pinned

Documentation

Overview

Package pinned provides a dial function that checks TLS server certificates against local pins.

Index

• Variables
• type Config
  • func (c *Config) Dial(network, addr string) (net.Conn, error)
• type Conn
  • func (c Conn) CloseWrite() error

Variables

var ErrPinFailure = errors.New("pinned: the peer leaf certificate did not match the provided pin")

ErrPinFailure is returned by Config.Dial if the TLS handshake succeeded but the peer certificate did not match the pin.

Types

type Config

type Config struct {
	// Hash specifies the hash function to use to check the Pin, it defaults to
	// sha256.New.
	Hash func() hash.Hash

	// Pin defines the expected digest of the peer's leaf certificate.
	Pin []byte

	// Config is used as the base TLS configuration, if set.
	Config *tls.Config
}

A Config structure provides pinning and TLS connection information used to dial a server. A Config may be reused, the pinned package will not modify it.

func (*Config) Dial

func (c *Config) Dial(network, addr string) (net.Conn, error)

Dial establishes a TLS connection to addr and checks the peer leaf certificate against the configured pin. The underlying type of the returned net.Conn is a Conn.

type Conn

type Conn struct {
	// Conn is the actual TLS connection.
	*tls.Conn

	// Wire is the network connection underlying the TLS connection.
	Wire net.Conn
}

A Conn represents a secured connection. It implements the net.Conn interface.

func (Conn) CloseWrite

func (c Conn) CloseWrite() error

CloseWrite shuts down the writing side of the connection.