listener

Documentation

Index

• func CertificateExpiry(cert tls.Certificate) (time.Time, error)
• func ChunkForDNS(data []byte) [][]byte
• func GenerateSelfSignedCert() (tls.Certificate, string, error)
• func LoadOrCreateCert(certPath, keyPath string) (tls.Certificate, string, error)
• func NewTLSConfig(cert tls.Certificate) *tls.Config
• type DNSHandler
  • func NewDNSHandler(store *session.Store, nc *nonce.Cache, domain string) *DNSHandler
  • func (h *DNSHandler) ServeDNS(w mdns.ResponseWriter, r *mdns.Msg)
• type HTTPSHandler
  • func NewHTTPSHandler(store *session.Store, nc *nonce.Cache) *HTTPSHandler
  • func (h *HTTPSHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)

Functions

func CertificateExpiry

func CertificateExpiry(cert tls.Certificate) (time.Time, error)

CertificateExpiry returns the leaf certificate's expiration time.

func ChunkForDNS

func ChunkForDNS(data []byte) [][]byte

ChunkForDNS splits data into chunks suitable for DNS label encoding. Exported so the agent transport can use the same chunking logic.

func GenerateSelfSignedCert

func GenerateSelfSignedCert() (tls.Certificate, string, error)

GenerateSelfSignedCert generates an ECDSA P-256 TLS certificate valid for 1 year. Returns the tls.Certificate, its SHA-256 fingerprint as a hex string, and any error. Use LoadOrCreateCert when persistence across server restarts is needed.

func LoadOrCreateCert

func LoadOrCreateCert(certPath, keyPath string) (tls.Certificate, string, error)

LoadOrCreateCert loads a persisted TLS certificate from certPath/keyPath, or generates a new one and writes it to those paths if they don't exist. Persisting the cert keeps the fingerprint stable across server restarts, so agents baked with that fingerprint don't need to be rebuilt after every restart.

func NewTLSConfig

func NewTLSConfig(cert tls.Certificate) *tls.Config

NewTLSConfig returns a TLS 1.3-minimum config using the provided certificate. TLS 1.2 and below are explicitly rejected.

Types

type DNSHandler

type DNSHandler struct {
	// contains filtered or unexported fields
}

DNSHandler is an authoritative DNS server that decodes agent beacons. Query format: <base32chunk>.<index>.<total>.<sessionID>.<agentID>.<authTag>.<domain>

func NewDNSHandler

func NewDNSHandler(store *session.Store, nc *nonce.Cache, domain string) *DNSHandler

NewDNSHandler creates a DNSHandler for the given authoritative domain. domain must end with "." (e.g. "c2.example.com.")

func (*DNSHandler) ServeDNS

func (h *DNSHandler) ServeDNS(w mdns.ResponseWriter, r *mdns.Msg)

ServeDNS implements dns.Handler. Query name format: <base32chunk>.<chunkIndex>.<totalChunks>.<sessionID>.<agentID>.<authTag>.<domain>

type HTTPSHandler

type HTTPSHandler struct {
	// contains filtered or unexported fields
}

HTTPSHandler processes agent beacons over HTTPS.

func NewHTTPSHandler

func NewHTTPSHandler(store *session.Store, nc *nonce.Cache) *HTTPSHandler

NewHTTPSHandler creates a handler that validates and processes beacons.

func (*HTTPSHandler) ServeHTTP

func (h *HTTPSHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)