tls

package
v2.0.0-...-29d9702 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 26, 2020 License: MIT Imports: 19 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// MinVersion Map of allowed TLS minimum versions
	MinVersion = map[string]uint16{
		`VersionTLS10`: tls.VersionTLS10,
		`VersionTLS11`: tls.VersionTLS11,
		`VersionTLS12`: tls.VersionTLS12,
		`VersionTLS13`: tls.VersionTLS13,
	}

	// MaxVersion Map of allowed TLS maximum versions
	MaxVersion = map[string]uint16{
		`VersionTLS10`: tls.VersionTLS10,
		`VersionTLS11`: tls.VersionTLS11,
		`VersionTLS12`: tls.VersionTLS12,
		`VersionTLS13`: tls.VersionTLS13,
	}

	// CurveIDs is a Map of TLS elliptic curves from crypto/tls
	// Available CurveIDs defined at https://godoc.org/crypto/tls#CurveID,
	// also allowing rfc names defined at https://tools.ietf.org/html/rfc8446#section-4.2.7
	CurveIDs = map[string]tls.CurveID{
		`secp256r1`: tls.CurveP256,
		`CurveP256`: tls.CurveP256,
		`secp384r1`: tls.CurveP384,
		`CurveP384`: tls.CurveP384,
		`secp521r1`: tls.CurveP521,
		`CurveP521`: tls.CurveP521,
		`x25519`:    tls.X25519,
		`X25519`:    tls.X25519,
	}
)
View Source 
var (
	// CipherSuites Map of TLS CipherSuites from crypto/tls
	// Available CipherSuites defined at https://golang.org/pkg/crypto/tls/#pkg-constants
	CipherSuites = map[string]uint16{
		`TLS_RSA_WITH_RC4_128_SHA`:                tls.TLS_RSA_WITH_RC4_128_SHA,
		`TLS_RSA_WITH_3DES_EDE_CBC_SHA`:           tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
		`TLS_RSA_WITH_AES_128_CBC_SHA`:            tls.TLS_RSA_WITH_AES_128_CBC_SHA,
		`TLS_RSA_WITH_AES_256_CBC_SHA`:            tls.TLS_RSA_WITH_AES_256_CBC_SHA,
		`TLS_RSA_WITH_AES_128_CBC_SHA256`:         tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
		`TLS_RSA_WITH_AES_128_GCM_SHA256`:         tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
		`TLS_RSA_WITH_AES_256_GCM_SHA384`:         tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
		`TLS_ECDHE_ECDSA_WITH_RC4_128_SHA`:        tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
		`TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`:    tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
		`TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`:    tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
		`TLS_ECDHE_RSA_WITH_RC4_128_SHA`:          tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
		`TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA`:     tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
		`TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`:      tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
		`TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`:      tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
		`TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`: tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
		`TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`:   tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
		`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`:   tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
		`TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`: tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
		`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`:   tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
		`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`: tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
		`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305`:    tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
		`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305`:  tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
		`TLS_AES_128_GCM_SHA256`:                  tls.TLS_AES_128_GCM_SHA256,
		`TLS_AES_256_GCM_SHA384`:                  tls.TLS_AES_256_GCM_SHA384,
		`TLS_CHACHA20_POLY1305_SHA256`:            tls.TLS_CHACHA20_POLY1305_SHA256,
		`TLS_FALLBACK_SCSV`:                       tls.TLS_FALLBACK_SCSV,
	}

	// CipherSuitesReversed Map of TLS CipherSuites from crypto/tls
	// Available CipherSuites defined at https://golang.org/pkg/crypto/tls/#pkg-constants
	CipherSuitesReversed = map[uint16]string{
		tls.TLS_RSA_WITH_RC4_128_SHA:                `TLS_RSA_WITH_RC4_128_SHA`,
		tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA:           `TLS_RSA_WITH_3DES_EDE_CBC_SHA`,
		tls.TLS_RSA_WITH_AES_128_CBC_SHA:            `TLS_RSA_WITH_AES_128_CBC_SHA`,
		tls.TLS_RSA_WITH_AES_256_CBC_SHA:            `TLS_RSA_WITH_AES_256_CBC_SHA`,
		tls.TLS_RSA_WITH_AES_128_CBC_SHA256:         `TLS_RSA_WITH_AES_128_CBC_SHA256`,
		tls.TLS_RSA_WITH_AES_128_GCM_SHA256:         `TLS_RSA_WITH_AES_128_GCM_SHA256`,
		tls.TLS_RSA_WITH_AES_256_GCM_SHA384:         `TLS_RSA_WITH_AES_256_GCM_SHA384`,
		tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA:        `TLS_ECDHE_ECDSA_WITH_RC4_128_SHA`,
		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:    `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`,
		tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:    `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`,
		tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA:          `TLS_ECDHE_RSA_WITH_RC4_128_SHA`,
		tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:     `TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA`,
		tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:      `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`,
		tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:      `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`,
		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`,
		tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:   `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`,
		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:   `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`,
		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`,
		tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:   `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`,
		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`,
		tls.TLS_AES_128_GCM_SHA256:                  `TLS_AES_128_GCM_SHA256`,
		tls.TLS_AES_256_GCM_SHA384:                  `TLS_AES_256_GCM_SHA384`,
		tls.TLS_CHACHA20_POLY1305_SHA256:            `TLS_CHACHA20_POLY1305_SHA256`,
		tls.TLS_FALLBACK_SCSV:                       `TLS_FALLBACK_SCSV`,
	}
)
View Source 
var DefaultTLSOptions = Options{}

DefaultTLSOptions the default TLS options.

Functions

func MatchDomain 

func MatchDomain(domain string, certDomain string) bool

MatchDomain return true if a domain match the cert domain

Types

type CertAndStores 

type CertAndStores struct {
	Certificate `yaml:",inline"`
	Stores      []string `json:"stores,omitempty" toml:"stores,omitempty" yaml:"stores,omitempty"`
}

CertAndStores allows mapping a TLS certificate to a list of entry points.

func (*CertAndStores) DeepCopy 

func (in *CertAndStores) DeepCopy() *CertAndStores

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertAndStores.

func (*CertAndStores) DeepCopyInto 

func (in *CertAndStores) DeepCopyInto(out *CertAndStores)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type Certificate 

type Certificate struct {
	CertFile FileOrContent `json:"certFile,omitempty" toml:"certFile,omitempty" yaml:"certFile,omitempty"`
	KeyFile  FileOrContent `json:"keyFile,omitempty" toml:"keyFile,omitempty" yaml:"keyFile,omitempty"`
}

Certificate holds a SSL cert/key pair Certs and Key could be either a file path, or the file content itself

func (*Certificate) AppendCertificate 

func (c *Certificate) AppendCertificate(certs map[string]map[string]*tls.Certificate, ep string) error

AppendCertificate appends a Certificate to a certificates map keyed by entrypoint.

func (*Certificate) GetTruncatedCertificateName 

func (c *Certificate) GetTruncatedCertificateName() string

GetTruncatedCertificateName truncates the certificate name

type CertificateStore 

type CertificateStore struct {
	DynamicCerts       *safe.Safe
	DefaultCertificate *tls.Certificate
	CertCache          *cache.Cache
}

CertificateStore store for dynamic and static certificates

func NewCertificateStore 

func NewCertificateStore() *CertificateStore

NewCertificateStore create a store for dynamic and static certificates

func (CertificateStore) GetAllDomains 

func (c CertificateStore) GetAllDomains() []string

GetAllDomains return a slice with all the certificate domain

func (CertificateStore) GetBestCertificate 

func (c CertificateStore) GetBestCertificate(clientHello *tls.ClientHelloInfo) *tls.Certificate

GetBestCertificate returns the best match certificate, and caches the response

func (CertificateStore) ResetCache 

func (c CertificateStore) ResetCache()

ResetCache clears the cache in the store

type Certificates 

type Certificates []Certificate

Certificates defines traefik certificates type Certs and Keys could be either a file path, or the file content itself

func (*Certificates) CreateTLSConfig 

func (c *Certificates) CreateTLSConfig(entryPointName string) (*tls.Config, error)

CreateTLSConfig creates a TLS config from Certificate structures

func (*Certificates) Set 

func (c *Certificates) Set(value string) error

Set is the method to set the flag value, part of the flag.Value interface. Set's argument is a string to be parsed to set the flag. It's a comma-separated list, so we split it.

func (*Certificates) String 

func (c *Certificates) String() string

String is the method to format the flag's value, part of the flag.Value interface. The String method's output will be used in diagnostics.

func (*Certificates) Type 

func (c *Certificates) Type() string

Type is type of the struct

type ClientAuth 

type ClientAuth struct {
	CAFiles []FileOrContent `json:"caFiles,omitempty" toml:"caFiles,omitempty" yaml:"caFiles,omitempty"`
	// ClientAuthType defines the client authentication type to apply.
	// The available values are: "NoClientCert", "RequestClientCert", "VerifyClientCertIfGiven" and "RequireAndVerifyClientCert".
	ClientAuthType string `json:"clientAuthType,omitempty" toml:"clientAuthType,omitempty" yaml:"clientAuthType,omitempty"`
}

ClientAuth defines the parameters of the client authentication part of the TLS connection, if any.

func (*ClientAuth) DeepCopy 

func (in *ClientAuth) DeepCopy() *ClientAuth

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientAuth.

func (*ClientAuth) DeepCopyInto 

func (in *ClientAuth) DeepCopyInto(out *ClientAuth)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type FileOrContent 

type FileOrContent string

FileOrContent hold a file path or content

func (FileOrContent) IsPath 

func (f FileOrContent) IsPath() bool

IsPath returns true if the FileOrContent is a file path, otherwise returns false

func (FileOrContent) Read 

func (f FileOrContent) Read() ([]byte, error)

func (FileOrContent) String 

func (f FileOrContent) String() string

type Manager 

type Manager struct {
	TLSAlpnGetter func(string) (*tls.Certificate, error)
	// contains filtered or unexported fields
}

Manager is the TLS option/store/configuration factory

func NewManager 

func NewManager() *Manager

NewManager creates a new Manager

func (*Manager) Get 

func (m *Manager) Get(storeName string, configName string) (*tls.Config, error)

Get gets the TLS configuration to use for a given store / configuration

func (*Manager) GetStore 

func (m *Manager) GetStore(storeName string) *CertificateStore

GetStore gets the certificate store of a given name

func (*Manager) UpdateConfigs 

func (m *Manager) UpdateConfigs(ctx context.Context, stores map[string]Store, configs map[string]Options, certs []*CertAndStores)

UpdateConfigs updates the TLS* configuration options

type Options 

type Options struct {
	MinVersion               string     `json:"minVersion,omitempty" toml:"minVersion,omitempty" yaml:"minVersion,omitempty" export:"true"`
	MaxVersion               string     `json:"maxVersion,omitempty" toml:"maxVersion,omitempty" yaml:"maxVersion,omitempty" export:"true"`
	CipherSuites             []string   `json:"cipherSuites,omitempty" toml:"cipherSuites,omitempty" yaml:"cipherSuites,omitempty"`
	CurvePreferences         []string   `json:"curvePreferences,omitempty" toml:"curvePreferences,omitempty" yaml:"curvePreferences,omitempty"`
	ClientAuth               ClientAuth `json:"clientAuth,omitempty" toml:"clientAuth,omitempty" yaml:"clientAuth,omitempty"`
	SniStrict                bool       `json:"sniStrict,omitempty" toml:"sniStrict,omitempty" yaml:"sniStrict,omitempty" export:"true"`
	PreferServerCipherSuites bool       `` /* 139-byte string literal not displayed */
}

Options configures TLS for an entry point

func (*Options) DeepCopy 

func (in *Options) DeepCopy() *Options

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Options.

func (*Options) DeepCopyInto 

func (in *Options) DeepCopyInto(out *Options)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type Store 

type Store struct {
	DefaultCertificate *Certificate `json:"defaultCertificate,omitempty" toml:"defaultCertificate,omitempty" yaml:"defaultCertificate,omitempty"`
}

Store holds the options for a given Store

func (*Store) DeepCopy 

func (in *Store) DeepCopy() *Store

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Store.

func (*Store) DeepCopyInto 

func (in *Store) DeepCopyInto(out *Store)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.