tlscommon

type CAReloader struct {
	// contains filtered or unexported fields
}

type CertReloader struct {
	// contains filtered or unexported fields
}

type CertReloaderOption func(*CertReloader)

type CertificateConfig struct {
	Certificate             string `config:"certificate" yaml:"certificate,omitempty"`
	Key                     string `config:"key" yaml:"key,omitempty"`
	Passphrase              string `config:"key_passphrase" yaml:"key_passphrase,omitempty"`
	PassphrasePath          string `config:"key_passphrase_path" yaml:"key_passphrase_path,omitempty"`
	DisableLegacyPEMSupport bool   `config:"disable_legacy_pem_support" yaml:"disable_legacy_pem_support,omitempty"`
}

type CertificateReload struct {
	Enabled        *bool         `config:"enabled" yaml:"enabled,omitempty"`
	ReloadInterval time.Duration `config:"reload_interval" yaml:"reload_interval,omitempty"`
}

type CipherSuite uint16

type Config struct {
	Enabled              *bool                   `config:"enabled" yaml:"enabled,omitempty"`
	VerificationMode     TLSVerificationMode     `config:"verification_mode" yaml:"verification_mode"` // one of 'none', 'full', 'certificate' and 'strict'
	Versions             []TLSVersion            `config:"supported_protocols" yaml:"supported_protocols,omitempty"`
	CipherSuites         []CipherSuite           `config:"cipher_suites" yaml:"cipher_suites,omitempty"`
	CAs                  []string                `config:"certificate_authorities" yaml:"certificate_authorities,omitempty"`
	Certificate          CertificateConfig       `config:",inline" yaml:",inline"`
	CurveTypes           []TLSCurveType          `config:"curve_types" yaml:"curve_types,omitempty"`
	Renegotiation        TLSRenegotiationSupport `config:"renegotiation" yaml:"renegotiation"`
	CASha256             []string                `config:"ca_sha256" yaml:"ca_sha256,omitempty"`
	CATrustedFingerprint string                  `config:"ca_trusted_fingerprint" yaml:"ca_trusted_fingerprint,omitempty"`
	CertificateReload    CertificateReload       `config:"certificate_reload" yaml:"certificate_reload,omitempty"`
}

type PEMReader struct {
	// contains filtered or unexported fields
}

type ServerConfig struct {
	Enabled           *bool               `config:"enabled" yaml:"enabled,omitempty"`
	VerificationMode  TLSVerificationMode `config:"verification_mode" yaml:"verification_mode,omitempty"` // one of 'none', 'full', 'strict', 'certificate'
	Versions          []TLSVersion        `config:"supported_protocols" yaml:"supported_protocols,omitempty"`
	CipherSuites      []CipherSuite       `config:"cipher_suites" yaml:"cipher_suites,omitempty"`
	CAs               []string            `config:"certificate_authorities" yaml:"certificate_authorities,omitempty"`
	Certificate       CertificateConfig   `config:",inline" yaml:",inline"`
	CurveTypes        []TLSCurveType      `config:"curve_types" yaml:"curve_types,omitempty"`
	ClientAuth        *TLSClientAuth      `config:"client_authentication" yaml:"client_authentication,omitempty"` //`none`, `optional` or `required`
	CASha256          []string            `config:"ca_sha256" yaml:"ca_sha256,omitempty"`
	CertificateReload CertificateReload   `config:"certificate_reload" yaml:"certificate_reload,omitempty"`
}

type TLSClientAuth int

type TLSConfig struct {

	// List of allowed SSL/TLS protocol versions. Connections might be dropped
	// after handshake succeeded, if TLS version in use is not listed.
	Versions []TLSVersion

	// Configure SSL/TLS verification mode used during handshake. By default
	// VerifyFull will be used.
	Verification TLSVerificationMode

	// List of certificate chains to present to the other side of the
	// connection.
	Certificates []tls.Certificate

	// List of supported cipher suites. If nil, a default list provided by the
	// implementation will be used.
	CipherSuites []CipherSuite

	// Types of elliptic curves that will be used in an ECDHE handshake. If empty,
	// the implementation will choose a default.
	CurvePreferences []tls.CurveID

	// Renegotiation controls what types of renegotiation are supported.
	// The default, never, is correct for the vast majority of applications.
	Renegotiation tls.RenegotiationSupport

	// ClientAuth controls how we want to verify certificate from a client, `none`, `optional` and
	// `required`, default to required. Do not affect TCP client.
	ClientAuth tls.ClientAuthType

	// CASha256 is the CA certificate pin, this is used to validate the CA that will be used to trust
	// the server certificate.
	CASha256 []string

	// CATrustedFingerprint is the HEX encoded fingerprint of a CA certificate. If present in the chain
	// this certificate will be added to the list of trusted CAs (RootCAs) during the handshake.
	CATrustedFingerprint string

	// ServerName is the remote server we're connecting to. It can be a hostname or IP address.
	ServerName string

	Logger *logp.Logger
	// contains filtered or unexported fields
}

type TLSCurveType tls.CurveID

type TLSOption interface {
	// contains filtered or unexported methods
}

type TLSRenegotiationSupport tls.RenegotiationSupport

type TLSSettings struct {
	// contains filtered or unexported fields
}

type TLSVerificationMode uint8

type TLSVersion uint16

type TLSVersionDetails struct {
	Version  string
	Protocol string
	Combined string
}