Documentation
¶
Index ¶
- func CreateCertManager(datadir string, letsencryptDomain ...string) (*autocert.Manager, error)
- func Decrypt(encryptedMsg []byte, peerPublicKey wgtypes.Key, privateKey wgtypes.Key) ([]byte, error)
- func DecryptMessage(remotePubKey wgtypes.Key, ourPrivateKey wgtypes.Key, encryptedMessage []byte, ...) error
- func Encrypt(msg []byte, peerPublicKey wgtypes.Key, privateKey wgtypes.Key) ([]byte, error)
- func EncryptMessage(remotePubKey wgtypes.Key, ourPrivateKey wgtypes.Key, message pb.Message) ([]byte, error)
- func LoadTLSConfig(certFile, keyFile string) (*tls.Config, error)
- type DefaultEncrypter
- type Encrypter
- type Route53TLS
- type SharedKeyCache
- func (c *SharedKeyCache) Close()
- func (c *SharedKeyCache) Decrypt(encryptedMsg []byte, peerPublicKey wgtypes.Key) ([]byte, error)
- func (c *SharedKeyCache) DecryptMessage(peerPublicKey wgtypes.Key, encryptedMessage []byte, message pb.Message) error
- func (c *SharedKeyCache) Encrypt(msg []byte, peerPublicKey wgtypes.Key) ([]byte, error)
- func (c *SharedKeyCache) EncryptMessage(peerPublicKey wgtypes.Key, message pb.Message) ([]byte, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CreateCertManager ¶
CreateCertManager wraps common logic of generating Let's encrypt certificate.
func Decrypt ¶
func Decrypt(encryptedMsg []byte, peerPublicKey wgtypes.Key, privateKey wgtypes.Key) ([]byte, error)
Decrypt decrypts a message that has been encrypted by the remote peer using Wireguard private key and remote peer's public key.
func DecryptMessage ¶
func DecryptMessage(remotePubKey wgtypes.Key, ourPrivateKey wgtypes.Key, encryptedMessage []byte, message pb.Message) error
DecryptMessage decrypts an encrypted message into given protobuf Message
func Encrypt ¶
Encrypt encrypts a message using local Wireguard private key and remote peer's public key.
Types ¶
type DefaultEncrypter ¶ added in v0.79.0
type DefaultEncrypter struct{}
type Route53TLS ¶ added in v0.29.0
Route53TLS by default, loads the AWS configuration from the environment. env variables: AWS_REGION, AWS_PROFILE, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN
func (*Route53TLS) GetCertificate ¶ added in v0.29.0
func (r *Route53TLS) GetCertificate() (*tls.Config, error)
type SharedKeyCache ¶
type SharedKeyCache struct {
// contains filtered or unexported fields
}
SharedKeyCache encrypts and decrypts messages for one local private key, deriving the box shared key once per remote public key instead of once per message.
The shared key is a pure function of the two keys, so a cached entry never goes stale: a different remote key is a different entry, and a different local key needs a different cache. Entries are only dropped to stay under maxSharedKeys. Every message still uses its own random nonce.
The cached values are secret key material, as sensitive as the private key.
func NewSharedKeyCache ¶
func NewSharedKeyCache(privateKey wgtypes.Key) *SharedKeyCache
NewSharedKeyCache returns a cache for messages sent and received with privateKey.
func (*SharedKeyCache) Close ¶
func (c *SharedKeyCache) Close()
Close drops every cached shared key and stops caching new ones. Encrypt and Decrypt keep working afterwards by deriving the key for each message.
func (*SharedKeyCache) Decrypt ¶
Decrypt decrypts a message that peerPublicKey encrypted for this cache's private key. It is safe for concurrent use.
func (*SharedKeyCache) DecryptMessage ¶
func (c *SharedKeyCache) DecryptMessage(peerPublicKey wgtypes.Key, encryptedMessage []byte, message pb.Message) error
DecryptMessage decrypts a message from peerPublicKey and unmarshals it into message.
func (*SharedKeyCache) Encrypt ¶
Encrypt encrypts msg for peerPublicKey. It is safe for concurrent use.
func (*SharedKeyCache) EncryptMessage ¶
func (c *SharedKeyCache) EncryptMessage(peerPublicKey wgtypes.Key, message pb.Message) ([]byte, error)
EncryptMessage marshals message and encrypts it for peerPublicKey.
Source Files
Directories