AtlatestRepositorysigil-tls
1
;;; (sigil tls) - TLS/SSL Connections2
;;;3
;;; Secure TCP connections using mbedTLS. Supports TLS 1.2 client4
;;; connections with system CA certificate verification.5
;;;6
;;; ```scheme7
;;; (import (sigil tls))8
;;;9
;;; (let ((conn (tls-connect "example.com" 443)))10
;;; (tls-write conn "GET / HTTP/1.1\r\nHost: example.com\r\n\r\n")11
;;; (display (tls-read conn))12
;;; (tls-close conn))13
;;; ```15
(define-library (sigil tls)16
(export17
tls-connection?18
tls-connect19
tls-read20
tls-read-bytevector21
tls-write22
tls-close23
tls-closed?24
tls-set-non-blocking!25
tls-upgrade)27
(begin29
;;; Check if value is a TLS connection object.30
(define-native (tls-connection? value)31
(: any? -> boolean?))33
;;; Establish a TLS connection to the specified host and port.34
;;;35
;;; Returns a TLS connection object on success, #f on failure.36
;;; Certificates are verified against system CA certificates by default.37
;;; Set SIGIL_TLS_INSECURE=1 to skip verification (testing only).38
;;;39
;;; An optional `connect-timeout-ms` (positive integer milliseconds)40
;;; bounds the TCP connect phase: the underlying connect is made41
;;; non-blocking and each resolved address is tried with `select`42
;;; under a shared deadline, so a blackholed address cannot hang on43
;;; the OS SYN-retransmit timeout. Omitted or <= 0 keeps the original44
;;; blocking connect (default behavior unchanged). Ignored on Windows.45
;;;46
;;; ```scheme47
;;; (tls-connect "example.com" 443) ; => tls-connection | #f48
;;; (tls-connect "example.com" 443 10000) ; 10s connect timeout49
;;; ```50
(define-native (tls-connect hostname port . connect-timeout-ms)51
(: string? integer? -> any?))53
;;; Read data from a TLS connection.54
;;;55
;;; Returns a string with data, #f on error, or eof-object if the56
;;; connection was closed by the peer. An optional max-bytes argument57
;;; controls the buffer size (default 4096).58
;;;59
;;; ```scheme60
;;; (tls-read conn) ; => string | #f | eof-object61
;;; (tls-read conn 8192) ; read up to 8192 bytes62
;;; ```63
(define-native (tls-read connection . max-bytes)64
(: any? -> any?))66
;;; Read raw bytes from a TLS connection into a bytevector.67
;;;68
;;; Like `tls-read` but returns a bytevector instead of a string,69
;;; preserving raw bytes without encoding interpretation.70
;;;71
;;; ```scheme72
;;; (tls-read-bytevector conn) ; => bytevector | #f | eof-object73
;;; (tls-read-bytevector conn 8192) ; read up to 8192 bytes74
;;; ```75
(define-native (tls-read-bytevector connection . max-bytes)76
(: any? -> any?))78
;;; Write data to a TLS connection.79
;;;80
;;; Accepts a string or bytevector. Returns the number of bytes81
;;; written, or #f on error.82
;;;83
;;; ```scheme84
;;; (tls-write conn "GET / HTTP/1.1\r\n\r\n") ; => integer | #f85
;;; ```86
(define-native (tls-write connection data)87
(: any? (any-of string? bytevector?) -> (any-of integer? boolean?)))89
;;; Close a TLS connection.90
;;;91
;;; Sends a close notification and frees resources. Returns #t.92
(define-native (tls-close connection)93
(: any? -> boolean?))95
;;; Check if a TLS connection is closed.96
(define-native (tls-closed? connection)97
(: any? -> boolean?))99
;;; Set the underlying socket to non-blocking mode.100
;;;101
;;; Enable defaults to #t if not provided. Returns #t on success.102
;;;103
;;; ```scheme104
;;; (tls-set-non-blocking! conn) ; enable non-blocking105
;;; (tls-set-non-blocking! conn #f) ; disable non-blocking106
;;; ```107
(define-native (tls-set-non-blocking! connection . enable)108
(: any? -> boolean?))110
;;; Upgrade an existing TCP socket to a TLS connection.111
;;;112
;;; Performs a TLS handshake on an existing socket connection (STARTTLS).113
;;; Takes ownership of the socket's file descriptor; the original socket114
;;; should not be used after this call.115
;;;116
;;; ```scheme117
;;; (tls-upgrade sock "mail.example.com") ; => tls-connection | #f118
;;; ```119
(define-native (tls-upgrade socket hostname)120
(: any? string? -> any?))))