tls

func New ¶

func New() filters.Spec

func NewMtlsAuthn ¶ added in v0.27.7

func NewMtlsAuthn(caPool, intermediates *x509.CertPool) filters.Spec

NewMtlsAuthn returns a filter spec for the mtlsAuthn filter. You need to pass the x509.CertPool that it will use to validate client certificates for authentication. The second parameter can be nil, in case you have no intermediate or can not load intermediates upfront.

func NewMtlsCN ¶ added in v0.27.7

func NewMtlsCN() filters.Spec

func NewMtlsIssuerDN ¶ added in v0.27.7

func NewMtlsIssuerDN() filters.Spec

NewMtlsIssuerDN returns a filter spec for the mtlsIssuerDN filter. Each argument must be a non-empty RFC 2253 Distinguished Name string. The filter allows a request when the certificate's full issuer DN matches any of the configured values exactly (e.g. "CN=My CA,O=My Org,C=DE").

func NewMtlsSanCIDR ¶ added in v0.27.7

func NewMtlsSanCIDR() filters.Spec

NewMtlsSanCIDR returns a filter spec for the mtlsSanCIDR filter. Each argument must be a valid CIDR block. CIDRs are combined into a single netipx.IPSet at filter-creation time so that matching in the hot path is O(log n) rather than O(n).

func NewMtlsSanDNS ¶ added in v0.27.7

func NewMtlsSanDNS() filters.Spec

NewMtlsSanDNS returns a filter spec for the mtlsSanDNS filter. Each argument must be a valid hostname.

func NewMtlsSanIP ¶ added in v0.27.7

func NewMtlsSanIP() filters.Spec

NewMtlsSanIP returns a filter spec for the mtlsSanIP filter. Each argument must be a valid IP address. IP addresses are combined into a single netipx.IPSet at filter-creation time so that matching in the hot path is O(log n) rather than O(n).

func NewMtlsSanURI ¶ added in v0.27.7

func NewMtlsSanURI() filters.Spec

NewMtlsSanURI returns a filter spec for the mtlsSanURI filter. Each argument must be a valid URI.