tlsconfig

Documentation

Overview

Package tlsconfig provides configuration for TLS clients and servers.

Index

• type ACME
  • func (a *ACME) Initialize() (*autocert.Manager, error)
  • func (a ACME) IsZero() bool
• type Client
  • func (c Client) ApplyTo(tlsConfig *tls.Config) error
  • func (c Client) Equals(other Client) bool
• type ClientAuth
  • func (c *ClientAuth) ApplyTo(tlsConfig *tls.Config) error
• type ClientKeyVault
• type Config
• type ConfigOptionFunc
• type ConfigurationProvider
  • func (p ConfigurationProvider) GetTLSClientConfig(ctx context.Context, opts ...Option) (*tls.Config, error)
  • func (p ConfigurationProvider) GetTLSServerConfig(ctx context.Context, opts ...Option) (*tls.Config, error)
• type FileReader
  • func FromFetcher(fetcher fetch.Interface) FileReader
• type Option
  • func WithNextProtos(protos ...string) Option
  • func WithTLSCertificates(certificates ...tls.Certificate) Option
  • func WithTLSClientAuth(auth tls.ClientAuthType, cas *x509.CertPool, ...) Option
• type ServerAuth
  • func (c *ServerAuth) ApplyTo(tlsConfig *tls.Config) error
  • func (c *ServerAuth) GetCipherSuites() ([]uint16, error)
• type ServerKeyVault

Types

type ACME

type ACME struct {

	// TODO: Remove Enable (https://github.com/TheThingsNetwork/lorawan-stack/issues/1450)
	Enable bool `` //nolint:lll
	/* 145-byte string literal not displayed */
	Endpoint    string   `name:"endpoint" description:"ACME endpoint"`
	Dir         string   `name:"dir" description:"Location of ACME storage directory"`
	Email       string   `name:"email" description:"Email address to register with the ACME account"`
	Hosts       []string `name:"hosts" description:"Hosts to enable automatic certificates for"`
	DefaultHost string   `name:"default-host" description:"Default host to assume for clients without SNI"`
	// contains filtered or unexported fields
}

ACME represents ACME configuration.

func (*ACME) Initialize

func (a *ACME) Initialize() (*autocert.Manager, error)

Initialize initializes the autocert manager for the ACME configuration. If it was already initialized, any changes after the previous initialization are ignored.

func (ACME) IsZero

func (a ACME) IsZero() bool

IsZero returns whether the ACME configuration is empty.

type Client

type Client struct {
	FileReader         FileReader `json:"-" yaml:"-" name:"-"`
	RootCA             string     `json:"root-ca" yaml:"root-ca" name:"root-ca" description:"Location of TLS root CA certificate (optional)"` //nolint:lll
	InsecureSkipVerify bool       `name:"insecure-skip-verify" description:"Skip verification of certificate chains (insecure)"`              //nolint:lll
}

Client is client-side configuration for server TLS.

func (Client) ApplyTo

func (c Client) ApplyTo(tlsConfig *tls.Config) error

ApplyTo applies the client configuration options to the given TLS configuration. If tlsConfig is nil, this is a no-op.

func (Client) Equals

func (c Client) Equals(other Client) bool

Equals checks if the other configuration is equivalent to this.

type ClientAuth

type ClientAuth struct {
	Source      string         `name:"source" description:"Source of the TLS certificate (file, key-vault)"`
	FileReader  FileReader     `json:"-" yaml:"-" name:"-"`
	Certificate string         `json:"certificate" yaml:"certificate" name:"certificate" description:"Location of TLS certificate"` //nolint:lll
	Key         string         `json:"key" yaml:"key" name:"key" description:"Location of TLS private key"`
	KeyVault    ClientKeyVault `name:"key-vault"`
}

ClientAuth is (client-side) configuration for TLS client authentication.

func (*ClientAuth) ApplyTo

func (c *ClientAuth) ApplyTo(tlsConfig *tls.Config) error

ApplyTo applies the TLS authentication configuration options to the given TLS configuration. If tlsConfig is nil, this is a no-op.

type ClientKeyVault

type ClientKeyVault struct {
	CertificateProvider interface {
		ClientCertificate(ctx context.Context, label string) (tls.Certificate, error)
	} `name:"-"`
	ID string `name:"id" description:"ID of the certificate"`
}

ClientKeyVault defines configuration for loading a TLS client certificate from the key vault.

type Config

type Config struct {
	Client     `name:",squash"`
	ServerAuth `name:",squash"`
}

Config represents TLS configuration.

type ConfigOptionFunc

type ConfigOptionFunc func(*tls.Config)

ConfigOptionFunc is a Option.

type ConfigurationProvider

type ConfigurationProvider func(context.Context) Config

ConfigurationProvider generates a Config from the provided context.

func (ConfigurationProvider) GetTLSClientConfig

func (p ConfigurationProvider) GetTLSClientConfig(ctx context.Context, opts ...Option) (*tls.Config, error)

GetTLSClientConfig gets the component's client TLS config and applies the given options.

func (ConfigurationProvider) GetTLSServerConfig

func (p ConfigurationProvider) GetTLSServerConfig(ctx context.Context, opts ...Option) (*tls.Config, error)

GetTLSServerConfig gets the component's server TLS config and applies the given options.

type FileReader

type FileReader interface {
	ReadFile(filename string) ([]byte, error)
}

FileReader is the interface used to read TLS certificates and keys.

func FromFetcher

func FromFetcher(fetcher fetch.Interface) FileReader

FromFetcher returns a FileReader that reads files from the given fetcher.

type Option

type Option interface {
	// contains filtered or unexported methods
}

Option provides customization for TLS configuration.

func WithNextProtos

func WithNextProtos(protos ...string) Option

WithNextProtos appends the given protocols to NextProtos.

func WithTLSCertificates

func WithTLSCertificates(certificates ...tls.Certificate) Option

WithTLSCertificates sets TLS certificates.

func WithTLSClientAuth

func WithTLSClientAuth(
	auth tls.ClientAuthType,
	cas *x509.CertPool,
	verify func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error,
) Option

WithTLSClientAuth sets TLS client authentication options.

type ServerAuth

type ServerAuth struct {
	Source       string         `name:"source" description:"Source of the TLS certificate (file, acme, key-vault)"`
	FileReader   FileReader     `json:"-" yaml:"-" name:"-"`
	Certificate  string         `json:"certificate" yaml:"certificate" name:"certificate" description:"Location of TLS certificate"` //nolint:lll
	Key          string         `json:"key" yaml:"key" name:"key" description:"Location of TLS private key"`
	ACME         ACME           `name:"acme"`
	KeyVault     ServerKeyVault `name:"key-vault"`
	CipherSuites []string       `name:"cipher-suites" description:"List of IANA names of TLS cipher suites to use (DEPRECATED)"` //nolint:lll
}

ServerAuth is configuration for TLS server authentication.

func (*ServerAuth) ApplyTo

func (c *ServerAuth) ApplyTo(tlsConfig *tls.Config) error

ApplyTo applies the TLS authentication configuration options to the given TLS configuration. If tlsConfig is nil, this is a no-op.

func (*ServerAuth) GetCipherSuites

func (c *ServerAuth) GetCipherSuites() ([]uint16, error)

GetCipherSuites returns a list of IDs of cipher suites in configuration. This list can be passed to tls.Config.

type ServerKeyVault

type ServerKeyVault struct {
	CertificateProvider interface {
		ServerCertificate(ctx context.Context, id string) (tls.Certificate, error)
	} `name:"-"`
	ID string `name:"id" description:"ID of the certificate"`
}

ServerKeyVault defines configuration for loading a TLS server certificate from the key vault.