internal

package
v0.0.0-...-edc748c Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jan 25, 2023 License: MIT Imports: 28 Imported by: 0

Documentation

Index

Constants

View Source
const (
	IPv4ServerDefault = "https://ipv4.openspa.org"
	IPv6ServerDefault = "https://ipv6.openspa.org"
)
View Source
const (
	ServerConfigADKXDPModeSKB    = "skb"
	ServerConfigADKXDPModeDriver = "driver"
)
View Source
const (
	ServerConfigFirewallBackendIPTables = "iptables"
	ServerConfigFirewallBackendCommand  = "command"
	ServerConfigFirewallBackendNone     = "none" // used for performance measurements, not for production workload
)
View Source
const (
	ServerConfigAuthorizationBackendSimple  = "simple"
	ServerConfigAuthorizationBackendCommand = "command"
	ServerConfigAuthorizationBackendNone    = "none" // used for performance measurements, not for production workload
)
View Source
const (
	IPTablesChainDefault = "OPENSPA-ALLOW"
)
View Source
const NoRequestHandlersDefault = 100
View Source
const OSPAFileVersion = "0.2"
View Source
const ServerHTTPPortDefault = 22212
View Source
const VersionBugfix = 1
View Source
const VersionInfo = "dev"
View Source
const VersionMajor = 0
View Source
const VersionMinor = 0

Variables

View Source
var (
	FirewallProtoTCP    = "TCP"
	FirewallProtoUDP    = "UDP"
	FirewallProtoICMP   = "ICMP"
	FirewallProtoICMPv6 = "ICMPv6"
)
View Source
var IPTablesSettingsDefault = IPTablesSettings{
	Chain: IPTablesChainDefault,
}
View Source
var RequestRoutineOptDefault = RequestRoutineOpt{
	Sender: NewUDPSend(),
}

Functions

func GetIP

func GetIP(ipv4Server, ipv6Server string)

func NewServerCipherSuite

func NewServerCipherSuite(c ServerConfigCrypto) (crypto.CipherSuite, error)

func ResolveClientsIPAndVersionBasedOnTargetIP

func ResolveClientsIPAndVersionBasedOnTargetIP(ipv4ResServer, ipv6ResServer string, target net.IP) (net.IP, error)

func SetMetricsRepository

func SetMetricsRepository(m observability.MetricsRepository)

func SetupClientCipherSuite

func SetupClientCipherSuite(ospa OSPA) (crypto.CipherSuite, error)

func SetupXDPADKMetrics

func SetupXDPADKMetrics(sp xdp.StatsProvider, stop chan bool)

func Version

func Version() string

Types

type ADKProofGen

type ADKProofGen struct {
	// contains filtered or unexported fields
}

func NewADKProofGen

func NewADKProofGen(secret string) ADKProofGen

func (ADKProofGen) ADKProofNext

func (a ADKProofGen) ADKProofNext() uint32

func (ADKProofGen) ADKProofNow

func (a ADKProofGen) ADKProofNow() uint32

type AuthorizationStrategy

type AuthorizationStrategy interface {
	RequestAuthorization(request tlv.Container) (time.Duration, error)
}

func NewAuthorizationStrategyFromServerConfigAuthorization

func NewAuthorizationStrategyFromServerConfigAuthorization(s ServerConfigAuthorization) (AuthorizationStrategy, error)

type AuthorizationStrategyCommand

type AuthorizationStrategyCommand struct {
	AuthorizeCmd string
	// contains filtered or unexported fields
}

func NewAuthorizationStrategyCommand

func NewAuthorizationStrategyCommand(cmd string) *AuthorizationStrategyCommand

func (AuthorizationStrategyCommand) RequestAuthorization

func (a AuthorizationStrategyCommand) RequestAuthorization(c tlv.Container) (time.Duration, error)

type AuthorizationStrategyCommandAuthorizeInput

type AuthorizationStrategyCommandAuthorizeInput struct {
	ClientUUID      string `json:"clientUUID"`
	IPIsIPv6        bool   `json:"ipIsIPv6"`
	ClientIP        net.IP `json:"clientIP"`
	TargetIP        net.IP `json:"targetIP"`
	TargetProtocol  string `json:"targetProtocol"`
	TargetPortStart int    `json:"targetPortStart"`
	TargetPortEnd   int    `json:"targetPortEnd"`
}

type AuthorizationStrategyCommandAuthorizeOutput

type AuthorizationStrategyCommandAuthorizeOutput struct {
	Duration int `json:"duration"`
}

type AuthorizationStrategySimple

type AuthorizationStrategySimple struct {
	// contains filtered or unexported fields
}

AuthorizationStrategySimple authorizes any form of request as long as it is authenticated successfully (authentication should be performed externally).

func NewAuthorizationStrategyAllow

func NewAuthorizationStrategyAllow(duration time.Duration) *AuthorizationStrategySimple

func (AuthorizationStrategySimple) RequestAuthorization

func (a AuthorizationStrategySimple) RequestAuthorization(_ tlv.Container) (time.Duration, error)

type CommandExecute

type CommandExecute struct{}

func (*CommandExecute) Execute

func (c *CommandExecute) Execute(cmd string, stdin []byte, args ...string) ([]byte, error)

type CommandExecuteMock

type CommandExecuteMock struct {
	mock.Mock
}

func (*CommandExecuteMock) Execute

func (c *CommandExecuteMock) Execute(cmd string, stdin []byte, args ...string) ([]byte, error)

type CommandExecuter

type CommandExecuter interface {
	Execute(cmd string, stdin []byte, args ...string) ([]byte, error)
}

type DatagramRequest

type DatagramRequest struct {
	// contains filtered or unexported fields
}

type DatagramRequestHandlerMock

type DatagramRequestHandlerMock struct {
	mock.Mock
}

func NewDatagramRequestHandlerMock

func NewDatagramRequestHandlerMock() *DatagramRequestHandlerMock

func (*DatagramRequestHandlerMock) ADKSupport

func (d *DatagramRequestHandlerMock) ADKSupport() bool

func (*DatagramRequestHandlerMock) DatagramRequestHandler

func (d *DatagramRequestHandlerMock) DatagramRequestHandler(ctx context.Context, resp UDPResponser, r DatagramRequest)

type DatagramRequestHandlerStub

type DatagramRequestHandlerStub struct {
	// contains filtered or unexported fields
}

func NewDatagramRequestHandlerStub

func NewDatagramRequestHandlerStub(f func(ctx context.Context, resp UDPResponser, r DatagramRequest), adkSupport bool) *DatagramRequestHandlerStub

func (DatagramRequestHandlerStub) ADKSupport

func (d DatagramRequestHandlerStub) ADKSupport() bool

func (DatagramRequestHandlerStub) DatagramRequestHandler

func (d DatagramRequestHandlerStub) DatagramRequestHandler(ctx context.Context, resp UDPResponser, r DatagramRequest)

type Firewall

type Firewall interface {
	FirewallSetup() error
	RuleAdd(r FirewallRule, meta FirewallRuleMetadata) error
	RuleRemove(r FirewallRule, meta FirewallRuleMetadata) error
}

func NewFirewallFromServerConfigFirewall

func NewFirewallFromServerConfigFirewall(fc ServerConfigFirewall) (Firewall, error)

type FirewallCommand

type FirewallCommand struct {
	FirewallSetupCmd string
	RuleAddCmd       string
	RuleRemoveCmd    string
	// contains filtered or unexported fields
}

func NewFirewallCommand

func NewFirewallCommand(setupCmd, ruleAddCmd, ruleRemoveCmd string) *FirewallCommand

func (*FirewallCommand) FirewallSetup

func (fc *FirewallCommand) FirewallSetup() error

func (*FirewallCommand) RuleAdd

func (*FirewallCommand) RuleRemove

func (fc *FirewallCommand) RuleRemove(r FirewallRule, meta FirewallRuleMetadata) error

type FirewallCommandRuleAddInput

type FirewallCommandRuleAddInput struct {
	ClientUUID     string `json:"clientUUID"`
	IPIsIPv6       bool   `json:"ipIsIPv6"`
	ClientIP       net.IP `json:"clientIP"`
	TargetIP       net.IP `json:"targetIP"`
	TargetProtocol string `json:"targetProtocol"`
	PortStart      int    `json:"portStart"`
	PortEnd        int    `json:"portEnd,omitempty"`
	Duration       int    `json:"duration"`
}

type FirewallCommandRuleRemoveInput

type FirewallCommandRuleRemoveInput struct {
	ClientUUID     string `json:"clientUUID"`
	IPIsIPv6       bool   `json:"ipIsIPv6"`
	ClientIP       net.IP `json:"clientIP"`
	TargetIP       net.IP `json:"targetIP"`
	TargetProtocol string `json:"targetProtocol"`
	PortStart      int    `json:"portStart"`
	PortEnd        int    `json:"portEnd,omitempty"`
}

type FirewallMock

type FirewallMock struct {
	mock.Mock
}

func (*FirewallMock) FirewallSetup

func (fw *FirewallMock) FirewallSetup() error

func (*FirewallMock) RuleAdd

func (fw *FirewallMock) RuleAdd(r FirewallRule, meta FirewallRuleMetadata) error

func (*FirewallMock) RuleRemove

func (fw *FirewallMock) RuleRemove(r FirewallRule, meta FirewallRuleMetadata) error

type FirewallRule

type FirewallRule struct {
	Proto        string
	SrcIP        net.IP
	DstIP        net.IP
	DstPortStart int
	DstPortEnd   int
}

func (*FirewallRule) String

func (r *FirewallRule) String() string

type FirewallRuleManager

type FirewallRuleManager struct {
	// contains filtered or unexported fields
}

func NewFirewallRuleManager

func NewFirewallRuleManager(fw Firewall) *FirewallRuleManager

func (*FirewallRuleManager) Add

func (*FirewallRuleManager) Count

func (frm *FirewallRuleManager) Count() int

func (*FirewallRuleManager) Debug

func (frm *FirewallRuleManager) Debug() map[string]interface{}

func (*FirewallRuleManager) Start

func (frm *FirewallRuleManager) Start() error

func (*FirewallRuleManager) Stop

func (frm *FirewallRuleManager) Stop() error

type FirewallRuleMetadata

type FirewallRuleMetadata struct {
	ClientUUID string
	Duration   time.Duration
}

type FirewallRuleWithExpiration

type FirewallRuleWithExpiration struct {
	Rule     FirewallRule
	Meta     FirewallRuleMetadata
	Duration time.Duration
	Created  time.Time
}

func (*FirewallRuleWithExpiration) Expiration

func (re *FirewallRuleWithExpiration) Expiration() time.Time

func (*FirewallRuleWithExpiration) String

func (re *FirewallRuleWithExpiration) String() string

type FirewallStub

type FirewallStub struct{}

func (FirewallStub) FirewallSetup

func (FirewallStub) FirewallSetup() error

func (FirewallStub) RuleAdd

func (FirewallStub) RuleRemove

type HTTPServer

type HTTPServer struct {
	// contains filtered or unexported fields
}

func NewHTTPServer

func NewHTTPServer(ip net.IP, port int) *HTTPServer

func (*HTTPServer) Start

func (h *HTTPServer) Start() error

func (*HTTPServer) Stop

func (h *HTTPServer) Stop() error

type IPResolver

type IPResolver interface {
	GetPublicIP() (net.IP, error)
}

type IPTables

type IPTables struct {
	Settings IPTablesSettings
	// contains filtered or unexported fields
}

func NewIPTables

func NewIPTables(c CommandExecuter, s IPTablesSettings) *IPTables

func (*IPTables) Check

func (ipt *IPTables) Check() error

func (*IPTables) FirewallSetup

func (ipt *IPTables) FirewallSetup() error

func (*IPTables) RuleAdd

func (ipt *IPTables) RuleAdd(r FirewallRule, _ FirewallRuleMetadata) error

func (*IPTables) RuleRemove

func (ipt *IPTables) RuleRemove(r FirewallRule, _ FirewallRuleMetadata) error

type IPTablesSettings

type IPTablesSettings struct {
	Chain string
}

type OSPA

type OSPA struct {
	Version    string     `yaml:"version"`
	ClientUUID string     `yaml:"clientUUID"`
	ServerHost string     `yaml:"serverHost"`
	ServerPort int        `yaml:"serverPort"`
	ADK        OSPAADK    `yaml:"adk"`
	Crypto     OSPACrypto `yaml:"crypto"`
}

func OSPAFromFile

func OSPAFromFile(path string) (OSPA, error)

func OSPAParse

func OSPAParse(b []byte) (OSPA, error)

func (OSPA) Verify

func (o OSPA) Verify() error

type OSPAADK

type OSPAADK struct {
	Secret string `yaml:"secret"`
}

func (OSPAADK) Verify

func (o OSPAADK) Verify() error

type OSPACrypto

type OSPACrypto struct {
	CipherSuitePriority []string      `yaml:"cipherSuitePriority"`
	RSA                 OSPACryptoRSA `yaml:"rsa"`
}

func (OSPACrypto) Verify

func (o OSPACrypto) Verify() error

type OSPACryptoRSA

type OSPACryptoRSA struct {
	Client OSPACryptoRSAClient `yaml:"client"`
	Server OSPACryptoRSAServer `yaml:"server"`
}

func (OSPACryptoRSA) Verify

func (o OSPACryptoRSA) Verify() error

type OSPACryptoRSAClient

type OSPACryptoRSAClient struct {
	PrivateKey string `yaml:"privateKey"`
	PublicKey  string `yaml:"publicKey"`
}

func (OSPACryptoRSAClient) Verify

func (o OSPACryptoRSAClient) Verify() error

type OSPACryptoRSAServer

type OSPACryptoRSAServer struct {
	PublicKey string `yaml:"publicKey"`
}

func (OSPACryptoRSAServer) Verify

func (o OSPACryptoRSAServer) Verify() error

type PublicIPResolver

type PublicIPResolver struct {
	ServerURL string
}

func (*PublicIPResolver) GetPublicIP

func (r *PublicIPResolver) GetPublicIP() (net.IP, error)

type PublicKeyLookupDir

type PublicKeyLookupDir struct {
	DirPath string
}

func NewPublicKeyLookupDir

func NewPublicKeyLookupDir(dirPath string) *PublicKeyLookupDir

func (PublicKeyLookupDir) LookupPublicKey

func (p PublicKeyLookupDir) LookupPublicKey(clientUUID string) (crypt.PublicKey, error)

type PublicKeyResolveFromClientUUID

type PublicKeyResolveFromClientUUID struct {
	// contains filtered or unexported fields
}

func (PublicKeyResolveFromClientUUID) PublicKey

type QueuedDatagramRequest

type QueuedDatagramRequest struct {
	DatagramRequest
	// contains filtered or unexported fields
}

type RequestCoordinator

type RequestCoordinator struct {
	// contains filtered or unexported fields
}

func NewRequestCoordinator

func NewRequestCoordinator(h UDPDatagramRequestHandler, handlers int) *RequestCoordinator

func (*RequestCoordinator) ADKSupport

func (d *RequestCoordinator) ADKSupport() bool

func (*RequestCoordinator) DatagramRequestHandler

func (d *RequestCoordinator) DatagramRequestHandler(ctx context.Context, resp UDPResponser, r DatagramRequest)

func (*RequestCoordinator) Start

func (d *RequestCoordinator) Start()

type RequestRoutineOpt

type RequestRoutineOpt struct {
	Sender UDPSender
}

type RequestRoutineParameters

type RequestRoutineParameters struct {
	ReqParams  RequestRoutineReqParameters
	AutoMode   bool
	RetryCount int
	Timeout    time.Duration
	ADKSecret  string
}

type RequestRoutineReqParameters

type RequestRoutineReqParameters struct {
	ClientUUID      string
	ClientIP        net.IP
	ServerIP        net.IP
	ServerPort      int
	TargetProto     lib.InternetProtocolNumber
	TargetIP        net.IP
	TargetPortStart int
	TargetPortEnd   int
}

type Server

type Server struct {
	// contains filtered or unexported fields
}

func NewServer

func NewServer(set ServerSettings) *Server

func (*Server) Start

func (s *Server) Start() error

func (*Server) Stop

func (s *Server) Stop() error

type ServerConfig

type ServerConfig struct {
	Server        ServerConfigServer        `yaml:"server"`
	Firewall      ServerConfigFirewall      `yaml:"firewall"`
	Authorization ServerConfigAuthorization `yaml:"authorization"`
	Crypto        ServerConfigCrypto        `yaml:"crypto"`
}

func DefaultServerConfig

func DefaultServerConfig() ServerConfig

func ServerConfigParse

func ServerConfigParse(b []byte) (ServerConfig, error)

func (ServerConfig) Merge

Merge sc -> s.

func (ServerConfig) Verify

func (s ServerConfig) Verify() error

type ServerConfigADK

type ServerConfigADK struct {
	Secret string             `yaml:"secret"`
	XDP    ServerConfigADKXDP `yaml:"xdp"`
}

func (ServerConfigADK) Verify

func (s ServerConfigADK) Verify() error

type ServerConfigADKXDP

type ServerConfigADKXDP struct {
	Mode       string   `yaml:"mode"`
	Interfaces []string `yaml:"interfaces"`
}

func (ServerConfigADKXDP) Verify

func (s ServerConfigADKXDP) Verify() error

type ServerConfigAuthorization

type ServerConfigAuthorization struct {
	Backend string                            `yaml:"backend"`
	Simple  *ServerConfigAuthorizationSimple  `yaml:"simple"`
	Command *ServerConfigAuthorizationCommand `yaml:"command"`
}

func (ServerConfigAuthorization) Verify

func (s ServerConfigAuthorization) Verify() error

type ServerConfigAuthorizationCommand

type ServerConfigAuthorizationCommand struct {
	AuthorizationCmd string `yaml:"authorizationCmd"`
}

func (ServerConfigAuthorizationCommand) Verify

type ServerConfigAuthorizationSimple

type ServerConfigAuthorizationSimple struct {
	Duration string `yaml:"duration"`
}

func (ServerConfigAuthorizationSimple) GetDuration

func (ServerConfigAuthorizationSimple) Verify

type ServerConfigCrypto

type ServerConfigCrypto struct {
	CipherSuitePriority []string              `yaml:"cipherSuitePriority"`
	RSA                 ServerConfigCryptoRSA `yaml:"rsa"`
}

func (ServerConfigCrypto) Verify

func (s ServerConfigCrypto) Verify() error

type ServerConfigCryptoRSA

type ServerConfigCryptoRSA struct {
	Client ServerConfigCryptoRSAClient `yaml:"client"`
	Server ServerConfigCryptoRSAServer `yaml:"server"`
}

func (ServerConfigCryptoRSA) Verify

func (s ServerConfigCryptoRSA) Verify() error

type ServerConfigCryptoRSAClient

type ServerConfigCryptoRSAClient struct {
	PublicKeyLookupDir string `yaml:"publicKeyLookupDir"`
}

func (ServerConfigCryptoRSAClient) Verify

type ServerConfigCryptoRSAServer

type ServerConfigCryptoRSAServer struct {
	PrivateKeyPath string `yaml:"privateKeyPath"`
	PublicKeyPath  string `yaml:"publicKeyPath"`
}

func (ServerConfigCryptoRSAServer) Verify

type ServerConfigFirewall

type ServerConfigFirewall struct {
	Backend  string                        `yaml:"backend"`
	IPTables *ServerConfigFirewallIPTables `yaml:"iptables"`
	Command  *ServerConfigFirewallCommand  `yaml:"command"`
}

func (ServerConfigFirewall) Verify

func (s ServerConfigFirewall) Verify() error

type ServerConfigFirewallCommand

type ServerConfigFirewallCommand struct {
	RuleAdd       string `yaml:"ruleAdd"`
	RuleRemove    string `yaml:"ruleRemove"`
	FirewallSetup string `yaml:"firewallSetup,omitempty"` // optional
}

func (ServerConfigFirewallCommand) Verify

type ServerConfigFirewallIPTables

type ServerConfigFirewallIPTables struct {
	Chain string `yaml:"chain"`
}

func (ServerConfigFirewallIPTables) Verify

type ServerConfigServer

type ServerConfigServer struct {
	IP              string                 `yaml:"ip"`
	Port            int                    `yaml:"port"`
	RequestHandlers int                    `yaml:"requestHandlers"`
	HTTP            ServerConfigServerHTTP `yaml:"http"`
	ADK             ServerConfigADK        `yaml:"adk"`
}

func (ServerConfigServer) Verify

func (s ServerConfigServer) Verify() error

type ServerConfigServerHTTP

type ServerConfigServerHTTP struct {
	Enable bool   `yaml:"enable"`
	IP     string `yaml:"ip"`
	Port   int    `yaml:"port"`
}

func (ServerConfigServerHTTP) Verify

func (s ServerConfigServerHTTP) Verify() error

type ServerHandler

type ServerHandler struct {
	// contains filtered or unexported fields
}

func (*ServerHandler) ADKSupport

func (o *ServerHandler) ADKSupport() bool

func (*ServerHandler) DatagramRequestHandler

func (o *ServerHandler) DatagramRequestHandler(_ context.Context, resp UDPResponser, r DatagramRequest)

type ServerHandlerOpt

type ServerHandlerOpt struct {
	ADKSecret string
}

type ServerSettings

type ServerSettings struct {
	UDPServerIP       net.IP
	UDPServerPort     int
	NoRequestHandlers int
	FW                Firewall
	CS                crypto.CipherSuite
	Authz             AuthorizationStrategy

	// HTTP server parameters, if HTTPServerPort is 0, the HTTP server will not be started
	HTTPServerIP   net.IP
	HTTPServerPort int

	// Optional
	ADKSecret string
}

type UDPDatagramRequestHandler

type UDPDatagramRequestHandler interface {
	DatagramRequestHandler(ctx context.Context, resp UDPResponser, r DatagramRequest)
	ADKSupport() bool
}

type UDPResponse

type UDPResponse struct {
	// contains filtered or unexported fields
}

func NewUDPResponse

func NewUDPResponse(c *net.UDPConn, metrics udpServerMetrics) *UDPResponse

func (*UDPResponse) SendUDPResponse

func (u *UDPResponse) SendUDPResponse(dst net.UDPAddr, body []byte) error

type UDPResponseMock

type UDPResponseMock struct {
	mock.Mock
}

func (*UDPResponseMock) SendUDPResponse

func (u *UDPResponseMock) SendUDPResponse(dst net.UDPAddr, body []byte) error

type UDPResponser

type UDPResponser interface {
	SendUDPResponse(dst net.UDPAddr, body []byte) error
}

type UDPSend

type UDPSend struct{}

func NewUDPSend

func NewUDPSend() UDPSend

func (UDPSend) SendUDPRequest

func (UDPSend) SendUDPRequest(req []byte, dest net.UDPAddr, timeout time.Duration) ([]byte, error)

type UDPSender

type UDPSender interface {
	SendUDPRequest(req []byte, dest net.UDPAddr, timeout time.Duration) ([]byte, error)
}

UDPSender abstraction exists so that we can use a different implementation that does not actually send UDP traffic which is useful during testing.

type UDPServer

type UDPServer struct {
	IP   net.IP
	Port int
	// contains filtered or unexported fields
}

func NewUDPServer

func NewUDPServer(ip net.IP, port int, reqHandle UDPDatagramRequestHandler) *UDPServer

func (*UDPServer) Start

func (u *UDPServer) Start() error

func (*UDPServer) Stop

func (u *UDPServer) Stop() error

type Verifier

type Verifier interface {
	Verify() error
}

Directories

Path Synopsis
xdp module

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL