package tls

  1. Overview
  2. Docs
type hmac_key = Cstruct.t
type iv_mode =
  1. | Iv of Cstruct_sexp.t
  2. | Random_iv
val sexp_of_iv_mode : iv_mode -> Ppx_sexp_conv_lib.Sexp.t
type 'k cbc_cipher = (module Mirage_crypto.Cipher_block.S.CBC with type key = 'k)
type 'k cbc_state = {
  1. cipher : 'k cbc_cipher;
  2. cipher_secret : 'k;
  3. iv_mode : iv_mode;
  4. hmac : Mirage_crypto.Hash.hash;
  5. hmac_secret : hmac_key;
}
type nonce = Cstruct.t
type 'k aead_cipher =
  1. | CCM of (module Mirage_crypto.Cipher_block.S.CCM with type key = 'k)
  2. | GCM of (module Mirage_crypto.Cipher_block.S.GCM with type key = 'k)
  3. | ChaCha20_Poly1305 of (module Mirage_crypto.AEAD with type key = 'k)
type 'k aead_state = {
  1. cipher : 'k aead_cipher;
  2. cipher_secret : 'k;
  3. nonce : nonce;
}
type cipher_st =
  1. | CBC : 'k cbc_state -> cipher_st
  2. | AEAD : 'k aead_state -> cipher_st
val sexp_of_cipher_st : cipher_st -> Sexplib.Sexp.t
type crypto_context = {
  1. sequence : int64;
  2. cipher_st : cipher_st;
}
val sexp_of_crypto_context : crypto_context -> Ppx_sexp_conv_lib.Sexp.t
type hs_log = Cstruct_sexp.t list
val sexp_of_hs_log : hs_log -> Ppx_sexp_conv_lib.Sexp.t
val sexp_of_dh_secret : 'a -> Sexplib.Sexp.t
val dh_secret_of_sexp : Sexplib0__.Sexp.t -> 'a
type reneg_params = Cstruct_sexp.t * Cstruct_sexp.t
val sexp_of_reneg_params : reneg_params -> Ppx_sexp_conv_lib.Sexp.t
type common_session_data = {
  1. server_random : Cstruct_sexp.t;
  2. client_random : Cstruct_sexp.t;
  3. peer_certificate_chain : Core.Cert.t list;
  4. peer_certificate : Core.Cert.t option;
  5. trust_anchor : Core.Cert.t option;
  6. received_certificates : Core.Cert.t list;
  7. own_certificate : Core.Cert.t list;
  8. own_private_key : Core.Priv.t option;
  9. own_name : Core.Peer_name.t option;
  10. client_auth : bool;
  11. master_secret : Core.master_secret;
  12. alpn_protocol : string option;
}
val sexp_of_common_session_data : common_session_data -> Ppx_sexp_conv_lib.Sexp.t
type session_data = {
  1. common_session_data : common_session_data;
  2. client_version : Core.tls_any_version;
  3. ciphersuite : Ciphersuite.ciphersuite;
  4. group : Core.group option;
  5. renegotiation : reneg_params;
  6. session_id : Cstruct_sexp.t;
  7. extended_ms : bool;
}
val sexp_of_session_data : session_data -> Ppx_sexp_conv_lib.Sexp.t
type server_handshake_state =
  1. | AwaitClientHello
  2. | AwaitClientHelloRenegotiate
  3. | AwaitClientCertificate_RSA of session_data * hs_log
  4. | AwaitClientCertificate_DHE of session_data * dh_secret * hs_log
  5. | AwaitClientKeyExchange_RSA of session_data * hs_log
  6. | AwaitClientKeyExchange_DHE of session_data * dh_secret * hs_log
  7. | AwaitClientCertificateVerify of session_data * crypto_context * crypto_context * hs_log
  8. | AwaitClientChangeCipherSpec of session_data * crypto_context * crypto_context * hs_log
  9. | AwaitClientChangeCipherSpecResume of session_data * crypto_context * Cstruct_sexp.t * hs_log
  10. | AwaitClientFinished of session_data * hs_log
  11. | AwaitClientFinishedResume of session_data * Cstruct_sexp.t * hs_log
  12. | Established
val sexp_of_server_handshake_state : server_handshake_state -> Ppx_sexp_conv_lib.Sexp.t
type client_handshake_state =
  1. | ClientInitial
  2. | AwaitServerHello of Core.client_hello * (Core.group * dh_secret) list * hs_log
  3. | AwaitServerHelloRenegotiate of session_data * Core.client_hello * hs_log
  4. | AwaitCertificate_RSA of session_data * hs_log
  5. | AwaitCertificate_DHE of session_data * hs_log
  6. | AwaitServerKeyExchange_DHE of session_data * hs_log
  7. | AwaitCertificateRequestOrServerHelloDone of session_data * Cstruct_sexp.t * Cstruct_sexp.t * hs_log
  8. | AwaitServerHelloDone of session_data * Core.signature_algorithm list option * Cstruct_sexp.t * Cstruct_sexp.t * hs_log
  9. | AwaitServerChangeCipherSpec of session_data * crypto_context * Cstruct_sexp.t * hs_log
  10. | AwaitServerChangeCipherSpecResume of session_data * crypto_context * crypto_context * hs_log
  11. | AwaitServerFinished of session_data * Cstruct_sexp.t * hs_log
  12. | AwaitServerFinishedResume of session_data * hs_log
  13. | Established
val sexp_of_client_handshake_state : client_handshake_state -> Ppx_sexp_conv_lib.Sexp.t
type kdf = {
  1. secret : Cstruct_sexp.t;
  2. cipher : Ciphersuite.ciphersuite13;
  3. hash : Ciphersuite.H.t;
}
val sexp_of_kdf : kdf -> Ppx_sexp_conv_lib.Sexp.t
type session_data13 = {
  1. common_session_data13 : common_session_data;
  2. ciphersuite13 : Ciphersuite.ciphersuite13;
  3. master_secret : kdf;
  4. resumption_secret : Cstruct_sexp.t;
  5. state : Core.epoch_state;
  6. resumed : bool;
  7. client_app_secret : Cstruct_sexp.t;
  8. server_app_secret : Cstruct_sexp.t;
}
val sexp_of_session_data13 : session_data13 -> Ppx_sexp_conv_lib.Sexp.t
type client13_handshake_state =
  1. | AwaitServerHello13 of Core.client_hello * (Core.group * dh_secret) list * Cstruct_sexp.t
  2. | AwaitServerEncryptedExtensions13 of session_data13 * Cstruct_sexp.t * Cstruct_sexp.t * Cstruct_sexp.t
  3. | AwaitServerCertificateRequestOrCertificate13 of session_data13 * Cstruct_sexp.t * Cstruct_sexp.t * Cstruct_sexp.t
  4. | AwaitServerCertificate13 of session_data13 * Cstruct_sexp.t * Cstruct_sexp.t * Core.signature_algorithm list option * Cstruct_sexp.t
  5. | AwaitServerCertificateVerify13 of session_data13 * Cstruct_sexp.t * Cstruct_sexp.t * Core.signature_algorithm list option * Cstruct_sexp.t
  6. | AwaitServerFinished13 of session_data13 * Cstruct_sexp.t * Cstruct_sexp.t * Core.signature_algorithm list option * Cstruct_sexp.t
  7. | Established13
val sexp_of_client13_handshake_state : client13_handshake_state -> Ppx_sexp_conv_lib.Sexp.t
type server13_handshake_state =
  1. | AwaitClientHelloHRR13
  2. | AwaitClientCertificate13 of session_data13 * Cstruct_sexp.t * crypto_context * Core.session_ticket option * Cstruct_sexp.t
  3. | AwaitClientCertificateVerify13 of session_data13 * Cstruct_sexp.t * crypto_context * Core.session_ticket option * Cstruct_sexp.t
  4. | AwaitClientFinished13 of Cstruct_sexp.t * crypto_context * Core.session_ticket option * Cstruct_sexp.t
  5. | AwaitEndOfEarlyData13 of Cstruct_sexp.t * crypto_context * crypto_context * Core.session_ticket option * Cstruct_sexp.t
  6. | Established13
val sexp_of_server13_handshake_state : server13_handshake_state -> Ppx_sexp_conv_lib.Sexp.t
type handshake_machina_state =
  1. | Client of client_handshake_state
  2. | Server of server_handshake_state
  3. | Client13 of client13_handshake_state
  4. | Server13 of server13_handshake_state
val sexp_of_handshake_machina_state : handshake_machina_state -> Ppx_sexp_conv_lib.Sexp.t
type handshake_state = {
  1. session : [ `TLS of session_data | `TLS13 of session_data13 ] list;
  2. protocol_version : Core.tls_version;
  3. early_data_left : int32;
  4. machina : handshake_machina_state;
  5. config : Config.config;
  6. hs_fragment : Cstruct_sexp.t;
}
val sexp_of_handshake_state : handshake_state -> Ppx_sexp_conv_lib.Sexp.t
type crypto_state = crypto_context option
val sexp_of_crypto_state : crypto_state -> Ppx_sexp_conv_lib.Sexp.t
type record = Packet.content_type * Cstruct_sexp.t
val sexp_of_record : record -> Ppx_sexp_conv_lib.Sexp.t
type rec_resp = [
  1. | `Change_enc of crypto_context
  2. | `Change_dec of crypto_context
  3. | `Record of record
]
type handshake_return = handshake_state * rec_resp list
type state = {
  1. handshake : handshake_state;
  2. decryptor : crypto_state;
  3. encryptor : crypto_state;
  4. fragment : Cstruct_sexp.t;
}
val sexp_of_state : state -> Ppx_sexp_conv_lib.Sexp.t
module V_err : sig ... end
module Ec_err : sig ... end
type error = [
  1. | `AuthenticationFailure of V_err.t
  2. | `NoConfiguredCiphersuite of Ciphersuite.ciphersuite list
  3. | `NoConfiguredVersions of Core.tls_version list
  4. | `NoConfiguredSignatureAlgorithm of Core.signature_algorithm list
  5. | `NoMatchingCertificateFound of string
  6. | `NoCertificateConfigured
  7. | `CouldntSelectCertificate
]
val sexp_of_error : error -> Ppx_sexp_conv_lib.Sexp.t
type client_hello_errors = [
  1. | `EmptyCiphersuites
  2. | `NotSetCiphersuites of Packet.any_ciphersuite list
  3. | `NoSupportedCiphersuite of Packet.any_ciphersuite list
  4. | `NotSetExtension of Core.client_extension list
  5. | `HasSignatureAlgorithmsExtension
  6. | `NoSignatureAlgorithmsExtension
  7. | `NoGoodSignatureAlgorithms of Core.signature_algorithm list
  8. | `NoKeyShareExtension
  9. | `NoSupportedGroupExtension
  10. | `NotSetSupportedGroup of Packet.named_group list
  11. | `NotSetKeyShare of (Packet.named_group * Cstruct_sexp.t) list
  12. | `NotSubsetKeyShareSupportedGroup of Packet.named_group list * (Packet.named_group * Cstruct_sexp.t) list
  13. | `Has0rttAfterHRR
  14. | `NoCookie
]
val sexp_of_client_hello_errors : client_hello_errors -> Ppx_sexp_conv_lib.Sexp.t
type fatal = [
  1. | `NoSecureRenegotiation
  2. | `NoSupportedGroup
  3. | `NoVersions of Core.tls_any_version list
  4. | `ReaderError of Reader.error
  5. | `NoCertificateReceived
  6. | `NoCertificateVerifyReceived
  7. | `NotRSACertificate
  8. | `KeyTooSmall
  9. | `SignatureVerificationFailed of string
  10. | `SigningFailed of string
  11. | `BadCertificateChain
  12. | `MACMismatch
  13. | `MACUnderflow
  14. | `RecordOverflow of int
  15. | `UnknownRecordVersion of int * int
  16. | `UnknownContentType of int
  17. | `CannotHandleApplicationDataYet
  18. | `NoHeartbeat
  19. | `BadRecordVersion of Core.tls_any_version
  20. | `BadFinished
  21. | `HandshakeFragmentsNotEmpty
  22. | `InsufficientDH
  23. | `InvalidDH
  24. | `BadECDH of Ec_err.t
  25. | `InvalidRenegotiation
  26. | `InvalidClientHello of client_hello_errors
  27. | `InvalidServerHello
  28. | `InvalidRenegotiationVersion of Core.tls_version
  29. | `InappropriateFallback
  30. | `UnexpectedCCS
  31. | `UnexpectedHandshake of Core.tls_handshake
  32. | `InvalidCertificateUsage
  33. | `InvalidCertificateExtendedUsage
  34. | `InvalidSession
  35. | `NoApplicationProtocol
  36. | `HelloRetryRequest
  37. | `InvalidMessage
  38. | `Toomany0rttbytes
  39. | `MissingContentType
  40. | `Downgrade12
  41. | `Downgrade11
]
val sexp_of_fatal : fatal -> Ppx_sexp_conv_lib.Sexp.t
type failure = [
  1. | `Error of error
  2. | `Fatal of fatal
]
val sexp_of_failure : failure -> Ppx_sexp_conv_lib.Sexp.t
val common_data_to_epoch : common_session_data -> bool -> Core.Peer_name.t option -> Core.epoch_data
val epoch_of_session : bool -> Core.Peer_name.t option -> Core.tls_version -> [< `TLS of session_data | `TLS13 of session_data13 ] -> Core.epoch_data
val epoch_of_hs : handshake_state -> Core.epoch_data option
OCaml

Innovation. Community. Security.

GitHub Discord Twitter Peertube RSS
About
Changelog Releases Industrial Users Academic Users Why OCaml
Ecosystem
Packages Community Events OCaml Planet Jobs
Resources
Install OCaml Get Started Platform Tools Language Manual Standard Library API Books Exercises Papers OCaml Playground Logo
Policies
Carbon Footprint Governance Privacy Code of Conduct