identity

Documentation

Overview

Package identity is the member key: lt_ plus 48 hex characters (24 bytes). The node stores SHA-256(key); HMAC/HKDF need the plaintext in members.keys.

Index

• func Match(plain, sha string) bool
• func NewKey() (plain, sha string, err error)
• func Short(sha string) string
• func Sum(plain string) string
• type Ring
  • func Load(path string) (*Ring, error)
  • func NewRing() *Ring
  • func (r *Ring) Delete(id string)
  • func (r *Ring) Filter(want map[string]string)
  • func (r *Ring) IDFor(token []byte) string
  • func (r *Ring) Len() int
  • func (r *Ring) Put(id, token string)
  • func (r *Ring) Replace(src *Ring)
  • func (r *Ring) Save(path string) error
  • func (r *Ring) TokenFor(id string) []byte
  • func (r *Ring) Tokens() [][]byte

Functions

func Match

func Match(plain, sha string) bool

Match reports whether plain hashes to sha. Empty either side is false.

func NewKey

func NewKey() (plain, sha string, err error)

NewKey mints a member key: lt_ plus 48 hex characters (24 random bytes). Shown once; the node stores SHA-256. This is a device credential, not a user password.

func Short

func Short(sha string) string

Short is a log-safe truncation of a hex SHA-256.

func Sum

func Sum(plain string) string

Sum is hex(SHA-256(plain)), the form stored in network.conf.

Types

type Ring

type Ring struct {
	// contains filtered or unexported fields
}

Ring is the in-memory set of member keys. HMAC and HKDF need the plaintext; network.conf keeps only SHA-256. One id may hold several tokens (the live key plus a reissue waiting for apply).

func Load

func Load(path string) (*Ring, error)

Load reads `{dir}/members.keys` (YAML map id → lt_… or a list of them). Missing file is empty.

func NewRing

func NewRing() *Ring

NewRing is an empty key ring.

func (*Ring) Delete

func (r *Ring) Delete(id string)

Delete removes id if present.

func (*Ring) Filter

func (r *Ring) Filter(want map[string]string)

Filter drops ids unknown to network.conf and tokens whose SHA-256 does not match. A reissue keeps the old token on disk until apply; Filter then keeps whichever token matches want.

func (*Ring) IDFor

func (r *Ring) IDFor(token []byte) string

IDFor returns the member id whose token equals the given bytes.

func (*Ring) Len

func (r *Ring) Len() int

Len is the number of members with at least one token.

func (*Ring) Put

func (r *Ring) Put(id, token string)

Put stores plaintext token for id. A second token for the same id is kept (reissue before apply) so a reload still matches network.conf.

func (*Ring) Replace

func (r *Ring) Replace(src *Ring)

Replace takes every key of src (a reload of members.keys).

func (*Ring) Save

func (r *Ring) Save(path string) error

Save writes id: lt_… YAML with mode 0600, sorted by id. One token stays a scalar so older nodes still read the file; several become a list.

func (*Ring) TokenFor

func (r *Ring) TokenFor(id string) []byte

TokenFor copies the latest plaintext token for id (the reissued key if several are stored).

func (*Ring) Tokens

func (r *Ring) Tokens() [][]byte

Tokens copies every plaintext key for CheckAuthAny.