<commit_before>open Utils
open Core

open Sexplib.Std

type certchain = Cert.t list * Mirage_crypto_pk.Rsa.priv [@@deriving sexp]

type own_cert = [
  | `None
  | `Single of certchain
  | `Multiple of certchain list
  | `Multiple_default of certchain * certchain list
] [@@deriving sexp]

type session_cache = SessionID.t -> epoch_data option
let session_cache_of_sexp _ = fun _ -> None
let sexp_of_session_cache _ = Sexplib.Sexp.Atom "SESSION_CACHE"

module Auth = struct
  type t = X509.Authenticator.t
  let t_of_sexp _ = failwith "can't convert sexp to authenticator"
  let sexp_of_t _ = Sexplib.Sexp.Atom "Authenticator"
end

module DN = struct
  type t = X509.Distinguished_name.t
  let t_of_sexp _ = failwith "can't convert sexp to distinguished name"
  let sexp_of_t _ = Sexplib.Sexp.Atom "distinguished name"
end

type ticket_cache = {
  lookup : Cstruct.t -> (psk13 * epoch_data) option ;
  ticket_granted : psk13 -> epoch_data -> unit ;
  lifetime : int32 ;
  timestamp : unit -> Ptime.t
}

type ticket_cache_opt = ticket_cache option
let ticket_cache_opt_of_sexp _ = None
let sexp_of_ticket_cache_opt _ = Sexplib.Sexp.Atom "TICKET_CACHE"

type config = {
  ciphers : Ciphersuite.ciphersuite list ;
  protocol_versions : tls_version * tls_version ;
  signature_algorithms : signature_algorithm list ;
  use_reneg : bool ;
  authenticator : Auth.t option ;
  peer_name : string option ;
  own_certificates : own_cert ;
  acceptable_cas : DN.t list ;
  session_cache : session_cache ;
  ticket_cache : ticket_cache_opt ;
  cached_session : epoch_data option ;
  cached_ticket : (psk13 * epoch_data) option ;
  alpn_protocols : string list ;
  groups : group list ;
  zero_rtt : int32 ;
} [@@deriving sexp]

let ciphers13 cfg =
  List.rev
    (List.fold_left (fun acc cs ->
         match Ciphersuite.ciphersuite_to_ciphersuite13 cs with
         | None -> acc
         | Some c -> c :: acc)
        [] cfg.ciphers)

module Ciphers = struct

  (* A good place for various pre-baked cipher lists and helper functions to
   * slice and groom those lists. *)

  let default13 = [
    `TLS_AES_128_GCM_SHA256 ;
    `TLS_AES_256_GCM_SHA384 ;
    (* `TLS_CHACHA20_POLY1305_SHA256 ; *)
    `TLS_AES_128_CCM_SHA256 ;
    (* `TLS_AES_128_CCM_8_SHA256 *)
  ]

  let default = default13 @ [
    `TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ;
    `TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 ;
    `TLS_DHE_RSA_WITH_AES_256_CCM ;
    `TLS_DHE_RSA_WITH_AES_128_CCM ;
    `TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 ;
    `TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 ;
    `TLS_DHE_RSA_WITH_AES_256_CBC_SHA ;
    `TLS_DHE_RSA_WITH_AES_128_CBC_SHA ;
    `TLS_RSA_WITH_AES_256_CCM ;
    `TLS_RSA_WITH_AES_128_CCM ;
    `TLS_RSA_WITH_AES_256_CBC_SHA256 ;
    `TLS_RSA_WITH_AES_128_CBC_SHA256 ;
    `TLS_RSA_WITH_AES_256_CBC_SHA ;
    `TLS_RSA_WITH_AES_128_CBC_SHA ;
    ]

  let supported = default @ [
    `TLS_RSA_WITH_AES_256_GCM_SHA384 ;
    `TLS_RSA_WITH_AES_128_GCM_SHA256 ;
    `TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA ;
    `TLS_RSA_WITH_3DES_EDE_CBC_SHA ;
    `TLS_RSA_WITH_RC4_128_SHA ;
    `TLS_RSA_WITH_RC4_128_MD5
    ]

  let fs_of = List.filter Ciphersuite.ciphersuite_fs

  let fs = fs_of default
end

(* TODO split into <=12 and >=13, the SHA1 isn't 13 anymore *)
let default_signature_algorithms =
  [ `RSA_PSS_RSAENC_SHA256 ;
    `RSA_PSS_RSAENC_SHA384 ;
    `RSA_PSS_RSAENC_SHA512 ;
    `RSA_PKCS1_SHA256 ;
    `RSA_PKCS1_SHA384 ;
    `RSA_PKCS1_SHA512 ;
    `RSA_PKCS1_SHA1 ]<commit_msg>TLS_RSA_GCM is fine in the default configuration, TLS_DHE_GCM is there as well<commit_after>open Utils
open Core

open Sexplib.Std

type certchain = Cert.t list * Mirage_crypto_pk.Rsa.priv [@@deriving sexp]

type own_cert = [
  | `None
  | `Single of certchain
  | `Multiple of certchain list
  | `Multiple_default of certchain * certchain list
] [@@deriving sexp]

type session_cache = SessionID.t -> epoch_data option
let session_cache_of_sexp _ = fun _ -> None
let sexp_of_session_cache _ = Sexplib.Sexp.Atom "SESSION_CACHE"

module Auth = struct
  type t = X509.Authenticator.t
  let t_of_sexp _ = failwith "can't convert sexp to authenticator"
  let sexp_of_t _ = Sexplib.Sexp.Atom "Authenticator"
end

module DN = struct
  type t = X509.Distinguished_name.t
  let t_of_sexp _ = failwith "can't convert sexp to distinguished name"
  let sexp_of_t _ = Sexplib.Sexp.Atom "distinguished name"
end

type ticket_cache = {
  lookup : Cstruct.t -> (psk13 * epoch_data) option ;
  ticket_granted : psk13 -> epoch_data -> unit ;
  lifetime : int32 ;
  timestamp : unit -> Ptime.t
}

type ticket_cache_opt = ticket_cache option
let ticket_cache_opt_of_sexp _ = None
let sexp_of_ticket_cache_opt _ = Sexplib.Sexp.Atom "TICKET_CACHE"

type config = {
  ciphers : Ciphersuite.ciphersuite list ;
  protocol_versions : tls_version * tls_version ;
  signature_algorithms : signature_algorithm list ;
  use_reneg : bool ;
  authenticator : Auth.t option ;
  peer_name : string option ;
  own_certificates : own_cert ;
  acceptable_cas : DN.t list ;
  session_cache : session_cache ;
  ticket_cache : ticket_cache_opt ;
  cached_session : epoch_data option ;
  cached_ticket : (psk13 * epoch_data) option ;
  alpn_protocols : string list ;
  groups : group list ;
  zero_rtt : int32 ;
} [@@deriving sexp]

let ciphers13 cfg =
  List.rev
    (List.fold_left (fun acc cs ->
         match Ciphersuite.ciphersuite_to_ciphersuite13 cs with
         | None -> acc
         | Some c -> c :: acc)
        [] cfg.ciphers)

module Ciphers = struct

  (* A good place for various pre-baked cipher lists and helper functions to
   * slice and groom those lists. *)

  let default13 = [
    `TLS_AES_128_GCM_SHA256 ;
    `TLS_AES_256_GCM_SHA384 ;
    (* `TLS_CHACHA20_POLY1305_SHA256 ; *)
    `TLS_AES_128_CCM_SHA256 ;
    (* `TLS_AES_128_CCM_8_SHA256 *)
  ]

  let default = default13 @ [
    `TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ;
    `TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 ;
    `TLS_DHE_RSA_WITH_AES_256_CCM ;
    `TLS_DHE_RSA_WITH_AES_128_CCM ;
    `TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 ;
    `TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 ;
    `TLS_DHE_RSA_WITH_AES_256_CBC_SHA ;
    `TLS_DHE_RSA_WITH_AES_128_CBC_SHA ;
    `TLS_RSA_WITH_AES_256_GCM_SHA384 ;
    `TLS_RSA_WITH_AES_128_GCM_SHA256 ;
    `TLS_RSA_WITH_AES_256_CCM ;
    `TLS_RSA_WITH_AES_128_CCM ;
    `TLS_RSA_WITH_AES_256_CBC_SHA256 ;
    `TLS_RSA_WITH_AES_128_CBC_SHA256 ;
    `TLS_RSA_WITH_AES_256_CBC_SHA ;
    `TLS_RSA_WITH_AES_128_CBC_SHA ;
    ]

  let supported = default @ [
    `TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA ;
    `TLS_RSA_WITH_3DES_EDE_CBC_SHA ;
    `TLS_RSA_WITH_RC4_128_SHA ;
    `TLS_RSA_WITH_RC4_128_MD5
    ]

  let fs_of = List.filter Ciphersuite.ciphersuite_fs

  let fs = fs_of default
end

(* TODO split into <=12 and >=13, the SHA1 isn't 13 anymore *)
let default_signature_algorithms =
  [ `RSA_PSS_RSAENC_SHA256 ;
    `RSA_PSS_RSAENC_SHA384 ;
    `RSA_PSS_RSAENC_SHA512 ;
    `RSA_PKCS1_SHA256 ;
    `RSA_PKCS1_SHA384 ;
    `RSA_PKCS1_SHA512 ;
    `RSA_PKCS1_SHA1 ]
{'fraction_non_alphanumeric': 0.07654886249821148, 'fraction_numerical': 0.04893403920446416, 'mean_word_length': 3.881284916201117, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 23, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '451292', 'n_tokens_mistral': 3132, 'n_tokens_neox': 2753, 'n_words': 523}