The cl-tls Reference Manual

Table of Contents

The cl-tls Reference Manual

This is the cl-tls Reference Manual, generated automatically by Declt version 3.0 "Montgomery Scott" on Sun May 15 04:14:48 2022 GMT+0.

1 Introduction

CL-TLS is a prototype Common Lisp implementation of TLS and related protocols and standards including:

• RFC5246
• ASN.1
• x{501,509}
• PKCS{1,3,5,8}

TLS is the IETF-standardized successor of Netscape's SSL protocol. Sometimes TLS/SSL are used interchangeably. At this point, there is no intention to support the older versions of the protocols (SSLv3 and below)

The project is currently in its early development phase and should only be used for experimental purposes.

CL-TLS uses Ironclad as its cryptographic back-end (at the time of writing, the ironclad in quicklisp has not yet been updated to the new maintained repo, use sharplispers/ironclad). See the system definition file for other dependencies

The project started as an attempt to create a network-based TLS fuzzer, but soon morphed of its own volition into a full-fledged TLS implementation.

Extensive testing, fuzzing, and code review is needed. Style guidelines, optimizations, feature-completion patches, bug fixes, and other contributions are welcome.

For an overview of known attacks against TLS and other issues relevant to implementors and users, see https://tools.ietf.org/html/rfc7457 At a minimum, CL-TLS will follow the recommendations and considerations in the aforementioned document before a proper alpha release is announced.

I also intend to fully document the internals of CL-TLS.

So far:

• You can initiate sessions and exchange data through a TLS tunnel either as a server or a client, for RSA, DSA, and Diffie-Hellman cipher suites. There is no support for ECDSA suites yet.
• Certificate path validation works for certificates signed using RSA or DSA. As above, no support for ECDSA signature verification yet.
• Support for PEM-encoded certificate chains.
• Support for most features of the TLS 1.2 spec such as fragmentation and session renegotiation.

Major TODOs before alpha release:

• Finalizing work on hello extensions.
• Fuzzing.
• Speed/Memory optimizations.

Features that would be nice, but are not essential

• Support for initializing with multiple certificates
• ECDSA/ECDH/ECDHE support
• Session resumption support
• Support for post-RFC5246 cipher suites
• rfc{4346,2246,6520}
• pkcs#{7,12}
• DTLS
• Tools for the generation and management of public/private keys and certificates
• DANE

CL-TLS does not offer gray streams, threading, sockets, event-loop, or compression functionality. This limits the code of CL-TLS to simply opening and managing a TLS tunnel through an octet stream and enhances portability and extensibility. However, libraries that offer this functionality (such as threaded or evented servers), can be built trivially on top of CL-TLS. See https://github.com/shrdlu68/secure-sockets as an example.

Here is an example of a simple text echo server that implements a simple one-thread-per-request model using usocket and bordeaux-threads:

(require :cl-tls)

(ql:quickload :bordeaux-threads)
(ql:quickload :usockets)
(ql:quickload :babel)

(defun echo-server (port &optional (host "localhost"))
  (let ((sock (usocket:socket-listen host port
				     :reuse-address t
				     :element-type '(unsigned-byte 8))))
    (cl-tls:initialize-listener
     :certificate "/path/to/cert.pem"
     :private-key "/path/to/key.pem")
    (loop
      for thread-id upfrom 0
      for new-sock = (usocket:socket-accept sock)
      for session-stream = (usocket:socket-stream new-sock)
      for handler = (multiple-value-bind (reader writer)
			(cl-tls:accept-tunnel :io-stream session-stream)
		      (lambda ()
			(loop
			  with id = thread-id
			  for in = (funcall reader)
			  for line = (and in
					  (babel:octets-to-string in))
			  if line do
			    (format t "~&~:R thread received data: ~A~%"
				    id line)
			    (funcall writer in)
			  else do
			    (format t
				    "~&Peer closed tunnel, ~:R thread exiting~%" id)
			    (return nil))))
      do
	 (bordeaux-threads:make-thread handler))))

And here is an example using client functionality:

(require :cl-tls)
(ql:quickload :babel)

(defun client-test (port &optional (host "localhost"))
  (let* ((sock (usocket:socket-connect
		host port
		:protocol :stream
		:element-type '(unsigned-byte 8))))
    (multiple-value-bind (reader writer close-callback)
	(cl-tls:request-tunnel
	 :certificate "/path/to/cert.pem"
	 :private-key "/path/to/key.pem"
	 :io-stream (usocket:socket-stream sock)
	 :peer-ip-addresses '((127 0 0 1))
	 :ca-certificates "/path/to/CA/ca-cert.pem")
      (loop
	for out = (read-line *standard-input* nil nil)
	for line = (and out
			(babel:string-to-octets out))
	if line do
	  (funcall writer line)
	  (let ((in (funcall reader)))
	    (cond (in
		   (format t "~&Received data: ~A~%"
			   (babel:octets-to-string in)))
		  (t
		   (funcall close-callback)
		   (return nil))))
	else do
	  (format t "~&Closing tunnel...~%")
	  (funcall close-callback)
	  (return nil)))))

Preliminary API documentation:

request-tunnel (&key certificate private-key ca-certificates
	       	     io-stream input-stream output-stream
		     include-ciphers exclude-ciphers
		     peer-dns-name peer-ip-addresses)

		Attempts to request a TLS tunnel from a server
		through an octet stream
		
		:io-stream A duplex octet stream
		
		:input-stream In the case where separate input and output
			      streams are used, an octet input stream
			      
		:output-stream An octet output stream

		:private-key A (DER/PEM-encoded) private key
			     (currently only DSA, RSA and DH private keys are supported)
			     If the private key is encrypted, you will be prompted for
			     the passphrase
			     
		:certificate A file containing a PEM-encoded list of one
			     or more cerificates
			     The file should consist of one or more
			     ----- BEGIN CERTIFICATE -----
			     ----- END CERTIFICATE -----
			     blocks. White space and other information around these blocks
			     is permitted and will be ignored. Support for PKCS#12-encoded
			     certificate chains is not yet implemented.
		:ca-certificates Either: 1. A directory to look for .crt, .pem, and .der
				 	    CA certificates in
					 2. A PEM-encoded file containing CA certificates,
					    encoded as explained above.
				 For servers, these are only needed if the server
				 needs to authenticate clients, i.e the clients are
				 expected to have client certificates issued to them.
				 This is not used very widely in practice.
				 For clients, CA certificates are used to authenticate
				 servers.
				 TLS clients such as browsers typically use a collection
				 of root certificates that are included by some means of
				 vetting, either provided by the operating system or
				 by the creators/maintainers of the browser.
				 You can use the CAs that your OS/browser has vetted,
				 or you can select which CAs to trust by yourself.
				 For example, most GNU/Linux systems have a package that
				 provides vetted root certificates, typically found in
				 the file "/etc/ssl/certs/ca-certificates.crt"
				 See also: https://curl.haxx.se/docs/sslcerts.html
				 
				 If you want to or have issued your own certificates,
				 include your CA certificate here, either in
				 addition to other CA certificates or as the sole
				 CA certificates. The client and server will only
				 be able to validate remote endpoints whose certificates
				 are signed by a CA certificate that is included,
				 there is no way to "accept" unvalidated certificates.

		
		:include-ciphers A list of symbols of cipher suites to add to the
				 default cipher list.
				 The symbols denote one of the cryptographic characteristics
				 of a cipher suite: key exchange, authentication
				 bulk encryption, mac, digest algorithms, prf, and key sizes.
				 Currently supported options:
				 :rsa-ke (RSA key exchange)
				 :rsa-auth (RSA authentication)
				 :dh (static dh) :dhe (ephemeral dh)
				 :dsa :anon (no authentication-vulnerable to MITM attacks!)
				 :rc4 (broken and prohibited) :3des
				 :aes128 :aes256 :cbc (cipher block chaining mode)
				 :md5 :sha1 :sha256
				 
		:exclude-ciphers A list of symbols of cipher suites to exclude
				 from the default cipher list.
				 :anon and :rc4 are already excluded by default
				 
		:peer-dns-name DNS-name of the peer. This is checked against
			       the dns-name values in the subject alternative name extension
			       of the certificate presented by the peer.
			       It is also used in the SNI extension, which is important
			       for virtual servers to determine which server the client
			       wants to contact.
		
		:peer-ip-addresses List of IP addresses of the peer
				   This is checked against the ip-address values
				   in the subject alternative name extension
			       	   of the certificate presented by the peer.

initialize-listener (&key certificate private-key ca-certificates
				include-ciphers exclude-ciphers force-reinitialize
				authenticate-client-p require-authentication-p
				dh-params)
			
		Loads resources needed for a server session and
		sets configuration options
		Servers need to call this once when initializing.
						 
		:authenticate-client-p When true, an attempt to authenticate the client
				       will be made. However, the client may send back an
				       empty certificate if it does not have
				       (an appropriate) certificate. This option defaults
				       to nil
				       
		:require-authentication-p When true, the server will be asked for a
					  certificate, and the connection will
					  fail if the client fails to provide a certificate.
					  This option defaults to nil.

accept-tunnel (&key io-stream input-stream output-stream)
	      => read-callback,write-callback,close-callback

	      Attempts to accept a client's request for a
	      TLS tunnel through an octet stream

		read-callback A closure whose argument list is in the form
			      (&key (eof-error-p nil) (eof-value nil))
			      that returns the contents
			      of one TLS record (2^14 bytes or less).
			      If :eof-error-p is true, the condition cl:end-of-file
			      will be signaled if the TLS tunnel is closed properly
			      (i.e a close_notify alert is received)
			      If :eof-error-p is false, eof-value is returned rather
			      than isgnalling end-of-file.
			      If an error is encountered while attempting to read from
			      the underlying stream (for example is a socket connection
			      is terminated without properly closing the TLS tunnel),
			      the condition cl:stream-error will be signalled.
		write-callback A closure of one argument, an octet vector of arbitrary size,
			       to be sent down the tunnel
			       Attempting to write to a closed TLS tunnel will
			       signal the condition cl:stream-error
			       If an error is encountered while attempting to write to
			       the underlying stream (for example is a socket connection
			       is terminated without properly closing the TLS tunnel),
			       the condition cl:stream-error will be signalled.
		close-callback A closure of no arguments that politely closes the TLS
			       connection by sending a close_notify alert.

(defclass address ()
  ((host :initarg :host
	 :accessor host)
   (port :initarg :port
	 :accessor port)))

request-stream-to-address (address)
		 =>octet stream
	Specialize this generic function and provide socket functionality.
	This is needed by some of the functionality in cl-tls that may need
	to open sockets, such as contacting OCSP responders.
	For example, to if you are using usockets:
	(defmethod cl-tls:request-stream-to-address ((addr cl-tls:address))
	  (usocket:socket-stream (usocket:socket-connect
	  (cl-tls:host addr) (cl-tls:port addr)
	  :protocol :stream
	  :element-type '(unsigned-byte 8))))

This API will likely change as development continues.

2 Systems

The main system appears first, followed by any subsystem dependency.

2.1 cl-tls

Author

Brian Kamotho

License

BSD-3-Clause

Description

An implementation of the Transport Layer Security Protocols

Dependencies

• babel
• ironclad
• alexandria
• cl-base64
• fast-io

Source

cl-tls.asd (file)

Components

• readme (file)
• license (file)
• src (module)

3 Modules

Modules are listed depth-first from the system components tree.

3.1 cl-tls/src

Dependency

license (file)

Parent

cl-tls (system)

Location

src/

Components

• package.lisp (file)
• utils.lisp (file)
• asn.1 (module)
• pkcs (module)
• x509 (module)
• pem (module)
• tls (module)

3.2 cl-tls/src/ASN.1

Parent

src (module)

Location

src/ASN.1/

Component

asn.1.lisp (file)

3.3 cl-tls/src/pkcs

Parent

src (module)

Location

src/pkcs/

Components

• pkcs1.lisp (file)
• pkcs3.lisp (file)
• pkcs5.lisp (file)
• pkcs8.lisp (file)

3.4 cl-tls/src/x509

Parent

src (module)

Location

src/x509/

Components

• extensions.lisp (file)
• x509.lisp (file)
• ocsp.lisp (file)
• validate.lisp (file)

3.5 cl-tls/src/PEM

Parent

src (module)

Location

src/PEM/

Component

rfc7468.lisp (file)

3.6 cl-tls/src/tls

Parent

src (module)

Location

src/tls/

Components

• transport.lisp (file)
• http.lisp (file)
• ciphersuites.lisp (file)
• alert.lisp (file)
• crypto.lisp (file)
• extensions.lisp (file)
• tls.lisp (file)

4 Files

Files are sorted by type and then listed depth-first from the systems components trees.

4.1 Lisp

4.1.1 cl-tls.asd

Location

cl-tls.asd

Systems

cl-tls (system)

4.1.2 cl-tls/src/package.lisp

Parent

src (module)

Location

src/package.lisp

Packages

cl-tls

4.1.3 cl-tls/src/utils.lisp

Parent

src (module)

Location

src/utils.lisp

Internal Definitions

• asn-type-matches-p (function)
• bytes-in-int (function)
• cat-vectors (function)
• dns-match-p (function)
• dump-to-file (function)
• find-certificates (function)
• get-contents (function)
• get-random-octets (function)
• get-sequence (function)
• gmt-unix-time (function)
• integer-to-octets (function)
• make-octet-vector (function)
• octet (type)
• octet-vector (type)
• octets-to-integer (function)
• split-string (function)
• stream-octets-to-integer (function)
• timing-independent-compare (function)
• with-specification-map (macro)

4.1.4 cl-tls/src/ASN.1/asn.1.lisp

Parent

asn.1 (module)

Location

src/ASN.1/asn.1.lisp

Exported Definitions

• asn-sequence-to-list (function)
• asn-serialize (function)
• create-asn-sequence (function)
• encode-oid (function)
• parse-der (function)

Internal Definitions

• *max-int-len* (special variable)
• +asn1_application+ (constant)
• +asn1_constructed+ (constant)
• +asn1_context_specific+ (constant)
• +asn1_primitive+ (constant)
• +asn1_private+ (constant)
• +asn1_universal+ (constant)
• asn-sequence-to-indices (function)
• asn.1-decoding-error (condition)
• create-explicit-tag (function)
• decode-oid (function)
• from-stream-parse-der (function)
• get-der-contents-indices (function)
• integer-to-vlq (function)
• make-octet-stream (function)
• octet-stream (class)
• ov-buffer-position (function)
• ov-read-byte (generic function)
• ov-read-byte (method)
• ov-read-sequence (generic function)
• ov-read-sequence (method)
• text (method)

4.1.5 cl-tls/src/pkcs/pkcs1.lisp

Parent

pkcs (module)

Location

src/pkcs/pkcs1.lisp

Exported Definitions

• rsa-decrypt (function)
• rsa-encrypt (function)
• rsassa-pkcs1.5-sign (function)
• rsassa-pkcs1.5-verify (function)

Internal Definitions

• emsa-pkcs1-v1.5-encode (function)
• fill-random-nonzero-octets (function)

4.1.6 cl-tls/src/pkcs/pkcs3.lisp

Parent

pkcs (module)

Location

src/pkcs/pkcs3.lisp

Internal Definitions

• compute-shared-secret (function)
• dh-params (class)
• generate-dh-params (function)
• generator (method)
• make-dh-key-pair (function)
• prime-modulus (method)
• strong-random-range (function)

4.1.7 cl-tls/src/pkcs/pkcs5.lisp

Parent

pkcs (module)

Location

src/pkcs/pkcs5.lisp

Exported Definitions

pbes2-decrypt (function)

Internal Definitions

• parse-enc-scheme (function)
• parse-kdf (function)
• remove-padding (function)

4.1.8 cl-tls/src/pkcs/pkcs8.lisp

Parent

pkcs (module)

Location

src/pkcs/pkcs8.lisp

Internal Definitions

• load-der-priv-key (function)
• load-pem-priv-key (function)
• load-priv-key (function)
• parse-priv-key (function)

4.1.9 cl-tls/src/x509/extensions.lisp

Parent

x509 (module)

Location

src/x509/extensions.lisp

Internal Definitions

• parse-access-description (function)
• parse-general-name (function)
• parse-general-names (function)
• parse-qualifier (function)
• process-extension (generic function)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)

4.1.10 cl-tls/src/x509/x509.lisp

Dependency

extensions.lisp (file)

Parent

x509 (module)

Location

src/x509/x509.lisp

Exported Definitions

x509-decode (function)

Internal Definitions

• +md2withrsaencryption+ (constant)
• +md5withrsaencryption+ (constant)
• +sha1withrsaencryption+ (constant)
• +sha224withrsaencryption+ (constant)
• +sha256withrsaencryption+ (constant)
• +sha384withrsaencryption+ (constant)
• +sha512withrsaencryption+ (constant)
• asn-time-to-universal-time (function)
• authority-information-access (method)
• (setf authority-information-access) (method)
• authority-key-identifier (method)
• (setf authority-key-identifier) (method)
• basic-constraints (method)
• (setf basic-constraints) (method)
• bind-tbs (macro)
• certificate-policies (method)
• (setf certificate-policies) (method)
• crl-distribution-points (method)
• (setf crl-distribution-points) (method)
• extended-key-usage (method)
• (setf extended-key-usage) (method)
• extensions (method)
• (setf extensions) (method)
• get-raw-tbs (function)
• hash (method)
• (setf hash) (method)
• issuer (method)
• (setf issuer) (method)
• issuer-alternative-name (method)
• (setf issuer-alternative-name) (method)
• issuer-unique-id (method)
• (setf issuer-unique-id) (method)
• key-usage (method)
• (setf key-usage) (method)
• parse-directory-name (function)
• parse-pka (function)
• parse-pub-key (function)
• parse-signature-algorithm (function)
• parse-tbs-certificate (function)
• policy-mappings (method)
• (setf policy-mappings) (method)
• process-extensions (function)
• raw (method)
• (setf raw) (method)
• serial (method)
• (setf serial) (method)
• signature (method)
• (setf signature) (method)
• signature (method)
• (setf signature) (method)
• signature-algorithm (method)
• (setf signature-algorithm) (method)
• subject (method)
• (setf subject) (method)
• subject-alternative-name (method)
• (setf subject-alternative-name) (method)
• subject-information-access (method)
• (setf subject-information-access) (method)
• subject-key-identifier (method)
• (setf subject-key-identifier) (method)
• subject-pki (method)
• (setf subject-pki) (method)
• subject-unique-id (method)
• (setf subject-unique-id) (method)
• tbs-certificate (method)
• (setf tbs-certificate) (method)
• tbs-certificate (class)
• text (method)
• time-valid-p (function)
• validity (method)
• (setf validity) (method)
• verify-signature (function)
• version (method)
• (setf version) (method)
• x509-decoding-error (condition)
• x509-extension (class)
• x509v3-certificate (class)

4.1.11 cl-tls/src/x509/ocsp.lisp

Dependency

x509.lisp (file)

Parent

x509 (module)

Location

src/x509/ocsp.lisp

Internal Definitions

• *id-ad-ocsp* (special variable)
• check-ocsp (function)
• create-cert-id (function)
• create-request (function)
• create-tbs-request (function)
• log-info (method)
• (setf log-info) (method)
• ocsp-catch-asn-error (macro)
• ocsp-error (condition)
• parse-response-data (function)
• prepare-ocsp-request (function)
• verify-ocsp-signature (function)

4.1.12 cl-tls/src/x509/validate.lisp

Dependency

ocsp.lisp (file)

Parent

x509 (module)

Location

src/x509/validate.lisp

Internal Definitions

• check-certificate-status (function)
• get-issuer-octets (function)
• get-pubkey-octets (function)
• validate (function)

4.1.13 cl-tls/src/PEM/rfc7468.lisp

Parent

pem (module)

Location

src/PEM/rfc7468.lisp

Internal Definitions

• decapsulate (function)
• parse-pem (function)

4.1.14 cl-tls/src/tls/transport.lisp

Parent

tls (module)

Location

src/tls/transport.lisp

Exported Definitions

• address (class)
• host (method)
• (setf host) (method)
• port (method)
• (setf port) (method)
• request-stream-to-address (generic function)
• request-stream-to-address (method)

4.1.15 cl-tls/src/tls/http.lisp

Parent

tls (module)

Location

src/tls/http.lisp

Exported Definitions

• host (method)
• (setf host) (method)
• port (method)
• (setf port) (method)

Internal Definitions

• *crlf* (special variable)
• *max-content-length* (special variable)
• header-value (function)
• http-error (condition)
• http-request (function)
• log-info (method)
• (setf log-info) (method)
• parse-headers-from-stream (function)
• parse-uri (function)
• path (method)
• (setf path) (method)
• read-chunk (function)
• read-chunked-response (function)
• read-header (function)
• scheme (method)
• (setf scheme) (method)
• split-header (function)
• trim-space (function)
• uri (class)

4.1.16 cl-tls/src/tls/ciphersuites.lisp

Parent

tls (module)

Location

src/tls/ciphersuites.lisp

Internal Definitions

• *supported-cipher-suites* (special variable)
• +3des-block-size+ (special variable)
• +3des-encryption-suites+ (special variable)
• +aes-128-ciphers+ (special variable)
• +aes-256-ciphers+ (special variable)
• +aes-block-size+ (special variable)
• +aes-encryption-suites+ (special variable)
• +anon-authentication-suites+ (special variable)
• +cbc-mode-ciphers+ (special variable)
• +dh-key-exchange-suites+ (special variable)
• +dhe-key-exchange-suites+ (special variable)
• +dss-authentication-suites+ (special variable)
• +md5-ciphers+ (special variable)
• +rc4-encryption-suites+ (special variable)
• +rsa-authentication-suites+ (special variable)
• +rsa-key-exchange-suites+ (special variable)
• +sha1-ciphers+ (special variable)
• +sha256-ciphers+ (special variable)
• +tls_dh_anon_with_3des_ede_cbc_sha+ (special variable)
• +tls_dh_anon_with_aes_128_cbc_sha+ (special variable)
• +tls_dh_anon_with_aes_128_cbc_sha256+ (special variable)
• +tls_dh_anon_with_aes_256_cbc_sha+ (special variable)
• +tls_dh_anon_with_aes_256_cbc_sha256+ (special variable)
• +tls_dh_anon_with_rc4_128_md5+ (special variable)
• +tls_dh_dss_with_3des_ede_cbc_sha+ (special variable)
• +tls_dh_dss_with_aes_128_cbc_sha+ (special variable)
• +tls_dh_dss_with_aes_128_cbc_sha256+ (special variable)
• +tls_dh_dss_with_aes_256_cbc_sha+ (special variable)
• +tls_dh_dss_with_aes_256_cbc_sha256+ (special variable)
• +tls_dh_rsa_with_3des_ede_cbc_sha+ (special variable)
• +tls_dh_rsa_with_aes_128_cbc_sha+ (special variable)
• +tls_dh_rsa_with_aes_128_cbc_sha256+ (special variable)
• +tls_dh_rsa_with_aes_256_cbc_sha+ (special variable)
• +tls_dh_rsa_with_aes_256_cbc_sha256+ (special variable)
• +tls_dhe_dss_with_3des_ede_cbc_sha+ (special variable)
• +tls_dhe_dss_with_aes_128_cbc_sha+ (special variable)
• +tls_dhe_dss_with_aes_128_cbc_sha256+ (special variable)
• +tls_dhe_dss_with_aes_256_cbc_sha+ (special variable)
• +tls_dhe_dss_with_aes_256_cbc_sha256+ (special variable)
• +tls_dhe_rsa_with_3des_ede_cbc_sha+ (special variable)
• +tls_dhe_rsa_with_aes_128_cbc_sha+ (special variable)
• +tls_dhe_rsa_with_aes_128_cbc_sha256+ (special variable)
• +tls_dhe_rsa_with_aes_256_cbc_sha+ (special variable)
• +tls_dhe_rsa_with_aes_256_cbc_sha256+ (special variable)
• +tls_rsa_with_3des_ede_cbc_sha+ (special variable)
• +tls_rsa_with_aes_128_cbc_sha+ (special variable)
• +tls_rsa_with_aes_128_cbc_sha256+ (special variable)
• +tls_rsa_with_aes_256_cbc_sha+ (special variable)
• +tls_rsa_with_aes_256_cbc_sha256+ (special variable)
• +tls_rsa_with_null_md5+ (special variable)
• +tls_rsa_with_null_sha+ (special variable)
• +tls_rsa_with_null_sha256+ (special variable)
• +tls_rsa_with_rc4_128_md5+ (special variable)
• +tls_rsa_with_rc4_128_sha+ (special variable)

4.1.17 cl-tls/src/tls/alert.lisp

Parent

tls (module)

Location

src/tls/alert.lisp

Internal Definitions

• +access-denied+ (constant)
• +bad-certificate+ (constant)
• +bad-record-mac+ (constant)
• +certificate-expired+ (constant)
• +certificate-revoked+ (constant)
• +certificate-unknown+ (constant)
• +close-notify+ (constant)
• +decode-error+ (constant)
• +decompression-failure+ (constant)
• +decrypt-error+ (constant)
• +decryption-failed-reserved+ (constant)
• +export-restriction-reserved+ (constant)
• +fatal+ (constant)
• +handshake-failure+ (constant)
• +illegal-parameter+ (constant)
• +insufficient-security+ (constant)
• +internal-error+ (constant)
• +no-certificate-reserved+ (constant)
• +no-renegotiation+ (constant)
• +protocol-version+ (constant)
• +record-overflow+ (constant)
• +unexpected-message+ (constant)
• +unknown-ca+ (constant)
• +unsupported-certificate+ (constant)
• +unsupported-extension+ (constant)
• +user-canceled+ (constant)
• +warning+ (constant)
• alert-record-to-text (function)
• send-alert (function)

4.1.18 cl-tls/src/tls/crypto.lisp

Parent

tls (module)

Location

src/tls/crypto.lisp

Internal Definitions

• digitally-sign (function)
• endpoint-decryption-key (symbol macro)
• endpoint-encryption-key (symbol macro)
• gen-key-material (function)
• p-hash (function)
• prf (function)
• sign-dh-params (function)
• verify-signed-data (function)
• verify-signed-params (function)

4.1.19 cl-tls/src/tls/extensions.lisp

Parent

tls (module)

Location

src/tls/extensions.lisp

Internal Definitions

• create-cert-status-request (function)
• create-sni (function)
• pack-extension (function)
• parse-extension (generic function)
• parse-extension (method)
• parse-extension (method)
• parse-extension (method)
• parse-extension (method)
• parse-extension (method)
• parse-extension (method)
• parse-extension (method)

4.1.20 cl-tls/src/tls/tls.lisp

Parent

tls (module)

Location

src/tls/tls.lisp

Exported Definitions

• accept-tunnel (function)
• initialize-listener (function)
• request-tunnel (function)
• tls-error (condition)
• tls-stream-error (condition)

Internal Definitions

• *certificate-request-msg* (special variable)
• *debug-stream* (special variable)
• *log-level* (special variable)
• *max-certificate-chain-length* (special variable)
• *max-fragment-length* (special variable)
• *version* (special variable)
• +alert+ (constant)
• +application-data+ (constant)
• +certificate+ (constant)
• +certificate-request+ (constant)
• +certificate-verify+ (constant)
• +change-cipher-spec+ (constant)
• +client-hello+ (constant)
• +client-key-exchange+ (constant)
• +finished+ (constant)
• +handshake+ (constant)
• +hello-request+ (constant)
• +server-hello+ (constant)
• +server-hello-done+ (constant)
• +server-key-exchange+ (constant)
• add-handshake-header (function)
• alert (method)
• (setf alert) (method)
• calculate-mac (function)
• calculate-verification-mac (function)
• cipher-suite-supported-p (function)
• ciphertext-to-compressed (generic function)
• ciphertext-to-compressed (method)
• client-certificate-url (method)
• (setf client-certificate-url) (method)
• client-session (class)
• create-cipher-vector (function)
• create-listener-session (function)
• create-session (function)
• decrypt (generic function)
• decrypt (method)
• dhparams-from-key-file (function)
• encrypt (generic function)
• encrypt (method)
• encrypt-and-send (function)
• endpoint-mac-decryption-key (symbol macro)
• endpoint-mac-encryption-key (symbol macro)
• exception (condition)
• get-application-data (function)
• get-ca-certificates (function)
• get-change-cipher-spec (function)
• get-dh-params (function)
• get-handshake-message (function)
• get-private-key (function)
• get-record (generic function)
• get-record (method)
• get-session-id (function)
• handle-handshake (generic function)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handshake-messages (method)
• (setf handshake-messages) (method)
• hello-extensions (class)
• host-name (method)
• (setf host-name) (method)
• initiate-connection (generic function)
• initiate-connection (method)
• initiate-connection (method)
• log-info (method)
• (setf log-info) (method)
• max-fragment-length (method)
• (setf max-fragment-length) (method)
• parse-cipher-suite (function)
• pre-master-secret (method)
• (setf pre-master-secret) (method)
• pub-key (method)
• (setf pub-key) (method)
• reassemble-handshake-message (function)
• send (generic function)
• send (method)
• send-change-cipher-spec (generic function)
• send-change-cipher-spec (method)
• send-handshake (generic function)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-record (generic function)
• send-record (method)
• server-session (class)
• session (class)
• shared-session-slots (class)
• supported-signature-algorithms (method)
• (setf supported-signature-algorithms) (method)
• symbol-to-suite-list (function)
• text (method)
• (setf text) (method)

4.2 Static

4.2.1 cl-tls/README

Parent

cl-tls (system)

Location

/home/quickref/quicklisp/dists/quicklisp/software/cl-tls-20211209-git/README (not found)

4.2.2 cl-tls/LICENSE

Dependency

readme (file)

Parent

cl-tls (system)

Location

LICENSE

5 Packages

Packages are listed by definition order.

5.1 cl-tls

CL-TLS is a Common Lisp implemetation of TLS and related specifications

Source

package.lisp (file)

Nickname

tls

Use List

• alexandria
• common-lisp

Exported Definitions

• accept-tunnel (function)
• address (class)
• asn-sequence-to-list (function)
• asn-serialize (function)
• create-asn-sequence (function)
• encode-oid (function)
• host (generic function)
• host (method)
• (setf host) (method)
• host (method)
• (setf host) (method)
• (setf host) (generic function)
• initialize-listener (function)
• parse-der (function)
• pbes2-decrypt (function)
• port (generic function)
• port (method)
• (setf port) (method)
• port (method)
• (setf port) (method)
• (setf port) (generic function)
• request-stream-to-address (generic function)
• request-stream-to-address (method)
• request-tunnel (function)
• rsa-decrypt (function)
• rsa-encrypt (function)
• rsassa-pkcs1.5-sign (function)
• rsassa-pkcs1.5-verify (function)
• tls-error (condition)
• tls-stream-error (condition)
• x509-decode (function)

Internal Definitions

• *certificate-request-msg* (special variable)
• *crlf* (special variable)
• *debug-stream* (special variable)
• *id-ad-ocsp* (special variable)
• *log-level* (special variable)
• *max-certificate-chain-length* (special variable)
• *max-content-length* (special variable)
• *max-fragment-length* (special variable)
• *max-int-len* (special variable)
• *supported-cipher-suites* (special variable)
• *version* (special variable)
• +3des-block-size+ (special variable)
• +3des-encryption-suites+ (special variable)
• +access-denied+ (constant)
• +aes-128-ciphers+ (special variable)
• +aes-256-ciphers+ (special variable)
• +aes-block-size+ (special variable)
• +aes-encryption-suites+ (special variable)
• +alert+ (constant)
• +anon-authentication-suites+ (special variable)
• +application-data+ (constant)
• +asn1_application+ (constant)
• +asn1_constructed+ (constant)
• +asn1_context_specific+ (constant)
• +asn1_primitive+ (constant)
• +asn1_private+ (constant)
• +asn1_universal+ (constant)
• +bad-certificate+ (constant)
• +bad-record-mac+ (constant)
• +cbc-mode-ciphers+ (special variable)
• +certificate+ (constant)
• +certificate-expired+ (constant)
• +certificate-request+ (constant)
• +certificate-revoked+ (constant)
• +certificate-unknown+ (constant)
• +certificate-verify+ (constant)
• +change-cipher-spec+ (constant)
• +client-hello+ (constant)
• +client-key-exchange+ (constant)
• +close-notify+ (constant)
• +decode-error+ (constant)
• +decompression-failure+ (constant)
• +decrypt-error+ (constant)
• +decryption-failed-reserved+ (constant)
• +dh-key-exchange-suites+ (special variable)
• +dhe-key-exchange-suites+ (special variable)
• +dss-authentication-suites+ (special variable)
• +export-restriction-reserved+ (constant)
• +fatal+ (constant)
• +finished+ (constant)
• +handshake+ (constant)
• +handshake-failure+ (constant)
• +hello-request+ (constant)
• +illegal-parameter+ (constant)
• +insufficient-security+ (constant)
• +internal-error+ (constant)
• +md2withrsaencryption+ (constant)
• +md5-ciphers+ (special variable)
• +md5withrsaencryption+ (constant)
• +no-certificate-reserved+ (constant)
• +no-renegotiation+ (constant)
• +protocol-version+ (constant)
• +rc4-encryption-suites+ (special variable)
• +record-overflow+ (constant)
• +rsa-authentication-suites+ (special variable)
• +rsa-key-exchange-suites+ (special variable)
• +server-hello+ (constant)
• +server-hello-done+ (constant)
• +server-key-exchange+ (constant)
• +sha1-ciphers+ (special variable)
• +sha1withrsaencryption+ (constant)
• +sha224withrsaencryption+ (constant)
• +sha256-ciphers+ (special variable)
• +sha256withrsaencryption+ (constant)
• +sha384withrsaencryption+ (constant)
• +sha512withrsaencryption+ (constant)
• +tls_dh_anon_with_3des_ede_cbc_sha+ (special variable)
• +tls_dh_anon_with_aes_128_cbc_sha+ (special variable)
• +tls_dh_anon_with_aes_128_cbc_sha256+ (special variable)
• +tls_dh_anon_with_aes_256_cbc_sha+ (special variable)
• +tls_dh_anon_with_aes_256_cbc_sha256+ (special variable)
• +tls_dh_anon_with_rc4_128_md5+ (special variable)
• +tls_dh_dss_with_3des_ede_cbc_sha+ (special variable)
• +tls_dh_dss_with_aes_128_cbc_sha+ (special variable)
• +tls_dh_dss_with_aes_128_cbc_sha256+ (special variable)
• +tls_dh_dss_with_aes_256_cbc_sha+ (special variable)
• +tls_dh_dss_with_aes_256_cbc_sha256+ (special variable)
• +tls_dh_rsa_with_3des_ede_cbc_sha+ (special variable)
• +tls_dh_rsa_with_aes_128_cbc_sha+ (special variable)
• +tls_dh_rsa_with_aes_128_cbc_sha256+ (special variable)
• +tls_dh_rsa_with_aes_256_cbc_sha+ (special variable)
• +tls_dh_rsa_with_aes_256_cbc_sha256+ (special variable)
• +tls_dhe_dss_with_3des_ede_cbc_sha+ (special variable)
• +tls_dhe_dss_with_aes_128_cbc_sha+ (special variable)
• +tls_dhe_dss_with_aes_128_cbc_sha256+ (special variable)
• +tls_dhe_dss_with_aes_256_cbc_sha+ (special variable)
• +tls_dhe_dss_with_aes_256_cbc_sha256+ (special variable)
• +tls_dhe_rsa_with_3des_ede_cbc_sha+ (special variable)
• +tls_dhe_rsa_with_aes_128_cbc_sha+ (special variable)
• +tls_dhe_rsa_with_aes_128_cbc_sha256+ (special variable)
• +tls_dhe_rsa_with_aes_256_cbc_sha+ (special variable)
• +tls_dhe_rsa_with_aes_256_cbc_sha256+ (special variable)
• +tls_rsa_with_3des_ede_cbc_sha+ (special variable)
• +tls_rsa_with_aes_128_cbc_sha+ (special variable)
• +tls_rsa_with_aes_128_cbc_sha256+ (special variable)
• +tls_rsa_with_aes_256_cbc_sha+ (special variable)
• +tls_rsa_with_aes_256_cbc_sha256+ (special variable)
• +tls_rsa_with_null_md5+ (special variable)
• +tls_rsa_with_null_sha+ (special variable)
• +tls_rsa_with_null_sha256+ (special variable)
• +tls_rsa_with_rc4_128_md5+ (special variable)
• +tls_rsa_with_rc4_128_sha+ (special variable)
• +unexpected-message+ (constant)
• +unknown-ca+ (constant)
• +unsupported-certificate+ (constant)
• +unsupported-extension+ (constant)
• +user-canceled+ (constant)
• +warning+ (constant)
• add-handshake-header (function)
• alert (generic function)
• alert (method)
• (setf alert) (method)
• (setf alert) (generic function)
• alert-record-to-text (function)
• asn-sequence-to-indices (function)
• asn-time-to-universal-time (function)
• asn-type-matches-p (function)
• asn.1-decoding-error (condition)
• authority-information-access (generic function)
• authority-information-access (method)
• (setf authority-information-access) (method)
• (setf authority-information-access) (generic function)
• authority-key-identifier (generic function)
• authority-key-identifier (method)
• (setf authority-key-identifier) (method)
• (setf authority-key-identifier) (generic function)
• basic-constraints (generic function)
• basic-constraints (method)
• (setf basic-constraints) (method)
• (setf basic-constraints) (generic function)
• bind-tbs (macro)
• bytes-in-int (function)
• calculate-mac (function)
• calculate-verification-mac (function)
• cat-vectors (function)
• certificate-policies (generic function)
• certificate-policies (method)
• (setf certificate-policies) (method)
• (setf certificate-policies) (generic function)
• check-certificate-status (function)
• check-ocsp (function)
• cipher-suite-supported-p (function)
• ciphertext-to-compressed (generic function)
• ciphertext-to-compressed (method)
• client-certificate-url (generic function)
• client-certificate-url (method)
• (setf client-certificate-url) (method)
• (setf client-certificate-url) (generic function)
• client-session (class)
• compute-shared-secret (function)
• create-cert-id (function)
• create-cert-status-request (function)
• create-cipher-vector (function)
• create-explicit-tag (function)
• create-listener-session (function)
• create-request (function)
• create-session (function)
• create-sni (function)
• create-tbs-request (function)
• crl-distribution-points (generic function)
• crl-distribution-points (method)
• (setf crl-distribution-points) (method)
• (setf crl-distribution-points) (generic function)
• decapsulate (function)
• decode-oid (function)
• decrypt (generic function)
• decrypt (method)
• dh-params (class)
• dhparams-from-key-file (function)
• digitally-sign (function)
• dns-match-p (function)
• dump-to-file (function)
• emsa-pkcs1-v1.5-encode (function)
• encrypt (generic function)
• encrypt (method)
• encrypt-and-send (function)
• endpoint-decryption-key (symbol macro)
• endpoint-encryption-key (symbol macro)
• endpoint-mac-decryption-key (symbol macro)
• endpoint-mac-encryption-key (symbol macro)
• exception (condition)
• extended-key-usage (generic function)
• extended-key-usage (method)
• (setf extended-key-usage) (method)
• (setf extended-key-usage) (generic function)
• extensions (generic function)
• extensions (method)
• (setf extensions) (method)
• (setf extensions) (generic function)
• fill-random-nonzero-octets (function)
• find-certificates (function)
• from-stream-parse-der (function)
• gen-key-material (function)
• generate-dh-params (function)
• generator (generic function)
• generator (method)
• get-application-data (function)
• get-ca-certificates (function)
• get-change-cipher-spec (function)
• get-contents (function)
• get-der-contents-indices (function)
• get-dh-params (function)
• get-handshake-message (function)
• get-issuer-octets (function)
• get-private-key (function)
• get-pubkey-octets (function)
• get-random-octets (function)
• get-raw-tbs (function)
• get-record (generic function)
• get-record (method)
• get-sequence (function)
• get-session-id (function)
• gmt-unix-time (function)
• handle-handshake (generic function)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handle-handshake (method)
• handshake-messages (generic function)
• handshake-messages (method)
• (setf handshake-messages) (method)
• (setf handshake-messages) (generic function)
• hash (generic function)
• hash (method)
• (setf hash) (method)
• (setf hash) (generic function)
• header-value (function)
• hello-extensions (class)
• host-name (generic function)
• host-name (method)
• (setf host-name) (method)
• (setf host-name) (generic function)
• http-error (condition)
• http-request (function)
• initiate-connection (generic function)
• initiate-connection (method)
• initiate-connection (method)
• integer-to-octets (function)
• integer-to-vlq (function)
• issuer (generic function)
• issuer (method)
• (setf issuer) (method)
• (setf issuer) (generic function)
• issuer-alternative-name (generic function)
• issuer-alternative-name (method)
• (setf issuer-alternative-name) (method)
• (setf issuer-alternative-name) (generic function)
• issuer-unique-id (generic function)
• issuer-unique-id (method)
• (setf issuer-unique-id) (method)
• (setf issuer-unique-id) (generic function)
• key-usage (generic function)
• key-usage (method)
• (setf key-usage) (method)
• (setf key-usage) (generic function)
• load-der-priv-key (function)
• load-pem-priv-key (function)
• load-priv-key (function)
• log-info (generic function)
• log-info (method)
• (setf log-info) (method)
• log-info (method)
• (setf log-info) (method)
• log-info (method)
• (setf log-info) (method)
• (setf log-info) (generic function)
• make-dh-key-pair (function)
• make-octet-stream (function)
• make-octet-vector (function)
• max-fragment-length (generic function)
• max-fragment-length (method)
• (setf max-fragment-length) (method)
• (setf max-fragment-length) (generic function)
• ocsp-catch-asn-error (macro)
• ocsp-error (condition)
• octet (type)
• octet-stream (class)
• octet-vector (type)
• octets-to-integer (function)
• ov-buffer-position (function)
• ov-read-byte (generic function)
• ov-read-byte (method)
• ov-read-sequence (generic function)
• ov-read-sequence (method)
• p-hash (function)
• pack-extension (function)
• parse-access-description (function)
• parse-cipher-suite (function)
• parse-directory-name (function)
• parse-enc-scheme (function)
• parse-extension (generic function)
• parse-extension (method)
• parse-extension (method)
• parse-extension (method)
• parse-extension (method)
• parse-extension (method)
• parse-extension (method)
• parse-extension (method)
• parse-general-name (function)
• parse-general-names (function)
• parse-headers-from-stream (function)
• parse-kdf (function)
• parse-pem (function)
• parse-pka (function)
• parse-priv-key (function)
• parse-pub-key (function)
• parse-qualifier (function)
• parse-response-data (function)
• parse-signature-algorithm (function)
• parse-tbs-certificate (function)
• parse-uri (function)
• path (generic function)
• path (method)
• (setf path) (method)
• (setf path) (generic function)
• policy-mappings (generic function)
• policy-mappings (method)
• (setf policy-mappings) (method)
• (setf policy-mappings) (generic function)
• pre-master-secret (generic function)
• pre-master-secret (method)
• (setf pre-master-secret) (method)
• (setf pre-master-secret) (generic function)
• prepare-ocsp-request (function)
• prf (function)
• prime-modulus (generic function)
• prime-modulus (method)
• process-extension (generic function)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extension (method)
• process-extensions (function)
• pub-key (generic function)
• pub-key (method)
• (setf pub-key) (method)
• (setf pub-key) (generic function)
• raw (generic function)
• raw (method)
• (setf raw) (method)
• (setf raw) (generic function)
• read-chunk (function)
• read-chunked-response (function)
• read-header (function)
• reassemble-handshake-message (function)
• remove-padding (function)
• scheme (generic function)
• scheme (method)
• (setf scheme) (method)
• (setf scheme) (generic function)
• send (generic function)
• send (method)
• send-alert (function)
• send-change-cipher-spec (generic function)
• send-change-cipher-spec (method)
• send-handshake (generic function)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-handshake (method)
• send-record (generic function)
• send-record (method)
• serial (generic function)
• serial (method)
• (setf serial) (method)
• (setf serial) (generic function)
• server-session (class)
• session (class)
• shared-session-slots (class)
• sign-dh-params (function)
• signature (generic function)
• signature (method)
• (setf signature) (method)
• signature (method)
• (setf signature) (method)
• (setf signature) (generic function)
• signature-algorithm (generic function)
• signature-algorithm (method)
• (setf signature-algorithm) (method)
• (setf signature-algorithm) (generic function)
• split-header (function)
• split-string (function)
• stream-octets-to-integer (function)
• strong-random-range (function)
• subject (generic function)
• subject (method)
• (setf subject) (method)
• (setf subject) (generic function)
• subject-alternative-name (generic function)
• subject-alternative-name (method)
• (setf subject-alternative-name) (method)
• (setf subject-alternative-name) (generic function)
• subject-information-access (generic function)
• subject-information-access (method)
• (setf subject-information-access) (method)
• (setf subject-information-access) (generic function)
• subject-key-identifier (generic function)
• subject-key-identifier (method)
• (setf subject-key-identifier) (method)
• (setf subject-key-identifier) (generic function)
• subject-pki (generic function)
• subject-pki (method)
• (setf subject-pki) (method)
• (setf subject-pki) (generic function)
• subject-unique-id (generic function)
• subject-unique-id (method)
• (setf subject-unique-id) (method)
• (setf subject-unique-id) (generic function)
• supported-signature-algorithms (generic function)
• supported-signature-algorithms (method)
• (setf supported-signature-algorithms) (method)
• (setf supported-signature-algorithms) (generic function)
• symbol-to-suite-list (function)
• tbs-certificate (generic function)
• tbs-certificate (method)
• (setf tbs-certificate) (method)
• (setf tbs-certificate) (generic function)
• tbs-certificate (class)
• text (generic function)
• text (method)
• (setf text) (method)
• text (method)
• text (method)
• (setf text) (generic function)
• time-valid-p (function)
• timing-independent-compare (function)
• trim-space (function)
• uri (class)
• validate (function)
• validity (generic function)
• validity (method)
• (setf validity) (method)
• (setf validity) (generic function)
• verify-ocsp-signature (function)
• verify-signature (function)
• verify-signed-data (function)
• verify-signed-params (function)
• version (generic function)
• version (method)
• (setf version) (method)
• (setf version) (generic function)
• with-specification-map (macro)
• x509-decoding-error (condition)
• x509-extension (class)
• x509v3-certificate (class)

6 Definitions

Definitions are sorted by export status, category, package, and then by lexicographic order.

6.1 Exported definitions

6.1.1 Functions

Function: accept-tunnel &key IO-STREAM INPUT-STREAM OUTPUT-STREAM

As a server, accept a new connection from a client

Package

cl-tls

Source

tls.lisp (file)

Function: asn-sequence-to-list VEC &key MODE

Given an asn sequence, return a list of the raw der elements

Package

cl-tls

Source

asn.1.lisp (file)

Function: asn-serialize OBJ TYPE &key CLASS PRIMITIVEP

Create an ASN structure

Package

cl-tls

Source

asn.1.lisp (file)

Function: create-asn-sequence &rest COLL

Package

cl-tls

Source

asn.1.lisp (file)

Function: encode-oid NUMS

Package

cl-tls

Source

asn.1.lisp (file)

Function: initialize-listener &key CERTIFICATE PRIVATE-KEY CA-CERTIFICATES INCLUDE-CIPHERS EXCLUDE-CIPHERS FORCE-REINITIALIZE AUTHENTICATE-CLIENT-P REQUIRE-AUTHENTICATION-P DH-PARAMS

Initialize a TLS server session with the given arguments

Package

cl-tls

Source

tls.lisp (file)

Function: parse-der OBJ &key START MODE

Serialized mode returns the plain contents octets. deserialized mode deserializes the contents octets. Octet strings and Bit Strings are not deserialized

Package

cl-tls

Source

asn.1.lisp (file)

Function: pbes2-decrypt OV &optional PASSPHRASE

Package

cl-tls

Source

pkcs5.lisp (file)

Function: request-tunnel &key CERTIFICATE PRIVATE-KEY CA-CERTIFICATES IO-STREAM INPUT-STREAM OUTPUT-STREAM INCLUDE-CIPHERS EXCLUDE-CIPHERS PEER-DNS-NAME PEER-IP-ADDRESSES

As a client, request a TLS connection from a server

Package

cl-tls

Source

tls.lisp (file)

Function: rsa-decrypt DATA PRIVATE-KEY

Returns raw data after decrypting and parsing the Encryption-block

Package

cl-tls

Source

pkcs1.lisp (file)

Function: rsa-encrypt DATA KEY

Converts data into an encryption block then calls ironclad

Package

cl-tls

Source

pkcs1.lisp (file)

Function: rsassa-pkcs1.5-sign PRIV-KEY MSG HASH-ALGORITHM

Package

cl-tls

Source

pkcs1.lisp (file)

Function: rsassa-pkcs1.5-verify PUB-KEY MSG SIGNATURE HASH-ALGORITHM

Package

cl-tls

Source

pkcs1.lisp (file)

Function: x509-decode OCTET-VECTOR

Deserialize an x509 certificate from an octet-vector

Package

cl-tls

Source

x509.lisp (file)

6.1.2 Generic functions

Generic Function: host OBJECT

Generic Function: (setf host) NEW-VALUE OBJECT

Package

cl-tls

Methods

Method: host (URI uri)

automatically generated reader method

Source

http.lisp (file)

Method: (setf host) NEW-VALUE (URI uri)

automatically generated writer method

Source

http.lisp (file)

Method: host (ADDRESS address)

automatically generated reader method

Source

transport.lisp (file)

Method: (setf host) NEW-VALUE (ADDRESS address)

automatically generated writer method

Source

transport.lisp (file)

Generic Function: port OBJECT

Generic Function: (setf port) NEW-VALUE OBJECT

Package

cl-tls

Methods

Method: port (URI uri)

automatically generated reader method

Source

http.lisp (file)

Method: (setf port) NEW-VALUE (URI uri)

automatically generated writer method

Source

http.lisp (file)

Method: port (ADDRESS address)

automatically generated reader method

Source

transport.lisp (file)

Method: (setf port) NEW-VALUE (ADDRESS address)

automatically generated writer method

Source

transport.lisp (file)

Generic Function: request-stream-to-address ADDRESS

Package

cl-tls

Source

transport.lisp (file)

Methods

Method: request-stream-to-address (ADDR address)

6.1.3 Conditions

Condition: tls-error ()

Package

cl-tls

Source

tls.lisp (file)

Direct superclasses

error (condition)

Direct methods

• text (method)
• text (method)

Direct slots

Slot: text

Initargs

:text

Readers

text (generic function)

Writers

(setf text) (generic function)

Condition: tls-stream-error ()

Package

cl-tls

Source

tls.lisp (file)

Direct superclasses

stream-error (condition)

6.1.4 Classes

Class: address ()

Package

cl-tls

Source

transport.lisp (file)

Direct superclasses

standard-object (class)

Direct methods

• request-stream-to-address (method)
• port (method)
• port (method)
• host (method)
• host (method)

Direct slots

Slot: host

Initargs

:host

Readers

host (generic function)

Writers

(setf host) (generic function)

Slot: port

Initargs

:port

Readers

port (generic function)

Writers

(setf port) (generic function)

6.2 Internal definitions

6.2.1 Constants

Constant: +access-denied+

Package

cl-tls

Source

alert.lisp (file)

Constant: +alert+

Package

cl-tls

Source

tls.lisp (file)

Constant: +application-data+

Package

cl-tls

Source

tls.lisp (file)

Constant: +asn1_application+

Package

cl-tls

Source

asn.1.lisp (file)

Constant: +asn1_constructed+

Package

cl-tls

Source

asn.1.lisp (file)

Constant: +asn1_context_specific+

Package

cl-tls

Source

asn.1.lisp (file)

Constant: +asn1_primitive+

Package

cl-tls

Source

asn.1.lisp (file)

Constant: +asn1_private+

Package

cl-tls

Source

asn.1.lisp (file)

Constant: +asn1_universal+

Package

cl-tls

Source

asn.1.lisp (file)

Constant: +bad-certificate+

Package

cl-tls

Source

alert.lisp (file)

Constant: +bad-record-mac+

Package

cl-tls

Source

alert.lisp (file)

Constant: +certificate+

Package

cl-tls

Source

tls.lisp (file)

Constant: +certificate-expired+

Package

cl-tls

Source

alert.lisp (file)

Constant: +certificate-request+

Package

cl-tls

Source

tls.lisp (file)

Constant: +certificate-revoked+

Package

cl-tls

Source

alert.lisp (file)

Constant: +certificate-unknown+

Package

cl-tls

Source

alert.lisp (file)

Constant: +certificate-verify+

Package

cl-tls

Source

tls.lisp (file)

Constant: +change-cipher-spec+

Package

cl-tls

Source

tls.lisp (file)

Constant: +client-hello+

Package

cl-tls

Source

tls.lisp (file)

Constant: +client-key-exchange+

Package

cl-tls

Source

tls.lisp (file)

Constant: +close-notify+

Package

cl-tls

Source

alert.lisp (file)

Constant: +decode-error+

Package

cl-tls

Source

alert.lisp (file)

Constant: +decompression-failure+

Package

cl-tls

Source

alert.lisp (file)

Constant: +decrypt-error+

Package

cl-tls

Source

alert.lisp (file)

Constant: +decryption-failed-reserved+

Package

cl-tls

Source

alert.lisp (file)

Constant: +export-restriction-reserved+

Package

cl-tls

Source

alert.lisp (file)

Constant: +fatal+

Package

cl-tls

Source

alert.lisp (file)

Constant: +finished+

Package

cl-tls

Source

tls.lisp (file)

Constant: +handshake+

Package

cl-tls

Source

tls.lisp (file)

Constant: +handshake-failure+

Package

cl-tls

Source

alert.lisp (file)

Constant: +hello-request+

Package

cl-tls

Source

tls.lisp (file)

Constant: +illegal-parameter+

Package

cl-tls

Source

alert.lisp (file)

Constant: +insufficient-security+

Package

cl-tls

Source

alert.lisp (file)

Constant: +internal-error+

Package

cl-tls

Source

alert.lisp (file)

Constant: +md2withrsaencryption+

Package

cl-tls

Source

x509.lisp (file)

Constant: +md5withrsaencryption+

Package

cl-tls

Source

x509.lisp (file)

Constant: +no-certificate-reserved+

Package

cl-tls

Source

alert.lisp (file)

Constant: +no-renegotiation+

Package

cl-tls

Source

alert.lisp (file)

Constant: +protocol-version+

Package

cl-tls

Source

alert.lisp (file)

Constant: +record-overflow+

Package

cl-tls

Source

alert.lisp (file)

Constant: +server-hello+

Package

cl-tls

Source

tls.lisp (file)

Constant: +server-hello-done+

Package

cl-tls

Source

tls.lisp (file)

Constant: +server-key-exchange+

Package

cl-tls

Source

tls.lisp (file)

Constant: +sha1withrsaencryption+

Package

cl-tls

Source

x509.lisp (file)

Constant: +sha224withrsaencryption+

Package

cl-tls

Source

x509.lisp (file)

Constant: +sha256withrsaencryption+

Package

cl-tls

Source

x509.lisp (file)

Constant: +sha384withrsaencryption+

Package

cl-tls

Source

x509.lisp (file)

Constant: +sha512withrsaencryption+

Package

cl-tls

Source

x509.lisp (file)

Constant: +unexpected-message+

Package

cl-tls

Source

alert.lisp (file)

Constant: +unknown-ca+

Package

cl-tls

Source

alert.lisp (file)

Constant: +unsupported-certificate+

Package

cl-tls

Source

alert.lisp (file)

Constant: +unsupported-extension+

Package

cl-tls

Source

alert.lisp (file)

Constant: +user-canceled+

Package

cl-tls

Source

alert.lisp (file)

Constant: +warning+

Package

cl-tls

Source

alert.lisp (file)

6.2.2 Special variables

Special Variable: *certificate-request-msg*

Package

cl-tls

Source

tls.lisp (file)

Special Variable: *crlf*

Package

cl-tls

Source

http.lisp (file)

Special Variable: *debug-stream*

Package

cl-tls

Source

tls.lisp (file)

Special Variable: *id-ad-ocsp*

Package

cl-tls

Source

ocsp.lisp (file)

Special Variable: *log-level*

Package

cl-tls

Source

tls.lisp (file)

Special Variable: *max-certificate-chain-length*

Package

cl-tls

Source

tls.lisp (file)

Special Variable: *max-content-length*

Package

cl-tls

Source

http.lisp (file)

Special Variable: *max-fragment-length*

Package

cl-tls

Source

tls.lisp (file)

Special Variable: *max-int-len*

Package

cl-tls

Source

asn.1.lisp (file)

Special Variable: *supported-cipher-suites*

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: *version*

Package

cl-tls

Source

tls.lisp (file)

Special Variable: +3des-block-size+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +3des-encryption-suites+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +aes-128-ciphers+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +aes-256-ciphers+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +aes-block-size+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +aes-encryption-suites+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +anon-authentication-suites+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +cbc-mode-ciphers+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +dh-key-exchange-suites+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +dhe-key-exchange-suites+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +dss-authentication-suites+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +md5-ciphers+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +rc4-encryption-suites+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +rsa-authentication-suites+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +rsa-key-exchange-suites+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +sha1-ciphers+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +sha256-ciphers+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_anon_with_3des_ede_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_anon_with_aes_128_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_anon_with_aes_128_cbc_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_anon_with_aes_256_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_anon_with_aes_256_cbc_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_anon_with_rc4_128_md5+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_dss_with_3des_ede_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_dss_with_aes_128_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_dss_with_aes_128_cbc_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_dss_with_aes_256_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_dss_with_aes_256_cbc_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_rsa_with_3des_ede_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_rsa_with_aes_128_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_rsa_with_aes_128_cbc_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_rsa_with_aes_256_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dh_rsa_with_aes_256_cbc_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dhe_dss_with_3des_ede_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dhe_dss_with_aes_128_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dhe_dss_with_aes_128_cbc_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dhe_dss_with_aes_256_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dhe_dss_with_aes_256_cbc_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dhe_rsa_with_3des_ede_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dhe_rsa_with_aes_128_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dhe_rsa_with_aes_128_cbc_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dhe_rsa_with_aes_256_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_dhe_rsa_with_aes_256_cbc_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_rsa_with_3des_ede_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_rsa_with_aes_128_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_rsa_with_aes_128_cbc_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_rsa_with_aes_256_cbc_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_rsa_with_aes_256_cbc_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_rsa_with_null_md5+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_rsa_with_null_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_rsa_with_null_sha256+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_rsa_with_rc4_128_md5+

Package

cl-tls

Source

ciphersuites.lisp (file)

Special Variable: +tls_rsa_with_rc4_128_sha+

Package

cl-tls

Source

ciphersuites.lisp (file)

6.2.3 Symbol macros

Symbol Macro: endpoint-decryption-key

Package

cl-tls

Source

crypto.lisp (file)

Expansion

(if (eql cl-tls::role :client) cl-tls::server-write-key cl-tls::client-write-key)

Symbol Macro: endpoint-encryption-key

Package

cl-tls

Source

crypto.lisp (file)

Expansion

(if (eql cl-tls::role :client) cl-tls::client-write-key cl-tls::server-write-key)

Symbol Macro: endpoint-mac-decryption-key

Package

cl-tls

Source

tls.lisp (file)

Expansion

(if (eql cl-tls::role :client) cl-tls::server-write-mac-key cl-tls::client-write-mac-key)

Symbol Macro: endpoint-mac-encryption-key

Package

cl-tls

Source

tls.lisp (file)

Expansion

(if (eql cl-tls::role :client) cl-tls::client-write-mac-key cl-tls::server-write-mac-key)

6.2.4 Macros

Macro: bind-tbs TBS &body BODY

Package

cl-tls

Source

x509.lisp (file)

Macro: ocsp-catch-asn-error &body BODY

Package

cl-tls

Source

ocsp.lisp (file)

Macro: with-specification-map MAP VEC ERROR-CLAUSE &body B

Package

cl-tls

Source

utils.lisp (file)

6.2.5 Functions

Function: add-handshake-header HANDSHAKE-TYPE BUFFER

Package

cl-tls

Source

tls.lisp (file)

Function: alert-record-to-text CONTENT

Package

cl-tls

Source

alert.lisp (file)

Function: asn-sequence-to-indices VEC &optional CONTENTS-START

Given an asn sequence, return a list of the types of elements in them and their start and end positions in the vector

Package

cl-tls

Source

asn.1.lisp (file)

Function: asn-time-to-universal-time TIME-STRING

Converts utcTime or GeneralTime to universal time

Package

cl-tls

Source

x509.lisp (file)

Function: asn-type-matches-p TYPE INFO

Package

cl-tls

Source

utils.lisp (file)

Function: bytes-in-int INT

Return the least number of octets needed to represent an integer

Package

cl-tls

Source

utils.lisp (file)

Function: calculate-mac SESSION CONTENT-TYPE MESSAGE

Package

cl-tls

Source

tls.lisp (file)

Function: calculate-verification-mac SESSION CONTENT-TYPE MESSAGE

Package

cl-tls

Source

tls.lisp (file)

Function: cat-vectors &rest VECTORS

Package

cl-tls

Source

utils.lisp (file)

Function: check-certificate-status SESSION SUBJECT ISSUER

Check certificate status via OCSP.
If the OCSP request is successful and the status os good, return true. Return false in every other case

Package

cl-tls

Source

validate.lisp (file)

Function: check-ocsp SUBJECT ISSUER

Return the status of the certificate or signal an error

Package

cl-tls

Source

ocsp.lisp (file)

Function: cipher-suite-supported-p CS SESSION

Package

cl-tls

Source

tls.lisp (file)

Function: compute-shared-secret DH-PARAMS SECRET-EXP DH-PUBLIC-VALUE

Generates the final secret, given the dh-params and the dh-public-value of the other party

Package

cl-tls

Source

pkcs3.lisp (file)

Function: create-cert-id ISSUER-DN ISSUER-PUB-KEY CERT-SERIAL-NUMBER &optional HASH-ALGORITHM

Package

cl-tls

Source

ocsp.lisp (file)

Function: create-cert-status-request ()

Package

cl-tls

Source

extensions.lisp (file)