client

Documentation

Index

• type Client
  • func (c *Client) AddAgentToVerifier(ctx context.Context, ragent *registrar.Agent, vc verifier.Client, ...) (retErr error)
  • func (c *Client) RandomVerifier() string
  • func (c *Client) Registrar() registrar.Client
  • func (c *Client) Verifier(name string) (verifier.Client, bool)
  • func (c *Client) VerifierNames() []string
  • func (c *Client) VerifyEK(ekCert *x509.Certificate, rootPool, intermediatePool *x509.CertPool) (*EKVerification, error)
• type EKVerification
• type Keylime
  • func New(ctx context.Context, logger logr.Logger, httpClient *http.Client, ...) (Keylime, error)

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

func (*Client) AddAgentToVerifier

func (c *Client) AddAgentToVerifier(ctx context.Context, ragent *registrar.Agent, vc verifier.Client, payload []byte, agentVerify bool) (retErr error)

func (*Client) RandomVerifier

func (c *Client) RandomVerifier() string

func (*Client) Registrar

func (c *Client) Registrar() registrar.Client

func (*Client) Verifier

func (c *Client) Verifier(name string) (verifier.Client, bool)

func (*Client) VerifierNames

func (c *Client) VerifierNames() []string

func (*Client) VerifyEK

func (c *Client) VerifyEK(ekCert *x509.Certificate, rootPool, intermediatePool *x509.CertPool) (*EKVerification, error)

VerifyEK will verify if the `ekCert` verifies against the intermediate and root pools. It will return with an error if this fails. NOTE: This function will *always* return an EKVerification which could contain additional information that was extracted from the EK certificate regardless if verification passes or not.

type EKVerification

type EKVerification struct {
	Verified                   bool
	AuthorityChains            [][]string
	SubjectAlternativeNames    *ekcert.EKSAN
	SubjectDirectoryAttributes *ekcert.EKSDA
}

type Keylime

type Keylime interface {
	Registrar() registrar.Client
	Verifier(name string) (verifier.Client, bool)
	VerifierNames() []string
	RandomVerifier() string
	AddAgentToVerifier(ctx context.Context, agent *registrar.Agent, vc verifier.Client, payload []byte, agentVerify bool) error
	VerifyEK(ekCert *x509.Certificate, rootPool, intermediatePool *x509.CertPool) (*EKVerification, error)
}

func New

func New(ctx context.Context, logger logr.Logger, httpClient *http.Client, registrarURL string, verifierURLs []string, tpmCertStore string) (Keylime, error)

New returns a new Keylime client which has (sort of) equivalent functionality to the Keylime tenant CLI