authority

Documentation

Index

• Variables
• type AuthInfo
  • func (a *AuthInfo) SetReport(report attestation.Report)
• type Authority
  • func New(hist *history.History, reg *prometheus.Registry, log *slog.Logger) *Authority
  • func (a *Authority) Credentials(reg *prometheus.Registry, issuer atls.Issuer) (*Credentials, func())
  • func (a *Authority) GetManifests(_ context.Context, _ *userapi.GetManifestsRequest) (*userapi.GetManifestsResponse, error)
  • func (m *Authority) GetSeedEngine() (*seedengine.SeedEngine, error)
  • func (a *Authority) Recover(_ context.Context, req *userapi.RecoverRequest) (*userapi.RecoverResponse, error)
  • func (a *Authority) SetManifest(ctx context.Context, req *userapi.SetManifestRequest) (*userapi.SetManifestResponse, error)
• type Credentials
  • func (c *Credentials) ClientHandshake(_ context.Context, _ string, _ net.Conn) (net.Conn, credentials.AuthInfo, error)
  • func (c *Credentials) Clone() credentials.TransportCredentials
  • func (c *Credentials) Info() credentials.ProtocolInfo
  • func (c *Credentials) OverrideServerName(_ string) error
  • func (c *Credentials) ServerHandshake(rawConn net.Conn) (net.Conn, credentials.AuthInfo, error)
• type State

Variables

var (
	// ErrAlreadyRecovered is returned if seedEngine initialization was requested but a seed is already set.
	ErrAlreadyRecovered = errors.New("coordinator is already recovered")
	// ErrNeedsRecovery is returned if state exists, but no secrets are available, e.g. after restart.
	ErrNeedsRecovery = errors.New("coordinator is in recovery mode")
)

var ErrNoManifest = errors.New("no manifest configured")

ErrNoManifest is returned when a manifest is needed but not present.

Types

type AuthInfo

type AuthInfo struct {
	// TLSInfo holds details from the TLS handshake.
	credentials.TLSInfo
	// State is the coordinator state at the time of the TLS handshake.
	State *State
	// Report is the attestation report sent by the peer.
	Report attestation.Report
}

AuthInfo is used to pass channel authentication information and state to gRPC handlers.

It implements [snp.validateCallbacker] to capture report data from the TLS handshake.

func (*AuthInfo) SetReport

func (a *AuthInfo) SetReport(report attestation.Report)

SetReport takes the validated report and attaches it to the AuthInfo.

type Authority

type Authority struct {
	userapi.UnimplementedUserAPIServer
	// contains filtered or unexported fields
}

Authority manages the manifest state of Contrast.

func New

func New(hist *history.History, reg *prometheus.Registry, log *slog.Logger) *Authority

New creates a new Authority instance.

func (*Authority) Credentials

func (a *Authority) Credentials(reg *prometheus.Registry, issuer atls.Issuer) (*Credentials, func())

Credentials creates new transport credentials that validate peers according to the latest manifest.

func (*Authority) GetManifests

func (a *Authority) GetManifests(_ context.Context, _ *userapi.GetManifestsRequest,
) (*userapi.GetManifestsResponse, error)

GetManifests retrieves the current CA certificates, the manifest history and all policies.

func (*Authority) GetSeedEngine

func (m *Authority) GetSeedEngine() (*seedengine.SeedEngine, error)

GetSeedEngine returns the seed engine.

func (*Authority) Recover

func (a *Authority) Recover(_ context.Context, req *userapi.RecoverRequest) (*userapi.RecoverResponse, error)

Recover recovers the Coordinator from a seed and salt.

func (*Authority) SetManifest

func (a *Authority) SetManifest(ctx context.Context, req *userapi.SetManifestRequest) (*userapi.SetManifestResponse, error)

SetManifest registers a new manifest at the Coordinator.

type Credentials

type Credentials struct {
	// contains filtered or unexported fields
}

Credentials are gRPC transport credentials that dynamically update with the Coordinator state.

func (*Credentials) ClientHandshake

func (c *Credentials) ClientHandshake(_ context.Context, _ string, _ net.Conn) (net.Conn, credentials.AuthInfo, error)

ClientHandshake is not implemented.

func (*Credentials) Clone

func (c *Credentials) Clone() credentials.TransportCredentials

Clone is only necessary for clients and thus not implemented.

func (*Credentials) Info

func (c *Credentials) Info() credentials.ProtocolInfo

Info provides information about the protocol.

func (*Credentials) OverrideServerName

func (c *Credentials) OverrideServerName(_ string) error

OverrideServerName is not implemented.

func (*Credentials) ServerHandshake

func (c *Credentials) ServerHandshake(rawConn net.Conn) (net.Conn, credentials.AuthInfo, error)

ServerHandshake implements an aTLS handshake for the latest state.

If successful, the state will be passed to gRPC as AuthInfo.

type State

type State struct {
	Manifest *manifest.Manifest
	CA       *ca.CA
	// contains filtered or unexported fields
}

State is a snapshot of the Coordinator's manifest history.