Documentation
¶
Index ¶
- func AbsSocketPaths(addrs []string) ([]string, error)
- func IsUnixSocketPath(addr string) bool
- func LoadCACertPool(caFile string) (*x509.CertPool, error)
- func LoadClientCert(certFile, keyFile string) (tls.Certificate, error)
- func NewMultiAddrListener(network, address string, opts ListenerOptions) (net.Listener, error)
- func NewMultiAddrTLSListener(network, address string, ...) (net.Listener, error)
- func NewMultiAddrTLSListenerWithOptions(network, address string, tlsOpts TLSOptions, opts ListenerOptions) (net.Listener, error)
- func RequireSecureTransport(address string, hasMTLS bool) error
- func ResolveHostnameIPs(address string) ([]string, error)
- type CertStorage
- type ListenerOptions
- type MultiListener
- type TLSOptions
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AbsSocketPaths ¶
func IsUnixSocketPath ¶
func LoadCACertPool ¶
LoadCACertPool loads a PEM-encoded CA bundle for verifying a peer's certificate on an outbound connection (the server's cert, from a client's perspective) or, on an inbound mTLS listener, a connecting client's certificate.
func LoadClientCert ¶
func LoadClientCert(certFile, keyFile string) (tls.Certificate, error)
LoadClientCert loads a client certificate/key pair for presenting on an outbound mTLS connection
func NewMultiAddrListener ¶
func NewMultiAddrListener(network, address string, opts ListenerOptions) (net.Listener, error)
func NewMultiAddrTLSListener ¶
func NewMultiAddrTLSListener(network, address string, getCertificateFunc func(*tls.ClientHelloInfo) (*tls.Certificate, error), opts ListenerOptions) (net.Listener, error)
NewMultiAddrTLSListener creates TLS listeners for all IP addresses that the hostname in the address resolves to. Similar to NewMultiAddrListener but with TLS.
func NewMultiAddrTLSListenerWithOptions ¶
func NewMultiAddrTLSListenerWithOptions(network, address string, tlsOpts TLSOptions, opts ListenerOptions) (net.Listener, error)
NewMultiAddrTLSListenerWithOptions is NewMultiAddrTLSListener with control over client-certificate verification (mTLS), for listeners — such as the standalone IAM service's private endpoints — that must authenticate the connecting client, not just the server.
func RequireSecureTransport ¶
RequireSecureTransport enforces mTLS or unix socket a unix socket is always acceptable (the filesystem is the trust boundary), but a TCP address is only acceptable when mTLS (a server cert plus mandatory client-certificate verification) is actually configured for it
func ResolveHostnameIPs ¶
Types ¶
type CertStorage ¶
type CertStorage struct {
// contains filtered or unexported fields
}
func NewCertStorage ¶
func NewCertStorage() *CertStorage
func (*CertStorage) GetCertificate ¶
func (cs *CertStorage) GetCertificate(_ *tls.ClientHelloInfo) (*tls.Certificate, error)
func (*CertStorage) SetCertificate ¶
func (cs *CertStorage) SetCertificate(certFile string, keyFile string) error
type ListenerOptions ¶
type MultiListener ¶
type MultiListener struct {
// contains filtered or unexported fields
}
MultiListener implements net.Listener and accepts connections from multiple underlying listeners.
func NewMultiListener ¶
func NewMultiListener(listeners ...net.Listener) *MultiListener
func (*MultiListener) Addr ¶
func (ml *MultiListener) Addr() net.Addr
func (*MultiListener) Close ¶
func (ml *MultiListener) Close() error
type TLSOptions ¶
type TLSOptions struct {
GetCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error)
ClientCAs *x509.CertPool
RequireClientCert bool
}
TLSOptions configures the server-side tls.Config for NewMultiAddrTLSListenerWithOptions. A non-nil ClientCAs enables mTLS: inbound connections must present a certificate verified against that pool
Source Files