atls

Documentation

Overview

Package atls exposes the accepted TLS and exported-authenticator binding helpers used by the Direct-Agent verifier surface.

The package does not verify TLS itself. It relies on an accepted TLS 1.3 connection from the deployment TLS stack and derives profile binding inputs from that connection and the accepted endpoint material.

Index

• Variables
• func BuildServerTLSConfig(certFile, keyFile, serverCAFile, clientCAFile string) (*tls.Config, tls.Certificate, bool, error)
• func IdentityBindingFromConnectionState(st *tls.ConnectionState, validation *ea.ValidationResult) (identitypolicy.Binding, error)
• func IdentityBindingFromValidation(validation *ea.ValidationResult) (identitypolicy.Binding, error)
• func NewRandomRequest(contextLen int) (*ea.AuthenticatorRequest, error)
• func NewRequest(context []byte) (*ea.AuthenticatorRequest, error)
• func VerificationPolicyFromEvidenceVerifier(v eaattestation.EvidenceVerifier) eaattestation.VerificationPolicy
• func VerifyOptionsFromTLSConfig(cfg *tls.Config) *x509.VerifyOptions
• type AuthenticatorRequest
• type CertificateProvider
  • func NewProvider(evidenceSource eaattestation.EvidenceSource) (CertificateProvider, error)
• type ClientConfig
• type Conn
  • func Client(tlsConn *tls.Conn, cfg *ClientConfig) (*Conn, error)
  • func Dial(network, address string, cfg *ClientConfig) (*Conn, error)
  • func DialContext(ctx context.Context, network, address string, cfg *ClientConfig) (*Conn, error)
  • func DialWithDialer(dialer *net.Dialer, network, address string, cfg *ClientConfig) (*Conn, error)
  • func Server(tlsConn *tls.Conn, cfg *ServerConfig) (*Conn, error)
• type Listener
  • func Listen(network, address string, cfg *ServerConfig) (*Listener, error)
• type ObservedIdentityFunc
• type ServerConfig

Variables

var ErrMissingObservedIdentity = internaltransport.ErrMissingObservedIdentity

ErrMissingObservedIdentity reports an enabled identity policy without a trusted observed-identity source.

Functions

func BuildServerTLSConfig

func BuildServerTLSConfig(certFile, keyFile, serverCAFile, clientCAFile string) (*tls.Config, tls.Certificate, bool, error)

BuildServerTLSConfig prepares the base TLS configuration used by the EA/aTLS transport. If no certificate/key pair is configured, it falls back to an ephemeral self-signed identity bound by the exported authenticator.

func IdentityBindingFromConnectionState

func IdentityBindingFromConnectionState(st *tls.ConnectionState, validation *ea.ValidationResult) (identitypolicy.Binding, error)

IdentityBindingFromConnectionState derives identity-policy binding values from the accepted TLS session and aTLS validation result.

func IdentityBindingFromValidation

func IdentityBindingFromValidation(validation *ea.ValidationResult) (identitypolicy.Binding, error)

IdentityBindingFromValidation derives the identity-policy binding values from the accepted aTLS validation result.

func NewRandomRequest

func NewRandomRequest(contextLen int) (*ea.AuthenticatorRequest, error)

func NewRequest

func NewRequest(context []byte) (*ea.AuthenticatorRequest, error)

func VerificationPolicyFromEvidenceVerifier

func VerificationPolicyFromEvidenceVerifier(v eaattestation.EvidenceVerifier) eaattestation.VerificationPolicy

func VerifyOptionsFromTLSConfig

func VerifyOptionsFromTLSConfig(cfg *tls.Config) *x509.VerifyOptions

Types

type AuthenticatorRequest

type AuthenticatorRequest = ea.AuthenticatorRequest

type CertificateProvider

type CertificateProvider interface {
	BuildLeafExtensions(st *tls.ConnectionState, req *ea.AuthenticatorRequest, leaf *x509.Certificate) ([]ea.Extension, error)
}

CertificateProvider builds leaf extensions for accepted aTLS call sites. In the EA-based implementation it provides the leaf certificate-entry extensions carried in the exported authenticator instead of generating TLS certificates.

func NewProvider

func NewProvider(evidenceSource eaattestation.EvidenceSource) (CertificateProvider, error)

type ClientConfig

type ClientConfig = internaltransport.ClientConfig

type Conn

type Conn = internaltransport.Conn

func Client

func Client(tlsConn *tls.Conn, cfg *ClientConfig) (*Conn, error)

func Dial

func Dial(network, address string, cfg *ClientConfig) (*Conn, error)

func DialContext

func DialContext(ctx context.Context, network, address string, cfg *ClientConfig) (*Conn, error)

func DialWithDialer

func DialWithDialer(dialer *net.Dialer, network, address string, cfg *ClientConfig) (*Conn, error)

func Server

func Server(tlsConn *tls.Conn, cfg *ServerConfig) (*Conn, error)

type Listener

type Listener = internaltransport.Listener

func Listen

func Listen(network, address string, cfg *ServerConfig) (*Listener, error)

type ObservedIdentityFunc

type ObservedIdentityFunc = internaltransport.ObservedIdentityFunc

ObservedIdentityFunc extracts a session-bound identity assertion after aTLS validation.

type ServerConfig

type ServerConfig = internaltransport.ServerConfig