std/tls
On this page
Index
- type
Verify - type
Roots - type
TlsErr- method
TlsErr.display
- method
- type
TlsCert - type
ClientAuth - type
TlsConn- method
TlsConn.read - method
TlsConn.write - method
TlsConn.close - method
TlsConn.set_deadline - method
TlsConn.set_read_deadline - method
TlsConn.set_write_deadline - method
TlsConn.alpn - method
TlsConn.version - method
TlsConn.peer_certificates
- method
- fn
roots - fn
roots_of - fn
cert - fn
client - fn
pin_sha1 - fn
pin_sha256
Types
Verify
enum Verify {
Full
ChainOnly
None
} derive DisplayHow the server’s certificate is checked (std.md 27).
Roots
struct Roots {}Certificates a client trusts (std.md 27); a handle.
TlsErr
struct TlsErr {
msg: Str
}TlsErr.display
fn (e: TlsErr) display() -> StrThe message (decision 0358).
TlsCert
struct TlsCert {}A certificate chain with its private key (std.md 27); a handle. std/http’s TlsCert is this type (decision 0433).
ClientAuth
enum ClientAuth {
None
Request
RequireAny
VerifyIfGiven
RequireAndVerify
} derive DisplayWhat a TLS server asks of a client’s certificate (Go’s tls.ClientAuthType, in Go’s order and meaning; decision 0433).
TlsConn
struct TlsConn {}A TLS connection (std.md 27); a handle.
TlsConn.read
fn (t: TlsConn) read(max: Int) -> Bytes? ! NetErr uses net.dialTlsConn.write
fn (t: TlsConn) write(data: Bytes) -> () ! NetErr uses net.dialTlsConn.close
fn (t: TlsConn) close()TlsConn.set_deadline
fn (t: TlsConn) set_deadline(clock: Clock, at: Time?) uses clockThe connection’s deadlines (decision 0430), Go’s tls.Conn SetDeadline:
a read or write past t fails with Timeout and the connection stays
usable, mid-record included; they apply to the handshake too when set
on the Conn before client.
TlsConn.set_read_deadline
fn (t: TlsConn) set_read_deadline(clock: Clock, at: Time?) uses clockTlsConn.set_write_deadline
fn (t: TlsConn) set_write_deadline(clock: Clock, at: Time?) uses clockTlsConn.alpn
fn (t: TlsConn) alpn() -> StrThe protocol the server chose by ALPN, "" for none.
TlsConn.version
fn (t: TlsConn) version() -> Str“TLS 1.2” or “TLS 1.3”.
TlsConn.peer_certificates
fn (t: TlsConn) peer_certificates() -> List[x509.Certificate]The server’s certificates as it sent them, leaf first (Go’s ConnectionState.PeerCertificates); empty without TLS (FakeNet).
Functions
roots
fn roots(pem: Bytes) -> Roots ! TlsErrParses the CERTIFICATE blocks of a PEM text, as http’s with_roots.
roots_of
fn roots_of(certs: List[x509.Certificate]) -> Roots ! TlsErrRoots of parsed certificates (std/x509), as roots does of a PEM text.
cert
fn cert(cert_pem: Bytes, key_pem: Bytes) -> TlsCert ! TlsErrParses a PEM certificate chain and its PEM private key (Go’s tls.X509KeyPair), as http.tls_cert.
client
fn client(c: Conn, host: Str, roots: Roots? = None, verify: Verify = Verify.Full, alpn: List[Str] = [], cert: TlsCert? = None, verify_conn: (fn(List[x509.Certificate]) -> () ! Str)? = None) -> TlsConn ! NetErr uses net.dialRuns a TLS client handshake on c, which belongs to the result from then on (std.md 27). cert is the certificate presented when the server asks for one (decision 0433).
pin_sha1
fn pin_sha1(pin: Str) -> fn(List[x509.Certificate]) -> () ! Str ! StrA verify_conn function (also Client.with_verify_conn’s) that accepts a server whose leaf certificate’s DER has the SHA-1 digest pin (hex, colons and spaces ignored; Service Fabric’s thumbprint), compared in constant time; the text of a bad pin is the Err of the call.
pin_sha256
fn pin_sha256(pin: Str) -> fn(List[x509.Certificate]) -> () ! Str ! StrLike pin_sha1, over SHA-256.
↑ index