Documentation
¶
Index ¶
- Constants
- Variables
- func AeadDecrypt(key [AeadSizeTag]byte, message AeadMessage, info []byte) ([]byte, error)
- func EcdhHkdf(skey *ecdh.PrivateKey, pkey []byte, salt []byte, info []byte) ([]byte, error)
- func EcdhKeygen() (*ecdh.PrivateKey, error)
- func IsError(wire enc.Wire) error
- type AeadCounter
- type AeadMessage
- type Challenge
- type ChallengeDns
- type ChallengeEmail
- type ChallengePin
- type ChallengeStatus
- type Client
- func (c *Client) CaPrefix() enc.Name
- func (c *Client) Challenge(challenge Challenge, newRes *tlv.NewRes, prevRes *tlv.ChallengeRes) (*tlv.ChallengeRes, error)
- func (c *Client) FetchIssuedCert(chRes *tlv.ChallengeRes) (ndn.Data, enc.Wire, error)
- func (c *Client) FetchProbe(params ParamMap) (*tlv.ProbeRes, error)
- func (c *Client) FetchProbeRedirect(params ParamMap) (probe *tlv.ProbeRes, err error)
- func (c *Client) FetchProfile() (*tlv.CaProfile, error)
- func (c *Client) New(challenge Challenge, expiry time.Time) (*tlv.NewRes, error)
- func (c *Client) RequestCert(args RequestCertArgs) (*RequestCertResult, error)
- func (c *Client) SetSigner(signer ndn.Signer)
- type ErrSignerProbeMismatch
- type ParamMap
- type RequestCertArgs
- type RequestCertResult
Constants ¶
const ( KwRecordName = "record-name" KwExpectedValue = "expected-value" DNSPrefix = "_ndncert-challenge" )
const AeadSizeNonce = 12
const AeadSizeRand = 8
const AeadSizeTag = 16
const KwCode = "code"
const KwConfirmation = "confirmation"
const KwDns = "dns"
const KwDomain = "domain"
const KwEmail = "email"
Keywords
const KwPin = "pin"
Variables ¶
var ErrChallengeBefore = errors.New("challenge before request")
Challenge Errors
var ErrChallengeFailed = errors.New("challenge failed")
var ErrChallengePending = errors.New("challenge pending")
var ErrChallengeStatusUnknown = errors.New("unknown challenge status")
var ErrNoKeySuggestions = errors.New("no key suggestions")
Functions ¶
func AeadDecrypt ¶
func AeadDecrypt( key [AeadSizeTag]byte, message AeadMessage, info []byte, ) ([]byte, error)
(AI GENERATED DESCRIPTION): Decrypts an AEAD‑protected message using AES‑GCM with the given key and additional authenticated data.
func EcdhKeygen ¶
func EcdhKeygen() (*ecdh.PrivateKey, error)
EcdhKeygen generates an ECDH key pair.
Types ¶
type AeadCounter ¶
type AeadCounter struct {
// contains filtered or unexported fields
}
func NewAeadCounter ¶
func NewAeadCounter() *AeadCounter
(AI GENERATED DESCRIPTION): Creates a new AeadCounter initialized with a zero block counter and a freshly generated random byte sequence.
type AeadMessage ¶
type AeadMessage struct {
IV [AeadSizeNonce]byte
AuthTag [AeadSizeTag]byte
CipherText []byte
}
func AeadEncrypt ¶
func AeadEncrypt( key [AeadSizeTag]byte, plaintext []byte, info []byte, counter *AeadCounter, ) (*AeadMessage, error)
(AI GENERATED DESCRIPTION): Encrypts the given plaintext with AES‑GCM using the supplied key and context info, deriving an IV from the counter, and returns an `AeadMessage` containing the IV, ciphertext, and authentication tag.
func (*AeadMessage) FromTLV ¶
func (m *AeadMessage) FromTLV(t *tlv.CipherMsg)
(AI GENERATED DESCRIPTION): Populates an AeadMessage's IV, AuthTag, and CipherText fields from a provided tlv.CipherMsg.
func (*AeadMessage) TLV ¶
func (m *AeadMessage) TLV() *tlv.CipherMsg
(AI GENERATED DESCRIPTION): Creates a tlv.CipherMsg containing the AEAD message’s IV, authentication tag, and ciphertext.
type Challenge ¶
type Challenge interface {
// Name returns the name of the challenge.
Name() string
// Request gets the params of the challenge request.
// The input provides the params of the previous challenge response.
// Input is nil for the initial request.
// Status is for the previous challenge response.
Request(input ParamMap, status optional.Optional[string]) (ParamMap, error)
}
Challenge is the interface for an NDNCERT challenge.
type ChallengeDns ¶ added in v1.5.3
type ChallengeDns struct {
// DomainCallback is called to get the domain name from the user.
// It receives the challenge status for user prompting.
DomainCallback func(status string) string
// ConfirmationCallback is called to get confirmation from user that
// they have created the required DNS record.
// It receives the record details and status for user prompting.
ConfirmationCallback func(recordName, expectedValue, status string) string
// contains filtered or unexported fields
}
ChallengeDns implements the DNS-01 challenge following Let's Encrypt practices. The challenge allows certificate requesters to prove domain ownership by creating a DNS TXT record containing a challenge token.
Challenge Flow: 1. Requester provides domain name they want to validate 2. CA generates challenge token and responds with DNS record details 3. Requester creates TXT record at _ndncert-challenge.<domain> with challenge response 4. Requester confirms record is in place 5. CA performs DNS lookup to verify the TXT record exists
func (*ChallengeDns) Name ¶ added in v1.5.3
func (*ChallengeDns) Name() string
(AI GENERATED DESCRIPTION): Returns the predefined DNS keyword `KwDns`, identifying this challenge type.
type ChallengeEmail ¶
type ChallengeEmail struct {
// Email address to send the challenge to.
Email string
// Callback to get the code from the user.
CodeCallback func(status string) string
}
func (*ChallengeEmail) Name ¶
func (*ChallengeEmail) Name() string
(AI GENERATED DESCRIPTION): Returns the constant name string KwEmail that identifies ChallengeEmail packets.
func (*ChallengeEmail) Request ¶
func (c *ChallengeEmail) Request(input ParamMap, status optional.Optional[string]) (ParamMap, error)
(AI GENERATED DESCRIPTION): Generates the appropriate request parameters for an email‑based challenge, returning the email address on first contact or the user‑supplied code when a status indicates a required or incorrect code.
type ChallengePin ¶
type ChallengePin struct {
// Callback to get the code from the user.
CodeCallback func(status string) string
}
func (*ChallengePin) Name ¶
func (*ChallengePin) Name() string
(AI GENERATED DESCRIPTION): Returns the predefined keyword string (KwPin) that identifies a ChallengePin, used as its name in the protocol.
func (*ChallengePin) Request ¶
(AI GENERATED DESCRIPTION): Processes a challenge request by calling a configured callback to obtain a PIN code when the status indicates “need‑code” or “wrong‑code”, returning that code in a ParamMap, and otherwise validating the challenge configuration or returning an error for unknown status.
type ChallengeStatus ¶
type ChallengeStatus uint64
const ( ChallengeStatusBefore ChallengeStatus = 0 ChallengeStatusChallenge ChallengeStatus = 1 ChallengeStatusPending ChallengeStatus = 2 ChallengeStatusSuccess ChallengeStatus = 3 ChallengeStatusFailure ChallengeStatus = 4 )
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
func NewClient ¶
NewClient creates a new NDNCERT client.
engine: NDN engine caCert: CA certificate raw wire signer: signer for the client
func (*Client) Challenge ¶
func (c *Client) Challenge( challenge Challenge, newRes *tlv.NewRes, prevRes *tlv.ChallengeRes, ) (*tlv.ChallengeRes, error)
Challenge sends a CHALLENGE request to the CA (blocking).
func (*Client) FetchIssuedCert ¶
FetchIssuedCert fetches the issued certificate from the CA (blocking).
func (*Client) FetchProbe ¶
FetchProbe sends a PROBE request to the CA (blocking).
func (*Client) FetchProbeRedirect ¶
FetchProbeRedirect sends a PROBE request to the CA (blocking). If a redirect is received, the request is sent to the new location.
func (*Client) FetchProfile ¶
FetchProfile fetches the profile from the CA (blocking).
func (*Client) RequestCert ¶
func (c *Client) RequestCert(args RequestCertArgs) (*RequestCertResult, error)
RequestCert is the high level function to issue a certificate. This API is recommended to be used for most cases. This is a blocking function and should be called in a separate goroutine.
type ErrSignerProbeMismatch ¶
RequestCert Errors
func (ErrSignerProbeMismatch) Error ¶
func (e ErrSignerProbeMismatch) Error() string
(AI GENERATED DESCRIPTION): Generates an error message stating that the supplied signer does not match any CA suggestion for the specified key name.
type RequestCertArgs ¶
type RequestCertArgs struct {
// Challenge is the challenge to be used for the certificate request.
Challenge Challenge
// OnProfile is called when a CA profile is fetched.
// Returning an error will abort the request.
OnProfile func(profile *tlv.CaProfile) error
// DisableProbe is a flag to disable the probe step.
// If true, the key will be used directly.
DisableProbe bool
// OnProbeParam is the callback to get the probe parameter.
// Returning an error will abort the request.
OnProbeParam func(key string) ([]byte, error)
// OnChooseKey is the callback to choose a key suggestion.
// Returning an invalid index will abort the request.
// If nil, the first suggestion is used.
OnChooseKey func(suggestions []enc.Name) int
// OnKeyChosen is called when a key is chosen.
// Returning an error will abort the request.
OnKeyChosen func(keyName enc.Name) error
}
RequestCertArgs is the arguments for the Issue function.
type RequestCertResult ¶
type RequestCertResult struct {
// CertData is the issued certificate data.
CertData ndn.Data
// CertWire is the raw certificate data.
CertWire enc.Wire
// Signer is the signer used for the certificate.
Signer ndn.Signer
}
RequestCertResult is the result of the Issue function.