sshpop

Documentation

Overview

Package sshpop implements ssh proof of possession based node attestation.

Index

• Constants
• Variables
• type Client
  • func NewClient(trustDomain string, configString string) (*Client, error)
  • func (c *Client) NewHandshake() *ClientHandshake
• type ClientConfig
  • func BuildClientConfig(coreConfig catalog.CoreConfig, hclText string, status *pluginconf.Status) *ClientConfig
  • func (cc *ClientConfig) NewClient() *Client
• type ClientConfigRequest
  • func (ccr *ClientConfigRequest) GetCoreConfiguration() *configv1.CoreConfiguration
  • func (ccr *ClientConfigRequest) GetHclConfiguration() string
• type ClientHandshake
  • func (c *ClientHandshake) AttestationData() ([]byte, error)
  • func (c *ClientHandshake) RespondToChallenge(req []byte) ([]byte, error)
• type Server
  • func NewServer(trustDomain, configString string) (*Server, error)
  • func (s *Server) NewHandshake() *ServerHandshake
• type ServerConfig
  • func BuildServerConfig(coreConfig catalog.CoreConfig, hclText string, status *pluginconf.Status) *ServerConfig
  • func (sc *ServerConfig) NewServer() *Server
• type ServerConfigRequest
  • func (scr *ServerConfigRequest) GetCoreConfiguration() *configv1.CoreConfiguration
  • func (scr *ServerConfigRequest) GetHclConfiguration() string
• type ServerHandshake
  • func (s *ServerHandshake) AgentID() (spiffeid.ID, error)
  • func (s *ServerHandshake) IssueChallenge() ([]byte, error)
  • func (s *ServerHandshake) VerifyAttestationData(data []byte) error
  • func (s *ServerHandshake) VerifyChallengeResponse(res []byte) error

Constants

const (
	// PluginName is used for identifying this plugin type for protobuf blobs.
	PluginName = "sshpop"
)

Variables

var (
	// DefaultAgentPathTemplate is the default text/template.
	DefaultAgentPathTemplate = agentpathtemplate.MustParse("/{{ .PluginName}}/{{ .Fingerprint }}")
)

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client is a factory for generating client handshake objects.

func NewClient

func NewClient(trustDomain string, configString string) (*Client, error)

func (*Client) NewHandshake

func (c *Client) NewHandshake() *ClientHandshake

type ClientConfig

type ClientConfig struct {
	HostKeyPath  string `hcl:"host_key_path"`
	HostCertPath string `hcl:"host_cert_path"`
	// contains filtered or unexported fields
}

ClientConfig configures the client.

func BuildClientConfig

func BuildClientConfig(coreConfig catalog.CoreConfig, hclText string, status *pluginconf.Status) *ClientConfig

func (*ClientConfig) NewClient

func (cc *ClientConfig) NewClient() *Client

type ClientConfigRequest

type ClientConfigRequest struct {
	// contains filtered or unexported fields
}

func (*ClientConfigRequest) GetCoreConfiguration

func (ccr *ClientConfigRequest) GetCoreConfiguration() *configv1.CoreConfiguration

func (*ClientConfigRequest) GetHclConfiguration

func (ccr *ClientConfigRequest) GetHclConfiguration() string

type ClientHandshake

type ClientHandshake struct {
	// contains filtered or unexported fields
}

ClientHandshake is a single-use object for an agent to do node attestation.

The handshake comprises a state machine that is not goroutine safe.

func (*ClientHandshake) AttestationData

func (c *ClientHandshake) AttestationData() ([]byte, error)

func (*ClientHandshake) RespondToChallenge

func (c *ClientHandshake) RespondToChallenge(req []byte) ([]byte, error)

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server is a factory for generating server handshake objects.

func NewServer

func NewServer(trustDomain, configString string) (*Server, error)

func (*Server) NewHandshake

func (s *Server) NewHandshake() *ServerHandshake

type ServerConfig

type ServerConfig struct {
	CertAuthorities     []string `hcl:"cert_authorities"`
	CertAuthoritiesPath string   `hcl:"cert_authorities_path"`
	// CanonicalDomain specifies the domain suffix for validating the hostname against
	// the certificate's valid principals. See CanonicalDomains in ssh_config(5).
	CanonicalDomain   string `hcl:"canonical_domain"`
	AgentPathTemplate string `hcl:"agent_path_template"`
	// contains filtered or unexported fields
}

ServerConfig configures the server.

func BuildServerConfig

func BuildServerConfig(coreConfig catalog.CoreConfig, hclText string, status *pluginconf.Status) *ServerConfig

func (*ServerConfig) NewServer

func (sc *ServerConfig) NewServer() *Server

type ServerConfigRequest

type ServerConfigRequest struct {
	// contains filtered or unexported fields
}

func (*ServerConfigRequest) GetCoreConfiguration

func (scr *ServerConfigRequest) GetCoreConfiguration() *configv1.CoreConfiguration

func (*ServerConfigRequest) GetHclConfiguration

func (scr *ServerConfigRequest) GetHclConfiguration() string

type ServerHandshake

type ServerHandshake struct {
	// contains filtered or unexported fields
}

ServerHandshake is a single-use object for a server to do node attestation.

The handshake comprises a state machine that is not goroutine safe.

func (*ServerHandshake) AgentID

func (s *ServerHandshake) AgentID() (spiffeid.ID, error)

func (*ServerHandshake) IssueChallenge

func (s *ServerHandshake) IssueChallenge() ([]byte, error)

func (*ServerHandshake) VerifyAttestationData

func (s *ServerHandshake) VerifyAttestationData(data []byte) error

func (*ServerHandshake) VerifyChallengeResponse

func (s *ServerHandshake) VerifyChallengeResponse(res []byte) error