1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
use crate::tls::{Alert, ProtocolVersion};
/// TLS errror
#[derive(Clone, Copy, Debug)]
pub enum TlsError {
/// Received an alert record in teh handshake phase
AbortedHandshake(Alert),
/// Peer closed the connection without a graceful stop
AbruptDisconnect,
/// Bad Pre Key Share
BadPreKeyShare,
/// Bad signature
BadSignature,
/// Expected Finished record
ClientExpectedFinished,
/// Digest Check Failed
DigestCheckFailed,
/// Diffie–Hellman error
DiffieHellmanError,
/// Duplicated Certificate Request Parameters
DuplicatedCertificateRequestParameters,
/// Duplicated Client Hello Parameters
DuplicatedClientHelloParameters,
/// Duplicated Encrypted Extensions Parameters
DuplicatedEncryptedExtensionsParameters,
/// Empty Certificate Authorities
EmptyCertificateAuthorities,
/// Invalid Negotiated ALPN
EmptyNegotiatedAlpnClient,
/// Invalid Negotiated ALPN
EmptyNegotiatedAlpnServer,
/// Empty New Session Ticket
EmptyNewSessionTicket,
/// Empty set of certificates
EmptySetOfCertificates,
/// Incompatible ALPN
IncompatibleAlpn,
/// Incompatible Certificate Types
IncompatibleCertificateTypes,
/// Invalid AES data
InvalidAesData,
/// Invalid Alert
InvalidAlert,
/// Invalid array
InvalidArray,
/// Invalid slice
InvalidSlice,
/// Invalid certificate
InvalidCertificate,
/// Invalid certificate authorities
InvalidCertificateAuthorities,
/// Invalid certificate request
InvalidCertificateRequest,
/// Invalid Certificate Type
InvalidCertificateType,
/// Invalid certificate verify
InvalidCertificateVerify,
/// Invalid Cipher Suite
InvalidCipherSuite,
/// Invalid client hello length
InvalidClientHelloLength,
/// Invalid cookie
InvalidCookie,
/// Invalid Encrypted Extensions
InvalidEncryptedExtensions,
/// Invalid extension
InvalidExtension,
/// Invalid extension type
InvalidExtensionTy,
/// Invalid Finished Record
InvalidFinishedRecord,
/// Invalid Handshake
InvalidHandshake,
/// Invalid Legacy Compression Method (Server)
InvalidLegacyCompressionMethod,
/// Invalid Legacy Compression Methods (Client)
InvalidLegacyCompressionMethods,
/// Invalid Legacy Session Id
InvalidLegacySessionId,
/// Invalid new session ticket
InvalidNewSessionTicket,
/// Invalid Key Share Client Hello
InvalidKeyShareClientHello,
/// Invalid Key Share
InvalidKeyShare,
/// Invalid Key Share Entry
InvalidKeyShareEntry,
/// Invalid key update state
InvalidKeyUpdateState,
/// Invalid Max Fragment Length
InvalidMaxFragmentLength,
/// Invalid Negotiated Max Fragment Length
InvalidNegotiatedMaxFragmentLength,
/// Invalid Negotiated Server Name
InvalidNegotiatedServerName,
/// Invalid Psk Key Exchange Modes
InvalidPskKeyExchangeModes,
/// Invalid Signature Algorithms
InvalidSignatureAlgorithms,
/// Invalid Signature Algorithms Certificate
InvalidSignatureAlgorithmsCert,
/// Invalid Signature Scheme
InvalidSignatureScheme,
/// Invalid Supported Groups
InvalidSupportedGroups,
/// Invalid Supported Versions Of Client Hello
InvalidSupportedVersions,
/// Invalid server hello
InvalidServerHello,
/// Invalid Legacy Session Id Echo
InvalidLegacySessionIdEcho,
/// Invalid Psk Key Exchange Mode
InvalidPskKeyExchangeMode,
/// Invalid Raw Public Key
InvalidRawPublicKey,
/// Invalid server name
InvalidServerName,
/// Invalid server name list
InvalidServerNameList,
/// Invalid Offered Psks
InvalidOfferedPsks,
/// Invalid u8 prefix
InvalidU8Prefix,
/// Invalid u16 prefix
InvalidU16Prefix,
/// Invalid u24 prefix
InvalidU24Prefix,
/// For example, public key is PSS but signature is RSAE
MismatchedCertificatePkAndSignature,
/// Mismatch Extension
MismatchedExtension,
/// Invalid Negotiated ALPN
MismatchedNegotiatedAlpnClient,
/// Invalid Negotiated ALPN
MismatchedNegotiatedAlpnServer,
/// Missing Key Shares
MissingKeyShares,
/// Missing signature algorithms
MissingSignatureAlgorithms,
/// Missing supported groups
MissingSupportedGroups,
/// Missing `supported_versions`
MissingSupportedVersions,
/// No certificate received
NoCertificate,
/// Record extrapolates the maximum fragment length
ReceivedRecordIsTooLarge,
/// Too many key updates
TooManyKeyUpdates,
/// Too many warning alerts
TooManyWarningAlerts,
/// Record was supposed to be encrypted
UnencryptedRecord,
/// Unknown name type
UnknownNameType,
/// Unoffered Extension
UnofferedExtension,
/// Unknown Signature Scheme
UnknownSignatureScheme,
/// Unknown Webpki Signature Scheme
UnknownWebpkiSignatureScheme,
/// Can not receive certificate records once a PSK was accepted
CertRecordInAcceptedPsk,
/// Secret mismatch
SecretMismatch,
/// The server has a set of suites that the client don't support
ServerHasNoCompatibleAlgorithmTy,
/// The server has a set of suites that the client don't support
ServerHasNoCompatibleAlgorithmTyForCert,
/// The server has a set of suites that the client don't support
ServerHasNoCompatibleCypherSuite,
/// The server has a set of suites that the client don't support
ServerHasNoCompatibleKeyShare,
/// The capacity upper bound of `TlsReadBuffer` was extrapolated
TlsReadBufferOverflow,
/// Records like `ChangeCipherSpec` are not allowed as an inner type
UnexpectedAfterHandshakeInnerRecord,
/// Only an outer `ApplicationData` is allowed after the handshake
UnexpectedAfterHandshakeOuterRecord,
/// Unsupported Cipher Suite
UnsupportedCipherSuite,
/// Unsupported extension
UnsupportedExtension,
/// mTLS is not supported
UnsupportedMtls,
/// Only TLS 1.2 is supported due to legacy reasons
UnsupportedRecTlsVersion(ProtocolVersion),
/// Only TLS 1.3 is supported
UnsupportedTlsVersion(Option<ProtocolVersion>),
/// Unknown Named Group
UnknownNamedGroup,
/// Unknown handshake type
UnknownHandshakeTy,
/// Unknown record content type
UnknownRecordContentType,
/// Wrong alert
WrongAlert,
}