ConnectionStatetls.ConnectionState CipherSuite is the cipher suite negotiated for the connection (e.g.
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_AES_128_GCM_SHA256). CurveID is the key exchange mechanism used for the connection. The name
refers to elliptic curves for legacy reasons, see [CurveID]. If a legacy
RSA key exchange is used, this value is zero. DidResume is true if this connection was successfully resumed from a
previous session with a session ticket or similar mechanism. ECHAccepted indicates if Encrypted Client Hello was offered by the client
and accepted by the server. Currently, ECH is supported only on the
client side. HandshakeComplete is true if the handshake has concluded. NegotiatedProtocol is the application protocol negotiated with ALPN. NegotiatedProtocolIsMutual used to indicate a mutual NPN negotiation.
Deprecated: this value is always true. OCSPResponse is a stapled Online Certificate Status Protocol (OCSP)
response provided by the peer for the leaf certificate, if any. PeerCertificates are the parsed certificates sent by the peer, in the
order in which they were sent. The first element is the leaf certificate
that the connection is verified against.
On the client side, it can't be empty. On the server side, it can be
empty if Config.ClientAuth is not RequireAnyClientCert or
RequireAndVerifyClientCert.
PeerCertificates and its contents should not be modified. ServerName is the value of the Server Name Indication extension sent by
the client. It's available both on the server and on the client side. SignedCertificateTimestamps is a list of SCTs provided by the peer
through the TLS handshake for the leaf certificate, if any. TLSUnique contains the "tls-unique" channel binding value (see RFC 5929,
Section 3). This value will be nil for TLS 1.3 connections and for
resumed connections that don't support Extended Master Secret (RFC 7627). VerifiedChains is a list of one or more chains where the first element is
PeerCertificates[0] and the last element is from Config.RootCAs (on the
client side) or Config.ClientCAs (on the server side).
On the client side, it's set if Config.InsecureSkipVerify is false. On
the server side, it's set if Config.ClientAuth is VerifyClientCertIfGiven
(and the peer provided a certificate) or RequireAndVerifyClientCert.
VerifiedChains and its contents should not be modified. Version is the TLS version used by the connection (e.g. VersionTLS12).Used0RTTbool ExportKeyingMaterial returns length bytes of exported key material in a new
slice as defined in RFC 5705. If context is nil, it is not used as part of
the seed. If the connection was set to allow renegotiation via
Config.Renegotiation, or if the connections supports neither TLS 1.3 nor
Extended Master Secret, this function will return an error.
Exporting key material without Extended Master Secret or TLS 1.3 was disabled
in Go 1.22 due to security issues (see the Security Considerations sections
of RFC 5705 and RFC 7627), but can be re-enabled with the GODEBUG setting
tlsunsafeekm=1.
*ConnectionState : github.com/pion/srtp/v3.KeyingMaterialExporter
func CryptoSetup.ConnectionState() ConnectionState
A TokenGenerator generates tokens DecodeToken decodes a token NewRetryToken generates a new token for a Retry for a given source address NewToken generates a new token to be sent in a NEW_TOKEN frame
func NewTokenGenerator(key TokenProtectorKey) *TokenGenerator
TokenProtectorKey is the key used to encrypt both Retry and session resumption tokens.
func NewTokenGenerator(key TokenProtectorKey) *TokenGenerator
Package-Level Functions (total 6)
GetRetryIntegrityTag calculates the integrity tag on a Retry packet
NewCryptoSetupClient creates a new crypto setup for the client
NewCryptoSetupServer creates a new crypto setup for the server
NewInitialAEAD creates a new AEAD for Initial encryption / decryption.
NewTokenGenerator initializes a new TokenGenerator
ErrDecryptionFailed is returned when the AEAD fails to open the packet.
ErrKeysDropped is returned when an opener or a sealer is requested for an encryption level,
but the corresponding keys have already been dropped.
ErrKeysNotYetAvailable is returned when an opener or a sealer is requested for an encryption level,
but the corresponding opener has not yet been initialized
This can happen when packets arrive out of order.
FirstKeyUpdateInterval is the maximum number of packets we send or receive before initiating the first key update.
It's a package-level variable to allow modifying it for testing purposes.
EventDiscard0RTTKeys signals that the Handshake keys were discarded.
EventHandshakeComplete signals that the TLS handshake was completed.
EventNoEvent signals that there are no new handshake events
EventReceivedReadKeys signals that new decryption keys are available.
It doesn't say which encryption level those keys are for.
EventReceivedTransportParameters contains the transport parameters sent by the peer.
EventRestoredTransportParameters contains the transport parameters restored from the session ticket.
It is only used for the client.
EventWriteHandshakeData contains new CRYPTO data to send at the Handshake encryption level
EventWriteInitialData contains new CRYPTO data to send at the Initial encryption level
The pages are generated with Goldsv0.8.2. (GOOS=linux GOARCH=amd64)
Golds is a Go 101 project developed by Tapir Liu.
PR and bug reports are welcome and can be submitted to the issue list.
Please follow @zigo_101 (reachable from the left QR code) to get the latest news of Golds.
