spiffetls

func Dial ¶

func Dial(ctx context.Context, network, addr string, authorizer tlsconfig.Authorizer, options ...DialOption) (net.Conn, error)

Dial creates an mTLS connection using an X509-SVID obtained from the Workload API. The server is authenticated using X.509 bundles also obtained from the Workload API. The server is authorized using the given authorizer.

This is the same as DialWithMode using the MTLSClient mode.

func DialWithMode ¶

func DialWithMode(ctx context.Context, network, addr string, mode DialMode, options ...DialOption) (_ net.Conn, err error)

DialWithMode creates a TLS connection using the specified mode.

func Listen ¶

func Listen(ctx context.Context, network, laddr string, authorizer tlsconfig.Authorizer, options ...ListenOption) (net.Listener, error)

Listen creates an mTLS listener accepting connections on the given network address using net.Listen. The server X509-SVID is obtained via the Workload API along with X.509 bundles used to verify client X509-SVIDs. The client is authorized using the given authorizer.

This function is the same as ListenWithMode using the MTLSServer mode.

func ListenWithMode ¶

func ListenWithMode(ctx context.Context, network, laddr string, mode ListenMode, options ...ListenOption) (net.Listener, error)

ListenWithMode creates a TLS listener accepting connections on the given network address using net.Listen. The given mode controls the authentication and authorization exercised during the TLS handshake.

func NewListener ¶

func NewListener(ctx context.Context, inner net.Listener, authorizer tlsconfig.Authorizer, options ...ListenOption) (net.Listener, error)

NewListener creates an mTLS listener which accepts connections from an inner Listener and wraps each connection with tls.Server. The server X509-SVID is obtained via the Workload API along with X.509 bundles used to verify client X509-SVIDs. The client is authorized using the given authorizer.

This function is the same as NewListenerWithMode using the MTLSServer mode.

func NewListenerWithMode ¶

func NewListenerWithMode(ctx context.Context, inner net.Listener, mode ListenMode, options ...ListenOption) (_ net.Listener, err error)

NewListenerWithMode creates a TLS listener which accepts connections from an inner Listener and wraps each connection with tls.Server. The given mode controls the authentication and authorization exercised during the TLS handshake.

func PeerIDFromConn ¶

func PeerIDFromConn(conn net.Conn) (spiffeid.ID, error)

PeerIDFromConn returns the peer ID from a server or client peer connection. The handshake must have been completed. Note that in Go's TLS stack, the TLS 1.3 handshake may not complete until the first read from the connection.