Versions in this module Expand all Collapse all v0 v0.2.0 Oct 11, 2026 Changes in this version + var ErrPolicy = errors.New("refused by the crypto policy") type Auditor + func MultiAuditor(as ...Auditor) Auditor + func SlogAuditor(log *slog.Logger) Auditor type CertValidator + func AllValidators(vs ...CertValidator) CertValidator + func ValidityPeriod(now func() time.Time) CertValidator + type FileKeySource struct + CertFile string + KeyFile string + func (s *FileKeySource) Identity(context.Context) (Identity, error) + type FileStore struct + Path string + func (s *FileStore) Load(_ context.Context, v any) error + func (s *FileStore) Save(_ context.Context, v any) error + type MemorySequences struct + func (s *MemorySequences) Last(subject string) (uint32, bool) + func (s *MemorySequences) Store(subject string, n uint32) + type MemoryStore struct + func (s *MemoryStore) Load(_ context.Context, v any) error + func (s *MemoryStore) Save(_ context.Context, v any) error + type PolicyRules struct + AllowEd25519 bool + Allowed map[string][]string + Denied []string + MinECBits int + MinKeyBits map[string]int + MinRSABits int + MinTagBits int + func (p PolicyRules) Allow(_ context.Context, use string, alg Algorithm) error + type StaticKeySource Identity + func (s StaticKeySource) Identity(context.Context) (Identity, error) v0.1.0 Oct 11, 2026 Changes in this version + const AlgCipher + const AlgDH + const AlgHash + const AlgKeyWrap + const AlgMAC + const AlgPublicKey + const OutcomeFailure + const OutcomeSuccess + const RoleOpAdd + const RoleOpChange + const RoleOpDelete + const RoleOpNone + var ErrNotStored = errors.New("no saved state") + var ErrRevoked = errors.New("certificate revoked") + func ServerNameFor(c TLSClient, addr string) string + func SetKeepalive(conn any, f Keepalive) bool + func TLSListener(l net.Listener, s TLSServer) net.Listener + type AccessToken struct + Holder string + Impl any + Legacy bool + NotAfter time.Time + NotBefore time.Time + Roles []RoleEntry + Signature []byte + SignatureAlgorithm asn1.ObjectIdentifier + TBS []byte + type Algorithm struct + Key any + KeyBits int + Kind string + Name string + TagBits int + type AuditFunc func(ctx context.Context, e SecurityEvent) + func (f AuditFunc) RecordSecurity(ctx context.Context, e SecurityEvent) + type Auditor interface + RecordSecurity func(ctx context.Context, e SecurityEvent) + type CertValidator interface + ValidateCertificate func(ctx context.Context, c *x509.Certificate) error + type CertValidatorFunc func(ctx context.Context, c *x509.Certificate) error + func (f CertValidatorFunc) ValidateCertificate(ctx context.Context, c *x509.Certificate) error + type CertificateRoleAuthority interface + CertificateRoles func(ctx context.Context, der []byte, issuer *x509.Certificate, req RoleRequest) ([]RoleGrant, error) + type CryptoPolicy interface + Allow func(ctx context.Context, use string, alg Algorithm) error + type CryptoPolicyFunc func(ctx context.Context, use string, alg Algorithm) error + func (f CryptoPolicyFunc) Allow(ctx context.Context, use string, alg Algorithm) error + type Dialer interface + DialContext func(ctx context.Context, network, address string) (net.Conn, error) + type DialerFunc func(ctx context.Context, network, address string) (net.Conn, error) + func (f DialerFunc) DialContext(ctx context.Context, network, address string) (net.Conn, error) + type Identity struct + Certificates []*x509.Certificate + Key crypto.Signer + type Keepalive = func() error + type KeepaliveConn interface + SetKeepalive func(f Keepalive) + type KeySource interface + Identity func(ctx context.Context) (Identity, error) + type NewRoleAuthority func(scope RoleScope) (RoleAuthority, error) + type RoleAuthority interface + Authorize func(ctx context.Context, tok AccessToken, req RoleRequest) ([]RoleGrant, error) + CheckSignature func(tok AccessToken, issuer *x509.Certificate, allowSHA1 bool) error + MatchArea func(aor string, local []string) bool + ReadToken func(der []byte, attribute bool) (AccessToken, error) + type RoleEntry struct + AoR string + Definition string + HasSequence bool + IDs []int + Operation int + Revision int + Sequence uint32 + type RoleGrant struct + AoR string + Definition string + HasSequence bool + ID int + Name string + Operation int + Revision int + Rights []string + Sequence uint32 + type RoleRequest struct + Peer string + Remote bool + SubjectAuthenticated bool + TokenVerified bool + type RoleScope struct + Areas []string + Log *slog.Logger + Sequences SequenceStore + Subject string + type SecurityEvent struct + Actor string + Category string + Detail map[string]string + Event string + Method string + Outcome string + Peer string + Subject string + Tenant string + type SequenceStore interface + Last func(subject string) (uint32, bool) + Store func(subject string, n uint32) + type StdTLS struct + Config *tls.Config + func (s StdTLS) Client(ctx context.Context, raw net.Conn, serverName string) (net.Conn, error) + func (s StdTLS) Server(raw net.Conn) net.Conn + func (s StdTLS) ServerName() string + type Store interface + Load func(ctx context.Context, v any) error + Save func(ctx context.Context, v any) error + type TLSClient interface + Client func(ctx context.Context, raw net.Conn, serverName string) (net.Conn, error) + type TLSNamedClient interface + ServerName func() string + type TLSSelection struct + CipherSuites []string + CipherSuites13 []string + type TLSServer interface + Server func(raw net.Conn) net.Conn + type TLSServerProfile func(sel TLSSelection) (TLSServer, error)
Go to main page