A Conn represents a secured connection. It implements the net.Conn interface.
| 29 | // A Conn represents a secured connection. |
| 30 | // It implements the net.Conn interface. |
| 31 | type Conn struct { |
| 32 | // constant |
| 33 | conn net.Conn |
| 34 | isClient bool |
| 35 | handshakeFn func(context.Context) error // (*Conn).clientHandshake or serverHandshake |
| 36 | |
| 37 | // handshakeStatus is 1 if the connection is currently transferring |
| 38 | // application data (i.e. is not currently processing a handshake). |
| 39 | // handshakeStatus == 1 implies handshakeErr == nil. |
| 40 | // This field is only to be accessed with sync/atomic. |
| 41 | handshakeStatus uint32 |
| 42 | // constant after handshake; protected by handshakeMutex |
| 43 | handshakeMutex sync.Mutex |
| 44 | handshakeErr error // error resulting from handshake |
| 45 | vers uint16 // TLS version |
| 46 | haveVers bool // version has been negotiated |
| 47 | config *Config // configuration passed to constructor |
| 48 | // handshakes counts the number of handshakes performed on the |
| 49 | // connection so far. If renegotiation is disabled then this is either |
| 50 | // zero or one. |
| 51 | handshakes int |
| 52 | didResume bool // whether this connection was a session resumption |
| 53 | cipherSuite uint16 |
| 54 | ocspResponse []byte // stapled OCSP response |
| 55 | scts [][]byte // signed certificate timestamps from server |
| 56 | peerCertificates []*x509.Certificate |
| 57 | // verifiedChains contains the certificate chains that we built, as |
| 58 | // opposed to the ones presented by the server. |
| 59 | verifiedChains [][]*x509.Certificate |
| 60 | // serverName contains the server name indicated by the client, if any. |
| 61 | serverName string |
| 62 | // secureRenegotiation is true if the server echoed the secure |
| 63 | // renegotiation extension. (This is meaningless as a server because |
| 64 | // renegotiation is not supported in that case.) |
| 65 | secureRenegotiation bool |
| 66 | // ekm is a closure for exporting keying material. |
| 67 | ekm func(label string, context []byte, length int) ([]byte, error) |
| 68 | // resumptionSecret is the resumption_master_secret for handling |
| 69 | // NewSessionTicket messages. nil if config.SessionTicketsDisabled. |
| 70 | resumptionSecret []byte |
| 71 | |
| 72 | // ticketKeys is the set of active session ticket keys for this |
| 73 | // connection. The first one is used to encrypt new tickets and |
| 74 | // all are tried to decrypt tickets. |
| 75 | ticketKeys []ticketKey |
| 76 | |
| 77 | // clientFinishedIsFirst is true if the client sent the first Finished |
| 78 | // message during the most recent handshake. This is recorded because |
| 79 | // the first transmitted Finished message is the tls-unique |
| 80 | // channel-binding value. |
| 81 | clientFinishedIsFirst bool |
| 82 | |
| 83 | // closeNotifyErr is any error from sending the alertCloseNotify record. |
| 84 | closeNotifyErr error |
| 85 | // closeNotifySent is true if the Conn attempted to send an |
| 86 | // alertCloseNotify record. |
| 87 | closeNotifySent bool |
| 88 |
nothing calls this directly
no outgoing calls
no test coverage detected