Rustls

TLS bindings for Rustls via rustls-ffi.

See the README on GitHub for setup instructions.

Currently, most of the functionality exposed by rustls-ffi is available, while rustls-ffi is still missing some more niche Rustls features.

Also see http-client-rustls for making HTTPS requests using http-client and Rustls.

Client example

Suppose you have alread opened a Socket to example.org, port 443 (see e.g. the examples at Network.Socket). This small example showcases how to perform a simple HTTP GET request:

>>> :set -XOverloadedStrings
>>> import qualified Rustls
>>> import Network.Socket (Socket)
>>> import Data.Acquire (withAcquire)
>>> :{
example :: Socket -> IO ()
example socket = do
  -- It is encouraged to share a single `clientConfig` when creating multiple
  -- TLS connections.
  clientConfig <-
    Rustls.buildClientConfig $ Rustls.defaultClientConfigBuilder roots
  let newConnection =
        Rustls.newClientConnection socket clientConfig "example.org"
  withAcquire newConnection $ \conn -> do
    Rustls.writeBS conn "GET /"
    recv <- Rustls.readBS conn 1000 -- max number of bytes to read
    print recv
  where
    -- For now, rustls-ffi does not provide a built-in way to access
    -- the OS certificate store.
    roots = Rustls.ClientRootsFromFile "/etc/ssl/certs/ca-certificates.crt"
:}

Using Acquire

Some API functions (like newClientConnection and newServerConnection) return an Acquire from resourcet, as it is a convenient abstraction for exposing a value that should be consumed in a "bracketed" manner.

Usually, it can be used via with or withAcquire, or via allocateAcquire when a MonadResource constraint is available. If you really need the extra flexibility, you can also access separate open… and close… functions by reaching for Data.Acquire.Internal.

Client

Builder

data ClientConfigBuilder

Rustls client config builder.

Constructors

ClientConfigBuilder

Fields

• clientConfigRoots :: ClientRoots

  Client root certificates.

• clientConfigTLSVersions :: [TLSVersion]

  Supported TLSVersions. When empty, good defaults are used.

• clientConfigCipherSuites :: [CipherSuite]

  Supported CipherSuites in order of preference. When empty, good defaults are used.

• clientConfigALPNProtocols :: [ALPNProtocol]

  ALPN protocols.

• clientConfigEnableSNI :: Bool

  Whether to enable Server Name Indication. Defaults to True.

• clientConfigCertifiedKeys :: [CertifiedKey]

  List of CertifiedKeys for client authentication.

  Clients that want to support both ECDSA and RSA certificates will want the ECDSA to go first in the list.

Instances

Show ClientConfigBuilder

Defined in Rustls.Internal

Methods

showsPrec :: Int -> ClientConfigBuilder -> ShowS

show :: ClientConfigBuilder -> String

showList :: [ClientConfigBuilder] -> ShowS

Generic ClientConfigBuilder

Defined in Rustls.Internal

Associated Types

type Rep ClientConfigBuilder :: Type -> Type

Methods

from :: ClientConfigBuilder -> Rep ClientConfigBuilder x

to :: Rep ClientConfigBuilder x -> ClientConfigBuilder

type Rep ClientConfigBuilder

Defined in Rustls.Internal

type Rep ClientConfigBuilder = D1 ('MetaData "ClientConfigBuilder" "Rustls.Internal" "rustls-0.0.0.0-inplace" 'False) (C1 ('MetaCons "ClientConfigBuilder" 'PrefixI 'True) ((S1 ('MetaSel ('Just "clientConfigRoots") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 ClientRoots) :*: (S1 ('MetaSel ('Just "clientConfigTLSVersions") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 [TLSVersion]) :*: S1 ('MetaSel ('Just "clientConfigCipherSuites") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 [CipherSuite]))) :*: (S1 ('MetaSel ('Just "clientConfigALPNProtocols") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 [ALPNProtocol]) :*: (S1 ('MetaSel ('Just "clientConfigEnableSNI") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Bool) :*: S1 ('MetaSel ('Just "clientConfigCertifiedKeys") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 [CertifiedKey])))))

defaultClientConfigBuilder :: ClientRoots -> ClientConfigBuilder

A ClientConfigBuilder with good defaults.

data ClientRoots

How to look up root certificates.

Constructors

ClientRootsFromFile FilePath

Fetch PEM-encoded root certificates from a file.

ClientRootsInMemory [PEMCertificates]

Use in-memory PEM-encoded certificates.

Instances

Show ClientRoots

Defined in Rustls.Internal

Methods

showsPrec :: Int -> ClientRoots -> ShowS

show :: ClientRoots -> String

showList :: [ClientRoots] -> ShowS

Generic ClientRoots

Defined in Rustls.Internal

Associated Types

type Rep ClientRoots :: Type -> Type

Methods

from :: ClientRoots -> Rep ClientRoots x

to :: Rep ClientRoots x -> ClientRoots

type Rep ClientRoots

Defined in Rustls.Internal

type Rep ClientRoots = D1 ('MetaData "ClientRoots" "Rustls.Internal" "rustls-0.0.0.0-inplace" 'False) (C1 ('MetaCons "ClientRootsFromFile" 'PrefixI 'False) (S1 ('MetaSel ('Nothing :: Maybe Symbol) 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 FilePath)) :+: C1 ('MetaCons "ClientRootsInMemory" 'PrefixI 'False) (S1 ('MetaSel ('Nothing :: Maybe Symbol) 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 [PEMCertificates])))

data PEMCertificates

In-memory PEM-encoded certificates.

Constructors

PEMCertificatesStrict ByteString

Syntactically valid PEM-encoded certificates.

PEMCertificatesLax ByteString

PEM-encoded certificates, ignored if syntactically invalid.

This may be useful on systems that have syntactically invalid root certificates.

Instances

Show PEMCertificates

Defined in Rustls.Internal

Methods

showsPrec :: Int -> PEMCertificates -> ShowS

show :: PEMCertificates -> String

showList :: [PEMCertificates] -> ShowS

Generic PEMCertificates

Defined in Rustls.Internal

Associated Types

type Rep PEMCertificates :: Type -> Type

Methods

from :: PEMCertificates -> Rep PEMCertificates x

to :: Rep PEMCertificates x -> PEMCertificates

type Rep PEMCertificates

Defined in Rustls.Internal

type Rep PEMCertificates = D1 ('MetaData "PEMCertificates" "Rustls.Internal" "rustls-0.0.0.0-inplace" 'False) (C1 ('MetaCons "PEMCertificatesStrict" 'PrefixI 'False) (S1 ('MetaSel ('Nothing :: Maybe Symbol) 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 ByteString)) :+: C1 ('MetaCons "PEMCertificatesLax" 'PrefixI 'False) (S1 ('MetaSel ('Nothing :: Maybe Symbol) 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 ByteString)))

Config

data ClientConfig

Assembled configuration for a Rustls client connection.

clientConfigLogCallback :: ClientConfig -> Maybe LogCallback

A logging callback. If it throws an exception, a note will be printed to stderr.

Note that this is a record selector, so you can use it as a setter:

>>> :{
setLogCallback :: LogCallback -> ClientConfig -> ClientConfig
setLogCallback logCallback clientConfig =
  clientConfig { clientConfigLogCallback = Just logCallback }
:}

buildClientConfig :: MonadIO m => ClientConfigBuilder -> m ClientConfig

Build a ClientConfigBuilder into a ClientConfig.

This is a relatively expensive operation, so it is a good idea to share one ClientConfig when creating multiple Connections.

Open a connection

newClientConnection

Arguments

:: Backend b

=> b

-> ClientConfig

-> Text

Hostname.

-> Acquire (Connection Client)

Initialize a TLS connection as a client.

Server

Builder

data ServerConfigBuilder

Rustls client config builder.

Constructors

ServerConfigBuilder

Fields

• serverConfigCertifiedKeys :: NonEmpty CertifiedKey

  List of CertifiedKeys.

• serverConfigTLSVersions :: [TLSVersion]

  Supported TLSVersions. When empty, good defaults are used.

• serverConfigCipherSuites :: [CipherSuite]

  Supported CipherSuites in order of preference. When empty, good defaults are used.

• serverConfigALPNProtocols :: [ALPNProtocol]

  ALPN protocols.

• serverConfigIgnoreClientOrder :: Bool

  Ignore the client's ciphersuite order. Defaults to False.

• serverConfigClientCertVerifier :: Maybe ClientCertVerifier

  Optionally, a client cert verifier.

Instances

Show ServerConfigBuilder

Defined in Rustls.Internal

Methods

showsPrec :: Int -> ServerConfigBuilder -> ShowS

show :: ServerConfigBuilder -> String

showList :: [ServerConfigBuilder] -> ShowS

Generic ServerConfigBuilder

Defined in Rustls.Internal

Associated Types

type Rep ServerConfigBuilder :: Type -> Type

Methods

from :: ServerConfigBuilder -> Rep ServerConfigBuilder x

to :: Rep ServerConfigBuilder x -> ServerConfigBuilder

type Rep ServerConfigBuilder

Defined in Rustls.Internal

type Rep ServerConfigBuilder = D1 ('MetaData "ServerConfigBuilder" "Rustls.Internal" "rustls-0.0.0.0-inplace" 'False) (C1 ('MetaCons "ServerConfigBuilder" 'PrefixI 'True) ((S1 ('MetaSel ('Just "serverConfigCertifiedKeys") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (NonEmpty CertifiedKey)) :*: (S1 ('MetaSel ('Just "serverConfigTLSVersions") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 [TLSVersion]) :*: S1 ('MetaSel ('Just "serverConfigCipherSuites") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 [CipherSuite]))) :*: (S1 ('MetaSel ('Just "serverConfigALPNProtocols") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 [ALPNProtocol]) :*: (S1 ('MetaSel ('Just "serverConfigIgnoreClientOrder") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Bool) :*: S1 ('MetaSel ('Just "serverConfigClientCertVerifier") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe ClientCertVerifier))))))

defaultServerConfigBuilder :: NonEmpty CertifiedKey -> ServerConfigBuilder

A ServerConfigBuilder with good defaults.

data ClientCertVerifier

How to verify TLS client certificates.

Constructors

ClientCertVerifier [PEMCertificates]

Root certificates used to verify TLS client certificates.

ClientCertVerifierOptional [PEMCertificates]

Root certificates used to verify TLS client certificates if present, but does not reject clients which provide no certificate.

Instances

Show ClientCertVerifier

Defined in Rustls.Internal

Methods

showsPrec :: Int -> ClientCertVerifier -> ShowS

show :: ClientCertVerifier -> String

showList :: [ClientCertVerifier] -> ShowS

Generic ClientCertVerifier

Defined in Rustls.Internal

Associated Types

type Rep ClientCertVerifier :: Type -> Type

Methods

from :: ClientCertVerifier -> Rep ClientCertVerifier x

to :: Rep ClientCertVerifier x -> ClientCertVerifier

type Rep ClientCertVerifier

Defined in Rustls.Internal

type Rep ClientCertVerifier = D1 ('MetaData "ClientCertVerifier" "Rustls.Internal" "rustls-0.0.0.0-inplace" 'False) (C1 ('MetaCons "ClientCertVerifier" 'PrefixI 'False) (S1 ('MetaSel ('Nothing :: Maybe Symbol) 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 [PEMCertificates])) :+: C1 ('MetaCons "ClientCertVerifierOptional" 'PrefixI 'False) (S1 ('MetaSel ('Nothing :: Maybe Symbol) 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 [PEMCertificates])))

Config

data ServerConfig

Assembled configuration for a Rustls server connection.

serverConfigLogCallback :: ServerConfig -> Maybe LogCallback

A logging callback. If it throws an exception, a note will be printed to stderr.

Note that this is a record selector, so you can use it as a setter:

>>> :{
setLogCallback :: LogCallback -> ServerConfig -> ServerConfig
setLogCallback logCallback serverConfig =
  serverConfig { serverConfigLogCallback = Just logCallback }
:}

buildServerConfig :: MonadIO m => ServerConfigBuilder -> m ServerConfig

Build a ServerConfigBuilder into a ServerConfig.

This is a relatively expensive operation, so it is a good idea to share one ServerConfig when creating multiple Connections.

Open a connection

newServerConnection :: Backend b => b -> ServerConfig -> Acquire (Connection Server)

Initialize a TLS connection as a server.

Connection

data Connection (side :: Side)

A Rustls connection.

data Side

Type-level indicator whether a Connection is client- or server-side.

Constructors

Client

Server

Read and write

readBS

Arguments

:: MonadIO m

=> Connection side

-> Int

Maximum result length. Note that a buffer of this size will be allocated.

-> m ByteString

Read data from the Rustls Connection into a ByteString. The result will not be longer than the given length.

writeBS :: MonadIO m => Connection side -> ByteString -> m ()

Write a ByteString to the Rustls Connection.

Handshaking

handshake :: MonadIO m => Connection side -> HandshakeQuery side a -> m a

Ensure that the connection is handshaked. It is only necessary to call this if you want to obtain connection information. You can do so by providing a HandshakeQuery.

>>> :{
getALPNAndTLSVersion ::
  MonadIO m =>
  Connection side ->
  m (Maybe ALPNProtocol, TLSVersion)
getALPNAndTLSVersion conn =
  handshake conn $ (,) <$> getALPNProtocol <*> getTLSVersion
:}

data HandshakeQuery (side :: Side) a

A Monad to get TLS connection information via handshake.

Instances

Monad (HandshakeQuery side)

Defined in Rustls.Internal

Methods

(>>=) :: HandshakeQuery side a -> (a -> HandshakeQuery side b) -> HandshakeQuery side b

(>>) :: HandshakeQuery side a -> HandshakeQuery side b -> HandshakeQuery side b

return :: a -> HandshakeQuery side a

Functor (HandshakeQuery side)

Defined in Rustls.Internal

Methods

fmap :: (a -> b) -> HandshakeQuery side a -> HandshakeQuery side b

(<$) :: a -> HandshakeQuery side b -> HandshakeQuery side a

Applicative (HandshakeQuery side)

Defined in Rustls.Internal

Methods

pure :: a -> HandshakeQuery side a

(<*>) :: HandshakeQuery side (a -> b) -> HandshakeQuery side a -> HandshakeQuery side b

liftA2 :: (a -> b -> c) -> HandshakeQuery side a -> HandshakeQuery side b -> HandshakeQuery side c

(*>) :: HandshakeQuery side a -> HandshakeQuery side b -> HandshakeQuery side b

(<*) :: HandshakeQuery side a -> HandshakeQuery side b -> HandshakeQuery side a

getALPNProtocol :: HandshakeQuery side (Maybe ALPNProtocol)

Get the negotiated ALPN protocol, if any.

getTLSVersion :: HandshakeQuery side TLSVersion

Get the negotiated TLS protocol version.

getCipherSuite :: HandshakeQuery side CipherSuite

Get the negotiated cipher suite.

getSNIHostname :: HandshakeQuery Server (Maybe Text)

Get the SNI hostname set by the client, if any.

getPeerCertificate :: CSize -> HandshakeQuery side (Maybe DERCertificate)

Get the i-th certificate provided by the peer.

Index 0 is the end entity certificate. Higher indices are certificates in the chain. Requesting an index higher than what is available returns Nothing.

Closing

sendCloseNotify :: MonadIO m => Connection side -> m ()

Send a close_notify warning alert. This informs the peer that the connection is being closed.

Logging

data LogCallback

A Rustls connection logging callback.

newLogCallback :: (LogLevel -> Text -> IO ()) -> Acquire LogCallback

Allocate a new logging callback, taking a LogLevel and a message.

🚫 Make sure that its lifetime encloses those of the Connections which you configured to use it.

data LogLevel

Rustls log level.

Constructors

LogLevelError

LogLevelWarn

LogLevelInfo

LogLevelDebug

LogLevelTrace

Instances

Bounded LogLevel

Defined in Rustls.Internal

Methods

minBound :: LogLevel

maxBound :: LogLevel

Enum LogLevel

Defined in Rustls.Internal

Methods

succ :: LogLevel -> LogLevel

pred :: LogLevel -> LogLevel

toEnum :: Int -> LogLevel

fromEnum :: LogLevel -> Int

enumFrom :: LogLevel -> [LogLevel]

enumFromThen :: LogLevel -> LogLevel -> [LogLevel]

enumFromTo :: LogLevel -> LogLevel -> [LogLevel]

enumFromThenTo :: LogLevel -> LogLevel -> LogLevel -> [LogLevel]

Eq LogLevel

Defined in Rustls.Internal

Methods

(==) :: LogLevel -> LogLevel -> Bool

(/=) :: LogLevel -> LogLevel -> Bool

Ord LogLevel

Defined in Rustls.Internal

Methods

compare :: LogLevel -> LogLevel -> Ordering

(<) :: LogLevel -> LogLevel -> Bool

(<=) :: LogLevel -> LogLevel -> Bool

(>) :: LogLevel -> LogLevel -> Bool

(>=) :: LogLevel -> LogLevel -> Bool

max :: LogLevel -> LogLevel -> LogLevel

min :: LogLevel -> LogLevel -> LogLevel

Show LogLevel

Defined in Rustls.Internal

Methods

showsPrec :: Int -> LogLevel -> ShowS

show :: LogLevel -> String

showList :: [LogLevel] -> ShowS

Generic LogLevel

Defined in Rustls.Internal

Associated Types

type Rep LogLevel :: Type -> Type

Methods

from :: LogLevel -> Rep LogLevel x

to :: Rep LogLevel x -> LogLevel

type Rep LogLevel

Defined in Rustls.Internal

type Rep LogLevel = D1 ('MetaData "LogLevel" "Rustls.Internal" "rustls-0.0.0.0-inplace" 'False) ((C1 ('MetaCons "LogLevelError" 'PrefixI 'False) (U1 :: Type -> Type) :+: C1 ('MetaCons "LogLevelWarn" 'PrefixI 'False) (U1 :: Type -> Type)) :+: (C1 ('MetaCons "LogLevelInfo" 'PrefixI 'False) (U1 :: Type -> Type) :+: (C1 ('MetaCons "LogLevelDebug" 'PrefixI 'False) (U1 :: Type -> Type) :+: C1 ('MetaCons "LogLevelTrace" 'PrefixI 'False) (U1 :: Type -> Type))))

Raw Ptr-based API

readPtr :: MonadIO m => Connection side -> Ptr Word8 -> CSize -> m CSize

Read data from the Rustls Connection into the given buffer.

writePtr :: MonadIO m => Connection side -> Ptr Word8 -> CSize -> m CSize

Write data to the Rustls Connection from the given buffer.

Misc

version :: Text

Combined version string of Rustls and rustls-ffi.

>>> version
"rustls-ffi/0.9.1/rustls/0.20.4"

Backend

class Backend b where

Underlying data sources for Rustls.

Methods

backendRead

Arguments

:: b

-> Ptr Word8

Target buffer pointer.

-> CSize

Target buffer length.

-> IO CSize

Amount of bytes read.

Read data from the backend into the given buffer.

backendWrite

Arguments

:: b

-> Ptr Word8

Source buffer pointer.

-> CSize

Source buffer length.

-> IO CSize

Amount of bytes written.

Write data from the given buffer to the backend.

Instances

Backend Socket

Defined in Rustls.Internal

Methods

backendRead :: Socket -> Ptr Word8 -> CSize -> IO CSize

backendWrite :: Socket -> Ptr Word8 -> CSize -> IO CSize

Backend ByteStringBackend

This instance will silently truncate ByteStrings which are too long.

Defined in Rustls.Internal

Methods

backendRead :: ByteStringBackend -> Ptr Word8 -> CSize -> IO CSize

backendWrite :: ByteStringBackend -> Ptr Word8 -> CSize -> IO CSize

data ByteStringBackend

An in-memory Backend.

Constructors

ByteStringBackend

Fields

• bsbRead :: Int -> IO ByteString

  Read a ByteString with the given max length.

• bsbWrite :: ByteString -> IO ()

  Write a ByteString.

Instances

Generic ByteStringBackend

Defined in Rustls.Internal

Associated Types

type Rep ByteStringBackend :: Type -> Type

Methods

from :: ByteStringBackend -> Rep ByteStringBackend x

to :: Rep ByteStringBackend x -> ByteStringBackend

Backend ByteStringBackend

This instance will silently truncate ByteStrings which are too long.

Defined in Rustls.Internal

Methods

backendRead :: ByteStringBackend -> Ptr Word8 -> CSize -> IO CSize

backendWrite :: ByteStringBackend -> Ptr Word8 -> CSize -> IO CSize

type Rep ByteStringBackend

Defined in Rustls.Internal

type Rep ByteStringBackend = D1 ('MetaData "ByteStringBackend" "Rustls.Internal" "rustls-0.0.0.0-inplace" 'False) (C1 ('MetaCons "ByteStringBackend" 'PrefixI 'True) (S1 ('MetaSel ('Just "bsbRead") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Int -> IO ByteString)) :*: S1 ('MetaSel ('Just "bsbWrite") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (ByteString -> IO ()))))

Types

newtype ALPNProtocol

An ALPN protocol ID. See https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids for a list of registered IDs.

Constructors

ALPNProtocol

Fields

• unALPNProtocol :: ByteString

Instances

Eq ALPNProtocol

Defined in Rustls.Internal

Methods

(==) :: ALPNProtocol -> ALPNProtocol -> Bool

(/=) :: ALPNProtocol -> ALPNProtocol -> Bool

Ord ALPNProtocol

Defined in Rustls.Internal

Methods

compare :: ALPNProtocol -> ALPNProtocol -> Ordering

(<) :: ALPNProtocol -> ALPNProtocol -> Bool

(<=) :: ALPNProtocol -> ALPNProtocol -> Bool

(>) :: ALPNProtocol -> ALPNProtocol -> Bool

(>=) :: ALPNProtocol -> ALPNProtocol -> Bool

max :: ALPNProtocol -> ALPNProtocol -> ALPNProtocol

min :: ALPNProtocol -> ALPNProtocol -> ALPNProtocol

Show ALPNProtocol

Defined in Rustls.Internal

Methods

showsPrec :: Int -> ALPNProtocol -> ShowS

show :: ALPNProtocol -> String

showList :: [ALPNProtocol] -> ShowS

Generic ALPNProtocol

Defined in Rustls.Internal

Associated Types

type Rep ALPNProtocol :: Type -> Type

Methods

from :: ALPNProtocol -> Rep ALPNProtocol x

to :: Rep ALPNProtocol x -> ALPNProtocol

type Rep ALPNProtocol

Defined in Rustls.Internal

type Rep ALPNProtocol = D1 ('MetaData "ALPNProtocol" "Rustls.Internal" "rustls-0.0.0.0-inplace" 'True) (C1 ('MetaCons "ALPNProtocol" 'PrefixI 'True) (S1 ('MetaSel ('Just "unALPNProtocol") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedLazy) (Rec0 ByteString)))

data CertifiedKey

A complete chain of certificates plus a private key for the leaf certificate.

Constructors

CertifiedKey

Fields

• certificateChain :: ByteString

  PEM-encoded certificate chain.

• privateKey :: ByteString

  PEM-encoded private key.

Instances

Show CertifiedKey

Defined in Rustls.Internal

Methods

showsPrec :: Int -> CertifiedKey -> ShowS

show :: CertifiedKey -> String

showList :: [CertifiedKey] -> ShowS

Generic CertifiedKey

Defined in Rustls.Internal

Associated Types

type Rep CertifiedKey :: Type -> Type

Methods

from :: CertifiedKey -> Rep CertifiedKey x

to :: Rep CertifiedKey x -> CertifiedKey

type Rep CertifiedKey

Defined in Rustls.Internal

type Rep CertifiedKey = D1 ('MetaData "CertifiedKey" "Rustls.Internal" "rustls-0.0.0.0-inplace" 'False) (C1 ('MetaCons "CertifiedKey" 'PrefixI 'True) (S1 ('MetaSel ('Just "certificateChain") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 ByteString) :*: S1 ('MetaSel ('Just "privateKey") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 ByteString)))

newtype DERCertificate

A DER-encoded certificate.

Constructors

DERCertificate

Fields

• unDERCertificate :: ByteString

Instances

Eq DERCertificate

Defined in Rustls

Methods

(==) :: DERCertificate -> DERCertificate -> Bool

(/=) :: DERCertificate -> DERCertificate -> Bool

Ord DERCertificate

Defined in Rustls

Methods

compare :: DERCertificate -> DERCertificate -> Ordering

(<) :: DERCertificate -> DERCertificate -> Bool

(<=) :: DERCertificate -> DERCertificate -> Bool

(>) :: DERCertificate -> DERCertificate -> Bool

(>=) :: DERCertificate -> DERCertificate -> Bool

max :: DERCertificate -> DERCertificate -> DERCertificate

min :: DERCertificate -> DERCertificate -> DERCertificate

Show DERCertificate

Defined in Rustls

Methods

showsPrec :: Int -> DERCertificate -> ShowS

show :: DERCertificate -> String

showList :: [DERCertificate] -> ShowS

Generic DERCertificate

Defined in Rustls

Associated Types

type Rep DERCertificate :: Type -> Type

Methods

from :: DERCertificate -> Rep DERCertificate x

to :: Rep DERCertificate x -> DERCertificate

type Rep DERCertificate

Defined in Rustls

type Rep DERCertificate = D1 ('MetaData "DERCertificate" "Rustls" "rustls-0.0.0.0-inplace" 'True) (C1 ('MetaCons "DERCertificate" 'PrefixI 'True) (S1 ('MetaSel ('Just "unDERCertificate") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedLazy) (Rec0 ByteString)))

data TLSVersion where

A TLS protocol version supported by Rustls.

Bundled Patterns

pattern TLS12 :: TLSVersion

pattern TLS13 :: TLSVersion

Instances

Eq TLSVersion

Defined in Rustls.Internal.FFI

Methods

(==) :: TLSVersion -> TLSVersion -> Bool

(/=) :: TLSVersion -> TLSVersion -> Bool

Ord TLSVersion

Defined in Rustls.Internal.FFI

Methods

compare :: TLSVersion -> TLSVersion -> Ordering

(<) :: TLSVersion -> TLSVersion -> Bool

(<=) :: TLSVersion -> TLSVersion -> Bool

(>) :: TLSVersion -> TLSVersion -> Bool

(>=) :: TLSVersion -> TLSVersion -> Bool

max :: TLSVersion -> TLSVersion -> TLSVersion

min :: TLSVersion -> TLSVersion -> TLSVersion

Show TLSVersion

Defined in Rustls.Internal.FFI

Methods

showsPrec :: Int -> TLSVersion -> ShowS

show :: TLSVersion -> String

showList :: [TLSVersion] -> ShowS

Storable TLSVersion

Defined in Rustls.Internal.FFI

Methods

sizeOf :: TLSVersion -> Int

alignment :: TLSVersion -> Int

peekElemOff :: Ptr TLSVersion -> Int -> IO TLSVersion

pokeElemOff :: Ptr TLSVersion -> Int -> TLSVersion -> IO ()

peekByteOff :: Ptr b -> Int -> IO TLSVersion

pokeByteOff :: Ptr b -> Int -> TLSVersion -> IO ()

peek :: Ptr TLSVersion -> IO TLSVersion

poke :: Ptr TLSVersion -> TLSVersion -> IO ()

defaultTLSVersions :: NonEmpty TLSVersion

The default TLSVersions used by Rustls. A subset of defaultTLSVersions.

allTLSVersions :: NonEmpty TLSVersion

All TLSVersions supported by Rustls.

data CipherSuite

A TLS cipher suite supported by Rustls.

Instances

Eq CipherSuite

Defined in Rustls.Internal

Methods

(==) :: CipherSuite -> CipherSuite -> Bool

(/=) :: CipherSuite -> CipherSuite -> Bool

Ord CipherSuite

Defined in Rustls.Internal

Methods

compare :: CipherSuite -> CipherSuite -> Ordering

(<) :: CipherSuite -> CipherSuite -> Bool

(<=) :: CipherSuite -> CipherSuite -> Bool

(>) :: CipherSuite -> CipherSuite -> Bool

(>=) :: CipherSuite -> CipherSuite -> Bool

max :: CipherSuite -> CipherSuite -> CipherSuite

min :: CipherSuite -> CipherSuite -> CipherSuite

Show CipherSuite

Defined in Rustls.Internal

Methods

showsPrec :: Int -> CipherSuite -> ShowS

show :: CipherSuite -> String

showList :: [CipherSuite] -> ShowS

cipherSuiteID :: CipherSuite -> Word16

Get the IANA value from a cipher suite. The bytes are interpreted in network order.

See https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4 for a list.

showCipherSuite :: CipherSuite -> Text

Get the text representation of a cipher suite.

defaultCipherSuites :: NonEmpty CipherSuite

The default CipherSuites used by Rustls. A subset of allCipherSuites.

allCipherSuites :: NonEmpty CipherSuite

All CipherSuites supported by Rustls.

Exceptions

data RustlsException

TLS exception thrown by Rustls.

Use displayException for a human-friendly representation.

Instances

Show RustlsException

Defined in Rustls.Internal

Methods

showsPrec :: Int -> RustlsException -> ShowS

show :: RustlsException -> String

showList :: [RustlsException] -> ShowS

Exception RustlsException

Defined in Rustls.Internal

Methods

toException :: RustlsException -> SomeException

fromException :: SomeException -> Maybe RustlsException

displayException :: RustlsException -> String

isCertError :: RustlsException -> Bool

Checks if the given RustlsException represents a certificate error.