grpc
/
grpc-go
mirror of https://github.com/grpc/grpc-go.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

advancedTLS: Documentation (#7213) 

Add documentation for advancedTLS package
This commit is contained in:
Gregory Cooke 2024-05-13 14:03:03 -04:00 committed by GitHub
parent 59954c8016
commit 0020ccf9d9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 16 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
security/advancedtls/advancedtls.go
View File

@ -16,9 +16,15 @@
* *
*/ */
// Package advancedtls is a utility library containing functions to construct // Package advancedtls provides gRPC transport credentials that allow easy
// credentials.TransportCredentials that can perform credential reloading and // configuration of advanced TLS features. The APIs here give the user more
// custom verification check. // customizable control to fit their security landscape, thus the "advanced"
// moniker. This package provides both interfaces and generally useful
// implementations of those interfaces, for example periodic credential
// reloading, support for certificate revocation lists, and customizable
// certificate verification behaviors. If the provided implementations do not
// fit a given use case, a custom implementation of the interface can be
// injected.
package advancedtls package advancedtls
import ( import (
@ -119,8 +125,9 @@ type GetRootCAsResults = RootCertificates
// RootCertificateOptions contains options to obtain root trust certificates // RootCertificateOptions contains options to obtain root trust certificates
// for both the client and the server. // for both the client and the server.
// At most one option could be set. If none of them are set, we // At most one field should be set. If none of them are set, we use the system
// use the system default trust certificates. // default trust certificates. Setting more than one field will result in
// undefined behavior.
type RootCertificateOptions struct { type RootCertificateOptions struct {
// If RootCertificates is set, it will be used every time when verifying // If RootCertificates is set, it will be used every time when verifying
// the peer certificates, without performing root certificate reloading. // the peer certificates, without performing root certificate reloading.
@ -153,18 +160,18 @@ func (o RootCertificateOptions) nonNilFieldCount() int {
// IdentityCertificateOptions contains options to obtain identity certificates // IdentityCertificateOptions contains options to obtain identity certificates
// for both the client and the server. // for both the client and the server.
// At most one option could be set. // At most one field should be set. Setting more than one field will result in undefined behavior.
type IdentityCertificateOptions struct { type IdentityCertificateOptions struct {
// If Certificates is set, it will be used every time when needed to present // If Certificates is set, it will be used every time when needed to present
//identity certificates, without performing identity certificate reloading. // identity certificates, without performing identity certificate reloading.
Certificates []tls.Certificate Certificates []tls.Certificate
// If GetIdentityCertificatesForClient is set, it will be invoked to obtain // If GetIdentityCertificatesForClient is set, it will be invoked to obtain
// identity certs for every new connection. // identity certs for every new connection.
// This field MUST be set on client side. // This field is only relevant when set on the client side.
GetIdentityCertificatesForClient func(*tls.CertificateRequestInfo) (*tls.Certificate, error) GetIdentityCertificatesForClient func(*tls.CertificateRequestInfo) (*tls.Certificate, error)
// If GetIdentityCertificatesForServer is set, it will be invoked to obtain // If GetIdentityCertificatesForServer is set, it will be invoked to obtain
// identity certs for every new connection. // identity certs for every new connection.
// This field MUST be set on server side. // This field is only relevant when set on the server side.
GetIdentityCertificatesForServer func(*tls.ClientHelloInfo) ([]*tls.Certificate, error) GetIdentityCertificatesForServer func(*tls.ClientHelloInfo) ([]*tls.Certificate, error)
// If IdentityProvider is set, we will use the identity certs from the // If IdentityProvider is set, we will use the identity certs from the
// Provider's KeyMaterial() call in the new connections. The Provider must // Provider's KeyMaterial() call in the new connections. The Provider must