Documentation
¶
Index ¶
- Constants
- Variables
- func AnyChainMatchesCAs(chainPEMs, caPEMs []string, now time.Time) bool
- func ChainMatchesCAs(chainPEM string, caPEMs []string, now time.Time) bool
- func EffectiveWindow() time.Duration
- func EncodeChainPEM(chain []*x509.Certificate) string
- func NonceAcceptedAlongside(nonce, current []byte) bool
- func ParseCAs(pems []string) (*x509.CertPool, error)
- func ParseChainPEM(chainPEM string) ([]*x509.Certificate, error)
- func Sign(signer crypto.Signer, nonce, peerKey []byte) (string, []byte, error)
- func VerifiedChain(leaf *x509.Certificate, intermediates []*x509.Certificate, ...) ([]*x509.Certificate, error)
- func VerifyChain(chain []*x509.Certificate, roots *x509.CertPool, now time.Time) error
- type Challenger
- type Proof
Constants ¶
const ( // Window is the default challenge window. A nonce stays valid through the window // after the one it was issued in, so a peer re-proves possession of its key between // once and twice per window. One window early is accepted too, for clock skew. Window = 12 * time.Hour // EnvWindow overrides Window, for end-to-end tests that cannot wait half a day to // watch a renewal. Every management instance has to be given the same value: the // window is part of the nonce, so instances that disagree reject each other's. EnvWindow = "NB_CERT_CHALLENGE_WINDOW" // NonceSize is the length of every nonce a Challenger issues. NonceSize = nonceLen )
const ( SigAlgECDSASHA256 = "ecdsa-sha256" SigAlgECDSASHA384 = "ecdsa-sha384" SigAlgRSAPSSSHA256 = "rsa-pss-sha256" SigAlgEd25519 = "ed25519" )
Variables ¶
var ( ErrNonceMalformed = errors.New("certificate challenge nonce is malformed") ErrNonceExpired = errors.New("certificate challenge nonce is expired") ErrNonceMismatch = errors.New("certificate challenge nonce was not issued to this peer") )
var ( ErrUnsupportedKey = errors.New("unsupported certificate key") ErrEmptyChain = errors.New("certificate chain is empty") ErrSignatureInvalid = errors.New("certificate proof signature is invalid") ErrSigAlgMismatch = errors.New("signature algorithm does not match the certificate key") )
var ErrNoCertificateInPEM = errors.New("no certificate found in PEM data")
Functions ¶
func AnyChainMatchesCAs ¶
AnyChainMatchesCAs reports whether at least one of the peer's verified chains is anchored in one of the configured CAs.
func ChainMatchesCAs ¶
ChainMatchesCAs is VerifyChain over the PEM forms stored in peer meta and check config.
func EffectiveWindow ¶
EffectiveWindow returns the challenge window in force, which is Window unless EnvWindow overrides it. Everything timed against the window derives from this, so a test that shortens it shortens the renewal that goes with it.
func EncodeChainPEM ¶
func EncodeChainPEM(chain []*x509.Certificate) string
func NonceAcceptedAlongside ¶
NonceAcceptedAlongside reports whether a proof answering nonce is still accepted while management issues current to the same peer, by the same window rule verification uses.
func ParseChainPEM ¶
func ParseChainPEM(chainPEM string) ([]*x509.Certificate, error)
func Sign ¶
Sign produces the proof signature for a nonce using the leaf's private key. The key never leaves the signer, which may be backed by a file, a TPM or an OS keystore.
func VerifiedChain ¶
func VerifiedChain(leaf *x509.Certificate, intermediates []*x509.Certificate, roots *x509.CertPool, now time.Time) ([]*x509.Certificate, error)
VerifiedChain finds a path from leaf to one of roots through any of intermediates, trying every candidate issuer rather than the first that matches, and returns it without the root, leaf first. It applies the same rules as VerifyChain.
func VerifyChain ¶
VerifyChain reports whether the leaf (chain[0]) chains to one of roots using the remaining certificates as intermediates.
Types ¶
type Challenger ¶
type Challenger struct {
// contains filtered or unexported fields
}
Challenger issues and verifies stateless per-peer nonces. A nonce is bound to the peer and to a time window, so any instance sharing the secret can verify it.
func NewChallenger ¶
func NewChallenger(secret []byte) *Challenger
func (*Challenger) Verify ¶
func (c *Challenger) Verify(proof Proof, peerKey []byte, now time.Time) ([]*x509.Certificate, error)
Verify checks that the proof's nonce was issued by this challenger to peerKey and is still fresh, and that the signature validates against the leaf's public key. It returns the parsed chain on success. Chain trust is deliberately not evaluated here.
Source Files
Directories