Documentation
¶
Overview ¶
Package auth is the two credentials a harness checks. An api key lets a connector call every HTTP route; api keys live hashed in a table in the harness's directory. A join secret lets a machine join the mesh as a worker; it can add a worker and nothing else. It derives from the device code, which is what a person types (code.go). Both are held as a token: the kind, the key of the harness its holder finds through the pointer, and the secret itself.
mp_<kind>_<harness key>.<secret>
Index ¶
- Constants
- Variables
- func Addr(r *http.Request) string
- func Code(s string) (string, error)
- func Hash(secret string) string
- func JoinHandler(k ed25519.PrivateKey, key string, code func() (string, error), l *Limit) http.Handler
- func NewCode() string
- func Parse(kind, token string) (key, secret string, err error)
- func Redeem(ctx context.Context, url, key, code string) (string, error)
- func Secret(k ed25519.PrivateKey, code string) string
- func Token(kind, key, secret string) string
- type Entry
- type Limit
- type Store
- func (s Store) Add(kind, name, secret string) error
- func (s Store) Bearer(l *Limit, next http.Handler) http.Handler
- func (s Store) Check(kind, secret string) bool
- func (s Store) Issue(kind, name string) (string, error)
- func (s Store) Load() (Table, error)
- func (s Store) Revoke(kind, name string) error
- type Table
Constants ¶
const ( Key = "key" // a connector's credential: every HTTP route Join = "join" // a worker's credential: joining the mesh )
Variables ¶
var ErrCode = errors.New("wrong device code")
ErrCode is a device code the harness does not hold.
var ErrTaken = errors.New("name in use")
ErrTaken is a name that already has an entry of its kind.
Functions ¶
func Addr ¶ added in v0.2.0
Addr is who sent r: the client address cloudflared puts in CF-Connecting-IP, else the peer. The harness listens on loopback only, so every peer is cloudflared or this machine, and the header can be trusted.
func Code ¶ added in v0.5.2
Code is s as a device code. Case and the hyphen do not matter, nor the letters people read for digits: O is 0, I and L are 1.
func JoinHandler ¶ added in v0.5.2
func JoinHandler(k ed25519.PrivateKey, key string, code func() (string, error), l *Limit) http.Handler
JoinHandler answers the device code exchange of the harness with k, whose code is code() now. Every exchange counts as a refusal in l, since the harness cannot tell a right code from a wrong one: so an address gets few guesses a window.
func Redeem ¶ added in v0.5.2
Redeem trades code for the join token of the harness with key at url, or ErrCode when that harness holds another code or another key.
Types ¶
type Limit ¶ added in v0.2.0
type Limit struct {
// contains filtered or unexported fields
}
Limit counts refused credentials and device code exchanges by address, and turns an address away for the rest of a window once it has too many. The window is one for every address, so an address may come back early. A 26-character secret needs no limit against guessing; an 8-character device code does, and this is it.
func (*Limit) Refused ¶ added in v0.2.0
Refused counts a refused credential from addr, in a new window once the last has passed.
type Store ¶
type Store struct{ Path string }
Store is the table as a file, read on every check so a new or revoked entry counts at once.
func (Store) Add ¶ added in v0.5.0
Add makes secret an entry of kind named name, beside any before it.
func (Store) Bearer ¶
Bearer refuses a request whose Authorization: Bearer is not a live api key, and one from an address l turns away. A request with no key is refused but not counted: it guesses nothing.
Source Files