tls

Apr 20, 2025

Changes in this version

+ var HelloChrome_131 = ClientHelloID

type ClientHelloInfo

+ Extensions []uint16

type ClientSessionState

+ func (css *ClientSessionState) SetAgeAdd(ageAdd uint32)

+ func (css *ClientSessionState) SetCreatedAt(createdAt uint64)

+ func (css *ClientSessionState) SetUseBy(useBy uint64)

type Config

+ EncryptedClientHelloConfigList []byte

+ EncryptedClientHelloKeys []EncryptedClientHelloKey

+ EncryptedClientHelloRejectionVerify func(ConnectionState) error

type ConnectionState

+ ECHAccepted bool

type CurveID

+ const FakeCurveP256Kyber768Draft00

+ const FakeCurveX25519Kyber512Draft00

+ const FakeCurveX25519Kyber768Draft00Old

+ const X25519MLKEM768

+ type ECHRejectionError struct

+ RetryConfigList []byte

+ func (e *ECHRejectionError) Error() string

+ type EncryptedClientHelloKey struct

+ Config []byte

+ PrivateKey []byte

+ SendAsRetry bool

type FinishedHash

+ Prfv2 prfFunc

+ type KeySharePrivateKeys struct

+ CurveID CurveID

+ Ecdhe *ecdh.PrivateKey

+ func (ksp *KeySharePrivateKeys) ToPrivate() *keySharePrivateKeys

type QUICConfig

+ EnableSessionEvents bool

type QUICConn

+ func (q *QUICConn) StoreSession(session *SessionState) error

type QUICEvent

+ SessionState *SessionState

type QUICEventKind

+ const QUICResumeSession

+ const QUICStoreSession

type QUICSessionTicketOptions

+ Extra [][]byte

type TLS13OnlyState

+ KeyShareKeys *KeySharePrivateKeys

Jun 27, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

type ClientSessionState

+ func (css *ClientSessionState) EMS() bool

+ func (css *ClientSessionState) SetEMS(ems bool)

type UConn

+ func (uconn *UConn) BuildHandshakeStateWithoutSession() error

Jul 5, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

May 3, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

May 3, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Apr 29, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

May 2, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Apr 10, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

type RenegotiationInfoExtension

+ RenegotiatedConnection []byte

type UConn

+ func (c *UConn) Read(b []byte) (int, error)

Apr 10, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Feb 21, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Feb 21, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Jan 11, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Jan 29, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Jan 8, 2024 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

type GREASEEncryptedClientHelloExtension

+ func (g *GREASEEncryptedClientHelloExtension) Write(b []byte) (int, error)

type UConn

+ func (uconn *UConn) MarshalClientHelloNoECH() error

Dec 16, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

+ const InnerClientHello

+ const OuterClientHello

+ var HelloChrome_120 = ClientHelloID

+ var HelloChrome_120_PQ = ClientHelloID

+ var HelloFirefox_120 = ClientHelloID

+ func AlwaysPadToLen(padToLen int) func(int) (int, bool)

type Config

+ ECHConfigs []ECHConfig

type ConnectionState

+ ECHRetryConfigs []ECHConfig

+ type ECHConfig struct

+ Contents ECHConfigContents

+ Length uint16

+ Version uint16

+ func UnmarshalECHConfigs(raw []byte) ([]ECHConfig, error)

+ type ECHConfigContents struct

+ KeyConfig HPKEKeyConfig

+ MaximumNameLength uint8

+ PublicName []byte

+ func UnmarshalECHConfigContents(contents []byte) (ECHConfigContents, error)

+ func (echcc *ECHConfigContents) ParsePublicKey() error

+ type ECHExtension = EncryptedClientHelloExtension

+ type EncryptedClientHelloExtension interface

+ Configure func([]ECHConfig) error

+ MarshalClientHello func(*UConn) error

+ type GREASEECHExtension = GREASEEncryptedClientHelloExtension

+ type GREASEEncryptedClientHelloExtension struct

+ CandidateCipherSuites []HPKESymmetricCipherSuite

+ CandidateConfigIds []uint8

+ CandidatePayloadLens []uint16

+ EncapsulatedKey []byte

+ func BoringGREASEECH() *GREASEEncryptedClientHelloExtension

+ func (*GREASEEncryptedClientHelloExtension) Configure([]ECHConfig) error

+ func (*GREASEEncryptedClientHelloExtension) MarshalClientHello(*UConn) error

+ func (g *GREASEEncryptedClientHelloExtension) Len() int

+ func (g *GREASEEncryptedClientHelloExtension) Read(b []byte) (int, error)

+ type HPKEKeyConfig struct

+ CipherSuites []HPKESymmetricCipherSuite

+ ConfigId uint8

+ KemId HPKE_KEM_ID

+ PublicKey kem.PublicKey

+ type HPKERawPublicKey = []byte

+ type HPKESymmetricCipherSuite struct

+ AeadId HPKE_AEAD_ID

+ KdfId HPKE_KDF_ID

+ type HPKE_AEAD_ID = uint16

+ type HPKE_KDF_ID = uint16

+ type HPKE_KEM_ID = uint16

+ type UnimplementedECHExtension struct

+ func (*UnimplementedECHExtension) Configure([]ECHConfig) error

+ func (*UnimplementedECHExtension) Len() int

+ func (*UnimplementedECHExtension) MarshalClientHello(*UConn) error

+ func (*UnimplementedECHExtension) Read(_ []byte) (int, error)

Oct 10, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

type Config

+ PreferSkipResumptionOnNilExtension bool

Sep 4, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Aug 28, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Aug 28, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Aug 27, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

+ const NoSession

+ const PskExtAllSet

+ const PskExtInitialized

+ const SessionTicketExtAllSet

+ const SessionTicketExtInitialized

+ var ErrEmptyPsk = errors.New(...)

+ var ErrUnknownClientHelloID = errors.New("tls: unknown ClientHelloID")

+ var HelloChrome_114_Padding_PSK_Shuf = ClientHelloID

+ var HelloChrome_115_PQ = ClientHelloID

+ var HelloChrome_115_PQ_PSK = ClientHelloID

+ var P256Kyber768Draft00 = CurveID(0xfe32)

+ var X25519Kyber512Draft00 = CurveID(0xfe30)

+ var X25519Kyber768Draft00 = CurveID(0x6399)

+ var X25519Kyber768Draft00Old = CurveID(0xfe31)

+ type ClientHelloBuildStatus int

+ const BuildByGoTLS

+ const BuildByUtls

+ const NotBuilt

type Config

+ OmitEmptyPsk bool

+ PQSignatureSchemesEnabled bool

type FakePreSharedKeyExtension

+ Binders [][]byte

+ Identities []PskIdentity

+ OmitEmptyPsk bool

+ func (*FakePreSharedKeyExtension) PatchBuiltHello(*PubClientHelloMsg) error

+ func (e *FakePreSharedKeyExtension) GetPreSharedKeyCommon() PreSharedKeyCommon

+ func (e *FakePreSharedKeyExtension) InitializeByUtls(session *SessionState, earlySecret []byte, binderKey []byte, ...)

+ func (e *FakePreSharedKeyExtension) IsInitialized() bool

+ func (e *FakePreSharedKeyExtension) SetOmitEmptyPsk(val bool)

type Fingerprinter

+ RealPSKResumption bool

+ type ISessionTicketExtension interface

+ GetSession func() *SessionState

+ GetTicket func() []byte

+ InitializeByUtls func(session *SessionState, ticket []byte)

+ type Initializable interface

+ IsInitialized func() bool

+ type KemPrivateKey struct

+ CurveID CurveID

+ SecretKey kem.PrivateKey

+ func (kpk *KemPrivateKey) ToPrivate() *kemPrivateKey

+ type KeySharesParameters struct

+ func NewKeySharesParameters() *KeySharesParameters

+ func (ksp *KeySharesParameters) AddEcdheKeypair(curveID CurveID, ecdheKey *ecdh.PrivateKey, ecdhePubKey *ecdh.PublicKey)

+ func (ksp *KeySharesParameters) AddKemKeypair(curveID CurveID, kemKey kem.PrivateKey, kemPubKey kem.PublicKey)

+ func (ksp *KeySharesParameters) GetEcdheKey(curveID CurveID) (ecdheKey *ecdh.PrivateKey, ok bool)

+ func (ksp *KeySharesParameters) GetEcdhePubkey(curveID CurveID) (params *ecdh.PublicKey, ok bool)

+ func (ksp *KeySharesParameters) GetKemKey(curveID CurveID) (kemKey kem.PrivateKey, ok bool)

+ func (ksp *KeySharesParameters) GetKemPubkey(curveID CurveID) (params kem.PublicKey, ok bool)

+ type LoadSessionTrackerState int

+ const CalledByGoTLS

+ const CalledByULoadSession

+ const NeverCalled

+ const UtlsAboutToCall

+ type PreSharedKeyCommon struct

+ BinderKey []byte

+ Binders [][]byte

+ EarlySecret []byte

+ Identities []PskIdentity

+ Session *SessionState

+ type PreSharedKeyExtension interface

+ GetPreSharedKeyCommon func() PreSharedKeyCommon

+ InitializeByUtls func(session *SessionState, earlySecret []byte, binderKey []byte, ...)

+ PatchBuiltHello func(hello *PubClientHelloMsg) error

+ SetOmitEmptyPsk func(val bool)

type SessionTicketExtension

+ Initialized bool

+ Ticket []byte

+ func (e *SessionTicketExtension) GetSession() *SessionState

+ func (e *SessionTicketExtension) GetTicket() []byte

+ func (e *SessionTicketExtension) InitializeByUtls(session *SessionState, ticket []byte)

+ func (e *SessionTicketExtension) IsInitialized() bool

type TLS13OnlyState

+ KEMKey *KemPrivateKey

+ KeySharesParams *KeySharesParameters

type TLSExtension

+ func ShuffleChromeTLSExtensions(exts []TLSExtension) []TLSExtension

type TLSExtensionsJSONUnmarshaler

+ AllowUnknownExt bool

+ UseRealPSK bool

type UConn

+ func (uconn *UConn) DidTls12Resume() bool

+ func (uconn *UConn) SetPskExtension(pskExt PreSharedKeyExtension) error

+ func (uconn *UConn) SetSessionTicketExtension(sessionTicketExt ISessionTicketExtension) error

+ type UnimplementedPreSharedKeyExtension struct

+ func (*UnimplementedPreSharedKeyExtension) GetPreSharedKeyCommon() PreSharedKeyCommon

+ func (*UnimplementedPreSharedKeyExtension) InitializeByUtls(session *SessionState, earlySecret []byte, binderKey []byte, ...)

+ func (*UnimplementedPreSharedKeyExtension) IsInitialized() bool

+ func (*UnimplementedPreSharedKeyExtension) Len() int

+ func (*UnimplementedPreSharedKeyExtension) PatchBuiltHello(hello *PubClientHelloMsg) error

+ func (*UnimplementedPreSharedKeyExtension) Read([]byte) (int, error)

+ func (*UnimplementedPreSharedKeyExtension) SetOmitEmptyPsk(val bool)

+ type UtlsPreSharedKeyExtension struct

+ OmitEmptyPsk bool

+ func (e *UtlsPreSharedKeyExtension) GetPreSharedKeyCommon() PreSharedKeyCommon

+ func (e *UtlsPreSharedKeyExtension) InitializeByUtls(session *SessionState, earlySecret []byte, binderKey []byte, ...)

+ func (e *UtlsPreSharedKeyExtension) IsInitialized() bool

+ func (e *UtlsPreSharedKeyExtension) Len() int

+ func (e *UtlsPreSharedKeyExtension) PatchBuiltHello(hello *PubClientHelloMsg) error

+ func (e *UtlsPreSharedKeyExtension) Read(b []byte) (int, error)

+ func (e *UtlsPreSharedKeyExtension) SetOmitEmptyPsk(val bool)

+ func (e *UtlsPreSharedKeyExtension) UnmarshalJSON(_ []byte) error

+ func (e *UtlsPreSharedKeyExtension) Write(b []byte) (int, error)

Aug 17, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Aug 16, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Aug 15, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Aug 14, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Aug 13, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Aug 11, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Aug 11, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Aug 9, 2023

retracted

GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

+ type GREASETransportParameter struct

+ IdOverride uint64

+ Length uint16

+ ValueOverride []byte

+ func (GREASETransportParameter) GetGREASEID() uint64

+ func (GREASETransportParameter) IsGREASEID(id uint64) bool

+ func (g *GREASETransportParameter) ID() uint64

+ func (g *GREASETransportParameter) Value() []byte

+ type PaddingTransportParameter []byte

+ func (PaddingTransportParameter) ID() uint64

+ func (p PaddingTransportParameter) Value() []byte

+ type QUICSessionTicketOptions struct

+ EarlyData bool

Aug 4, 2023

retracted

GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

+ const GREASE_MAX_MULTIPLIER

+ const QUICEncryptionLevelApplication

+ const QUICEncryptionLevelEarly

+ const QUICEncryptionLevelHandshake

+ const QUICEncryptionLevelInitial

+ const VERSION_1

+ const VERSION_2

+ const VERSION_GREASE

+ const VERSION_NEGOTIATION

+ func VersionName(version uint16) string

+ type ActiveConnectionIDLimit uint64

+ func (ActiveConnectionIDLimit) ID() uint64

+ func (a ActiveConnectionIDLimit) Value() []byte

+ type AlertError uint8

+ func (e AlertError) Error() string

+ type CertificateVerificationError struct

+ Err error

+ UnverifiedCertificates []*x509.Certificate

+ func (e *CertificateVerificationError) Error() string

+ func (e *CertificateVerificationError) Unwrap() error

type ClientSessionState

+ func NewResumptionState(ticket []byte, state *SessionState) (*ClientSessionState, error)

+ func (cs *ClientSessionState) ResumptionState() (ticket []byte, state *SessionState, err error)

type Config

+ UnwrapSession func(identity []byte, cs ConnectionState) (*SessionState, error)

+ WrapSession func(ConnectionState, *SessionState) ([]byte, error)

+ func (c *Config) DecryptTicket(identity []byte, cs ConnectionState) (*SessionState, error)

+ func (c *Config) EncryptTicket(cs ConnectionState, ss *SessionState) ([]byte, error)

type CurveID

+ const CurveSECP256R1

+ const CurveSECP384R1

+ const CurveSECP521R1

+ const CurveX25519

+ const FakeCurveFFDHE2048

+ const FakeCurveFFDHE3072

+ const FakeCurveFFDHE4096

+ const FakeCurveFFDHE6144

+ const FakeCurveFFDHE8192

+ type DisableActiveMigration struct

+ func (*DisableActiveMigration) ID() uint64

+ func (*DisableActiveMigration) Value() []byte

+ type ExtendedMasterSecretExtension struct

+ func (e *ExtendedMasterSecretExtension) Len() int

+ func (e *ExtendedMasterSecretExtension) Read(b []byte) (int, error)

+ func (e *ExtendedMasterSecretExtension) UnmarshalJSON(_ []byte) error

+ func (e *ExtendedMasterSecretExtension) Write(_ []byte) (int, error)

+ type FakeQUICTransportParameter struct

+ Id uint64

+ Val []byte

+ func (f *FakeQUICTransportParameter) ID() uint64

+ func (f *FakeQUICTransportParameter) Value() []byte

+ type GREASE struct

+ IdOverride uint64

+ Length uint16

+ ValueOverride []byte

+ func (GREASE) GetGREASEID() uint64

+ func (GREASE) IsGREASEID(id uint64) bool

+ func (g *GREASE) ID() uint64

+ func (g *GREASE) Value() []byte

+ type GREASEQUICBit struct

+ func (*GREASEQUICBit) ID() uint64

+ func (*GREASEQUICBit) Value() []byte

+ type InitialMaxData uint64

+ func (InitialMaxData) ID() uint64

+ func (i InitialMaxData) Value() []byte

+ type InitialMaxStreamDataBidiLocal uint64

+ func (InitialMaxStreamDataBidiLocal) ID() uint64

+ func (i InitialMaxStreamDataBidiLocal) Value() []byte

+ type InitialMaxStreamDataBidiRemote uint64

+ func (InitialMaxStreamDataBidiRemote) ID() uint64

+ func (i InitialMaxStreamDataBidiRemote) Value() []byte

+ type InitialMaxStreamDataUni uint64

+ func (InitialMaxStreamDataUni) ID() uint64

+ func (i InitialMaxStreamDataUni) Value() []byte

+ type InitialMaxStreamsBidi uint64

+ func (InitialMaxStreamsBidi) ID() uint64

+ func (i InitialMaxStreamsBidi) Value() []byte

+ type InitialMaxStreamsUni uint64

+ func (InitialMaxStreamsUni) ID() uint64

+ func (i InitialMaxStreamsUni) Value() []byte

+ type InitialSourceConnectionID []byte

+ func (InitialSourceConnectionID) ID() uint64

+ func (i InitialSourceConnectionID) Value() []byte

+ type MaxAckDelay uint64

+ func (MaxAckDelay) ID() uint64

+ func (m MaxAckDelay) Value() []byte

+ type MaxDatagramFrameSize uint64

+ func (MaxDatagramFrameSize) ID() uint64

+ func (m MaxDatagramFrameSize) Value() []byte

+ type MaxIdleTimeout uint64

+ func (MaxIdleTimeout) ID() uint64

+ func (m MaxIdleTimeout) Value() []byte

+ type MaxUDPPayloadSize uint64

+ func (MaxUDPPayloadSize) ID() uint64

+ func (m MaxUDPPayloadSize) Value() []byte

+ type Padding []byte

+ func (Padding) ID() uint64

+ func (p Padding) Value() []byte

type PubClientHelloMsg

+ QuicTransportParameters []byte

type PubServerHelloMsg

+ ExtendedMasterSecret bool

+ type QUICConfig struct

+ TLSConfig *Config

+ type QUICConn struct

+ func QUICClient(config *QUICConfig) *QUICConn

+ func QUICServer(config *QUICConfig) *QUICConn

+ func (q *QUICConn) Close() error

+ func (q *QUICConn) ConnectionState() ConnectionState

+ func (q *QUICConn) HandleData(level QUICEncryptionLevel, data []byte) error

+ func (q *QUICConn) NextEvent() QUICEvent

+ func (q *QUICConn) SendSessionTicket(earlyData bool) error

+ func (q *QUICConn) SetTransportParameters(params []byte)

+ func (q *QUICConn) Start(ctx context.Context) error

+ type QUICEncryptionLevel int

+ func (l QUICEncryptionLevel) String() string

+ type QUICEvent struct

+ Data []byte

+ Kind QUICEventKind

+ Level QUICEncryptionLevel

+ Suite uint16

+ type QUICEventKind int

+ const QUICHandshakeDone

+ const QUICNoEvent

+ const QUICRejectedEarlyData

+ const QUICSetReadSecret

+ const QUICSetWriteSecret

+ const QUICTransportParameters

+ const QUICTransportParametersRequired

+ const QUICWriteData

+ type QUICTransportParametersExtension struct

+ TransportParameters TransportParameters

+ func (e *QUICTransportParametersExtension) Len() int

+ func (e *QUICTransportParametersExtension) Read(b []byte) (int, error)

+ type SessionState struct

+ EarlyData bool

+ Extra [][]byte

+ func ParseSessionState(data []byte) (*SessionState, error)

+ func (s *SessionState) Bytes() ([]byte, error)

type TLS13OnlyState

+ EcdheKey *ecdh.PrivateKey

type TicketKey

+ Created time.Time

+ type TransportParameter interface

+ ID func() uint64

+ Value func() []byte

+ type TransportParameters []TransportParameter

+ func (tps TransportParameters) Marshal() []byte

type UConn

+ func (uc *UConn) QUICGetTransportParameters() ([]byte, error)

+ func (uc *UConn) QUICSetReadSecret(level QUICEncryptionLevel, suite uint16, secret []byte)

+ func (uc *UConn) QUICSetWriteSecret(level QUICEncryptionLevel, suite uint16, secret []byte)

+ type UQUICConn struct

+ func UQUICClient(config *QUICConfig, clientHelloID ClientHelloID) *UQUICConn

+ func (q *UQUICConn) ApplyPreset(p *ClientHelloSpec) error

+ func (q *UQUICConn) Close() error

+ func (q *UQUICConn) ConnectionState() ConnectionState

+ func (q *UQUICConn) HandleData(level QUICEncryptionLevel, data []byte) error

+ func (q *UQUICConn) NextEvent() QUICEvent

+ func (q *UQUICConn) SendSessionTicket(earlyData bool) error

+ func (q *UQUICConn) SetTransportParameters(params []byte)

+ func (q *UQUICConn) Start(ctx context.Context) error

+ type VersionInformation struct

+ AvailableVersions []uint32

+ ChoosenVersion uint32

+ LegacyID bool

+ func (*VersionInformation) GetGREASEVersion() uint32

+ func (v *VersionInformation) ID() uint64

+ func (v *VersionInformation) Value() []byte

Jul 6, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Apr 7, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

+ var ErrUnknownExtension = errors.New("extension name is unknown to the dictionary")

+ var HelloChrome_100_PSK = ClientHelloID

+ var HelloChrome_112_PSK_Shuf = ClientHelloID

type ALPNExtension

+ func (e *ALPNExtension) UnmarshalJSON(b []byte) error

type ApplicationSettingsExtension

+ func (e *ApplicationSettingsExtension) UnmarshalJSON(b []byte) error

+ type CipherSuitesJSONUnmarshaler struct

+ func (c *CipherSuitesJSONUnmarshaler) CipherSuites() []uint16

+ func (c *CipherSuitesJSONUnmarshaler) UnmarshalJSON(jsonStr []byte) error

type ClientHelloSpec

+ func (chs *ClientHelloSpec) FromRaw(raw []byte, allowBluntMimicry ...bool) error

+ func (chs *ClientHelloSpec) UnmarshalJSON(jsonB []byte) error

+ type ClientHelloSpecJSONUnmarshaler struct

+ CipherSuites *CipherSuitesJSONUnmarshaler

+ CompressionMethods *CompressionMethodsJSONUnmarshaler

+ Extensions *TLSExtensionsJSONUnmarshaler

+ TLSVersMax uint16

+ TLSVersMin uint16

+ func (chsju *ClientHelloSpecJSONUnmarshaler) ClientHelloSpec() ClientHelloSpec

+ type CompressionMethodsJSONUnmarshaler struct

+ func (c *CompressionMethodsJSONUnmarshaler) CompressionMethods() []uint8

+ func (c *CompressionMethodsJSONUnmarshaler) UnmarshalJSON(jsonStr []byte) error

type CookieExtension

+ func (e *CookieExtension) UnmarshalJSON(data []byte) error

type FakeChannelIDExtension

+ func (e *FakeChannelIDExtension) UnmarshalJSON(_ []byte) error

type FakeDelegatedCredentialsExtension

+ func (e *FakeDelegatedCredentialsExtension) UnmarshalJSON(data []byte) error

type FakePreSharedKeyExtension

+ func (e *FakePreSharedKeyExtension) UnmarshalJSON(data []byte) error

type FakeRecordSizeLimitExtension

+ func (e *FakeRecordSizeLimitExtension) UnmarshalJSON(data []byte) error

type FakeTokenBindingExtension

+ func (e *FakeTokenBindingExtension) UnmarshalJSON(data []byte) error

type Fingerprinter

+ func (f *Fingerprinter) RawClientHello(raw []byte) (clientHelloSpec *ClientHelloSpec, err error)

+ func (f *Fingerprinter) UnmarshalJSONClientHello(json []byte) (clientHelloSpec *ClientHelloSpec, err error)

type GenericExtension

+ func (e *GenericExtension) UnmarshalJSON(b []byte) error

type KeyShareExtension

+ func (e *KeyShareExtension) UnmarshalJSON(b []byte) error

+ type KeySharesEcdheParameters map[CurveID]ecdheParameters

+ func (keymap KeySharesEcdheParameters) AddEcdheParams(curveID CurveID, params ecdheParameters)

+ func (keymap KeySharesEcdheParameters) GetEcdheParams(curveID CurveID) (params ecdheParameters, ok bool)

+ func (keymap KeySharesEcdheParameters) GetPublicEcdheParams(curveID CurveID) (params EcdheParameters, ok bool)

type NPNExtension

+ func (e *NPNExtension) UnmarshalJSON(_ []byte) error

type PSKKeyExchangeModesExtension

+ func (e *PSKKeyExchangeModesExtension) UnmarshalJSON(b []byte) error

type RenegotiationInfoExtension

+ func (e *RenegotiationInfoExtension) UnmarshalJSON(_ []byte) error

type SCTExtension

+ func (e *SCTExtension) UnmarshalJSON(_ []byte) error

type SNIExtension

+ func (e *SNIExtension) UnmarshalJSON(_ []byte) error

type SessionTicketExtension

+ func (e *SessionTicketExtension) UnmarshalJSON(_ []byte) error

type SignatureAlgorithmsCertExtension

+ func (e *SignatureAlgorithmsCertExtension) UnmarshalJSON(data []byte) error

type SignatureAlgorithmsExtension

+ func (e *SignatureAlgorithmsExtension) UnmarshalJSON(data []byte) error

type StatusRequestExtension

+ func (e *StatusRequestExtension) UnmarshalJSON(_ []byte) error

type StatusRequestV2Extension

+ func (e *StatusRequestV2Extension) UnmarshalJSON(_ []byte) error

type SupportedCurvesExtension

+ func (e *SupportedCurvesExtension) UnmarshalJSON(data []byte) error

type SupportedPointsExtension

+ func (e *SupportedPointsExtension) UnmarshalJSON(data []byte) error

type SupportedVersionsExtension

+ func (e *SupportedVersionsExtension) UnmarshalJSON(b []byte) error

type TLS13OnlyState

+ KeySharesEcdheParams KeySharesEcdheParameters

type TLSExtension

+ func ExtensionFromID(id uint16) TLSExtension

+ type TLSExtensionJSON interface

+ UnmarshalJSON func([]byte) error

+ type TLSExtensionsJSONUnmarshaler struct

+ func (e *TLSExtensionsJSONUnmarshaler) Extensions() []TLSExtension

+ func (e *TLSExtensionsJSONUnmarshaler) UnmarshalJSON(jsonStr []byte) error

type UtlsCompressCertExtension

+ func (e *UtlsCompressCertExtension) UnmarshalJSON(b []byte) error

type UtlsExtendedMasterSecretExtension

+ func (e *UtlsExtendedMasterSecretExtension) UnmarshalJSON(_ []byte) error

type UtlsGREASEExtension

+ func (e *UtlsGREASEExtension) UnmarshalJSON(b []byte) error

type UtlsPaddingExtension

+ func (e *UtlsPaddingExtension) UnmarshalJSON(b []byte) error

Mar 12, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

type Config

+ InsecureSkipTimeVerify bool

Mar 9, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

type ALPNExtension

+ func (e *ALPNExtension) Write(b []byte) (int, error)

type ApplicationSettingsExtension

+ func (e *ApplicationSettingsExtension) Write(b []byte) (int, error)

type ClientHelloSpec

+ func (chs *ClientHelloSpec) AlwaysAddPadding()

+ func (chs *ClientHelloSpec) ImportTLSClientHello(data map[string][]byte) error

+ func (chs *ClientHelloSpec) ImportTLSClientHelloFromJSON(jsonB []byte) error

+ func (chs *ClientHelloSpec) ReadCipherSuites(b []byte) error

+ func (chs *ClientHelloSpec) ReadCompressionMethods(compressionMethods []byte) error

+ func (chs *ClientHelloSpec) ReadTLSExtensions(b []byte, allowBluntMimicry bool) error

type FakeChannelIDExtension

+ func (e *FakeChannelIDExtension) Write(_ []byte) (int, error)

type FakeDelegatedCredentialsExtension

+ func (e *FakeDelegatedCredentialsExtension) Write(b []byte) (int, error)

+ type FakePreSharedKeyExtension struct

+ PskBinders [][]byte

+ PskIdentities []PskIdentity

+ func (e *FakePreSharedKeyExtension) Len() int

+ func (e *FakePreSharedKeyExtension) Read(b []byte) (int, error)

+ func (e *FakePreSharedKeyExtension) Write(b []byte) (n int, err error)

type FakeRecordSizeLimitExtension

+ func (e *FakeRecordSizeLimitExtension) Write(b []byte) (int, error)

type FakeTokenBindingExtension

+ func (e *FakeTokenBindingExtension) Write(b []byte) (int, error)

type KeyShareExtension

+ func (e *KeyShareExtension) Write(b []byte) (int, error)

type NPNExtension

+ func (e *NPNExtension) Write(_ []byte) (int, error)

type PSKKeyExchangeModesExtension

+ func (e *PSKKeyExchangeModesExtension) Write(b []byte) (int, error)

+ type PskIdentities []PskIdentity

+ func (PSS PskIdentities) ToPrivate() []pskIdentity

+ type PskIdentity struct

+ Label []byte

+ ObfuscatedTicketAge uint32

type RenegotiationInfoExtension

+ func (e *RenegotiationInfoExtension) Write(_ []byte) (int, error)

type SCTExtension

+ func (e *SCTExtension) Write(_ []byte) (int, error)

type SNIExtension

+ func (e *SNIExtension) Write(b []byte) (int, error)

type SessionTicketExtension

+ func (e *SessionTicketExtension) Write(_ []byte) (int, error)

type SignatureAlgorithmsCertExtension

+ func (e *SignatureAlgorithmsCertExtension) Write(b []byte) (int, error)

type SignatureAlgorithmsExtension

+ func (e *SignatureAlgorithmsExtension) Write(b []byte) (int, error)

type StatusRequestExtension

+ func (e *StatusRequestExtension) Write(b []byte) (int, error)

type StatusRequestV2Extension

+ func (e *StatusRequestV2Extension) Write(b []byte) (int, error)

type SupportedCurvesExtension

+ func (e *SupportedCurvesExtension) Write(b []byte) (int, error)

type SupportedPointsExtension

+ func (e *SupportedPointsExtension) Write(b []byte) (int, error)

type SupportedVersionsExtension

+ func (e *SupportedVersionsExtension) Write(b []byte) (int, error)

+ type TLSExtensionWriter interface

+ Write func(b []byte) (n int, err error)

+ func ExtensionIDToExtension(id uint16) TLSExtensionWriter

type UtlsCompressCertExtension

+ func (e *UtlsCompressCertExtension) Write(b []byte) (int, error)

type UtlsExtendedMasterSecretExtension

+ func (e *UtlsExtendedMasterSecretExtension) Write(_ []byte) (int, error)

type UtlsGREASEExtension

+ func (e *UtlsGREASEExtension) Write(b []byte) (int, error)

type UtlsPaddingExtension

+ func (e *UtlsPaddingExtension) Write(_ []byte) (int, error)

Feb 7, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

+ var DefaultWeights = Weights

type ClientHelloID

+ Weights *Weights

+ type Weights struct

+ CipherSuites_Remove_RandomCiphers float64

+ CurveIDs_Append_CurveP521 float64

+ CurveIDs_Append_X25519 float64

+ Extensions_Append_ALPN float64

+ Extensions_Append_ALPS float64

+ Extensions_Append_EMS float64

+ Extensions_Append_Padding float64

+ Extensions_Append_Reneg float64

+ Extensions_Append_SCT float64

+ Extensions_Append_Status float64

+ FirstKeyShare_Set_CurveP256 float64

+ SigAndHashAlgos_Append_ECDSAWithP521AndSHA512 float64

+ SigAndHashAlgos_Append_ECDSAWithSHA1 float64

+ SigAndHashAlgos_Append_PSSWithSHA256 float64

+ SigAndHashAlgos_Append_PSSWithSHA384_PSSWithSHA512 float64

+ TLSVersMax_Set_VersionTLS13 float64

Feb 5, 2023 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

type Config

+ InsecureServerNameToVerify string

Nov 17, 2022 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

+ var HelloChrome_106_Shuffle = ClientHelloID

+ type Boring struct

+ Enabled bool

+ func (*Boring) NewGCMTLS(_ cipher.Block) (cipher.AEAD, error)

+ func (*Boring) Unreachable()

type ClientHelloSpec

+ func UTLSIdToSpec(id ClientHelloID) (ClientHelloSpec, error)

type Config

+ ApplicationSettings map[string][]byte

type ConnectionState

+ PeerApplicationSettings []byte

type PubClientHelloMsg

+ func (chm *PubClientHelloMsg) Marshal() []byte

Oct 17, 2022 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Oct 17, 2022 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

+ const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

+ const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

+ func CipherSuiteName(id uint16) string

type Certificate

+ SupportedSignatureAlgorithms []SignatureScheme

type CertificateRequestInfo

+ Version uint16

+ func (c *CertificateRequestInfo) Context() context.Context

+ func (cri *CertificateRequestInfo) SupportsCertificate(c *Certificate) error

type CipherSuite

+ ID uint16

+ Insecure bool

+ Name string

+ SupportedVersions []uint16

+ func CipherSuites() []*CipherSuite

+ func InsecureCipherSuites() []*CipherSuite

type ClientAuthType

+ func (i ClientAuthType) String() string

type ClientHelloInfo

+ func (c *ClientHelloInfo) Context() context.Context

+ func (chi *ClientHelloInfo) SupportsCertificate(c *Certificate) error

type Config

+ VerifyConnection func(ConnectionState) error

type Conn

+ func (c *Conn) HandshakeContext(ctx context.Context) error

+ func (c *Conn) NetConn() net.Conn

type CurveID

+ func (i CurveID) String() string

+ type Dialer struct

+ Config *Config

+ NetDialer *net.Dialer

+ func (d *Dialer) Dial(network, addr string) (net.Conn, error)

+ func (d *Dialer) DialContext(ctx context.Context, network, addr string) (net.Conn, error)

+ type PubCipherSuite struct

+ Aead func(key, fixedNonce []byte) aead

+ Cipher func(key, iv []byte, isRead bool) interface{}

+ Flags int

+ Id uint16

+ IvLen int

+ Ka func(version uint16) keyAgreement

+ KeyLen int

+ Mac func(macKey []byte) hash.Hash

+ MacLen int

+ type PubCipherSuiteTLS13 struct

+ Aead func(key, fixedNonce []byte) aead

+ Hash crypto.Hash

+ Id uint16

+ KeyLen int

+ type PubClientHandshakeState struct

+ C *Conn

+ Hello *PubClientHelloMsg

+ MasterSecret []byte

+ ServerHello *PubServerHelloMsg

+ Session *ClientSessionState

+ State12 TLS12OnlyState

+ State13 TLS13OnlyState

+ type PubClientHelloMsg struct

+ AlpnProtocols []string

+ CipherSuites []uint16

+ CompressionMethods []uint8

+ Cookie []byte

+ EarlyData bool

+ Ems bool

+ KeyShares []KeyShare

+ NextProtoNeg bool

+ OcspStapling bool

+ PskBinders [][]byte

+ PskIdentities []pskIdentity

+ PskModes []uint8

+ Random []byte

+ Raw []byte

+ Scts bool

+ SecureRenegotiation []byte

+ SecureRenegotiationSupported bool

+ ServerName string

+ SessionId []byte

+ SessionTicket []uint8

+ SupportedCurves []CurveID

+ SupportedPoints []uint8

+ SupportedSignatureAlgorithms []SignatureScheme

+ SupportedSignatureAlgorithmsCert []SignatureScheme

+ SupportedVersions []uint16

+ TicketSupported bool

+ Vers uint16

+ type PubServerHelloMsg struct

+ AlpnProtocol string

+ CipherSuite uint16

+ CompressionMethod uint8

+ Cookie []byte

+ Ems bool

+ NextProtoNeg bool

+ NextProtos []string

+ OcspStapling bool

+ Random []byte

+ Raw []byte

+ Scts [][]byte

+ SecureRenegotiation []byte

+ SecureRenegotiationSupported bool

+ SelectedGroup CurveID

+ SelectedIdentity uint16

+ SelectedIdentityPresent bool

+ ServerShare keyShare

+ SessionId []byte

+ SupportedVersion uint16

+ TicketSupported bool

+ Vers uint16

type SignatureScheme

+ const Ed25519

+ func (i SignatureScheme) String() string

type UConn

+ func (c *UConn) HandshakeContext(ctx context.Context) error

Oct 12, 2022 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

+ const FAKE_TLS_DHE_DSS_WITH_AES_128_CBC_SHA

+ const FAKE_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256

+ const FAKE_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

+ const FAKE_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA

+ var Hello360_11_0 = ClientHelloID

+ var Hello360_7_5 = ClientHelloID

+ var Hello360_Auto = Hello360_7_5

+ var HelloEdge_106 = ClientHelloID

+ var HelloEdge_85 = ClientHelloID

+ var HelloEdge_Auto = HelloEdge_85

+ var HelloFirefox_105 = ClientHelloID

+ var HelloQQ_11_1 = ClientHelloID

+ var HelloQQ_Auto = HelloQQ_11_1

+ var HelloSafari_16_0 = ClientHelloID

+ var HelloSafari_Auto = HelloSafari_16_0

type FakeChannelIDExtension

+ OldExtensionID bool

+ type FakeDelegatedCredentialsExtension struct

+ SupportedSignatureAlgorithms []SignatureScheme

+ func (e *FakeDelegatedCredentialsExtension) Len() int

+ func (e *FakeDelegatedCredentialsExtension) Read(b []byte) (int, error)

+ type FakeTokenBindingExtension struct

+ KeyParameters []uint8

+ MajorVersion uint8

+ MinorVersion uint8

+ func (e *FakeTokenBindingExtension) Len() int

+ func (e *FakeTokenBindingExtension) Read(b []byte) (int, error)

type SignatureScheme

+ var FakeSHA1WithDSA SignatureScheme = 0x0202

+ var FakeSHA256WithDSA SignatureScheme = 0x0402

Sep 7, 2022 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

+ var HelloAndroid_11_OkHttp = ClientHelloID

+ var HelloChrome_100 = ClientHelloID

+ var HelloChrome_102 = ClientHelloID

+ var HelloChrome_87 = ClientHelloID

+ var HelloChrome_96 = ClientHelloID

+ var HelloFirefox_102 = ClientHelloID

+ var HelloFirefox_99 = ClientHelloID

+ var HelloIOS_13 = ClientHelloID

+ var HelloIOS_14 = ClientHelloID

+ type ApplicationSettingsExtension struct

+ SupportedProtocols []string

+ func (e *ApplicationSettingsExtension) Len() int

+ func (e *ApplicationSettingsExtension) Read(b []byte) (int, error)

+ type DelegatedCredentialsExtension struct

+ AlgorithmsSignature []SignatureScheme

+ func (e *DelegatedCredentialsExtension) Len() int

+ func (e *DelegatedCredentialsExtension) Read(b []byte) (int, error)

+ type SignatureAlgorithmsCertExtension struct

+ SupportedSignatureAlgorithms []SignatureScheme

+ func (e *SignatureAlgorithmsCertExtension) Len() int

+ func (e *SignatureAlgorithmsCertExtension) Read(b []byte) (int, error)

+ type StatusRequestV2Extension struct

+ func (e *StatusRequestV2Extension) Len() int

+ func (e *StatusRequestV2Extension) Read(b []byte) (int, error)

Jul 20, 2022 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

type CertCompressionAlgo

+ const CertCompressionZstd

+ type UtlsCompressCertExtension struct

+ Algorithms []CertCompressionAlgo

+ func (e *UtlsCompressCertExtension) Len() int

+ func (e *UtlsCompressCertExtension) Read(b []byte) (int, error)

Apr 28, 2022 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Jul 13, 2021 GO-2025-3638

  GO-2025-3638: ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Changes in this version

+ const DISABLED_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

+ const DISABLED_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

+ const DISABLED_TLS_RSA_WITH_AES_256_CBC_SHA256

+ const FAKE_OLD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256

+ const FAKE_TLS_DHE_RSA_WITH_AES_128_CBC_SHA

+ const FAKE_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

+ const FAKE_TLS_DHE_RSA_WITH_AES_256_CBC_SHA

+ const FAKE_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

+ const FAKE_TLS_EMPTY_RENEGOTIATION_INFO_SCSV

+ const FAKE_TLS_RSA_WITH_RC4_128_MD5

+ const GREASE_PLACEHOLDER

+ const OLD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

+ const OLD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

+ const PRNGSeedLength

+ const PskModeDHE

+ const PskModePlain

+ const TLS_AES_128_GCM_SHA256

+ const TLS_AES_256_GCM_SHA384

+ const TLS_CHACHA20_POLY1305_SHA256

+ const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

+ const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

+ const TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

+ const TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

+ const TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

+ const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305

+ const TLS_ECDHE_ECDSA_WITH_RC4_128_SHA

+ const TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

+ const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

+ const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

+ const TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

+ const TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

+ const TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

+ const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305

+ const TLS_ECDHE_RSA_WITH_RC4_128_SHA

+ const TLS_FALLBACK_SCSV

+ const TLS_RSA_WITH_3DES_EDE_CBC_SHA

+ const TLS_RSA_WITH_AES_128_CBC_SHA

+ const TLS_RSA_WITH_AES_128_CBC_SHA256

+ const TLS_RSA_WITH_AES_128_GCM_SHA256

+ const TLS_RSA_WITH_AES_256_CBC_SHA

+ const TLS_RSA_WITH_AES_256_GCM_SHA384

+ const TLS_RSA_WITH_RC4_128_SHA

+ const VersionSSL30

+ const VersionTLS10

+ const VersionTLS11

+ const VersionTLS12

+ const VersionTLS13

+ var FakeFFDHE2048 = uint16(0x0100)

+ var FakeFFDHE3072 = uint16(0x0101)

+ var HelloChrome_58 = ClientHelloID

+ var HelloChrome_62 = ClientHelloID

+ var HelloChrome_70 = ClientHelloID

+ var HelloChrome_72 = ClientHelloID

+ var HelloChrome_83 = ClientHelloID

+ var HelloChrome_Auto = HelloChrome_83

+ var HelloCustom = ClientHelloID

+ var HelloFirefox_55 = ClientHelloID

+ var HelloFirefox_56 = ClientHelloID

+ var HelloFirefox_63 = ClientHelloID

+ var HelloFirefox_65 = ClientHelloID

+ var HelloFirefox_Auto = HelloFirefox_65

+ var HelloGolang = ClientHelloID

+ var HelloIOS_11_1 = ClientHelloID

+ var HelloIOS_12_1 = ClientHelloID

+ var HelloIOS_Auto = HelloIOS_12_1

+ var HelloRandomized = ClientHelloID

+ var HelloRandomizedALPN = ClientHelloID

+ var HelloRandomizedNoALPN = ClientHelloID

+ func BoringPaddingStyle(unpaddedLen int) (int, bool)

+ func DecryptTicketWith(encrypted []byte, tks TicketKeys) (plaintext []byte, usedOldKey bool)

+ func EnableWeakCiphers()

+ func GetBoringGREASEValue(greaseSeed [ssl_grease_last_index]uint16, index int) uint16

+ func Listen(network, laddr string, config *Config) (net.Listener, error)

+ func NewListener(inner net.Listener, config *Config) net.Listener

+ type ALPNExtension struct

+ AlpnProtocols []string

+ func (e *ALPNExtension) Len() int

+ func (e *ALPNExtension) Read(b []byte) (int, error)

+ type CertCompressionAlgo uint16

+ const CertCompressionBrotli

+ const CertCompressionZlib

+ type Certificate struct

+ Certificate [][]byte

+ Leaf *x509.Certificate

+ OCSPStaple []byte

+ PrivateKey crypto.PrivateKey

+ SignedCertificateTimestamps [][]byte

+ func LoadX509KeyPair(certFile, keyFile string) (Certificate, error)

+ func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (Certificate, error)

+ type CertificateRequestInfo struct

+ AcceptableCAs [][]byte

+ SignatureSchemes []SignatureScheme

+ type CertificateRequestMsgTLS13 struct

+ CertificateAuthorities [][]byte

+ OcspStapling bool

+ Raw []byte

+ Scts bool

+ SupportedSignatureAlgorithms []SignatureScheme

+ SupportedSignatureAlgorithmsCert []SignatureScheme

+ type CipherSuite struct

+ Aead func(key, fixedNonce []byte) aead

+ Cipher func(key, iv []byte, isRead bool) interface{}

+ Flags int

+ Id uint16

+ IvLen int

+ Ka func(version uint16) keyAgreement

+ KeyLen int

+ Mac func(version uint16, macKey []byte) macFunction

+ MacLen int

+ type CipherSuiteTLS13 struct

+ Aead func(key, fixedNonce []byte) aead

+ Hash crypto.Hash

+ Id uint16

+ KeyLen int

+ type ClientAuthType int

+ const NoClientCert

+ const RequestClientCert

+ const RequireAndVerifyClientCert

+ const RequireAnyClientCert

+ const VerifyClientCertIfGiven

+ type ClientHandshakeState struct

+ C *Conn

+ Hello *ClientHelloMsg

+ MasterSecret []byte

+ ServerHello *ServerHelloMsg

+ Session *ClientSessionState

+ State12 TLS12OnlyState

+ State13 TLS13OnlyState

+ type ClientHelloID struct

+ Client string

+ Seed *PRNGSeed

+ Version string

+ func (p *ClientHelloID) IsSet() bool

+ func (p *ClientHelloID) Str() string

+ type ClientHelloInfo struct

+ CipherSuites []uint16

+ Conn net.Conn

+ ServerName string

+ SignatureSchemes []SignatureScheme

+ SupportedCurves []CurveID

+ SupportedPoints []uint8

+ SupportedProtos []string

+ SupportedVersions []uint16

+ type ClientHelloMsg struct

+ AlpnProtocols []string

+ CipherSuites []uint16

+ CompressionMethods []uint8

+ Cookie []byte

+ EarlyData bool

+ Ems bool

+ KeyShares []KeyShare

+ NextProtoNeg bool

+ OcspStapling bool

+ PskBinders [][]byte

+ PskIdentities []pskIdentity

+ PskModes []uint8

+ Random []byte

+ Raw []byte

+ Scts bool

+ SecureRenegotiation []byte

+ SecureRenegotiationSupported bool

+ ServerName string

+ SessionId []byte

+ SessionTicket []uint8

+ SupportedCurves []CurveID

+ SupportedPoints []uint8

+ SupportedSignatureAlgorithms []SignatureScheme

+ SupportedSignatureAlgorithmsCert []SignatureScheme

+ SupportedVersions []uint16

+ TicketSupported bool

+ Vers uint16

+ func UnmarshalClientHello(data []byte) *ClientHelloMsg

+ type ClientHelloSpec struct

+ CipherSuites []uint16

+ CompressionMethods []uint8

+ Extensions []TLSExtension

+ GetSessionID func(ticket []byte) [32]byte

+ TLSVersMax uint16

+ TLSVersMin uint16

+ type ClientSessionCache interface

+ Get func(sessionKey string) (session *ClientSessionState, ok bool)

+ Put func(sessionKey string, cs *ClientSessionState)

+ func NewLRUClientSessionCache(capacity int) ClientSessionCache

+ type ClientSessionState struct

+ func MakeClientSessionState(SessionTicket []uint8, Vers uint16, CipherSuite uint16, MasterSecret []byte, ...) *ClientSessionState

+ func (css *ClientSessionState) CipherSuite() uint16

+ func (css *ClientSessionState) MasterSecret() []byte

+ func (css *ClientSessionState) ServerCertificates() []*x509.Certificate

+ func (css *ClientSessionState) SessionTicket() []uint8

+ func (css *ClientSessionState) SetCipherSuite(CipherSuite uint16)

+ func (css *ClientSessionState) SetMasterSecret(MasterSecret []byte)

+ func (css *ClientSessionState) SetServerCertificates(ServerCertificates []*x509.Certificate)

+ func (css *ClientSessionState) SetSessionTicket(SessionTicket []uint8)

+ func (css *ClientSessionState) SetVerifiedChains(VerifiedChains [][]*x509.Certificate)

+ func (css *ClientSessionState) SetVers(Vers uint16)

+ func (css *ClientSessionState) VerifiedChains() [][]*x509.Certificate

+ func (css *ClientSessionState) Vers() uint16

+ type Config struct

+ Certificates []Certificate

+ CipherSuites []uint16

+ ClientAuth ClientAuthType

+ ClientCAs *x509.CertPool

+ ClientSessionCache ClientSessionCache

+ CurvePreferences []CurveID

+ DynamicRecordSizingDisabled bool

+ GetCertificate func(*ClientHelloInfo) (*Certificate, error)

+ GetClientCertificate func(*CertificateRequestInfo) (*Certificate, error)

+ GetConfigForClient func(*ClientHelloInfo) (*Config, error)

+ InsecureSkipVerify bool

+ KeyLogWriter io.Writer

+ MaxVersion uint16

+ MinVersion uint16

+ NameToCertificate map[string]*Certificate

+ NextProtos []string

+ PreferServerCipherSuites bool

+ Rand io.Reader

+ Renegotiation RenegotiationSupport

+ RootCAs *x509.CertPool

+ ServerName string

+ SessionTicketKey [32]byte

+ SessionTicketsDisabled bool

+ Time func() time.Time

+ VerifyPeerCertificate func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error

+ func (c *Config) BuildNameToCertificate()

+ func (c *Config) Clone() *Config

+ func (c *Config) SetSessionTicketKeys(keys [][32]byte)

+ type Conn struct

+ func Client(conn net.Conn, config *Config) *Conn

+ func Dial(network, addr string, config *Config) (*Conn, error)

+ func DialWithDialer(dialer *net.Dialer, network, addr string, config *Config) (*Conn, error)

+ func MakeConnWithCompleteHandshake(tcpConn net.Conn, version uint16, cipherSuite uint16, masterSecret []byte, ...) *Conn

+ func Server(conn net.Conn, config *Config) *Conn

+ func (c *Conn) Close() error

+ func (c *Conn) CloseWrite() error

+ func (c *Conn) ConnectionState() ConnectionState

+ func (c *Conn) Handshake() error

+ func (c *Conn) LocalAddr() net.Addr

+ func (c *Conn) OCSPResponse() []byte

+ func (c *Conn) Read(b []byte) (int, error)

+ func (c *Conn) RemoteAddr() net.Addr

+ func (c *Conn) SetDeadline(t time.Time) error

+ func (c *Conn) SetReadDeadline(t time.Time) error

+ func (c *Conn) SetWriteDeadline(t time.Time) error

+ func (c *Conn) VerifyHostname(host string) error

+ func (c *Conn) Write(b []byte) (int, error)

+ type ConnectionState struct

+ CipherSuite uint16

+ DidResume bool

+ HandshakeComplete bool

+ NegotiatedProtocol string

+ NegotiatedProtocolIsMutual bool

+ OCSPResponse []byte

+ PeerCertificates []*x509.Certificate

+ ServerName string

+ SignedCertificateTimestamps [][]byte

+ TLSUnique []byte

+ VerifiedChains [][]*x509.Certificate

+ Version uint16

+ func (cs *ConnectionState) ExportKeyingMaterial(label string, context []byte, length int) ([]byte, error)

+ type CookieExtension struct

+ Cookie []byte

+ func (e *CookieExtension) Len() int

+ func (e *CookieExtension) Read(b []byte) (int, error)

+ type CurveID uint16

+ const CurveP256

+ const CurveP384

+ const CurveP521

+ const X25519

+ type EcdheParameters interface

+ type FakeCertCompressionAlgsExtension struct

+ Methods []CertCompressionAlgo

+ func (e *FakeCertCompressionAlgsExtension) Len() int

+ func (e *FakeCertCompressionAlgsExtension) Read(b []byte) (int, error)

+ type FakeChannelIDExtension struct

+ func (e *FakeChannelIDExtension) Len() int

+ func (e *FakeChannelIDExtension) Read(b []byte) (int, error)

+ type FakeRecordSizeLimitExtension struct

+ Limit uint16

+ func (e *FakeRecordSizeLimitExtension) Len() int

+ func (e *FakeRecordSizeLimitExtension) Read(b []byte) (int, error)

+ type Fingerprinter struct

+ AllowBluntMimicry bool

+ AlwaysAddPadding bool

+ KeepPSK bool

+ func (f *Fingerprinter) FingerprintClientHello(data []byte) (*ClientHelloSpec, error)

+ type FinishedHash struct

+ Buffer []byte

+ Client hash.Hash

+ ClientMD5 hash.Hash

+ Prf func(result, secret, label, seed []byte)

+ Server hash.Hash

+ ServerMD5 hash.Hash

+ Version uint16

+ type GenericExtension struct

+ Data []byte

+ Id uint16

+ func (e *GenericExtension) Len() int

+ func (e *GenericExtension) Read(b []byte) (int, error)

+ type KeyShare struct

+ Data []byte

+ Group CurveID

+ type KeyShareExtension struct

+ KeyShares []KeyShare

+ func (e *KeyShareExtension) Len() int

+ func (e *KeyShareExtension) Read(b []byte) (int, error)

+ type KeyShares []KeyShare

+ func (KSS KeyShares) ToPrivate() []keyShare

+ type NPNExtension struct

+ NextProtos []string

+ func (e *NPNExtension) Len() int

+ func (e *NPNExtension) Read(b []byte) (int, error)

+ type PRNGSeed [PRNGSeedLength]byte

+ func NewPRNGSeed() (*PRNGSeed, error)

+ type PSKKeyExchangeModesExtension struct

+ Modes []uint8

+ func (e *PSKKeyExchangeModesExtension) Len() int

+ func (e *PSKKeyExchangeModesExtension) Read(b []byte) (int, error)

+ type RecordHeaderError struct

+ Conn net.Conn

+ Msg string

+ RecordHeader [5]byte

+ func (e RecordHeaderError) Error() string

+ type RenegotiationInfoExtension struct

+ Renegotiation RenegotiationSupport

+ func (e *RenegotiationInfoExtension) Len() int

+ func (e *RenegotiationInfoExtension) Read(b []byte) (int, error)

+ type RenegotiationSupport int

+ const RenegotiateFreelyAsClient

+ const RenegotiateNever

+ const RenegotiateOnceAsClient

+ type Roller struct

+ HelloIDMu sync.Mutex

+ HelloIDs []ClientHelloID

+ TcpDialTimeout time.Duration

+ TlsHandshakeTimeout time.Duration

+ WorkingHelloID *ClientHelloID

+ func NewRoller() (*Roller, error)

+ func (c *Roller) Dial(network, addr, serverName string) (*UConn, error)

+ type SCTExtension struct

+ func (e *SCTExtension) Len() int

+ func (e *SCTExtension) Read(b []byte) (int, error)

+ type SNIExtension struct

+ ServerName string

+ func (e *SNIExtension) Len() int

+ func (e *SNIExtension) Read(b []byte) (int, error)

+ type ServerHelloMsg struct

+ AlpnProtocol string

+ CipherSuite uint16

+ CompressionMethod uint8

+ Cookie []byte

+ Ems bool

+ NextProtoNeg bool

+ NextProtos []string

+ OcspStapling bool

+ Random []byte

+ Raw []byte

+ Scts [][]byte

+ SecureRenegotiation []byte

+ SecureRenegotiationSupported bool

+ SelectedGroup CurveID

+ SelectedIdentity uint16

+ SelectedIdentityPresent bool

+ ServerShare keyShare

+ SessionId []byte

+ SupportedVersion uint16

+ TicketSupported bool

+ Vers uint16

+ type SessionTicketExtension struct

+ Session *ClientSessionState

+ func (e *SessionTicketExtension) Len() int

+ func (e *SessionTicketExtension) Read(b []byte) (int, error)

+ type SignatureAlgorithmsExtension struct

+ SupportedSignatureAlgorithms []SignatureScheme

+ func (e *SignatureAlgorithmsExtension) Len() int

+ func (e *SignatureAlgorithmsExtension) Read(b []byte) (int, error)

+ type SignatureScheme uint16

+ const ECDSAWithP256AndSHA256

+ const ECDSAWithP384AndSHA384

+ const ECDSAWithP521AndSHA512

+ const ECDSAWithSHA1

+ const PKCS1WithSHA1

+ const PKCS1WithSHA256

+ const PKCS1WithSHA384

+ const PKCS1WithSHA512

+ const PSSWithSHA256

+ const PSSWithSHA384

+ const PSSWithSHA512

+ var FakeECDSAWithSHA224 SignatureScheme = 0x0303

+ var FakePKCS1WithSHA224 SignatureScheme = 0x0301

+ type StatusRequestExtension struct

+ func (e *StatusRequestExtension) Len() int

+ func (e *StatusRequestExtension) Read(b []byte) (int, error)

+ type SupportedCurvesExtension struct

+ Curves []CurveID

+ func (e *SupportedCurvesExtension) Len() int

+ func (e *SupportedCurvesExtension) Read(b []byte) (int, error)

+ type SupportedPointsExtension struct

+ SupportedPoints []uint8

+ func (e *SupportedPointsExtension) Len() int

+ func (e *SupportedPointsExtension) Read(b []byte) (int, error)

+ type SupportedVersionsExtension struct

+ Versions []uint16

+ func (e *SupportedVersionsExtension) Len() int

+ func (e *SupportedVersionsExtension) Read(b []byte) (int, error)

+ type TLS12OnlyState struct

+ FinishedHash FinishedHash

+ Suite CipherSuite

+ type TLS13OnlyState struct

+ BinderKey []byte

+ CertReq *CertificateRequestMsgTLS13

+ EarlySecret []byte

+ EcdheParams EcdheParameters

+ SentDummyCCS bool

+ Suite *CipherSuiteTLS13

+ TrafficSecret []byte

+ Transcript hash.Hash

+ UsingPSK bool

+ type TLSExtension interface

+ Len func() int

+ Read func(p []byte) (n int, err error)

+ type TicketKey struct

+ AesKey [16]byte

+ HmacKey [16]byte

+ KeyName [ticketKeyNameLen]byte

+ func TicketKeyFromBytes(b [32]byte) TicketKey

+ func (TK TicketKey) ToPrivate() ticketKey

+ type TicketKeys []TicketKey

+ func (TKS TicketKeys) ToPrivate() []ticketKey

+ type UConn struct

+ ClientHelloBuilt bool

+ ClientHelloID ClientHelloID

+ Extensions []TLSExtension

+ GetSessionID func(ticket []byte) [32]byte

+ HandshakeState ClientHandshakeState

+ func UClient(conn net.Conn, config *Config, clientHelloID ClientHelloID) *UConn

+ func (c *UConn) Handshake() error

+ func (c *UConn) Write(b []byte) (int, error)

+ func (uconn *UConn) ApplyConfig() error

+ func (uconn *UConn) ApplyPreset(p *ClientHelloSpec) error

+ func (uconn *UConn) BuildHandshakeState() error

+ func (uconn *UConn) GetOutKeystream(length int) ([]byte, error)

+ func (uconn *UConn) GetUnderlyingConn() net.Conn

+ func (uconn *UConn) MarshalClientHello() error

+ func (uconn *UConn) RemoveSNIExtension() error

+ func (uconn *UConn) SetClientRandom(r []byte) error

+ func (uconn *UConn) SetSNI(sni string)

+ func (uconn *UConn) SetSessionCache(cache ClientSessionCache)

+ func (uconn *UConn) SetSessionState(session *ClientSessionState) error

+ func (uconn *UConn) SetTLSVers(minTLSVers, maxTLSVers uint16, specExtensions []TLSExtension) error

+ func (uconn *UConn) SetUnderlyingConn(c net.Conn)

+ type UtlsExtendedMasterSecretExtension struct

+ func (e *UtlsExtendedMasterSecretExtension) Len() int

+ func (e *UtlsExtendedMasterSecretExtension) Read(b []byte) (int, error)

+ type UtlsGREASEExtension struct

+ Body []byte

+ Value uint16

+ func (e *UtlsGREASEExtension) Len() int

+ func (e *UtlsGREASEExtension) Read(b []byte) (int, error)

+ type UtlsPaddingExtension struct

+ GetPaddingLen func(clientHelloUnpaddedLen int) (paddingLen int, willPad bool)

+ PaddingLen int

+ WillPad bool

+ func (e *UtlsPaddingExtension) Len() int

+ func (e *UtlsPaddingExtension) Read(b []byte) (int, error)

+ func (e *UtlsPaddingExtension) Update(clientHelloUnpaddedLen int)