Documentation
¶
Index ¶
- func AbsSocketPaths(addrs []string) ([]string, error)
- func IsUnixSocketPath(addr string) bool
- func LoadCACertPool(caFile string) (*x509.CertPool, error)
- func LoadClientCert(certFile, keyFile string) (tls.Certificate, error)
- func NewMultiAddrListener(network, address string, opts ListenerOptions) (net.Listener, error)
- func NewMultiAddrTLSListener(network, address string, ...) (net.Listener, error)
- func NewMultiAddrTLSListenerWithOptions(network, address string, tlsOpts TLSOptions, opts ListenerOptions) (net.Listener, error)
- func RequireSecureTransport(address string, hasMTLS bool) error
- func ResolveHostnameIPs(address string) ([]string, error)
- type CAPoolStorage
- type CertStorage
- type ListenerOptions
- type MultiListener
- type TLSOptions
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AbsSocketPaths ¶
func IsUnixSocketPath ¶
func LoadCACertPool ¶
LoadCACertPool loads a PEM-encoded CA bundle for verifying a peer's certificate on an outbound connection (the server's cert, from a client's perspective) or, on an inbound mTLS listener, a connecting client's certificate.
func LoadClientCert ¶
func LoadClientCert(certFile, keyFile string) (tls.Certificate, error)
LoadClientCert loads a client certificate/key pair for presenting on an outbound mTLS connection
func NewMultiAddrListener ¶
func NewMultiAddrListener(network, address string, opts ListenerOptions) (net.Listener, error)
func NewMultiAddrTLSListener ¶
func NewMultiAddrTLSListener(network, address string, getCertificateFunc func(*tls.ClientHelloInfo) (*tls.Certificate, error), opts ListenerOptions) (net.Listener, error)
NewMultiAddrTLSListener creates TLS listeners for all IP addresses that the hostname in the address resolves to. Similar to NewMultiAddrListener but with TLS.
func NewMultiAddrTLSListenerWithOptions ¶
func NewMultiAddrTLSListenerWithOptions(network, address string, tlsOpts TLSOptions, opts ListenerOptions) (net.Listener, error)
NewMultiAddrTLSListenerWithOptions is NewMultiAddrTLSListener with control over client-certificate verification (mTLS), for listeners — such as the standalone IAM service's private endpoints — that must authenticate the connecting client, not just the server.
func RequireSecureTransport ¶
RequireSecureTransport enforces mTLS or unix socket a unix socket is always acceptable (the filesystem is the trust boundary), but a TCP address is only acceptable when mTLS (a server cert plus mandatory client-certificate verification) is actually configured for it
func ResolveHostnameIPs ¶
Types ¶
type CAPoolStorage ¶ added in v1.9.0
type CAPoolStorage struct {
// contains filtered or unexported fields
}
CAPoolStorage is CertStorage's counterpart for the CA bundle that verifies a peer: it holds the pool loaded from a file, and SetCAPool swaps in a reloaded one without disturbing connections already verified.
func NewCAPoolStorage ¶ added in v1.9.0
func NewCAPoolStorage() *CAPoolStorage
func (*CAPoolStorage) GetCAPool ¶ added in v1.9.0
func (cs *CAPoolStorage) GetCAPool() *x509.CertPool
func (*CAPoolStorage) SetCAPool ¶ added in v1.9.0
func (cs *CAPoolStorage) SetCAPool(caFile string) error
SetCAPool loads caFile and makes it the current pool. On error the previous pool stays in place.
type CertStorage ¶
type CertStorage struct {
// contains filtered or unexported fields
}
func NewCertStorage ¶
func NewCertStorage() *CertStorage
func (*CertStorage) GetCertificate ¶
func (cs *CertStorage) GetCertificate(_ *tls.ClientHelloInfo) (*tls.Certificate, error)
func (*CertStorage) SetCertificate ¶
func (cs *CertStorage) SetCertificate(certFile string, keyFile string) error
type ListenerOptions ¶
type MultiListener ¶
type MultiListener struct {
// contains filtered or unexported fields
}
MultiListener implements net.Listener and accepts connections from multiple underlying listeners.
func NewMultiListener ¶
func NewMultiListener(listeners ...net.Listener) *MultiListener
func (*MultiListener) Addr ¶
func (ml *MultiListener) Addr() net.Addr
func (*MultiListener) Addrs ¶ added in v1.9.0
func (ml *MultiListener) Addrs() []net.Addr
Addrs returns the address of every underlying listener, in the order the listeners were given, expanding nested MultiListeners. Unlike Addr, which reports only the first, this covers every address the MultiListener accepts on -- including the ports the kernel chose for specifications that asked for port 0.
func (*MultiListener) Close ¶
func (ml *MultiListener) Close() error
type TLSOptions ¶
type TLSOptions struct {
GetCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error)
GetClientCAs func() *x509.CertPool
RequireClientCert bool
}
TLSOptions configures the server-side tls.Config for NewMultiAddrTLSListenerWithOptions. A non-nil GetClientCAs enables mTLS: inbound connections must present a certificate verified against the pool it returns, which is fetched again for every handshake so a reloaded CA bundle applies to the next connection.
Source Files