mtls

type ConfigHooks interface {
	// GetClientAuth sets the tls.Config's ClientAuth fields
	GetClientAuth(cfg *v2.TLSConfig) tls.ClientAuthType
	// GetCertificate returns the tls.Certificate by index.
	// By default the index is the cert/key file path or cert/key pem string
	GetCertificate(certIndex, keyIndex string) (tls.Certificate, error)
	// GetX509Pool returns the x509.CertPool, which is a set of certificates.
	// By default the index is the ca certificate file path or certificate pem string
	GetX509Pool(caIndex string) (*x509.CertPool, error)
	// ServerHandshakeVerify returns a function that used to set "VerifyPeerCertificate" defined in tls.Config.
	// If it is returns nil, the normal certificate verification will be used.
	// Notice that we set tls.Config.InsecureSkipVerify to make sure the "VerifyPeerCertificate" is called,
	// so the ServerHandshakeVerify should verify the trusted ca if necessary.
	// If the TLSConfig.RequireClientCert is false, the ServerHandshakeVerify will be ignored
	ServerHandshakeVerify(cfg *tls.Config) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
	// ClientHandshakeVerify returns a function that used to set "VerifyPeerCertificate" defined in tls.Config.
	// If it is returns nil, the normal certificate verification will be used.
	// Notice that we set tls.Config.InsecureSkipVerify to make sure the "VerifyPeerCertificate" is called,
	// so the ClientHandshakeVerify should verify the trusted ca if necessary.
	// If TLSConfig.InsecureSkip is true, the ClientHandshakeVerify will be ignored.
	ClientHandshakeVerify(cfg *tls.Config) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
	// GenerateHashValue creates a hash value based on the tls.Config
	GenerateHashValue(cfg *tls.Config) *types.HashValue
}

type ConfigHooksFactory interface {
	CreateConfigHooks(config map[string]interface{}) ConfigHooks
}

type Conn struct {
	net.Conn
	// contains filtered or unexported fields
}

type MockListener struct {
	net.Listener
	Mng types.TLSContextManager
}

type MockServer struct {
	Mng  types.TLSContextManager
	Addr string
	// contains filtered or unexported fields
}

type SecretInfo struct {
	Certificate  string
	PrivateKey   string
	Validation   string // root ca
	NoValidation bool
}

type TLSConn struct {
	*tls.Conn
}

type TLSStats struct {
	TLSConnpoolChanged gometrics.Counter
}

type TlsContext interface {
	// set the server side tls config
	SetServerConfig(template *tls.Config, cfg *v2.TLSConfig, hooks ConfigHooks)
	// return the server side TLSConfigContext
	GetServerTLSConfigContext() *types.TLSConfigContext

	// set the client side tls config
	SetClientConfig(template *tls.Config, cfg *v2.TLSConfig, hooks ConfigHooks)
	// return the client side TLSConfigContext
	GetClientTLSConfigContext() *types.TLSConfigContext

	// return the v2 tls config set by SetServerConfig/SetClientConfig
	GetTLSConfig() *v2.TLSConfig
	// return the tls SecretInfo set by SetServerConfig/SetClientConfig
	GetSecretInfo() *SecretInfo

	// whether the tls context matches the server name
	MatchedServerName(sn string) bool
	// whether the tls context matches the ALPN
	MatchedALPN(protocols []string) bool
}

type TlsContextCallback func(tlsContext TlsContext)