Network.TLS

tls-1.3.8: TLS/SSL protocol native implementation (Server and Client)

License | BSD-style
Maintainer | Vincent Hanquez <vincent@snarc.org>
Stability | experimental
Portability | unknown
Safe Haskell | None
Language | Haskell98

Network.TLS

Contents

- Context configuration
- raw types
- Session
- Backend abstraction
- Context object
- Creating a context
- Information gathering
- Credentials
- Initialisation and Termination of context
- Next Protocol Negotiation
- Server Name Indication
- High level API
- Crypto Key
- Compressions & Predefined compressions
- member redefined for the class abstraction
- helper
- Ciphers & Predefined ciphers
- Versions
- Errors
- Exceptions
- X509 Validation
- X509 Validation Cache

Description

Synopsis

- data ClientParams = ClientParams {
  - clientUseMaxFragmentLength :: Maybe MaxFragmentEnum
  - clientServerIdentification :: (HostName, Bytes)
  - clientUseServerNameIndication :: Bool
  - clientWantSessionResume :: Maybe (SessionID, SessionData)
  - clientShared :: Shared
  - clientHooks :: ClientHooks
  - clientSupported :: Supported
  - clientDebug :: DebugParams
  }
- data ServerParams = ServerParams {
  - serverWantClientCert :: Bool
  - serverCACertificates :: [SignedCertificate]
  - serverDHEParams :: Maybe DHParams
  - serverShared :: Shared
  - serverHooks :: ServerHooks
  - serverSupported :: Supported
  - serverDebug :: DebugParams
  }
- data DebugParams = DebugParams {
  - debugSeed :: Maybe Seed
  - debugPrintSeed :: Seed -> IO ()
  }
- data ClientHooks = ClientHooks {
  - onCertificateRequest :: ([CertificateType], Maybe [HashAndSignatureAlgorithm], [DistinguishedName]) -> IO (Maybe (CertificateChain, PrivKey))
  - onNPNServerSuggest :: Maybe ([ByteString] -> IO ByteString)
  - onServerCertificate :: CertificateStore -> ValidationCache -> ServiceID -> CertificateChain -> IO [FailedReason]
  - onSuggestALPN :: IO (Maybe [ByteString])
  }
- data ServerHooks = ServerHooks {
  - onClientCertificate :: CertificateChain -> IO CertificateUsage
  - onUnverifiedClientCert :: IO Bool
  - onCipherChoosing :: Version -> [Cipher] -> Cipher
  - onServerNameIndication :: Maybe HostName -> IO Credentials
  - onSuggestNextProtocols :: IO (Maybe [ByteString])
  - onNewHandshake :: Measurement -> IO Bool
  - onALPNClientSuggest :: Maybe ([ByteString] -> IO ByteString)
  }
- data Supported = Supported {
  - supportedVersions :: [Version]
  - supportedCiphers :: [Cipher]
  - supportedCompressions :: [Compression]
  - supportedHashSignatures :: [HashAndSignatureAlgorithm]
  - supportedSecureRenegotiation :: Bool
  - supportedClientInitiatedRenegotiation :: Bool
  - supportedSession :: Bool
  - supportedFallbackScsv :: Bool
  - supportedEmptyPacket :: Bool
  }
- data Shared = Shared {
  - sharedCredentials :: Credentials
  - sharedSessionManager :: SessionManager
  - sharedCAStore :: CertificateStore
  - sharedValidationCache :: ValidationCache
  }
- data Hooks = Hooks {
  - hookRecvHandshake :: Handshake -> IO Handshake
  - hookRecvCertificates :: CertificateChain -> IO ()
  - hookLogging :: Logging
  }
- data Logging = Logging {
  - loggingPacketSent :: String -> IO ()
  - loggingPacketRecv :: String -> IO ()
  - loggingIOSent :: ByteString -> IO ()
  - loggingIORecv :: Header -> ByteString -> IO ()
  }
- data Measurement = Measurement {
  - nbHandshakes :: !Word32
  - bytesReceived :: !Word32
  - bytesSent :: !Word32
  }
- data CertificateUsage
  - = CertificateUsageAccept
  - | CertificateUsageReject CertificateRejectReason
- data CertificateRejectReason
  - = CertificateRejectExpired
  - | CertificateRejectRevoked
  - | CertificateRejectUnknownCA
  - | CertificateRejectOther String
- defaultParamsClient :: HostName -> Bytes -> ClientParams
- data MaxFragmentEnum
  - = MaxFragment512
  - | MaxFragment1024
  - | MaxFragment2048
  - | MaxFragment4096
- type HashAndSignatureAlgorithm = (HashAlgorithm, SignatureAlgorithm)
- data HashAlgorithm
  - = HashNone
  - | HashMD5
  - | HashSHA1
  - | HashSHA224
  - | HashSHA256
  - | HashSHA384
  - | HashSHA512
  - | HashOther Word8
- data SignatureAlgorithm
  - = SignatureAnonymous
  - | SignatureRSA
  - | SignatureDSS
  - | SignatureECDSA
  - | SignatureOther Word8
- data CertificateType
  - = CertificateType_RSA_Sign
  - | CertificateType_DSS_Sign
  - | CertificateType_RSA_Fixed_DH
  - | CertificateType_DSS_Fixed_DH
  - | CertificateType_RSA_Ephemeral_DH
  - | CertificateType_DSS_Ephemeral_DH
  - | CertificateType_fortezza_dms
  - | CertificateType_Unknown Word8
- data ProtocolType
  - = ProtocolType_ChangeCipherSpec
  - | ProtocolType_Alert
  - | ProtocolType_Handshake
  - | ProtocolType_AppData
  - | ProtocolType_DeprecatedHandshake
- data Header = Header ProtocolType Version Word16
- type SessionID = ByteString
- data SessionData = SessionData {
  - sessionVersion :: Version
  - sessionCipher :: CipherID
  - sessionSecret :: ByteString
  }
- data SessionManager = SessionManager {
  - sessionResume :: SessionID -> IO (Maybe SessionData)
  - sessionEstablish :: SessionID -> SessionData -> IO ()
  - sessionInvalidate :: SessionID -> IO ()
  }
- noSessionManager :: SessionManager
- data Backend = Backend {
  - backendFlush :: IO ()
  - backendClose :: IO ()
  - backendSend :: ByteString -> IO ()
  - backendRecv :: Int -> IO ByteString
  }
- data Context
- ctxConnection :: Context -> Backend
- class TLSParams a
- class HasBackend a
- contextNew :: (MonadIO m, HasBackend backend, TLSParams params) => backend -> params -> m Context
- contextNewOnHandle :: (MonadIO m, TLSParams params) => Handle -> params -> m Context
- contextNewOnSocket :: (MonadIO m, TLSParams params) => Socket -> params -> m Context
- contextFlush :: Context -> IO ()
- contextClose :: Context -> IO ()
- contextHookSetHandshakeRecv :: Context -> (Handshake -> IO Handshake) -> IO ()
- contextHookSetCertificateRecv :: Context -> (CertificateChain -> IO ()) -> IO ()
- contextHookSetLogging :: Context -> Logging -> IO ()
- contextModifyHooks :: Context -> (Hooks -> Hooks) -> IO ()
- data Information = Information {
  - infoVersion :: Version
  - infoCipher :: Cipher
  - infoCompression :: Compression
  - infoMasterSecret :: Maybe Bytes
  - infoClientRandom :: Maybe ClientRandom
  - infoServerRandom :: Maybe ServerRandom
  }
- unClientRandom :: ClientRandom -> Bytes
- unServerRandom :: ServerRandom -> Bytes
- contextGetInformation :: Context -> IO (Maybe Information)
- newtype Credentials = Credentials [Credential]
- type Credential = (CertificateChain, PrivKey)
- credentialLoadX509 :: FilePath -> FilePath -> IO (Either String Credential)
- credentialLoadX509FromMemory :: Bytes -> Bytes -> Either String Credential
- credentialLoadX509Chain :: FilePath -> [FilePath] -> FilePath -> IO (Either String Credential)
- credentialLoadX509ChainFromMemory :: Bytes -> [Bytes] -> Bytes -> Either String Credential
- bye :: MonadIO m => Context -> m ()
- handshake :: MonadIO m => Context -> m ()
- getNegotiatedProtocol :: MonadIO m => Context -> m (Maybe ByteString)
- getClientSNI :: MonadIO m => Context -> m (Maybe HostName)
- sendData :: MonadIO m => Context -> ByteString -> m ()
- recvData :: MonadIO m => Context -> m ByteString
- recvData' :: MonadIO m => Context -> m ByteString
- data PubKey :: *
  - = PubKeyRSA PublicKey
  - | PubKeyDSA PublicKey
  - | PubKeyDH (Integer, Integer, Integer, Maybe Integer, ([Word8], Integer))
  - | PubKeyEC PubKeyEC
  - | PubKeyUnknown OID ByteString
- data PrivKey :: *
  - = PrivKeyRSA PrivateKey
  - | PrivKeyDSA PrivateKey
- class CompressionC a where
- data Compression = CompressionC a => Compression a
- type CompressionID = Word8
- nullCompression :: Compression
- data NullCompression
- compressionID :: Compression -> CompressionID
- compressionDeflate :: ByteString -> Compression -> (Compression, ByteString)
- compressionInflate :: ByteString -> Compression -> (Compression, ByteString)
- compressionIntersectID :: [Compression] -> [Word8] -> [Compression]
- data CipherKeyExchangeType
  - = CipherKeyExchange_RSA
  - | CipherKeyExchange_DH_Anon
  - | CipherKeyExchange_DHE_RSA
  - | CipherKeyExchange_ECDHE_RSA
  - | CipherKeyExchange_DHE_DSS
  - | CipherKeyExchange_DH_DSS
  - | CipherKeyExchange_DH_RSA
  - | CipherKeyExchange_ECDH_ECDSA
  - | CipherKeyExchange_ECDH_RSA
  - | CipherKeyExchange_ECDHE_ECDSA
- data Bulk = Bulk {
  - bulkName :: String
  - bulkKeySize :: Int
  - bulkIVSize :: Int
  - bulkExplicitIV :: Int
  - bulkAuthTagLen :: Int
  - bulkBlockSize :: Int
  - bulkF :: BulkFunctions
  }
- data BulkFunctions
  - = BulkBlockF (BulkDirection -> BulkKey -> BulkBlock)
  - | BulkStreamF (BulkDirection -> BulkKey -> BulkStream)
  - | BulkAeadF (BulkDirection -> BulkKey -> BulkAEAD)
- data BulkDirection
  - = BulkEncrypt
  - | BulkDecrypt
- data BulkState
  - = BulkStateStream BulkStream
  - | BulkStateBlock BulkBlock
  - | BulkStateAEAD BulkAEAD
  - | BulkStateUninitialized
- newtype BulkStream = BulkStream (ByteString -> (ByteString, BulkStream))
- type BulkBlock = BulkIV -> ByteString -> (ByteString, BulkIV)
- type BulkAEAD = BulkNonce -> ByteString -> BulkAdditionalData -> (ByteString, AuthTag)
- bulkInit :: Bulk -> BulkDirection -> BulkKey -> BulkState
- data Hash
  - = MD5
  - | SHA1
  - | SHA224
  - | SHA256
  - | SHA384
  - | SHA512
  - | SHA1_MD5
- data Cipher = Cipher {
  - cipherID :: CipherID
  - cipherName :: String
  - cipherHash :: Hash
  - cipherBulk :: Bulk
  - cipherKeyExchange :: CipherKeyExchangeType
  - cipherMinVer :: Maybe Version
  }
- type CipherID = Word16
- cipherKeyBlockSize :: Cipher -> Int
- type BulkKey = ByteString
- type BulkIV = ByteString
- type BulkNonce = ByteString
- type BulkAdditionalData = ByteString
- cipherAllowedForVersion :: Version -> Cipher -> Bool
- cipherExchangeNeedMoreData :: CipherKeyExchangeType -> Bool
- hasMAC :: BulkFunctions -> Bool
- hasRecordIV :: BulkFunctions -> Bool
- data Version
  - = SSL2
  - | SSL3
  - | TLS10
  - | TLS11
  - | TLS12
- data TLSError
  - = Error_Misc String
  - | Error_Protocol (String, Bool, AlertDescription)
  - | Error_Certificate String
  - | Error_HandshakePolicy String
  - | Error_EOF
  - | Error_Packet String
  - | Error_Packet_unexpected String String
  - | Error_Packet_Parsing String
- data KxError
  - = RSAError Error
  - | KxUnsupported
- data AlertDescription
  - = CloseNotify
  - | UnexpectedMessage
  - | BadRecordMac
  - | DecryptionFailed
  - | RecordOverflow
  - | DecompressionFailure
  - | HandshakeFailure
  - | BadCertificate
  - | UnsupportedCertificate
  - | CertificateRevoked
  - | CertificateExpired
  - | CertificateUnknown
  - | IllegalParameter
  - | UnknownCa
  - | AccessDenied
  - | DecodeError
  - | DecryptError
  - | ExportRestriction
  - | ProtocolVersion
  - | InsufficientSecurity
  - | InternalError
  - | InappropriateFallback
  - | UserCanceled
  - | NoRenegotiation
  - | UnsupportedExtension
  - | CertificateUnobtainable
  - | UnrecognizedName
  - | BadCertificateStatusResponse
  - | BadCertificateHashValue
- data TLSException
  - = Terminated Bool String TLSError
  - | HandshakeFailed TLSError
  - | ConnectionNotEstablished
- data ValidationChecks :: * = ValidationChecks {
  - checkTimeValidity :: Bool
  - checkAtTime :: Maybe DateTime
  - checkStrictOrdering :: Bool
  - checkCAConstraints :: Bool
  - checkExhaustive :: Bool
  - checkLeafV3 :: Bool
  - checkLeafKeyUsage :: [ExtKeyUsageFlag]
  - checkLeafKeyPurpose :: [ExtKeyUsagePurpose]
  - checkFQHN :: Bool
  }
- data ValidationHooks :: * = ValidationHooks {
  - hookMatchSubjectIssuer :: DistinguishedName -> Certificate -> Bool
  - hookValidateTime :: DateTime -> Certificate -> [FailedReason]
  - hookValidateName :: HostName -> Certificate -> [FailedReason]
  - hookFilterReason :: [FailedReason] -> [FailedReason]
  }
- data ValidationCache :: * = ValidationCache {
  - cacheQuery :: ValidationCacheQueryCallback
  - cacheAdd :: ValidationCacheAddCallback
  }
- data ValidationCacheResult :: *
  - = ValidationCachePass
  - | ValidationCacheDenied String
  - | ValidationCacheUnknown
- exceptionValidationCache :: [(ServiceID, Fingerprint)] -> ValidationCache

# Context configuration

data ClientParams #

Constructors

ClientParams |
Fields clientUseMaxFragmentLength :: Maybe MaxFragmentEnum clientServerIdentification :: (HostName, Bytes) Define the name of the server, along with an extra service identification blob. this is important that the hostname part is properly filled for security reason, as it allow to properly associate the remote side with the given certificate during a handshake. The extra blob is useful to differentiate services running on the same host, but that might have different certificates given. It's only used as part of the X509 validation infrastructure. clientUseServerNameIndication :: Bool Allow the use of the Server Name Indication TLS extension during handshake, which allow the client to specify which host name, it's trying to access. This is useful to distinguish CNAME aliasing (e.g. web virtual host). clientWantSessionResume :: Maybe (SessionID, SessionData) try to establish a connection using this session. clientShared :: Shared clientHooks :: ClientHooks clientSupported :: Supported clientDebug :: DebugParams

Instances

Show ClientParams # |
Methods showsPrec :: Int -> ClientParams -> ShowS # show :: ClientParams -> String # showList :: [ClientParams] -> ShowS #
TLSParams ClientParams # |
Methods getTLSCommonParams :: ClientParams -> CommonParams getTLSRole :: ClientParams -> Role getCiphers :: ClientParams -> [Cipher] doHandshake :: ClientParams -> Context -> IO () doHandshakeWith :: ClientParams -> Context -> Handshake -> IO ()

data ServerParams #

Constructors

ServerParams |
Fields serverWantClientCert :: Bool request a certificate from client. serverCACertificates :: [SignedCertificate] This is a list of certificates from which the disinguished names are sent in certificate request messages. For TLS1.0, it should not be empty. serverDHEParams :: Maybe DHParams Server Optional Diffie Hellman parameters. If this value is not properly set, no Diffie Hellman key exchange will take place. serverShared :: Shared serverHooks :: ServerHooks serverSupported :: Supported serverDebug :: DebugParams

Instances

Show ServerParams # |
Methods showsPrec :: Int -> ServerParams -> ShowS # show :: ServerParams -> String # showList :: [ServerParams] -> ShowS #
Default ServerParams # |
Methods def :: ServerParams #
TLSParams ServerParams # |
Methods getTLSCommonParams :: ServerParams -> CommonParams getTLSRole :: ServerParams -> Role getCiphers :: ServerParams -> [Cipher] doHandshake :: ServerParams -> Context -> IO () doHandshakeWith :: ServerParams -> Context -> Handshake -> IO ()

data DebugParams #

All settings should not be used in production

Constructors

DebugParams |
Fields debugSeed :: Maybe Seed Disable the true randomness in favor of deterministic seed that will produce a deterministic random from. This is useful for tests and debugging purpose. Do not use in production debugPrintSeed :: Seed -> IO () Add a way to print the seed that was randomly generated. re-using the same seed will reproduce the same randomness with `debugSeed`

Instances

Show DebugParams # |
Methods showsPrec :: Int -> DebugParams -> ShowS # show :: DebugParams -> String # showList :: [DebugParams] -> ShowS #
Default DebugParams # |
Methods def :: DebugParams #

data ClientHooks #

A set of callbacks run by the clients for various corners of TLS establishment

Constructors

ClientHooks |
Fields onCertificateRequest :: ([CertificateType], Maybe [HashAndSignatureAlgorithm], [DistinguishedName]) -> IO (Maybe (CertificateChain, PrivKey)) This action is called when the server sends a certificate request. The parameter is the information from the request. The action should select a certificate chain of one of the given certificate types where the last certificate in the chain should be signed by one of the given distinguished names. Each certificate should be signed by the following one, except for the last. At least the first of the certificates in the chain must have a corresponding private key, because that is used for signing the certificate verify message. Note that is is the responsibility of this action to select a certificate matching one of the requested certificate types. Returning a non-matching one will lead to handshake failure later. Returning a certificate chain not matching the distinguished names may lead to problems or not, depending whether the server accepts it. onNPNServerSuggest :: Maybe ([ByteString] -> IO ByteString) onServerCertificate :: CertificateStore -> ValidationCache -> ServiceID -> CertificateChain -> IO [FailedReason] onSuggestALPN :: IO (Maybe [ByteString])

Instances

Show ClientHooks # |
Methods showsPrec :: Int -> ClientHooks -> ShowS # show :: ClientHooks -> String # showList :: [ClientHooks] -> ShowS #
Default ClientHooks # |
Methods def :: ClientHooks #

data ServerHooks #

A set of callbacks run by the server for various corners of the TLS establishment

Constructors

ServerHooks |
Fields onClientCertificate :: CertificateChain -> IO CertificateUsage This action is called when a client certificate chain is received from the client. When it returns a CertificateUsageReject value, the handshake is aborted. onUnverifiedClientCert :: IO Bool This action is called when the client certificate cannot be verified. A `Nothing` argument indicates a wrong signature, a 'Just e' message signals a crypto error. onCipherChoosing :: Version -> [Cipher] -> Cipher Allow the server to choose the cipher relative to the the client version and the client list of ciphers. This could be useful with old clients and as a workaround to the BEAST (where RC4 is sometimes prefered with TLS < 1.1) The client cipher list cannot be empty. onServerNameIndication :: Maybe HostName -> IO Credentials Allow the server to indicate additional credentials to be used depending on the host name indicated by the client. This is most useful for transparent proxies where credentials must be generated on the fly according to the host the client is trying to connect to. onSuggestNextProtocols :: IO (Maybe [ByteString]) suggested next protocols accoring to the next protocol negotiation extension. onNewHandshake :: Measurement -> IO Bool at each new handshake, we call this hook to see if we allow handshake to happens. onALPNClientSuggest :: Maybe ([ByteString] -> IO ByteString)

Instances

Show ServerHooks # |
Methods showsPrec :: Int -> ServerHooks -> ShowS # show :: ServerHooks -> String # showList :: [ServerHooks] -> ShowS #
Default ServerHooks # |
Methods def :: ServerHooks #

data Supported #

List all the supported algorithms, versions, ciphers, etc supported.

Constructors

Supported |
Fields supportedVersions :: [Version] Supported Versions by this context On the client side, the highest version will be used to establish the connection. On the server side, the highest version that is less or equal than the client version will be chosed. supportedCiphers :: [Cipher] Supported cipher methods supportedCompressions :: [Compression] supported compressions methods supportedHashSignatures :: [HashAndSignatureAlgorithm] All supported hash/signature algorithms pair for client certificate verification, ordered by decreasing priority. supportedSecureRenegotiation :: Bool Secure renegotiation defined in RFC5746. If `True`, clients send the renegotiation_info extension. If `True`, servers handle the extension or the renegotiation SCSV then send the renegotiation_info extension. supportedClientInitiatedRenegotiation :: Bool If `True`, renegotiation is allowed from the client side. This is vulnerable to DOS attacks. If `False`, renegotiation is allowed only from the server side via HelloRequest. supportedSession :: Bool Set if we support session. supportedFallbackScsv :: Bool Support for fallback SCSV defined in RFC7507. If `True`, servers reject handshakes which suggest a lower protocol than the highest protocol supported. supportedEmptyPacket :: Bool In ver <= TLS1.0, block ciphers using CBC are using CBC residue as IV, which can be guessed by an attacker. Hence, an empty packet is normally sent before a normal data packet, to prevent guessability. Some Microsoft TLS-based protocol implementations, however, consider these empty packets as a protocol violation and disconnect. If this parameter is `False`, empty packets will never be added, which is less secure, but might help in rare cases.

Instances

Eq Supported # |
Methods (==) :: Supported -> Supported -> Bool # (/=) :: Supported -> Supported -> Bool #
Show Supported # |
Methods showsPrec :: Int -> Supported -> ShowS # show :: Supported -> String # showList :: [Supported] -> ShowS #
Default Supported # |
Methods def :: Supported #

data Shared #

Constructors

Shared |
Fields sharedCredentials :: Credentials sharedSessionManager :: SessionManager sharedCAStore :: CertificateStore sharedValidationCache :: ValidationCache

Instances

Show Shared # |
Methods showsPrec :: Int -> Shared -> ShowS # show :: Shared -> String # showList :: [Shared] -> ShowS #
Default Shared # |
Methods def :: Shared #

data Hooks #

A collection of hooks actions.

Constructors

Hooks |
Fields hookRecvHandshake :: Handshake -> IO Handshake called at each handshake message received hookRecvCertificates :: CertificateChain -> IO () called at each certificate chain message received hookLogging :: Logging hooks on IO and packets, receiving and sending.

Instances

Default Hooks # |
Methods def :: Hooks #

data Logging #

Hooks for logging

This is called when sending and receiving packets and IO

Constructors

Logging |
Fields loggingPacketSent :: String -> IO () loggingPacketRecv :: String -> IO () loggingIOSent :: ByteString -> IO () loggingIORecv :: Header -> ByteString -> IO ()

Instances

Default Logging # |
Methods def :: Logging #

data Measurement #

record some data about this connection.

Constructors

Measurement |
Fields nbHandshakes :: !Word32 number of handshakes on this context bytesReceived :: !Word32 bytes received since last handshake bytesSent :: !Word32 bytes sent since last handshake

Instances

Eq Measurement # |
Methods (==) :: Measurement -> Measurement -> Bool # (/=) :: Measurement -> Measurement -> Bool #
Show Measurement # |
Methods showsPrec :: Int -> Measurement -> ShowS # show :: Measurement -> String # showList :: [Measurement] -> ShowS #

data CertificateUsage #

Certificate Usage callback possible returns values.

Constructors

CertificateUsageAccept | usage of certificate accepted
CertificateUsageReject CertificateRejectReason | usage of certificate rejected

Instances

Eq CertificateUsage # |
Methods (==) :: CertificateUsage -> CertificateUsage -> Bool # (/=) :: CertificateUsage -> CertificateUsage -> Bool #
Show CertificateUsage # |
Methods showsPrec :: Int -> CertificateUsage -> ShowS # show :: CertificateUsage -> String # showList :: [CertificateUsage] -> ShowS #

data CertificateRejectReason #

Certificate and Chain rejection reason

Constructors

CertificateRejectExpired |
CertificateRejectRevoked |
CertificateRejectUnknownCA |
CertificateRejectOther String |

Instances

Eq CertificateRejectReason # |
Methods (==) :: CertificateRejectReason -> CertificateRejectReason -> Bool # (/=) :: CertificateRejectReason -> CertificateRejectReason -> Bool #
Show CertificateRejectReason # |
Methods showsPrec :: Int -> CertificateRejectReason -> ShowS # show :: CertificateRejectReason -> String # showList :: [CertificateRejectReason] -> ShowS #

defaultParamsClient :: HostName -> Bytes -> ClientParams #

data MaxFragmentEnum #

Constructors

MaxFragment512 |
MaxFragment1024 |
MaxFragment2048 |
MaxFragment4096 |

Instances

Eq MaxFragmentEnum # |
Methods (==) :: MaxFragmentEnum -> MaxFragmentEnum -> Bool # (/=) :: MaxFragmentEnum -> MaxFragmentEnum -> Bool #
Show MaxFragmentEnum # |
Methods showsPrec :: Int -> MaxFragmentEnum -> ShowS # show :: MaxFragmentEnum -> String # showList :: [MaxFragmentEnum] -> ShowS #

type HashAndSignatureAlgorithm = (HashAlgorithm, SignatureAlgorithm) #

data HashAlgorithm #

Constructors

HashNone |
HashMD5 |
HashSHA1 |
HashSHA224 |
HashSHA256 |
HashSHA384 |
HashSHA512 |
HashOther Word8 |

Instances

Eq HashAlgorithm # |
Methods (==) :: HashAlgorithm -> HashAlgorithm -> Bool # (/=) :: HashAlgorithm -> HashAlgorithm -> Bool #
Show HashAlgorithm # |
Methods showsPrec :: Int -> HashAlgorithm -> ShowS # show :: HashAlgorithm -> String # showList :: [HashAlgorithm] -> ShowS #

data SignatureAlgorithm #

Constructors

SignatureAnonymous |
SignatureRSA |
SignatureDSS |
SignatureECDSA |
SignatureOther Word8 |

Instances

Eq SignatureAlgorithm # |
Methods (==) :: SignatureAlgorithm -> SignatureAlgorithm -> Bool # (/=) :: SignatureAlgorithm -> SignatureAlgorithm -> Bool #
Show SignatureAlgorithm # |
Methods showsPrec :: Int -> SignatureAlgorithm -> ShowS # show :: SignatureAlgorithm -> String # showList :: [SignatureAlgorithm] -> ShowS #

data CertificateType #

Constructors

CertificateType_RSA_Sign |
CertificateType_DSS_Sign |
CertificateType_RSA_Fixed_DH |
CertificateType_DSS_Fixed_DH |
CertificateType_RSA_Ephemeral_DH |
CertificateType_DSS_Ephemeral_DH |
CertificateType_fortezza_dms |
CertificateType_Unknown Word8 |

Instances

Eq CertificateType # |
Methods (==) :: CertificateType -> CertificateType -> Bool # (/=) :: CertificateType -> CertificateType -> Bool #
Show CertificateType # |
Methods showsPrec :: Int -> CertificateType -> ShowS # show :: CertificateType -> String # showList :: [CertificateType] -> ShowS #

# raw types

data ProtocolType #

Constructors

ProtocolType_ChangeCipherSpec |
ProtocolType_Alert |
ProtocolType_Handshake |
ProtocolType_AppData |
ProtocolType_DeprecatedHandshake |

Instances

Eq ProtocolType # |
Methods (==) :: ProtocolType -> ProtocolType -> Bool # (/=) :: ProtocolType -> ProtocolType -> Bool #
Show ProtocolType # |
Methods showsPrec :: Int -> ProtocolType -> ShowS # show :: ProtocolType -> String # showList :: [ProtocolType] -> ShowS #

data Header #

Constructors

Header ProtocolType Version Word16 |

Instances

Eq Header # |
Methods (==) :: Header -> Header -> Bool # (/=) :: Header -> Header -> Bool #
Show Header # |
Methods showsPrec :: Int -> Header -> ShowS # show :: Header -> String # showList :: [Header] -> ShowS #

# Session

type SessionID = ByteString #

A session ID

data SessionData #

Session data to resume

Constructors

SessionData |
Fields sessionVersion :: Version sessionCipher :: CipherID sessionSecret :: ByteString

Instances

Eq SessionData # |
Methods (==) :: SessionData -> SessionData -> Bool # (/=) :: SessionData -> SessionData -> Bool #
Show SessionData # |
Methods showsPrec :: Int -> SessionData -> ShowS # show :: SessionData -> String # showList :: [SessionData] -> ShowS #

data SessionManager #

A session manager

Constructors

SessionManager |
Fields sessionResume :: SessionID -> IO (Maybe SessionData) used on server side to decide whether to resume a client session. sessionEstablish :: SessionID -> SessionData -> IO () used when a session is established. sessionInvalidate :: SessionID -> IO () used when a session is invalidated.

noSessionManager :: SessionManager #

# Backend abstraction

data Backend #

Connection IO backend

Constructors

Backend |
Fields backendFlush :: IO () Flush the connection sending buffer, if any. backendClose :: IO () Close the connection. backendSend :: ByteString -> IO () Send a bytestring through the connection. backendRecv :: Int -> IO ByteString Receive specified number of bytes from the connection.

Instances

HasBackend Backend # |
Methods initializeBackend :: Backend -> IO () getBackend :: Backend -> Backend

# Context object

data Context #

A TLS Context keep tls specific state, parameters and backend information.

ctxConnection :: Context -> Backend #

return the backend object associated with this context

class TLSParams a #

Minimal complete definition

getTLSCommonParams, getTLSRole, getCiphers, doHandshake, doHandshakeWith

Instances

TLSParams ServerParams # |
Methods getTLSCommonParams :: ServerParams -> CommonParams getTLSRole :: ServerParams -> Role getCiphers :: ServerParams -> [Cipher] doHandshake :: ServerParams -> Context -> IO () doHandshakeWith :: ServerParams -> Context -> Handshake -> IO ()
TLSParams ClientParams # |
Methods getTLSCommonParams :: ClientParams -> CommonParams getTLSRole :: ClientParams -> Role getCiphers :: ClientParams -> [Cipher] doHandshake :: ClientParams -> Context -> IO () doHandshakeWith :: ClientParams -> Context -> Handshake -> IO ()

class HasBackend a #

Minimal complete definition

initializeBackend, getBackend

Instances

HasBackend Handle # |
Methods initializeBackend :: Handle -> IO () getBackend :: Handle -> Backend
HasBackend Socket # |
Methods initializeBackend :: Socket -> IO () getBackend :: Socket -> Backend
HasBackend Backend # |
Methods initializeBackend :: Backend -> IO () getBackend :: Backend -> Backend

# Creating a context

contextNew #

Arguments

:: (MonadIO m, HasBackend backend, TLSParams params) |
=> backend | Backend abstraction with specific method to interact with the connection type.
-> params | Parameters of the context.
-> m Context |

create a new context using the backend and parameters specified.

contextNewOnHandle #

Arguments

:: (MonadIO m, TLSParams params) |
=> Handle | Handle of the connection.
-> params | Parameters of the context.
-> m Context |

Deprecated: use contextNew

create a new context on an handle.

contextNewOnSocket #

Arguments

:: (MonadIO m, TLSParams params) |
=> Socket | Socket of the connection.
-> params | Parameters of the context.
-> m Context |

Deprecated: use contextNew

create a new context on a socket.

contextFlush :: Context -> IO () #

contextClose :: Context -> IO () #

contextHookSetHandshakeRecv :: Context -> (Handshake -> IO Handshake) -> IO () #

contextHookSetCertificateRecv :: Context -> (CertificateChain -> IO ()) -> IO () #

contextHookSetLogging :: Context -> Logging -> IO () #

contextModifyHooks :: Context -> (Hooks -> Hooks) -> IO () #

# Information gathering

data Information #

Information related to a running context, e.g. current cipher

Constructors

Information |
Fields infoVersion :: Version infoCipher :: Cipher infoCompression :: Compression infoMasterSecret :: Maybe Bytes infoClientRandom :: Maybe ClientRandom infoServerRandom :: Maybe ServerRandom

Instances

Eq Information # |
Methods (==) :: Information -> Information -> Bool # (/=) :: Information -> Information -> Bool #
Show Information # |
Methods showsPrec :: Int -> Information -> ShowS # show :: Information -> String # showList :: [Information] -> ShowS #

unClientRandom :: ClientRandom -> Bytes #

unServerRandom :: ServerRandom -> Bytes #

contextGetInformation :: Context -> IO (Maybe Information) #

Information about the current context

# Credentials

newtype Credentials #

Constructors

Credentials [Credential] |

Instances

Monoid Credentials # |
Methods mempty :: Credentials # mappend :: Credentials -> Credentials -> Credentials # mconcat :: [Credentials] -> Credentials #

type Credential = (CertificateChain, PrivKey) #

credentialLoadX509 #

Arguments

:: FilePath | public certificate (X.509 format)
-> FilePath | private key associated
-> IO (Either String Credential) |

try to create a new credential object from a public certificate and the associated private key that are stored on the filesystem in PEM format.

credentialLoadX509FromMemory :: Bytes -> Bytes -> Either String Credential #

similar to `credentialLoadX509` but take the certificate and private key from memory instead of from the filesystem.

credentialLoadX509Chain #

Arguments

:: FilePath | public certificate (X.509 format)
-> [FilePath] | chain certificates (X.509 format)
-> FilePath | private key associated
-> IO (Either String Credential) |

similar to `credentialLoadX509` but also allow specifying chain certificates.

credentialLoadX509ChainFromMemory :: Bytes -> [Bytes] -> Bytes -> Either String Credential #

similar to `credentialLoadX509FromMemory` but also allow specifying chain certificates.

# Initialisation and Termination of context

bye :: MonadIO m => Context -> m () #

notify the context that this side wants to close connection. this is important that it is called before closing the handle, otherwise the session might not be resumable (for version < TLS1.2).

this doesn't actually close the handle

handshake :: MonadIO m => Context -> m () #

Handshake for a new TLS connection This is to be called at the beginning of a connection, and during renegotiation

# Next Protocol Negotiation

getNegotiatedProtocol :: MonadIO m => Context -> m (Maybe ByteString) #

If the Next Protocol Negotiation extension has been used, this will return get the protocol agreed upon.

# Server Name Indication

getClientSNI :: MonadIO m => Context -> m (Maybe HostName) #

If the Server Name Indication extension has been used, return the hostname specified by the client.

# High level API

sendData :: MonadIO m => Context -> ByteString -> m () #

sendData sends a bunch of data. It will automatically chunk data to acceptable packet size

recvData :: MonadIO m => Context -> m ByteString #

recvData get data out of Data packet, and automatically renegotiate if a Handshake ClientHello is received

recvData' :: MonadIO m => Context -> m ByteString #

Deprecated: use recvData that returns strict bytestring

same as recvData but returns a lazy bytestring.

# Crypto Key

data PubKey :: * #

Public key types known and used in X.509

Constructors

PubKeyRSA PublicKey | RSA public key
PubKeyDSA PublicKey | DSA public key
PubKeyDH (Integer, Integer, Integer, Maybe Integer, ([Word8], Integer)) | DH format with (p,g,q,j,(seed,pgenCounter))
PubKeyEC PubKeyEC | EC public key
PubKeyUnknown OID ByteString | unrecognized format

Instances

Eq PubKey |
Methods (==) :: PubKey -> PubKey -> Bool # (/=) :: PubKey -> PubKey -> Bool #
Show PubKey |
Methods showsPrec :: Int -> PubKey -> ShowS # show :: PubKey -> String # showList :: [PubKey] -> ShowS #
ASN1Object PubKey |
Methods toASN1 :: PubKey -> ASN1S # fromASN1 :: [ASN1] -> Either String (PubKey, [ASN1]) #

data PrivKey :: * #

Private key types known and used in X.509

Constructors

PrivKeyRSA PrivateKey | RSA private key
PrivKeyDSA PrivateKey | DSA private key

Instances

Eq PrivKey |
Methods (==) :: PrivKey -> PrivKey -> Bool # (/=) :: PrivKey -> PrivKey -> Bool #
Show PrivKey |
Methods showsPrec :: Int -> PrivKey -> ShowS # show :: PrivKey -> String # showList :: [PrivKey] -> ShowS #

# Compressions & Predefined compressions

class CompressionC a where #

supported compression algorithms need to be part of this class

Minimal complete definition

compressionCID, compressionCDeflate, compressionCInflate

Methods

compressionCID :: a -> CompressionID #

compressionCDeflate :: a -> ByteString -> (a, ByteString) #

compressionCInflate :: a -> ByteString -> (a, ByteString) #

data Compression #

every compression need to be wrapped in this, to fit in structure

Constructors

CompressionC a => Compression a |

Instances

Eq Compression # |
Methods (==) :: Compression -> Compression -> Bool # (/=) :: Compression -> Compression -> Bool #
Show Compression # |
Methods showsPrec :: Int -> Compression -> ShowS # show :: Compression -> String # showList :: [Compression] -> ShowS #

type CompressionID = Word8 #

Compression identification

nullCompression :: Compression #

default null compression

data NullCompression #

This is the default compression which is a NOOP.

# member redefined for the class abstraction

compressionID :: Compression -> CompressionID #

return the associated ID for this algorithm

compressionDeflate :: ByteString -> Compression -> (Compression, ByteString) #

deflate (compress) a bytestring using a compression context and return the result along with the new compression context.

compressionInflate :: ByteString -> Compression -> (Compression, ByteString) #

inflate (decompress) a bytestring using a compression context and return the result along the new compression context.

# helper

compressionIntersectID :: [Compression] -> [Word8] -> [Compression] #

intersect a list of ids commonly given by the other side with a list of compression the function keeps the list of compression in order, to be able to find quickly the prefered compression.

# Ciphers & Predefined ciphers

data CipherKeyExchangeType #

Constructors

CipherKeyExchange_RSA |
CipherKeyExchange_DH_Anon |
CipherKeyExchange_DHE_RSA |
CipherKeyExchange_ECDHE_RSA |
CipherKeyExchange_DHE_DSS |
CipherKeyExchange_DH_DSS |
CipherKeyExchange_DH_RSA |
CipherKeyExchange_ECDH_ECDSA |
CipherKeyExchange_ECDH_RSA |
CipherKeyExchange_ECDHE_ECDSA |

Instances

Eq CipherKeyExchangeType # |
Methods (==) :: CipherKeyExchangeType -> CipherKeyExchangeType -> Bool # (/=) :: CipherKeyExchangeType -> CipherKeyExchangeType -> Bool #
Show CipherKeyExchangeType # |
Methods showsPrec :: Int -> CipherKeyExchangeType -> ShowS # show :: CipherKeyExchangeType -> String # showList :: [CipherKeyExchangeType] -> ShowS #

data Bulk #

Constructors

Bulk |
Fields bulkName :: String bulkKeySize :: Int bulkIVSize :: Int bulkExplicitIV :: Int bulkAuthTagLen :: Int bulkBlockSize :: Int bulkF :: BulkFunctions

Instances

Eq Bulk # |
Methods (==) :: Bulk -> Bulk -> Bool # (/=) :: Bulk -> Bulk -> Bool #
Show Bulk # |
Methods showsPrec :: Int -> Bulk -> ShowS # show :: Bulk -> String # showList :: [Bulk] -> ShowS #

data BulkFunctions #

Constructors

BulkBlockF (BulkDirection -> BulkKey -> BulkBlock) |
BulkStreamF (BulkDirection -> BulkKey -> BulkStream) |
BulkAeadF (BulkDirection -> BulkKey -> BulkAEAD) |

data BulkDirection #

Constructors

BulkEncrypt |
BulkDecrypt |

Instances

Eq BulkDirection # |
Methods (==) :: BulkDirection -> BulkDirection -> Bool # (/=) :: BulkDirection -> BulkDirection -> Bool #
Show BulkDirection # |
Methods showsPrec :: Int -> BulkDirection -> ShowS # show :: BulkDirection -> String # showList :: [BulkDirection] -> ShowS #

data BulkState #

Constructors

BulkStateStream BulkStream |
BulkStateBlock BulkBlock |
BulkStateAEAD BulkAEAD |
BulkStateUninitialized |

Instances

Show BulkState # |
Methods showsPrec :: Int -> BulkState -> ShowS # show :: BulkState -> String # showList :: [BulkState] -> ShowS #

newtype BulkStream #

Constructors

BulkStream (ByteString -> (ByteString, BulkStream)) |

type BulkBlock = BulkIV -> ByteString -> (ByteString, BulkIV) #

type BulkAEAD = BulkNonce -> ByteString -> BulkAdditionalData -> (ByteString, AuthTag) #

bulkInit :: Bulk -> BulkDirection -> BulkKey -> BulkState #

data Hash #

Constructors

MD5 |
SHA1 |
SHA224 |
SHA256 |
SHA384 |
SHA512 |
SHA1_MD5 |

Instances

Eq Hash # |
Methods (==) :: Hash -> Hash -> Bool # (/=) :: Hash -> Hash -> Bool #
Show Hash # |
Methods showsPrec :: Int -> Hash -> ShowS # show :: Hash -> String # showList :: [Hash] -> ShowS #

data Cipher #

Cipher algorithm

Constructors

Cipher |
Fields cipherID :: CipherID cipherName :: String cipherHash :: Hash cipherBulk :: Bulk cipherKeyExchange :: CipherKeyExchangeType cipherMinVer :: Maybe Version

Instances

Eq Cipher # |
Methods (==) :: Cipher -> Cipher -> Bool # (/=) :: Cipher -> Cipher -> Bool #
Show Cipher # |
Methods showsPrec :: Int -> Cipher -> ShowS # show :: Cipher -> String # showList :: [Cipher] -> ShowS #

type CipherID = Word16 #

Cipher identification

cipherKeyBlockSize :: Cipher -> Int #

type BulkKey = ByteString #

type BulkIV = ByteString #

type BulkNonce = ByteString #

type BulkAdditionalData = ByteString #

cipherAllowedForVersion :: Version -> Cipher -> Bool #

Check if a specific `Cipher` is allowed to be used with the version specified

cipherExchangeNeedMoreData :: CipherKeyExchangeType -> Bool #

hasMAC :: BulkFunctions -> Bool #

hasRecordIV :: BulkFunctions -> Bool #

# Versions

data Version #

Versions known to TLS

SSL2 is just defined, but this version is and will not be supported.

Constructors

SSL2 |
SSL3 |
TLS10 |
TLS11 |
TLS12 |

Instances

Bounded Version # |
Methods minBound :: Version # maxBound :: Version #
Eq Version # |
Methods (==) :: Version -> Version -> Bool # (/=) :: Version -> Version -> Bool #
Ord Version # |
Methods compare :: Version -> Version -> Ordering # (<) :: Version -> Version -> Bool # (<=) :: Version -> Version -> Bool # (>) :: Version -> Version -> Bool # (>=) :: Version -> Version -> Bool # max :: Version -> Version -> Version # min :: Version -> Version -> Version #
Show Version # |
Methods showsPrec :: Int -> Version -> ShowS # show :: Version -> String # showList :: [Version] -> ShowS #

# Errors

data TLSError #

TLSError that might be returned through the TLS stack

Constructors

Error_Misc String | mainly for instance of Error
Error_Protocol (String, Bool, AlertDescription) |
Error_Certificate String |
Error_HandshakePolicy String | handshake policy failed.
Error_EOF |
Error_Packet String |
Error_Packet_unexpected String String |
Error_Packet_Parsing String |

Instances

Eq TLSError # |
Methods (==) :: TLSError -> TLSError -> Bool # (/=) :: TLSError -> TLSError -> Bool #
Show TLSError # |
Methods showsPrec :: Int -> TLSError -> ShowS # show :: TLSError -> String # showList :: [TLSError] -> ShowS #
Exception TLSError # |
Methods toException :: TLSError -> SomeException # fromException :: SomeException -> Maybe TLSError # displayException :: TLSError -> String #

data KxError #

Constructors

RSAError Error |
KxUnsupported |

Instances

Show KxError # |
Methods showsPrec :: Int -> KxError -> ShowS # show :: KxError -> String # showList :: [KxError] -> ShowS #

data AlertDescription #

Constructors

CloseNotify |
UnexpectedMessage |
BadRecordMac |
DecryptionFailed | deprecated alert, should never be sent by compliant implementation
RecordOverflow |
DecompressionFailure |
HandshakeFailure |
BadCertificate |
UnsupportedCertificate |
CertificateRevoked |
CertificateExpired |
CertificateUnknown |
IllegalParameter |
UnknownCa |
AccessDenied |
DecodeError |
DecryptError |
ExportRestriction |
ProtocolVersion |
InsufficientSecurity |
InternalError |
InappropriateFallback |
UserCanceled |
NoRenegotiation |
UnsupportedExtension |
CertificateUnobtainable |
UnrecognizedName |
BadCertificateStatusResponse |
BadCertificateHashValue |

Instances

Eq AlertDescription # |
Methods (==) :: AlertDescription -> AlertDescription -> Bool # (/=) :: AlertDescription -> AlertDescription -> Bool #
Show AlertDescription # |
Methods showsPrec :: Int -> AlertDescription -> ShowS # show :: AlertDescription -> String # showList :: [AlertDescription] -> ShowS #

# Exceptions

data TLSException #

TLS Exceptions related to bad user usage or asynchronous errors

Constructors

Terminated Bool String TLSError | Early termination exception with the reason and the error associated
HandshakeFailed TLSError | Handshake failed for the reason attached
ConnectionNotEstablished | Usage error when the connection has not been established and the user is trying to send or receive data

Instances

Eq TLSException # |
Methods (==) :: TLSException -> TLSException -> Bool # (/=) :: TLSException -> TLSException -> Bool #
Show TLSException # |
Methods showsPrec :: Int -> TLSException -> ShowS # show :: TLSException -> String # showList :: [TLSException] -> ShowS #
Exception TLSException # |
Methods toException :: TLSException -> SomeException # fromException :: SomeException -> Maybe TLSException # displayException :: TLSException -> String #

# X509 Validation

data ValidationChecks :: * #

A set of checks to activate or parametrize to perform on certificates.

It's recommended to use `defaultChecks` to create the structure, to better cope with future changes or expansion of the structure.

Constructors

ValidationChecks |
Fields checkTimeValidity :: Bool check time validity of every certificate in the chain. the make sure that current time is between each validity bounds in the certificate checkAtTime :: Maybe DateTime The time when the validity check happens. When set to Nothing, the current time will be used checkStrictOrdering :: Bool Check that no certificate is included that shouldn't be included. unfortunately despite the specification violation, a lots of real world server serves useless and usually old certificates that are not relevant to the certificate sent, in their chain. checkCAConstraints :: Bool Check that signing certificate got the CA basic constraint. this is absolutely not recommended to turn it off. checkExhaustive :: Bool Check the whole certificate chain without stopping at the first failure. Allow gathering a exhaustive list of failure reasons. if this is turn off, it's absolutely not safe to ignore a failed reason even it doesn't look serious (e.g. Expired) as other more serious checks would not have been performed. checkLeafV3 :: Bool Check that the leaf certificate is version 3. If disable, version 2 certificate is authorized in leaf position and key usage cannot be checked. checkLeafKeyUsage :: [ExtKeyUsageFlag] Check that the leaf certificate is authorized to be used for certain usage. If set to empty list no check are performed, otherwise all the flags is the list need to exists in the key usage extension. If the extension is not present, the check will pass and behave as if the certificate key is not restricted to any specific usage. checkLeafKeyPurpose :: [ExtKeyUsagePurpose] Check that the leaf certificate is authorized to be used for certain purpose. If set to empty list no check are performed, otherwise all the flags is the list need to exists in the extended key usage extension if present. If the extension is not present, then the check will pass and behave as if the certificate is not restricted to any specific purpose. checkFQHN :: Bool Check the top certificate names matching the fully qualified hostname (FQHN). it's not recommended to turn this check off, if no other name checks are performed.

Instances

Eq ValidationChecks |
Methods (==) :: ValidationChecks -> ValidationChecks -> Bool # (/=) :: ValidationChecks -> ValidationChecks -> Bool #
Show ValidationChecks |
Methods showsPrec :: Int -> ValidationChecks -> ShowS # show :: ValidationChecks -> String # showList :: [ValidationChecks] -> ShowS #
Default ValidationChecks |
Methods def :: ValidationChecks #

data ValidationHooks :: * #

A set of hooks to manipulate the way the verification works.

BEWARE, it's easy to change behavior leading to compromised security.

Constructors

ValidationHooks |
Fields hookMatchSubjectIssuer :: DistinguishedName -> Certificate -> Bool check the the issuer `DistinguishedName` match the subject `DistinguishedName` of a certificate. hookValidateTime :: DateTime -> Certificate -> [FailedReason] validate that the parametrized time valide with the certificate in argument hookValidateName :: HostName -> Certificate -> [FailedReason] validate the certificate leaf name with the DNS named used to connect hookFilterReason :: [FailedReason] -> [FailedReason] user filter to modify the list of failure reasons

Instances

Default ValidationHooks |
Methods def :: ValidationHooks #

# X509 Validation Cache

data ValidationCache :: * #

All the callbacks needed for querying and adding to the cache.

Constructors

ValidationCache |
Fields cacheQuery :: ValidationCacheQueryCallback cache querying callback cacheAdd :: ValidationCacheAddCallback cache adding callback

Instances

Default ValidationCache |
Methods def :: ValidationCache #

data ValidationCacheResult :: * #

The result of a cache query

Constructors

ValidationCachePass | cache allow this fingerprint to go through
ValidationCacheDenied String | cache denied this fingerprint for further validation
ValidationCacheUnknown | unknown fingerprint in cache

Instances

Eq ValidationCacheResult |
Methods (==) :: ValidationCacheResult -> ValidationCacheResult -> Bool # (/=) :: ValidationCacheResult -> ValidationCacheResult -> Bool #
Show ValidationCacheResult |
Methods showsPrec :: Int -> ValidationCacheResult -> ShowS # show :: ValidationCacheResult -> String # showList :: [ValidationCacheResult] -> ShowS #

exceptionValidationCache :: [(ServiceID, Fingerprint)] -> ValidationCache #

create a simple constant cache that list exceptions to the certification validation. Typically this is use to allow self-signed certificates for specific use, with out-of-bounds user checks.

No fingerprints will be added after the instance is created.

The underlying structure for the check is kept as a list, as usually the exception list will be short, but when the list go above a dozen exceptions it's recommended to use another cache mechanism with a faster lookup mechanism (hashtable, map, etc).

Note that only one fingerprint is allowed per ServiceID, for other use, another cache mechanism need to be use.