Documentation
¶
Index ¶
- Constants
- Variables
- func GetIP(ipv4Server, ipv6Server string)
- func NewServerCipherSuite(c ServerConfigCrypto) (crypto.CipherSuite, error)
- func RequestRoutine(p RequestRoutineParameters, cs crypto.CipherSuite, opt RequestRoutineOpt) error
- func ResolveClientsIPAndVersionBasedOnTargetIP(ipv4ResServer, ipv6ResServer string, target net.IP) (net.IP, error)
- func SetMetricsRepository(m observability.MetricsRepository)
- func SetupClientCipherSuite(ospa OSPA) (crypto.CipherSuite, error)
- func SetupXDPADKMetrics(sp xdp.StatsProvider, stop chan bool)
- func Version() string
- type ADKProofGen
- type AuthorizationStrategy
- type AuthorizationStrategyCommand
- type AuthorizationStrategyCommandAuthorizeInput
- type AuthorizationStrategyCommandAuthorizeOutput
- type AuthorizationStrategySimple
- type CommandExecute
- type CommandExecuteMock
- type CommandExecuter
- type DatagramRequest
- type DatagramRequestHandlerMock
- type DatagramRequestHandlerStub
- type Firewall
- type FirewallCommand
- type FirewallCommandRuleAddInput
- type FirewallCommandRuleRemoveInput
- type FirewallMock
- type FirewallRule
- type FirewallRuleManager
- type FirewallRuleMetadata
- type FirewallRuleWithExpiration
- type FirewallStub
- type HTTPServer
- type IPResolver
- type IPTables
- type IPTablesSettings
- type OSPA
- type OSPAADK
- type OSPACrypto
- type OSPACryptoRSA
- type OSPACryptoRSAClient
- type OSPACryptoRSAServer
- type PublicIPResolver
- type PublicKeyLookupDir
- type PublicKeyResolveFromClientUUID
- type QueuedDatagramRequest
- type RequestCoordinator
- type RequestRoutineOpt
- type RequestRoutineParameters
- type RequestRoutineReqParameters
- type Server
- type ServerConfig
- type ServerConfigADK
- type ServerConfigADKXDP
- type ServerConfigAuthorization
- type ServerConfigAuthorizationCommand
- type ServerConfigAuthorizationSimple
- type ServerConfigCrypto
- type ServerConfigCryptoRSA
- type ServerConfigCryptoRSAClient
- type ServerConfigCryptoRSAServer
- type ServerConfigFirewall
- type ServerConfigFirewallCommand
- type ServerConfigFirewallIPTables
- type ServerConfigServer
- type ServerConfigServerHTTP
- type ServerHandler
- type ServerHandlerOpt
- type ServerSettings
- type UDPDatagramRequestHandler
- type UDPResponse
- type UDPResponseMock
- type UDPResponser
- type UDPSend
- type UDPSender
- type UDPServer
- type Verifier
Constants ¶
View Source
const ( IPv4ServerDefault = "https://ipv4.openspa.org" IPv6ServerDefault = "https://ipv6.openspa.org" )
View Source
const ( ServerConfigADKXDPModeSKB = "skb" ServerConfigADKXDPModeDriver = "driver" )
View Source
const ( ServerConfigFirewallBackendIPTables = "iptables" ServerConfigFirewallBackendCommand = "command" ServerConfigFirewallBackendNone = "none" // used for performance measurements, not for production workload )
View Source
const ( ServerConfigAuthorizationBackendSimple = "simple" ServerConfigAuthorizationBackendCommand = "command" ServerConfigAuthorizationBackendNone = "none" // used for performance measurements, not for production workload )
View Source
const (
IPTablesChainDefault = "OPENSPA-ALLOW"
)
View Source
const NoRequestHandlersDefault = 100
View Source
const OSPAFileVersion = "0.2"
View Source
const ServerHTTPPortDefault = 22212
View Source
const VersionBugfix = 1
View Source
const VersionInfo = "dev"
View Source
const VersionMajor = 0
View Source
const VersionMinor = 0
Variables ¶
View Source
var ( FirewallProtoTCP = "TCP" FirewallProtoUDP = "UDP" FirewallProtoICMP = "ICMP" FirewallProtoICMPv6 = "ICMPv6" )
View Source
var IPTablesSettingsDefault = IPTablesSettings{ Chain: IPTablesChainDefault, }
View Source
var RequestRoutineOptDefault = RequestRoutineOpt{ Sender: NewUDPSend(), }
Functions ¶
func NewServerCipherSuite ¶
func NewServerCipherSuite(c ServerConfigCrypto) (crypto.CipherSuite, error)
func RequestRoutine ¶
func RequestRoutine(p RequestRoutineParameters, cs crypto.CipherSuite, opt RequestRoutineOpt) error
func SetMetricsRepository ¶
func SetMetricsRepository(m observability.MetricsRepository)
func SetupClientCipherSuite ¶
func SetupClientCipherSuite(ospa OSPA) (crypto.CipherSuite, error)
func SetupXDPADKMetrics ¶
func SetupXDPADKMetrics(sp xdp.StatsProvider, stop chan bool)
Types ¶
type ADKProofGen ¶
type ADKProofGen struct {
// contains filtered or unexported fields
}
func NewADKProofGen ¶
func NewADKProofGen(secret string) ADKProofGen
func (ADKProofGen) ADKProofNext ¶
func (a ADKProofGen) ADKProofNext() uint32
func (ADKProofGen) ADKProofNow ¶
func (a ADKProofGen) ADKProofNow() uint32
type AuthorizationStrategy ¶
type AuthorizationStrategy interface {
RequestAuthorization(request tlv.Container) (time.Duration, error)
}
func NewAuthorizationStrategyFromServerConfigAuthorization ¶
func NewAuthorizationStrategyFromServerConfigAuthorization(s ServerConfigAuthorization) (AuthorizationStrategy, error)
type AuthorizationStrategyCommand ¶
type AuthorizationStrategyCommand struct { AuthorizeCmd string // contains filtered or unexported fields }
func NewAuthorizationStrategyCommand ¶
func NewAuthorizationStrategyCommand(cmd string) *AuthorizationStrategyCommand
func (AuthorizationStrategyCommand) RequestAuthorization ¶
type AuthorizationStrategyCommandAuthorizeInput ¶
type AuthorizationStrategyCommandAuthorizeInput struct { ClientUUID string `json:"clientUUID"` IPIsIPv6 bool `json:"ipIsIPv6"` ClientIP net.IP `json:"clientIP"` TargetIP net.IP `json:"targetIP"` TargetProtocol string `json:"targetProtocol"` TargetPortStart int `json:"targetPortStart"` TargetPortEnd int `json:"targetPortEnd"` }
type AuthorizationStrategyCommandAuthorizeOutput ¶
type AuthorizationStrategyCommandAuthorizeOutput struct {
Duration int `json:"duration"`
}
type AuthorizationStrategySimple ¶
type AuthorizationStrategySimple struct {
// contains filtered or unexported fields
}
AuthorizationStrategySimple authorizes any form of request as long as it is authenticated successfully (authentication should be performed externally).
func NewAuthorizationStrategyAllow ¶
func NewAuthorizationStrategyAllow(duration time.Duration) *AuthorizationStrategySimple
func (AuthorizationStrategySimple) RequestAuthorization ¶
type CommandExecute ¶
type CommandExecute struct{}
type CommandExecuteMock ¶
type CommandExecuter ¶
type DatagramRequest ¶
type DatagramRequest struct {
// contains filtered or unexported fields
}
type DatagramRequestHandlerMock ¶
func NewDatagramRequestHandlerMock ¶
func NewDatagramRequestHandlerMock() *DatagramRequestHandlerMock
func (*DatagramRequestHandlerMock) ADKSupport ¶
func (d *DatagramRequestHandlerMock) ADKSupport() bool
func (*DatagramRequestHandlerMock) DatagramRequestHandler ¶
func (d *DatagramRequestHandlerMock) DatagramRequestHandler(ctx context.Context, resp UDPResponser, r DatagramRequest)
type DatagramRequestHandlerStub ¶
type DatagramRequestHandlerStub struct {
// contains filtered or unexported fields
}
func NewDatagramRequestHandlerStub ¶
func NewDatagramRequestHandlerStub(f func(ctx context.Context, resp UDPResponser, r DatagramRequest), adkSupport bool) *DatagramRequestHandlerStub
func (DatagramRequestHandlerStub) ADKSupport ¶
func (d DatagramRequestHandlerStub) ADKSupport() bool
func (DatagramRequestHandlerStub) DatagramRequestHandler ¶
func (d DatagramRequestHandlerStub) DatagramRequestHandler(ctx context.Context, resp UDPResponser, r DatagramRequest)
type Firewall ¶
type Firewall interface { FirewallSetup() error RuleAdd(r FirewallRule, meta FirewallRuleMetadata) error RuleRemove(r FirewallRule, meta FirewallRuleMetadata) error }
func NewFirewallFromServerConfigFirewall ¶
func NewFirewallFromServerConfigFirewall(fc ServerConfigFirewall) (Firewall, error)
type FirewallCommand ¶
type FirewallCommand struct { FirewallSetupCmd string RuleAddCmd string RuleRemoveCmd string // contains filtered or unexported fields }
func NewFirewallCommand ¶
func NewFirewallCommand(setupCmd, ruleAddCmd, ruleRemoveCmd string) *FirewallCommand
func (*FirewallCommand) FirewallSetup ¶
func (fc *FirewallCommand) FirewallSetup() error
func (*FirewallCommand) RuleAdd ¶
func (fc *FirewallCommand) RuleAdd(r FirewallRule, meta FirewallRuleMetadata) error
func (*FirewallCommand) RuleRemove ¶
func (fc *FirewallCommand) RuleRemove(r FirewallRule, meta FirewallRuleMetadata) error
type FirewallCommandRuleAddInput ¶
type FirewallCommandRuleAddInput struct { ClientUUID string `json:"clientUUID"` IPIsIPv6 bool `json:"ipIsIPv6"` ClientIP net.IP `json:"clientIP"` TargetIP net.IP `json:"targetIP"` TargetProtocol string `json:"targetProtocol"` PortStart int `json:"portStart"` PortEnd int `json:"portEnd,omitempty"` Duration int `json:"duration"` }
type FirewallCommandRuleRemoveInput ¶
type FirewallCommandRuleRemoveInput struct { ClientUUID string `json:"clientUUID"` IPIsIPv6 bool `json:"ipIsIPv6"` ClientIP net.IP `json:"clientIP"` TargetIP net.IP `json:"targetIP"` TargetProtocol string `json:"targetProtocol"` PortStart int `json:"portStart"` PortEnd int `json:"portEnd,omitempty"` }
type FirewallMock ¶
func (*FirewallMock) FirewallSetup ¶
func (fw *FirewallMock) FirewallSetup() error
func (*FirewallMock) RuleAdd ¶
func (fw *FirewallMock) RuleAdd(r FirewallRule, meta FirewallRuleMetadata) error
func (*FirewallMock) RuleRemove ¶
func (fw *FirewallMock) RuleRemove(r FirewallRule, meta FirewallRuleMetadata) error
type FirewallRule ¶
func (*FirewallRule) String ¶
func (r *FirewallRule) String() string
type FirewallRuleManager ¶
type FirewallRuleManager struct {
// contains filtered or unexported fields
}
func NewFirewallRuleManager ¶
func NewFirewallRuleManager(fw Firewall) *FirewallRuleManager
func (*FirewallRuleManager) Add ¶
func (frm *FirewallRuleManager) Add(r FirewallRule, meta FirewallRuleMetadata) error
func (*FirewallRuleManager) Count ¶
func (frm *FirewallRuleManager) Count() int
func (*FirewallRuleManager) Debug ¶
func (frm *FirewallRuleManager) Debug() map[string]interface{}
func (*FirewallRuleManager) Start ¶
func (frm *FirewallRuleManager) Start() error
func (*FirewallRuleManager) Stop ¶
func (frm *FirewallRuleManager) Stop() error
type FirewallRuleMetadata ¶
type FirewallRuleWithExpiration ¶
type FirewallRuleWithExpiration struct { Rule FirewallRule Meta FirewallRuleMetadata Duration time.Duration Created time.Time }
func (*FirewallRuleWithExpiration) Expiration ¶
func (re *FirewallRuleWithExpiration) Expiration() time.Time
func (*FirewallRuleWithExpiration) String ¶
func (re *FirewallRuleWithExpiration) String() string
type FirewallStub ¶
type FirewallStub struct{}
func (FirewallStub) FirewallSetup ¶
func (FirewallStub) FirewallSetup() error
func (FirewallStub) RuleAdd ¶
func (FirewallStub) RuleAdd(r FirewallRule, meta FirewallRuleMetadata) error
func (FirewallStub) RuleRemove ¶
func (FirewallStub) RuleRemove(r FirewallRule, meta FirewallRuleMetadata) error
type HTTPServer ¶
type HTTPServer struct {
// contains filtered or unexported fields
}
func NewHTTPServer ¶
func NewHTTPServer(ip net.IP, port int) *HTTPServer
func (*HTTPServer) Start ¶
func (h *HTTPServer) Start() error
func (*HTTPServer) Stop ¶
func (h *HTTPServer) Stop() error
type IPResolver ¶
type IPTables ¶
type IPTables struct { Settings IPTablesSettings // contains filtered or unexported fields }
func NewIPTables ¶
func NewIPTables(c CommandExecuter, s IPTablesSettings) *IPTables
func (*IPTables) FirewallSetup ¶
func (*IPTables) RuleAdd ¶
func (ipt *IPTables) RuleAdd(r FirewallRule, _ FirewallRuleMetadata) error
func (*IPTables) RuleRemove ¶
func (ipt *IPTables) RuleRemove(r FirewallRule, _ FirewallRuleMetadata) error
type IPTablesSettings ¶
type IPTablesSettings struct {
Chain string
}
type OSPA ¶
type OSPA struct { Version string `yaml:"version"` ClientUUID string `yaml:"clientUUID"` ServerHost string `yaml:"serverHost"` ServerPort int `yaml:"serverPort"` ADK OSPAADK `yaml:"adk"` Crypto OSPACrypto `yaml:"crypto"` }
func OSPAFromFile ¶
type OSPACrypto ¶
type OSPACrypto struct { CipherSuitePriority []string `yaml:"cipherSuitePriority"` RSA OSPACryptoRSA `yaml:"rsa"` }
func (OSPACrypto) Verify ¶
func (o OSPACrypto) Verify() error
type OSPACryptoRSA ¶
type OSPACryptoRSA struct { Client OSPACryptoRSAClient `yaml:"client"` Server OSPACryptoRSAServer `yaml:"server"` }
func (OSPACryptoRSA) Verify ¶
func (o OSPACryptoRSA) Verify() error
type OSPACryptoRSAClient ¶
type OSPACryptoRSAClient struct { PrivateKey string `yaml:"privateKey"` PublicKey string `yaml:"publicKey"` }
func (OSPACryptoRSAClient) Verify ¶
func (o OSPACryptoRSAClient) Verify() error
type OSPACryptoRSAServer ¶
type OSPACryptoRSAServer struct {
PublicKey string `yaml:"publicKey"`
}
func (OSPACryptoRSAServer) Verify ¶
func (o OSPACryptoRSAServer) Verify() error
type PublicIPResolver ¶
type PublicIPResolver struct {
ServerURL string
}
func (*PublicIPResolver) GetPublicIP ¶
func (r *PublicIPResolver) GetPublicIP() (net.IP, error)
type PublicKeyLookupDir ¶
type PublicKeyLookupDir struct {
DirPath string
}
func NewPublicKeyLookupDir ¶
func NewPublicKeyLookupDir(dirPath string) *PublicKeyLookupDir
func (PublicKeyLookupDir) LookupPublicKey ¶
func (p PublicKeyLookupDir) LookupPublicKey(clientUUID string) (crypt.PublicKey, error)
type PublicKeyResolveFromClientUUID ¶
type PublicKeyResolveFromClientUUID struct {
// contains filtered or unexported fields
}
func NewPublicKeyResolveFromClientUUID ¶
func NewPublicKeyResolveFromClientUUID(l crypto.PublicKeyLookuper) *PublicKeyResolveFromClientUUID
type QueuedDatagramRequest ¶
type QueuedDatagramRequest struct { DatagramRequest // contains filtered or unexported fields }
type RequestCoordinator ¶
type RequestCoordinator struct {
// contains filtered or unexported fields
}
func NewRequestCoordinator ¶
func NewRequestCoordinator(h UDPDatagramRequestHandler, handlers int) *RequestCoordinator
func (*RequestCoordinator) ADKSupport ¶
func (d *RequestCoordinator) ADKSupport() bool
func (*RequestCoordinator) DatagramRequestHandler ¶
func (d *RequestCoordinator) DatagramRequestHandler(ctx context.Context, resp UDPResponser, r DatagramRequest)
func (*RequestCoordinator) Start ¶
func (d *RequestCoordinator) Start()
type RequestRoutineOpt ¶
type RequestRoutineOpt struct {
Sender UDPSender
}
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
func NewServer ¶
func NewServer(set ServerSettings) *Server
type ServerConfig ¶
type ServerConfig struct { Server ServerConfigServer `yaml:"server"` Firewall ServerConfigFirewall `yaml:"firewall"` Authorization ServerConfigAuthorization `yaml:"authorization"` Crypto ServerConfigCrypto `yaml:"crypto"` }
func DefaultServerConfig ¶
func DefaultServerConfig() ServerConfig
func ServerConfigParse ¶
func ServerConfigParse(b []byte) (ServerConfig, error)
func (ServerConfig) Merge ¶
func (s ServerConfig) Merge(sc ServerConfig) ServerConfig
Merge sc -> s.
func (ServerConfig) Verify ¶
func (s ServerConfig) Verify() error
type ServerConfigADK ¶
type ServerConfigADK struct { Secret string `yaml:"secret"` XDP ServerConfigADKXDP `yaml:"xdp"` }
func (ServerConfigADK) Verify ¶
func (s ServerConfigADK) Verify() error
type ServerConfigADKXDP ¶
type ServerConfigADKXDP struct { Mode string `yaml:"mode"` Interfaces []string `yaml:"interfaces"` }
func (ServerConfigADKXDP) Verify ¶
func (s ServerConfigADKXDP) Verify() error
type ServerConfigAuthorization ¶
type ServerConfigAuthorization struct { Backend string `yaml:"backend"` Simple *ServerConfigAuthorizationSimple `yaml:"simple"` Command *ServerConfigAuthorizationCommand `yaml:"command"` }
func (ServerConfigAuthorization) Verify ¶
func (s ServerConfigAuthorization) Verify() error
type ServerConfigAuthorizationCommand ¶
type ServerConfigAuthorizationCommand struct {
AuthorizationCmd string `yaml:"authorizationCmd"`
}
func (ServerConfigAuthorizationCommand) Verify ¶
func (s ServerConfigAuthorizationCommand) Verify() error
type ServerConfigAuthorizationSimple ¶
type ServerConfigAuthorizationSimple struct {
Duration string `yaml:"duration"`
}
func (ServerConfigAuthorizationSimple) GetDuration ¶
func (s ServerConfigAuthorizationSimple) GetDuration() time.Duration
func (ServerConfigAuthorizationSimple) Verify ¶
func (s ServerConfigAuthorizationSimple) Verify() error
type ServerConfigCrypto ¶
type ServerConfigCrypto struct { CipherSuitePriority []string `yaml:"cipherSuitePriority"` RSA ServerConfigCryptoRSA `yaml:"rsa"` }
func (ServerConfigCrypto) Verify ¶
func (s ServerConfigCrypto) Verify() error
type ServerConfigCryptoRSA ¶
type ServerConfigCryptoRSA struct { Client ServerConfigCryptoRSAClient `yaml:"client"` Server ServerConfigCryptoRSAServer `yaml:"server"` }
func (ServerConfigCryptoRSA) Verify ¶
func (s ServerConfigCryptoRSA) Verify() error
type ServerConfigCryptoRSAClient ¶
type ServerConfigCryptoRSAClient struct {
PublicKeyLookupDir string `yaml:"publicKeyLookupDir"`
}
func (ServerConfigCryptoRSAClient) Verify ¶
func (s ServerConfigCryptoRSAClient) Verify() error
type ServerConfigCryptoRSAServer ¶
type ServerConfigCryptoRSAServer struct { PrivateKeyPath string `yaml:"privateKeyPath"` PublicKeyPath string `yaml:"publicKeyPath"` }
func (ServerConfigCryptoRSAServer) Verify ¶
func (s ServerConfigCryptoRSAServer) Verify() error
type ServerConfigFirewall ¶
type ServerConfigFirewall struct { Backend string `yaml:"backend"` IPTables *ServerConfigFirewallIPTables `yaml:"iptables"` Command *ServerConfigFirewallCommand `yaml:"command"` }
func (ServerConfigFirewall) Verify ¶
func (s ServerConfigFirewall) Verify() error
type ServerConfigFirewallCommand ¶
type ServerConfigFirewallCommand struct { RuleAdd string `yaml:"ruleAdd"` RuleRemove string `yaml:"ruleRemove"` FirewallSetup string `yaml:"firewallSetup,omitempty"` // optional }
func (ServerConfigFirewallCommand) Verify ¶
func (s ServerConfigFirewallCommand) Verify() error
type ServerConfigFirewallIPTables ¶
type ServerConfigFirewallIPTables struct {
Chain string `yaml:"chain"`
}
func (ServerConfigFirewallIPTables) Verify ¶
func (s ServerConfigFirewallIPTables) Verify() error
type ServerConfigServer ¶
type ServerConfigServer struct { IP string `yaml:"ip"` Port int `yaml:"port"` RequestHandlers int `yaml:"requestHandlers"` HTTP ServerConfigServerHTTP `yaml:"http"` ADK ServerConfigADK `yaml:"adk"` }
func (ServerConfigServer) Verify ¶
func (s ServerConfigServer) Verify() error
type ServerConfigServerHTTP ¶
type ServerConfigServerHTTP struct { Enable bool `yaml:"enable"` IP string `yaml:"ip"` Port int `yaml:"port"` }
func (ServerConfigServerHTTP) Verify ¶
func (s ServerConfigServerHTTP) Verify() error
type ServerHandler ¶
type ServerHandler struct {
// contains filtered or unexported fields
}
func NewServerHandler ¶
func NewServerHandler(frm *FirewallRuleManager, cs crypto.CipherSuite, authz AuthorizationStrategy, opt ServerHandlerOpt) *ServerHandler
func (*ServerHandler) ADKSupport ¶
func (o *ServerHandler) ADKSupport() bool
func (*ServerHandler) DatagramRequestHandler ¶
func (o *ServerHandler) DatagramRequestHandler(_ context.Context, resp UDPResponser, r DatagramRequest)
type ServerHandlerOpt ¶
type ServerHandlerOpt struct {
ADKSecret string
}
type ServerSettings ¶
type ServerSettings struct { UDPServerIP net.IP UDPServerPort int NoRequestHandlers int FW Firewall CS crypto.CipherSuite Authz AuthorizationStrategy // HTTP server parameters, if HTTPServerPort is 0, the HTTP server will not be started HTTPServerIP net.IP HTTPServerPort int // Optional ADKSecret string }
type UDPDatagramRequestHandler ¶
type UDPDatagramRequestHandler interface { DatagramRequestHandler(ctx context.Context, resp UDPResponser, r DatagramRequest) ADKSupport() bool }
type UDPResponse ¶
type UDPResponse struct {
// contains filtered or unexported fields
}
func NewUDPResponse ¶
func NewUDPResponse(c *net.UDPConn, metrics udpServerMetrics) *UDPResponse
func (*UDPResponse) SendUDPResponse ¶
func (u *UDPResponse) SendUDPResponse(dst net.UDPAddr, body []byte) error
type UDPResponseMock ¶
func (*UDPResponseMock) SendUDPResponse ¶
func (u *UDPResponseMock) SendUDPResponse(dst net.UDPAddr, body []byte) error
type UDPResponser ¶
type UDPSender ¶
type UDPSender interface {
SendUDPRequest(req []byte, dest net.UDPAddr, timeout time.Duration) ([]byte, error)
}
UDPSender abstraction exists so that we can use a different implementation that does not actually send UDP traffic which is useful during testing.
type UDPServer ¶
func NewUDPServer ¶
func NewUDPServer(ip net.IP, port int, reqHandle UDPDatagramRequestHandler) *UDPServer
Source Files
¶
Click to show internal directories.
Click to hide internal directories.