security

Documentation

Overview

Package security implements security-related features such as signature creation and verification, secrets processing etc.

Index

• func Decrypt(src io.Reader, key PrivateKey) (*bytes.Buffer, error)
• func DecryptRequest(key PrivateKey) func(next http.Handler) http.Handler
• func Encrypt(src io.Reader, key PublicKey) (*bytes.Buffer, error)
• func FilterRequest(trustedSubnet *net.IPNet) func(next http.Handler) http.Handler
• func UnaryRequestsFilter(trustedSubnet *net.IPNet) grpc.UnaryServerInterceptor
• type DatabaseURL
  • func (u DatabaseURL) String() string
• type PrivateKey
  • func NewPrivateKey(path entity.FilePath) (PrivateKey, error)
• type PublicKey
  • func NewPublicKey(path entity.FilePath) (PublicKey, error)
• type Secret
  • func (s *Secret) Set(src string) error
  • func (s Secret) String() string
  • func (s Secret) Type() string
• type Signer
  • func NewSigner(secret Secret) *Signer
  • func (s *Signer) CalculateRecordSignature(data storage.Record) (string, error)
  • func (s *Signer) CalculateSignature(name string, data metrics.Metric) (string, error)
  • func (s *Signer) VerifyRecordSignature(data storage.Record, hash string) (bool, error)
  • func (s *Signer) VerifySignature(name string, data metrics.Metric, hash string) (bool, error)

Functions

func Decrypt

func Decrypt(src io.Reader, key PrivateKey) (*bytes.Buffer, error)

Decrypt decrypts the provided message using RSA algorithm.

func DecryptRequest

func DecryptRequest(key PrivateKey) func(next http.Handler) http.Handler

DecryptRequest is a HTTP middleware that decrypts request's body using RSA algorithm.

func Encrypt

func Encrypt(src io.Reader, key PublicKey) (*bytes.Buffer, error)

Encrypt encrypts the provided message with RSA algorithm.

func FilterRequest

func FilterRequest(trustedSubnet *net.IPNet) func(next http.Handler) http.Handler

FilterRequest is a HTTP middleware that rejects requests which don't match trusted subnet.

func UnaryRequestsFilter

func UnaryRequestsFilter(
	trustedSubnet *net.IPNet,
) grpc.UnaryServerInterceptor

UnaryRequestsFilter is grpc unary interceptor that rejects requests which don't match trusted subnet.

Types

type DatabaseURL

type DatabaseURL string

A DatabaseURL is designed to store database connection URLs and avoid leaking of login and password values during logging.

func (DatabaseURL) String

func (u DatabaseURL) String() string

String returns masked representation of stored value.

type PrivateKey

type PrivateKey *rsa.PrivateKey

PrivateKey is RSA key used to decrypt data.

func NewPrivateKey

func NewPrivateKey(path entity.FilePath) (PrivateKey, error)

NewPrivateKey reads RSA private key from file.

type PublicKey

type PublicKey *rsa.PublicKey

PublicKey is RSA key used to encrypt data.

func NewPublicKey

func NewPublicKey(path entity.FilePath) (PublicKey, error)

NewPublicKey reads RSA public key from file.

type Secret

type Secret string

A Secret is designed to store sensitive data (e.g. passwords) and avoid leaking of values during logging.

func (*Secret) Set

func (s *Secret) Set(src string) error

Set assigns provided value to Secret.

func (Secret) String

func (s Secret) String() string

String returns masked representation of stored value. Required by pflags interface.

func (Secret) Type

func (s Secret) Type() string

Type returns underlying type used to store NetAddress value. Required by pflags interface.

type Signer

type Signer struct {
	// contains filtered or unexported fields
}

A Signer provides signature generation and verification functionality.

func NewSigner

func NewSigner(secret Secret) *Signer

NewSigner creates new Signer object with the given secret. The secret is used to generate/verify payload signature.

func (*Signer) CalculateRecordSignature

func (s *Signer) CalculateRecordSignature(data storage.Record) (string, error)

CalculateRecordSignature generates signature for provided record.

func (*Signer) CalculateSignature

func (s *Signer) CalculateSignature(name string, data metrics.Metric) (string, error)

CalculateSignature generates signature for provided payload.

func (*Signer) VerifyRecordSignature

func (s *Signer) VerifyRecordSignature(data storage.Record, hash string) (bool, error)

VerifyRecordSignature checks signature of provided record.

func (*Signer) VerifySignature

func (s *Signer) VerifySignature(name string, data metrics.Metric, hash string) (bool, error)

VerifySignature checks signature of provided payload.