tls

package
v0.0.0-...-c9c9802 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 20, 2025 License: MIT Imports: 25 Imported by: 0

Documentation

Overview

Package tls implements the TLS 1.3 protocol.

Index

Constants

This section is empty.

Variables

View Source 
var HelloRetryRequestRandom = [32]byte{
	0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11,
	0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91,
	0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E,
	0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33, 0x9C,
}

HelloRetryRequestRandom defines the well-known value of the HelloRetryRequest's Random field.

Functions

func Marshal 

func Marshal(v interface{}) ([]byte, error)

Marshal encodes the value v.

func MarshalTo 

func MarshalTo(buf []byte, v interface{}) (int, error)

MarshalTo encodes the value v to the buffer buf.

func Unmarshal 

func Unmarshal(buf []byte, v interface{}) error

Unmarshal decodes the value v from the buffer buf. It is an error if the buffer has any trailing bytes that were not decoded.

func UnmarshalFrom 

func UnmarshalFrom(buf []byte, v interface{}) (int, error)

UnmarshalFrom decodes the value v from the buffer buf.

Types

type Alert 

type Alert struct {
	Level       AlertLevel
	Description AlertDescription
}

Alert defines alert messages.

type AlertDescription 

type AlertDescription uint8

AlertDescription describes the alert. 

const (
	AlertCloseNotify                  AlertDescription = 0
	AlertUnexpectedMessage            AlertDescription = 10
	AlertBadRecordMAC                 AlertDescription = 20
	AlertRecordOverflow               AlertDescription = 22
	AlertHandshakeFailure             AlertDescription = 40
	AlertBadCertificate               AlertDescription = 42
	AlertUnsupportedCertificate       AlertDescription = 43
	AlertCertificateRevoked           AlertDescription = 44
	AlertCertificateExpired           AlertDescription = 45
	AlertCertificateUnknown           AlertDescription = 46
	AlertIllegalParameter             AlertDescription = 47
	AlertUnknownCA                    AlertDescription = 48
	AlertAccessDenied                 AlertDescription = 49
	AlertDecodeError                  AlertDescription = 50
	AlertDecryptError                 AlertDescription = 51
	AlertProtocolVersion              AlertDescription = 70
	AlertInsufficientSecurity         AlertDescription = 71
	AlertInternalError                AlertDescription = 80
	AlertInappropriateFallback        AlertDescription = 86
	AlertUserCanceled                 AlertDescription = 90
	AlertMissingExtension             AlertDescription = 109
	AlertUnsupportedExtension         AlertDescription = 110
	AlertUnrecognizedName             AlertDescription = 112
	AlertBadCertificateStatusResponse AlertDescription = 113
	AlertUnknownPSKIdentity           AlertDescription = 115
	AlertCertificateRequired          AlertDescription = 116
	AlertNoApplicationProtocol        AlertDescription = 120
)

Alert descriptions.

func (AlertDescription) Error 

func (desc AlertDescription) Error() string

func (AlertDescription) Level 

func (desc AlertDescription) Level() AlertLevel

Level returns the alert description's severity.

func (AlertDescription) String 

func (desc AlertDescription) String() string

type AlertLevel 

type AlertLevel uint8

AlertLevel defines alert severity 

const (
	AlertLevelWarning AlertLevel = 1
	AlertLevelFatal   AlertLevel = 2
)

Alert Levels.

func (AlertLevel) String 

func (level AlertLevel) String() string

type Certificate 

type Certificate struct {
	HandshakeTypeLen          uint32
	CertificateRequestContext []byte             `tls:"u8"`
	CertificateList           []CertificateEntry `tls:"u24"`
}

Certificate implements the certificate handshake message.

type CertificateEntry 

type CertificateEntry struct {
	Data       []byte      `tls:"u24"`
	Extensions []Extension `tls:"u16"`
}

CertificateEntry defines a certificate entry in the Certificate message.

type CertificateVerify 

type CertificateVerify struct {
	HandshakeTypeLen uint32
	Algorithm        SignatureScheme
	Signature        []byte `tls:"u16"`
}

CertificateVerify implements the certificate_verify handshake message.

type Cipher 

type Cipher struct {
	// contains filtered or unexported fields
}

Cipher implements an AEAD cipher instance.

func NewCipher 

func NewCipher(conn *Conn, key, iv []byte, role string) (*Cipher, error)

NewCipher creates a new Cipher for the key and iv.

func (*Cipher) Decrypt 

func (cipher *Cipher) Decrypt(data []byte) (ContentType, []byte, error)

Decrypt decrypts the data and returns its content type and decrypted content.

func (*Cipher) Encrypt 

func (cipher *Cipher) Encrypt(ct ContentType, data []byte) []byte

Encrypt encrypts the data. The ct argument specifies the content type of the data.

func (*Cipher) IV 

func (cipher *Cipher) IV() []byte

IV creates the IV for the next encrypt/decrypt operation.

type CipherSuite 

type CipherSuite uint16

CipherSuite defines cipher suites. 

const (
	CipherTLSAes128GcmSha256        CipherSuite = 0x1301
	CipherTLSAes256GcmSha384        CipherSuite = 0x1302
	CipherTLSChacha20Poly1305Sha256 CipherSuite = 0x1303
)

TLS 1.3 mandatory cipher suites.

func (CipherSuite) Hash 

func (cs CipherSuite) Hash() hash.Hash

Hash returns the cipher suite's hash function.

func (CipherSuite) IVSize 

func (cs CipherSuite) IVSize() int

func (CipherSuite) KeySize 

func (cs CipherSuite) KeySize() int

func (CipherSuite) String 

func (cs CipherSuite) String() string

type ClientHello 

type ClientHello struct {
	HandshakeTypeLen         uint32
	LegacyVersion            ProtocolVersion
	Random                   [32]byte
	LegacySessionID          []byte        `tls:"u8"`
	CipherSuites             []CipherSuite `tls:"u16"`
	LegacyCompressionMethods []byte        `tls:"u8"`
	Extensions               []Extension   `tls:"u16"`
}

ClientHello implements the client_hello message.

type Config 

type Config struct {
	Debug       bool
	PrivateKey  *ecdsa.PrivateKey
	Certificate *x509.Certificate
	ServerName  string
}

Config defines TLS client and server configuration options.

type Conn 

type Conn struct {
	// contains filtered or unexported fields
}

Conn implements a TLS connection.

func NewConnection 

func NewConnection(conn net.Conn, config *Config) *Conn

NewConnection creates a new TLS connection for the argument conn.

func (*Conn) ClientHandshake 

func (conn *Conn) ClientHandshake() error

ClientHandshake runs the client handshake protocol.

func (*Conn) Close 

func (conn *Conn) Close() error

Close implements io.Closer.Close.

func (*Conn) Debugf 

func (conn *Conn) Debugf(format string, a ...interface{})

Debugf prints debug output for the connection.

func (*Conn) LocalAddr 

func (conn *Conn) LocalAddr() net.Addr

LocalAddr implements net.Conn.LocalAddr.

func (*Conn) Read 

func (conn *Conn) Read(p []byte) (n int, err error)

func (*Conn) ReadRecord 

func (conn *Conn) ReadRecord() (ContentType, []byte, error)

ReadRecord reads a record layer record.

func (*Conn) RemoteAddr 

func (conn *Conn) RemoteAddr() net.Addr

RemoteAddr implements net.Conn.RemoteAddr.

func (*Conn) ServerHandshake 

func (conn *Conn) ServerHandshake(key *ecdsa.PrivateKey,
	cert *x509.Certificate) error

ServerHandshake runs the server handshake protocol.

func (*Conn) SetDeadline 

func (conn *Conn) SetDeadline(t time.Time) error

SetDeadline implements net.Conn.SetDeadline.

func (*Conn) SetReadDeadline 

func (conn *Conn) SetReadDeadline(t time.Time) error

SetReadDeadline implements net.Conn.SetReadDeadline.

func (*Conn) SetWriteDeadline 

func (conn *Conn) SetWriteDeadline(t time.Time) error

SetWriteDeadline implements net.Conn.SetWriteDeadline.

func (*Conn) Write 

func (conn *Conn) Write(p []byte) (int, error)

func (*Conn) WriteRecord 

func (conn *Conn) WriteRecord(ct ContentType, data []byte) error

WriteRecord writes a record layer record.

func (*Conn) WriteTranscript 

func (conn *Conn) WriteTranscript(data []byte)

type ContentType 

type ContentType uint8

ContentType specifies record layer record types. 

const (
	CTInvalid          ContentType = 0
	CTChangeCipherSpec ContentType = 20
	CTAlert            ContentType = 21
	CTHandshake        ContentType = 22
	CTApplicationData  ContentType = 23
)

Record layer record types.

func (ContentType) String 

func (ct ContentType) String() string

type EncryptedExtensions 

type EncryptedExtensions struct {
	HandshakeTypeLen uint32
	Extensions       []Extension `tls:"u16"`
}

EncryptedExtensions implements the encrypted_extensions handshake message.

type Extension 

type Extension struct {
	Type ExtensionType
	Data []byte `tls:"u16"`
}

Extension defines protocol extensions.

func NewExtension 

func NewExtension(t ExtensionType, values ...interface{}) Extension

NewExtension creates a new protocol extension.

func (Extension) String 

func (ext Extension) String() string

func (Extension) Uint16List 

func (ext Extension) Uint16List(lsize int) ([]uint16, error)

Uint16List returns the extension value as a list of uint16 values. The argument lsize specifies the list value length in bytes.

type ExtensionType 

type ExtensionType uint16

ExtensionType defines the protocol extensions. 

const (
	ETServerName                          ExtensionType = 0     // RFC 6066
	ETMaxFragmentLength                   ExtensionType = 1     // RFC 6066
	ETStatusRequest                       ExtensionType = 5     // RFC 6066
	ETSupportedGroups                     ExtensionType = 10    // RFC 8422 7919
	ETECPointFormats                      ExtensionType = 11    // RFC 8422
	ETSignatureAlgorithms                 ExtensionType = 13    // RFC 8446
	ETUseSRTP                             ExtensionType = 14    // RFC 5764
	ETHeartbeat                           ExtensionType = 15    // RFC 6520
	ETApplicationLayerProtocolNegotiation ExtensionType = 16    // RFC 7301
	ETSignedCertificateTimestamp          ExtensionType = 18    // RFC 6962
	ETClientCertificateType               ExtensionType = 19    // RFC 7250
	ETServerCertificateType               ExtensionType = 20    // RFC 7250
	ETPadding                             ExtensionType = 21    // RFC 7685
	ETExtendedMasterSecret                ExtensionType = 23    // RFC 7627
	ETCompressCertificate                 ExtensionType = 27    // RFC 8879
	ETSessionTicket                       ExtensionType = 35    // RFC 8446
	ETPreSharedKey                        ExtensionType = 41    // RFC 8446
	ETEarlyData                           ExtensionType = 42    // RFC 8446
	ETSupportedVersions                   ExtensionType = 43    // RFC 8446
	ETCookie                              ExtensionType = 44    // RFC 8446
	ETPSKKeyExchangeModes                 ExtensionType = 45    // RFC 8446
	ETCertificateAuthorities              ExtensionType = 47    // RFC 8446
	ETOIDFilters                          ExtensionType = 48    // RFC 8446
	ETPostHandshakeAuth                   ExtensionType = 49    // RFC 8446
	ETSignatureAlgorithmsCert             ExtensionType = 50    // RFC 8446
	ETKeyShare                            ExtensionType = 51    // RFC 8446
	ETRenegotiationInfo                   ExtensionType = 65281 // RFC 5746
)

ExtensionTypes.

func (ExtensionType) String 

func (et ExtensionType) String() string

type Finished 

type Finished struct {
	HandshakeTypeLen uint32
	VerifyData       [32]byte
}

Finished implements the finished handshake message.

type HandshakeState 

type HandshakeState uint8

HandshakeState defines the connection's handshake state. 

const (
	HSClientHello HandshakeState = iota
	HSServerHello
	HSServerDone
	HSDone
)

Handshake states.

func (HandshakeState) String 

func (hs HandshakeState) String() string

type HandshakeType 

type HandshakeType uint8

HandshakeType defines handshake message types. 

const (
	HTClientHello HandshakeType = iota + 1
	HTServerHello

	HTNewSessionTicket
	HTEndOfEarlyData

	HTEncryptedExtensions

	HTCertificate

	HTCertificateRequest

	HTCertificateVerify

	HTFinished

	HTKeyUpdate

	HTMessageHash HandshakeType = 254
)

Handshake message types.

func (HandshakeType) String 

func (ht HandshakeType) String() string

type KeyShareEntry 

type KeyShareEntry struct {
	Group       NamedGroup
	KeyExchange []byte `tls:"u16"`
}

KeyShareEntry defines a key_share extension entry.

func (KeyShareEntry) Bytes 

func (key KeyShareEntry) Bytes() []byte

Bytes returns the key share entry's protocol encoding.

func (KeyShareEntry) Clone 

func (key KeyShareEntry) Clone() *KeyShareEntry

Clone creates an independent copy of the KeyShareEntry.

func (KeyShareEntry) String 

func (key KeyShareEntry) String() string

type NamedGroup 

type NamedGroup uint16

NamedGroup defines named key exchange groups. 

const (
	GroupSecp256r1      NamedGroup = 0x0017
	GroupSecp384r1      NamedGroup = 0x0018
	GroupSecp521r1      NamedGroup = 0x0019
	GroupX25519         NamedGroup = 0x001D
	GroupX448           NamedGroup = 0x001E
	GroupFfdhe2048      NamedGroup = 0x0100
	GroupFfdhe3072      NamedGroup = 0x0101
	GroupFfdhe4096      NamedGroup = 0x0102
	GroupFfdhe6144      NamedGroup = 0x0103
	GroupFfdhe8192      NamedGroup = 0x0104
	GroupX25519MLKEM768 NamedGroup = 0x11EC
)

Named groups.

func (NamedGroup) Bytes 

func (group NamedGroup) Bytes() []byte

Bytes returns the protocol encoding of the group.

func (NamedGroup) String 

func (group NamedGroup) String() string

type NewSessionTicket 

type NewSessionTicket struct {
	HandshakeTypeLen uint32
	TicketLifetime   uint32
	TicketAgeAdd     uint32
	TicketNonce      []byte      `tls:"u8"`
	Ticket           []byte      `tls:"u16"`
	Extensions       []Extension `tls:"u16"`
}

NewSessionTicket implements the new_session_ticket message.

type ProtocolVersion 

type ProtocolVersion uint16

ProtocolVersion defines TLS protocol version. 

const (
	VersionSSL30 ProtocolVersion = 0x0300
	VersionTLS10 ProtocolVersion = 0x0301
	VersionTLS11 ProtocolVersion = 0x0302
	VersionTLS12 ProtocolVersion = 0x0303
	VersionTLS13 ProtocolVersion = 0x0304
)

Version numbers.

func (ProtocolVersion) Bytes 

func (v ProtocolVersion) Bytes() []byte

Bytes returns the protocol encoding of the group.

func (ProtocolVersion) String 

func (v ProtocolVersion) String() string

type ServerHello 

type ServerHello struct {
	HandshakeTypeLen        uint32
	LegacyVersion           ProtocolVersion
	Random                  [32]byte
	LegacySessionID         []byte `tls:"u8"`
	CipherSuite             CipherSuite
	LegacyCompressionMethod byte
	Extensions              []Extension `tls:"u16"`
}

ServerHello implements the server_hello message.

type ServerName 

type ServerName struct {
	NameType uint8
	Hostname []byte `tls:"u16"`
}

ServerName defines a server_name extension.

type SignatureScheme 

type SignatureScheme uint16

SignatureScheme defines the signature algorithms for the signature_algorithms and signature_algorithms_cert extensions. 

const (
	SigSchemeRsaPkcs1Sha256       SignatureScheme = 0x0401
	SigSchemeRsaPkcs1Sha384       SignatureScheme = 0x0501
	SigSchemeRsaPkcs1Sha512       SignatureScheme = 0x0601
	SigSchemeEcdsaSecp256r1Sha256 SignatureScheme = 0x0403
	SigSchemeEcdsaSecp384r1Sha384 SignatureScheme = 0x0503
	SigSchemeEcdsaSecp521r1Sha512 SignatureScheme = 0x0603
	SigSchemeRsaPssRsaeSha256     SignatureScheme = 0x0804
	SigSchemeRsaPssRsaeSha384     SignatureScheme = 0x0805
	SigSchemeRsaPssRsaeSha512     SignatureScheme = 0x0806
	SigSchemeEd25519              SignatureScheme = 0x0807
	SigSchemeEd448                SignatureScheme = 0x0808
	SigSchemeRsaPssPssSha256      SignatureScheme = 0x0809
	SigSchemeRsaPssPssSha384      SignatureScheme = 0x080a
	SigSchemeRsaPssPssSha512      SignatureScheme = 0x080b
	SigSchemeRsaPkcs1Sha1         SignatureScheme = 0x0201
	SigSchemeEcdsaSha1            SignatureScheme = 0x0203
)

Signature algorithms.

func (SignatureScheme) String 

func (scheme SignatureScheme) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.