rest

Documentation

Index

• Constants
• func DecodeBody(req *http.Request, out interface{}) error
• func WrapTLSClient(conn net.Conn, tlsConfig *tls.Config) (net.Conn, error)
• type Config
  • func (c *Config) AppendCA(pool *x509.CertPool) error
  • func (c *Config) IncomingTLSConfig() (*tls.Config, error)
  • func (c *Config) KeyPair() (*tls.Certificate, error)
  • func (c *Config) OutgoingTLSConfig() (*tls.Config, error)
• type HTTPCodedError
  • func CodedError(c cerr.ErrCodeType, s string) HTTPCodedError
• type HTTPServer
  • func NewHTTPServer(listen string, tls *TLSConfig) (*HTTPServer, error)
  • func (s *HTTPServer) RegisterHandler(url string, rhandler RequestHandler)
  • func (s *HTTPServer) Serve()
  • func (s *HTTPServer) Shutdown()
• type RegionWrapper
• type RequestHandler
• type Server
• type TLSConfig
  • func (t *TLSConfig) Merge(b *TLSConfig) *TLSConfig
• type Wrapper
  • func RegionSpecificWrapper(region string, tlsWrap RegionWrapper) Wrapper

Constants

const (
	// ErrInvalidMethod is used if the HTTP method is not supported
	ErrInvalidMethod = "Invalid method"

	// ErrInvalidParams is used if the HTTP request params is not valid
	ErrInvalidParams = "Invalid request params"

	// ErrInvalidRequest is used if the HTTP request is invalid for example: invalid parameter ...
	ErrInvalidRequest = "Invalid request"

	ErrPermissionDenied = "Permission deny"

	ErrInternalServerError = "Internal server error"

	ErrMethodNotImplemented = "Method not implementated"

	// ErrCodeDuplicateEntity is error code to indicate has duplicate resource
	ErrCodeDuplicateEntity cerr.ErrCodeType = 1001
)

Functions

func DecodeBody

func DecodeBody(req *http.Request, out interface{}) error

DecodeBody is used to decode a JSON request body

func WrapTLSClient

func WrapTLSClient(conn net.Conn, tlsConfig *tls.Config) (net.Conn, error)

Wrap a net.Conn into a client tls connection, performing any additional verification as needed.

As of go 1.3, crypto/tls only supports either doing no certificate verification, or doing full verification including of the peer's DNS name. For consul, we want to validate that the certificate is signed by a known CA, but because consul doesn't use DNS names for node names, we don't verify the certificate DNS names. Since go 1.3 no longer supports this mode of operation, we have to do it manually.

Types

type Config

type Config struct {
	// VerifyIncoming is used to verify the authenticity of incoming connections.
	// This means that TCP requests are forbidden, only allowing for TLS. TLS connections
	// must match a provided certificate authority. This can be used to force client auth.
	VerifyIncoming bool

	// VerifyOutgoing is used to verify the authenticity of outgoing connections.
	// This means that TLS requests are used, and TCP requests are not made. TLS connections
	// must match a provided certificate authority. This is used to verify authenticity of
	// server nodes.
	VerifyOutgoing bool

	// VerifyServerHostname is used to enable hostname verification of servers. This
	// ensures that the certificate presented is valid for server.<datacenter>.<domain>.
	// This prevents a compromised client from being restarted as a server, and then
	// intercepting request traffic as well as being added as a raft peer. This should be
	// enabled by default with VerifyOutgoing, but for legacy reasons we cannot break
	// existing clients.
	VerifyServerHostname bool

	// CAFile is a path to a certificate authority file. This is used with VerifyIncoming
	// or VerifyOutgoing to verify the TLS connection.
	CAFile string

	// CertFile is used to provide a TLS certificate that is used for serving TLS connections.
	// Must be provided to serve TLS connections.
	CertFile string

	// KeyFile is used to provide a TLS key that is used for serving TLS connections.
	// Must be provided to serve TLS connections.
	KeyFile string
}

Config used to create tls.Config

func (*Config) AppendCA

func (c *Config) AppendCA(pool *x509.CertPool) error

AppendCA opens and parses the CA file and adds the certificates to the provided CertPool.

func (*Config) IncomingTLSConfig

func (c *Config) IncomingTLSConfig() (*tls.Config, error)

IncomingTLSConfig generates a TLS configuration for incoming requests

func (*Config) KeyPair

func (c *Config) KeyPair() (*tls.Certificate, error)

KeyPair is used to open and parse a certificate and key file

func (*Config) OutgoingTLSConfig

func (c *Config) OutgoingTLSConfig() (*tls.Config, error)

OutgoingTLSConfig generates a TLS configuration for outgoing requests. It will return a nil config if this configuration should not use TLS for outgoing connections.

type HTTPCodedError

type HTTPCodedError interface {
	error
	Code() cerr.ErrCodeType
}

HTTPCodedError is used to provide the HTTP error code

func CodedError

func CodedError(c cerr.ErrCodeType, s string) HTTPCodedError

type HTTPServer

type HTTPServer struct {
	HTTPAPIResponseHeaders map[string]string
	// contains filtered or unexported fields
}

HTTPServer is used to wrap an Agent and expose it over an HTTP interface

func NewHTTPServer

func NewHTTPServer(listen string, tls *TLSConfig) (*HTTPServer, error)

NewHTTPServer creates new HTTP server

func (*HTTPServer) RegisterHandler

func (s *HTTPServer) RegisterHandler(url string, rhandler RequestHandler)

RegisterHandler register the handler function for http server

func (*HTTPServer) Serve

func (s *HTTPServer) Serve()

Serve is used to start the HTTP server

func (*HTTPServer) Shutdown

func (s *HTTPServer) Shutdown()

Shutdown is used to shutdown the HTTP server

type RegionWrapper

type RegionWrapper func(region string, conn net.Conn) (net.Conn, error)

RegionWrapper is a function that is used to wrap a non-TLS connection and returns an appropriate TLS connection or error. This takes a Region as an argument.

type RequestHandler

type RequestHandler func(resp http.ResponseWriter, req *http.Request) (interface{}, error)

RequestHandler defines the function type for handling http request

type Server

type Server interface {
	Start() (err error)
	Shutdown()
}

Server interface ...

type TLSConfig

type TLSConfig struct {

	// EnableHTTP enabled TLS for http traffic to the Nomad server and clients
	EnableHTTP bool

	// EnableRPC enables TLS for RPC and Raft traffic to the Nomad servers
	EnableRPC bool

	// VerifyServerHostname is used to enable hostname verification of servers. This
	// ensures that the certificate presented is valid for server.<region>.nomad
	// This prevents a compromised client from being restarted as a server, and then
	// intercepting request traffic as well as being added as a raft peer. This should be
	// enabled by default with VerifyOutgoing, but for legacy reasons we cannot break
	// existing clients.
	VerifyServerHostname bool

	// CAFile is a path to a certificate authority file. This is used with VerifyIncoming
	// or VerifyOutgoing to verify the TLS connection.
	CAFile string

	// CertFile is used to provide a TLS certificate that is used for serving TLS connections.
	// Must be provided to serve TLS connections.
	CertFile string

	// KeyFile is used to provide a TLS key that is used for serving TLS connections.
	// Must be provided to serve TLS connections.
	KeyFile string
}

TLSConfig provides TLS related configuration

func (*TLSConfig) Merge

func (t *TLSConfig) Merge(b *TLSConfig) *TLSConfig

Merge is used to merge two TLS configs together

type Wrapper

type Wrapper func(conn net.Conn) (net.Conn, error)

Wrapper wraps a connection and enables TLS on it.

func RegionSpecificWrapper

func RegionSpecificWrapper(region string, tlsWrap RegionWrapper) Wrapper

RegionSpecificWrapper is used to invoke a static Region and turns a RegionWrapper into a Wrapper type.