Affected by 
README
¶
server/certs
Overview
Certificate generation and management helpers for server transports. Issues and rotates TLS material for listeners. Key routines cover acme, CA, HTTPS, and mTLS within the certs subsystem.
Go Files
acme.go– Integrates with ACME providers to issue certificates automatically.ca.go– Manages the internal certificate authority lifecycle.certs.go– High-level certificate manager used by transports.certs_test.go(tests) – Tests certificate issuance and rotation workflows.https.go– Provides HTTPS certificate helpers and caching.mtls.go– Generates and manages mTLS client certificates.operators.go– Issues operator-specific certificates and keys.subject.go– Builds X.509 subject information based on configuration.tlskeys.go– Handles TLS keypair generation and persistence.wireguard.go– Manages certificates/keys for WireGuard listeners when needed.
Documentation
¶
Index ¶
- Constants
- Variables
- func GenerateCertificateAuthority(caType string, commonName string) (*x509.Certificate, *ecdsa.PrivateKey)
- func GenerateECCCertificate(caType string, commonName string, isCA bool, isClient bool, isOperator bool) ([]byte, []byte)
- func GenerateMultiplayerWGServerKeys() (string, string, error)
- func GenerateRSACertificate(caType string, commonName string, isCA bool, isClient bool) ([]byte, []byte)
- func GenerateWGKeyPair() (string, string, error)
- func GenerateWGKeys(isPeer bool, wgPeerTunIP string) (string, string, error)
- func GetACMEDir() string
- func GetACMEManager(domain string) *autocert.Manager
- func GetCertificate(caType string, keyType string, commonName string) ([]byte, []byte, error)
- func GetCertificateAuthority(caType string) (*x509.Certificate, *ecdsa.PrivateKey, error)
- func GetCertificateAuthorityPEM(caType string) ([]byte, []byte, error)
- func GetECCCertificate(caType string, commonName string) ([]byte, []byte, error)
- func GetMultiplayerWGServerKeys() (string, string, error)
- func GetOperatorWGPeers() (map[string]string, error)
- func GetRSACertificate(caType string, commonName string) ([]byte, []byte, error)
- func GetWGPeers() (map[string]string, error)
- func GetWGServerKeys() (string, string, error)
- func HTTPSGenerateRSACertificate(host string) ([]byte, []byte, error)
- func ImplantGenerateWGKeys(wgPeerTunIP string) (string, string, error)
- func MtlsC2ImplantGenerateECCCertificate(name string) ([]byte, []byte, error)
- func MtlsC2ServerGenerateECCCertificate(host string) ([]byte, []byte, error)
- func OperatorClientGenerateCertificate(operator string) ([]byte, []byte, error)
- func OperatorClientGetCertificate(operator string) ([]byte, []byte, error)
- func OperatorClientListCertificates() []*x509.Certificate
- func OperatorClientRemoveCertificate(operator string) error
- func OperatorServerGenerateCertificate(hostname string) ([]byte, []byte, error)
- func OperatorServerGetCertificate(hostname string) ([]byte, []byte, error)
- func RemoveCertificate(caType string, keyType string, commonName string) error
- func SaveCertificateAuthority(caType string, cert []byte, key []byte)
- func SetupCAs()
- func SetupMultiplayerWGKeys()
- func SetupWGKeys()
- func ValidateOperatorClientCertificate(peerCertificates []*x509.Certificate) error
Constants ¶
const ( // ECCKey - Namespace for ECC keys ECCKey = "ecc" // RSAKey - Namespace for RSA keys RSAKey = "rsa" )
const ( // MtlsImplantCA - Directory containing HTTPS server certificates MtlsImplantCA = "mtls-implant" MtlsServerCA = "mtls-server" )
const ( C2WireGuardServerIP = "100.64.0.1" MultiplayerWireGuardServerIP = "100.65.0.1" )
const (
// ACMEDirName - Name of dir to store ACME certs
ACMEDirName = "acme"
)
const (
// HTTPSCA - Directory containing operator certificates
HTTPSCA = "https"
)
const (
// OperatorCA - Directory containing operator certificates
OperatorCA = "operator"
)
Variables ¶
var ( // ErrOperatorClientCertificateNotFound indicates that the presented operator // client certificate is no longer trusted because it is not present in the // certificate store. ErrOperatorClientCertificateNotFound = errors.New("operator client certificate not found in database") // ErrInvalidOperatorClientCertificate indicates that the presented // certificate is not shaped like an operator client leaf certificate. ErrInvalidOperatorClientCertificate = errors.New("invalid operator client certificate") )
var ( ErrWGPeerDoesNotExist = errors.New("wg peer does not exist") ErrWGServerKeysDoNotExist = errors.New("wg server keys do not exist") ErrMultiplayerWGServerKeysDoNotExist = errors.New("multiplayer wg server keys do not exist") )
var ( // ErrCertDoesNotExist - Returned if a GetCertificate() is called for a cert/cn that does not exist ErrCertDoesNotExist = errors.New("Certificate does not exist") )
var (
// TLSKeyLogger - File descriptor for logging TLS keys
TLSKeyLogger = newKeyLogger()
)
Functions ¶
func GenerateCertificateAuthority ¶
func GenerateCertificateAuthority(caType string, commonName string) (*x509.Certificate, *ecdsa.PrivateKey)
GenerateCertificateAuthority - Creates a new CA cert for a given type
func GenerateECCCertificate ¶
func GenerateECCCertificate(caType string, commonName string, isCA bool, isClient bool, isOperator bool) ([]byte, []byte)
GenerateECCCertificate - Generate a TLS certificate with the given parameters We choose some reasonable defaults like Curve, Key Size, ValidFor, etc. Returns two strings `cert` and `key` (PEM Encoded).
func GenerateMultiplayerWGServerKeys ¶ added in v1.7.4
GenerateMultiplayerWGServerKeys - Generates and saves dedicated multiplayer WireGuard server keys.
func GenerateRSACertificate ¶
func GenerateRSACertificate(caType string, commonName string, isCA bool, isClient bool) ([]byte, []byte)
GenerateRSACertificate - Generates an RSA Certificate
func GenerateWGKeyPair ¶ added in v1.7.4
GenerateWGKeyPair - Generate a WireGuard keypair without persisting it.
func GenerateWGKeys ¶ added in v1.4.9
GenerateWGKeys - Generates and saves new C2 WireGuard keys.
func GetACMEManager ¶
GetACMEManager - Get an ACME cert/tls config with the certs
func GetCertificate ¶
GetCertificate - Get the PEM encoded certificate & key for a host
func GetCertificateAuthority ¶
func GetCertificateAuthority(caType string) (*x509.Certificate, *ecdsa.PrivateKey, error)
GetCertificateAuthority - Get the current CA certificate
func GetCertificateAuthorityPEM ¶
GetCertificateAuthorityPEM - Get PEM encoded CA cert/key
func GetECCCertificate ¶
GetECCCertificate - Get an ECC certificate
func GetMultiplayerWGServerKeys ¶ added in v1.7.4
GetMultiplayerWGServerKeys - Get existing multiplayer WireGuard server keys.
func GetOperatorWGPeers ¶ added in v1.7.4
GetOperatorWGPeers - Get a map of operator WG public keys to tunnel IPs.
func GetRSACertificate ¶
GetRSACertificate - Get an RSA certificate
func GetWGPeers ¶ added in v1.4.9
GetWGSPeers - Get a map of Pubkey:TunIP for existing wg peers
func GetWGServerKeys ¶ added in v1.4.9
GetWGServerKeys - Get existing C2 WireGuard server keys.
func HTTPSGenerateRSACertificate ¶
HTTPSGenerateRSACertificate - Generate a server certificate signed with a given CA
func ImplantGenerateWGKeys ¶ added in v1.4.9
ImplantGenerateWGKeys - Generate WG keys for implant
func MtlsC2ImplantGenerateECCCertificate ¶ added in v1.5.0
MtlsC2ImplantGenerateECCCertificate - Generate a server certificate signed with a given CA
func MtlsC2ServerGenerateECCCertificate ¶ added in v1.5.0
MtlsC2ServerGenerateECCCertificate - Generate a server certificate signed with a given CA
func OperatorClientGenerateCertificate ¶
OperatorClientGenerateCertificate - Generate a certificate signed with a given CA
func OperatorClientGetCertificate ¶
OperatorClientGetCertificate - Helper function to fetch a client cert
func OperatorClientListCertificates ¶
func OperatorClientListCertificates() []*x509.Certificate
OperatorClientListCertificates - Get all client certificates
func OperatorClientRemoveCertificate ¶
OperatorClientRemoveCertificate - Helper function to remove a client cert
func OperatorServerGenerateCertificate ¶
OperatorServerGenerateCertificate - Generate a certificate signed with a given CA
func OperatorServerGetCertificate ¶
OperatorServerGetCertificate - Helper function to fetch a server cert
func RemoveCertificate ¶
RemoveCertificate - Remove a certificate from the cert store
func SaveCertificateAuthority ¶
SaveCertificateAuthority - Save the certificate and the key to the database doesn't return an error because errors are fatal. If we can't generate CAs, then we can't secure communication and we should die a horrible death.
func SetupMultiplayerWGKeys ¶ added in v1.7.4
func SetupMultiplayerWGKeys()
SetupMultiplayerWGKeys - Setup multiplayer WireGuard server keys.
func ValidateOperatorClientCertificate ¶ added in v1.7.4
func ValidateOperatorClientCertificate(peerCertificates []*x509.Certificate) error
ValidateOperatorClientCertificate ensures that the presented operator client certificate is still present in the database. A valid chain alone is not enough; the exact leaf certificate must still exist in storage.
Types ¶
This section is empty.
Source Files