| Portability | unknown |
|---|---|
| Stability | experimental |
| Maintainer | Vincent Hanquez <vincent@snarc.org> |
| Safe Haskell | None |
Network.TLS
Contents
- Context configuration
- raw types
- Session
- Backend abstraction
- Context object
- Creating a context
- Information gathering
- Credentials
- Initialisation and Termination of context
- Next Protocol Negotiation
- High level API
- Crypto Key
- Compressions & Predefined compressions
- member redefined for the class abstraction
- helper
- Ciphers & Predefined ciphers
- Versions
- Errors
- Exceptions
- X509 Validation
- X509 Validation Cache
Description
- data ClientParams = ClientParams {}
- data ServerParams = ServerParams {}
- data ClientHooks = ClientHooks {
- onCertificateRequest :: ([CertificateType], Maybe [HashAndSignatureAlgorithm], [DistinguishedName]) -> IO (Maybe (CertificateChain, PrivKey))
- onNPNServerSuggest :: Maybe ([ByteString] -> IO ByteString)
- onServerCertificate :: CertificateStore -> ValidationCache -> ServiceID -> CertificateChain -> IO [FailedReason]
- data ServerHooks = ServerHooks {
- onClientCertificate :: CertificateChain -> IO CertificateUsage
- onUnverifiedClientCert :: IO Bool
- onCipherChoosing :: Version -> [Cipher] -> Cipher
- onSuggestNextProtocols :: IO (Maybe [ByteString])
- onNewHandshake :: Measurement -> IO Bool
- data Supported = Supported {}
- data Shared = Shared {}
- data Hooks = Hooks {
- hookRecvHandshake :: Handshake -> IO Handshake
- hookRecvCertificates :: CertificateChain -> IO ()
- hookLogging :: Logging
- data Logging = Logging {
- loggingPacketSent :: String -> IO ()
- loggingPacketRecv :: String -> IO ()
- loggingIOSent :: ByteString -> IO ()
- loggingIORecv :: Header -> ByteString -> IO ()
- data Measurement = Measurement {
- nbHandshakes :: !Word32
- bytesReceived :: !Word32
- bytesSent :: !Word32
- data CertificateUsage
- data CertificateRejectReason
- defaultParamsClient :: HostName -> Bytes -> ClientParams
- data MaxFragmentEnum
- type HashAndSignatureAlgorithm = (HashAlgorithm, SignatureAlgorithm)
- data HashAlgorithm
- = HashNone
- | HashMD5
- | HashSHA1
- | HashSHA224
- | HashSHA256
- | HashSHA384
- | HashSHA512
- | HashOther Word8
- data SignatureAlgorithm
- data CertificateType
- data ProtocolType
- data Header = Header ProtocolType Version Word16
- type SessionID = ByteString
- data SessionData = SessionData {}
- data SessionManager = SessionManager {
- sessionResume :: SessionID -> IO (Maybe SessionData)
- sessionEstablish :: SessionID -> SessionData -> IO ()
- sessionInvalidate :: SessionID -> IO ()
- noSessionManager :: SessionManager
- data Backend = Backend {
- backendFlush :: IO ()
- backendClose :: IO ()
- backendSend :: ByteString -> IO ()
- backendRecv :: Int -> IO ByteString
- data Context
- ctxConnection :: Context -> Backend
- contextNew :: (MonadIO m, CPRG rng, HasBackend backend, TLSParams params) => backend -> params -> rng -> m Context
- contextNewOnHandle :: (MonadIO m, CPRG rng, TLSParams params) => Handle -> params -> rng -> m Context
- contextNewOnSocket :: (MonadIO m, CPRG rng, TLSParams params) => Socket -> params -> rng -> m Context
- contextFlush :: Context -> IO ()
- contextClose :: Context -> IO ()
- contextHookSetHandshakeRecv :: Context -> (Handshake -> IO Handshake) -> IO ()
- contextHookSetCertificateRecv :: Context -> (CertificateChain -> IO ()) -> IO ()
- contextHookSetLogging :: Context -> Logging -> IO ()
- contextModifyHooks :: Context -> (Hooks -> Hooks) -> IO ()
- data Information = Information {}
- contextGetInformation :: Context -> IO (Maybe Information)
- newtype Credentials = Credentials [Credential]
- type Credential = (CertificateChain, PrivKey)
- credentialLoadX509 :: FilePath -> FilePath -> IO (Either String Credential)
- credentialLoadX509FromMemory :: Bytes -> Bytes -> Either String Credential
- bye :: MonadIO m => Context -> m ()
- handshake :: MonadIO m => Context -> m ()
- getNegotiatedProtocol :: MonadIO m => Context -> m (Maybe ByteString)
- sendData :: MonadIO m => Context -> ByteString -> m ()
- recvData :: MonadIO m => Context -> m ByteString
- recvData' :: MonadIO m => Context -> m ByteString
- data PubKey
- = PubKeyRSA PublicKey
- | PubKeyDSA PublicKey
- | PubKeyDH (Integer, Integer, Integer, Maybe Integer, ([Word8], Integer))
- | PubKeyECDSA CurveName ByteString
- | PubKeyUnknown OID ByteString
- data PrivKey
- class CompressionC a where
- compressionCID :: a -> CompressionID
- compressionCDeflate :: a -> ByteString -> (a, ByteString)
- compressionCInflate :: a -> ByteString -> (a, ByteString)
- data Compression = forall a . CompressionC a => Compression a
- type CompressionID = Word8
- nullCompression :: Compression
- data NullCompression
- compressionID :: Compression -> CompressionID
- compressionDeflate :: ByteString -> Compression -> (Compression, ByteString)
- compressionInflate :: ByteString -> Compression -> (Compression, ByteString)
- compressionIntersectID :: [Compression] -> [Word8] -> [Compression]
- data BulkFunctions
- = BulkBlockF (Key -> IV -> ByteString -> ByteString) (Key -> IV -> ByteString -> ByteString)
- | BulkStreamF (Key -> IV) (IV -> ByteString -> (ByteString, IV)) (IV -> ByteString -> (ByteString, IV))
- data CipherKeyExchangeType
- data Bulk = Bulk {
- bulkName :: String
- bulkKeySize :: Int
- bulkIVSize :: Int
- bulkBlockSize :: Int
- bulkF :: BulkFunctions
- data Hash = Hash {
- hashName :: String
- hashSize :: Int
- hashF :: ByteString -> ByteString
- data Cipher = Cipher {}
- type CipherID = Word16
- type Key = ByteString
- type IV = ByteString
- cipherKeyBlockSize :: Cipher -> Int
- cipherAllowedForVersion :: Version -> Cipher -> Bool
- cipherExchangeNeedMoreData :: CipherKeyExchangeType -> Bool
- data Version
- data TLSError
- data KxError
- data AlertDescription
- = CloseNotify
- | UnexpectedMessage
- | BadRecordMac
- | DecryptionFailed
- | RecordOverflow
- | DecompressionFailure
- | HandshakeFailure
- | BadCertificate
- | UnsupportedCertificate
- | CertificateRevoked
- | CertificateExpired
- | CertificateUnknown
- | IllegalParameter
- | UnknownCa
- | AccessDenied
- | DecodeError
- | DecryptError
- | ExportRestriction
- | ProtocolVersion
- | InsufficientSecurity
- | InternalError
- | UserCanceled
- | NoRenegotiation
- | UnsupportedExtension
- | CertificateUnobtainable
- | UnrecognizedName
- | BadCertificateStatusResponse
- | BadCertificateHashValue
- data TLSException
- data ValidationChecks = ValidationChecks {}
- data ValidationHooks = ValidationHooks {
- hookMatchSubjectIssuer :: DistinguishedName -> Certificate -> Bool
- hookValidateTime :: UTCTime -> Certificate -> [FailedReason]
- hookValidateName :: HostName -> Certificate -> [FailedReason]
- hookFilterReason :: [FailedReason] -> [FailedReason]
- data ValidationCache = ValidationCache {}
- data ValidationCacheResult
- exceptionValidationCache :: [(ServiceID, Fingerprint)] -> ValidationCache
Context configuration
data ClientParams Source
Constructors
| ClientParams | |
Fields
| |
Instances
data ServerParams Source
Constructors
| ServerParams | |
Fields
| |
Instances
data ClientHooks Source
A set of callbacks run by the clients for various corners of TLS establishment
Constructors
| ClientHooks | |
Fields
| |
Instances
data ServerHooks Source
A set of callbacks run by the server for various corners of the TLS establishment
Constructors
| ServerHooks | |
Fields
| |
Instances
List all the supported algorithms, versions, ciphers, etc supported.
Constructors
| Supported | |
Fields
| |
Constructors
| Shared | |
A collection of hooks actions.
Constructors
| Hooks | |
Fields
| |
Hooks for logging
This is called when sending and receiving packets and IO
Constructors
| Logging | |
Fields
| |
data Measurement Source
record some data about this connection.
Constructors
| Measurement | |
Fields
| |
Instances
data CertificateUsage Source
Certificate Usage callback possible returns values.
Constructors
| CertificateUsageAccept | usage of certificate accepted |
| CertificateUsageReject CertificateRejectReason | usage of certificate rejected |
Instances
data CertificateRejectReason Source
Certificate and Chain rejection reason
defaultParamsClient :: HostName -> Bytes -> ClientParamsSource
data MaxFragmentEnum Source
Constructors
| MaxFragment512 | |
| MaxFragment1024 | |
| MaxFragment2048 | |
| MaxFragment4096 |
Instances
data HashAlgorithm Source
Constructors
| HashNone | |
| HashMD5 | |
| HashSHA1 | |
| HashSHA224 | |
| HashSHA256 | |
| HashSHA384 | |
| HashSHA512 | |
| HashOther Word8 |
Instances
data SignatureAlgorithm Source
Instances
data CertificateType Source
Constructors
Instances
raw types
data ProtocolType Source
Constructors
| ProtocolType_ChangeCipherSpec | |
| ProtocolType_Alert | |
| ProtocolType_Handshake | |
| ProtocolType_AppData | |
| ProtocolType_DeprecatedHandshake |
Instances
Session
type SessionID = ByteStringSource
A session ID
data SessionManager Source
A session manager
Constructors
| SessionManager | |
Fields
| |
Backend abstraction
Connection IO backend
Constructors
| Backend | |
Fields
| |
Context object
ctxConnection :: Context -> BackendSource
return the backend object associated with this context
Creating a context
Arguments
| :: (MonadIO m, CPRG rng, HasBackend backend, TLSParams params) | |
| => backend | Backend abstraction with specific method to interact with the connection type. |
| -> params | Parameters of the context. |
| -> rng | Random number generator associated with this context. |
| -> m Context |
create a new context using the backend and parameters specified.
Arguments
| :: (MonadIO m, CPRG rng, TLSParams params) | |
| => Handle | Handle of the connection. |
| -> params | Parameters of the context. |
| -> rng | Random number generator associated with this context. |
| -> m Context |
Deprecated: use contextNew
create a new context on an handle.
Arguments
| :: (MonadIO m, CPRG rng, TLSParams params) | |
| => Socket | Socket of the connection. |
| -> params | Parameters of the context. |
| -> rng | Random number generator associated with this context. |
| -> m Context |
Deprecated: use contextNew
create a new context on a socket.
contextFlush :: Context -> IO ()Source
contextClose :: Context -> IO ()Source
contextHookSetHandshakeRecv :: Context -> (Handshake -> IO Handshake) -> IO ()Source
contextHookSetCertificateRecv :: Context -> (CertificateChain -> IO ()) -> IO ()Source
contextHookSetLogging :: Context -> Logging -> IO ()Source
Information gathering
data Information Source
Information related to a running context, e.g. current cipher
Constructors
| Information | |
Fields | |
Instances
contextGetInformation :: Context -> IO (Maybe Information)Source
Information about the current context
Credentials
type Credential = (CertificateChain, PrivKey)Source
Arguments
| :: FilePath | public certificate (X.509 format) |
| -> FilePath | private key associated |
| -> IO (Either String Credential) |
try to create a new credential object from a public certificate and the associated private key that are stored on the filesystem in PEM format.
credentialLoadX509FromMemory :: Bytes -> Bytes -> Either String CredentialSource
similar to credentialLoadX509 but take the certificate
and private key from memory instead of from the filesystem.
Initialisation and Termination of context
bye :: MonadIO m => Context -> m ()Source
notify the context that this side wants to close connection. this is important that it is called before closing the handle, otherwise the session might not be resumable (for version < TLS1.2).
this doesn't actually close the handle
handshake :: MonadIO m => Context -> m ()Source
Handshake for a new TLS connection This is to be called at the beginning of a connection, and during renegotiation
Next Protocol Negotiation
getNegotiatedProtocol :: MonadIO m => Context -> m (Maybe ByteString)Source
If the Next Protocol Negotiation extension has been used, this will return get the protocol agreed upon.
High level API
sendData :: MonadIO m => Context -> ByteString -> m ()Source
sendData sends a bunch of data. It will automatically chunk data to acceptable packet size
recvData :: MonadIO m => Context -> m ByteStringSource
recvData get data out of Data packet, and automatically renegotiate if a Handshake ClientHello is received
recvData' :: MonadIO m => Context -> m ByteStringSource
Deprecated: use recvData that returns strict bytestring
same as recvData but returns a lazy bytestring.
Crypto Key
data PubKey
Public key types known and used in X.509
Constructors
| PubKeyRSA PublicKey | RSA public key |
| PubKeyDSA PublicKey | DSA public key |
| PubKeyDH (Integer, Integer, Integer, Maybe Integer, ([Word8], Integer)) | DH format with (p,g,q,j,(seed,pgenCounter)) |
| PubKeyECDSA CurveName ByteString | |
| PubKeyUnknown OID ByteString | unrecognized format |
data PrivKey
Private key types known and used in X.509
Constructors
| PrivKeyRSA PrivateKey | RSA private key |
| PrivKeyDSA PrivateKey | DSA private key |
Compressions & Predefined compressions
class CompressionC a whereSource
supported compression algorithms need to be part of this class
Methods
compressionCID :: a -> CompressionIDSource
compressionCDeflate :: a -> ByteString -> (a, ByteString)Source
compressionCInflate :: a -> ByteString -> (a, ByteString)Source
data Compression Source
every compression need to be wrapped in this, to fit in structure
Constructors
| forall a . CompressionC a => Compression a |
Instances
type CompressionID = Word8Source
Compression identification
nullCompression :: CompressionSource
default null compression
data NullCompression Source
This is the default compression which is a NOOP.
member redefined for the class abstraction
compressionID :: Compression -> CompressionIDSource
return the associated ID for this algorithm
compressionDeflate :: ByteString -> Compression -> (Compression, ByteString)Source
deflate (compress) a bytestring using a compression context and return the result along with the new compression context.
compressionInflate :: ByteString -> Compression -> (Compression, ByteString)Source
inflate (decompress) a bytestring using a compression context and return the result along the new compression context.
helper
compressionIntersectID :: [Compression] -> [Word8] -> [Compression]Source
intersect a list of ids commonly given by the other side with a list of compression the function keeps the list of compression in order, to be able to find quickly the prefered compression.
Ciphers & Predefined ciphers
data BulkFunctions Source
Constructors
| BulkBlockF (Key -> IV -> ByteString -> ByteString) (Key -> IV -> ByteString -> ByteString) | |
| BulkStreamF (Key -> IV) (IV -> ByteString -> (ByteString, IV)) (IV -> ByteString -> (ByteString, IV)) |
data CipherKeyExchangeType Source
Constructors
Instances
Constructors
| Bulk | |
Fields
| |
Constructors
| Hash | |
Fields
| |
Cipher algorithm
Constructors
| Cipher | |
Fields | |
type Key = ByteStringSource
type IV = ByteStringSource
cipherAllowedForVersion :: Version -> Cipher -> BoolSource
Check if a specific Cipher is allowed to be used
with the version specified
Versions
Versions known to TLS
SSL2 is just defined, but this version is and will not be supported.
Errors
TLSError that might be returned through the TLS stack
Constructors
| Error_Misc String | mainly for instance of Error |
| Error_Protocol (String, Bool, AlertDescription) | |
| Error_Certificate String | |
| Error_HandshakePolicy String | handshake policy failed. |
| Error_EOF | |
| Error_Packet String | |
| Error_Packet_unexpected String String | |
| Error_Packet_Parsing String |
data AlertDescription Source
Constructors
Instances
Exceptions
data TLSException Source
TLS Exceptions related to bad user usage or asynchronous errors
Constructors
| Terminated Bool String TLSError | Early termination exception with the reason and the error associated |
| HandshakeFailed TLSError | Handshake failed for the reason attached |
| ConnectionNotEstablished | Usage error when the connection has not been established and the user is trying to send or receive data |
X509 Validation
data ValidationChecks
A set of checks to activate or parametrize to perform on certificates.
It's recommended to use defaultChecks to create the structure,
to better cope with future changes or expansion of the structure.
Constructors
| ValidationChecks | |
Fields
| |
data ValidationHooks
A set of hooks to manipulate the way the verification works.
BEWARE, it's easy to change behavior leading to compromised security.
Constructors
| ValidationHooks | |
Fields
| |
Instances
X509 Validation Cache
data ValidationCache
All the callbacks needed for querying and adding to the cache.
Constructors
| ValidationCache | |
Fields
| |
Instances
The result of a cache query
Constructors
| ValidationCachePass | cache allow this fingerprint to go through |
| ValidationCacheDenied String | cache denied this fingerprint for further validation |
| ValidationCacheUnknown | unknown fingerprint in cache |
Instances
exceptionValidationCache :: [(ServiceID, Fingerprint)] -> ValidationCache
create a simple constant cache that list exceptions to the certification validation. Typically this is use to allow self-signed certificates for specific use, with out-of-bounds user checks.
No fingerprints will be added after the instance is created.
The underlying structure for the check is kept as a list, as usually the exception list will be short, but when the list go above a dozen exceptions it's recommended to use another cache mechanism with a faster lookup mechanism (hashtable, map, etc).
Note that only one fingerprint is allowed per ServiceID, for other use, another cache mechanism need to be use.