Tls

This PR adds TLS support using ocaml-tls. Due to reindentation of the modified code with ocaml-indent, the changeset is a bit hard to read, sorry about that.
On Thu, Aug 28, 2014 at 12:33:49AM -0700, Vincent Bernardoff wrote:
> > +          try_lwt
> > +            lwt ich, och = match t.tls with
> > +              | None ->
> > +                  Lwt_io.(of_fd input fd, of_fd output fd) |> Lwt.return
> > +              | Some server_config ->
> > +                  Tls_lwt.(Unix.server_of_fd server_config fd >|= of_t)
> > +            in
> > +            let conn = { addr; ich; och; in_buf = ref ""; out_buf = MB.create () } in
> > +              (match_lwt read_msg conn with
> > +                | { id; op = Connect client_id; _ } ->
> > +                    Lwt_log.info_f ~section "Incoming client connection from %S" client_id >>
> > +                    send_msg conn { id; response = OK "" } >>
> > +                    request_loop t client_id conn
> > +                | { id; _ } ->
> > +                    send_msg conn { id; response = Error "Bad request" })
> > +              >> try_lwt Lwt_io.close ich with _ -> return_unit
> 
> On 28/08/2014 01:02, mfp wrote:
> > Is there any particular reason to close the channel here (note that the fd is
> > closed below in L469)?
> > In order to get a socket shutdown(2) (doesn't closing the fd imply shutdown
> > SHUT_RDWR?)?
> 
> Yes, when using TLS, you need to advertise you're closing the connection, and
> that magic is done by a function automatically called by Lwt_io.close (which
> call I believe Tls_lwt.Unix.close).
> 
> So when using TLS, one need to call Lwt_io.close.

I thought just closing the fd would terminate the TCP connection and thus the
TLS session, but
http://gnutls.org/manual/html_node/Core-TLS-API.html#gnutls_005fbye explains
(as is obvious in hindsight) that doing proper in-protocol termination allows
to distinguish between malicious premature termination by a third party and
normal one.

-- 
Mauricio Fernández