kdfhelper

package

v0.12.0 Latest Latest Go to latest Published: Sep 12, 2026 License: MIT Imports: 16 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/wentf9/xops-cli

Links

Open Source Insights

Documentation ¶

Rendered for

Overview ¶

Package kdfhelper defines the private, single-request KDF wire protocol. Linux execution uses a bounded same-binary worker before normal CLI startup.

Index ¶

Constants
Variables
func ServeFiles(in, out *os.File) (code int)
type Capabilities
type Deriver
type Request
- func ParseRequest(b []byte) (Request, error)
- func (r Request) MarshalBinary() ([]byte, error)
- func (r *Request) Zero()
type Response
- func ParseResponse(b []byte) (Response, error)
- func (r Response) MarshalBinary() ([]byte, error)
- func (r *Response) Zero()
type Runner
- func (r Runner) Capabilities() Capabilities
- func (r Runner) Derive(ctx context.Context, req Request) ([]byte, error)
type Status

Constants ¶

View Source

const (
	// MaxRequestBytes bounds the complete request before parsing or allocation.
	MaxRequestBytes = 2048
	// MaxResponseBytes bounds the complete response.
	MaxResponseBytes = 256
)

View Source

const PrivateArgument = "__xops_kdf_v1"

PrivateArgument selects a single-use worker before normal CLI initialization.

Variables ¶

View Source

var (
	// ErrProcess hides untrusted process output while preserving exit failures.
	ErrProcess = errors.New("private KDF process failed")
	// ErrUnsupported fails closed on platforms not natively validated.
	ErrUnsupported = errors.New("private KDF process is unsupported")
	// ErrResource indicates insufficient observable memory or an enforced limit failure.
	ErrResource = errors.New("private KDF resource unavailable")
)

View Source

var ErrProtocol = errors.New("invalid private KDF protocol frame")

ErrProtocol indicates an invalid frame without echoing potentially secret input.

Functions ¶

func ServeFiles ¶

func ServeFiles(in, out *os.File) (code int)

ServeFiles is the private process entry. It accepts only bounded pipes and returns an exit code without logging, loading configuration or printing secrets.

Types ¶

type Capabilities ¶

type Capabilities struct {
	HardMemoryLimit      bool
	MemoryObserved       bool
	AvailableMemoryBytes uint64
}

Capabilities distinguishes Go's soft target from a kernel-enforced memory limit.

type Deriver ¶

type Deriver interface {
	Derive(context.Context, Request) ([]byte, error)
}

Deriver permits deterministic session tests without doing KDF work in the host. Implementations honor ctx and transfer exclusive ownership of returned bytes, including on error; the caller may clear them immediately.

type Request ¶

type Request struct {
	Salt     [16]byte
	Password []byte
}

Request owns its password bytes; Zero must be called when they are no longer needed.

func ParseRequest ¶

func ParseRequest(b []byte) (Request, error)

ParseRequest validates all framing and KDF parameters before copying a password. The transport must separately ensure EOF, a deadline and the same byte limit.

func (Request) MarshalBinary ¶

func (r Request) MarshalBinary() ([]byte, error)

MarshalBinary emits the fixed approved parameters; callers must clear the frame.

func (*Request) Zero ¶

func (r *Request) Zero()

Zero clears the owned password, leaving only public metadata.

type Response ¶

type Response struct {
	Status Status
	Key    []byte
}

Response owns a key only on success. Process status must still be checked.

func ParseResponse ¶

func ParseResponse(b []byte) (Response, error)

ParseResponse rejects trailing data, unknown statuses and keys on failure frames.

func (Response) MarshalBinary ¶

func (r Response) MarshalBinary() ([]byte, error)

MarshalBinary emits one bounded response. The caller must clear the output.

func (*Response) Zero ¶

func (r *Response) Zero()

Zero clears the owned derived key.

type Runner ¶

type Runner struct {
	Timeout      time.Duration
	CgroupParent string
}

Runner launches the current binary, with a bounded process lifetime. An explicit delegated cgroup directory can enforce the provisional 128 MiB limit on Linux. Empty CgroupParent never elevates privileges and reports a soft-only capability.

func (Runner) Capabilities ¶

func (r Runner) Capabilities() Capabilities

Capabilities reports requested enforcement; Derive fails if it cannot establish it.

func (Runner) Derive ¶

func (r Runner) Derive(ctx context.Context, req Request) ([]byte, error)

Derive accepts a response only after clean EOF, zero exit and live context.

type Status ¶

type Status byte

Status is a fixed, non-textual response classification.

const (
	// Success must also be accompanied by a successful process exit.
	Success Status = iota
	// InvalidRequest indicates malformed input.
	InvalidRequest
	// UnsupportedVersion indicates a protocol version mismatch.
	UnsupportedVersion
	// ResourceFailure indicates a reliably identified resource failure.
	ResourceFailure
	// InternalFailure indicates other helper failure.
	InternalFailure
)

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL