Documentation
¶
Overview ¶
Package tlsbackend provides HTTPS backends that require a client certificate and report the subject of the one they received, for the gateway's outbound mutual TLS.
Each backend serves its own server certificate and accepts client certificates that chain to its own authorities. A request without a certificate, or with one that does not verify, is answered 400 without a subject, as a web server that requires client certificates does. An accepted request is answered 200 with the subject in the X-Client-Subject header and in the body. Responses derive from the request alone, so the service is stateless.
The certificates and authorities arrive in one environment variable, generated by the test process so the gateway identities it uploads and the authorities a backend trusts come from the same run.
Index ¶
Constants ¶
const ( PortA = 8443 PortB = 8444 PortWrongHost = 8445 PortOptional = 8446 )
Container ports of the backends.
const EnvBackends = "TESTBENCH_TLS_BACKENDS"
EnvBackends names the environment variable that carries the backends. When it is set, the testbench serves these backends and nothing else.
const HeaderClientSubject = "X-Client-Subject"
HeaderClientSubject carries the subject of the accepted client certificate.
const HeaderClientVerified = "X-Client-Verified"
HeaderClientVerified carries "true" or "false" in optional mode: whether the presented client certificate verified against the backend's client authorities.
const HeaderCloseConnection = "X-Close-Connection"
HeaderCloseConnection, set to "true" on a request, makes the backend close the connection after answering, so the next request reaches it on a connection dialled afresh.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Backend ¶
type Backend struct {
// Name identifies the backend in responses and logs, for example "a".
Name string `json:"name"`
// Port is the container port it listens on.
Port int `json:"port"`
// Certificate is the server certificate, followed by any issuing intermediates.
Certificate string `json:"certificate"`
// PrivateKey is the server certificate's key.
PrivateKey string `json:"privateKey"`
// ClientCAs are the authorities a client certificate must chain to.
ClientCAs string `json:"clientCAs"`
// Optional makes the backend request a client certificate without requiring one: it
// always answers 200 and reports the subject of whatever leaf certificate was presented,
// verified or not, in X-Client-Subject and the body, and whether it verified against the
// backend's client authorities in X-Client-Verified and the body. An empty subject and
// false mean none was presented.
Optional bool `json:"optional,omitempty"`
}
Backend is one HTTPS backend as the environment carries it.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service is one HTTPS backend.
func New ¶
New builds a backend, refusing one without a name, port, server certificate or authority.
Source Files