h*"      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~2.0.3 BSD-styleKazu Yamamoto  experimentalunknown Safe-Inferred< '/0:987654321; Safe-Inferred l Safe-Inferred   Safe-InferredJ?tlsConnection IO backendAtls,Flush the connection sending buffer, if any.BtlsClose the connection.Ctls)Send a bytestring through the connection.Dtls6Receive specified number of bytes from the connection. <=>?@ABCD  Safe-Inferred3Etls'record some data about this connection.Gtls$number of handshakes on this contextHtls#bytes received since last handshakeItlsbytes sent since last handshake EFGHI  Safe-Inferredo   Safe-InferredJK BSD-styleKazu Yamamoto  experimentalunknown Safe-Inferred0Ltls2048 bits finite field Diffie-Hellman ephemeral parameters defined in RFC 7919. The estimated symmetric-equivalent strength is 103 bits.Mtls3072 bits finite field Diffie-Hellman ephemeral parameters defined in RFC 7919. The estimated symmetric-equivalent strength is 125 bits.Ntls4096 bits finite field Diffie-Hellman ephemeral parameters defined in RFC 7919. The estimated symmetric-equivalent strength is 150 bits.Otls6144 bits finite field Diffie-Hellman ephemeral parameters defined in RFC 7919. The estimated symmetric-equivalent strength is 175 bits.Ptls8192 bits finite field Diffie-Hellman ephemeral parameters defined in RFC 7919. The estimated symmetric-equivalent strength is 192 bits.LMNOPLMNOP  Safe-InferredtlsAn opaque newtype wrapper to prevent from poking inside content that has been saved.tlsThis is a strict version of &&.tlsSave the content of an  to restore it later.tlsRestore the content of an  to a previous saved value and return the content that has just been replaced.  Safe-InferredtlsAttempt to decode a bytestring representing an DER ASN.1 serialized object into the object.tls7Encode an ASN.1 Object to the DER serialized bytestring Safe-Inferred BSD-styleKazu Yamamoto  experimentalunknown Safe-Inferred;  Safe-Inferred\tlsDigest size in bytes.tlsTest the RSASSA-PKCS1 length condition described in RFC 8017 section 9.2, i.e. emLen >= tLen + 11. Lengths are in bytes.tlsTest the RSASSA-PSS length condition described in RFC 8017 section 9.1.1, i.e. emBits >= 8hLen + 8sLen + 9. Lengths are in bits.tls+(for the md5 context, for the sha1 context)JK/0:987654321;QWVUTSRX\ YZ[ Safe-Inferred<"]tls=Hold both client and server traffic secrets at the same step.^tlsA server traffic secret, typed with a parameter indicating a step in the TLS key schedule.`tlsA client traffic secret, typed with a parameter indicating a step in the TLS key schedule.btls4Phantom type indicating application traffic secrets.ctls2Phantom type indicating handshake traffic secrets.dtls-Phantom type indicating early traffic secret.tls DirectiontlsRoleetlsCompression identificationftlsCipher identificationtls(Certificate request context for TLS 1.3.htlsSome session flagsitls)Session created with Extended Main SecretjtlsSession data to resumevtls)Encrypted session ticket (encrypt(encode j)).wtlsIdentityxtls A session IDytlsVersions known to TLSyz~}|{xwvjklmnopqrstuhigfe.dcb`a^_] Safe-InferredtlsA session managertls&Used on TLS 1.2/1.3 servers to lookup j with x or to decrypt v to get j.tls+Used for 0RTT on TLS 1.3 servers to lookup j with x or to decrypt v to get j.tls*Used TLS 1.2/1.3 servers/clients to store j with x or to encrypt j to get v. In the client side,  should be returned. For clients, only this field should be set with .tls#Used TLS 1.2/1.3 servers to delete j with x if sessionUseTicket is .tls)Used on TLS 1.2 servers to decide to use x or v7. Note that TLS 1.3 servers always use session tickets.tls"The session manager to do nothing. Safe-Inferred"tls0This is the default compression which is a NOOP.tlsevery compression need to be wrapped in this, to fit in structuretls>supported compression algorithms need to be part of this classtls+return the associated ID for this algorithmtlsdeflate (compress) a bytestring using a compression context and return the result along with the new compression context.tlsinflate (decompress) a bytestring using a compression context and return the result along the new compression context.tlsintersect a list of ids commonly given by the other side with a list of compression the function keeps the list of compression in order, to be able to find quickly the prefered compression.tlsdefault null compression e Safe-Inferred7-xtls#The raw content of a TLS extension.tls"Identifier of a TLS extension. http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.txttlsTLS Exceptions. Some of the data constructors indicate incorrect use of the library, and the documentation for those data constructors calls this out. The others wrap  with some kind of context to explain when the exception occurred.tlsEarly termination exception with the reason and the error associatedtls)Handshake failed for the reason attached.tlsFailure occurred while sending or receiving data after the TLS handshake succeeded.tlsLifts a  into  without provided any context around when the error happened.tlsUsage error when the connection has not been established and the user is trying to send or receive data. Indicates that this library has been used incorrectly.tlsExpected that a TLS handshake had already taken place, but no TLS handshake had occurred. Indicates that this library has been used incorrectly.tls6TLSError that might be returned through the TLS stack.)Prior to version 1.8.0, this type had an  Exception instance. In version 1.8.0, this instance was removed, and functions in this library now only throw .tlsmainly for instance of ErrortlsA fatal error condition was encountered at a low level. The elements of the tuple give (freeform text description, structured error description).tlsA non-fatal error condition was encountered at a low level at a low level. The elements of the tuple give (freeform text description, structured error description).tlshandshake policy failed.tls,Some of the IANA registered code points for  are not currently supported by the library. Nor should they be, they're are either unwise, obsolete or both. There's no point in conveying these to the user in the client certificate request callback. The request callback will be filtered to exclude unsupported values. If the user cannot find a certificate for a supported code point, we'll go ahead without a client certificate and hope for the best, unless the user's callback decides to throw an exception.tlsTLS10 and up, RFC8422tlsTLS10 and up, RFC5246tlsTLS10 and up, RFC5246tlsLast supported certificate type, no 'CertificateType that compares greater than this one (based on the  instance, not on the wire code point) will be reported to the application via the client certificate request callback.yz|{~}xjklmnopqrstu Safe-Inferred/ Safe-Inferred0tlsFor now we ignore the version, but perhaps some day the PRF will depend not only on the cipher PRF algorithm, but also on the protocol version. Safe-Inferred19tlsCipher algorithmtlsCheck if a specific 2 is allowed to be used with the version specifiedQWVUTSRXf Safe-Inferred3tlsHandshake information generated for traffic at application level.tls?Handshake information generated for traffic at handshake level.tls;Handshake information generated for traffic at 0-RTT level.tlsID of the application-level protocol negotiated between client and server. See values listed in the  https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids IANA registry.  Safe-Inferred9tlsAll AES and ChaCha20-Poly1305 ciphers supported ordered from strong to weak. This choice of ciphersuites should satisfy most normal needs. For otherwise strong ciphers we make little distinction between AES128 and AES256, and list each but the weakest of the AES128 ciphers ahead of the corresponding AES256 ciphers.AEAD ciphers with equivalent security properties are ordered based on CPU hardware-acceleration support. If this dynamic runtime behavior is not desired, use  instead.tlsSame as , but using deterministic preference not influenced by the CPU.tlsThe default ciphersuites + some not recommended last resort ciphers.AEAD ciphers with equivalent security properties are ordered based on CPU hardware-acceleration support. If this dynamic runtime behavior is not desired, use  instead.tlsSame as , but using deterministic preference not influenced by the CPU.tlsThe strongest ciphers supported. For ciphers with PFS, AEAD and SHA2, we list each AES128 variant after the corresponding AES256 and ChaCha20-Poly1305 variants. For weaker constructs, we use just the AES256 form.AEAD ciphers with equivalent security properties are ordered based on CPU hardware-acceleration support. If this dynamic runtime behavior is not desired, use  instead.tlsSame as , but using deterministic preference not influenced by the CPU. Safe-Inferred:,LMNOP Safe-Inferred:.  Safe-Inferred"%&=Q tlscurrent protocol version tlscurrent key exchange type tls$Decode a list CA distinguished names tls%Encode a list of distinguished names. tlsin certain cases, we haven't manage to decode ServerKeyExchange properly, because the decoding was too eager and the cipher wasn't been set yet. we keep the Server Key Exchange in it unparsed format, and this function is able to really decode the server key xchange if it's unparsed. tlsThe TLS12 PRF is cipher specific, and some TLS12 algorithms use SHA384 instead of the default SHA256.(  Safe-Inferred>tlsTLS encryption level.tlsUnprotected traffictls&Protected with main secret (TLS < 1.3)tls-Protected with early traffic secret (TLS 1.3)tls1Protected with handshake traffic secret (TLS 1.3)tls3Protected with application traffic secret (TLS 1.3)'   Safe-InferredA tlsRepresent a TLS record. tlsturn a plaintext record into a compressed record using the compression function supplied tlsturn a compressed record into a ciphertext record using the cipher function supplied tlsturn a ciphertext fragment into a compressed fragment using the cipher function supplied tlsturn a compressed fragment into a plaintext fragment using the decompression function supplied tls&turn a record into an header and bytes tls*turn a header and a fragment into a record tlsturn a record into a header  Safe-InferredB   Safe-InferredB= ! Safe-InferredBj " Safe-Inferred"B # Safe-Inferred"Sdtls5Type to show which handshake mode is used in TLS 1.3.tlsFull handshake is used.tls0Full handshake is used with hello retry request.tls!Server authentication is skipped.tls8Server authentication is skipped and early data is sent. tlsWhen we receive a CertificateRequest from a server, a just-in-time callback is issued to the application to obtain a suitable certificate. Somewhat unfortunately, the callback parameters don't abstract away the details of the TLS 1.2 Certificate Request message, which combines the legacy certificate_types and new supported_signature_algorithms' parameters is a rather subtle way.TLS 1.2 also (again unfortunately, in the opinion of the author of this comment) overloads the signature algorithms parameter to constrain not only the algorithms used in TLS, but also the algorithms used by issuing CAs in the X.509 chain. Best practice is to NOT treat such that restriction as a MUST, but rather take it as merely a preference, when a choice exists. If the best chain available does not match the provided signature algorithm list, go ahead and use it anyway, it will probably work, and the server may not even care about the issuer CAs at all, it may be doing DANE or have explicit mappings for the client's public key, ... The TLS 1.3 CertificateRequest message, drops certificate_types and no longer overloads supported_signature_algorithms to cover X.509. It also includes a new opaque context token that the client must echo back, which makes certain client authentication replay attacks more difficult. We will store that context separately, it does not need to be presented in the user callback. The certificate signature algorithms preferred by the peer are now in the separate signature_algorithms_cert extension, but we cannot report these to the application callback without an API change. The good news is that filtering the X.509 signature types is generally unnecessary, unwise and difficult. So we just ignore this extension.As a result, the information we provide to the callback is no longer a verbatim copy of the certificate request payload. In the case of TLS 1.3 The 7 list is synthetically generated from the server's signature_algorithms extension, and the signature_algorithms_certs extension is ignored.Since the original TLS 1.2  has no provision for the newer certificate types that have appeared in TLS 1.3 we're adding some synthetic values that have no equivalent values in the TLS 1.2 ! as defined in the IANA < https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-2 TLS ClientCertificateType Identifiers> registry. These values are inferred from the TLS 1.3 signature_algorithms extension, and will allow clients to present Ed25519 and Ed448 certificates when these become supported. tls>Set to Just-value when a TLS13 certificate request is received tls8Set to Just-value when a certificate request is received tlsIn TLS 1.3, these are separate from the certificate issuer signature algorithm hints in the callback data. In TLS 1.2 the same list is overloaded for both purposes. Not present in TLS 1.1 and earlier tls4Set to true when a client certificate chain was sent tlsSet to true when a certificate request was sent. This applies only to requests sent during handshake (not post-handshake). tlsCompress the whole transcript with the specified function. Function f takes the handshake digest as input and returns an encoded handshake message to replace the transcript with. tls2Generate the main secret from the pre-main secret. tlsSet main secret and as a side effect generate the key block with all the right parameters, and setup the pending tx/rx state. tlschosen transmission versiontls2the role (Client or Server) of the generating sidetlsthe pre-main secret tlschosen version  $ Safe-Inferred"U_tls HKDF-Extract function. Returns the pseudorandom key (PRK) from salt and input keying material (IKM).tlsHKDF-Expand-Label function. Returns output keying material of the specified length from the PRK, customized for a TLS label and context. % Safe-Inferred"X tlsExtended Main Secret tls-Application Layer Protocol Negotiation (ALPN) tlsSecure Renegotiation tls?Max fragment extension with length from 512 bytes to 4096 bytesRFC 6066 defines: If a server receives a maximum fragment length negotiation request for a value other than the allowed values, it MUST abort the handshake with an "illegal_parameter" alert.So, if a server receives MaxFragmentLengthOther, it must send the alert. tlsServer Name extension including the name type and the associated name. the associated name decoding is dependant of its name type. name type = 0 : hostname tlsExtension class to transform bytes to and from a high level Extension type. tls.all supported extensions by the implementation  /0:987654321 & Safe-Inferred"Y  ' Safe-Inferred[tls3Certificate Usage callback possible returns values.tlsusage of certificate acceptedtlsusage of certificate rejectedtls&Certificate and Chain rejection reason!   ( Safe-Inferred\tlsA collection of hooks actions.tls)called at each handshake message receivedtls5called at each handshake message received for TLS 1.3tls1called at each certificate chain message receivedtls/hooks on IO and packets, receiving and sending.tlsHooks for logging8This is called when sending and receiving packets and IO  ) Safe-Inferred`tlstry to create a new credential object from a public certificate and the associated private key that are stored on the filesystem in PEM format.tls similar to  but take the certificate and private key from memory instead of from the filesystem.tls similar to / but also allow specifying chain certificates.tls similar to / but also allow specifying chain certificates. tlsChecks whether certificate signatures in the chain comply with a list of hash/signature algorithm pairs. Currently the verification applies only to the signature of the leaf certificate, and when not self-signed. This may be extended to additional chain elements in the future.tls!public certificate (X.509 format)tlsprivate key associatedtls!public certificate (X.509 format)tls!chain certificates (X.509 format)tlsprivate key associated  * Safe-InferredtlsA set of callbacks run by the server for various corners of the TLS establishmenttlsThis action is called when a client certificate chain is received from the client. When it returns a CertificateUsageReject value, the handshake is aborted.The function is not expected to verify the key-usage extension of the certificate. This verification is performed by the library internally. Default: returns the followings: CertificateUsageReject (CertificateRejectOther "no client certificates expected") tlsThis action is called when the client certificate cannot be verified. Return ' to accept the certificate anyway, or   to fail verification.Default: returns  tlsAllow the server to choose the cipher relative to the the client version and the client list of ciphers.This could be useful with old clients and as a workaround to the BEAST (where RC4 is sometimes prefered with TLS < 1.1)'The client cipher list cannot be empty.$Default: taking the head of ciphers.tlsAllow the server to indicate additional credentials to be used depending on the host name indicated by the client.This is most useful for transparent proxies where credentials must be generated on the fly according to the host the client is trying to connect to.Returned credentials may be ignored if a client does not support the signature algorithms used in the certificate chain.Default: returns  tlsAt each new handshake, we call this hook to see if we allow handshake to happens.Default: returns tlsAllow the server to choose an application layer protocol suggested from the client through the ALPN (Application Layer Protocol Negotiation) extensions. If the server supports no protocols that the client advertises an empty  should be returned. Default: tlsAllow to modify extensions to be sent in EncryptedExtensions of TLS 1.3. Default: tlsA set of callbacks run by the clients for various corners of TLS establishmenttlsThis action is called when the a certificate request is received from the server. The callback argument is the information from the request. The server, at its discretion, may be willing to continue the handshake without a client certificate. Therefore, the callback is free to return  to indicate that no client certificate should be sent, despite the server's request. In some cases it may be appropriate to get user consent before sending the certificate; the content of the user's certificate may be sensitive and intended only for specific servers.The action should select a certificate chain of one of the given certificate types and one of the certificates in the chain should (if possible) be signed by one of the given distinguished names. Some servers, that don't have a narrow set of preferred issuer CAs, will send an empty  list, rather than send all the names from their trusted CA bundle. If the client does not have a certificate chaining to a matching CA, it may choose a default certificate instead.Each certificate except the last should be signed by the following one. The returned private key must be for the first certificates in the chain. This key will be used to signing the certificate verify message.The public key in the first certificate, and the matching returned private key must be compatible with one of the list of  value when provided. TLS 1.3 changes the meaning of the list elements, adding explicit code points for each supported pair of hash and signature (public key) algorithms, rather than combining separate codes for the hash and key. For details see  1https://tools.ietf.org/html/rfc8446#section-4.2.3RFC 8446 section 4.2.3. When no compatible certificate chain is available, return  if it is OK to continue without a client certificate. Returning a non-matching certificate should result in a handshake failure.While the TLS version is not provided to the callback, the content of the signature_algorithms list provides a strong hint, since TLS 1.3 servers will generally list RSA pairs with a hash component of  Intrinsic (0x08).Note that is is the responsibility of this action to select a certificate matching one of the requested certificate types (public key algorithms). Returning a non-matching one will lead to handshake failure later.Default: returns  anyway.tlsUsed by the client to validate the server certificate. The default implementation calls   which validates according to the default hooks and checks provided by Data.X509.Validation. This can be replaced with a custom validation function using different settings.The function is not expected to verify the key-usage extension of the end-entity certificate, as this depends on the dynamically-selected cipher and this part should not be cached. Key-usage verification is performed by the library internally. Default:  tlsThis action is called when the client sends ClientHello to determine ALPN values such as '["h2", "http/1.1"]'.Default: returns tlsThis action is called to validate DHE parameters when the server selected a finite-field group not part of the "Supported Groups Registry" or not part of  list.With TLS 1.3 custom groups have been removed from the protocol, so this callback is only used when the version negotiated is 1.2 or below.The default behavior with (dh_p, dh_g, dh_size) and pub as follows: rejecting if dh_p is even,rejecting unless 1 < dh_g && dh_g < dh_p - 1+rejecting unless 1 < dh_p && pub < dh_p - 16rejecting if dh_size < 1024 (to prevent Logjam attack)-See RFC 7919 section 3.1 for recommandations.tls Type for 4. This type synonym is to make document readable.tls Type for 4. This type synonym is to make document readable.tls,Group usage callback possible return values.tlsusage of group acceptedtls-usage of group provides insufficient securitytls>usage of group rejected for other reason (specified as string)tls+usage of group with an invalid public valuetls2Parameters that are common to clients and servers.tlsThe list of certificates and private keys that a server will use as part of authentication to clients. Actual credentials that are used are selected dynamically from this list based on client capabilities. Additional credentials returned by  are also considered.When credential list is left empty (the default value), no key exchange can take place. Default:  tlsCallbacks used by clients and servers in order to resume TLS sessions. The default implementation never resumes sessions. Package  7https://hackage.haskell.org/package/tls-session-managertls-session-manager' provides an in-memory implementation. Default: tlsA collection of trust anchors to be used by a client as part of validation of server certificates. This is set as first argument to function  . Package  7https://hackage.haskell.org/package/crypton-x509-systemcrypton-x509-system gives access to a default certificate store configured in the system. Default:  tlsCallbacks that may be used by a client to cache certificate validation results (positive or negative) and avoid expensive signature check. The default implementation does not have any caching.See the default value of .tls;Additional extensions to be sent during the Hello sequence.For a client this is always included in message ClientHello. For a server, this is sent in messages ServerHello or EncryptedExtensions based on the TLS version. Default: []tls6Client or server policy regarding Extended Main Secrettls Extended Main Secret is not usedtlsExtended Main Secret is allowedtls Extended Main Secret is requiredtlsList all the supported algorithms, versions, ciphers, etc supported.tlsSupported versions by this context. On the client side, the highest version will be used to establish the connection. On the server side, the highest version that is less or equal than the client version will be chosen.Versions should be listed in preference order, i.e. higher versions first. Default:  [TLS13,TLS12]tlsSupported cipher methods. The default is empty, specify a suitable cipher list. + is often a good choice. Default: []tlsSupported compressions methods. By default only the "null" compression is supported, which means no compression will be performed. Allowing other compression method is not advised as it causes a connection failure when TLS 1.3 is negotiated. Default: [nullCompression]tlsAll supported hash/signature algorithms pair for client certificate verification and server signature in (EC)DHE, ordered by decreasing priority.This list is sent to the peer as part of the "signature_algorithms" extension. It is used to restrict accepted signatures received from the peer at TLS level (not in X.509 certificates), but only when the TLS version is 1.2 or above. In order to disable SHA-1 one must then also disable earlier protocol versions in .The list also impacts the selection of possible algorithms when generating signatures.Note: with TLS 1.3 some algorithms have been deprecated and will not be used even when listed in the parameter: MD5, SHA-1, SHA-224, RSA PKCS#1, DSA.Default:  [ (HashIntrinsic, SignatureEd448) , (HashIntrinsic, SignatureEd25519) , (Struct.HashSHA256, SignatureECDSA) , (Struct.HashSHA384, SignatureECDSA) , (Struct.HashSHA512, SignatureECDSA) , (HashIntrinsic, SignatureRSApssRSAeSHA512) , (HashIntrinsic, SignatureRSApssRSAeSHA384) , (HashIntrinsic, SignatureRSApssRSAeSHA256) , (Struct.HashSHA512, SignatureRSA) , (Struct.HashSHA384, SignatureRSA) , (Struct.HashSHA256, SignatureRSA) , (Struct.HashSHA1, SignatureRSA) , (Struct.HashSHA1, SignatureDSA) ] tls/Secure renegotiation defined in RFC5746. If 7, clients send the renegotiation_info extension. If , servers handle the extension or the renegotiation SCSV then send the renegotiation_info extension. Default: tlsIf , renegotiation is allowed from the client side. This is vulnerable to DOS attacks. If  , renegotiation is allowed only from the server side via HelloRequest. Default:  tlsThe mode regarding extended main secret. Enabling this extension provides better security for TLS versions 1.2. TLS 1.3 provides the security properties natively and does not need the extension.By default the extension is . So, the handshake will fail when the peer does not support the extension. Default: tlsSet if we support session. Default: tls4Support for fallback SCSV defined in RFC7507. If , servers reject handshakes which suggest a lower protocol than the highest protocol supported. Default: tlsIn ver <= TLS1.0, block ciphers using CBC are using CBC residue as IV, which can be guessed by an attacker. Hence, an empty packet is normally sent before a normal data packet, to prevent guessability. Some Microsoft TLS-based protocol implementations, however, consider these empty packets as a protocol violation and disconnect. If this parameter is  , empty packets will never be added, which is less secure, but might help in rare cases. Default: tlsA list of supported elliptic curves and finite-field groups in the preferred order.The list is sent to the server as part of the "supported_groups" extension. It is used in both clients and servers to restrict accepted groups in DH key exchange. Up until TLS v1.2, it is also used by a client to restrict accepted elliptic curves in ECDSA signatures.The default value includes all groups with security strength of 128 bits or more. Default: [X25519,X448,P256,FFDHE3072,FFDHE4096,P384,FFDHE6144,FFDHE8192,P521]tls"Request a certificate from client. Default:  tlsThis is a list of certificates from which the disinguished names are sent in certificate request messages. For TLS1.0, it should not be empty. Default: '[]'tlsServer Optional Diffie Hellman parameters. Setting parameters is necessary for FFDHE key exchange when clients are not compatible with RFC 7919.9Value can be one of the standardized groups from module Network.TLS.Extra.FFDHE& or custom parameters generated with ,-. Default: tlsSee the default value of .tlsSee the default value of .tlsSee the default value of .tlsSee the default value of .tlsServer accepts this size of early data in TLS 1.3. 0 (or lower) means that the server does not accept early data. Default: 0tlsLifetime in seconds for session tickets generated by the server. Acceptable value range is 0 to 604800 (7 days).Default: 7200 (2 hours)tls Default: tlsDefine the name of the server, along with an extra service identification blob. this is important that the hostname part is properly filled for security reason, as it allow to properly associate the remote side with the given certificate during a handshake.The extra blob is useful to differentiate services running on the same host, but that might have different certificates given. It's only used as part of the X509 validation infrastructure.This value is typically set by .tlsAllow the use of the Server Name Indication TLS extension during handshake, which allow the client to specify which host name, it's trying to access. This is useful to distinguish CNAME aliasing (e.g. web virtual host). Default: tls1try to establish a connection using this session. Default: tlsSee the default value of .tlsSee the default value of .tlsIn this element, you'll need to override the default empty value of of  with a suitable cipherlist.See the default value of .tlsSee the default value of .tls0Client tries to send early data in TLS 1.3 via sendData if possible. If not accepted by the server, the early data is automatically re-sent. Default:  tls-All settings should not be used in productiontlsDisable the true randomness in favor of deterministic seed that will produce a deterministic random from. This is useful for tests and debugging purpose. Do not use in production Default: tlsAdd a way to print the seed that was randomly generated. re-using the same seed will reproduce the same randomness with Default: no printingtls0Force to choose this version in the server side. Default: tlsPrinting main keys.Default: no printing . Safe-Inferred"%& tls!simple pending action. The first   is necessity of alignment. tlspending action taking transcript hash up to preceding message The first   is necessity of alignment. tls;lock to use for writing data (including updating the state) tls;lock to use for reading data (including updating the state) tlslock used during read/write when receiving and sending packet. it is usually nested in a write or read lock.tlsA TLS Context keep tls specific state, parameters and backend information.tls6return the backend object associated with this context tlshas the handle EOFed or not. tls0has the handshake been done and been successful. tlscurrent TX record state tlscurrent RX record state tlsoptional handshake state tlshooks for this context tls.pending post handshake authentication requests tls-empty packet workaround for CBC guessability. tls#maximum size of plaintext fragmentstls=Information related to a running context, e.g. current ciphertls+A shortcut for 'backendFlush . ctxBackend'.tls+A shortcut for 'backendClose . ctxBackend'.tls%Information about the current contextxjklmnopqrstuEFGHI      / Safe-Inferred> 0 Safe-InferredT tlsrecvRecord receive a full TLS record (header + data), from the other side..The record is disengaged from the record layer tls TLS contexttls;number of AppData bytes to accept above normal maximum size 1 Safe-Inferred 2 Safe-Inferred" 3 Safe-Inferred tlsGenerate a server random suitable for the version selected by the server and its supported versions. We use an 8-byte downgrade suffix when the selected version is lowered because of incomplete client support, but also when a version downgrade has been forced with debugVersionForced. This second part allows to test that the client implementation correctly detects downgrades. The suffix is not used when forcing TLS13 to a server not officially supporting TLS13 (this is not a downgrade scenario but only the consequence of our debug API allowing this). tlsTest if the negotiated version was artificially downgraded (that is, for other reason than the versions supported by the client). 4 Safe-Inferred tlsencodePacket transform a packet into marshalled data related to current state and updating state on the go 5 Safe-Inferred tlsState monad used to group several packets together and send them on wire as single flight. When packets are loaded in the monad, they are logged immediately, update the context digest and transcript, but actual sending is deferred. Packets are sent all at once when the monadic computation ends (normal termination but also if interrupted by an exception). tlsSend one packet to the context tlsreceive one packet from the context that contains 1 or many messages (many only in case of handshake). if will returns a TLSError if the packet is unexpected or malformed 6 Safe-InferredZ 7 Safe-InferredE tlsTest whether the argument is a public key supported for signature at the specified TLS version. This also accepts a key for RSA encryption. This test is performed by clients or servers before verifying a remote Certificate Verify. tlsTest whether the argument is matching key pair supported for signature. This also accepts material for RSA encryption. This test is performed by servers or clients before using a credential from the local configuration. tlsTest whether the public key satisfies a predicate about the elliptic curve. When the public key is not suitable for ECDSA, like RSA for instance, the predicate is not used and the result is . 8 Safe-Inferred" tls0Check that the key is compatible with a list of  values. Ed25519 and Ed448 have no assigned code point and are checked with extension "signature_algorithms" only. tls Translate a  to an acceptable . Perhaps this needs to take supported groups into account, so that, for example, if we don't support any shared ECDSA groups with the server, we return  rather than .Therefore, this interface is preliminary. It gets us moving in the right direction. The interplay between all the various TLS extensions and certificate selection is rather complex.The goal is to ensure that the client certificate request callback only sees  values that are supported by the library and also compatible with the server signature algorithms extension.Since we don't yet support ECDSA private keys, the caller will use , to filter those out for now, leaving just RSA as the only supported client certificate algorithm for TLS 1.3.1FIXME: Add RSA_PSS_PSS signatures when supported. 9 Safe-Inferred"2tlsReturn the message that a TLS endpoint can add to its local log for the specified library error. tls1when a new handshake is done, wrap up & clean up. tls?process a list of handshakes message in the recv state machine. tlsStore the specified keypair. Whether the public key and private key actually match is left for the peer to discover. We're not presently burning CPU to detect that misconfiguration. We verify only that the types of keys match and that it does not include an algorithm that would not be safe.  : Safe-Inferred%& ; Safe-Inferred < Safe-Inferred"%&j tls1TLS13 handshake wrap up & clean up. Contrary to  handshakeDone, this does not handle session, which is managed separately for TLS 1.3. This does not reset byte counters because renegotiation is not allowed. And a few more state attributes are preserved, necessary for TLS13 handshake modes, session tickets and post-handshake authentication.(   = Safe-Inferred"%&> Safe-Inferred"? Safe-Inferred"%&V@ Safe-Inferred";tls>receive Client data in handshake until the Finished handshake.<- [certificate] <- client key xchg <- [cert verify] <- change cipher <- finishA Safe-Inferred"%&kB Safe-Inferred"%&C Safe-Inferred"%&D Safe-Inferred"Ktls)Put the server context in handshake mode.Expect a client hello message as parameter. This is useful when the client hello has been already poped from the recv layer to inspect the packet.When the function returns, a new handshake has been succesfully negociated. On any error, a HandshakeFailed exception is raised.E Safe-Inferred^tlsReturn the supported  values that are compatible with at least one supported signature algorithm.tlsWhen the server requests a client certificate, we try to obtain a suitable certificate chain and private key via the callback in the client parameters. It is OK for the callback to return an empty chain, in many cases the client certificate is optional. If the client wishes to abort the handshake for lack of a suitable certificate, it can throw an exception in the callback.The return value is  when no CertificateRequest was received and no  Certificate? message needs to be sent. An empty chain means that an empty  Certificate> message needs to be sent to the server, naturally without a CertificateVerify. A non-empty   is the chain to send to the server along with a corresponding CertificateVerify.With TLS < 1.2 the server's CertificateRequest does not carry a signature algorithm list. It has a list of supported public key signing algorithms in the certificate_types' field. The hash is implicit. It is S for DSA and X for RSA.With TLS == 1.2 the server's CertificateRequest always has a supported_signature_algorithms list, as a fixed component of the structure. This list is (wrongly) overloaded to also limit X.509 signatures in the client's certificate chain. The BCP strategy is to find a compatible chain if possible, but else ignore the constraint, and let the server verify the chain as it sees fit. The supported_signature_algorithms field is only obligatory with respect to signatures on TLS messages, in this case the CertificateVerify message. The certificate_types field is still included.With TLS 1.3 the server's CertificateRequest has a mandatory signature_algorithms extension, the signature_algorithms_cert extension, which is optional, carries a list of algorithms the server promises to support in verifying the certificate chain. As with TLS 1.2, the client's makes a  best-effort to deliver a compatible certificate chain where all the CA signatures are known to be supported, but it should not abort the connection just because the chain might not work out, just send the best chain you have and let the server worry about the rest. The supported public key algorithms are now inferred from the signature_algorithms extension and certificate_types is gone.(With TLS 1.3, we synthesize and store a certificate_types& field at the time that the server's CertificateRequest message is received. This is then present across all the protocol versions, and can be used to determine whether a CertificateRequest was received or not.If signature_algorithms is ), then we're doing TLS 1.0 or 1.1. The signature_algorithms_cert extension is optional in TLS 1.3, and so the application callback will not be able to distinguish between TLS 1.[01] and TLS 1.3 with no certificate algorithm hints, but this just simplifies the chain selection process, all CA signatures are OK.tlsStore the keypair and check that it is compatible with the current protocol version and a list of  values.tlsReturn a most preferred HandAndSignatureAlgorithm that is compatible with the local key and server's signature algorithms (both already saved). Must only be called for TLS versions 1.2 and up, with compatibility function   or   based on version.The values in the server's signature_algorithms extension are in descending order of preference. However here the algorithms are selected by client preference in  cHashSigs.F Safe-Inferred"tlsTLS 1.2 and below. Send the client handshake messages that follow the  ServerHello, etc. except for CCS and Finished.XXX: Is any buffering done here to combined these messages into a single TCP packet? Otherwise we're prone to Nagle delays, or in any case needlessly generate multiple small packets, where a single larger packet will do. The TLS 1.3 code path seems to separating record generation and transmission and sending multiple records in a single packet.> [certificate]> client key exchange> [cert verify]G Safe-Inferred"ϒtlsprocessServerHello processes the ServerHello message on the client.1) check the version chosen by the server is one allowed by parameters. 2) check that our compression and cipher algorithms are part of the list we sent 3) check extensions received are part of the one we sent 4) process the session parameter to see if the server want to start a new session or can resumeH Safe-Inferred"I Safe-Inferred"J Safe-Inferred"&K Safe-Inferredtls:Post-handshake certificate request with TLS 1.3. Returns  if the request was possible, i.e. if TLS 1.3 is used and the remote client supports post-handshake authentication.L Safe-InferredOM Safe-Inferred"$tlscreate a new context using the backend and parameters specified.tls"Getting TLS Finished sent to peer.tls(Getting TLS Finished received from peer.tlsGetting the "tls-unique" channel binding for TLS 1.2 (RFC5929). For TLS 1.3,  is returned.  must be  But in general, it is highly recommended to upgrade to TLS 1.3 and use the "tls-exporter" channel binding via .tlsGetting the "tls-exporter" channel binding for TLS 1.3 (RFC9266). For TLS 1.2,  is returned.tlsGetting the "tls-server-end-point" channel binding for TLS 1.2 (RFC5929). For 1.3, there is no specifications for how to create it. In this implementation, a certificate chain without extensions is hashed like TLS 1.2.tlsBackend abstraction with specific method to interact with the connection type.tlsParameters of the context.       N Safe-Inferred4 O Safe-Inferred"F tlsHow to update keys in TLS 1.3tlsUnidirectional key updatetls&Bidirectional key update (normal case)tlsHandshake for a new TLS connection This is to be called at the beginning of a connection, and during renegotiation. Don't use this function as the acquire resource of bracket.tlsnotify the context that this side wants to close connection. this is important that it is called before closing the handle, otherwise the session might not be resumable (for version < TLS1.2).&this doesn't actually close the handletlsIf the ALPN extensions have been used, this will return get the protocol agreed upon.tlsIf the Server Name Indication extension has been used, return the hostname specified by the client.tlssendData sends a bunch of data. It will automatically chunk data to acceptable packet sizetlsGet data out of Data packet, and automatically renegotiate if a Handshake ClientHello is received. An empty result means EOF.tls/same as recvData but returns a lazy bytestring.tlsUpdating appication traffic secrets for TLS 1.3. If this API is called for TLS 1.3,  is returned. Otherwise,   is returned.  Safe-Inferred"tlsCallbacks implemented by QUIC and to be called by TLS at specific points during the handshake. TLS may invoke them from external threads but calls are not concurrent. Only a single callback function is called at a given point in time.tlsCalled by TLS so that QUIC sends one or more handshake fragments. The content transiting on this API is the plaintext of the fragments and QUIC responsability is to encrypt this payload with the key material given for the specified level and an appropriate encryption scheme.The size of the fragments may exceed QUIC datagram limits so QUIC may break them into smaller fragments.The handshake protocol sometimes combines content at two levels in a single flight. The TLS library does its best to provide this in the same quicSend call and with a multi-valued argument. QUIC can then decide how to transmit this optimally.tlsCalled by TLS to receive from QUIC the next plaintext handshake fragment. The argument specifies with which encryption level the fragment should be decrypted.?QUIC may return partial fragments to TLS. TLS will then call quicRecv again as long as necessary. Note however that fragments must be returned in the correct sequence, i.e. the order the TLS peer emitted them.The function may return an error to TLS if end of stream is reached or if a protocol error has been received, believing the handshake cannot proceed any longer. If the TLS handshake protocol cannot recover from this error, the failure condition will be reported back to QUIC through the control interface.tlsCalled by TLS when new encryption material is ready to be used in the handshake. The next  or  may now use the associated encryption level (although the previous level is also possible: directions Send/Recv do not change at the same time).tlsCalled by TLS when QUIC-specific extensions have been received from the peer.tls Called when  is done. ' is finished after calling this hook.  calls : after calling this hook to wait for new session tickets.tlsArgument given to ' when encryption material is available.tls6Key material and parameters for traffic at 0-RTT leveltls:Key material and parameters for traffic at handshake leveltls?@ABCDEFGHIxwvjklmnopqrstuhigyz|{~}/0:987654321;JK.YZ[e QWVUTSRXf#$%&'()*+,- !"<=>?@ABCDEFGHIxwvjklmnopqrstuhigyz|{~}|{~}/0:987654321:987654321;JK.YZ[e QWVUTSRXf#$%&'()*+,- !"QRSQRTQRUQRVQRWQRXQRYQRZQR[QR\Q]^Q]_Q]`Q]aQ]bQ]cQ]dQ]efghfghfgifgjfgkfglfgmfgnfgofgpfgqfrsfrsfrtfrufrvfrwfrxfrxfryfrzfr{fr|fr}fr~frfrfr                +#####$$%%%%%'''''''''(((((((((((()))))))***************************************************************************...................9KMMMMMMMMMMMOOOOOOOOOOO                                   Q                                                                                                                                                                                    " " " " " # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # $ % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % %% % % % % % % % & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & && & & & & &&& & & & & & & & & & & & & & & & & & & & & & & Q  Q  Q Q Q Q Q Q Q Q Q Q Q  Q ' '  fr fr f  ' ' ( ) ) ) ) )   * .  . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . / / / 0 0 1 1 2 2 2 2 2 2 2 2 2 2 2 2 2 2 3 3 3 3 3 4 4 4 4 5 5 5 5 5 5 5 5 5 6 6 6 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 8 8 8 8 8 8 8 8 8 8 8 8 8 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 : ;;;;;<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<==>>>>>>>>??@@ABCDDDDEEEEEEEEEEFFFFGGGHHHHIIJJKLLNtls-2.0.3-2jTVhxRoD1SNLfe7mqudr Network.TLSNetwork.TLS.Extra.FFDHENetwork.TLS.QUICNetwork.TLS.Extra.CiphertlsNetwork.TLS.Crypto.TypesNetwork.TLS.ErrTNetwork.TLS.ImportsNetwork.TLS.BackendNetwork.TLS.MeasurementNetwork.TLS.RNGNetwork.TLS.Crypto.DHNetwork.TLS.UtilNetwork.TLS.Util.ASN1Network.TLS.Util.SerializationNetwork.TLS.Crypto.IESNetwork.TLS.CryptoNetwork.TLS.TypesNetwork.TLS.SessionNetwork.TLS.CompressionNetwork.TLS.StructNetwork.TLS.Struct13Network.TLS.MACNetwork.TLS.CipherNetwork.TLS.Handshake.ControlNetwork.TLS.ExtraNetwork.TLS.WireNetwork.TLS.PacketNetwork.TLS.Record.StateNetwork.TLS.Record.TypesNetwork.TLS.Record.EngageNetwork.TLS.Record.DisengageNetwork.TLS.RecordNetwork.TLS.Packet13Network.TLS.Handshake.StateNetwork.TLS.KeyScheduleNetwork.TLS.ExtensionNetwork.TLS.StateNetwork.TLS.X509Network.TLS.HooksNetwork.TLS.CredentialsNetwork.TLS.Parametersciphersuite_defaultCrypto.PubKey.DHgenerateParamsNetwork.TLS.Context.InternalNetwork.TLS.Record.WritingNetwork.TLS.Record.ReadingNetwork.TLS.ReceivingNetwork.TLS.Handshake.State13Network.TLS.Handshake.RandomNetwork.TLS.SendingNetwork.TLS.IONetwork.TLS.Handshake.ProcessNetwork.TLS.Handshake.KeyNetwork.TLS.Handshake.SignatureNetwork.TLS.Handshake.Common(Network.TLS.Handshake.Server.ClientHello!Network.TLS.Handshake.CertificateNetwork.TLS.Handshake.Common13*Network.TLS.Handshake.Server.ClientHello13#Network.TLS.Handshake.Server.Common"Network.TLS.Handshake.Server.TLS13"Network.TLS.Handshake.Server.TLS12*Network.TLS.Handshake.Server.ServerHello13*Network.TLS.Handshake.Server.ServerHello12*Network.TLS.Handshake.Server.ClientHello12Network.TLS.Handshake.Server#Network.TLS.Handshake.Client.Common"Network.TLS.Handshake.Client.TLS12(Network.TLS.Handshake.Client.ServerHello"Network.TLS.Handshake.Client.TLS13(Network.TLS.Handshake.Client.ClientHelloNetwork.TLS.Handshake.ClientNetwork.TLS.PostHandshakeNetwork.TLS.HandshakeNetwork.TLS.ContextNetwork.TLS.Record.LayerNetwork.TLS.CoreNetwork.TLS.Internal)crypton-x509-1.7.6-GhyrNaqq9oy7CmtW9X38vCData.X509.PublicKeyPubKey PubKeyRSA PubKeyDSAPubKeyDHPubKeyEC PubKeyX25519 PubKeyX448 PubKeyEd25519 PubKeyEd448 PubKeyUnknownData.X509.PrivateKeyPrivKey PrivKeyRSA PrivKeyDSA PrivKeyEC PrivKeyX25519 PrivKeyX448PrivKeyEd25519 PrivKeyEd4485crypton-x509-validation-1.6.12-2dGUu4iPcwuBTTK68HzvL0Data.X509.Validation.CacheValidationCache cacheQuerycacheAddValidationCacheAddCallbackValidationCacheQueryCallbackValidationCacheResultValidationCachePassValidationCacheDeniedValidationCacheUnknownexceptionValidationCacheData.X509.ValidationValidationHookshookMatchSubjectIssuerhookValidateTimehookValidateNamehookFilterReasonValidationCheckscheckTimeValidity checkAtTimecheckStrictOrderingcheckCAConstraintscheckExhaustive checkLeafV3checkLeafKeyUsagecheckLeafKeyPurpose checkFQHN&network-3.2.0.0-5QpNnrjrLsi7YSUErzYZu3Network.Socket.InfoHostNameGroup FFDHE8192 FFDHE6144 FFDHE4096 FFDHE3072 FFDHE2048X448X25519P521P384P256supportedNamedGroups HasBackendinitializeBackend getBackendBackend backendFlush backendClose backendSend backendRecv Measurement nbHandshakes bytesReceived bytesSentDHParamsDHPublic ffdhe2048 ffdhe3072 ffdhe4096 ffdhe6144 ffdhe8192HashMD5SHA1SHA224SHA256SHA384SHA512SHA1_MD5KxErrorRSAError KxUnsupportedhashDigestSizeTrafficSecretsServerTrafficSecretClientTrafficSecretApplicationSecretHandshakeSecret EarlySecret CompressionIDCipherIDTLS13TicketInfo SessionFlag SessionEMS SessionDatasessionVersion sessionCiphersessionCompressionsessionClientSNI sessionSecret sessionGroupsessionTicketInfo sessionALPNsessionMaxEarlyDataSize sessionFlagsTicketSessionIDorTicket SessionIDVersionTLS13TLS12TLS11TLS10SSL3SSL2SessionManager sessionResumesessionResumeOnlyOncesessionEstablishsessionInvalidatesessionUseTicketnoSessionManager Compression CompressionCcompressionCIDcompressionCDeflatecompressionCInflatenullCompression HandshakeAlertDescriptionfromAlertDescription ExtensionRaw ExtensionID ClientRandomunClientRandom ServerRandomunServerRandomHeader TLSException TerminatedHandshakeFailed PostHandshakeUncontextualizedConnectionNotEstablishedMissingHandshakeTLSError Error_MiscError_ProtocolError_Protocol_WarningError_CertificateError_HandshakePolicy Error_EOF Error_PacketError_Packet_unexpectedError_Packet_Parsing ProtocolTypefromProtocolTypeHashAndSignatureAlgorithmSignatureAlgorithmfromSignatureAlgorithm HashAlgorithmfromHashAlgorithmCertificateTypefromCertificateTypeNoApplicationProtocolCertificateRequiredUnknownPskIdentityBadCertificateHashValueBadCertificateStatusResponseUnrecognizedNameCertificateUnobtainableUnsupportedExtensionMissingExtensionNoRenegotiation UserCanceledInappropriateFallback InternalErrorInsufficientSecurityProtocolVersionExportRestriction DecryptError DecodeError AccessDenied UnknownCaIllegalParameterCertificateUnknownCertificateExpiredCertificateRevokedUnsupportedCertificateBadCertificateHandshakeFailureDecompressionFailureRecordOverflowDecryptionFailed BadRecordMacUnexpectedMessage CloseNotifyEID_QuicTransportParametersProtocolType_AppDataProtocolType_HandshakeProtocolType_AlertProtocolType_ChangeCipherSpecSignatureRSApsspssSHA512SignatureRSApsspssSHA384SignatureRSApsspssSHA256SignatureEd448SignatureEd25519SignatureRSApssRSAeSHA512SignatureRSApssRSAeSHA384SignatureRSApssRSAeSHA256SignatureECDSA SignatureDSA SignatureRSASignatureAnonymous HashIntrinsic HashSHA512 HashSHA384 HashSHA256 HashSHA224HashSHA1HashMD5HashNoneCertificateType_Ed448_SignCertificateType_Ed25519_SignCertificateType_ECDSA_SignCertificateType_DSA_SignCertificateType_RSA_SignsupportedSignatureSchemes Handshake13CiphercipherID cipherName cipherHash cipherBulkcipherKeyExchange cipherMinVer cipherPRFHashBulkbulkName bulkKeySize bulkIVSizebulkExplicitIVbulkAuthTagLen bulkBlockSizebulkFCipherKeyExchangeTypeCipherKeyExchange_RSACipherKeyExchange_DH_AnonCipherKeyExchange_DHE_RSACipherKeyExchange_ECDHE_RSACipherKeyExchange_DHE_DSACipherKeyExchange_DH_DSACipherKeyExchange_DH_RSACipherKeyExchange_ECDH_ECDSACipherKeyExchange_ECDH_RSACipherKeyExchange_ECDHE_ECDSACipherKeyExchange_TLS13 BulkFunctions BulkBlockF BulkStreamF BulkAeadF BulkDirection BulkEncrypt BulkDecryptBulkAEAD BulkBlock BulkStream BulkStateBulkStateStreamBulkStateBlock BulkStateAEADBulkStateUninitializedBulkAdditionalData BulkNonceBulkIVBulkKeybulkInithasMAC hasRecordIVcipherKeyBlockSizecipherAllowedForVersionApplicationSecretInfoHandshakeSecretInfoEarlySecretInfoNegotiatedProtocolciphersuite_default_detciphersuite_allciphersuite_all_detciphersuite_strongciphersuite_strong_detcipher_TLS13_AES128GCM_SHA256cipher_TLS13_AES256GCM_SHA384$cipher_TLS13_CHACHA20POLY1305_SHA256cipher_TLS13_AES128CCM_SHA256cipher_TLS13_AES128CCM8_SHA256#cipher_ECDHE_ECDSA_AES128GCM_SHA256#cipher_ECDHE_ECDSA_AES256GCM_SHA384!cipher_ECDHE_RSA_AES128GCM_SHA256!cipher_ECDHE_RSA_AES256GCM_SHA384#cipher_ECDHE_ECDSA_AES128CCM_SHA256#cipher_ECDHE_ECDSA_AES256CCM_SHA256$cipher_ECDHE_ECDSA_AES128CCM8_SHA256$cipher_ECDHE_ECDSA_AES256CCM8_SHA256(cipher_ECDHE_RSA_CHACHA20POLY1305_SHA256*cipher_ECDHE_ECDSA_CHACHA20POLY1305_SHA256 CryptLevel CryptInitialCryptMainSecretCryptEarlySecretCryptHandshakeSecretCryptApplicationSecretHandshakeMode13 FullHandshakeHelloRetryRequest PreSharedKeyRTT0 hkdfExtracthkdfExpandLabelMaxFragmentEnumMaxFragment512MaxFragment1024MaxFragment2048MaxFragment4096CertificateUsageCertificateUsageAcceptCertificateUsageRejectCertificateRejectReasonCertificateRejectExpiredCertificateRejectRevokedCertificateRejectUnknownCACertificateRejectAbsentCertificateRejectOtherHookshookRecvHandshakehookRecvHandshake13hookRecvCertificates hookLoggingLoggingloggingPacketSentloggingPacketRecv loggingIOSent loggingIORecv Credentials CredentialcredentialLoadX509credentialLoadX509FromMemorycredentialLoadX509Chain!credentialLoadX509ChainFromMemory ServerHooksonClientCertificateonUnverifiedClientCertonCipherChoosingonServerNameIndicationonNewHandshakeonALPNClientSuggestonEncryptedExtensionsCreating ClientHooksonCertificateRequestonServerCertificate onSuggestALPNonCustomFFDHEGroupOnServerCertificateOnCertificateRequest GroupUsageGroupUsageValidGroupUsageInsecureGroupUsageUnsupportedGroupUsageInvalidPublicSharedsharedCredentialssharedSessionManager sharedCAStoresharedValidationCachesharedHelloExtensionsEMSModeNoEMSAllowEMS RequireEMS SupportedsupportedVersionssupportedCipherssupportedCompressionssupportedHashSignaturessupportedSecureRenegotiation%supportedClientInitiatedRenegotiationsupportedExtendedMainSecretsupportedSessionsupportedFallbackScsvsupportedEmptyPacketsupportedGroups ServerParamsserverWantClientCertserverCACertificatesserverDHEParams serverHooks serverSharedserverSupported serverDebugserverEarlyDataSizeserverTicketLifetime ClientParamsclientUseMaxFragmentLengthclientServerIdentificationclientUseServerNameIndicationclientWantSessionResume clientShared clientHooksclientSupported clientDebugclientUseEarlyData DebugParams debugSeeddebugPrintSeeddebugVersionForceddebugKeyLoggerdefaultParamsClientContext ctxBackend Information infoVersion infoCipherinfoCompressioninfoMainSecretinfoExtendedMainSecretinfoClientRandominfoServerRandominfoSupportedGroupinfoTLS12ResumptioninfoTLS13HandshakeModeinfoIsEarlyDataAccepted contextFlush contextClosecontextGetInformationcontextModifyHookserrorToAlertMessagerequestCertificate TLSParams contextNewcontextHookSetHandshakeRecvcontextHookSetHandshake13RecvcontextHookSetCertificateRecvcontextHookSetLogging getFinishedgetPeerFinished getTLSUniquegetTLSExportergetTLSServerEndPointKeyUpdateRequestOneWayTwoWay handshakebyegetNegotiatedProtocol getClientSNIsendDatarecvData recvData' updateKey QUICCallbacksquicSendquicRecvquicInstallKeysquicNotifyExtensionsquicDoneKeyScheduleEventInstallEarlyKeysInstallHandshakeKeysInstallApplicationKeys tlsQUICClient tlsQUICServererrorTLSerrorToAlertDescriptiontoAlertDescriptiondefaultSupportedquicMaxEarlyDataSizeBytesgetClientCertificateChainavailableFFGroupsavailableECGroupsKeyExchangeSignatureAlgKX_RSAKX_DSAKX_ECDSArunErrTErrT mtl-2.3.1Control.Monad.Error.Class MonadError throwError catchErrorbytestring-0.11.5.2Data.ByteString.Internal.Type ByteStringbase Data.Functor<&>GHC.Base Applicative*><*>pureliftA2<* Alternativeempty<|>somemanyData.Functor.ConstConstgetConstControl.ApplicativeZipList getZipList WrappedArrow WrapArrow unwrapArrow WrappedMonad WrapMonad unwrapMonad<$>Functorfmap<$<**>liftAliftA3optional Data.FoldableasumMonadreturn>>>>= MonadPlusmzeromplusControl.Monad.Fail MonadFailfailjoinmapM_forM_Data.TraversablemapMsequenceforM Control.MonadforeverliftMguard=<<whenliftM2liftM3liftM4liftM5apvoid sequence_msumfilterM>=><=< mapAndUnzipMzipWithM zipWithM_foldMfoldM_ replicateM replicateM_unless<$!>mfilterGHC.Bits FiniteBits finiteBitSizecountLeadingZeroscountTrailingZerosBits.&..|.xor complementshiftrotatezeroBitsbitsetBitclearBit complementBittestBit bitSizeMaybebitSizeisSignedshiftL unsafeShiftLshiftR unsafeShiftRrotateLrotateRpopCount Data.BitsIffgetIffXorgetXorIorgetIorAndgetAnd bitDefaulttestBitDefaultpopCountDefaulttoIntegralSizedoneBits.^..>>..<<.!>>.!<<.++foldrlengthfoldlnullfoldl'foldl1sumproductfoldr1maximumminimumelemmapGHC.ListzipWith Data.OldListsortBy genericLength maximumBy minimumBygenericReplicate genericTake genericDropgenericSplitAt genericIndexheadgroupgroupByfilterunfoldr transposesortOncycleconcatzipunconstaillastinitfoldl1'scanlscanl1scanl'scanrscanr1iterateiterate'repeat replicate takeWhile dropWhiletakedropsplitAtspanbreakreverseandoranyallnotElemlookup concatMap!!zip3zipWith3unzipunzip3find dropWhileEnd stripPrefix elemIndex elemIndices findIndex findIndices isPrefixOf isSuffixOf isInfixOfnubnubBydeletedeleteBy\\unionunionBy intersect intersectBy intersperse intercalate partition mapAccumL mapAccumRinsertinsertByzip4zip5zip6zip7zipWith4zipWith5zipWith6zipWith7unzip4unzip5unzip6unzip7deleteFirstsByinitstails subsequences permutationssort singletonlinesunlineswordsunwords Data.ListisSubsequenceOf GHC.MaybeMaybeNothingJust Data.MaybemaybeisJust isNothingfromJust fromMaybe maybeToList listToMaybe catMaybesmapMaybeData.Semigroup.InternalAnygetAny Semigroup<>sconcatstimesSumgetSumProduct getProductData.SemigroupLastgetLastFirstgetFirstMingetMinMaxgetMaxAllgetAllEndoappEndoDualgetDual WrappedMonoid WrapMonoid unwrapMonoidArgMaxArgMinArgstimesIdempotentstimesIdempotentMonoid stimesMonoidcycle1diff mtimesDefaultghc-prim GHC.TypesOrderingLTEQGT GHC.ClassesOrdcompare>=<<=>maxminData.OrdDowngetDownclamp comparingGHC.WordWord8WordWord64Word32Word16 byteSwap16 byteSwap32 byteSwap64 bitReverse8 bitReverse16 bitReverse32 bitReverse64 showBytesHexnewMeasurementaddBytesReceived addBytesSentresetBytesCountersincrementNbHandshakesStateRNG#crypton-0.34-E5Dk5pqXKlDCTQoCaWkaff Crypto.RandomSeedseedNew seedToIntegerseedFromInteger withTLSRNG newStateRNGCrypto.Random.Types MonadRandomgetRandomBytes DHPrivateDHKeydhPublic dhPrivatedhParams dhParamsGetP dhParamsGetGdhParamsGetBitsdhGenerateKeyPair dhGetShareddhValiddhUnwrapdhUnwrapPublicSaved&&!saveMVarGHC.MVarMVar restoreMVarsubtakelast partition3 partition6 fmapEithercatchException forEitherM mapChunks_ getChunksdecodeASN1ObjectencodeASN1ObjectCrypto.Number.Serializeos2ipi2ospi2ospOf_ GroupPublic GroupPrivateGroupKeygroupGenerateKeyPairgroupGetPubSharedgroupGetSharedencodeGroupPublicdecodeGroupPublicdhParamsForGroupdhGroupGenerateKeyPairdhGroupGetPubSharedkxCanUseRSApkcs1kxCanUseRSApss hashUpdateSSL HashContextHashCtxhashInit hashUpdate hashFinalhashhashName hashBlockSize PublicKey PrivateKeySignatureParams RSAParams DSAParams ECDSAParams Ed25519Params Ed448ParamsisKeyExchangeSignatureKeyfindKeyExchangeSignatureAlgfindFiniteFieldGroupfindEllipticCurveGroup kxEncrypt kxDecryptkxSignkxVerifykxSupportedPrivKeyEC RSAEncodingRSApkcs1RSApss DirectionRoleCertReqContextisTicket toSessionIDlifetimeageAddtxrxTime estimatedRTT ClientRole ServerRole invertRoleTxRxSecond MillisecondResumptionSecret BaseSecretAnyTrafficSecret SecretTripletriBase triClient triServer SecretPairpairBase pairClient MainSecretTrueNullCompression compressionIDcompressionDeflatecompressionInflatecompressionIntersectIDlastSupportedCertificateType CipherDatacipherDataContent cipherDataMACcipherDataPaddingEID_ServerNameEID_MaxFragmentLengthEID_ClientCertificateUrlEID_TrustedCAKeysEID_TruncatedHMACEID_StatusRequestEID_UserMappingEID_ClientAuthzEID_ServerAuthz EID_CertTypeEID_SupportedGroupsEID_EcPointFormatsEID_SRPEID_SignatureAlgorithmsEID_SRTP EID_Heartbeat'EID_ApplicationLayerProtocolNegotiationEID_StatusRequestv2EID_SignedCertificateTimestampEID_ClientCertificateTypeEID_ServerCertificateType EID_PaddingEID_EncryptThenMACEID_ExtendedMainSecretEID_SessionTicketEID_PreSharedKey EID_EarlyDataEID_SupportedVersions EID_CookieEID_PskKeyExchangeModesEID_CertificateAuthoritiesEID_OidFiltersEID_PostHandshakeAuthEID_SignatureAlgorithmsCert EID_KeyShareEID_SecureRenegotiationfromExtensionIDDigitallySigned SignatureData.X509.DistinguishedNameDistinguishedNameBigNumbigNumToIntegerbigNumFromIntegerServerDHParamsserverDHParams_pserverDHParams_gserverDHParams_yserverDHParamsToParamsserverDHParamsToPublicserverDHParamsFromServerECDHParamsServerRSAParams rsa_modulus rsa_exponentServerKeyXchgAlgorithmData SKX_DH_Anon SKX_DHE_DSA SKX_DHE_RSA SKX_ECDHE_RSASKX_ECDHE_ECDSASKX_RSA SKX_DH_DSA SKX_DH_RSA SKX_Unparsed SKX_UnknownClientKeyXchgAlgorithmDataCKX_RSACKX_DHCKX_ECDHPacketAlertChangeCipherSpecAppData FinishedData VerifyDataSession AlertLevelAlertLevel_WarningAlertLevel_FatalfromAlertLevel HandshakeTypeHandshakeType_HelloRequestHandshakeType_ClientHelloHandshakeType_ServerHelloHandshakeType_NewSessionTicketHandshakeType_EndOfEarlyData!HandshakeType_EncryptedExtensionsHandshakeType_CertificateHandshakeType_ServerKeyXchgHandshakeType_CertRequestHandshakeType_ServerHelloDoneHandshakeType_CertVerifyHandshakeType_ClientKeyXchgHandshakeType_FinishedHandshakeType_KeyUpdatefromHandshakeTypeFinished Certificate ClientHello ServerHello HelloRequestServerHelloDone ClientKeyXchg ServerKeyXchg CertRequest CertVerifyNewSessionTicketCH chSession chCiphers chExtensions packetTypetypeOfHandshakePacket13Alert13ChangeCipherSpec13 AppData13 ServerHello13NewSessionTicket13EndOfEarlyData13EncryptedExtensions13 CertRequest13 Certificate13 CertVerify13 Finished13 KeyUpdate13typeOfHandshake13 contentType KeyUpdateUpdateNotRequestedUpdateRequestedprf_TLSmacSSLhmacprf_MD5prf_SHA1 prf_SHA256 prf_MD5SHA1 ClientStateSendClientHelloRecvServerHelloSendClientFinished ServerStateSendServerHelloSendServerFinished%cereal-0.5.8.3-JKZKQMLMQ2v8uUoo8OtauqData.Serialize.GetGet GetResultGotError GotPartial GotSuccessGotSuccessRemainingGetContinuationrunGet runGetErr runGetMaybetryGet remaininggetWord8 getWords8 getWord16 getWords16 getWord24 getWord32 getWord64getBytes getOpaque8 getOpaque16 getOpaque24 getInteger16 getBigNum16getList processBytesisEmptyData.Serialize.PutPutrunPutputWord8 putWords8 putWord16 putWords16 putWord24 putWord32 putWord64putBytes putOpaque8 putOpaque16 putOpaque24 putInteger16 putBigNum16 encodeWord16 encodeWord32 encodeWord64cParamsVersioncParamsKeyXchgType getDNames putDNames&decodeReallyServerKeyXchgAlgorithmDatagetPRF CurrentParams decodeHeader encodeHeader decodeAlert decodeAlerts encodeAlertsdecodeHandshakeRecorddecodeHandshakeencodeHandshakeencodeCertificatedecodeChangeCipherSpecencodeChangeCipherSpecdecodePreMainSecretencodePreMainSecretencodeSignedDHParamsencodeSignedECDHParamsgenerateMainSecretgenerateExtendedMainSecretgenerateKeyBlockgenerateClientFinishedgenerateServerFinishedgetSignatureHashAlgorithmputSignatureHashAlgorithmgetBinaryVersionputBinaryVersiongetClientRandom32putClientRandom32getServerRandom32putServerRandom32 getExtensions putExtension getSession putSessiongetHandshakeType CryptStatecstKeycstIV cstMacSecret HasCryptLevel getCryptLevelMacState msSequence RecordOptions recordVersion recordTLS13 RecordStatestCipher stCompression stCryptLevel stCryptState stMacStatenewRecordStateincrRecordStateRecordM runRecordMgetRecordOptionsgetRecordVersion setRecordIVwithCompression computeDigest makeDigestgetBulkgetMacSequenceRecordfragmentCompressfragmentCipherfragmentUncipherfragmentUncompress recordToRaw rawToRecordrecordToHeaderFragmentfragmentGetBytesfragmentPlaintextfragmentCompressedfragmentCiphertext Plaintext Compressed CiphertextonRecordFragment engageRecorddisengageRecordencodeHandshake13decodeHandshakeRecord13decodeHandshake13decodeHandshakes13encodeCertificate13 CertReqCBdatahstCertReqTokenhstCertReqCBdatahstCertReqSigAlgsCerthstClientCertSenthstCertReqSentfoldHandshakeDigestsetMainSecretFromPre setMainSecretsetServerHelloParametersHandshakeStatehstClientVersionhstClientRandomhstServerRandom hstMainSecret hstKeyStatehstServerDHParams hstDHPrivatehstServerECDHParamshstGroupPrivatehstHandshakeDigesthstHandshakeMessageshstClientCertChainhstPendingTxStatehstPendingRxStatehstPendingCipherhstPendingCompressionhstExtendedMainSecrethstSupportedGrouphstTLS13HandshakeModehstTLS13RTT0StatushstTLS13EarlySecrethstTLS13ResumptionSecret hstCCS13SentHandshakeDigestHandshakeMessagesHandshakeDigestContext RTT0StatusRTT0NoneRTT0Sent RTT0Accepted RTT0Rejected HandshakeMnewEmptyHandshake runHandshake setPublicKeysetPublicPrivateKeysgetLocalPublicPrivateKeysgetRemotePublicKeysetServerDHParamsgetServerDHParamssetServerECDHParamsgetServerECDHParams setDHPrivate getDHPrivatesetGroupPrivategetGroupPrivatesetClientCertSentgetClientCertSentsetCertReqSentgetCertReqSentsetClientCertChaingetClientCertChainsetCertReqTokengetCertReqTokensetCertReqCBdatagetCertReqCBdatasetCertReqSigAlgsCertgetCertReqSigAlgsCertaddHandshakeMessageupdateHandshakeDigestgetHandshakeMessagesgetHandshakeMessagesRevgetHandshakeDigestgetPendingCiphersetExtendedMainSecretgetExtendedMainSecretsetSupportedGroupgetSupportedGroupsetTLS13HandshakeModegetTLS13HandshakeModesetTLS13RTT0StatusgetTLS13RTT0StatussetTLS13EarlySecretgetTLS13EarlySecretsetTLS13ResumptionSecretgetTLS13ResumptionSecret setCCS13Sent getCCS13Sent deriveSecretExtendedMainSecret#ApplicationLayerProtocolNegotiationSecureRenegotiationMaxFragmentLength ServerName ExtensionsupportedExtensionsextensionDecodeextensionEncode extensionIDdefinedExtensionsServerNameTypeServerNameHostNameServerNameOtherMaxFragmentLengthOtherSupportedGroupsEcPointFormatsSupported EcPointFormatEcPointFormat_Uncompressed'EcPointFormat_AnsiX962_compressed_prime'EcPointFormat_AnsiX962_compressed_char2 SessionTicket HeartBeat HeartBeatModeHeartBeat_PeerAllowedToSendHeartBeat_PeerNotAllowedToSendSignatureAlgorithmsSignatureAlgorithmsCertSupportedVersionsSupportedVersionsClientHelloSupportedVersionsServerHelloKeyShareKeyShareClientHelloKeyShareServerHello KeyShareHRR KeyShareEntrykeyShareEntryGroupkeyShareEntryKeyExchange MessageTypeMsgTClientHelloMsgTServerHelloMsgTHelloRetryRequestMsgTEncryptedExtensionsMsgTNewSessionTicketMsgTCertificateRequestPostHandshakeAuth PskKexModePSK_KE PSK_DHE_KEPskKeyExchangeModes PskIdentityPreSharedKeyClientHelloPreSharedKeyServerHelloEarlyDataIndicationCookieCertificateAuthoritiesTLSState stSessionstSessionResumingstSecureRenegotiationstClientVerifyDatastServerVerifyDatastServerCertificateChainstExtensionALPNstHandshakeRecordContstNegotiatedProtocolstHandshakeRecordCont13stClientALPNSuggeststClientGroupSuggeststClientEcPointFormatSuggeststClientCertificateChain stClientSNI stRandomGen stVersionstClientContextstTLS13KeySharestTLS13PreSharedKey stTLS13HRR stTLS13CookiestExporterSecretstClientSupportsPHAstTLS12SessionTicketTLSSt runTLSState newTLSStatesetVerifyDataForSendsetVerifyDataForRecv getVerifyDatagetMyVerifyDatagetPeerVerifyDatagetFirstVerifyDatafinishedHandshakeTypeMaterialfinishedHandshakeMaterialcertVerifyHandshakeTypeMaterialcertVerifyHandshakeMaterial setVersionsetVersionIfUnset getVersiongetVersionWithDefaultsetSecureRenegotiationgetSecureRenegotiationsetExtensionALPNgetExtensionALPNsetNegotiatedProtocolsetClientALPNSuggestgetClientALPNSuggestsetClientEcPointFormatSuggestgetClientEcPointFormatSuggest setClientSNIsetClientCertificateChaingetServerCertificateChainsetServerCertificateChain setSessionisSessionResuminggetRolesetExporterSecretgetExporterSecretsetTLS13KeySharegetTLS13KeySharesetTLS13PreSharedKeygetTLS13PreSharedKey setTLS13HRR getTLS13HRRsetTLS13CookiegetTLS13CookiesetClientSupportsPHAgetClientSupportsPHAsetTLS12SessionTicketgetTLS12SessionTicket genRandomwithRNGData.X509.CertificateChainCertificateChainData.X509.Cert certVersion certSerialcertSignatureAlg certIssuerDN certValidity certSubjectDN certPubKeycertExtensions Data.X509SignedCertificategetCertificateisNullCertificateChaingetCertificateChainLeaf/crypton-x509-store-1.6.9-A0HOMV9aTdyHu7OvQp2eYnData.X509.CertificateStoreCertificateStorevalidateDefault FailedReasonData.X509.Validation.Types ServiceIDwrapCertificateChecks pubkeyType defaultHookscredentialMatchesHashSignaturescredentialsFindForSigningcredentialsFindForDecrypting credentialsListSigningAlgorithmscredentialPublicPrivateKeysFalsemempty CommonParamsPendingRecvActionBoolPendingRecvActionHash lockWritelockRead lockStatectxEOF_ctxEstablished_ctxTxRecordStatectxRxRecordStatectxHandshakeState ctxRoleParamsctxCertRequestsctxNeedEmptyPacketctxFragmentSize ctxSupported ctxShared ctxTLSStatectxMeasurementctxLocks ctxKeyLoggerctxHooks ctxTLS13StatectxPendingRecvActionsctxPendingSendActionctxRecordLayerctxHandshakeSync ctxQUICMode EstablishedNotEstablishedEarlyDataAllowedEarlyDataNotAllowedEarlyDataSending RecordLayer recordEncoderecordEncode13recordSendBytes recordRecv recordRecv13Locks RoleParams doHandshake_doHandshakeWith_doRequestCertificate_doPostHandshakeAuthWith_ctxEOFctxEstablishedwithLog ctxWithHookssetEOFsetEstablished contextSend contextRecvupdateRecordLayer updateMeasure withMeasure withReadLock withWriteLock withStateLock withRWLock throwCorefailOnEitherError usingState usingState_runTxRecordStaterunRxRecordState usingHState getHState saveHState restoreHState getStateRNG tls13orLateraddCertRequest13getCertRequest13decideRecordVersion HandshakeSync TLS13Statetls13stRecvNSTtls13stSentClientCert tls13stRecvSF tls13stSentCF tls13stRecvCFtls13stPendingRecvDatatls13stPendingSentData tls13stRTT tls13st0RTTtls13st0RTTAcceptedtls13stClientExtensions tls13stChoice tls13stHsKeytls13stSessiontls13stSentExtensionsdefaultTLS13State getTLS13StatemodifyTLS13State CipherChoicecVersioncCiphercHashcZeromakeCipherChoice encodeRecordencodeRecord13 sendBytes recvRecord recvRecord13 processPacketprocessPacket13 TrafficSecretgetTxRecordStategetRxRecordStatesetTxRecordStatesetRxRecordState getTxLevel getRxLevelclearTxRecordStateclearRxRecordStatesetHelloParameters13transcriptHashwrapAsMessageHash13setPendingRecvActionspopPendingRecvAction serverRandom isDowngraded clientRandom hrrRandomisHelloRetryRequestencodePacket12encodePacket13updateHandshake12updateHandshake13 PacketFlightM sendPacket12 recvPacket12 sendPacket13 recvPacket13isRecvComplete checkValidrunPacketFlight loadPacket13processHandshake12processHandshake13startHandshakecheckDigitalSignatureKeyisDigitalSignaturePairsatisfiesEcPredicate encryptRSA signPrivate decryptRSA verifyPublic generateDHE generateECDHEgenerateECDHEShared generateFFDHEgenerateFFDHESharedversionCompatiblegetLocalPublicKeylogKeycertificateCompatiblehashSigToCertTypecreateCertificateVerifycheckCertificateVerifydigitallySignDHParamsdigitallySignECDHParamsdigitallySignDHParamsVerifydigitallySignECDHParamsVerifycheckSupportedHashSignaturesignatureCompatiblesignatureCompatible13signatureParams decryptErrorhandshakeDone12onRecvStateHandshake storePrivInfohandshakeFailedhandleException unexpected newSessionensureNullCompressionsendCCSandFinished RecvStateRecvStatePacketRecvStateHandshake RecvStateDone runRecvStaterunRecvStateHSrecvPacketHandshakeensureRecvCompleteprocessExtendedMainSecretextensionLookupgetSessionDataisSupportedGroupcheckSupportedGroup errorToAlertexpectFinishedprocessCertificateprocessClientHellocertificateRejectedbadCertificaterejectOnExceptionverifyLeafKeyUsage extractCAnamehandshakeDone13 makeFinished checkFinishedmakeServerKeySharemakeClientKeySharefromServerKeySharemakeCertVerifycheckCertVerify makePSKBinderreplacePSKBindersendChangeCipherSpec13makeCertRequestcreateTLS13TicketInfoageToObfuscatedAge isAgeValidgetAgecheckFreshnessgetCurrentTimeFromBasegetSessionData13isHashSignatureValid13safeNonNegative32RecvHandshake13MrunRecvHandshake13recvHandshake13recvHandshake13hashinitEarlySecretcalculateEarlySecretcalculateHandshakeSecretcalculateApplicationSecretcalculateResumptionSecret derivePSKcheckKeyShareKeyLengthsetRTTprocessClientHello13sendHRRapplicationProtocolcheckValidClientCertChainclientCertificatecredentialDigitalSignatureKeyfilterCredentials#filterCredentialsWithHashSignaturesisCredentialAllowedstorePrivInfoServerrecvClientSecondFlight13postHandshakeAuthServerWith recvClientCCCrecvClientSecondFlight12sendServerHello13sendServerHello12processClinetHello12handshakeServerhandshakeServerWithrequestCertificateServersupportedCtypes clientChainstorePrivInfoClientgetLocalHashSigAlgthrowMiscErrorOnExceptiondoServerKeyExchange doCertificatesigAlgsToCertTypessetALPN contextSync sendClientCCCrecvServerFirstFlight12sendClientSecondFlight12recvServerSecondFlight12processServerHellorecvServerHelloprocessServerHello13recvServerSecondFlight13sendClientSecondFlight13asyncServerHello13postHandshakeAuthClientWithsendClientHellogetPreSharedKeyInfohandshakeClienthandshakeClientWithpostHandshakeAuthWith handshake_ handshakeWithnewTransparentRecordLayer