#crypto/gmtls

const version_gmtls11

pub const version_gmtls11 = 257

Purpose

GMTLS/TLCP (GB/T 38636) client subset. Xu addition — has no crypto/gmtls. Cipher suites ECC/ECDHE × SM4-GCM/CBC-SM3; dual SM2 certs. ECDHE uses GM/T 0003.3 (server=initiator) and requires client dual certs. CBC is TLS 1.1 style (explicit IV, HMAC-SM3 then SM4-CBC). Record/handshake are software; does not use crypto/tls platform ncall. In-process peer is server over net.pipe — not a Listen/Accept product API. After handshake, Conn.close sends an encrypted close_notify (warning, description 0); Conn.read throws "crypto/gmtls: close notify" on that record. Other alerts still throw "crypto/gmtls: alert". Does not close the pipe. ECC SKE is GM/T 0009 DER SEQUENCE{r,s}; CKE is DER SM2Cipher. ECDHE SKE/CKE carry named curveSM2 (41) + uncompressed point. Peers that still send raw r||s (64) or C1||C3||C2 (leading 0x04) are accepted on the ECC path. Zero C, not a commercial-crypto certification. Value `257`.

Parameters

none

const ecc_sm4_gcm_sm3

pub const ecc_sm4_gcm_sm3 = 57427

Purpose

Public constant `ecc_sm4_gcm_sm3`. Value `57427`.

Parameters

none

const ecdhe_sm4_gcm_sm3

pub const ecdhe_sm4_gcm_sm3 = 57425

Purpose

Public constant `ecdhe_sm4_gcm_sm3`. Value `57425`.

Parameters

none

const ecc_sm4_cbc_sm3

pub const ecc_sm4_cbc_sm3 = 57363

Purpose

Public constant `ecc_sm4_cbc_sm3`. Value `57363`.

Parameters

none

const ecdhe_sm4_cbc_sm3

pub const ecdhe_sm4_cbc_sm3 = 57361

Purpose

Public constant `ecdhe_sm4_cbc_sm3`. Value `57361`.

Parameters

none

struct Config

pub struct Config {
    pub server_name string
    pub client_name string
    pub insecure_skip_verify bool
    pub sign_cert string
    pub sign_key string
    pub enc_cert string
    pub enc_key string
    pub cipher_suite int
}

Purpose

sign_key / enc_key: 32-byte raw d, PKCS#8/SEC1 DER, or PEM (PRIVATE KEY / EC PRIVATE KEY / SM2 PRIVATE KEY). sign_cert / enc_cert: DER or PEM CERTIFICATE / X509 CERTIFICATE. server_name: ClientHello SNI (RFC 6066) when non-empty; client also matches it against the server sign certificate DNS SAN / CN unless empty or insecure_skip_verify. client_name: ECDHE server matches it against the client sign certificate DNS SAN / CN unless empty or insecure_skip_verify (does not check the encryption certificate). ECDHE client Config.sign_cert/enc_cert are the client's dual certs and need not match the server. Conn.peer_sign_cert / peer_enc_cert are the peer's presented dual certs (DER). ECC server leaves them empty (no client certs).

Parameters

server_name string

field (string)

client_name string

field (string)

insecure_skip_verify bool

field (bool)

sign_cert string

field (string)

sign_key string

field (string)

enc_cert string

field (string)

enc_key string

field (string)

cipher_suite int

field (int)

struct Conn

pub struct Conn {
    pub handshake_complete bool
    pub cipher_suite int
    pub server_name string
    pub peer_sign_cert string
    pub peer_enc_cert string
}

Purpose

Public struct `Conn`.

Parameters

handshake_complete bool

field (bool)

cipher_suite int

field (int)

server_name string

field (string)

peer_sign_cert string

field (string)

peer_enc_cert string

field (string)

client

pub fn client(c net.PipeConn, cfg &Config) Conn

Purpose

client; returns Conn. Throws on failure.

Parameters

c net.PipeConn

byte or character code (net.PipeConn)

cfg &Config

cfg (borrowed; caller keeps it; type &Config)

Returns

Conn — a value of this type

server

pub fn server(c net.PipeConn, cfg &Config) Conn

Purpose

server; returns Conn. Throws on failure.

Parameters

c net.PipeConn

byte or character code (net.PipeConn)

cfg &Config

cfg (borrowed; caller keeps it; type &Config)

Returns

Conn — a value of this type

(&mut Conn) write

pub fn (c &mut Conn) write(data &string) int

Purpose

Method on `&mut Conn`: write data and return the byte count. Throws on failure.

Parameters

c &mut Conn

receiver &mut Conn (exclusive borrow)

data &string

data (borrowed; caller keeps it; type &string)

Returns

int — bytes written

(&mut Conn) read

pub fn (c &mut Conn) read() string

Purpose

Method on `&mut Conn`: read up to max bytes. Throws on failure.

Parameters

c &mut Conn

receiver &mut Conn (exclusive borrow)

Returns

string — result string

(&mut Conn) close

pub fn (c &mut Conn) close() int

Purpose

Method on `&mut Conn`: close the resource. Throws on failure.

Parameters

c &mut Conn

receiver &mut Conn (exclusive borrow)

Returns

int — a value of this type