mtls

Documentation

Index

• Variables
• func ClearSecretManager()
• func GetSdsClient(cfg *auth.SdsSecretConfig) types.SdsClient
• func GetTLSConn(c net.Conn, b []byte) (net.Conn, error)
• func NewProvider(cfg *v2.TLSConfig) (types.TLSProvider, error)
• func NewTLSClientContextManager(cfg *v2.TLSConfig) (types.TLSContextManager, error)
• func NewTLSServerContextManager(cfg *v2.Listener) (types.TLSContextManager, error)
• func Register(name string, factory ConfigHooksFactory) error
• func RegisterSdsCallback(f func())
• type ConfigHooks
  • func DefaultConfigHooks() ConfigHooks
• type ConfigHooksFactory
• type Conn
  • func (c *Conn) Peek() ([]byte, error)
  • func (c *Conn) Read(b []byte) (int, error)
• type TLSConn
  • func (c *TLSConn) ConnectionState() gotls.ConnectionState
  • func (c *TLSConn) GetRawConn() net.Conn
  • func (c *TLSConn) GetTLSInfo(buf types.IoBuffer) int
  • func (c *TLSConn) SetALPN(alpn string)
  • func (c *TLSConn) WriteTo(v *net.Buffers) (int64, error)

Variables

var ErrorNoCertConfigure = errors.New("no certificate config")

ErrorNoCertConfigure represents config has no certificate

Functions

func ClearSecretManager

func ClearSecretManager()

func GetSdsClient

func GetSdsClient(cfg *auth.SdsSecretConfig) types.SdsClient

func GetTLSConn

func GetTLSConn(c net.Conn, b []byte) (net.Conn, error)

GetTLSConn return TLSConn

func NewProvider

func NewProvider(cfg *v2.TLSConfig) (types.TLSProvider, error)

NewProvider returns a types.Provider. we support sds provider and static provider.

func NewTLSClientContextManager

func NewTLSClientContextManager(cfg *v2.TLSConfig) (types.TLSContextManager, error)

NewTLSClientContextManager returns a types.TLSContextManager used in TLS Client

func NewTLSServerContextManager

func NewTLSServerContextManager(cfg *v2.Listener) (types.TLSContextManager, error)

NewTLSServerContextManager returns a types.TLSContextManager used in TLS Server A Server Manager can contains multiple certificates in provider

func Register

func Register(name string, factory ConfigHooksFactory) error

Register registers an extension.

func RegisterSdsCallback

func RegisterSdsCallback(f func())

Types

type ConfigHooks

type ConfigHooks interface {
	// GetCertificate returns the tls.Certificate by index.
	// By default the index is the cert/key file path or cert/key pem string
	GetCertificate(certIndex, keyIndex string) (tls.Certificate, error)
	// GetX509Pool returns the x509.CertPool, which is a set of certificates.
	// By default the index is the ca certificate file path or certificate pem string
	GetX509Pool(caIndex string) (*x509.CertPool, error)
	// ServerHandshakeVerify returns a function that used to set "VerifyPeerCertificate" defined in tls.Config.
	// If it is returns nil, the normal certificate verification will be used.
	// Notice that we set tls.Config.InsecureSkipVerify to make sure the "VerifyPeerCertificate" is called,
	// so the ServerHandshakeVerify should verify the trusted ca if necessary.
	// If the TLSConfig.RequireClientCert is false, the ServerHandshakeVerify will be ignored
	ServerHandshakeVerify(cfg *tls.Config) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
	// ClientHandshakeVerify returns a function that used to set "VerifyPeerCertificate" defined in tls.Config.
	// If it is returns nil, the normal certificate verification will be used.
	// Notice that we set tls.Config.InsecureSkipVerify to make sure the "VerifyPeerCertificate" is called,
	// so the ClientHandshakeVerify should verify the trusted ca if necessary.
	// If TLSConfig.InsecureSkip is true, the ClientHandshakeVerify will be ignored.
	ClientHandshakeVerify(cfg *tls.Config) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
}

ConfigHooks is a set of functions used to make a tls config

func DefaultConfigHooks

func DefaultConfigHooks() ConfigHooks

DefaultConfigHooks returns the default config hooks implement

type ConfigHooksFactory

type ConfigHooksFactory interface {
	CreateConfigHooks(config map[string]interface{}) ConfigHooks
}

ConfigHooksFactory creates ConfigHooks by config

type Conn

type Conn struct {
	net.Conn
	// contains filtered or unexported fields
}

Conn is a generic stream-oriented network connection. It implements the net.Conn interface.

func (*Conn) Peek

func (c *Conn) Peek() ([]byte, error)

Peek returns 1 byte from connection, without draining any buffered data.

func (*Conn) Read

func (c *Conn) Read(b []byte) (int, error)

Read reads data from the connection.

type TLSConn

type TLSConn struct {
	*tls.Conn
}

TLSConn represents a secured connection. It implements the net.Conn interface.

func (*TLSConn) ConnectionState

func (c *TLSConn) ConnectionState() gotls.ConnectionState

ConnectionState records basic TLS details about the connection.

func (*TLSConn) GetRawConn

func (c *TLSConn) GetRawConn() net.Conn

GetRawConn returns network connection.

func (*TLSConn) GetTLSInfo

func (c *TLSConn) GetTLSInfo(buf types.IoBuffer) int

GetTLSInfo returns TLSInfo

func (*TLSConn) SetALPN

func (c *TLSConn) SetALPN(alpn string)

SetALPN sets ALPN

func (*TLSConn) WriteTo

func (c *TLSConn) WriteTo(v *net.Buffers) (int64, error)

WriteTo writes data