Documentation
¶
Overview ¶
Copyright © 2024 Vicknesh Suppramaniam <vicknesh@handletec.my>
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Copyright © 2024 Vicknesh Suppramaniam <vicknesh@handletec.my>
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Copyright © 2024 Vicknesh Suppramaniam <vicknesh@handletec.my>
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Copyright © 2024 Vicknesh Suppramaniam <vicknesh@handletec.my>
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Copyright © 2024 Vicknesh Suppramaniam <vicknesh@handletec.my>
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Index ¶
- type Listener
- type Listeners
- type Protocol
- type TLSClientAuth
- type TLSConfigBuilder
- func (t *TLSConfigBuilder) AddCABytes(pemData []byte) error
- func (t *TLSConfigBuilder) AddCADir(dir string) error
- func (t *TLSConfigBuilder) AddCAFile(path string) error
- func (t *TLSConfigBuilder) Close()
- func (t *TLSConfigBuilder) FileExists(path string) error
- func (t *TLSConfigBuilder) ForClient() (*tls.Config, error)
- func (t *TLSConfigBuilder) ForServer() (*tls.Config, error)
- func (t *TLSConfigBuilder) SetCertKeyFile(certPath, keyPath string) error
- func (t *TLSConfigBuilder) SetCertKeyFromBytes(certPEM, keyPEM []byte) error
- func (t *TLSConfigBuilder) SetClientAuth(auth TLSClientAuth)
- func (t *TLSConfigBuilder) SetInsecureSkipVerify(skip bool)
- func (t *TLSConfigBuilder) SetLogger(logger *slog.Logger)
- func (t *TLSConfigBuilder) VerifyCertTrusted(certPEM []byte) error
- func (t *TLSConfigBuilder) WatcherErr() error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Listener ¶
type Listener interface {
Name() string
Init(logger *slog.Logger, address string, port int, tlsConfig *tls.Config) error
SetConfig(config any) error
Start() error
}
Listener - generic interface that specific interfaces must implement
type Listeners ¶
type Listeners []Listener
Listeners - slice of listeners for specific protocols
type Protocol ¶
type Protocol uint8
Protocol - custom protocol definitions
func ParseProto ¶
ParseProto - returns protocol type from given string
type TLSClientAuth ¶
type TLSClientAuth tls.ClientAuthType
TLSClientAuth - TLS client authentication type
const ( // TLSClientAuthNone - there is no need to verify clients TLSClientAuthNone TLSClientAuth = TLSClientAuth(tls.NoClientCert) // TLSClientAuthRequest - server may request client cert but clients are not obligated to send it TLSClientAuthRequest TLSClientAuth = TLSClientAuth(tls.RequestClientCert) // TLSClientAuthRequire - clients must send a certificate but the server does NOT verify it. // Use only when post-handshake verification is handled at the application layer. // To require a valid certificate use TLSClientAuthRequireVerify instead. TLSClientAuthRequire TLSClientAuth = TLSClientAuth(tls.RequireAnyClientCert) // TLSClientAuthVerify - server may request client cert and if client responds, the cert must be valid TLSClientAuthVerify TLSClientAuth = TLSClientAuth(tls.VerifyClientCertIfGiven) // TLSClientAuthRequireVerify - server requests client cert and the client **MUST** respond with a valid certificate TLSClientAuthRequireVerify TLSClientAuth = TLSClientAuth(tls.RequireAndVerifyClientCert) )
func (TLSClientAuth) AuthType ¶
func (tca TLSClientAuth) AuthType() (at tls.ClientAuthType)
func (TLSClientAuth) String ¶
func (tca TLSClientAuth) String() (str string)
type TLSConfigBuilder ¶ added in v1.1.0
type TLSConfigBuilder struct {
// contains filtered or unexported fields
}
TLSConfigBuilder - builds and manages tls.Config instances for both server and client.
func NewTLSConfigBuilder ¶ added in v1.1.0
func NewTLSConfigBuilder(useSystemCA bool) (*TLSConfigBuilder, error)
NewTLSConfigBuilder - creates a new TLSConfigBuilder. If useSystemCA is true, it loads system root CAs.
func (*TLSConfigBuilder) AddCABytes ¶ added in v1.1.0
func (t *TLSConfigBuilder) AddCABytes(pemData []byte) error
AddCABytes - adds PEM-encoded certificates to the CA pool. Returns an error if the input is empty, contains no CERTIFICATE blocks, or any CERTIFICATE block contains malformed DER.
func (*TLSConfigBuilder) AddCADir ¶ added in v1.1.0
func (t *TLSConfigBuilder) AddCADir(dir string) error
AddCADir - loads all .crt/.pem files in a directory into the CA pool.
func (*TLSConfigBuilder) AddCAFile ¶ added in v1.1.0
func (t *TLSConfigBuilder) AddCAFile(path string) error
AddCAFile - loads a CA certificate from file and adds it to the pool.
func (*TLSConfigBuilder) Close ¶ added in v1.1.0
func (t *TLSConfigBuilder) Close()
Close - stops file watching. Safe to call multiple times.
func (*TLSConfigBuilder) FileExists ¶ added in v1.1.0
func (t *TLSConfigBuilder) FileExists(path string) error
FileExists - checks if the given path exists and is a regular file.
func (*TLSConfigBuilder) ForClient ¶ added in v1.1.0
func (t *TLSConfigBuilder) ForClient() (*tls.Config, error)
ForClient - returns a configured *tls.Config for client usage. Returns an error if SetCertKeyFile was used and the certificate files cannot be loaded. The returned config holds a snapshot of the CA pool at the time of the call.
func (*TLSConfigBuilder) ForServer ¶ added in v1.1.0
func (t *TLSConfigBuilder) ForServer() (*tls.Config, error)
ForServer - returns a configured *tls.Config for server usage. The returned config holds a snapshot of the CA pool at the time of the call.
func (*TLSConfigBuilder) SetCertKeyFile ¶ added in v1.1.0
func (t *TLSConfigBuilder) SetCertKeyFile(certPath, keyPath string) error
SetCertKeyFile - sets the cert and key files.
func (*TLSConfigBuilder) SetCertKeyFromBytes ¶ added in v1.1.0
func (t *TLSConfigBuilder) SetCertKeyFromBytes(certPEM, keyPEM []byte) error
SetCertKeyFromBytes - sets the cert and key directly from memory.
func (*TLSConfigBuilder) SetClientAuth ¶ added in v1.1.0
func (t *TLSConfigBuilder) SetClientAuth(auth TLSClientAuth)
SetClientAuth - sets the desired client auth level.
func (*TLSConfigBuilder) SetInsecureSkipVerify ¶ added in v1.1.0
func (t *TLSConfigBuilder) SetInsecureSkipVerify(skip bool)
SetInsecureSkipVerify - enables or disables skipping TLS verification. WARNING: for testing only; never set true in production. Setting true logs a warning via the configured logger or os.Stderr.
func (*TLSConfigBuilder) SetLogger ¶ added in v1.3.0
func (t *TLSConfigBuilder) SetLogger(logger *slog.Logger)
SetLogger - configures a structured logger for watcher diagnostics and security warnings. Without a logger, messages fall back to os.Stderr. Call before ForServer to ensure watcher diagnostics are routed to the application's observability stack.
func (*TLSConfigBuilder) VerifyCertTrusted ¶ added in v1.1.0
func (t *TLSConfigBuilder) VerifyCertTrusted(certPEM []byte) error
VerifyCertTrusted - checks if a PEM-encoded certificate chain is trusted by the builder's CA pool. The first certificate in the chain is the leaf; any remaining certificates are intermediates. Verification uses a snapshot of the current CA pool and requires ExtKeyUsageServerAuth.
func (*TLSConfigBuilder) WatcherErr ¶ added in v1.3.0
func (t *TLSConfigBuilder) WatcherErr() error
WatcherErr - returns the error from the watcher initialisation, if any. A non-nil value means certificate hot-reload is not active. Call after ForServer to check whether the watcher started successfully.