Skip to content

create TLS client & server with full set of arguments#52

Open
CodiePP wants to merge 1 commit intoanmonteiro:masterfrom
CodiePP:tls_pass_all_arguments
Open

create TLS client & server with full set of arguments#52
CodiePP wants to merge 1 commit intoanmonteiro:masterfrom
CodiePP:tls_pass_all_arguments

Conversation

@CodiePP
Copy link

@CodiePP CodiePP commented Feb 11, 2023

Signed-off-by: Alexander Diemand codieplusplus@apax.net

This change allows to pass in more arguments to the basic Tls_io functions to setup its Tls.Config.

This allows to more finegrained control the TLS handshake and improve security.

An example of its usage is in: https://github.com/CodiePP/ml-grpc-examples
(an accompanying PR is submitted to https://github.com/anmonteiro/ocaml-h2)

Signed-off-by: Alexander Diemand <codieplusplus@apax.net>
@anmonteiro
Copy link
Owner

My rationale for having a limited set of options for these default handlers is that you can always "jailbreak" by using your own Tls_lwt.Unix.t, check out this example https://github.com/anmonteiro/ocaml-h2/blob/fceaad2cfa198f090b47d6d72cb1c4ea9dee4a07/examples/alpn/unix/alpn_server_tls.ml#L29-L48

@CodiePP
Copy link
Author

CodiePP commented Feb 15, 2023

My rationale for having a limited set of options for these default handlers is that you can always "jailbreak" by using your own Tls_lwt.Unix.t, check out this example https://github.com/anmonteiro/ocaml-h2/blob/fceaad2cfa198f090b47d6d72cb1c4ea9dee4a07/examples/alpn/unix/alpn_server_tls.ml#L29-L48

true. Since the arguments are optional they could be put on the default handler too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants