tlsutil

Documentation

Index

• func GenerateCA(opts CAOpts) (string, string, error)
• func GenerateCert(opts CertOpts) (string, string, error)
• func GeneratePrivateKey() (crypto.Signer, string, error)
• func GenerateSerialNumber() (*big.Int, error)
• func ParseCert(pemValue string) (*x509.Certificate, error)
• func ParseCiphers(tlsConfig *config.TLSConfig) ([]uint16, error)
• func ParseMinVersion(version string) (uint16, error)
• func ParseSigner(pemValue string) (crypto.Signer, error)
• func ShouldReloadRPCConnections(old, new *config.TLSConfig) (bool, error)
• func Verify(caString, certString, dns string) error
• func WrapTLSClient(conn net.Conn, tlsConfig *tls.Config) (net.Conn, error)
• type CAOpts
• type CertOpts
• type Config
  • func NewTLSConfiguration(newConf *config.TLSConfig, verifyIncoming, verifyOutgoing bool) (*Config, error)
  • func (c *Config) AppendCA(pool *x509.CertPool) error
  • func (c *Config) IncomingTLSConfig() (*tls.Config, error)
  • func (c *Config) LoadKeyPair() (*tls.Certificate, error)
  • func (c *Config) OutgoingTLSConfig() (*tls.Config, error)
  • func (c *Config) OutgoingTLSWrapper() (RegionWrapper, error)
• type RegionWrapper
• type Wrapper
  • func RegionSpecificWrapper(region string, tlsWrap RegionWrapper) Wrapper

Functions

func GenerateCA

func GenerateCA(opts CAOpts) (string, string, error)

GenerateCA generates a new CA for agent TLS (not to be confused with Connect TLS)

func GenerateCert

func GenerateCert(opts CertOpts) (string, string, error)

GenerateCert generates a new certificate for agent TLS (not to be confused with Connect TLS)

func GeneratePrivateKey

func GeneratePrivateKey() (crypto.Signer, string, error)

GeneratePrivateKey generates a new ecdsa private key

func GenerateSerialNumber

func GenerateSerialNumber() (*big.Int, error)

GenerateSerialNumber returns random bigint generated with crypto/rand

func ParseCert

func ParseCert(pemValue string) (*x509.Certificate, error)

ParseCert parses the x509 certificate from a PEM-encoded value.

func ParseCiphers

func ParseCiphers(tlsConfig *config.TLSConfig) ([]uint16, error)

ParseCiphers parses ciphersuites from the comma-separated string into recognized slice

func ParseMinVersion

func ParseMinVersion(version string) (uint16, error)

ParseMinVersion parses the specified minimum TLS version for the Nomad agent

func ParseSigner

func ParseSigner(pemValue string) (crypto.Signer, error)

ParseSigner parses a crypto.Signer from a PEM-encoded key. The private key is expected to be the first block in the PEM value.

func ShouldReloadRPCConnections

func ShouldReloadRPCConnections(old, new *config.TLSConfig) (bool, error)

ShouldReloadRPCConnections compares two TLS Configurations and determines whether they differ such that RPC connections should be reloaded

func Verify

func Verify(caString, certString, dns string) error

func WrapTLSClient

func WrapTLSClient(conn net.Conn, tlsConfig *tls.Config) (net.Conn, error)

WrapTLSClient wraps a net.Conn into a client tls connection, performing any additional verification as needed.

As of go 1.3, crypto/tls only supports either doing no certificate verification, or doing full verification including of the peer's DNS name. For consul, we want to validate that the certificate is signed by a known CA, but because consul doesn't use DNS names for node names, we don't verify the certificate DNS names. Since go 1.3 no longer supports this mode of operation, we have to do it manually.

Types

type CAOpts

type CAOpts struct {
	Signer              crypto.Signer
	Serial              *big.Int
	Days                int
	PermittedDNSDomains []string
	Domain              string
	Name                string
}

type CertOpts

type CertOpts struct {
	Signer      crypto.Signer
	CA          string
	Serial      *big.Int
	Name        string
	Days        int
	DNSNames    []string
	IPAddresses []net.IP
	ExtKeyUsage []x509.ExtKeyUsage
}

type Config

type Config struct {
	// VerifyIncoming is used to verify the authenticity of incoming connections.
	// This means that TCP requests are forbidden, only allowing for TLS. TLS connections
	// must match a provided certificate authority. This can be used to force client auth.
	VerifyIncoming bool

	// VerifyOutgoing is used to verify the authenticity of outgoing connections.
	// This means that TLS requests are used, and TCP requests are not made. TLS connections
	// must match a provided certificate authority. This is used to verify authenticity of
	// server nodes.
	VerifyOutgoing bool

	// VerifyServerHostname is used to enable hostname verification of servers. This
	// ensures that the certificate presented is valid for server.<datacenter>.<domain>.
	// This prevents a compromised client from being restarted as a server, and then
	// intercepting request traffic as well as being added as a raft peer. This should be
	// enabled by default with VerifyOutgoing, but for legacy reasons we cannot break
	// existing clients.
	VerifyServerHostname bool

	// CAFile is a path to a certificate authority file. This is used with VerifyIncoming
	// or VerifyOutgoing to verify the TLS connection.
	CAFile string

	// CertFile is used to provide a TLS certificate that is used for serving TLS connections.
	// Must be provided to serve TLS connections.
	CertFile string

	// KeyFile is used to provide a TLS key that is used for serving TLS connections.
	// Must be provided to serve TLS connections.
	KeyFile string

	// KeyLoader dynamically reloads TLS configuration.
	KeyLoader *config.KeyLoader

	// CipherSuites have a default safe configuration, or operators can override
	// these values for acceptable safe alternatives.
	CipherSuites []uint16

	// PreferServerCipherSuites controls whether the server selects the
	// client's most preferred ciphersuite, or the server's most preferred
	// ciphersuite. If true then the server's preference, as expressed in
	// the order of elements in CipherSuites, is used.
	PreferServerCipherSuites bool

	// MinVersion contains the minimum SSL/TLS version that is accepted.
	MinVersion uint16
}

Config used to create tls.Config

func NewTLSConfiguration

func NewTLSConfiguration(newConf *config.TLSConfig, verifyIncoming, verifyOutgoing bool) (*Config, error)

func (*Config) AppendCA

func (c *Config) AppendCA(pool *x509.CertPool) error

AppendCA opens and parses the CA file and adds the certificates to the provided CertPool.

func (*Config) IncomingTLSConfig

func (c *Config) IncomingTLSConfig() (*tls.Config, error)

IncomingTLSConfig generates a TLS configuration for incoming requests

func (*Config) LoadKeyPair

func (c *Config) LoadKeyPair() (*tls.Certificate, error)

LoadKeyPair is used to open and parse a certificate and key file

func (*Config) OutgoingTLSConfig

func (c *Config) OutgoingTLSConfig() (*tls.Config, error)

OutgoingTLSConfig generates a TLS configuration for outgoing requests. It will return a nil config if this configuration should not use TLS for outgoing connections. Provides a callback to fetch certificates, allowing for reloading on the fly.

func (*Config) OutgoingTLSWrapper

func (c *Config) OutgoingTLSWrapper() (RegionWrapper, error)

OutgoingTLSWrapper returns a a Wrapper based on the OutgoingTLS configuration. If hostname verification is on, the wrapper will properly generate the dynamic server name for verification.

type RegionWrapper

type RegionWrapper func(region string, conn net.Conn) (net.Conn, error)

RegionWrapper is a function that is used to wrap a non-TLS connection and returns an appropriate TLS connection or error. This takes a Region as an argument.

type Wrapper

type Wrapper func(conn net.Conn) (net.Conn, error)

Wrapper wraps a connection and enables TLS on it.

func RegionSpecificWrapper

func RegionSpecificWrapper(region string, tlsWrap RegionWrapper) Wrapper

RegionSpecificWrapper is used to invoke a static Region and turns a RegionWrapper into a Wrapper type.