tlsutil

package
v1.8.19 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 15, 2021 License: MPL-2.0 Imports: 24 Imported by: 513

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var TLSLookup = map[string]uint16{
	"":      tls.VersionTLS10,
	"tls10": tls.VersionTLS10,
	"tls11": tls.VersionTLS11,
	"tls12": tls.VersionTLS12,
	"tls13": tls.VersionTLS13,
}

TLSLookup maps the tls_min_version configuration to the internal value

View Source 
var TLSVersions = strings.Join(tlsVersions(), ", ")

TLSVersions has all the keys from the map above.

Functions

func CipherString added in v1.8.1 

func CipherString(ciphers []uint16) (string, error)

CipherString performs the inverse operation of ParseCiphers

func GenerateCA added in v1.5.2 

func GenerateCA(opts CAOpts) (string, string, error)

GenerateCA generates a new CA for agent TLS (not to be confused with Connect TLS)

func GenerateCert added in v1.5.2 

func GenerateCert(opts CertOpts) (string, string, error)

GenerateCert generates a new certificate for agent TLS (not to be confused with Connect TLS)

func GeneratePrivateKey added in v1.5.2 

func GeneratePrivateKey() (crypto.Signer, string, error)

GeneratePrivateKey generates a new ecdsa private key

func GenerateSerialNumber added in v1.5.2 

func GenerateSerialNumber() (*big.Int, error)

GenerateSerialNumber returns random bigint generated with crypto/rand

func LoadCAs added in v1.8.4 

func LoadCAs(caFile, caPath string) ([]string, error)

func ParseCiphers added in v0.8.2 

func ParseCiphers(cipherStr string) ([]uint16, error)

ParseCiphers parse ciphersuites from the comma-separated string into recognized slice

func ParseSigner added in v1.5.2 

func ParseSigner(pemValue string) (crypto.Signer, error)

ParseSigner parses a crypto.Signer from a PEM-encoded key. The private key is expected to be the first block in the PEM value.

func Verify added in v1.5.2 

func Verify(caString, certString, dns string) error

Types

type ALPNWrapper added in v1.8.0 

type ALPNWrapper func(dc, nodeName, alpnProto string, conn net.Conn) (net.Conn, error)

ALPNWrapper is a function that is used to wrap a non-TLS connection and returns an appropriate TLS connection or error. This taks a datacenter and node name as argument to configure the desired SNI value and the desired next proto for configuring ALPN.

type CAOpts added in v1.8.9 

type CAOpts struct {
	Signer              crypto.Signer
	Serial              *big.Int
	ClusterID           string
	Days                int
	PermittedDNSDomains []string
	Domain              string
	Name                string
}

type CertOpts added in v1.8.10 

type CertOpts struct {
	Signer      crypto.Signer
	CA          string
	Serial      *big.Int
	Name        string
	Days        int
	DNSNames    []string
	IPAddresses []net.IP
	ExtKeyUsage []x509.ExtKeyUsage
	IsCA        bool
}

type Config 

type Config struct {
	// VerifyIncoming is used to verify the authenticity of incoming
	// connections.  This means that TCP requests are forbidden, only
	// allowing for TLS. TLS connections must match a provided certificate
	// authority. This can be used to force client auth.
	VerifyIncoming bool

	// VerifyIncomingRPC is used to verify the authenticity of incoming RPC
	// connections.  This means that TCP requests are forbidden, only
	// allowing for TLS. TLS connections must match a provided certificate
	// authority. This can be used to force client auth.
	VerifyIncomingRPC bool

	// VerifyIncomingHTTPS is used to verify the authenticity of incoming
	// HTTPS connections.  This means that TCP requests are forbidden, only
	// allowing for TLS. TLS connections must match a provided certificate
	// authority. This can be used to force client auth.
	VerifyIncomingHTTPS bool

	// VerifyOutgoing is used to verify the authenticity of outgoing
	// connections.  This means that TLS requests are used, and TCP
	// requests are not made. TLS connections must match a provided
	// certificate authority. This is used to verify authenticity of server
	// nodes.
	VerifyOutgoing bool

	// VerifyServerHostname is used to enable hostname verification of
	// servers. This ensures that the certificate presented is valid for
	// server.<datacenter>.<domain>.  This prevents a compromised client
	// from being restarted as a server, and then intercepting request
	// traffic as well as being added as a raft peer. This should be
	// enabled by default with VerifyOutgoing, but for legacy reasons we
	// cannot break existing clients.
	VerifyServerHostname bool

	// UseTLS is used to enable outgoing TLS connections to Consul servers.
	UseTLS bool

	// CAFile is a path to a certificate authority file. This is used with
	// VerifyIncoming or VerifyOutgoing to verify the TLS connection.
	CAFile string

	// CAPath is a path to a directory containing certificate authority
	// files. This is used with VerifyIncoming or VerifyOutgoing to verify
	// the TLS connection.
	CAPath string

	// CertFile is used to provide a TLS certificate that is used for
	// serving TLS connections.  Must be provided to serve TLS connections.
	CertFile string

	// KeyFile is used to provide a TLS key that is used for serving TLS
	// connections.  Must be provided to serve TLS connections.
	KeyFile string

	// Node name is the name we use to advertise. Defaults to hostname.
	NodeName string

	// ServerName is used with the TLS certificate to ensure the name we
	// provide matches the certificate
	ServerName string

	// Domain is the Consul TLD being used. Defaults to "consul."
	Domain string

	// TLSMinVersion is the minimum accepted TLS version that can be used.
	TLSMinVersion string

	// CipherSuites is the list of TLS cipher suites to use.
	CipherSuites []uint16

	// PreferServerCipherSuites specifies whether to prefer the server's
	// ciphersuite over the client ciphersuites.
	PreferServerCipherSuites bool

	// EnableAgentTLSForChecks is used to apply the agent's TLS settings in
	// order to configure the HTTP client used for health checks. Enabling
	// this allows HTTP checks to present a client certificate and verify
	// the server using the same TLS configuration as the agent (CA, cert,
	// and key).
	EnableAgentTLSForChecks bool

	// AutoTLS opts the agent into provisioning agent
	// TLS certificates.
	AutoTLS bool
}

Config used to create tls.Config

func (*Config) KeyPair 

func (c *Config) KeyPair() (*tls.Certificate, error)

KeyPair is used to open and parse a certificate and key file

type Configurator added in v1.4.3 

type Configurator struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

Configurator holds a Config and is responsible for generating all the *tls.Config necessary for Consul. Except the one in the api package.

func NewConfigurator added in v1.4.3 

func NewConfigurator(config Config, logger hclog.Logger) (*Configurator, error)

NewConfigurator creates a new Configurator and sets the provided configuration.

func (*Configurator) AuthorizeServerConn added in v1.8.15 

func (c *Configurator) AuthorizeServerConn(dc string, conn TLSConn) error

AuthorizeServerConn is used to validate that the connection is being established by a Consul server in the same datacenter.

The identity of the connection is checked by verifying that the certificate presented is signed by the Agent TLS CA, and has a DNSName that matches the local ServerSNI name.

Note this check is only performed if VerifyServerHostname and VerifyIncomingRPC are both enabled, otherwise it does no authorization.

func (*Configurator) AutoEncryptCertExpired added in v1.5.2 

func (c *Configurator) AutoEncryptCertExpired() bool

AutoEncryptCertExpired returns if the auto_encrypt cert is expired.

func (*Configurator) AutoEncryptCertNotAfter added in v1.5.2 

func (c *Configurator) AutoEncryptCertNotAfter() time.Time

AutoEncryptCertNotAfter returns NotAfter from the auto_encrypt cert. In case there is no cert, it will return a time in the past.

func (*Configurator) Base added in v1.5.2 

func (c *Configurator) Base() Config

func (*Configurator) Cert added in v1.7.0 

func (c *Configurator) Cert() *tls.Certificate

This function acquires a read lock because it reads from the config.

func (*Configurator) IncomingALPNRPCConfig added in v1.8.0 

func (c *Configurator) IncomingALPNRPCConfig(alpnProtos []string) *tls.Config

IncomingALPNRPCConfig generates a *tls.Config for incoming RPC connections directly using TLS with ALPN instead of the older byte-prefixed protocol.

func (*Configurator) IncomingGRPCConfig added in v1.7.0 

func (c *Configurator) IncomingGRPCConfig() *tls.Config

IncomingGRPCConfig generates a *tls.Config for incoming GRPC connections.

func (*Configurator) IncomingHTTPSConfig added in v1.4.3 

func (c *Configurator) IncomingHTTPSConfig() *tls.Config

IncomingHTTPSConfig generates a *tls.Config for incoming HTTPS connections.

func (*Configurator) IncomingInsecureRPCConfig added in v1.5.2 

func (c *Configurator) IncomingInsecureRPCConfig() *tls.Config

IncomingInsecureRPCConfig means that it doesn't verify incoming even thought it might have been configured. This is only supposed to be used by the servers for the insecure RPC server. At the time of writing only the AutoEncrypt.Sign call is supported on that server. And it might be the only usecase ever.

func (*Configurator) IncomingRPCConfig added in v1.4.3 

func (c *Configurator) IncomingRPCConfig() *tls.Config

IncomingRPCConfig generates a *tls.Config for incoming RPC connections.

func (*Configurator) ManualCAPems added in v1.5.2 

func (c *Configurator) ManualCAPems() []string

ManualCAPems returns the currently loaded CAs in PEM format.

func (*Configurator) MutualTLSCapable added in v1.8.0 

func (c *Configurator) MutualTLSCapable() bool

func (*Configurator) OutgoingALPNRPCConfig added in v1.8.0 

func (c *Configurator) OutgoingALPNRPCConfig() *tls.Config

OutgoingALPNRPCConfig generates a *tls.Config for outgoing RPC connections directly using TLS with ALPN instead of the older byte-prefixed protocol. If there is a CA or VerifyOutgoing is set, a *tls.Config will be provided, otherwise we assume that no TLS should be used which completely disables the ALPN variation.

func (*Configurator) OutgoingALPNRPCWrapper added in v1.8.0 

func (c *Configurator) OutgoingALPNRPCWrapper() ALPNWrapper

OutgoingALPNRPCWrapper wraps the result of OutgoingALPNRPCConfig in an ALPNWrapper. It configures all of the negotiation plumbing.

func (*Configurator) OutgoingRPCConfig added in v1.4.3 

func (c *Configurator) OutgoingRPCConfig() *tls.Config

OutgoingRPCConfig generates a *tls.Config for outgoing RPC connections. If there is a CA or VerifyOutgoing is set, a *tls.Config will be provided, otherwise we assume that no TLS should be used.

func (*Configurator) OutgoingRPCWrapper added in v1.4.3 

func (c *Configurator) OutgoingRPCWrapper() DCWrapper

OutgoingRPCWrapper wraps the result of OutgoingRPCConfig in a DCWrapper. It decides if verify server hostname should be used.

func (*Configurator) OutgoingTLSConfigForCheck added in v1.4.3 

func (c *Configurator) OutgoingTLSConfigForCheck(skipVerify bool) *tls.Config

IncomingTLSConfig generates a *tls.Config for outgoing TLS connections for checks. This function is separated because there is an extra flag to consider for checks. EnableAgentTLSForChecks and InsecureSkipVerify has to be checked for checks.

func (*Configurator) ServerSNI added in v1.8.0 

func (c *Configurator) ServerSNI(dc, nodeName string) string

func (*Configurator) Update added in v1.4.3 

func (c *Configurator) Update(config Config) error

Update updates the internal configuration which is used to generate *tls.Config. This function acquires a write lock because it writes the new config.

func (*Configurator) UpdateAreaPeerDatacenterUseTLS added in v1.7.3 

func (c *Configurator) UpdateAreaPeerDatacenterUseTLS(peerDatacenter string, useTLS bool)

func (*Configurator) UpdateAutoTLS added in v1.8.1 

func (c *Configurator) UpdateAutoTLS(manualCAPems, connectCAPems []string, pub, priv string, verifyServerHostname bool) error

UpdateAutoTLS sets everything under autoEncrypt. This is being called on the client when it received its cert from AutoEncrypt/AutoConfig endpoints.

func (*Configurator) UpdateAutoTLSCA added in v1.8.1 

func (c *Configurator) UpdateAutoTLSCA(connectCAPems []string) error

UpdateAutoTLSCA updates the autoEncrypt.caPems. This is supposed to be called from the server in order to be able to accept TLS connections with TLS certificates. Or it is being called on the client side when CA changes are detected.

func (*Configurator) UpdateAutoTLSCert added in v1.8.1 

func (c *Configurator) UpdateAutoTLSCert(pub, priv string) error

UpdateAutoTLSCert

func (*Configurator) UseTLS added in v1.7.3 

func (c *Configurator) UseTLS(dc string) bool

func (*Configurator) VerifyIncomingRPC added in v1.5.2 

func (c *Configurator) VerifyIncomingRPC() bool

This function acquires a read lock because it reads from the config.

func (*Configurator) VerifyServerHostname added in v1.5.2 

func (c *Configurator) VerifyServerHostname() bool

This function acquires a read lock because it reads from the config.

type DCWrapper added in v0.5.1 

type DCWrapper func(dc string, conn net.Conn) (net.Conn, error)

DCWrapper is a function that is used to wrap a non-TLS connection and returns an appropriate TLS connection or error. This takes a datacenter as an argument.

type TLSConn added in v1.8.17 

type TLSConn interface {
	ConnectionState() tls.ConnectionState
}

type Wrapper added in v0.5.1 

type Wrapper func(conn net.Conn) (net.Conn, error)

Wrapper is a variant of DCWrapper, where the DC is provided as a constant value. This is usually done by currying DCWrapper.

func SpecificDC added in v0.5.1 

func SpecificDC(dc string, tlsWrap DCWrapper) Wrapper

SpecificDC is used to invoke a static datacenter and turns a DCWrapper into a Wrapper type.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.