A Config structure is used to configure a TLS client or server. After one has been passed to a TLS function it must not be modified. A Config may be reused; the tls package will also not modify it.
| 515 | // modified. A Config may be reused; the tls package will also not |
| 516 | // modify it. |
| 517 | type Config struct { |
| 518 | // Rand provides the source of entropy for nonces and RSA blinding. |
| 519 | // If Rand is nil, TLS uses the cryptographic random reader in package |
| 520 | // crypto/rand. |
| 521 | // The Reader must be safe for use by multiple goroutines. |
| 522 | Rand io.Reader |
| 523 | |
| 524 | // Time returns the current time as the number of seconds since the epoch. |
| 525 | // If Time is nil, TLS uses time.Now. |
| 526 | Time func() time.Time |
| 527 | |
| 528 | // Certificates contains one or more certificate chains to present to the |
| 529 | // other side of the connection. The first certificate compatible with the |
| 530 | // peer's requirements is selected automatically. |
| 531 | // |
| 532 | // Server configurations must set one of Certificates, GetCertificate or |
| 533 | // GetConfigForClient. Clients doing client-authentication may set either |
| 534 | // Certificates or GetClientCertificate. |
| 535 | // |
| 536 | // Note: if there are multiple Certificates, and they don't have the |
| 537 | // optional field Leaf set, certificate selection will incur a significant |
| 538 | // per-handshake performance cost. |
| 539 | Certificates []Certificate |
| 540 | |
| 541 | // NameToCertificate maps from a certificate name to an element of |
| 542 | // Certificates. Note that a certificate name can be of the form |
| 543 | // '*.example.com' and so doesn't have to be a domain name as such. |
| 544 | // |
| 545 | // Deprecated: NameToCertificate only allows associating a single |
| 546 | // certificate with a given name. Leave this field nil to let the library |
| 547 | // select the first compatible chain from Certificates. |
| 548 | NameToCertificate map[string]*Certificate |
| 549 | |
| 550 | // GetCertificate returns a Certificate based on the given |
| 551 | // ClientHelloInfo. It will only be called if the client supplies SNI |
| 552 | // information or if Certificates is empty. |
| 553 | // |
| 554 | // If GetCertificate is nil or returns nil, then the certificate is |
| 555 | // retrieved from NameToCertificate. If NameToCertificate is nil, the |
| 556 | // best element of Certificates will be used. |
| 557 | GetCertificate func(*ClientHelloInfo) (*Certificate, error) |
| 558 | |
| 559 | // GetClientCertificate, if not nil, is called when a server requests a |
| 560 | // certificate from a client. If set, the contents of Certificates will |
| 561 | // be ignored. |
| 562 | // |
| 563 | // If GetClientCertificate returns an error, the handshake will be |
| 564 | // aborted and that error will be returned. Otherwise |
| 565 | // GetClientCertificate must return a non-nil Certificate. If |
| 566 | // Certificate.Certificate is empty then no certificate will be sent to |
| 567 | // the server. If this is unacceptable to the server then it may abort |
| 568 | // the handshake. |
| 569 | // |
| 570 | // GetClientCertificate may be called multiple times for the same |
| 571 | // connection if renegotiation occurs or if TLS 1.3 is in use. |
| 572 | GetClientCertificate func(*CertificateRequestInfo) (*Certificate, error) |
| 573 | |
| 574 | // GetConfigForClient, if not nil, is called after a ClientHello is |
nothing calls this directly
no outgoing calls
no test coverage detected