depot

Documentation

Index

• Constants
• func CheckCertificate(d Depot, name string) bool
• func CheckCertificateSigningRequest(d Depot, name string) bool
• func CheckPrivateKey(d Depot, name string) bool
• func DeleteCertificate(d Depot, name string) error
• func DeleteCertificateSigningRequest(d Depot, name string) error
• func GetCertificate(d Depot, name string) (crt *pkix.Certificate, err error)
• func GetCertificateRevocationList(d Depot, name string) (*pkix.CertificateRevocationList, error)
• func GetCertificateSigningRequest(d Depot, name string) (crt *pkix.CertificateSigningRequest, err error)
• func GetEncryptedPrivateKey(d Depot, name string, passphrase []byte) (key *pkix.Key, err error)
• func GetNameFromCrlTag(tag *Tag) string
• func GetNameFromCrtTag(tag *Tag) string
• func GetNameFromCsrTag(tag *Tag) string
• func GetNameFromPrivKeyTag(tag *Tag) string
• func GetPrivateKey(d Depot, name string) (key *pkix.Key, err error)
• func PutCertificate(d Depot, name string, crt *pkix.Certificate) error
• func PutCertificateRevocationList(d Depot, name string, crl *pkix.CertificateRevocationList) error
• func PutCertificateSigningRequest(d Depot, name string, csr *pkix.CertificateSigningRequest) error
• func PutEncryptedPrivateKey(d Depot, name string, key *pkix.Key, passphrase []byte) error
• func PutPrivateKey(d Depot, name string, key *pkix.Key) error
• type Depot
• type File
• type FileDepot
  • func NewFileDepot(dir string) (*FileDepot, error)
  • func (d *FileDepot) Check(tag *Tag) bool
  • func (d *FileDepot) Delete(tag *Tag) error
  • func (d *FileDepot) Get(tag *Tag) ([]byte, error)
  • func (d *FileDepot) GetFile(tag *Tag) (*File, error)
  • func (d *FileDepot) List() []*Tag
  • func (d *FileDepot) Put(tag *Tag, data []byte) error
• type Tag
  • func CrlTag(prefix string) *Tag
  • func CrtTag(prefix string) *Tag
  • func CsrTag(prefix string) *Tag
  • func PrivKeyTag(prefix string) *Tag

Constants

const (
	BranchPerm = 0440
	LeafPerm   = 0444
)

const (
	// DefaultFileDepotDir is the default directory where .key/.csr/.crt files can be found
	DefaultFileDepotDir = "out"
)

Functions

func CheckCertificate

func CheckCertificate(d Depot, name string) bool

CheckCertificate checks the depot for existence of a certificate file for a given CA name

func CheckCertificateSigningRequest

func CheckCertificateSigningRequest(d Depot, name string) bool

CheckCertificateSigningRequest checks the depot for existence of a certificate signing request file for a given host name

func CheckPrivateKey

func CheckPrivateKey(d Depot, name string) bool

CheckPrivateKey checks the depot for existence of a private key file for a given name

func DeleteCertificate

func DeleteCertificate(d Depot, name string) error

DeleteCertificate removes a certificate file for a given name from the depot

func DeleteCertificateSigningRequest

func DeleteCertificateSigningRequest(d Depot, name string) error

DeleteCertificateSigningRequest removes a certificate signing request file for a given host name from the depot

func GetCertificate

func GetCertificate(d Depot, name string) (crt *pkix.Certificate, err error)

GetCertificate retrieves a certificate file for a given name from the depot

func GetCertificateRevocationList

func GetCertificateRevocationList(d Depot, name string) (*pkix.CertificateRevocationList, error)

GetCertificateRevocationList gets a CRL file for a given name and ca in the depot.

func GetCertificateSigningRequest

func GetCertificateSigningRequest(d Depot, name string) (crt *pkix.CertificateSigningRequest, err error)

GetCertificateSigningRequest retrieves a certificate signing request file for a given host name from the depot

func GetEncryptedPrivateKey

func GetEncryptedPrivateKey(d Depot, name string, passphrase []byte) (key *pkix.Key, err error)

GetEncryptedPrivateKey retrieves an encrypted private key file for a given name from the depot

func GetNameFromCrlTag

func GetNameFromCrlTag(tag *Tag) string

GetNameFromCrlTag returns the host name from a certificate revocation list file tag

func GetNameFromCrtTag

func GetNameFromCrtTag(tag *Tag) string

GetNameFromCrtTag returns the host name from a certificate file tag

func GetNameFromCsrTag

func GetNameFromCsrTag(tag *Tag) string

GetNameFromCsrTag returns the host name from a certificate request file tag

func GetNameFromPrivKeyTag

func GetNameFromPrivKeyTag(tag *Tag) string

GetNameFromPrivKeyTag returns the host name from a private key file tag

func GetPrivateKey

func GetPrivateKey(d Depot, name string) (key *pkix.Key, err error)

GetPrivateKey retrieves a private key file for a given name from the depot

func PutCertificate

func PutCertificate(d Depot, name string, crt *pkix.Certificate) error

PutCertificate creates a certificate file for a given CA name in the depot

func PutCertificateRevocationList

func PutCertificateRevocationList(d Depot, name string, crl *pkix.CertificateRevocationList) error

PutCertificateRevocationList creates a CRL file for a given name and ca in the depot

func PutCertificateSigningRequest

func PutCertificateSigningRequest(d Depot, name string, csr *pkix.CertificateSigningRequest) error

PutCertificateSigningRequest creates a certificate signing request file for a given name and csr in the depot

func PutEncryptedPrivateKey

func PutEncryptedPrivateKey(d Depot, name string, key *pkix.Key, passphrase []byte) error

PutEncryptedPrivateKey creates an encrypted private key file for a given name in the depot

func PutPrivateKey

func PutPrivateKey(d Depot, name string, key *pkix.Key) error

PutPrivateKey creates a private key file for a given name in the depot

Types

type Depot

type Depot interface {
	Put(tag *Tag, data []byte) error
	Check(tag *Tag) bool
	Get(tag *Tag) ([]byte, error)
	Delete(tag *Tag) error
}

Depot is in charge of data storage

type File

type File struct {
	Info os.FileInfo
	Data []byte
}

File is a wrapper around a FileInfo and the files data bytes

type FileDepot

type FileDepot struct {
	// contains filtered or unexported fields
}

FileDepot is a implementation of Depot using file system

func NewFileDepot

func NewFileDepot(dir string) (*FileDepot, error)

NewFileDepot creates a new Depot at the specified path

func (*FileDepot) Check

func (d *FileDepot) Check(tag *Tag) bool

Check returns whether the file at the tag location exists and has permissions at least as restrictive as the given tag.

func (*FileDepot) Delete

func (d *FileDepot) Delete(tag *Tag) error

Delete removes the file specified by the tag

func (*FileDepot) Get

func (d *FileDepot) Get(tag *Tag) ([]byte, error)

Get reads the file specified by the tag

func (*FileDepot) GetFile

func (d *FileDepot) GetFile(tag *Tag) (*File, error)

GetFile returns the File at the specified tag in the given depot

func (*FileDepot) List

func (d *FileDepot) List() []*Tag

List returns all tags in the specified depot

func (*FileDepot) Put

func (d *FileDepot) Put(tag *Tag, data []byte) error

Put inserts the data into the file specified by the tag

type Tag

type Tag struct {
	// contains filtered or unexported fields
}

Tag includes name and permission requirement Permission requirement is used in two ways: 1. Set the permission for data when Put 2. Check the permission required when Get It is set to prevent attacks from other users for FileDepot. For example, 'evil' creates file ca.key with 0666 file perm, 'core' reads it and uses it as ca.key. It may cause the security problem of fake certificate and key.

func CrlTag

func CrlTag(prefix string) *Tag

CrlTag returns a tag corresponding to a certificate revocation list

func CrtTag

func CrtTag(prefix string) *Tag

CrtTag returns a tag corresponding to a certificate

func CsrTag

func CsrTag(prefix string) *Tag

CsrTag returns a tag corresponding to a certificate signature request file

func PrivKeyTag

func PrivKeyTag(prefix string) *Tag

PrivKeyTag returns a tag corresponding to a private key