Package: crypto/tls

package tls

Import Path
	crypto/tls (on golang.org and go.dev)

Dependency Relation
	imports 38 packages, and imported by 5 packages

Involved Source Files
	    alert.go
	    auth.go
	    cipher_suites.go
	    common.go
	    common_string.go
	    conn.go
	    handshake_client.go
	    handshake_client_tls13.go
	    handshake_messages.go
	    handshake_server.go
	    handshake_server_tls13.go
	    key_agreement.go
	    key_schedule.go
	    prf.go
	    ticket.go
	d-> tls.go

Exported Type Names

	 type Certificate (struct)
		A Certificate is a chain of one or more certificates, leaf first.

		Exported Fields (6)
			Certificate [][]byte
			Leaf *x509.Certificate
			OCSPStaple []byte
			PrivateKey crypto.PrivateKey
			SignedCertificateTimestamps [][]byte
			SupportedSignatureAlgorithms []SignatureScheme
		As Outputs Of (2+)
			func LoadX509KeyPair(certFile, keyFile string) (Certificate, error)
			func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (Certificate, error)
		As Inputs Of (2+)
			func (*CertificateRequestInfo).SupportsCertificate(c *Certificate) error
			func (*ClientHelloInfo).SupportsCertificate(c *Certificate) error
	 type CertificateRequestInfo (struct)
		CertificateRequestInfo contains information from a server's
		CertificateRequest message, which is used to demand a certificate and proof
		of control from a client.

		Exported Fields (3)
			AcceptableCAs [][]byte
			SignatureSchemes []SignatureScheme
			Version uint16
		One Exported Method
			(*T) SupportsCertificate(c *Certificate) error
	 type CipherSuite (struct)
		CipherSuite is a TLS cipher suite. Note that most functions in this package
		accept and expose cipher suite IDs instead of this type.

		Exported Fields (4)
			ID uint16
			Insecure bool
			Name string
			SupportedVersions []uint16
		As Outputs Of (2+)
			func CipherSuites() []*CipherSuite
			func InsecureCipherSuites() []*CipherSuite
	 type ClientAuthType int
		ClientAuthType declares the policy the server will follow for
		TLS Client Authentication.

		One Exported Method
			 (T) String() string
		Implements (2+)
			 T : expvar.Var
			 T : fmt.Stringer
		As Types Of (5+)
			const NoClientCert
			const RequestClientCert
			const RequireAndVerifyClientCert
			const RequireAnyClientCert
			const VerifyClientCertIfGiven
	 type ClientHelloInfo (struct)
		ClientHelloInfo contains information from a ClientHello message in order to
		guide application logic in the GetCertificate and GetConfigForClient callbacks.

		Exported Fields (8)
			CipherSuites []uint16
			Conn net.Conn
			ServerName string
			SignatureSchemes []SignatureScheme
			SupportedCurves []CurveID
			SupportedPoints []uint8
			SupportedProtos []string
			SupportedVersions []uint16
		One Exported Method
			(*T) SupportsCertificate(c *Certificate) error
	 type ClientSessionCache (interface)
		ClientSessionCache is a cache of ClientSessionState objects that can be used
		by a client to resume a TLS session with a given server. ClientSessionCache
		implementations should expect to be called concurrently from different
		goroutines. Up to TLS 1.2, only ticket-based resumption is supported, not
		SessionID-based resumption. In TLS 1.3 they were merged into PSK modes, which
		are supported via this interface.

		Exported Methods (2)
			 (T) Get(sessionKey string) (session *ClientSessionState, ok bool)
			 (T) Put(sessionKey string, cs *ClientSessionState)
		As Outputs Of (1+)
			func NewLRUClientSessionCache(capacity int) ClientSessionCache
	 type ClientSessionState (struct)
		ClientSessionState contains the state needed by clients to resume TLS
		sessions.

		As Outputs Of (1+)
			func ClientSessionCache.Get(sessionKey string) (session *ClientSessionState, ok bool)
		As Inputs Of (1+)
			func ClientSessionCache.Put(sessionKey string, cs *ClientSessionState)
	 type Config (struct)
		A Config structure is used to configure a TLS client or server.
		After one has been passed to a TLS function it must not be
		modified. A Config may be reused; the tls package will also not
		modify it.

		Exported Fields (26)
			Certificates []Certificate
			CipherSuites []uint16
			ClientAuth ClientAuthType
			ClientCAs *x509.CertPool
			ClientSessionCache ClientSessionCache
			CurvePreferences []CurveID
			DynamicRecordSizingDisabled bool
			GetCertificate func(*ClientHelloInfo) (*Certificate, error)
			GetClientCertificate func(*CertificateRequestInfo) (*Certificate, error)
			GetConfigForClient func(*ClientHelloInfo) (*Config, error)
			InsecureSkipVerify bool
			KeyLogWriter io.Writer
			MaxVersion uint16
			MinVersion uint16
			NameToCertificate map[string]*Certificate
			NextProtos []string
			PreferServerCipherSuites bool
			Rand io.Reader
			Renegotiation RenegotiationSupport
			RootCAs *x509.CertPool
			ServerName string
			SessionTicketKey [32]byte
			SessionTicketsDisabled bool
			Time func() time.Time
			VerifyConnection func(ConnectionState) error
			VerifyPeerCertificate func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
		Exported Methods (3)
			(*T) BuildNameToCertificate()
			(*T) Clone() *Config
			(*T) SetSessionTicketKeys(keys [][32]byte)
		As Outputs Of (1+)
			func (*Config).Clone() *Config
		As Inputs Of (7+)
			func Client(conn net.Conn, config *Config) *Conn
			func Dial(network, addr string, config *Config) (*Conn, error)
			func DialWithDialer(dialer *net.Dialer, network, addr string, config *Config) (*Conn, error)
			func Listen(network, laddr string, config *Config) (net.Listener, error)
			func NewListener(inner net.Listener, config *Config) net.Listener
			func Server(conn net.Conn, config *Config) *Conn
			func net/smtp.(*Client).StartTLS(config *Config) error
	 type Conn (struct)
		A Conn represents a secured connection.
		It implements the net.Conn interface.

		Exported Methods (13)
			(*T) Close() error
			(*T) CloseWrite() error
			(*T) ConnectionState() ConnectionState
			(*T) Handshake() error
			(*T) LocalAddr() net.Addr
			(*T) OCSPResponse() []byte
			(*T) Read(b []byte) (int, error)
			(*T) RemoteAddr() net.Addr
			(*T) SetDeadline(t time.Time) error
			(*T) SetReadDeadline(t time.Time) error
			(*T) SetWriteDeadline(t time.Time) error
			(*T) VerifyHostname(host string) error
			(*T) Write(b []byte) (int, error)
		Implements (8+)
			*T : io.Closer
			*T : io.ReadCloser
			*T : io.Reader
			*T : io.ReadWriteCloser
			*T : io.ReadWriter
			*T : io.WriteCloser
			*T : io.Writer
			*T : net.Conn
		As Outputs Of (4+)
			func Client(conn net.Conn, config *Config) *Conn
			func Dial(network, addr string, config *Config) (*Conn, error)
			func DialWithDialer(dialer *net.Dialer, network, addr string, config *Config) (*Conn, error)
			func Server(conn net.Conn, config *Config) *Conn
	 type ConnectionState (struct)
		ConnectionState records basic TLS details about the connection.

		Exported Fields (12)
			CipherSuite uint16
			DidResume bool
			HandshakeComplete bool
			NegotiatedProtocol string
			NegotiatedProtocolIsMutual bool
			OCSPResponse []byte
			PeerCertificates []*x509.Certificate
			ServerName string
			SignedCertificateTimestamps [][]byte
			TLSUnique []byte
			VerifiedChains [][]*x509.Certificate
			Version uint16
		One Exported Method
			(*T) ExportKeyingMaterial(label string, context []byte, length int) ([]byte, error)
		As Outputs Of (2+)
			func (*Conn).ConnectionState() ConnectionState
			func net/smtp.(*Client).TLSConnectionState() (state ConnectionState, ok bool)
	 type CurveID uint16
		CurveID is the type of a TLS identifier for an elliptic curve. See
		https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-8.

		In TLS 1.3, this type is called NamedGroup, but at this time this library
		only supports Elliptic Curve based groups. See RFC 8446, Section 4.2.7.

		One Exported Method
			 (T) String() string
		Implements (2+)
			 T : expvar.Var
			 T : fmt.Stringer
		As Types Of (4+)
			const CurveP256
			const CurveP384
			const CurveP521
			const X25519
	 type Dialer (struct)
		Dialer dials TLS connections given a configuration and a Dialer for the
		underlying connection.

		Exported Fields (2)
			Config *Config
			NetDialer *net.Dialer
		Exported Methods (2)
			(*T) Dial(network, addr string) (net.Conn, error)
			(*T) DialContext(ctx context.Context, network, addr string) (net.Conn, error)
	 type RecordHeaderError (struct)
		RecordHeaderError is returned when a TLS record header is invalid.

		Exported Fields (3)
			Conn net.Conn
			Msg string
			RecordHeader [5]byte
		One Exported Method
			 (T) Error() string
		Implements (1+)
			 T : error
	 type RenegotiationSupport int
		RenegotiationSupport enumerates the different levels of support for TLS
		renegotiation. TLS renegotiation is the act of performing subsequent
		handshakes on a connection after the first. This significantly complicates
		the state machine and has been the source of numerous, subtle security
		issues. Initiating a renegotiation is not supported, but support for
		accepting renegotiation requests may be enabled.

		Even when enabled, the server may not change its identity between handshakes
		(i.e. the leaf certificate must be the same). Additionally, concurrent
		handshake and application data flow is not permitted so renegotiation can
		only be used with protocols that synchronise with the renegotiation, such as
		HTTPS.

		Renegotiation is not defined in TLS 1.3.

		As Types Of (3+)
			const RenegotiateFreelyAsClient
			const RenegotiateNever
			const RenegotiateOnceAsClient
	 type SignatureScheme uint16
		SignatureScheme identifies a signature algorithm supported by TLS. See
		RFC 8446, Section 4.2.3.

		One Exported Method
			 (T) String() string
		Implements (2+)
			 T : expvar.Var
			 T : fmt.Stringer
		As Types Of (12+)
			const ECDSAWithP256AndSHA256
			const ECDSAWithP384AndSHA384
			const ECDSAWithP521AndSHA512
			const ECDSAWithSHA1
			const Ed25519
			const PKCS1WithSHA1
			const PKCS1WithSHA256
			const PKCS1WithSHA384
			const PKCS1WithSHA512
			const PSSWithSHA256
			const PSSWithSHA384
			const PSSWithSHA512
Exported Values

	 func CipherSuiteName(id uint16) string
		CipherSuiteName returns the standard name for the passed cipher suite ID
		(e.g. "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"), or a fallback representation
		of the ID value if the cipher suite is not implemented by this package.
	 func CipherSuites() []*CipherSuite
		CipherSuites returns a list of cipher suites currently implemented by this
		package, excluding those with security issues, which are returned by
		InsecureCipherSuites.

		The list is sorted by ID. Note that the default cipher suites selected by
		this package might depend on logic that can't be captured by a static list.
	 func Client(conn net.Conn, config *Config) *Conn
		Client returns a new TLS client side connection
		using conn as the underlying transport.
		The config cannot be nil: users must set either ServerName or
		InsecureSkipVerify in the config.
	const CurveP256 CurveID = 23
	const CurveP384 CurveID = 24
	const CurveP521 CurveID = 25
	 func Dial(network, addr string, config *Config) (*Conn, error)
		Dial connects to the given network address using net.Dial
		and then initiates a TLS handshake, returning the resulting
		TLS connection.
		Dial interprets a nil configuration as equivalent to
		the zero configuration; see the documentation of Config
		for the defaults.
	 func DialWithDialer(dialer *net.Dialer, network, addr string, config *Config) (*Conn, error)
		DialWithDialer connects to the given network address using dialer.Dial and
		then initiates a TLS handshake, returning the resulting TLS connection. Any
		timeout or deadline given in the dialer apply to connection and TLS
		handshake as a whole.

		DialWithDialer interprets a nil configuration as equivalent to the zero
		configuration; see the documentation of Config for the defaults.
	const ECDSAWithP256AndSHA256 SignatureScheme = 1027
		ECDSA algorithms. Only constrained to a specific curve in TLS 1.3.
	const ECDSAWithP384AndSHA384 SignatureScheme = 1283
	const ECDSAWithP521AndSHA512 SignatureScheme = 1539
	const ECDSAWithSHA1 SignatureScheme = 515
	const Ed25519 SignatureScheme = 2055
		EdDSA algorithms.
	 func InsecureCipherSuites() []*CipherSuite
		InsecureCipherSuites returns a list of cipher suites currently implemented by
		this package and which have security issues.

		Most applications should not use the cipher suites in this list, and should
		only use those returned by CipherSuites.
	 func Listen(network, laddr string, config *Config) (net.Listener, error)
		Listen creates a TLS listener accepting connections on the
		given network address using net.Listen.
		The configuration config must be non-nil and must include
		at least one certificate or else set GetCertificate.
	 func LoadX509KeyPair(certFile, keyFile string) (Certificate, error)
		LoadX509KeyPair reads and parses a public/private key pair from a pair
		of files. The files must contain PEM encoded data. The certificate file
		may contain intermediate certificates following the leaf certificate to
		form a certificate chain. On successful return, Certificate.Leaf will
		be nil because the parsed form of the certificate is not retained.
	 func NewListener(inner net.Listener, config *Config) net.Listener
		NewListener creates a Listener which accepts connections from an inner
		Listener and wraps each connection with Server.
		The configuration config must be non-nil and must include
		at least one certificate or else set GetCertificate.
	 func NewLRUClientSessionCache(capacity int) ClientSessionCache
		NewLRUClientSessionCache returns a ClientSessionCache with the given
		capacity that uses an LRU strategy. If capacity is < 1, a default capacity
		is used instead.
	const NoClientCert ClientAuthType = 0
	const PKCS1WithSHA1 SignatureScheme = 513
		Legacy signature and hash algorithms for TLS 1.2.
	const PKCS1WithSHA256 SignatureScheme = 1025
		RSASSA-PKCS1-v1_5 algorithms.
	const PKCS1WithSHA384 SignatureScheme = 1281
	const PKCS1WithSHA512 SignatureScheme = 1537
	const PSSWithSHA256 SignatureScheme = 2052
		RSASSA-PSS algorithms with public key OID rsaEncryption.
	const PSSWithSHA384 SignatureScheme = 2053
	const PSSWithSHA512 SignatureScheme = 2054
	const RenegotiateFreelyAsClient RenegotiationSupport = 2
		RenegotiateFreelyAsClient allows a remote server to repeatedly
		request renegotiation.
	const RenegotiateNever RenegotiationSupport = 0
		RenegotiateNever disables renegotiation.
	const RenegotiateOnceAsClient RenegotiationSupport = 1
		RenegotiateOnceAsClient allows a remote server to request
		renegotiation once per connection.
	const RequestClientCert ClientAuthType = 1
	const RequireAndVerifyClientCert ClientAuthType = 4
	const RequireAnyClientCert ClientAuthType = 2
	 func Server(conn net.Conn, config *Config) *Conn
		Server returns a new TLS server side connection
		using conn as the underlying transport.
		The configuration config must be non-nil and must include
		at least one certificate or else set GetCertificate.
	const TLS_AES_128_GCM_SHA256 uint16 = 4865
		TLS 1.3 cipher suites.
	const TLS_AES_256_GCM_SHA384 uint16 = 4866
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_CHACHA20_POLY1305_SHA256 uint16 = 4867
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA uint16 = 49161
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 uint16 = 49187
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 uint16 = 49195
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA uint16 = 49162
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 uint16 = 49196
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 uint16 = 52393
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 uint16 = 52393
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_ECDSA_WITH_RC4_128_SHA uint16 = 49159
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA uint16 = 49170
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA uint16 = 49171
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 uint16 = 49191
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 uint16 = 49199
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA uint16 = 49172
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 uint16 = 49200
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 uint16 = 52392
		Legacy names for the corresponding cipher suites with the correct _SHA256
		suffix, retained for backward compatibility.
	const TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 uint16 = 52392
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_ECDHE_RSA_WITH_RC4_128_SHA uint16 = 49169
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_FALLBACK_SCSV uint16 = 22016
		TLS_FALLBACK_SCSV isn't a standard cipher suite but an indicator
		that the client is doing version fallback. See RFC 7507.
	const TLS_RSA_WITH_3DES_EDE_CBC_SHA uint16 = 10
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_RSA_WITH_AES_128_CBC_SHA uint16 = 47
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_RSA_WITH_AES_128_CBC_SHA256 uint16 = 60
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_RSA_WITH_AES_128_GCM_SHA256 uint16 = 156
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_RSA_WITH_AES_256_CBC_SHA uint16 = 53
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_RSA_WITH_AES_256_GCM_SHA384 uint16 = 157
		A list of cipher suite IDs that are, or have been, implemented by this
		package.

		See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml
	const TLS_RSA_WITH_RC4_128_SHA uint16 = 5
		TLS 1.0 - 1.2 cipher suites.
	const VerifyClientCertIfGiven ClientAuthType = 3
	const VersionSSL30 = 768
		Deprecated: SSLv3 is cryptographically broken, and is no longer
		supported by this package. See golang.org/issue/32716.
	const VersionTLS10 = 769
	const VersionTLS11 = 770
	const VersionTLS12 = 771
	const VersionTLS13 = 772
	const X25519 CurveID = 29
	 func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (Certificate, error)
		X509KeyPair parses a public/private key pair from a pair of
		PEM encoded data. On successful return, Certificate.Leaf will be nil because
		the parsed form of the certificate is not retained.


The pages are generated with Golds v0.1.6-preview. (GOOS=linux GOARCH=amd64)
Golds is a Go 101 project and developed by Tapir Liu.
PR and bug reports are welcome and can be submitted to the issue list.
Please follow @Go100and1 (reachable from the left QR code) to get the latest news of Golds.