621 lines
24 KiB
OCaml
621 lines
24 KiB
OCaml
(** Magic numbers of the TLS protocol. *)
|
|
|
|
(* HACK: 24 bits type not in cstruct *)
|
|
let get_uint24_len ~off buf =
|
|
(String.get_uint16_be buf off) * 0x100 + (String.get_uint8 buf (off + 2))
|
|
|
|
let set_uint24_len ~off buf num =
|
|
Bytes.set_uint16_be buf off (num / 0x100);
|
|
Bytes.set_uint8 buf (off + 2) (num mod 0x100)
|
|
|
|
(* TLS record content type *)
|
|
type content_type =
|
|
| CHANGE_CIPHER_SPEC
|
|
| ALERT
|
|
| HANDSHAKE
|
|
| APPLICATION_DATA
|
|
|
|
let content_type_to_int = function
|
|
| CHANGE_CIPHER_SPEC -> 20
|
|
| ALERT -> 21
|
|
| HANDSHAKE -> 22
|
|
| APPLICATION_DATA -> 23
|
|
and int_to_content_type = function
|
|
| 20 -> Some CHANGE_CIPHER_SPEC
|
|
| 21 -> Some ALERT
|
|
| 22 -> Some HANDSHAKE
|
|
| 23 -> Some APPLICATION_DATA
|
|
| _ -> None
|
|
|
|
let content_type_to_string = function
|
|
| CHANGE_CIPHER_SPEC -> "change cipher spec"
|
|
| ALERT -> "alert"
|
|
| HANDSHAKE -> "handshake"
|
|
| APPLICATION_DATA -> "application data"
|
|
|
|
let pp_content_type ppf ct =
|
|
Fmt.string ppf (content_type_to_string ct)
|
|
|
|
(* TLS alert level *)
|
|
type alert_level =
|
|
| WARNING
|
|
| FATAL
|
|
|
|
let pp_alert_level ppf = function
|
|
| WARNING -> Fmt.string ppf "warning"
|
|
| FATAL -> Fmt.string ppf "fatal"
|
|
|
|
let alert_level_to_int = function
|
|
| WARNING -> 1
|
|
| FATAL -> 2
|
|
and int_to_alert_level = function
|
|
| 1 -> Some WARNING
|
|
| 2 -> Some FATAL
|
|
| _ -> None
|
|
|
|
(* TLS alert types *)
|
|
type alert_type =
|
|
| CLOSE_NOTIFY [@id 0] (*RFC5246*)
|
|
| UNEXPECTED_MESSAGE [@id 10] (*RFC5246*)
|
|
| BAD_RECORD_MAC [@id 20] (*RFC5246*)
|
|
| RECORD_OVERFLOW [@id 22] (*RFC5246*)
|
|
| HANDSHAKE_FAILURE [@id 40] (*RFC5246*)
|
|
| BAD_CERTIFICATE [@id 42] (*RFC5246*)
|
|
| CERTIFICATE_EXPIRED [@id 45] (*RFC5246*)
|
|
| CERTIFICATE_UNKNOWN [@id 46] (*RFC5246*)
|
|
| DECODE_ERROR [@id 50] (*RFC5246*)
|
|
| PROTOCOL_VERSION [@id 70] (*RFC5246*)
|
|
| INAPPROPRIATE_FALLBACK [@id 86] (*draft-ietf-tls-downgrade-scsv*)
|
|
| USER_CANCELED [@id 90] (*RFC5246*)
|
|
| NO_RENEGOTIATION [@id 100] (*RFC5246*)
|
|
| MISSING_EXTENSION [@id 109] (*RFC8446*)
|
|
| UNSUPPORTED_EXTENSION [@id 110] (*RFC5246*)
|
|
| UNRECOGNIZED_NAME [@id 112] (*RFC6066*)
|
|
| NO_APPLICATION_PROTOCOL [@id 120] (*RFC7301*)
|
|
| UNKNOWN of int
|
|
|
|
let alert_type_to_string = function
|
|
| CLOSE_NOTIFY -> "close notify"
|
|
| UNEXPECTED_MESSAGE -> "unexpected message"
|
|
| BAD_RECORD_MAC -> "bad record mac"
|
|
| RECORD_OVERFLOW -> "record overflow"
|
|
| HANDSHAKE_FAILURE -> "handshake failure"
|
|
| BAD_CERTIFICATE -> "bad certificate"
|
|
| CERTIFICATE_EXPIRED -> "certificate expired"
|
|
| CERTIFICATE_UNKNOWN -> "certificate unknown"
|
|
| DECODE_ERROR -> "decode error"
|
|
| PROTOCOL_VERSION -> "protocol version"
|
|
| INAPPROPRIATE_FALLBACK -> "inappropriate fallback"
|
|
| USER_CANCELED -> "user canceled"
|
|
| NO_RENEGOTIATION -> "no renegotiation"
|
|
| MISSING_EXTENSION -> "missing extension"
|
|
| UNSUPPORTED_EXTENSION -> "unsupported extension"
|
|
| UNRECOGNIZED_NAME -> "unrecognized name"
|
|
| NO_APPLICATION_PROTOCOL -> "no application protocol"
|
|
| UNKNOWN x -> "unknown " ^ string_of_int x
|
|
|
|
let alert_type_to_int = function
|
|
| CLOSE_NOTIFY -> 0 (*RFC5246*)
|
|
| UNEXPECTED_MESSAGE -> 10 (*RFC5246*)
|
|
| BAD_RECORD_MAC -> 20 (*RFC5246*)
|
|
| RECORD_OVERFLOW -> 22 (*RFC5246*)
|
|
| HANDSHAKE_FAILURE -> 40 (*RFC5246*)
|
|
| BAD_CERTIFICATE -> 42 (*RFC5246*)
|
|
| CERTIFICATE_EXPIRED -> 45 (*RFC5246*)
|
|
| CERTIFICATE_UNKNOWN -> 46 (*RFC5246*)
|
|
| DECODE_ERROR -> 50 (*RFC5246*)
|
|
| PROTOCOL_VERSION -> 70 (*RFC5246*)
|
|
| INAPPROPRIATE_FALLBACK -> 86 (*draft-ietf-tls-downgrade-scsv*)
|
|
| USER_CANCELED -> 90 (*RFC5246*)
|
|
| NO_RENEGOTIATION -> 100 (*RFC5246*)
|
|
| MISSING_EXTENSION -> 109 (*RFC8446*)
|
|
| UNSUPPORTED_EXTENSION -> 110 (*RFC5246*)
|
|
| UNRECOGNIZED_NAME -> 112 (*RFC6066*)
|
|
| NO_APPLICATION_PROTOCOL -> 120 (*RFC7301*)
|
|
| UNKNOWN x -> x
|
|
and int_to_alert_type = function
|
|
| 0 -> CLOSE_NOTIFY
|
|
| 10 -> UNEXPECTED_MESSAGE
|
|
| 20 -> BAD_RECORD_MAC
|
|
| 22 -> RECORD_OVERFLOW
|
|
| 40 -> HANDSHAKE_FAILURE
|
|
| 42 -> BAD_CERTIFICATE
|
|
| 45 -> CERTIFICATE_EXPIRED
|
|
| 46 -> CERTIFICATE_UNKNOWN
|
|
| 50 -> DECODE_ERROR
|
|
| 70 -> PROTOCOL_VERSION
|
|
| 86 -> INAPPROPRIATE_FALLBACK
|
|
| 90 -> USER_CANCELED
|
|
| 100 -> NO_RENEGOTIATION
|
|
| 109 -> MISSING_EXTENSION
|
|
| 110 -> UNSUPPORTED_EXTENSION
|
|
| 112 -> UNRECOGNIZED_NAME
|
|
| 120 -> NO_APPLICATION_PROTOCOL
|
|
| x -> UNKNOWN x
|
|
|
|
let pp_alert ppf (lvl, typ) =
|
|
Fmt.pf ppf "ALERT %a %s" pp_alert_level lvl (alert_type_to_string typ)
|
|
|
|
(* TLS handshake type *)
|
|
type handshake_type =
|
|
| HELLO_REQUEST [@id 0]
|
|
| CLIENT_HELLO [@id 1]
|
|
| SERVER_HELLO [@id 2]
|
|
| HELLO_VERIFY_REQUEST [@id 3] (*RFC6347*)
|
|
| SESSION_TICKET [@id 4] (*RFC4507, RFC8446*)
|
|
| END_OF_EARLY_DATA [@id 5] (*RFC8446*)
|
|
| ENCRYPTED_EXTENSIONS [@id 8] (*RFC8446*)
|
|
| CERTIFICATE [@id 11]
|
|
| SERVER_KEY_EXCHANGE [@id 12]
|
|
| CERTIFICATE_REQUEST [@id 13]
|
|
| SERVER_HELLO_DONE [@id 14]
|
|
| CERTIFICATE_VERIFY [@id 15]
|
|
| CLIENT_KEY_EXCHANGE [@id 16]
|
|
| FINISHED [@id 20]
|
|
| CERTIFICATE_URL [@id 21] (*RFC4366*)
|
|
| CERTIFICATE_STATUS [@id 22] (*RFC4366*)
|
|
| SUPPLEMENTAL_DATA [@id 23] (*RFC4680*)
|
|
| KEY_UPDATE [@id 24] (*RFC8446*)
|
|
| MESSAGE_HASH [@id 254] (*RFC8446*)
|
|
|
|
let handshake_type_to_int = function
|
|
| HELLO_REQUEST -> 0
|
|
| CLIENT_HELLO -> 1
|
|
| SERVER_HELLO -> 2
|
|
| HELLO_VERIFY_REQUEST -> 3 (*RFC6347*)
|
|
| SESSION_TICKET -> 4 (*RFC4507, RFC8446*)
|
|
| END_OF_EARLY_DATA -> 5 (*RFC8446*)
|
|
| ENCRYPTED_EXTENSIONS -> 8 (*RFC8446*)
|
|
| CERTIFICATE -> 11
|
|
| SERVER_KEY_EXCHANGE -> 12
|
|
| CERTIFICATE_REQUEST -> 13
|
|
| SERVER_HELLO_DONE -> 14
|
|
| CERTIFICATE_VERIFY -> 15
|
|
| CLIENT_KEY_EXCHANGE -> 16
|
|
| FINISHED -> 20
|
|
| CERTIFICATE_URL -> 21 (*RFC4366*)
|
|
| CERTIFICATE_STATUS -> 22 (*RFC4366*)
|
|
| SUPPLEMENTAL_DATA -> 23 (*RFC4680*)
|
|
| KEY_UPDATE -> 24 (*RFC8446*)
|
|
| MESSAGE_HASH -> 254 (*RFC8446*)
|
|
and int_to_handshake_type = function
|
|
| 0 -> Some HELLO_REQUEST
|
|
| 1 -> Some CLIENT_HELLO
|
|
| 2 -> Some SERVER_HELLO
|
|
| 3 -> Some HELLO_VERIFY_REQUEST
|
|
| 4 -> Some SESSION_TICKET
|
|
| 5 -> Some END_OF_EARLY_DATA
|
|
| 8 -> Some ENCRYPTED_EXTENSIONS
|
|
| 11 -> Some CERTIFICATE
|
|
| 12 -> Some SERVER_KEY_EXCHANGE
|
|
| 13 -> Some CERTIFICATE_REQUEST
|
|
| 14 -> Some SERVER_HELLO_DONE
|
|
| 15 -> Some CERTIFICATE_VERIFY
|
|
| 16 -> Some CLIENT_KEY_EXCHANGE
|
|
| 20 -> Some FINISHED
|
|
| 21 -> Some CERTIFICATE_URL
|
|
| 22 -> Some CERTIFICATE_STATUS
|
|
| 23 -> Some SUPPLEMENTAL_DATA
|
|
| 24 -> Some KEY_UPDATE
|
|
| 254 -> Some MESSAGE_HASH
|
|
| _ -> None
|
|
|
|
(* TLS certificate types *)
|
|
type client_certificate_type =
|
|
| RSA_SIGN [@id 1] (*RFC5246*)
|
|
| ECDSA_SIGN [@id 64] (*RFC4492*)
|
|
|
|
let client_certificate_type_to_int = function
|
|
| RSA_SIGN -> 1 (*RFC5246*)
|
|
| ECDSA_SIGN -> 64 (*RFC4492*)
|
|
and int_to_client_certificate_type = function
|
|
| 1 -> Some RSA_SIGN
|
|
| 64 -> Some ECDSA_SIGN
|
|
| _ -> None
|
|
|
|
(* TLS compression methods, used in hello packets *)
|
|
type compression_method =
|
|
| NULL [@id 0]
|
|
|
|
let compression_method_to_int = function
|
|
| NULL -> 0
|
|
and int_to_compression_method = function
|
|
| 0 -> Some NULL
|
|
| _ -> None
|
|
|
|
(* TLS extensions in hello packets from RFC 6066, formerly RFC 4366 *)
|
|
type extension_type =
|
|
| SERVER_NAME [@id 0]
|
|
| MAX_FRAGMENT_LENGTH [@id 1]
|
|
| SUPPORTED_GROUPS [@id 10] (*RFC4492, RFC8446*)
|
|
| EC_POINT_FORMATS [@id 11] (*RFC4492*)
|
|
| SIGNATURE_ALGORITHMS [@id 13] (*RFC5246*)
|
|
| APPLICATION_LAYER_PROTOCOL_NEGOTIATION [@id 16] (*RFC7301*)
|
|
| PADDING [@id 21] (*RFC7685*)
|
|
| EXTENDED_MASTER_SECRET [@id 23] (*RFC7627*)
|
|
| SESSION_TICKET [@id 35] (*RFC4507*)
|
|
| PRE_SHARED_KEY [@id 41] (*RFC8446*)
|
|
| EARLY_DATA [@id 42] (*RFC8446*)
|
|
| SUPPORTED_VERSIONS [@id 43] (*RFC8446*)
|
|
| COOKIE [@id 44] (*RFC8446*)
|
|
| PSK_KEY_EXCHANGE_MODES [@id 45] (*RFC8446*)
|
|
| CERTIFICATE_AUTHORITIES [@id 47] (*RFC8446*)
|
|
| POST_HANDSHAKE_AUTH [@id 49] (*RFC8446*)
|
|
| KEY_SHARE [@id 51] (*RFC8446*)
|
|
| RENEGOTIATION_INFO [@id 0xFF01] (*RFC5746*)
|
|
|
|
let extension_type_to_int = function
|
|
| SERVER_NAME -> 0
|
|
| MAX_FRAGMENT_LENGTH -> 1
|
|
| SUPPORTED_GROUPS -> 10 (*RFC4492, RFC8446*)
|
|
| EC_POINT_FORMATS -> 11 (*RFC4492*)
|
|
| SIGNATURE_ALGORITHMS -> 13 (*RFC5246*)
|
|
| APPLICATION_LAYER_PROTOCOL_NEGOTIATION -> 16 (*RFC7301*)
|
|
| PADDING -> 21 (*RFC7685*)
|
|
| EXTENDED_MASTER_SECRET -> 23 (*RFC7627*)
|
|
| SESSION_TICKET -> 35 (*RFC4507*)
|
|
| PRE_SHARED_KEY -> 41 (*RFC8446*)
|
|
| EARLY_DATA -> 42 (*RFC8446*)
|
|
| SUPPORTED_VERSIONS -> 43 (*RFC8446*)
|
|
| COOKIE -> 44 (*RFC8446*)
|
|
| PSK_KEY_EXCHANGE_MODES -> 45 (*RFC8446*)
|
|
| CERTIFICATE_AUTHORITIES -> 47 (*RFC8446*)
|
|
| POST_HANDSHAKE_AUTH -> 49 (*RFC8446*)
|
|
| KEY_SHARE -> 51 (*RFC8446*)
|
|
| RENEGOTIATION_INFO -> 0xFF01 (*RFC5746*)
|
|
and int_to_extension_type = function
|
|
| 0 -> Some SERVER_NAME
|
|
| 1 -> Some MAX_FRAGMENT_LENGTH
|
|
| 10 -> Some SUPPORTED_GROUPS
|
|
| 11 -> Some EC_POINT_FORMATS
|
|
| 13 -> Some SIGNATURE_ALGORITHMS
|
|
| 16 -> Some APPLICATION_LAYER_PROTOCOL_NEGOTIATION
|
|
| 21 -> Some PADDING
|
|
| 23 -> Some EXTENDED_MASTER_SECRET
|
|
| 35 -> Some SESSION_TICKET
|
|
| 41 -> Some PRE_SHARED_KEY
|
|
| 42 -> Some EARLY_DATA
|
|
| 43 -> Some SUPPORTED_VERSIONS
|
|
| 44 -> Some COOKIE
|
|
| 45 -> Some PSK_KEY_EXCHANGE_MODES
|
|
| 47 -> Some CERTIFICATE_AUTHORITIES
|
|
| 49 -> Some POST_HANDSHAKE_AUTH
|
|
| 51 -> Some KEY_SHARE
|
|
| 0xFF01 -> Some RENEGOTIATION_INFO
|
|
| _ -> None
|
|
|
|
let extension_type_to_string et = string_of_int (extension_type_to_int et)
|
|
|
|
(* TLS maximum fragment length *)
|
|
type max_fragment_length =
|
|
| TWO_9 [@id 1]
|
|
| TWO_10 [@id 2]
|
|
| TWO_11 [@id 3]
|
|
| TWO_12 [@id 4]
|
|
|
|
let max_fragment_length_to_int = function
|
|
| TWO_9 -> 1
|
|
| TWO_10 -> 2
|
|
| TWO_11 -> 3
|
|
| TWO_12 -> 4
|
|
and int_to_max_fragment_length = function
|
|
| 1 -> Some TWO_9
|
|
| 2 -> Some TWO_10
|
|
| 3 -> Some TWO_11
|
|
| 4 -> Some TWO_12
|
|
| _ -> None
|
|
|
|
(* TLS 1.3 pre-shared key mode (4.2.9) *)
|
|
type psk_key_exchange_mode =
|
|
| PSK_KE [@id 0]
|
|
| PSK_KE_DHE [@id 1]
|
|
|
|
let psk_key_exchange_mode_to_int = function
|
|
| PSK_KE -> 0
|
|
| PSK_KE_DHE -> 1
|
|
and int_to_psk_key_exchange_mode = function
|
|
| 0 -> Some PSK_KE
|
|
| 1 -> Some PSK_KE_DHE
|
|
| _ -> None
|
|
|
|
(* TLS 1.3 4.2.3 *)
|
|
type signature_alg =
|
|
| RSA_PKCS1_MD5 [@id 0x0101] (* deprecated, TLS 1.2 only *)
|
|
| RSA_PKCS1_SHA1 [@id 0x0201] (* deprecated, TLS 1.2 only *)
|
|
| RSA_PKCS1_SHA224 [@id 0x0301]
|
|
| RSA_PKCS1_SHA256 [@id 0x0401]
|
|
| RSA_PKCS1_SHA384 [@id 0x0501]
|
|
| RSA_PKCS1_SHA512 [@id 0x0601]
|
|
| ECDSA_SECP256R1_SHA1 [@id 0x0203] (* deprecated, TLS 1.2 only *)
|
|
| ECDSA_SECP256R1_SHA256 [@id 0x0403]
|
|
| ECDSA_SECP384R1_SHA384 [@id 0x0503]
|
|
| ECDSA_SECP521R1_SHA512 [@id 0x0603]
|
|
| RSA_PSS_RSAENC_SHA256 [@id 0x0804]
|
|
| RSA_PSS_RSAENC_SHA384 [@id 0x0805]
|
|
| RSA_PSS_RSAENC_SHA512 [@id 0x0806]
|
|
| ED25519 [@id 0x0807]
|
|
| ED448 [@id 0x0808]
|
|
| RSA_PSS_PSS_SHA256 [@id 0x0809]
|
|
| RSA_PSS_PSS_SHA384 [@id 0x080a]
|
|
| RSA_PSS_PSS_SHA512 [@id 0x080b]
|
|
(* private use 0xFE00 - 0xFFFF *)
|
|
|
|
let signature_alg_to_int = function
|
|
| RSA_PKCS1_MD5 -> 0x0101 (* deprecated, TLS 1.2 only *)
|
|
| RSA_PKCS1_SHA1 -> 0x0201 (* deprecated, TLS 1.2 only *)
|
|
| RSA_PKCS1_SHA224 -> 0x0301
|
|
| RSA_PKCS1_SHA256 -> 0x0401
|
|
| RSA_PKCS1_SHA384 -> 0x0501
|
|
| RSA_PKCS1_SHA512 -> 0x0601
|
|
| ECDSA_SECP256R1_SHA1 -> 0x0203 (* deprecated, TLS 1.2 only *)
|
|
| ECDSA_SECP256R1_SHA256 -> 0x0403
|
|
| ECDSA_SECP384R1_SHA384 -> 0x0503
|
|
| ECDSA_SECP521R1_SHA512 -> 0x0603
|
|
| RSA_PSS_RSAENC_SHA256 -> 0x0804
|
|
| RSA_PSS_RSAENC_SHA384 -> 0x0805
|
|
| RSA_PSS_RSAENC_SHA512 -> 0x0806
|
|
| ED25519 -> 0x0807
|
|
| ED448 -> 0x0808
|
|
| RSA_PSS_PSS_SHA256 -> 0x0809
|
|
| RSA_PSS_PSS_SHA384 -> 0x080a
|
|
| RSA_PSS_PSS_SHA512 -> 0x080b
|
|
(* private use 0xFE00 - 0xFFFF *)
|
|
and int_to_signature_alg = function
|
|
| 0x0101 -> Some RSA_PKCS1_MD5
|
|
| 0x0201 -> Some RSA_PKCS1_SHA1
|
|
| 0x0301 -> Some RSA_PKCS1_SHA224
|
|
| 0x0401 -> Some RSA_PKCS1_SHA256
|
|
| 0x0501 -> Some RSA_PKCS1_SHA384
|
|
| 0x0601 -> Some RSA_PKCS1_SHA512
|
|
| 0x0203 -> Some ECDSA_SECP256R1_SHA1
|
|
| 0x0403 -> Some ECDSA_SECP256R1_SHA256
|
|
| 0x0503 -> Some ECDSA_SECP384R1_SHA384
|
|
| 0x0603 -> Some ECDSA_SECP521R1_SHA512
|
|
| 0x0804 -> Some RSA_PSS_RSAENC_SHA256
|
|
| 0x0805 -> Some RSA_PSS_RSAENC_SHA384
|
|
| 0x0806 -> Some RSA_PSS_RSAENC_SHA512
|
|
| 0x0807 -> Some ED25519
|
|
| 0x0808 -> Some ED448
|
|
| 0x0809 -> Some RSA_PSS_PSS_SHA256
|
|
| 0x080a -> Some RSA_PSS_PSS_SHA384
|
|
| 0x080b -> Some RSA_PSS_PSS_SHA512
|
|
| _ -> None
|
|
|
|
let to_signature_alg = function
|
|
| `RSA_PKCS1_MD5 -> RSA_PKCS1_MD5
|
|
| `RSA_PKCS1_SHA1 -> RSA_PKCS1_SHA1
|
|
| `RSA_PKCS1_SHA224 -> RSA_PKCS1_SHA224
|
|
| `RSA_PKCS1_SHA256 -> RSA_PKCS1_SHA256
|
|
| `RSA_PKCS1_SHA384 -> RSA_PKCS1_SHA384
|
|
| `RSA_PKCS1_SHA512 -> RSA_PKCS1_SHA512
|
|
| `RSA_PSS_RSAENC_SHA256 -> RSA_PSS_RSAENC_SHA256
|
|
| `RSA_PSS_RSAENC_SHA384 -> RSA_PSS_RSAENC_SHA384
|
|
| `RSA_PSS_RSAENC_SHA512 -> RSA_PSS_RSAENC_SHA512
|
|
| `ECDSA_SECP256R1_SHA1 -> ECDSA_SECP256R1_SHA1
|
|
| `ECDSA_SECP256R1_SHA256 -> ECDSA_SECP256R1_SHA256
|
|
| `ECDSA_SECP384R1_SHA384 -> ECDSA_SECP384R1_SHA384
|
|
| `ECDSA_SECP521R1_SHA512 -> ECDSA_SECP521R1_SHA512
|
|
| `ED25519 -> ED25519
|
|
|
|
let of_signature_alg = function
|
|
| RSA_PKCS1_MD5 -> Some `RSA_PKCS1_MD5
|
|
| RSA_PKCS1_SHA1 -> Some `RSA_PKCS1_SHA1
|
|
| RSA_PKCS1_SHA224 -> Some `RSA_PKCS1_SHA224
|
|
| RSA_PKCS1_SHA256 -> Some `RSA_PKCS1_SHA256
|
|
| RSA_PKCS1_SHA384 -> Some `RSA_PKCS1_SHA384
|
|
| RSA_PKCS1_SHA512 -> Some `RSA_PKCS1_SHA512
|
|
| RSA_PSS_RSAENC_SHA256 -> Some `RSA_PSS_RSAENC_SHA256
|
|
| RSA_PSS_RSAENC_SHA384 -> Some `RSA_PSS_RSAENC_SHA384
|
|
| RSA_PSS_RSAENC_SHA512 -> Some `RSA_PSS_RSAENC_SHA512
|
|
| ECDSA_SECP256R1_SHA1 -> Some `ECDSA_SECP256R1_SHA1
|
|
| ECDSA_SECP256R1_SHA256 -> Some `ECDSA_SECP256R1_SHA256
|
|
| ECDSA_SECP384R1_SHA384 -> Some `ECDSA_SECP384R1_SHA384
|
|
| ECDSA_SECP521R1_SHA512 -> Some `ECDSA_SECP521R1_SHA512
|
|
| ED25519 -> Some `ED25519
|
|
| _ -> None
|
|
|
|
(* EC RFC4492*)
|
|
type ec_curve_type =
|
|
(* 1 and 2 are deprecated in RFC 8422 *)
|
|
| NAMED_CURVE [@id 3]
|
|
|
|
let ec_curve_type_to_int = function
|
|
| NAMED_CURVE -> 3
|
|
and int_to_ec_curve_type = function
|
|
| 3 -> Some NAMED_CURVE
|
|
| _ -> None
|
|
|
|
type named_group =
|
|
(* OBSOLETE_RESERVED 0x0001 - 0x0016 *)
|
|
| SECP256R1 [@id 23]
|
|
| SECP384R1 [@id 24]
|
|
| SECP521R1 [@id 25]
|
|
(* OBSOLETE_RESERVED 0x001A - 0x001C *)
|
|
| X25519 [@id 29] (*RFC8446*)
|
|
| X448 [@id 30] (*RFC8446*)
|
|
| FFDHE2048 [@id 256] (*RFC8446*)
|
|
| FFDHE3072 [@id 257] (*RFC8446*)
|
|
| FFDHE4096 [@id 258] (*RFC8446*)
|
|
| FFDHE6144 [@id 259] (*RFC8446*)
|
|
| FFDHE8192 [@id 260] (*RFC8446*)
|
|
(* FFDHE_PRIVATE_USE 0x01FC - 0x01FF *)
|
|
(* ECDHE_PRIVATE_USE 0xFE00 - 0xFEFF *)
|
|
(* OBSOLETE_RESERVED 0xFF01 - 0xFF02 *)
|
|
|
|
let named_group_to_int = function
|
|
| SECP256R1 -> 23
|
|
| SECP384R1 -> 24
|
|
| SECP521R1 -> 25
|
|
(* OBSOLETE_RESERVED 0x001A - 0x001C *)
|
|
| X25519 -> 29 (*RFC8446*)
|
|
| X448 -> 30 (*RFC8446*)
|
|
| FFDHE2048 -> 256 (*RFC8446*)
|
|
| FFDHE3072 -> 257 (*RFC8446*)
|
|
| FFDHE4096 -> 258 (*RFC8446*)
|
|
| FFDHE6144 -> 259 (*RFC8446*)
|
|
| FFDHE8192 -> 260 (*RFC8446*)
|
|
(* FFDHE_PRIVATE_USE 0x01FC - 0x01FF *)
|
|
(* ECDHE_PRIVATE_USE 0xFE00 - 0xFEFF *)
|
|
(* OBSOLETE_RESERVED 0xFF01 - 0xFF02 *)
|
|
and int_to_named_group = function
|
|
| 23 -> Some SECP256R1
|
|
| 24 -> Some SECP384R1
|
|
| 25 -> Some SECP521R1
|
|
| 29 -> Some X25519
|
|
| 30 -> Some X448
|
|
| 256 -> Some FFDHE2048
|
|
| 257 -> Some FFDHE3072
|
|
| 258 -> Some FFDHE4096
|
|
| 259 -> Some FFDHE6144
|
|
| 260 -> Some FFDHE8192
|
|
| _ -> None
|
|
|
|
(** enum of all TLS ciphersuites *)
|
|
type any_ciphersuite =
|
|
| TLS_RSA_WITH_3DES_EDE_CBC_SHA [@id 0x000A]
|
|
| TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA [@id 0x0016]
|
|
(* from RFC 3268 *)
|
|
| TLS_RSA_WITH_AES_128_CBC_SHA [@id 0x002F]
|
|
| TLS_DHE_RSA_WITH_AES_128_CBC_SHA [@id 0x0033]
|
|
| TLS_RSA_WITH_AES_256_CBC_SHA [@id 0x0035]
|
|
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA [@id 0x0039]
|
|
(* from RFC 5246 *)
|
|
| TLS_RSA_WITH_AES_128_CBC_SHA256 [@id 0x003C]
|
|
| TLS_RSA_WITH_AES_256_CBC_SHA256 [@id 0x003D]
|
|
| TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 [@id 0x0067]
|
|
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 [@id 0x006B]
|
|
| TLS_RSA_WITH_AES_128_GCM_SHA256 [@id 0x009C] (*RFC5288*)
|
|
| TLS_RSA_WITH_AES_256_GCM_SHA384 [@id 0x009D] (*RFC5288*)
|
|
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 [@id 0x009E] (*RFC5288*)
|
|
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 [@id 0x009F] (*RFC5288*)
|
|
| TLS_EMPTY_RENEGOTIATION_INFO_SCSV [@id 0x00FF] (*RFC5746*)
|
|
| TLS_AES_128_GCM_SHA256 [@id 0x1301] (*RFC8446*)
|
|
| TLS_AES_256_GCM_SHA384 [@id 0x1302] (*RFC8446*)
|
|
| TLS_CHACHA20_POLY1305_SHA256 [@id 0x1303] (*RFC8446*)
|
|
| TLS_AES_128_CCM_SHA256 [@id 0x1304] (*RFC8446*)
|
|
| TLS_FALLBACK_SCSV [@id 0x5600] (*draft-ietf-tls-downgrade-scsv*)
|
|
(* from RFC 4492 *)
|
|
| TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA [@id 0xC008]
|
|
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA [@id 0xC009]
|
|
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA [@id 0xC00A]
|
|
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA [@id 0xC012]
|
|
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA [@id 0xC013]
|
|
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA [@id 0xC014]
|
|
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 [@id 0xC023] (*RFC5289*)
|
|
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 [@id 0xC024] (*RFC5289*)
|
|
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 [@id 0xC027] (*RFC5289*)
|
|
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 [@id 0xC028] (*RFC5289*)
|
|
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 [@id 0xC02B] (*RFC5289*)
|
|
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 [@id 0xC02C] (*RFC5289*)
|
|
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [@id 0xC02F] (*RFC5289*)
|
|
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 [@id 0xC030] (*RFC5289*)
|
|
| TLS_RSA_WITH_AES_128_CCM [@id 0xC09C] (*RFC6655*)
|
|
| TLS_RSA_WITH_AES_256_CCM [@id 0xC09D] (*RFC6655*)
|
|
| TLS_DHE_RSA_WITH_AES_128_CCM [@id 0xC09E] (*RFC6655*)
|
|
| TLS_DHE_RSA_WITH_AES_256_CCM [@id 0xC09F] (*RFC6655*)
|
|
| TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 [@id 0xCCA8] (*RFC7905*)
|
|
| TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 [@id 0xCCA9] (*RFC7905*)
|
|
| TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 [@id 0xCCAA] (*RFC7905*)
|
|
|
|
let any_ciphersuite_to_int = function
|
|
| TLS_RSA_WITH_3DES_EDE_CBC_SHA -> 0x000A
|
|
| TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA -> 0x0016
|
|
| TLS_RSA_WITH_AES_128_CBC_SHA -> 0x002F
|
|
| TLS_DHE_RSA_WITH_AES_128_CBC_SHA -> 0x0033
|
|
| TLS_RSA_WITH_AES_256_CBC_SHA -> 0x0035
|
|
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA -> 0x0039
|
|
| TLS_RSA_WITH_AES_128_CBC_SHA256 -> 0x003C
|
|
| TLS_RSA_WITH_AES_256_CBC_SHA256 -> 0x003D
|
|
| TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 -> 0x0067
|
|
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 -> 0x006B
|
|
| TLS_RSA_WITH_AES_128_GCM_SHA256 -> 0x009C (*RFC5288*)
|
|
| TLS_RSA_WITH_AES_256_GCM_SHA384 -> 0x009D (*RFC5288*)
|
|
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 -> 0x009E (*RFC5288*)
|
|
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 -> 0x009F (*RFC5288*)
|
|
| TLS_EMPTY_RENEGOTIATION_INFO_SCSV -> 0x00FF (*RFC5746*)
|
|
| TLS_AES_128_GCM_SHA256 -> 0x1301 (*RFC8446*)
|
|
| TLS_AES_256_GCM_SHA384 -> 0x1302 (*RFC8446*)
|
|
| TLS_CHACHA20_POLY1305_SHA256 -> 0x1303 (*RFC8446*)
|
|
| TLS_AES_128_CCM_SHA256 -> 0x1304 (*RFC8446*)
|
|
| TLS_FALLBACK_SCSV -> 0x5600 (*draft-ietf-tls-downgrade-scsv*)
|
|
| TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA -> 0xC008
|
|
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA -> 0xC009
|
|
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA -> 0xC00A
|
|
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA -> 0xC012
|
|
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA -> 0xC013
|
|
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA -> 0xC014
|
|
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 -> 0xC023 (*RFC5289*)
|
|
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 -> 0xC024 (*RFC5289*)
|
|
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 -> 0xC027 (*RFC5289*)
|
|
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 -> 0xC028 (*RFC5289*)
|
|
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 -> 0xC02B (*RFC5289*)
|
|
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 -> 0xC02C (*RFC5289*)
|
|
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 -> 0xC02F (*RFC5289*)
|
|
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 -> 0xC030 (*RFC5289*)
|
|
| TLS_RSA_WITH_AES_128_CCM -> 0xC09C (*RFC6655*)
|
|
| TLS_RSA_WITH_AES_256_CCM -> 0xC09D (*RFC6655*)
|
|
| TLS_DHE_RSA_WITH_AES_128_CCM -> 0xC09E (*RFC6655*)
|
|
| TLS_DHE_RSA_WITH_AES_256_CCM -> 0xC09F (*RFC6655*)
|
|
| TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 -> 0xCCA8 (*RFC7905*)
|
|
| TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 -> 0xCCA9 (*RFC7905*)
|
|
| TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 -> 0xCCAA (*RFC7905*)
|
|
|
|
and int_to_any_ciphersuite = function
|
|
| 0x000A -> Some TLS_RSA_WITH_3DES_EDE_CBC_SHA
|
|
| 0x0016 -> Some TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
|
|
| 0x002F -> Some TLS_RSA_WITH_AES_128_CBC_SHA
|
|
| 0x0033 -> Some TLS_DHE_RSA_WITH_AES_128_CBC_SHA
|
|
| 0x0035 -> Some TLS_RSA_WITH_AES_256_CBC_SHA
|
|
| 0x0039 -> Some TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|
|
| 0x003C -> Some TLS_RSA_WITH_AES_128_CBC_SHA256
|
|
| 0x003D -> Some TLS_RSA_WITH_AES_256_CBC_SHA256
|
|
| 0x0067 -> Some TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|
|
| 0x006B -> Some TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
|
|
| 0x009C -> Some TLS_RSA_WITH_AES_128_GCM_SHA256
|
|
| 0x009D -> Some TLS_RSA_WITH_AES_256_GCM_SHA384
|
|
| 0x009E -> Some TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|
|
| 0x009F -> Some TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|
|
| 0x00FF -> Some TLS_EMPTY_RENEGOTIATION_INFO_SCSV
|
|
| 0x1301 -> Some TLS_AES_128_GCM_SHA256
|
|
| 0x1302 -> Some TLS_AES_256_GCM_SHA384
|
|
| 0x1303 -> Some TLS_CHACHA20_POLY1305_SHA256
|
|
| 0x1304 -> Some TLS_AES_128_CCM_SHA256
|
|
| 0x5600 -> Some TLS_FALLBACK_SCSV
|
|
| 0xC008 -> Some TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
|
|
| 0xC009 -> Some TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|
|
| 0xC00A -> Some TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|
|
| 0xC012 -> Some TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
|
|
| 0xC013 -> Some TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
|
| 0xC014 -> Some TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
|
| 0xC023 -> Some TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|
|
| 0xC024 -> Some TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
|
|
| 0xC027 -> Some TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
|
| 0xC028 -> Some TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
|
| 0xC02B -> Some TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
|
| 0xC02C -> Some TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
|
| 0xC02F -> Some TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
|
| 0xC030 -> Some TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
|
| 0xC09C -> Some TLS_RSA_WITH_AES_128_CCM
|
|
| 0xC09D -> Some TLS_RSA_WITH_AES_256_CCM
|
|
| 0xC09E -> Some TLS_DHE_RSA_WITH_AES_128_CCM
|
|
| 0xC09F -> Some TLS_DHE_RSA_WITH_AES_256_CCM
|
|
| 0xCCA8 -> Some TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
|
| 0xCCA9 -> Some TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
|
| 0xCCAA -> Some TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
|
| _ -> None
|
|
|
|
type key_update_request_type =
|
|
| UPDATE_NOT_REQUESTED [@id 0]
|
|
| UPDATE_REQUESTED [@id 1]
|
|
|
|
let key_update_request_type_to_int = function
|
|
| UPDATE_NOT_REQUESTED -> 0
|
|
| UPDATE_REQUESTED -> 1
|
|
and int_to_key_update_request_type = function
|
|
| 0 -> Some UPDATE_NOT_REQUESTED
|
|
| 1 -> Some UPDATE_REQUESTED
|
|
| _ -> None
|
|
|
|
let helloretryrequest = Digestif.SHA256.(to_raw_string (digest_string "HelloRetryRequest"))
|
|
let downgrade12 = "\x44\x4F\x57\x4E\x47\x52\x44\x01"
|
|
let downgrade11 = "\x44\x4F\x57\x4E\x47\x52\x44\x00"
|