tls 0.17.3 · OCaml Package

Core type definitions

val (<+>) : Cstruct.t -> Cstruct.t -> Cstruct.t

val let* : ('a, 'b) result -> ('a -> ('c, 'b) result) -> ('c, 'b) result

val guard : bool -> 'a -> (unit, 'a) result

val map_reader_error : 
  ('a, 'b) result ->
  ('a, [> `Fatal of [> `ReaderError of 'b ] ]) result

type tls13 = [

| `TLS_1_3

]

val pp_tls13 : Format.formatter -> [< `TLS_1_3 ] -> unit

type tls_before_13 = [

| `TLS_1_0
| `TLS_1_1
| `TLS_1_2

]

val pp_tls_before_13 : 
  Format.formatter ->
  [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 ] ->
  unit

type tls_version = [

| tls13
| tls_before_13

]

val pp_tls_version : 
  Format.formatter ->
  [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] ->
  unit

val pair_of_tls_version : 
  [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] ->
  int * int

val compare_tls_version : 
  [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] ->
  [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] ->
  int

val next : 
  [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] ->
  [> `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] option

val all_versions : 
  ([< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 TLS_1_1 TLS_1_2 TLS_1_3 ] as 'a
   * [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ]) ->
  'a list

val tls_version_of_pair : 
  (int * int) ->
  [> `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] option

type tls_any_version = [

| tls_version
| `SSL_3
| `TLS_1_X of int

]

val pp_tls_any_version : 
  Format.formatter ->
  [< `SSL_3 | `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 | `TLS_1_X of int ] ->
  unit

val any_version_to_version : 
  [> tls_version ] ->
  [> `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] option

val version_eq : 
  [> tls_version ] ->
  [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] ->
  bool

val version_ge : 
  [< `SSL_3 | `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 | `TLS_1_X of 'a ] ->
  [< `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 ] ->
  bool

val tls_any_version_of_pair : 
  (int * int) ->
  [> `SSL_3 | `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 | `TLS_1_X of int ]
    option

val pair_of_tls_any_version : 
  [< `SSL_3 | `TLS_1_0 | `TLS_1_1 | `TLS_1_2 | `TLS_1_3 | `TLS_1_X of int ] ->
  int * int

val max_protocol_version : ('a * 'b) -> 'b

val min_protocol_version : ('a * 'b) -> 'a

type tls_hdr = {

content_type : Packet.content_type;
version : tls_any_version;

}

val pp_tls_hdr : Format.formatter -> tls_hdr -> unit

module SessionID : sig ... end

module PreSharedKeyID : sig ... end

type psk_identity = (Cstruct.t * int32) * Cstruct.t

val binders_len : ('a * Cstruct.t) list -> int

type group = [

| `FFDHE2048
| `FFDHE3072
| `FFDHE4096
| `FFDHE6144
| `FFDHE8192
| `X25519
| `P256
| `P384
| `P521

]

val pp_group : 
  Format.formatter ->
  [< `FFDHE2048
  | `FFDHE3072
  | `FFDHE4096
  | `FFDHE6144
  | `FFDHE8192
  | `P256
  | `P384
  | `P521
  | `X25519 ] ->
  unit

val named_group_to_group : 
  Packet.named_group ->
  [> `FFDHE2048
  | `FFDHE3072
  | `FFDHE4096
  | `FFDHE6144
  | `FFDHE8192
  | `P256
  | `P384
  | `P521
  | `X25519 ]
    option

val group_to_named_group : 
  [< `FFDHE2048
  | `FFDHE3072
  | `FFDHE4096
  | `FFDHE6144
  | `FFDHE8192
  | `P256
  | `P384
  | `P521
  | `X25519 ] ->
  Packet.named_group

val group_to_impl : 
  [< `FFDHE2048
  | `FFDHE3072
  | `FFDHE4096
  | `FFDHE6144
  | `FFDHE8192
  | `P256
  | `P384
  | `P521
  | `X25519 ] ->
  [> `Finite_field of Mirage_crypto_pk.Dh.group
  | `P256
  | `P384
  | `P521
  | `X25519 ]

type signature_algorithm = [

| `RSA_PKCS1_MD5
| `RSA_PKCS1_SHA1
| `RSA_PKCS1_SHA224
| `RSA_PKCS1_SHA256
| `RSA_PKCS1_SHA384
| `RSA_PKCS1_SHA512
| `ECDSA_SECP256R1_SHA1
| `ECDSA_SECP256R1_SHA256
| `ECDSA_SECP384R1_SHA384
| `ECDSA_SECP521R1_SHA512
| `RSA_PSS_RSAENC_SHA256
| `RSA_PSS_RSAENC_SHA384
| `RSA_PSS_RSAENC_SHA512
| `ED25519

]

val hash_of_signature_algorithm : 
  [< `ECDSA_SECP256R1_SHA1
  | `ECDSA_SECP256R1_SHA256
  | `ECDSA_SECP384R1_SHA384
  | `ECDSA_SECP521R1_SHA512
  | `ED25519
  | `RSA_PKCS1_MD5
  | `RSA_PKCS1_SHA1
  | `RSA_PKCS1_SHA224
  | `RSA_PKCS1_SHA256
  | `RSA_PKCS1_SHA384
  | `RSA_PKCS1_SHA512
  | `RSA_PSS_RSAENC_SHA256
  | `RSA_PSS_RSAENC_SHA384
  | `RSA_PSS_RSAENC_SHA512 ] ->
  [> `MD5 | `SHA1 | `SHA224 | `SHA256 | `SHA384 | `SHA512 ]

val signature_scheme_of_signature_algorithm : 
  [< `ECDSA_SECP256R1_SHA1
  | `ECDSA_SECP256R1_SHA256
  | `ECDSA_SECP384R1_SHA384
  | `ECDSA_SECP521R1_SHA512
  | `ED25519
  | `RSA_PKCS1_MD5
  | `RSA_PKCS1_SHA1
  | `RSA_PKCS1_SHA224
  | `RSA_PKCS1_SHA256
  | `RSA_PKCS1_SHA384
  | `RSA_PKCS1_SHA512
  | `RSA_PSS_RSAENC_SHA256
  | `RSA_PSS_RSAENC_SHA384
  | `RSA_PSS_RSAENC_SHA512 ] ->
  [> `ECDSA | `ED25519 | `RSA_PKCS1 | `RSA_PSS ]

val pp_signature_algorithm : 
  Format.formatter ->
  [< `ECDSA_SECP256R1_SHA1
  | `ECDSA_SECP256R1_SHA256
  | `ECDSA_SECP384R1_SHA384
  | `ECDSA_SECP521R1_SHA512
  | `ED25519
  | `RSA_PKCS1_MD5
  | `RSA_PKCS1_SHA1
  | `RSA_PKCS1_SHA224
  | `RSA_PKCS1_SHA256
  | `RSA_PKCS1_SHA384
  | `RSA_PKCS1_SHA512
  | `RSA_PSS_RSAENC_SHA256
  | `RSA_PSS_RSAENC_SHA384
  | `RSA_PSS_RSAENC_SHA512 ECDSA_SECP256R1_SHA1 ECDSA_SECP256R1_SHA256 ECDSA_SECP384R1_SHA384 ECDSA_SECP521R1_SHA512 ] ->
  unit

val rsa_sigalg : 
  [< `ECDSA_SECP256R1_SHA1
  | `ECDSA_SECP256R1_SHA256
  | `ECDSA_SECP384R1_SHA384
  | `ECDSA_SECP521R1_SHA512
  | `ED25519
  | `RSA_PKCS1_MD5
  | `RSA_PKCS1_SHA1
  | `RSA_PKCS1_SHA224
  | `RSA_PKCS1_SHA256
  | `RSA_PKCS1_SHA384
  | `RSA_PKCS1_SHA512
  | `RSA_PSS_RSAENC_SHA256
  | `RSA_PSS_RSAENC_SHA384
  | `RSA_PSS_RSAENC_SHA512 ] ->
  bool

val tls13_sigalg : 
  [< `ECDSA_SECP256R1_SHA1
  | `ECDSA_SECP256R1_SHA256
  | `ECDSA_SECP384R1_SHA384
  | `ECDSA_SECP521R1_SHA512
  | `ED25519
  | `RSA_PKCS1_MD5
  | `RSA_PKCS1_SHA1
  | `RSA_PKCS1_SHA224
  | `RSA_PKCS1_SHA256
  | `RSA_PKCS1_SHA384
  | `RSA_PKCS1_SHA512
  | `RSA_PSS_RSAENC_SHA256
  | `RSA_PSS_RSAENC_SHA384
  | `RSA_PSS_RSAENC_SHA512 ] ->
  bool

val pk_matches_sa : 
  [> `ED25519 of 'a | `P256 of 'b | `P384 of 'c | `P521 of 'd | `RSA of 'e ] ->
  [< `ECDSA_SECP256R1_SHA1
  | `ECDSA_SECP256R1_SHA256
  | `ECDSA_SECP384R1_SHA384
  | `ECDSA_SECP521R1_SHA512
  | `ED25519
  | `RSA_PKCS1_MD5
  | `RSA_PKCS1_SHA1
  | `RSA_PKCS1_SHA224
  | `RSA_PKCS1_SHA256
  | `RSA_PKCS1_SHA384
  | `RSA_PKCS1_SHA512
  | `RSA_PSS_RSAENC_SHA256
  | `RSA_PSS_RSAENC_SHA384
  | `RSA_PSS_RSAENC_SHA512 ECDSA_SECP256R1_SHA1 ECDSA_SECP256R1_SHA256 ECDSA_SECP384R1_SHA384 ECDSA_SECP521R1_SHA512 ED25519 ] ->
  bool

type client_extension = [

| `Hostname of [ `host ] Domain_name.t
| `MaxFragmentLength of Packet.max_fragment_length
| `SupportedGroups of Packet.named_group list
| `SecureRenegotiation of Cstruct.t
| `Padding of int
| `SignatureAlgorithms of signature_algorithm list
| `ExtendedMasterSecret
| `ALPN of string list
| `KeyShare of (Packet.named_group * Cstruct.t) list
| `EarlyDataIndication
| `PreSharedKeys of psk_identity list
| `SupportedVersions of tls_any_version list
| `PostHandshakeAuthentication
| `Cookie of Cstruct.t
| `PskKeyExchangeModes of Packet.psk_key_exchange_mode list
| `ECPointFormats
| `UnknownExtension of int * Cstruct.t

]

type server13_extension = [

| `KeyShare of group * Cstruct.t
| `PreSharedKey of int
| `SelectedVersion of tls_version

]

type server_extension = [

| server13_extension
| `Hostname
| `MaxFragmentLength of Packet.max_fragment_length
| `SecureRenegotiation of Cstruct.t
| `ExtendedMasterSecret
| `ALPN of string
| `ECPointFormats
| `UnknownExtension of int * Cstruct.t

]

type encrypted_extension = [

| `Hostname
| `MaxFragmentLength of Packet.max_fragment_length
| `SupportedGroups of group list
| `ALPN of string
| `EarlyDataIndication
| `UnknownExtension of int * Cstruct.t

]

type hello_retry_extension = [

| `SelectedGroup of group
| `Cookie of Cstruct.t
| `SelectedVersion of tls_version
| `UnknownExtension of int * Cstruct.t

]

type client_hello = {

client_version : tls_any_version;
client_random : Cstruct.t;
sessionid : SessionID.t option;
ciphersuites : Packet.any_ciphersuite list;
extensions : client_extension list;

}

type server_hello = {

server_version : tls_version;
server_random : Cstruct.t;
sessionid : SessionID.t option;
ciphersuite : Ciphersuite.ciphersuite;
extensions : server_extension list;

}

type dh_parameters = {

dh_p : Cstruct.t;
dh_g : Cstruct.t;
dh_Ys : Cstruct.t;

}

type hello_retry = {

retry_version : tls_version;
ciphersuite : Ciphersuite.ciphersuite13;
sessionid : SessionID.t option;
selected_group : group;
extensions : hello_retry_extension list;

}

type session_ticket_extension = [

| `EarlyDataIndication of int32
| `UnknownExtension of int * Cstruct.t

]

type session_ticket = {

lifetime : int32;
age_add : int32;
nonce : Cstruct.t;
ticket : Cstruct.t;
extensions : session_ticket_extension list;

}

type certificate_request_extension = [

| `SignatureAlgorithms of signature_algorithm list
| `CertificateAuthorities of X509.Distinguished_name.t list
| `UnknownExtension of int * Cstruct.t

]

type tls_handshake =

| HelloRequest
| HelloRetryRequest of hello_retry
| EncryptedExtensions of encrypted_extension list
| ServerHelloDone
| ClientHello of client_hello
| ServerHello of server_hello
| Certificate of Cstruct.t
| ServerKeyExchange of Cstruct.t
| CertificateRequest of Cstruct.t
| ClientKeyExchange of Cstruct.t
| CertificateVerify of Cstruct.t
| Finished of Cstruct.t
| SessionTicket of session_ticket
| KeyUpdate of Packet.key_update_request_type
| EndOfEarlyData

val pp_handshake : Format.formatter -> tls_handshake -> unit

val src : Logs.src

module Tracing : sig ... end

type tls_alert = Packet.alert_level * Packet.alert_type

type master_secret = Cstruct.t

the master secret of a TLS connection

type psk13 = {

identifier : Cstruct.t;
obfuscation : int32;
secret : Cstruct.t;
lifetime : int32;
early_data : int32;
issued_at : Ptime.t;

}

type epoch_state = [

| `ZeroRTT
| `Established

]

type epoch_data = {

side : [ `Client | `Server ];
state : epoch_state;
protocol_version : tls_version;
ciphersuite : Ciphersuite.ciphersuite;
peer_random : Cstruct.t;
peer_certificate_chain : X509.Certificate.t list;
peer_certificate : X509.Certificate.t option;
peer_name : [ `host ] Domain_name.t option;
trust_anchor : X509.Certificate.t option;
received_certificates : X509.Certificate.t list;
own_random : Cstruct.t;
own_certificate : X509.Certificate.t list;
own_private_key : X509.Private_key.t option;
own_name : [ `host ] Domain_name.t option;
master_secret : master_secret;
exporter_master_secret : master_secret;
session_id : SessionID.t;
extended_ms : bool;
alpn_protocol : string option;

}

information about an open session

val supports_key_usage : 
  ?not_present:bool ->
  X509.Extension.key_usage ->
  X509.Certificate.t ->
  bool

val supports_extended_key_usage : 
  ?not_present:bool ->
  X509.Extension.extended_key_usage ->
  X509.Certificate.t ->
  bool

package tls