
val filter : (elt -> bool) -> t -> t
val filter_map : (elt -> elt option) -> t -> t
val partition : (elt -> bool) -> t -> t * t
val cardinal : t -> int
val elements : t -> elt list
val min_elt : t -> elt
val min_elt_opt : t -> elt option
val max_elt : t -> elt
val max_elt_opt : t -> elt option
val choose : t -> elt
val choose_opt : t -> elt option
val split : elt -> t -> t * bool * t
val find : elt -> t -> elt
val find_opt : elt -> t -> elt option
val find_first : (elt -> bool) -> t -> elt
val find_first_opt : (elt -> bool) -> t -> elt option
val find_last : (elt -> bool) -> t -> elt
val find_last_opt : (elt -> bool) -> t -> elt option
val of_list : elt list -> t
val to_seq_from : elt -> t -> elt Stdlib.Seq.t
val to_seq : t -> elt Stdlib.Seq.t
val to_rev_seq : t -> elt Stdlib.Seq.t
val add_seq : elt Stdlib.Seq.t -> t -> t
val of_seq : elt Stdlib.Seq.t -> t
diff --git a/doc/tls/Tls/Handshake_common/index.html b/doc/tls/Tls/Handshake_common/index.html index 4b6d3270..318f83b8 100644 --- a/doc/tls/Tls/Handshake_common/index.html +++ b/doc/tls/Tls/Handshake_common/index.html @@ -1,5 +1,5 @@ -Handshake_common (tls.Tls.Handshake_common)

Module Tls.Handshake_common

val src : Logs.src
module Log : Logs.LOG
val trace_cipher : +Handshake_common (tls.Tls.Handshake_common)

Module Tls.Handshake_common

val src : Logs.src
module Log : Logs.LOG
val trace_cipher : [< `AES_128_CCM_SHA256 | `AES_128_GCM_SHA256 | `AES_256_GCM_SHA384 diff --git a/doc/tls/Tls/Handshake_crypto/index.html b/doc/tls/Tls/Handshake_crypto/index.html index 07fd00c8..264d8504 100644 --- a/doc/tls/Tls/Handshake_crypto/index.html +++ b/doc/tls/Tls/Handshake_crypto/index.html @@ -1,5 +1,5 @@ -Handshake_crypto (tls.Tls.Handshake_crypto)

Module Tls.Handshake_crypto

val derive_master_secret : +Handshake_crypto (tls.Tls.Handshake_crypto)

Module Tls.Handshake_crypto

val derive_master_secret : Core.tls_before_13 -> State.session_data -> Cstruct.t -> diff --git a/doc/tls/Tls/Handshake_crypto13/index.html b/doc/tls/Tls/Handshake_crypto13/index.html index 47a1a7bf..e33a9606 100644 --- a/doc/tls/Tls/Handshake_crypto13/index.html +++ b/doc/tls/Tls/Handshake_crypto13/index.html @@ -1,5 +1,5 @@ -Handshake_crypto13 (tls.Tls.Handshake_crypto13)

Module Tls.Handshake_crypto13

val cdiv : int -> int -> int
val left_pad_dh : Mirage_crypto_pk.Dh.group -> Cstruct.t -> Cstruct.t
val not_all_zero : +Handshake_crypto13 (tls.Tls.Handshake_crypto13)

Module Tls.Handshake_crypto13

val cdiv : int -> int -> int
val left_pad_dh : Mirage_crypto_pk.Dh.group -> Cstruct.t -> Cstruct.t
val not_all_zero : (Cstruct.t, [> `Fatal of [> `InvalidDH ] ] as 'a) Stdlib.result -> (Cstruct.t, 'a) Stdlib.result
val dh_shared : [< `Finite_field of Mirage_crypto_pk.Dh.secret diff --git a/doc/tls/Tls/Handshake_server/index.html b/doc/tls/Tls/Handshake_server/index.html index 70aaa9da..7aa7c942 100644 --- a/doc/tls/Tls/Handshake_server/index.html +++ b/doc/tls/Tls/Handshake_server/index.html @@ -1,5 +1,5 @@ -Handshake_server (tls.Tls.Handshake_server)

Module Tls.Handshake_server

val hello_request : +Handshake_server (tls.Tls.Handshake_server)

Module Tls.Handshake_server

val hello_request : State.handshake_state -> (State.handshake_return, State.failure) Stdlib.result
val handle_change_cipher_spec : State.server_handshake_state -> diff --git a/doc/tls/Tls/Handshake_server13/index.html b/doc/tls/Tls/Handshake_server13/index.html index 495512e2..92fc444d 100644 --- a/doc/tls/Tls/Handshake_server13/index.html +++ b/doc/tls/Tls/Handshake_server13/index.html @@ -1,5 +1,5 @@ -Handshake_server13 (tls.Tls.Handshake_server13)

Module Tls.Handshake_server13

val answer_client_hello : +Handshake_server13 (tls.Tls.Handshake_server13)

Module Tls.Handshake_server13

val answer_client_hello : hrr:bool -> State.handshake_state -> Core.client_hello -> diff --git a/doc/tls/Tls/Packet/index.html b/doc/tls/Tls/Packet/index.html index 82a2c126..7ff81db0 100644 --- a/doc/tls/Tls/Packet/index.html +++ b/doc/tls/Tls/Packet/index.html @@ -1,5 +1,5 @@ -Packet (tls.Tls.Packet)

Module Tls.Packet

Magic numbers of the TLS protocol.

val get_uint24_len : Cstruct.t -> int
val set_uint24_len : Cstruct.t -> int -> unit
type content_type =
  1. | CHANGE_CIPHER_SPEC
  2. | ALERT
  3. | HANDSHAKE
  4. | APPLICATION_DATA
val content_type_to_int : content_type -> int
val int_to_content_type : int -> content_type option
val pp_content_type : Stdlib.Format.formatter -> content_type -> unit
type alert_level =
  1. | WARNING
  2. | FATAL
val pp_alert_level : Stdlib.Format.formatter -> alert_level -> unit
val alert_level_to_int : alert_level -> int
val int_to_alert_level : int -> alert_level option
type alert_type =
  1. | CLOSE_NOTIFY
  2. | UNEXPECTED_MESSAGE
  3. | BAD_RECORD_MAC
  4. | DECRYPTION_FAILED
  5. | RECORD_OVERFLOW
  6. | DECOMPRESSION_FAILURE
  7. | HANDSHAKE_FAILURE
  8. | NO_CERTIFICATE_RESERVED
  9. | BAD_CERTIFICATE
  10. | UNSUPPORTED_CERTIFICATE
  11. | CERTIFICATE_REVOKED
  12. | CERTIFICATE_EXPIRED
  13. | CERTIFICATE_UNKNOWN
  14. | ILLEGAL_PARAMETER
  15. | UNKNOWN_CA
  16. | ACCESS_DENIED
  17. | DECODE_ERROR
  18. | DECRYPT_ERROR
  19. | EXPORT_RESTRICTION_RESERVED
  20. | PROTOCOL_VERSION
  21. | INSUFFICIENT_SECURITY
  22. | INTERNAL_ERROR
  23. | INAPPROPRIATE_FALLBACK
  24. | USER_CANCELED
  25. | NO_RENEGOTIATION
  26. | MISSING_EXTENSION
  27. | UNSUPPORTED_EXTENSION
  28. | CERTIFICATE_UNOBTAINABLE
  29. | UNRECOGNIZED_NAME
  30. | BAD_CERTIFICATE_STATUS_RESPONSE
  31. | BAD_CERTIFICATE_HASH_VALUE
  32. | UNKNOWN_PSK_IDENTITY
  33. | CERTIFICATE_REQUIRED
  34. | NO_APPLICATION_PROTOCOL
val alert_type_to_string : alert_type -> string
val alert_type_to_int : alert_type -> int
val int_to_alert_type : int -> alert_type option
val pp_alert : Stdlib.Format.formatter -> (alert_level * alert_type) -> unit
type handshake_type =
  1. | HELLO_REQUEST
  2. | CLIENT_HELLO
  3. | SERVER_HELLO
  4. | HELLO_VERIFY_REQUEST
  5. | SESSION_TICKET
  6. | END_OF_EARLY_DATA
  7. | ENCRYPTED_EXTENSIONS
  8. | CERTIFICATE
  9. | SERVER_KEY_EXCHANGE
  10. | CERTIFICATE_REQUEST
  11. | SERVER_HELLO_DONE
  12. | CERTIFICATE_VERIFY
  13. | CLIENT_KEY_EXCHANGE
  14. | FINISHED
  15. | CERTIFICATE_URL
  16. | CERTIFICATE_STATUS
  17. | SUPPLEMENTAL_DATA
  18. | KEY_UPDATE
  19. | MESSAGE_HASH
val handshake_type_to_int : handshake_type -> int
val int_to_handshake_type : int -> handshake_type option
type client_certificate_type =
  1. | RSA_SIGN
  2. | DSS_SIGN
  3. | RSA_FIXED_DH
  4. | DSS_FIXED_DH
  5. | RSA_EPHEMERAL_DH_RESERVED
  6. | DSS_EPHEMERAL_DH_RESERVED
  7. | FORTEZZA_DMS_RESERVED
  8. | ECDSA_SIGN
  9. | RSA_FIXED_ECDH
  10. | ECDSA_FIXED_ECDH
val client_certificate_type_to_int : client_certificate_type -> int
val int_to_client_certificate_type : int -> client_certificate_type option
type compression_method =
  1. | NULL
  2. | DEFLATE
  3. | LZS
val compression_method_to_int : compression_method -> int
val int_to_compression_method : int -> compression_method option
type extension_type =
  1. | SERVER_NAME
  2. | MAX_FRAGMENT_LENGTH
  3. | CLIENT_CERTIFICATE_URL
  4. | TRUSTED_CA_KEYS
  5. | TRUNCATED_HMAC
  6. | STATUS_REQUEST
  7. | USER_MAPPING
  8. | CLIENT_AUTHZ
  9. | SERVER_AUTHZ
  10. | CERT_TYPE
  11. | SUPPORTED_GROUPS
  12. | EC_POINT_FORMATS
  13. | SRP
  14. | SIGNATURE_ALGORITHMS
  15. | USE_SRTP
  16. | HEARTBEAT
  17. | APPLICATION_LAYER_PROTOCOL_NEGOTIATION
  18. | STATUS_REQUEST_V2
  19. | SIGNED_CERTIFICATE_TIMESTAMP
  20. | CLIENT_CERTIFICATE_TYPE
  21. | SERVER_CERTIFICATE_TYPE
  22. | PADDING
  23. | ENCRYPT_THEN_MAC
  24. | EXTENDED_MASTER_SECRET
  25. | TOKEN_BINDING
  26. | CACHED_INFO
  27. | TLS_LTS
  28. | COMPRESSED_CERTIFICATE
  29. | RECORD_SIZE_LIMIT
  30. | PWD_PROTECT
  31. | PWD_CLEAR
  32. | PASSWORD_SALT
  33. | SESSION_TICKET
  34. | PRE_SHARED_KEY
  35. | EARLY_DATA
  36. | SUPPORTED_VERSIONS
  37. | COOKIE
  38. | PSK_KEY_EXCHANGE_MODES
  39. | CERTIFICATE_AUTHORITIES
  40. | OID_FILTERS
  41. | POST_HANDSHAKE_AUTH
  42. | SIGNATURE_ALGORITHMS_CERT
  43. | KEY_SHARE
  44. | RENEGOTIATION_INFO
  45. | DRAFT_SUPPORT
val extension_type_to_int : extension_type -> int
val int_to_extension_type : int -> extension_type option
val extension_type_to_string : extension_type -> string
type max_fragment_length =
  1. | TWO_9
  2. | TWO_10
  3. | TWO_11
  4. | TWO_12
val max_fragment_length_to_int : max_fragment_length -> int
val int_to_max_fragment_length : int -> max_fragment_length option
type psk_key_exchange_mode =
  1. | PSK_KE
  2. | PSK_KE_DHE
val psk_key_exchange_mode_to_int : psk_key_exchange_mode -> int
val int_to_psk_key_exchange_mode : int -> psk_key_exchange_mode option
type signature_alg =
  1. | RSA_PKCS1_MD5
  2. | RSA_PKCS1_SHA1
  3. | RSA_PKCS1_SHA224
  4. | RSA_PKCS1_SHA256
  5. | RSA_PKCS1_SHA384
  6. | RSA_PKCS1_SHA512
  7. | ECDSA_SECP256R1_SHA1
  8. | ECDSA_SECP256R1_SHA256
  9. | ECDSA_SECP384R1_SHA384
  10. | ECDSA_SECP521R1_SHA512
  11. | RSA_PSS_RSAENC_SHA256
  12. | RSA_PSS_RSAENC_SHA384
  13. | RSA_PSS_RSAENC_SHA512
  14. | ED25519
  15. | ED448
  16. | RSA_PSS_PSS_SHA256
  17. | RSA_PSS_PSS_SHA384
  18. | RSA_PSS_PSS_SHA512
val signature_alg_to_int : signature_alg -> int
val int_to_signature_alg : int -> signature_alg option
val to_signature_alg : +Packet (tls.Tls.Packet)

Module Tls.Packet

Magic numbers of the TLS protocol.

val get_uint24_len : Cstruct.t -> int
val set_uint24_len : Cstruct.t -> int -> unit
type content_type =
  1. | CHANGE_CIPHER_SPEC
  2. | ALERT
  3. | HANDSHAKE
  4. | APPLICATION_DATA
val content_type_to_int : content_type -> int
val int_to_content_type : int -> content_type option
val pp_content_type : Stdlib.Format.formatter -> content_type -> unit
type alert_level =
  1. | WARNING
  2. | FATAL
val pp_alert_level : Stdlib.Format.formatter -> alert_level -> unit
val alert_level_to_int : alert_level -> int
val int_to_alert_level : int -> alert_level option
type alert_type =
  1. | CLOSE_NOTIFY
  2. | UNEXPECTED_MESSAGE
  3. | BAD_RECORD_MAC
  4. | DECRYPTION_FAILED
  5. | RECORD_OVERFLOW
  6. | DECOMPRESSION_FAILURE
  7. | HANDSHAKE_FAILURE
  8. | NO_CERTIFICATE_RESERVED
  9. | BAD_CERTIFICATE
  10. | UNSUPPORTED_CERTIFICATE
  11. | CERTIFICATE_REVOKED
  12. | CERTIFICATE_EXPIRED
  13. | CERTIFICATE_UNKNOWN
  14. | ILLEGAL_PARAMETER
  15. | UNKNOWN_CA
  16. | ACCESS_DENIED
  17. | DECODE_ERROR
  18. | DECRYPT_ERROR
  19. | EXPORT_RESTRICTION_RESERVED
  20. | PROTOCOL_VERSION
  21. | INSUFFICIENT_SECURITY
  22. | INTERNAL_ERROR
  23. | INAPPROPRIATE_FALLBACK
  24. | USER_CANCELED
  25. | NO_RENEGOTIATION
  26. | MISSING_EXTENSION
  27. | UNSUPPORTED_EXTENSION
  28. | CERTIFICATE_UNOBTAINABLE
  29. | UNRECOGNIZED_NAME
  30. | BAD_CERTIFICATE_STATUS_RESPONSE
  31. | BAD_CERTIFICATE_HASH_VALUE
  32. | UNKNOWN_PSK_IDENTITY
  33. | CERTIFICATE_REQUIRED
  34. | NO_APPLICATION_PROTOCOL
val alert_type_to_string : alert_type -> string
val alert_type_to_int : alert_type -> int
val int_to_alert_type : int -> alert_type option
val pp_alert : Stdlib.Format.formatter -> (alert_level * alert_type) -> unit
type handshake_type =
  1. | HELLO_REQUEST
  2. | CLIENT_HELLO
  3. | SERVER_HELLO
  4. | HELLO_VERIFY_REQUEST
  5. | SESSION_TICKET
  6. | END_OF_EARLY_DATA
  7. | ENCRYPTED_EXTENSIONS
  8. | CERTIFICATE
  9. | SERVER_KEY_EXCHANGE
  10. | CERTIFICATE_REQUEST
  11. | SERVER_HELLO_DONE
  12. | CERTIFICATE_VERIFY
  13. | CLIENT_KEY_EXCHANGE
  14. | FINISHED
  15. | CERTIFICATE_URL
  16. | CERTIFICATE_STATUS
  17. | SUPPLEMENTAL_DATA
  18. | KEY_UPDATE
  19. | MESSAGE_HASH
val handshake_type_to_int : handshake_type -> int
val int_to_handshake_type : int -> handshake_type option
type client_certificate_type =
  1. | RSA_SIGN
  2. | DSS_SIGN
  3. | RSA_FIXED_DH
  4. | DSS_FIXED_DH
  5. | RSA_EPHEMERAL_DH_RESERVED
  6. | DSS_EPHEMERAL_DH_RESERVED
  7. | FORTEZZA_DMS_RESERVED
  8. | ECDSA_SIGN
  9. | RSA_FIXED_ECDH
  10. | ECDSA_FIXED_ECDH
val client_certificate_type_to_int : client_certificate_type -> int
val int_to_client_certificate_type : int -> client_certificate_type option
type compression_method =
  1. | NULL
  2. | DEFLATE
  3. | LZS
val compression_method_to_int : compression_method -> int
val int_to_compression_method : int -> compression_method option
type extension_type =
  1. | SERVER_NAME
  2. | MAX_FRAGMENT_LENGTH
  3. | CLIENT_CERTIFICATE_URL
  4. | TRUSTED_CA_KEYS
  5. | TRUNCATED_HMAC
  6. | STATUS_REQUEST
  7. | USER_MAPPING
  8. | CLIENT_AUTHZ
  9. | SERVER_AUTHZ
  10. | CERT_TYPE
  11. | SUPPORTED_GROUPS
  12. | EC_POINT_FORMATS
  13. | SRP
  14. | SIGNATURE_ALGORITHMS
  15. | USE_SRTP
  16. | HEARTBEAT
  17. | APPLICATION_LAYER_PROTOCOL_NEGOTIATION
  18. | STATUS_REQUEST_V2
  19. | SIGNED_CERTIFICATE_TIMESTAMP
  20. | CLIENT_CERTIFICATE_TYPE
  21. | SERVER_CERTIFICATE_TYPE
  22. | PADDING
  23. | ENCRYPT_THEN_MAC
  24. | EXTENDED_MASTER_SECRET
  25. | TOKEN_BINDING
  26. | CACHED_INFO
  27. | TLS_LTS
  28. | COMPRESSED_CERTIFICATE
  29. | RECORD_SIZE_LIMIT
  30. | PWD_PROTECT
  31. | PWD_CLEAR
  32. | PASSWORD_SALT
  33. | SESSION_TICKET
  34. | PRE_SHARED_KEY
  35. | EARLY_DATA
  36. | SUPPORTED_VERSIONS
  37. | COOKIE
  38. | PSK_KEY_EXCHANGE_MODES
  39. | CERTIFICATE_AUTHORITIES
  40. | OID_FILTERS
  41. | POST_HANDSHAKE_AUTH
  42. | SIGNATURE_ALGORITHMS_CERT
  43. | KEY_SHARE
  44. | RENEGOTIATION_INFO
  45. | DRAFT_SUPPORT
val extension_type_to_int : extension_type -> int
val int_to_extension_type : int -> extension_type option
val extension_type_to_string : extension_type -> string
type max_fragment_length =
  1. | TWO_9
  2. | TWO_10
  3. | TWO_11
  4. | TWO_12
val max_fragment_length_to_int : max_fragment_length -> int
val int_to_max_fragment_length : int -> max_fragment_length option
type psk_key_exchange_mode =
  1. | PSK_KE
  2. | PSK_KE_DHE
val psk_key_exchange_mode_to_int : psk_key_exchange_mode -> int
val int_to_psk_key_exchange_mode : int -> psk_key_exchange_mode option
type signature_alg =
  1. | RSA_PKCS1_MD5
  2. | RSA_PKCS1_SHA1
  3. | RSA_PKCS1_SHA224
  4. | RSA_PKCS1_SHA256
  5. | RSA_PKCS1_SHA384
  6. | RSA_PKCS1_SHA512
  7. | ECDSA_SECP256R1_SHA1
  8. | ECDSA_SECP256R1_SHA256
  9. | ECDSA_SECP384R1_SHA384
  10. | ECDSA_SECP521R1_SHA512
  11. | RSA_PSS_RSAENC_SHA256
  12. | RSA_PSS_RSAENC_SHA384
  13. | RSA_PSS_RSAENC_SHA512
  14. | ED25519
  15. | ED448
  16. | RSA_PSS_PSS_SHA256
  17. | RSA_PSS_PSS_SHA384
  18. | RSA_PSS_PSS_SHA512
val signature_alg_to_int : signature_alg -> int
val int_to_signature_alg : int -> signature_alg option
val to_signature_alg : [< `ECDSA_SECP256R1_SHA1 | `ECDSA_SECP256R1_SHA256 | `ECDSA_SECP384R1_SHA384 diff --git a/doc/tls/Tls/Reader/index.html b/doc/tls/Tls/Reader/index.html index a6c7b805..ace59f7b 100644 --- a/doc/tls/Tls/Reader/index.html +++ b/doc/tls/Tls/Reader/index.html @@ -1,5 +1,5 @@ -Reader (tls.Tls.Reader)

Module Tls.Reader

type error =
  1. | TrailingBytes of string
  2. | WrongLength of string
  3. | Unknown of string
  4. | Underflow
  5. | Overflow of int
  6. | UnknownVersion of int * int
  7. | UnknownContent of int
val pp_error : error Fmt.t
val parse_version : Cstruct.t -> (Core.tls_version, error) Stdlib.result
val parse_any_version : +Reader (tls.Tls.Reader)

Module Tls.Reader

type error =
  1. | TrailingBytes of string
  2. | WrongLength of string
  3. | Unknown of string
  4. | Underflow
  5. | Overflow of int
  6. | UnknownVersion of int * int
  7. | UnknownContent of int
val pp_error : error Fmt.t
val parse_version : Cstruct.t -> (Core.tls_version, error) Stdlib.result
val parse_any_version : Cstruct.t -> (Core.tls_any_version, error) Stdlib.result
val parse_record : Cstruct.t -> diff --git a/doc/tls/Tls/State/index.html b/doc/tls/Tls/State/index.html index 5eda7a14..aa529aa7 100644 --- a/doc/tls/Tls/State/index.html +++ b/doc/tls/Tls/State/index.html @@ -1,7 +1,7 @@ -State (tls.Tls.State)

Module Tls.State

type hmac_key = Cstruct.t
type iv_mode =
  1. | Iv of Cstruct.t
  2. | Random_iv
type 'k cbc_cipher = +State (tls.Tls.State)

Module Tls.State

type hmac_key = Cstruct.t
type iv_mode =
  1. | Iv of Cstruct.t
  2. | Random_iv
type 'k cbc_cipher = (module Mirage_crypto.Cipher_block.S.CBC - with type key = 'k)
type 'k cbc_state = {
  1. cipher : 'k cbc_cipher;
  2. cipher_secret : 'k;
  3. iv_mode : iv_mode;
  4. hmac : Mirage_crypto.Hash.hash;
  5. hmac_secret : hmac_key;
}
type nonce = Cstruct.t
type 'k aead_cipher = (module Mirage_crypto.AEAD with type key = 'k)
type 'k aead_state = {
  1. cipher : 'k aead_cipher;
  2. cipher_secret : 'k;
  3. nonce : nonce;
  4. explicit_nonce : bool;
}
type cipher_st =
  1. | CBC : 'k cbc_state -> cipher_st
  2. | AEAD : 'k aead_state -> cipher_st
type crypto_context = {
  1. sequence : int64;
  2. cipher_st : cipher_st;
}
type hs_log = Cstruct.t list
type dh_secret = [
  1. | `Finite_field of Mirage_crypto_pk.Dh.secret
  2. | `P256 of Mirage_crypto_ec.P256.Dh.secret
  3. | `P384 of Mirage_crypto_ec.P384.Dh.secret
  4. | `P521 of Mirage_crypto_ec.P521.Dh.secret
  5. | `X25519 of Mirage_crypto_ec.X25519.secret
]
type reneg_params = Cstruct.t * Cstruct.t
type common_session_data = {
  1. server_random : Cstruct.t;
  2. client_random : Cstruct.t;
  3. peer_certificate_chain : X509.Certificate.t list;
  4. peer_certificate : X509.Certificate.t option;
  5. trust_anchor : X509.Certificate.t option;
  6. received_certificates : X509.Certificate.t list;
  7. own_certificate : X509.Certificate.t list;
  8. own_private_key : X509.Private_key.t option;
  9. own_name : [ `host ] Domain_name.t option;
  10. client_auth : bool;
  11. master_secret : Core.master_secret;
  12. alpn_protocol : string option;
}
type session_data = {
  1. common_session_data : common_session_data;
  2. client_version : Core.tls_any_version;
  3. ciphersuite : Ciphersuite.ciphersuite;
  4. group : Core.group option;
  5. renegotiation : reneg_params;
  6. session_id : Cstruct.t;
  7. extended_ms : bool;
}
type server_handshake_state =
  1. | AwaitClientHello
  2. | AwaitClientHelloRenegotiate
  3. | AwaitClientCertificate_RSA of session_data * hs_log
  4. | AwaitClientCertificate_DHE of session_data * dh_secret * hs_log
  5. | AwaitClientKeyExchange_RSA of session_data * hs_log
  6. | AwaitClientKeyExchange_DHE of session_data * dh_secret * hs_log
  7. | AwaitClientCertificateVerify of session_data + with type key = 'k)
type 'k cbc_state = {
  1. cipher : 'k cbc_cipher;
  2. cipher_secret : 'k;
  3. iv_mode : iv_mode;
  4. hmac : Mirage_crypto.Hash.hash;
  5. hmac_secret : hmac_key;
}
type nonce = Cstruct.t
type 'k aead_cipher = (module Mirage_crypto.AEAD with type key = 'k)
type 'k aead_state = {
  1. cipher : 'k aead_cipher;
  2. cipher_secret : 'k;
  3. nonce : nonce;
  4. explicit_nonce : bool;
}
type cipher_st =
  1. | CBC : 'k cbc_state -> cipher_st
  2. | AEAD : 'k aead_state -> cipher_st
type crypto_context = {
  1. sequence : int64;
  2. cipher_st : cipher_st;
}
type hs_log = Cstruct.t list
type dh_secret = [
  1. | `Finite_field of Mirage_crypto_pk.Dh.secret
  2. | `P256 of Mirage_crypto_ec.P256.Dh.secret
  3. | `P384 of Mirage_crypto_ec.P384.Dh.secret
  4. | `P521 of Mirage_crypto_ec.P521.Dh.secret
  5. | `X25519 of Mirage_crypto_ec.X25519.secret
]
type reneg_params = Cstruct.t * Cstruct.t
type common_session_data = {
  1. server_random : Cstruct.t;
  2. client_random : Cstruct.t;
  3. peer_certificate_chain : X509.Certificate.t list;
  4. peer_certificate : X509.Certificate.t option;
  5. trust_anchor : X509.Certificate.t option;
  6. received_certificates : X509.Certificate.t list;
  7. own_certificate : X509.Certificate.t list;
  8. own_private_key : X509.Private_key.t option;
  9. own_name : [ `host ] Domain_name.t option;
  10. client_auth : bool;
  11. master_secret : Core.master_secret;
  12. alpn_protocol : string option;
}
type session_data = {
  1. common_session_data : common_session_data;
  2. client_version : Core.tls_any_version;
  3. ciphersuite : Ciphersuite.ciphersuite;
  4. group : Core.group option;
  5. renegotiation : reneg_params;
  6. session_id : Cstruct.t;
  7. extended_ms : bool;
  8. tls_unique : Cstruct.t;
}
type server_handshake_state =
  1. | AwaitClientHello
  2. | AwaitClientHelloRenegotiate
  3. | AwaitClientCertificate_RSA of session_data * hs_log
  4. | AwaitClientCertificate_DHE of session_data * dh_secret * hs_log
  5. | AwaitClientKeyExchange_RSA of session_data * hs_log
  6. | AwaitClientKeyExchange_DHE of session_data * dh_secret * hs_log
  7. | AwaitClientCertificateVerify of session_data * crypto_context * crypto_context * hs_log
  8. | AwaitClientChangeCipherSpec of session_data diff --git a/doc/tls/Tls/Utils/List_set/index.html b/doc/tls/Tls/Utils/List_set/index.html index 5bd237c3..2fcd3dfc 100644 --- a/doc/tls/Tls/Utils/List_set/index.html +++ b/doc/tls/Tls/Utils/List_set/index.html @@ -1,2 +1,2 @@ -List_set (tls.Tls.Utils.List_set)

    Module Utils.List_set

    val subset : ?compare:('a -> 'a -> int) -> 'b list -> 'a list -> bool
    val is_proper_set : 'a list -> bool
    +List_set (tls.Tls.Utils.List_set)

    Module Utils.List_set

    val subset : ?compare:('a -> 'a -> int) -> 'b list -> 'a list -> bool
    val is_proper_set : 'a list -> bool
    diff --git a/doc/tls/Tls/Utils/index.html b/doc/tls/Tls/Utils/index.html index d910941e..1383a334 100644 --- a/doc/tls/Tls/Utils/index.html +++ b/doc/tls/Tls/Utils/index.html @@ -1,2 +1,2 @@ -Utils (tls.Tls.Utils)

    Module Tls.Utils

    module List_set : sig ... end
    val map_find : f:('a -> 'b option) -> 'c list -> 'd option
    val init_and_last : 'a list -> ('b list * 'c) option
    val first_match : 'a list -> 'b list -> 'c option
    +Utils (tls.Tls.Utils)

    Module Tls.Utils

    module List_set : sig ... end
    val map_find : f:('a -> 'b option) -> 'c list -> 'd option
    val init_and_last : 'a list -> ('b list * 'c) option
    val first_match : 'a list -> 'b list -> 'c option
    diff --git a/doc/tls/Tls/Writer/index.html b/doc/tls/Tls/Writer/index.html index 96bf6fbe..56ca6996 100644 --- a/doc/tls/Tls/Writer/index.html +++ b/doc/tls/Tls/Writer/index.html @@ -1,5 +1,5 @@ -Writer (tls.Tls.Writer)

    Module Tls.Writer

    val assemble_protocol_version : Core.tls_version -> Cstruct.t
    val assemble_handshake : Core.tls_handshake -> Cstruct.t
    val assemble_message_hash : int -> Cstruct.t
    val assemble_hdr : +Writer (tls.Tls.Writer)

    Module Tls.Writer

    val assemble_protocol_version : Core.tls_version -> Cstruct.t
    val assemble_handshake : Core.tls_handshake -> Cstruct.t
    val assemble_message_hash : int -> Cstruct.t
    val assemble_hdr : Core.tls_version -> (Packet.content_type * Cstruct.t) -> Cstruct.t
    val assemble_alert : diff --git a/doc/tls/Tls/index.html b/doc/tls/Tls/index.html index ae3596a3..9140b480 100644 --- a/doc/tls/Tls/index.html +++ b/doc/tls/Tls/index.html @@ -1,2 +1,2 @@ -Tls (tls.Tls)

    Module Tls

    module Ciphersuite : sig ... end

    Ciphersuite definitions and some helper functions.

    module Config : sig ... end

    Configuration of the TLS stack

    module Core : sig ... end

    Core type definitions

    module Crypto : sig ... end
    module Engine : sig ... end

    Transport layer security

    module Explorator : sig ... end
    module Handshake_client : sig ... end
    module Handshake_client13 : sig ... end
    module Handshake_common : sig ... end
    module Handshake_crypto : sig ... end
    module Handshake_crypto13 : sig ... end
    module Handshake_server : sig ... end
    module Handshake_server13 : sig ... end
    module Packet : sig ... end

    Magic numbers of the TLS protocol.

    module Reader : sig ... end
    module State : sig ... end
    module Utils : sig ... end
    module Writer : sig ... end
    +Tls (tls.Tls)

    Module Tls

    module Ciphersuite : sig ... end

    Ciphersuite definitions and some helper functions.

    module Config : sig ... end

    Configuration of the TLS stack

    module Core : sig ... end

    Core type definitions

    module Crypto : sig ... end
    module Engine : sig ... end

    Transport layer security

    module Explorator : sig ... end
    module Handshake_client : sig ... end
    module Handshake_client13 : sig ... end
    module Handshake_common : sig ... end
    module Handshake_crypto : sig ... end
    module Handshake_crypto13 : sig ... end
    module Handshake_server : sig ... end
    module Handshake_server13 : sig ... end
    module Packet : sig ... end

    Magic numbers of the TLS protocol.

    module Reader : sig ... end
    module State : sig ... end
    module Utils : sig ... end
    module Writer : sig ... end
    diff --git a/doc/tls/index.html b/doc/tls/index.html index 50efdb45..cb1b0fc0 100644 --- a/doc/tls/index.html +++ b/doc/tls/index.html @@ -1,2 +1,2 @@ -index (tls.index)

    tls index

    Library tls

    The entry point of this library is the module: Tls.

    +index (tls.index)

    tls index

    Library tls

    The entry point of this library is the module: Tls.