Documentation
¶
Overview ¶
Package fipsx exposes a tiny façade over crypto/fips140 so the rest of apic can gate behavior on FIPS 140-3 mode without importing crypto/fips140 directly (keeping the import boundary tight makes FIPS-disabled callers easy to audit).
Index ¶
- Variables
- func ApprovedCipherSuites() []uint16
- func ApprovedCurves() []tls.CurveID
- func ApprovedSignatureSchemes() []tls.SignatureScheme
- func CompiledWithFIPSTag() bool
- func IsFIPS() bool
- func NewClientTLSConfig() *tls.Config
- func NewServerTLSConfig(certs []tls.Certificate, opts ...Option) *tls.Config
- func RequireFIPS() error
- func Version() string
- type MTLSOpts
- type Option
Constants ¶
This section is empty.
Variables ¶
var ErrNotInFIPS = errors.New("fipsx: FIPS 140-3 mode is not enabled (build with GOFIPS140=v1.0.0)")
ErrNotInFIPS is returned by RequireFIPS when the running binary was not selected with GOFIPS140 or when the active module reports disabled.
Functions ¶
func ApprovedCipherSuites ¶
func ApprovedCipherSuites() []uint16
ApprovedCipherSuites returns the TLS 1.3 cipher suite IDs that the Go 1.26 FIPS 140-3 Cryptographic Module v1.26.0 will actually negotiate. SP 800-140C / SP 800-140D approved AEADs only — ChaCha20-Poly1305 is excluded by design.
func ApprovedCurves ¶
ApprovedCurves returns NIST-approved curves accepted by the FIPS module. X25519 is intentionally absent (not FIPS-approved in v1.26.0).
func ApprovedSignatureSchemes ¶
func ApprovedSignatureSchemes() []tls.SignatureScheme
ApprovedSignatureSchemes returns the signature schemes FIPS 140-3 will negotiate for TLS 1.3 handshake signatures and for client/server certificate verification. RSA-PSS preferred; Ed25519 excluded until the next module catalog update.
func CompiledWithFIPSTag ¶
func CompiledWithFIPSTag() bool
CompiledWithFIPSTag reports whether this binary was compiled with the `fips` build tag.
func IsFIPS ¶
func IsFIPS() bool
IsFIPS reports whether the Go Cryptographic Module is in FIPS 140-3 mode.
func NewClientTLSConfig ¶
NewClientTLSConfig is the client-side companion. Used by the generated SDK clients and by the apic pipeline when it pulls OIDC discovery documents over TLS.
func NewServerTLSConfig ¶
func NewServerTLSConfig(certs []tls.Certificate, opts ...Option) *tls.Config
NewServerTLSConfig builds a tls.Config locked to TLS 1.3, the FIPS 140-3 approved cipher suites and curves, and the caller-supplied server certificate(s), then applies any opts. The returned config is safe to mutate further; callers that need ClientAuth / ClientCAs for mTLS should pass WithMTLS rather than mutating directly so the fail-closed cipher catalog stays in force.
The variadic Option list is backward-compatible: existing single-arg callers (api/server.go, pkg/httpx/server.go) compile unchanged.
func RequireFIPS ¶
func RequireFIPS() error
RequireFIPS returns ErrNotInFIPS when called from a binary that did not activate the FIPS 140-3 module. Callers MUST treat this as a fail-closed startup gate.
Types ¶
type MTLSOpts ¶
type MTLSOpts struct {
ClientAuth tls.ClientAuthType
ClientCAs *x509.CertPool
}
MTLSOpts groups the per-listener mutual-TLS settings consumed by WithMTLS. Used by api.WithMTLS (Plan 02 Task 12) to bind the listener to a trust pool while inheriting the FIPS cipher catalog.
Source Files