kes

Nov 10, 2023

Changes in this version

+ const ServerShutdownTimeout

+ type AuditHandler interface

+ Enabled func(context.Context, slog.Level) bool

+ Handle func(context.Context, AuditRecord) error

+ type AuditLogHandler struct

+ Handler slog.Handler

+ func (a *AuditLogHandler) Enabled(ctx context.Context, level slog.Level) bool

+ func (a *AuditLogHandler) Handle(ctx context.Context, r AuditRecord) error

+ type AuditRecord struct

+ Identity kes.Identity

+ Level slog.Level

+ Message string

+ Method string

+ Path string

+ RemoteIP netip.Addr

+ ResponseTime time.Duration

+ StatusCode int

+ Time time.Time

+ type CacheConfig struct

+ Expiry time.Duration

+ ExpiryOffline time.Duration

+ ExpiryUnused time.Duration

+ type Config struct

+ Admin kes.Identity

+ AuditLog AuditHandler

+ Cache *CacheConfig

+ ErrorLog slog.Handler

+ Keys KeyStore

+ Policies map[string]Policy

+ Routes map[string]RouteConfig

+ TLS *tls.Config

+ type KeyStore interface

+ Create func(ctx context.Context, name string, value []byte) error

+ Delete func(ctx context.Context, name string) error

+ Get func(ctx context.Context, name string) ([]byte, error)

+ List func(ctx context.Context, prefix string, n int) ([]string, string, error)

+ Status func(context.Context) (KeyStoreState, error)

+ type KeyStoreState struct

+ Latency time.Duration

+ type MemKeyStore struct

+ func (ks *MemKeyStore) Close() error

+ func (ks *MemKeyStore) Create(_ context.Context, name string, value []byte) error

+ func (ks *MemKeyStore) Delete(_ context.Context, name string) error

+ func (ks *MemKeyStore) Get(_ context.Context, name string) ([]byte, error)

+ func (ks *MemKeyStore) List(_ context.Context, prefix string, n int) ([]string, string, error)

+ func (ks *MemKeyStore) Status(context.Context) (KeyStoreState, error)

+ func (ks *MemKeyStore) String() string

type Policy

+ Identities []kes.Identity

+ type RouteConfig struct

+ InsecureSkipAuth bool

+ Timeout time.Duration

+ type Server struct

+ AuditLevel slog.LevelVar

+ ErrLevel slog.LevelVar

+ ShutdownTimeout time.Duration

+ func (s *Server) Addr() string

+ func (s *Server) Close() error

+ func (s *Server) ListenAndStart(ctx context.Context, addr string, conf *Config) error

+ func (s *Server) Start(ctx context.Context, ln net.Listener, conf *Config) error

+ func (s *Server) Update(conf *Config) (io.Closer, error)

+ func (s *Server) UpdateAdmin(admin kes.Identity) error

+ func (s *Server) UpdatePolicies(policies map[string]Policy) error

+ func (s *Server) UpdateTLS(conf *tls.Config) error

Jan 24, 2023

Changes in this version

+ var ErrSecretExists = NewError(http.StatusNotFound, "secret already exists")

+ var ErrSecretNotFound = NewError(http.StatusNotFound, "secret does not exist")

type Client

+ func (c *Client) CreateSecret(ctx context.Context, name string, value []byte, options *SecretOptions) error

+ func (c *Client) DeleteSecret(ctx context.Context, name string) error

+ func (c *Client) DescribeSecret(ctx context.Context, name string) (*SecretInfo, error)

+ func (c *Client) ListSecrets(ctx context.Context, pattern string) (*SecretIter, error)

+ func (c *Client) ReadSecret(ctx context.Context, name string) ([]byte, *SecretInfo, error)

type Enclave

+ func (e *Enclave) CreateSecret(ctx context.Context, name string, value []byte, options *SecretOptions) error

+ func (e *Enclave) DeleteSecret(ctx context.Context, name string) error

+ func (e *Enclave) DescribeSecret(ctx context.Context, name string) (*SecretInfo, error)

+ func (e *Enclave) ListSecrets(ctx context.Context, pattern string) (*SecretIter, error)

+ func (e *Enclave) ReadSecret(ctx context.Context, name string) ([]byte, *SecretInfo, error)

+ type KeyAlgorithm uint

+ const AES256_GCM_SHA256

+ const KeyAlgorithmUndefined

+ const XCHACHA20_POLY1305

+ func (a *KeyAlgorithm) UnmarshalText(text []byte) error

+ func (a KeyAlgorithm) MarshalText() ([]byte, error)

+ func (a KeyAlgorithm) String() string

type KeyInfo

+ Algorithm KeyAlgorithm

+ func (k *KeyInfo) MarshalJSON() ([]byte, error)

+ func (k *KeyInfo) UnmarshalJSON(text []byte) error

type KeyIterator

+ func (i *KeyIterator) Algorithm() KeyAlgorithm

+ type SecretInfo struct

+ CreatedAt time.Time

+ CreatedBy Identity

+ ModTime time.Time

+ Name string

+ Type SecretType

+ func (s *SecretInfo) MarshalJSON() ([]byte, error)

+ func (s *SecretInfo) UnmarshalJSON(data []byte) error

+ type SecretIter struct

+ func (i *SecretIter) Close() error

+ func (i *SecretIter) CreatedAt() time.Time

+ func (i *SecretIter) CreatedBy() Identity

+ func (i *SecretIter) ModTime() time.Time

+ func (i *SecretIter) Name() string

+ func (i *SecretIter) Next() bool

+ func (i *SecretIter) Type() SecretType

+ func (i *SecretIter) Value() SecretInfo

+ func (i *SecretIter) Values(n int) ([]SecretInfo, error)

+ func (i *SecretIter) WriteTo(w io.Writer) (int64, error)

+ type SecretOptions struct

+ Type SecretType

+ type SecretType uint

+ const SecretGeneric

+ func (s *SecretType) UnmarshalText(text []byte) error

+ func (s SecretType) MarshalText() ([]byte, error)

+ func (s SecretType) String() string

Nov 15, 2022

Changes in this version

type Client

+ func (c *Client) Enclave(name string) *Enclave

type Enclave

+ Endpoints []string

+ HTTPClient http.Client

+ Name string

+ func NewEnclave(endpoint, name string, certificate tls.Certificate) *Enclave

+ func NewEnclaveWithConfig(endpoint, name string, config *tls.Config) *Enclave

Oct 19, 2022

Changes in this version

type Client

+ func (c *Client) DescribeEnclave(ctx context.Context, name string) (*EnclaveInfo, error)

+ func (c *Client) DescribeKey(ctx context.Context, name string) (*KeyInfo, error)

type Enclave

+ func (e *Enclave) DescribeKey(ctx context.Context, name string) (*KeyInfo, error)

+ type EnclaveInfo struct

+ CreatedAt time.Time

+ CreatedBy Identity

+ Name string

type KeyInfo

+ ID string

type KeyIterator

+ func (i *KeyIterator) ID() string

Sep 12, 2022

Changes in this version

+ var ErrIdentityNotFound = NewError(http.StatusNotFound, "identity does not exist")

+ var ErrSealed = NewError(http.StatusForbidden, "system is sealed")

type Client

+ func (c *Client) CreateEnclave(ctx context.Context, name string, admin Identity) error

+ func (c *Client) DeleteEnclave(ctx context.Context, name string) error

type State

+ Arch string

+ OS string

Jul 6, 2022

Changes in this version

type Client

+ func (c *Client) DescribePolicy(ctx context.Context, name string) (*PolicyInfo, error)

+ type ConnError struct

+ Err error

+ Host string

+ func IsConnError(err error) (*ConnError, bool)

+ func (c *ConnError) Error() string

+ func (c *ConnError) Temporary() bool

+ func (c *ConnError) Timeout() bool

+ func (c *ConnError) Unwrap() error

type Enclave

+ func (e *Enclave) DescribePolicy(ctx context.Context, name string) (*PolicyInfo, error)

type IdentityIterator

+ func (i *IdentityIterator) Values(n int) ([]IdentityInfo, error)

type KeyIterator

+ func (i *KeyIterator) Values(n int) ([]KeyInfo, error)

type Policy

+ Info PolicyInfo

type PolicyIterator

+ func (i *PolicyIterator) Values(n int) ([]PolicyInfo, error)

type State

+ CPUs int

+ HeapAlloc uint64

+ StackAlloc uint64

+ UsableCPUs int

Apr 7, 2022

Changes in this version

type Metric

+ CPUs int

+ HeapAlloc uint64

+ HeapObjects uint64

+ StackAlloc uint64

+ Threads int

+ UsableCPUs int

Mar 24, 2022

Changes in this version

+ var ErrEnclaveExists = NewError(http.StatusBadRequest, "enclave already exists")

+ var ErrEnclaveNotFound = NewError(http.StatusNotFound, "enclave does not exist")

+ type API struct

+ MaxBody int64

+ Method string

+ Path string

+ Timeout time.Duration

+ type CCP struct

+ Ciphertext []byte

+ Context []byte

type Client

+ func (c *Client) APIs(ctx context.Context) ([]API, error)

+ func (c *Client) DecryptAll(ctx context.Context, name string, ciphertexts ...CCP) ([]PCP, error)

+ func (c *Client) DescribeIdentity(ctx context.Context, identity Identity) (*IdentityInfo, error)

+ func (c *Client) DescribeSelf(ctx context.Context) (*IdentityInfo, *Policy, error)

type Enclave

+ func (e *Enclave) DecryptAll(ctx context.Context, name string, ciphertexts ...CCP) ([]PCP, error)

+ func (e *Enclave) DescribeIdentity(ctx context.Context, identity Identity) (*IdentityInfo, error)

+ func (e *Enclave) DescribeSelf(ctx context.Context) (*IdentityInfo, *Policy, error)

type IdentityInfo

+ IsAdmin bool

type IdentityIterator

+ func (i *IdentityIterator) WriteTo(w io.Writer) (int64, error)

type KeyIterator

+ func (i *KeyIterator) WriteTo(w io.Writer) (int64, error)

+ type PCP struct

+ Context []byte

+ Plaintext []byte

type PolicyIterator

+ func (i *PolicyIterator) WriteTo(w io.Writer) (int64, error)

Feb 28, 2022

Changes in this version

type AuditEvent

+ APIPath string

+ ClientIP net.IP

+ ClientIdentity Identity

+ ResponseTime time.Duration

+ StatusCode int

+ Timestamp time.Time

type AuditStream

+ func (s *AuditStream) WriteTo(w io.Writer) (int64, error)

type Client

+ func (c *Client) AssignPolicy(ctx context.Context, policy string, identity Identity) error

+ func (c *Client) DeleteIdentity(ctx context.Context, identity Identity) error

+ func (c *Client) Status(ctx context.Context) (State, error)

+ type Enclave struct

+ func (e *Enclave) AssignPolicy(ctx context.Context, policy string, identity Identity) error

+ func (e *Enclave) CreateKey(ctx context.Context, name string) error

+ func (e *Enclave) Decrypt(ctx context.Context, name string, ciphertext, context []byte) ([]byte, error)

+ func (e *Enclave) DeleteIdentity(ctx context.Context, identity Identity) error

+ func (e *Enclave) DeleteKey(ctx context.Context, name string) error

+ func (e *Enclave) DeletePolicy(ctx context.Context, name string) error

+ func (e *Enclave) Encrypt(ctx context.Context, name string, plaintext, context []byte) ([]byte, error)

+ func (e *Enclave) GenerateKey(ctx context.Context, name string, context []byte) (DEK, error)

+ func (e *Enclave) GetPolicy(ctx context.Context, name string) (*Policy, error)

+ func (e *Enclave) ImportKey(ctx context.Context, name string, key []byte) error

+ func (e *Enclave) ListIdentities(ctx context.Context, pattern string) (*IdentityIterator, error)

+ func (e *Enclave) ListKeys(ctx context.Context, pattern string) (*KeyIterator, error)

+ func (e *Enclave) ListPolicies(ctx context.Context, pattern string) (*PolicyIterator, error)

+ func (e *Enclave) SetPolicy(ctx context.Context, name string, policy *Policy) error

type ErrorStream

+ func (s *ErrorStream) Message() string

+ func (s *ErrorStream) WriteTo(w io.Writer) (int64, error)

+ type IdentityInfo struct

+ CreatedAt time.Time

+ CreatedBy Identity

+ Identity Identity

+ Policy string

type IdentityIterator

+ func (i *IdentityIterator) CreatedAt() time.Time

+ func (i *IdentityIterator) CreatedBy() Identity

+ func (i *IdentityIterator) Identity() Identity

+ func (i *IdentityIterator) Policy() string

+ type KeyInfo struct

+ CreatedAt time.Time

+ CreatedBy Identity

+ Name string

type KeyIterator

+ func (i *KeyIterator) CreatedAt() time.Time

+ func (i *KeyIterator) CreatedBy() Identity

+ func (i *KeyIterator) Name() string

+ type PolicyInfo struct

+ CreatedAt time.Time

+ CreatedBy Identity

+ Name string

+ type PolicyIterator struct

+ func (i *PolicyIterator) Close() error

+ func (i *PolicyIterator) CreatedAt() time.Time

+ func (i *PolicyIterator) CreatedBy() Identity

+ func (i *PolicyIterator) Name() string

+ func (i *PolicyIterator) Next() bool

+ func (i *PolicyIterator) Value() PolicyInfo

+ type State struct

+ UpTime time.Duration

+ Version string

Jul 7, 2021

Changes in this version

type Error

+ var ErrDecrypt Error = NewError(http.StatusBadRequest, "decryption failed: ciphertext is not authentic")

+ type IdentityDescription struct

+ Identity Identity

+ Policy string

+ type IdentityIterator struct

+ func (i *IdentityIterator) Close() error

+ func (i *IdentityIterator) Err() error

+ func (i *IdentityIterator) Next() bool

+ func (i *IdentityIterator) Value() IdentityDescription

type Metric

+ AuditEvents uint64

+ ErrorEvents uint64

type Policy

+ func (p *Policy) Allow(patterns ...string) error

+ func (p *Policy) Deny(patterns ...string) error

May 3, 2021

Changes in this version

type Client

+ Endpoints []string

Mar 30, 2021

Changes in this version

type Metric

+ RequestActive uint64

+ UpTime time.Duration

Jan 12, 2021

Changes in this version

type Client

+ func (c *Client) Metrics() (Metric, error)

+ type Metric struct

+ LatencyHistogram map[time.Duration]uint64

+ RequestErr uint64

+ RequestFail uint64

+ RequestOK uint64

+ func (m *Metric) RequestN() uint64

Dec 16, 2020

Changes in this version

type AuditEvent

+ func (a *AuditEvent) String() string

type AuditEventRequest

+ func (a *AuditEventRequest) String() string

type AuditEventResponse

+ func (a *AuditEventResponse) String() string

type Client

+ func (c *Client) ListKeys(ctx context.Context, pattern string) (*KeyIterator, error)

+ type KeyDescription struct

+ Name string

+ type KeyIterator struct

+ func (i *KeyIterator) Close() error

+ func (i *KeyIterator) Err() error

+ func (i *KeyIterator) Next() bool

+ func (i *KeyIterator) Value() KeyDescription

Sep 23, 2020

Changes in this version

type Client

+ func (c *Client) AuditLog() (*AuditStream, error)

+ func (c *Client) ErrorLog() (*ErrorStream, error)

Jun 16, 2020

Changes in this version

type Client

+ func (c *Client) GetPolicy(name string) (*Policy, error)

+ func (c *Client) SetPolicy(name string, policy *Policy) error

type Error

+ var ErrPolicyNotFound Error = NewError(http.StatusNotFound, "policy does not exist")

Jun 5, 2020

Changes in this version

type Client

+ func (c *Client) Encrypt(key string, plaintext, context []byte) ([]byte, error)

Apr 29, 2020

Changes in this version

type Client

+ Endpoint string

+ HTTPClient http.Client

+ func NewClientWithConfig(endpoint string, config *tls.Config) *Client

+ func (c *Client) Decrypt(key string, ciphertext, context []byte) ([]byte, error)

+ func (c *Client) GenerateKey(key string, context []byte) (DEK, error)

+ type DEK struct

+ Ciphertext []byte

+ Plaintext []byte

+ func (d *DEK) UnmarshalBinary(data []byte) error

+ func (d *DEK) UnmarshalText(text []byte) error

+ func (d DEK) MarshalBinary() ([]byte, error)

+ func (d DEK) MarshalText() ([]byte, error)

Mar 31, 2020

Changes in this version

+ type AuditEvent struct

+ Request AuditEventRequest

+ Response AuditEventResponse

+ Time time.Time

+ type AuditEventRequest struct

+ Identity string

+ Path string

+ type AuditEventResponse struct

+ StatusCode int

+ Time time.Duration

+ type AuditStream struct

+ func NewAuditStream(r io.Reader) *AuditStream

+ func (s *AuditStream) Bytes() []byte

+ func (s *AuditStream) Close() (err error)

+ func (s *AuditStream) Err() error

+ func (s *AuditStream) Event() AuditEvent

+ func (s *AuditStream) Next() bool

type Client

+ func (c *Client) TraceErrorLog() (*ErrorStream, error)

type Error

+ var ErrKeySealed Error = NewError(http.StatusForbidden, "key is sealed")

+ type ErrorEvent struct

+ Message string

+ type ErrorStream struct

+ func NewErrorStream(r io.Reader) *ErrorStream

+ func (s *ErrorStream) Bytes() []byte

+ func (s *ErrorStream) Close() (err error)

+ func (s *ErrorStream) Err() error

+ func (s *ErrorStream) Event() ErrorEvent

+ func (s *ErrorStream) Next() bool

Mar 11, 2020

Changes in this version

type Client

+ func (c *Client) Version() (string, error)

+ type Error struct

+ var ErrNotAllowed Error = NewError(http.StatusForbidden, "prohibited by policy")

+ func (e Error) Error() string

+ func (e Error) Status() int

Feb 5, 2020

Changes in this version

+ func AuditLog(logger *log.Logger, roles *Roles, f http.HandlerFunc) http.HandlerFunc

+ func HandleImportKey(store Store) http.HandlerFunc

+ func HandleTraceAuditLog(log *SystemLog) http.HandlerFunc

+ func ValidatePath(apiPattern string, f http.HandlerFunc) http.HandlerFunc

type Client

+ func (c *Client) ImportKey(name string, key []byte) error

+ func (c *Client) TraceAuditLog() (io.ReadCloser, error)

+ type SystemLog struct

+ func NewLogger(out io.Writer, prefix string, flags int) *SystemLog

+ func (l *SystemLog) AddOutput(out io.Writer)

+ func (l *SystemLog) Log() *log.Logger

+ func (l *SystemLog) RemoveOutput(out io.Writer)

+ func (l *SystemLog) SetOutput(out ...io.Writer)

Dec 19, 2019

Changes in this version

+ func LimitPathSegments(n int, f http.HandlerFunc) http.HandlerFunc

type Secret

+ func (s *Secret) ParseString(v string) error

+ func (s *Secret) ReadFrom(r io.Reader) (int64, error)

+ func (s Secret) String() string

+ func (s Secret) WriteTo(w io.Writer) (int64, error)

Dec 13, 2019

Changes in this version

+ const ErrKeyExists

+ const ErrKeyNotFound

+ const ErrStoreSealed

+ func EnforcePolicies(roles *Roles, f http.HandlerFunc) http.HandlerFunc

+ func HandleAssignIdentity(roles *Roles) http.HandlerFunc

+ func HandleCreateKey(store Store) http.HandlerFunc

+ func HandleDecryptKey(store Store) http.HandlerFunc

+ func HandleDeleteKey(store Store) http.HandlerFunc

+ func HandleDeletePolicy(roles *Roles) http.HandlerFunc

+ func HandleForgetIdentity(roles *Roles) http.HandlerFunc

+ func HandleGenerateKey(store Store) http.HandlerFunc

+ func HandleListIdentities(roles *Roles) http.HandlerFunc

+ func HandleListPolicies(roles *Roles) http.HandlerFunc

+ func HandleReadPolicy(roles *Roles) http.HandlerFunc

+ func HandleWritePolicy(roles *Roles) http.HandlerFunc

+ func LimitRequestBody(n int64, f http.HandlerFunc) http.HandlerFunc

+ func NewError(status int, text string) error

+ func RequireMethod(method string, f http.HandlerFunc) http.HandlerFunc

+ type Client struct

+ func NewClient(addr string, config *tls.Config) *Client

+ func (c *Client) AssignIdentity(policy string, id Identity) error

+ func (c *Client) CreateKey(name string, key []byte) error

+ func (c *Client) DecryptDataKey(name string, ciphertext, context []byte) ([]byte, error)

+ func (c *Client) DeleteKey(name string) error

+ func (c *Client) DeletePolicy(name string) error

+ func (c *Client) ForgetIdentity(id Identity) error

+ func (c *Client) GenerateDataKey(name string, context []byte) ([]byte, []byte, error)

+ func (c *Client) ListIdentities(pattern string) (map[Identity]string, error)

+ func (c *Client) ListPolicies(pattern string) ([]string, error)

+ func (c *Client) ReadPolicy(name string) (*Policy, error)

+ func (c *Client) Transport(transport http.RoundTripper)

+ func (c *Client) WritePolicy(name string, policy *Policy) error

+ type Identity string

+ const IdentityUnknown

+ func Identify(req *http.Request, f IdentityFunc) Identity

+ func (id Identity) IsUnknown() bool

+ func (id Identity) String() string

+ type IdentityFunc func(*x509.Certificate) Identity

+ func HashPublicKey(hash crypto.Hash) IdentityFunc

+ type Policy struct

+ func NewPolicy(patterns ...string) *Policy

+ func (p *Policy) String() string

+ func (p *Policy) UnmarshalJSON(b []byte) error

+ func (p *Policy) UnmarshalTOML(b []byte) error

+ func (p *Policy) Verify(r *http.Request) error

+ func (p Policy) MarshalJSON() ([]byte, error)

+ func (p Policy) MarshalTOML() ([]byte, error)

+ type Roles struct

+ Identify IdentityFunc

+ Root Identity

+ func (r *Roles) Assign(name string, id Identity) error

+ func (r *Roles) Delete(name string)

+ func (r *Roles) Forget(id Identity)

+ func (r *Roles) Get(name string) (*Policy, bool)

+ func (r *Roles) Identities() map[Identity]string

+ func (r *Roles) IsAssigned(id Identity) bool

+ func (r *Roles) Policies() (names []string)

+ func (r *Roles) Set(name string, policy *Policy)

+ type Secret [32]byte

+ func (s Secret) Unwrap(ciphertext []byte, associatedData []byte) ([]byte, error)

+ func (s Secret) Wrap(plaintext, associatedData []byte) ([]byte, error)

+ type Store interface

+ Create func(string, Secret) error

+ Delete func(string) error

+ Get func(string) (Secret, error)