key

type ClientFetcher ¶

type ClientFetcher interface {
	Fetch(host string) (PublicKey, error)
}

ClientFetcher is a generic interface to allow fetching the server's public key from different sources.

type ClientFetcherCache ¶

type ClientFetcherCache struct {
	// contains filtered or unexported fields
}

ClientFetcherCache is a generic interface to allow fetching the server's public key from different sources. It will cache the public key for a given TTL.

func NewClientFetcherCache(fetcher ClientFetcher, optFuncs ...func(*ClientFetcherCacheOptions)) *ClientFetcherCache

func (c *ClientFetcherCache) Fetch(host string) (PublicKey, error)

type ClientFetcherCacheOptions ¶

type ClientFetcherCacheOptions struct {
	// contains filtered or unexported fields
}

ClientFetcherCacheOptions contains options for the ClientFetcherCache.

type ClientFetcherDNSKEY ¶

type ClientFetcherDNSKEY struct {
	// contains filtered or unexported fields
}

ClientFetcherDNSKEY retrieves the server's public key in the DNSKEY resource record using DNS over HTTPS. It's highly recommended to wrap this fetcher in a cache (ClientFetcherCache) to avoid network overheads on every handshake.

It supports DNSKEY containing RSA, ECDSA and Ed25519 keys.

func NewClientFetcherDNSKEY(provider string, optFuncs ...func(*ClientFetcherDNSKEYOptions)) ClientFetcherDNSKEY

func (c ClientFetcherDNSKEY) Fetch(host string) (PublicKey, error)

package main

import (
	"log"

	"github.com/rafaeljusto/goe2ee"
	"github.com/rafaeljusto/goe2ee/key"
)

func main() {
	hostport := "example.com:123"
	client, err := goe2ee.DialTCP(hostport,
		goe2ee.ClientWithKeyFetcher(key.NewClientFetcherDNSKEY(key.GoogleDNSProvider)),
	)
	if err != nil {
		panic(err)
	}
	defer func() {
		if err := client.Close(); err != nil {
			log.Printf("failed to close client: %v", err)
		}
	}()
}

Output:

type ClientFetcherDNSKEYOptions ¶

type ClientFetcherDNSKEYOptions struct {
	// contains filtered or unexported fields
}

ClientFetcherDNSKEYOptions contains options for the KeyFetcherDNSKEY constructor.

type ClientFetcherInMemory ¶

type ClientFetcherInMemory struct {
	// contains filtered or unexported fields
}

ClientFetcherInMemory retrieves the server's public key from an in-memory storage.

func NewClientFetcherInMemory(publicKey PublicKey) ClientFetcherInMemory

func ParseClientFetcherPEM(r io.Reader) (*ClientFetcherInMemory, error)

func (c ClientFetcherInMemory) Fetch(_ string) (PublicKey, error)

type ClientFetcherProtocol ¶

type ClientFetcherProtocol struct {
	// contains filtered or unexported fields
}

ClientFetcherProtocol retrieves the server's public key using the goe2ee protocol. This fetcher could be vulnerable to man-in-the-middle attacks. It's highly recommended to wrap this fetcher in a cache (ClientFetcherCache) to avoid network overheads on every handshake.

func NewClientFetcherProtocol(network, serverAddr string) ClientFetcherProtocol

func (c ClientFetcherProtocol) Fetch(_ string) (PublicKey, error)

package main

import (
	"log"

	"github.com/rafaeljusto/goe2ee"
	"github.com/rafaeljusto/goe2ee/key"
)

func main() {
	hostport := "example.com:123"
	client, err := goe2ee.DialTCP(hostport,
		goe2ee.ClientWithKeyFetcher(key.NewClientFetcherProtocol("tcp", hostport)),
	)
	if err != nil {
		panic(err)
	}
	defer func() {
		if err := client.Close(); err != nil {
			log.Printf("failed to close client: %v", err)
		}
	}()
}

Output:

type ClientFetcherTLS ¶

type ClientFetcherTLS struct {
	// contains filtered or unexported fields
}

ClientFetcherTLS retrieves the server's public key in the TLS certificate. It's highly recommended to wrap this fetcher in a cache (ClientFetcherCache) to avoid network overheads on every handshake.

func NewClientFetcherTLS(optFuncs ...func(*ClientFetcherTLSOptions)) ClientFetcherTLS

func (c ClientFetcherTLS) Fetch(host string) (publicKey PublicKey, err error)

package main

import (
	"log"

	"github.com/rafaeljusto/goe2ee"
	"github.com/rafaeljusto/goe2ee/key"
)

func main() {
	hostport := "example.com:123"
	client, err := goe2ee.DialTCP(hostport,
		goe2ee.ClientWithKeyFetcher(key.NewClientFetcherTLS()),
	)
	if err != nil {
		panic(err)
	}
	defer func() {
		if err := client.Close(); err != nil {
			log.Printf("failed to close client: %v", err)
		}
	}()
}

Output:

type ClientFetcherTLSOptions ¶

type ClientFetcherTLSOptions struct {
	// contains filtered or unexported fields
}

ClientFetcherTLSOptions contains options for the ClientFetcherTLS.

type PublicKey ¶

type PublicKey struct {
	crypto.PublicKey
}

PublicKey adds some extra functionality to the crypto.PublicKey interface.

func (p PublicKey) VerifySignature(hashType crypto.Hash, content, signature []byte) (bool, error)

type ServerManager ¶

type ServerManager interface {
	FetchKey() (protocol.KeyAlgorithm, PublicKey, error)
	Sign(crypto.Hash, []byte) ([]byte, error)
}

ServerManager is a generic interface to manage the server's key-pair.

type ServerManagerInMemory ¶

type ServerManagerInMemory struct {
	// contains filtered or unexported fields
}

ServerManagerInMemory loads the private key and stores it in-memory.

func NewServerManager(privateKey crypto.PrivateKey) *ServerManagerInMemory

func ServerManagerGenerateOnTheFly(algorithm protocol.KeyAlgorithm) (*ServerManagerInMemory, error)

func ServerManagerParsePEM(r io.Reader) (*ServerManagerInMemory, error)

func (s *ServerManagerInMemory) FetchKey() (protocol.KeyAlgorithm, PublicKey, error)

func (s *ServerManagerInMemory) Sign(hashType crypto.Hash, content []byte) ([]byte, error)