nox

func CheckKnownhosts ¶

func CheckKnownhosts(address string, pubKey PublicKey, conn *Conn) error

CheckKnownhosts looks up address in the "known_hosts" file in the nearest ".nox" directory. If it is present and the public key matches, CheckKnownhosts returns nil.

CheckKnownhosts implements the remote specifier "known" in nox addresses.

func CheckTrustOnFirstUse ¶

func CheckTrustOnFirstUse(address string, pubKey PublicKey, conn *Conn) error

CheckTrustOnFirstUse is like CheckKnownhosts. If a public key is associated with the address in the "known_hosts" file, the check passes. If the address is not in the "known_hosts" file, CheckTrustOnFirstUse adds the remote public key to the file. Future connections to the same address require the same public key from remote.

It is an error if the "known_hosts" file does not exist yet.

CheckTrustOnFirstUse implements the remote specifier "tofu" in nox addresses.

func Listen ¶

func Listen(network, address string, config *Config) (net.Listener, error)

Listen creates a new listener for incoming connections. Accept on the returned listener returns a *Conn with the handshake not yet completed. The first read or write performs the handshake, as does calling RemoteAddress.

Listen calls ParseAddress on address, which can be a nox address.

package main

import (
	"io"
	"log"

	"github.com/mjl-/nox"
)

func main() {
	// Use defaults "+fs+known" to make server read ".nox/private_key" and ".nox/known_hosts".
	address := "localhost:1047"

	config := &nox.Config{}
	l, err := nox.Listen("tcp", address, config)
	if err != nil {
		log.Fatalf("listen: %s", err)
	}

	log.Printf("listening on %s, local static public key %s\n", config.Address, config.LocalStaticPublic())

	serve := func(conn *nox.Conn) {
		defer conn.Close()
		io.Copy(conn, conn)
	}

	for {
		conn, err := l.Accept()
		if err != nil {
			log.Fatalf("accept: %s", err)
		}

		go serve(conn.(*nox.Conn))
	}
}

Output:

func NearestNoxDir ¶

func NearestNoxDir() (string, error)

NearestNoxDir locates the nearest directory named ".nox", starting at the current directory, walking up to the root. If no directory was found, ErrNoNoxDir is returned.

func ParseAddress ¶

func ParseAddress(address string, config *Config) (rerr error)

ParseAddress parses a regular "host:port" address, or a nox address of the form "host:port+local+remote". Config is updated with information from "local" and "remote". The leftover regular address is stored in config.Address.

"Local" specifies the local static private key, and must be one of:

• a literal base64-raw-url-encoded key. Keep in mind this address may be printed or logged, revealing it unintentionally.
• "fs", read the key from the file "private_key" from the nearest ".nox" directory. The default for regular addresses.
• "new", a new private key is created and used for the lifetime of the program.
• "" (empty string), nothing is done, in which case the "config" parameter must contain a private key.

"Remote" specifies the remote static public keys, and must be a comma-separated list of:

• a literal base64-raw-url-encoded key.
• "known", read the file "known_hosts" for known public keys from the nearest ".nox" directory. The default for regular addresses.
• "tofu", for trust on first use, like "known", but adds a line to the known hosts file for a previously unseen address, returning an error if no known hosts file was found.
• "any", for trusting any remote public key, this is unsafe and should only be used for testing or merely fetching the remote's public key.

Example addresses:

localhost:1047
localhost:1047+fs+known
localhost:1047+fs+tofu
localhost:1047+EzckHRK9zMVib3vIHYc17LztyyabLGaV5F7Z-ye5yRQ+S1KCaHr7wHI4f06GY4uPstZnPC6UIDzwkYq48B3lhG8
localhost:1047+new+any