bfe_tls

type CRLPool struct {
	// contains filtered or unexported fields
}

type Certificate struct {
	Certificate [][]byte
	PrivateKey  crypto.PrivateKey // supported types: *rsa.PrivateKey, *ecdsa.PrivateKey
	// OCSPStaple contains an optional OCSP response which will be served
	// to clients that request it.
	OCSPStaple []byte
	OCSPParse  *ocsp.Response // OCSPParse specify the details of ocsp response
	// Leaf is the parsed form of the leaf certificate, which may be
	// initialized using x509.ParseCertificate to reduce per-handshake
	// processing for TLS clients doing client authentication. If nil, the
	// leaf certificate will be parsed as needed.
	Leaf *x509.Certificate
	// contains filtered or unexported fields
}

type CipherFilter func(id uint16) bool

type ClientAuthType int

type ClientSessionCache interface {
	// Get searches for a ClientSessionState associated with the given key.
	// On return, ok is true if one was found.
	Get(sessionKey string) (session *ClientSessionState, ok bool)

	// Put adds the ClientSessionState to the cache with the given key.
	Put(sessionKey string, cs *ClientSessionState)
}

type ClientSessionState struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Rand provides the source of entropy for nonces and RSA blinding.
	// If Rand is nil, TLS uses the cryptographic random reader in package
	// crypto/rand.
	// The Reader must be safe for use by multiple goroutines.
	Rand io.Reader

	// Time returns the current time as the number of seconds since the epoch.
	// If Time is nil, TLS uses time.Now.
	Time func() time.Time

	// Certificates contains one or more certificate chains
	// to present to the other side of the connection.
	// Server configurations must include at least one certificate.
	Certificates []Certificate

	// NameToCertificate maps from a certificate name to an element of
	// Certificates. Note that a certificate name can be of the form
	// '*.example.com' and so doesn't have to be a domain name as such.
	// See Config.BuildNameToCertificate
	// The nil value causes the first element of Certificates to be used
	// for all connections.
	NameToCertificate map[string]*Certificate

	// VerifyPeerCertificate, if not nil, is called after normal
	// certificate verification by either a TLS client or server. It
	// receives the raw ASN.1 certificates provided by the peer and also
	// any verified chains that normal processing found. If it returns a
	// non-nil error, the handshake is aborted and that error results.
	//
	// If normal verification fails then the handshake will abort before
	// considering this callback. If normal verification is disabled by
	// setting InsecureSkipVerify, or (for a server) when ClientAuth is
	// RequestClientCert or RequireAnyClientCert, then this callback will
	// be considered but the verifiedChains argument will always be nil.
	VerifyPeerCertificate func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error

	// default multiply certificates policy for tls server
	MultiCert MultiCertificate

	// RootCAs defines the set of root certificate authorities
	// that clients use when verifying server certificates.
	// If RootCAs is nil, TLS uses the host's root CA set.
	RootCAs *x509.CertPool

	// NextProtos is a list of supported, application level protocols.
	NextProtos []string

	// ServerName is used to verify the hostname on the returned
	// certificates unless InsecureSkipVerify is given. It is also included
	// in the client's handshake to support virtual hosting.
	ServerName string

	// ClientAuth determines the server's global policy for
	// TLS Client Authentication. The default is NoClientCert.
	ClientAuth ClientAuthType

	// ClientCAs defines the set of root certificate authorities
	// that servers use if required to verify a client certificate
	// by the policy in ClientAuth.
	ClientCAs *x509.CertPool

	// InsecureSkipVerify controls whether a client verifies the
	// server's certificate chain and host name.
	// If InsecureSkipVerify is true, TLS accepts any certificate
	// presented by the server and any host name in that certificate.
	// In this mode, TLS is susceptible to man-in-the-middle attacks.
	// This should be used only for testing.
	InsecureSkipVerify bool

	// CipherSuites is a list of supported cipher suites. If CipherSuites
	// is nil, TLS uses a list of suites supported by the implementation.
	CipherSuites []uint16

	// Priority of cipher suites in server side. If PreferServerCipherSuites
	// is false, CipherSuitesPriority should be ignored during cipher suite
	// negotiation
	CipherSuitesPriority []uint16

	// PreferServerCipherSuites controls whether the server selects the
	// client's most preferred ciphersuite, or the server's most preferred
	// ciphersuite. If true then the server's preference, as expressed in
	// the order of elements in CipherSuites, is used.
	PreferServerCipherSuites bool

	// here prohibit poodle attack by allow RC4 cipher only used with ssl3.0
	Ssl3PoodleProofed bool

	// SessionTicketsDisabled may be set to true to disable session ticket
	// (resumption) support.
	SessionTicketsDisabled bool

	// SessionTicketKey is used by TLS servers to provide session
	// resumption. See RFC 5077. If zero, it will be filled with
	// random data before the first server handshake.
	//
	// If multiple servers are terminating connections for the same host
	// they should all have the same SessionTicketKey. If the
	// SessionTicketKey leaks, previously recorded and future TLS
	// connections using that key are compromised.
	SessionTicketKey [32]byte

	// SessionTicketKeyName is used as an identifier for SessionTicketKey
	// in SessionTicket
	SessionTicketKeyName [16]byte

	// SessionCache is a cache of ClientSessionState entries for TLS session
	// resumption.
	ClientSessionCache ClientSessionCache

	// SessionCache is a cache of sessionState entries for TLS session
	// resumption.
	ServerSessionCache ServerSessionCache

	// SessionCacheDisabled may be set to true to disable session cache
	// (resumption) support.
	SessionCacheDisabled bool

	// MinVersion contains the minimum SSL/TLS version that is acceptable.
	// If zero, then SSLv3 is taken as the minimum.
	MinVersion uint16

	// MaxVersion contains the maximum SSL/TLS version that is acceptable.
	// If zero, then the maximum version supported by this package is used,
	// which is currently TLS 1.2.
	MaxVersion uint16

	// CurvePreferences contains the elliptic curves that will be used in
	// an ECDHE handshake, in preference order. If empty, the default will
	// be used.
	CurvePreferences []CurveID

	// Support SSLv2 ClientHello for backward compatibility with ancient
	// TLS-capable clients.
	EnableSslv2ClientHello bool

	// customized config for server side
	ServerRule ServerRule
	// contains filtered or unexported fields
}

type Conn struct {
	// contains filtered or unexported fields
}

type ConnParam interface {
	// Get virtual ip for current conn
	GetVip() net.IP
}

type ConnectionState struct {
	Version                    uint16                // TLS version used by the connection (e.g. VersionTLS12)
	HandshakeComplete          bool                  // TLS handshake is complete
	DidResume                  bool                  // connection resumes a previous TLS connection
	CipherSuite                uint16                // cipher suite in use (TLS_RSA_WITH_RC4_128_SHA, ...)
	OcspStaple                 bool                  // use ocsp staple (in server side)
	NegotiatedProtocolIsMutual bool                  // negotiated protocol was advertised by server
	NegotiatedProtocol         string                // negotiated next protocol (from Config.NextProtos)
	ServerName                 string                // server name requested by client, if any (server side only)
	HandshakeTime              time.Duration         // TLS handshake time (in server side)
	PeerCertificates           []*x509.Certificate   // certificate chain presented by remote peer
	VerifiedChains             [][]*x509.Certificate // verified chains built from PeerCertificates
	ClientRandom               []byte                // random in client hello
	ServerRandom               []byte                // random in server hello
	MasterSecret               []byte                // master secret used by the connection
	ClientCiphers              []uint16              // ciphers supported by client
	ClientAuth                 bool                  // enable TLS Client Authentication
	ClientCAName               string                // TLS client CA name
	JA3Raw                     string                // JA3 fingerprint string for TLS Client
	JA3Hash                    string                // JA3 fingerprint hash for TLS Client
}

type CurveID uint16

type KeyPairLoader interface {
	LoadX509KeyPair(certFile, keyFile string) (cert Certificate, err error)
}

type MultiCertificate interface {
	// Get certificate for the given conn
	Get(c *Conn) *Certificate
}

type NextProtoConf interface {
	// Get next protos for the given conn
	Get(c *Conn) []string
}

type Rule struct {
	// NextProtos is a list of supported, application level protocols.
	NextProtos NextProtoConf

	// Security Grade
	Grade string

	// enable TLS Client Authentication
	ClientAuth bool

	// client CA certificate
	ClientCAs *x509.CertPool

	// client CA name
	ClientCAName string

	// client CRL pool
	ClientCRLPool *CRLPool

	// enable Chacha20-poly1305 cipher suites
	Chacha20 bool

	// enable Dynamic TLS record size
	DynamicRecord bool
}

type ServerRule interface {
	// Get tls rule for the given conn
	Get(c *Conn) *Rule
}

type ServerSessionCache interface {
	// Get searches for a sessionState associated with the given key.
	// On return, ok is true if one was found.
	Get(sessionKey string) (sessionState []byte, ok bool)

	// Put adds the sessionState to the cache with the given key.
	Put(sessionKey string, sessionState []byte) error
}

type TestPemNameEnmu string

type TlsState struct {
	TlsHandshakeReadClientHelloErr        *metrics.Counter
	TlsHandshakeFullAll                   *metrics.Counter
	TlsHandshakeFullSucc                  *metrics.Counter
	TlsHandshakeResumeAll                 *metrics.Counter
	TlsHandshakeResumeSucc                *metrics.Counter
	TlsHandshakeCheckResumeSessionTicket  *metrics.Counter
	TlsHandshakeShouldResumeSessionTicket *metrics.Counter
	TlsHandshakeCheckResumeSessionCache   *metrics.Counter
	TlsHandshakeShouldResumeSessionCache  *metrics.Counter
	TlsHandshakeAcceptSslv2ClientHello    *metrics.Counter
	TlsHandshakeAcceptEcdheWithoutExt     *metrics.Counter
	TlsHandshakeNoSharedCipherSuite       *metrics.Counter
	TlsHandshakeSslv2NotSupport           *metrics.Counter
	TlsHandshakeOcspTimeErr               *metrics.Counter
	TlsStatusRequestExtCount              *metrics.Counter
	TlsHandshakeZeroData                  *metrics.Counter
}

type VerifyCertHook func(insecureSkipVerify bool, host string, certificates []*x509.Certificate, cas *x509.CertPool) error

type VerifyPeerCertHooks struct {
	InsecureSkipVerify bool
	Host               string

	CAs *x509.CertPool
	// contains filtered or unexported fields
}