security

Documentation

Overview

Package security provides TLS configuration, local address checking, and security helpers for gofly services.

Index

• func AuthorizeBearerOrLocal(r *http.Request, token string) bool
• func ConstantTimeEqual(a string, b string) bool
• func IsLocalRemote(remote string) bool
• type TLSConfig
  • func (c TLSConfig) ClientTLSConfig() (*tls.Config, error)
  • func (c TLSConfig) Enabled() bool
  • func (c TLSConfig) MutualEnabled() bool
  • func (c TLSConfig) ServerTLSConfig() (*tls.Config, error)

Functions

func AuthorizeBearerOrLocal

func AuthorizeBearerOrLocal(r *http.Request, token string) bool

func ConstantTimeEqual

func ConstantTimeEqual(a string, b string) bool

func IsLocalRemote

func IsLocalRemote(remote string) bool

Types

type TLSConfig

type TLSConfig struct {
	CertFile string `json:"certFile,omitempty"`
	KeyFile  string `json:"keyFile,omitempty"`
	// CAFile is the CA bundle used to verify the peer certificate. On a client
	// it verifies the server; on a server in mutual mode it may also verify the
	// client when ClientCAFile is empty.
	CAFile string `json:"caFile,omitempty"`
	// ClientCAFile, when set on a server, turns on mutual TLS and verifies
	// client certificates against this CA bundle.
	ClientCAFile string `json:"clientCAFile,omitempty"`
	// ServerName overrides the SNI / verification hostname on a client.
	ServerName string `json:"serverName,omitempty"`
	// InsecureSkipVerify disables peer verification on a client. Use only for
	// local development.
	InsecureSkipVerify bool `json:"insecureSkipVerify,omitempty"`
	// MinVersion optionally pins the minimum TLS version (e.g. tls.VersionTLS13).
	MinVersion uint16 `json:"minVersion,omitempty"`
}

TLSConfig describes the TLS/mTLS material for a server or client.

CertFile/KeyFile carry the local identity. CAFile lets a client (or a server in mutual mode) verify the peer certificate chain against a custom CA bundle. ClientCAFile is server-only and, when set, enables mutual TLS by requiring and verifying client certificates against the given CA bundle.

func (TLSConfig) ClientTLSConfig

func (c TLSConfig) ClientTLSConfig() (*tls.Config, error)

ClientTLSConfig builds a *tls.Config for a TLS/mTLS client. It returns nil (and no error) when no CA, client certificate, ServerName or skip-verify flag is configured, letting callers fall back to plaintext.

func (TLSConfig) Enabled

func (c TLSConfig) Enabled() bool

Enabled reports whether a local certificate/key pair is configured.

func (TLSConfig) MutualEnabled

func (c TLSConfig) MutualEnabled() bool

MutualEnabled reports whether the server should require and verify client certificates (mutual TLS).

func (TLSConfig) ServerTLSConfig

func (c TLSConfig) ServerTLSConfig() (*tls.Config, error)

ServerTLSConfig builds a *tls.Config for a TLS/mTLS server. It returns nil (and no error) when no certificate/key pair is configured, letting callers fall back to plaintext.