authority

Documentation

Index

• Variables
• type Authority
  • func New(hist *history.History, reg *prometheus.Registry, log *slog.Logger) *Authority
  • func (m *Authority) GetCertBundle(peerPublicKeyHashStr string) (Bundle, error)
  • func (a *Authority) GetManifests(_ context.Context, _ *userapi.GetManifestsRequest) (*userapi.GetManifestsResponse, error)
  • func (a *Authority) Recover(_ context.Context, req *userapi.RecoverRequest) (*userapi.RecoverResponse, error)
  • func (m *Authority) SNPValidateOpts(report *sevsnp.Report) (*validate.Options, error)
  • func (a *Authority) SetManifest(ctx context.Context, req *userapi.SetManifestRequest) (*userapi.SetManifestResponse, error)
  • func (m *Authority) ValidateCallback(_ context.Context, report *sevsnp.Report, _ asn1.ObjectIdentifier, ...) error
• type Bundle

Variables

var (
	// ErrAlreadyRecovered is returned if seedEngine initialization was requested but a seed is already set.
	ErrAlreadyRecovered = errors.New("coordinator is already recovered")
	// ErrNeedsRecovery is returned if state exists, but no secrets are available, e.g. after restart.
	ErrNeedsRecovery = errors.New("coordinator is in recovery mode")
)

var ErrNoManifest = errors.New("no manifest configured")

ErrNoManifest is returned when a manifest is needed but not present.

Types

type Authority

type Authority struct {
	userapi.UnimplementedUserAPIServer
	// contains filtered or unexported fields
}

Authority manages the manifest state of Contrast.

func New

func New(hist *history.History, reg *prometheus.Registry, log *slog.Logger) *Authority

New creates a new Authority instance.

func (*Authority) GetCertBundle

func (m *Authority) GetCertBundle(peerPublicKeyHashStr string) (Bundle, error)

GetCertBundle retrieves the certificate bundle created for the peer identified by the given public key.

func (*Authority) GetManifests

func (a *Authority) GetManifests(_ context.Context, _ *userapi.GetManifestsRequest,
) (*userapi.GetManifestsResponse, error)

GetManifests retrieves the current CA certificates, the manifest history and all policies.

func (*Authority) Recover

func (a *Authority) Recover(_ context.Context, req *userapi.RecoverRequest) (*userapi.RecoverResponse, error)

Recover recovers the Coordinator from a seed and salt.

func (*Authority) SNPValidateOpts

func (m *Authority) SNPValidateOpts(report *sevsnp.Report) (*validate.Options, error)

SNPValidateOpts returns SNP validation options from reference values.

It also ensures that the policy hash in the report's HOSTDATA is allowed by the current manifest.

func (*Authority) SetManifest

func (a *Authority) SetManifest(ctx context.Context, req *userapi.SetManifestRequest) (*userapi.SetManifestResponse, error)

SetManifest registers a new manifest at the Coordinator.

func (*Authority) ValidateCallback

func (m *Authority) ValidateCallback(_ context.Context, report *sevsnp.Report,
	_ asn1.ObjectIdentifier, _, _, peerPubKeyBytes []byte,
) error

ValidateCallback creates a certificate bundle for the verified client.

type Bundle

type Bundle struct {
	WorkloadCert   []byte
	MeshCA         []byte
	IntermediateCA []byte
	RootCA         []byte
}

Bundle is a set of PEM-encoded certificates for Contrast workloads.