Prepare release

.travis-test-mirage.sh

@@ -6,8 +6,8 @@ opam install mirage
 
 cd mirage/example
 
-mirage clean && mirage configure && mirage build
-export BUILD=client && mirage clean && mirage configure && mirage build && ./mir-tls-client
+mirage clean && mirage configure --unix --net=socket && mirage build
+export BUILD=client && mirage clean && mirage configure --unix --net=socket && mirage build && ./mir-tls-client
 
 cd ../example2
 mirage clean && mirage configure && mirage build

CHANGES.md

@@ -1,4 +1,5 @@
-master:
+0.7.1 (2016-03-21):
+* remove camlp4 dependency (use cstruct ppx and sexplib ppx instead)
 * sort client extensions, there are servers which dislike an extension without
   data at the end, thus try to send extensions with data at the end (#319)
 * initial GCM support (#310)
@@ -26,7 +27,7 @@ master:
 
     In the end, it is a pretty academic thing anyways, since nobody uses
     renegotiation with OCaml-TLS in the field.
-* durinng verification of a digitally signed: checked that the used hash
+* during verification of a digitally signed: checked that the used hash
   algorithm is one of the configured ones (#313)
 * unify return type of handshake and change cipher spec handler (#314)
 * separate client and server extensions (#317)

_oasis

@@ -1,6 +1,6 @@
 OASISFormat: 0.4
 Name:        tls
-Version:     0.7.0
+Version:     0.7.1
 Synopsis:    TLS support for OCaml
 Authors:     Hannes Mehnert <hannes@mehnert.org>, David Kaloper <david@numm.org>
 Maintainers: David Kaloper <david@numm.org>, Hannes Mehnert <hannes@mehnert.org>

lib/config.ml

@@ -40,17 +40,13 @@ module Ciphers = struct
    * slice and groom those lists. *)
 
   let default = [
-    `TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ;
-    `TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 ;
     `TLS_DHE_RSA_WITH_AES_256_CCM ;
     `TLS_DHE_RSA_WITH_AES_128_CCM ;
     `TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 ;
     `TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 ;
     `TLS_DHE_RSA_WITH_AES_256_CBC_SHA ;
     `TLS_DHE_RSA_WITH_AES_128_CBC_SHA ;
     `TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA ;
-    `TLS_RSA_WITH_AES_256_GCM_SHA384 ;
-    `TLS_RSA_WITH_AES_128_GCM_SHA256 ;
     `TLS_RSA_WITH_AES_256_CCM ;
     `TLS_RSA_WITH_AES_128_CCM ;
     `TLS_RSA_WITH_AES_256_CBC_SHA256 ;
@@ -61,6 +57,10 @@ module Ciphers = struct
     ]
 
   let supported = default @ [
+    `TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ;
+    `TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 ;
+    `TLS_RSA_WITH_AES_256_GCM_SHA384 ;
+    `TLS_RSA_WITH_AES_128_GCM_SHA256 ;
     `TLS_RSA_WITH_RC4_128_SHA ;
     `TLS_RSA_WITH_RC4_128_MD5
     ]

mirage/example/unikernel.ml

@@ -1,4 +1,4 @@
-open Lwt
+open Lwt.Infix
 
 open V1
 open V1_LWT
@@ -9,7 +9,7 @@ type ('a, 'e, 'c) m = ([< `Ok of 'a | `Error of 'e | `Eof ] as 'c) Lwt.t
 let (>>==) (a : ('a, 'e, _) m) (f : 'a -> ('b, 'e, _) m) : ('b, 'e, _) m =
   a >>= function
     | `Ok x                -> f x
-    | `Error _ | `Eof as e -> return e
+    | `Error _ | `Eof as e -> Lwt.return e
 
 
 module Color = struct
@@ -53,27 +53,29 @@ struct
   module L    = Log (C)
 
   let rec handle c flush tls =
-    lwt res = TLS.read tls in
-    flush () >> match res with
-      | `Ok buf ->
-          L.log_data c "recv" buf
-          >> TLS.write tls buf >> handle c flush tls
-      | err     -> return err
+    TLS.read tls >>= fun res ->
+    flush () >>= fun () ->
+    match res with
+    | `Ok buf ->
+      L.log_data c "recv" buf >>= fun () ->
+      TLS.write tls buf >>== fun () ->
+      handle c flush tls
+    | err     -> Lwt.return err
 
   let accept c conf k flow =
     let (trace, flush_trace) = make_tracer (C.log_s c) in
-    L.log_trace c "accepted." >>
+    L.log_trace c "accepted." >>= fun () ->
     TLS.server_of_flow ~trace conf flow
-    >>== (fun tls -> L.log_trace c "shook hands" >> k c flush_trace tls)
+    >>== (fun tls -> L.log_trace c "shook hands" >>= fun () -> k c flush_trace tls)
     >>= function
       | `Ok _    -> assert false
       | `Error e -> L.log_error c (TLS.error_message e)
       | `Eof     -> L.log_trace c "eof."
 
   let start c stack kv _ _ =
-    lwt cert = X509.certificate kv `Default in
+    X509.certificate kv `Default >>= fun cert ->
     let conf = Tls.Config.server ~certificates:(`Single cert) () in
-    S.listen_tcpv4 stack 4433 (accept c conf handle) ;
+    S.listen_tcpv4 stack ~port:4433 (accept c conf handle) ;
     S.listen stack
 
 end
@@ -103,12 +105,14 @@ struct
   let chat c tls =
     let rec dump () =
       TLS.read tls >>== fun buf ->
-        L.log_data c "recv" buf >> dump () in
-    TLS.write tls initial >> dump ()
+      L.log_data c "recv" buf >>= fun () ->
+      dump ()
+    in
+    TLS.write tls initial >>== dump
 
-  let start c stack kv _ =
-    lwt authenticator = X509.authenticator kv `CAs in
-    let conf          = Tls.Config.client ~authenticator () in
+  let start c stack kv _ _ =
+    X509.authenticator kv `CAs >>= fun authenticator ->
+    let conf = Tls.Config.client ~authenticator () in
     S.TCPV4.create_connection (S.tcpv4 stack) (fst peer)
     >>= function
     | `Error e -> L.log_error c (S.TCPV4.error_message e)

mirage/example2/config.ml

@@ -5,7 +5,7 @@ let secrets_dir = "sekrit"
 let disk  = direct_kv_ro secrets_dir
 and stack = socket_stackv4 default_console [Ipaddr.V4.any]
 
-let server = foreign "Unikernel.Main" @@ console @-> stackv4 @-> kv_ro @-> job
+let server = foreign ~deps:[abstract nocrypto] "Unikernel.Main" @@ console @-> stackv4 @-> kv_ro @-> clock @-> job
 
 let () =
   add_to_opam_packages [
@@ -21,4 +21,4 @@ let () =
     "cohttp.lwt-core" ;
     "mirage-http"
   ] ;
-  register "tls-server" [ server $ default_console $ stack $ disk ]
+  register "tls-server" [ server $ default_console $ stack $ disk $ default_clock ]

mirage/example2/unikernel.ml

@@ -1,44 +1,43 @@
-
-open Lwt
+open Lwt.Infix
 open V1_LWT
 
 module Main (C  : CONSOLE)
             (S  : STACKV4)
-            (KV : KV_RO) =
+            (KV : KV_RO)
+            (CL : V1.CLOCK) =
 struct
 
   module TLS  = Tls_mirage.Make (S.TCPV4)
-  module X509 = Tls_mirage.X509 (KV) (Clock)
+  module X509 = Tls_mirage.X509 (KV) (CL)
   module Http = Cohttp_mirage.Server (TLS)
 
   module Body = Cohttp_lwt_body
 
   let handle c conn req body =
     let resp = Cohttp.Response.make ~status:`OK () in
-    lwt body =
-      lwt inlet = match Cohttp.Request.meth req with
-        | `POST ->
-            lwt contents = Body.to_string body in
-            return @@ "<pre>" ^ contents ^ "</pre>"
-        | _     -> return "" in
-      return @@ Body.of_string @@
-        "<html><head><title>ohai</title></head>
-         <body><h3>Secure CoHTTP on-line.</h3>"
-         ^ inlet ^ "</body></html>\r\n"
+    (match Cohttp.Request.meth req with
+     | `POST ->
+       Body.to_string body >|= fun contents ->
+       "<pre>" ^ contents ^ "</pre>"
+     | _     -> Lwt.return "") >|= fun inlet ->
+    let body = Body.of_string @@
+    "<html><head><title>ohai</title></head> \
+     <body><h3>Secure CoHTTP on-line.</h3>"
+    ^ inlet ^ "</body></html>\r\n"
     in
-    return (resp, body)
+    (resp, body)
 
   let upgrade c conf tcp =
     TLS.server_of_flow conf tcp >>= function
-      | `Error _  | `Eof -> fail (Failure "tls init")
-      | `Ok tls  ->
-        let t = Http.make (handle c) () in
-        Http.listen t tls
+    | `Error _  | `Eof -> Lwt.fail (Failure "tls init")
+    | `Ok tls  ->
+      let t = Http.make (handle c) () in
+      Http.listen t tls
 
-  let start c stack kv =
-    lwt cert = X509.certificate kv `Default in
+  let start c stack kv _ _ =
+    X509.certificate kv `Default >>= fun cert ->
     let conf = Tls.Config.server ~certificates:(`Single cert) () in
-    S.listen_tcpv4 stack 4433 (upgrade c conf) ;
+    S.listen_tcpv4 stack ~port:4433 (upgrade c conf) ;
     S.listen stack
 
 end

opam

@@ -25,7 +25,7 @@ depends: [
   "cstruct" {>= "1.9.0"}
   "sexplib"
   "ppx_sexp_conv"
-  "nocrypto" {>= "0.5.0"}
+  "nocrypto" {>= "0.5.3"}
   "x509" {>= "0.5.0"}
   "ounit" {test}
 ]

tests/interop-polarssl-client2.sh → tests/interop-mbedtls-client2.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 port=4455
-polarssl="/opt/bin/polarssl_ssl_client2 auth_mode=none server_port="
+polarssl="/opt/bin/mbedtls_ssl_client2 auth_mode=none server_port="
 
 extra_args=""
 statfile="/tmp/test_server.status"
@@ -72,10 +72,14 @@ TLS-DHE-RSA-WITH-AES-256-CCM
 TLS-DHE-RSA-WITH-AES-128-CCM
 TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
 TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
+TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
+TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
 TLS-RSA-WITH-AES-256-CCM
-TLS-RSA-WITH-AES-256-CBC-SHA256
 TLS-RSA-WITH-AES-128-CCM
-TLS-RSA-WITH-AES-128-CBC-SHA256"
+TLS-RSA-WITH-AES-256-CBC-SHA256
+TLS-RSA-WITH-AES-128-CBC-SHA256
+TLS-RSA-WITH-AES-256-GCM-SHA384
+TLS-RSA-WITH-AES-128-GCM-SHA256"
 for i in $tls12_ciphers; do
     extra_args="force_ciphersuite=$i"
     testit