agentsign

package

v0.5.1 Latest Latest Go to latest Published: Aug 16, 2026 License: GPL-2.0 Imports: 25 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/tech-arch1tect/berth-agent

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func BodyDigest(body []byte) string
func Canonical(fields ...string) []byte
func CertificateIdentity(certPEM []byte) (string, error)
func LoadMaterial(certDir string) (*Verifier, *Responder, error)
func Middleware(verifier *Verifier, responder *Responder, maxBodyBytes int64, ...) echo.MiddlewareFunc
func ReadBody(req *http.Request, limit int64) ([]byte, error)
func RequestBase(audience, method, target, contentType, bodyDigest string, timestamp int64, ...) []byte
func ResponseBase(requestNonce string, status int, contentType string, bodyDigest string, ...) []byte
func SessionFor(c echo.Context, direction string) (*FrameWriter, *FrameReader, error)
func SessionKey(local *ecdsa.PrivateKey, remote *ecdsa.PublicKey, salt string) ([]byte, error)
func SignResponses(responder *Responder) echo.MiddlewareFunc
func SignUpgradeResponses(responder *Responder) echo.MiddlewareFunc
func VerifyBody(req *http.Request, body []byte) error
type BodyWriter
- func NewBodyWriter(writer io.Writer, key []byte) *BodyWriter
- func (w *BodyWriter) Close() error
- func (w *BodyWriter) Write(payload []byte) (int, error)
type FrameReader
- func NewFrameReader(key []byte, direction string) *FrameReader
- func (r *FrameReader) Unwrap(frame []byte) ([]byte, error)
- func (r *FrameReader) UnwrapTyped(frame []byte) (byte, []byte, error)
type FrameWriter
- func NewFrameWriter(key []byte, direction string) *FrameWriter
- func (w *FrameWriter) SendTyped(kind byte, payload []byte, deliver func([]byte) error) error
- func (w *FrameWriter) Wrap(payload []byte) []byte
- func (w *FrameWriter) WrapTyped(kind byte, payload []byte) []byte
type Responder
- func NewResponder(certPEM, keyPEM []byte) (*Responder, error)
- func (r *Responder) SessionKeyFor(peer *x509.Certificate, salt string) ([]byte, error)
type Verifier
- func NewVerifier(authorityPEM []byte, identity string, skew time.Duration) (*Verifier, error)
- func (v *Verifier) VerifyRequest(req *http.Request) (*x509.Certificate, error)

Constants ¶

View Source

const (
	HeaderSignature   = "X-Berth-Signature"
	HeaderCertificate = "X-Berth-Certificate"
	HeaderTimestamp   = "X-Berth-Timestamp"
	HeaderNonce       = "X-Berth-Nonce"
	HeaderBodyDigest  = "X-Berth-Body-Digest"

	RequestContext  = "berth-request-v1"
	ResponseContext = "berth-response-v1"
	ServerIdentity  = "berth-server"

	BodyUnsigned = "unsigned"
	BodyFramed   = "framed"

	FrameBodyBeyond = 1024 * 1024
)

View Source

const (
	AuthorityFileName   = "ca.crt"
	CertificateFileName = "agent.crt"
	KeyFileName         = "agent.key"
	DefaultSkew         = time.Minute
)

View Source

const (
	StreamContext = "berth-stream-v1"

	DirectionToAgent     = "to-agent"
	DirectionToBerth     = "to-berth"
	DirectionBodyToBerth = "body-to-berth"
)

Variables ¶

View Source

var ErrFrameRejected = errors.New("stream frame rejected")

View Source

var ErrRejected = errors.New("request signature rejected")

Functions ¶

func BodyDigest ¶

func BodyDigest(body []byte) string

func Canonical ¶

func Canonical(fields ...string) []byte

func CertificateIdentity ¶

func CertificateIdentity(certPEM []byte) (string, error)

func LoadMaterial ¶

func LoadMaterial(certDir string) (*Verifier, *Responder, error)

func Middleware ¶

func Middleware(verifier *Verifier, responder *Responder, maxBodyBytes int64, logger *logging.Logger) echo.MiddlewareFunc

func ReadBody ¶

func ReadBody(req *http.Request, limit int64) ([]byte, error)

func RequestBase ¶

func RequestBase(audience, method, target, contentType, bodyDigest string, timestamp int64, nonce string) []byte

func ResponseBase ¶

func ResponseBase(requestNonce string, status int, contentType string, bodyDigest string, timestamp int64) []byte

func SessionFor ¶

func SessionFor(c echo.Context, direction string) (*FrameWriter, *FrameReader, error)

func SessionKey ¶

func SessionKey(local *ecdsa.PrivateKey, remote *ecdsa.PublicKey, salt string) ([]byte, error)

func SignResponses ¶

func SignResponses(responder *Responder) echo.MiddlewareFunc

func SignUpgradeResponses ¶

func SignUpgradeResponses(responder *Responder) echo.MiddlewareFunc

func VerifyBody ¶

func VerifyBody(req *http.Request, body []byte) error

Types ¶

type BodyWriter ¶

type BodyWriter struct {
	// contains filtered or unexported fields
}

func NewBodyWriter ¶

func NewBodyWriter(writer io.Writer, key []byte) *BodyWriter

func (*BodyWriter) Close ¶

func (w *BodyWriter) Close() error

func (*BodyWriter) Write ¶

func (w *BodyWriter) Write(payload []byte) (int, error)

type FrameReader ¶

type FrameReader struct {
	// contains filtered or unexported fields
}

func NewFrameReader ¶

func NewFrameReader(key []byte, direction string) *FrameReader

func (*FrameReader) Unwrap ¶

func (r *FrameReader) Unwrap(frame []byte) ([]byte, error)

func (*FrameReader) UnwrapTyped ¶

func (r *FrameReader) UnwrapTyped(frame []byte) (byte, []byte, error)

type FrameWriter ¶

type FrameWriter struct {
	// contains filtered or unexported fields
}

func NewFrameWriter ¶

func NewFrameWriter(key []byte, direction string) *FrameWriter

func (*FrameWriter) SendTyped ¶

func (w *FrameWriter) SendTyped(kind byte, payload []byte, deliver func([]byte) error) error

func (*FrameWriter) Wrap ¶

func (w *FrameWriter) Wrap(payload []byte) []byte

func (*FrameWriter) WrapTyped ¶

func (w *FrameWriter) WrapTyped(kind byte, payload []byte) []byte

type Responder ¶

type Responder struct {
	// contains filtered or unexported fields
}

func NewResponder ¶

func NewResponder(certPEM, keyPEM []byte) (*Responder, error)

func (*Responder) SessionKeyFor ¶

func (r *Responder) SessionKeyFor(peer *x509.Certificate, salt string) ([]byte, error)

type Verifier ¶

type Verifier struct {
	// contains filtered or unexported fields
}

func NewVerifier ¶

func NewVerifier(authorityPEM []byte, identity string, skew time.Duration) (*Verifier, error)

func (*Verifier) VerifyRequest ¶

func (v *Verifier) VerifyRequest(req *http.Request) (*x509.Certificate, error)

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL