va

Documentation

Index

• type CAASet
• type SafeBrowsing
• type SafeBrowsingV4
• type ValidationAuthorityImpl
  • func NewValidationAuthorityImpl(pc *cmd.PortConfig, sbc SafeBrowsing, cdrClient *cdr.CAADistributedResolver, ...) *ValidationAuthorityImpl
  • func (va *ValidationAuthorityImpl) IsSafeDomain(ctx context.Context, req *vaPB.IsSafeDomainRequest) (*vaPB.IsDomainSafe, error)
  • func (va *ValidationAuthorityImpl) PerformValidation(ctx context.Context, domain string, challenge core.Challenge, ...) ([]core.ValidationRecord, error)

Types

type CAASet

type CAASet struct {
	Issue     []*dns.CAA
	Issuewild []*dns.CAA
	Iodef     []*dns.CAA
	Unknown   []*dns.CAA
}

CAASet consists of filtered CAA records

type SafeBrowsing

type SafeBrowsing interface {
	// IsListed returns a non-empty string if the domain was bad. Specifically,
	// it is which Google Safe Browsing list the domain was found on.
	IsListed(url string) (list string, err error)
}

SafeBrowsing is an interface for a third-party safe browsing API client.

type SafeBrowsingV4

type SafeBrowsingV4 interface {
	LookupURLs(urls []string) (threats [][]safebrowsingv4.URLThreat, err error)
}

SafeBrowsingV4 is an interface around the functions from Google safebrowsing's v4 API's *SafeBrowser type that we use. Using this interface allows mocking for tests

type ValidationAuthorityImpl

type ValidationAuthorityImpl struct {
	// contains filtered or unexported fields
}

ValidationAuthorityImpl represents a VA

func NewValidationAuthorityImpl

func NewValidationAuthorityImpl(
	pc *cmd.PortConfig,
	sbc SafeBrowsing,
	cdrClient *cdr.CAADistributedResolver,
	resolver bdns.DNSResolver,
	userAgent string,
	issuerDomain string,
	stats metrics.Scope,
	clk clock.Clock,
	logger blog.Logger,
) *ValidationAuthorityImpl

NewValidationAuthorityImpl constructs a new VA

func (*ValidationAuthorityImpl) IsSafeDomain

func (va *ValidationAuthorityImpl) IsSafeDomain(ctx context.Context, req *vaPB.IsSafeDomainRequest) (*vaPB.IsDomainSafe, error)

IsSafeDomain returns true if the domain given is determined to be safe by a third-party safe browsing API. It's meant be called by the RA before pending authorization creation. If no third-party client was provided, it fails open and increments a Skips metric.

func (*ValidationAuthorityImpl) PerformValidation

func (va *ValidationAuthorityImpl) PerformValidation(ctx context.Context, domain string, challenge core.Challenge, authz core.Authorization) ([]core.ValidationRecord, error)

PerformValidation validates the given challenge. It always returns a list of validation records, even when it also returns an error.

TODO(#1626): remove authz parameter