tls

README

constructor-tls - Constructor wrapper for *tls.Config

Quick Start

package main

import (
    "context"
    "crypto/tls"

    "github.com/stackopsd/config"
    "github.com/stackopsd/constructor"
    ctls "github.com/stackopsd/constructor-tls"
)

func main() {
    ctx, cancel := context.WithCancel(context.Background())
    defer cancel()

    const := ctls.NewConstructor()
    conf := new(tls.Config)

    // Create a loader from a source of configuration data.
    loader := config.NewFileLoader("/path/to/some/config.json_or_yaml")

    if err := constructor.New(ctx, loader, &cons, conf); err != nil {
        panic(err)
    }

    // Use the constructed *tls.Config.
    lis, err := tls.Listen("tcp", "localhost:443", conf)
    if err != nil {
        panic(err)
    }
    for {
        _, _  = lis.Accept()
    }
}

Example Configuration

If loading from a file, the following represents all the possible options:

insecure_skip_verify: true
server_name: "my-server"
client_auth: "require_and_verify_client_cert"
rand:
    choice: "crypto" # Can be zero if needed for testing.
certificates: # Set of certificates to present when authenticating.
    bytes:
        -   cert: "<FULL PEM ENCODED CERTIFICATE AS A STRING>"
            key: "<FULL PEM ENCODED KEY AS A STRING>"
        -   cert: "<FULL PEM ENCODED CERTIFICATE AS A STRING>"
            key: "<FULL PEM ENCODED KEY AS A STRING>"
    files:
        -   cert: "/path/to/pem/encoded/cert"
            key: "/path/to/pem/encoded/key"
        -   cert: "/path/to/pem/encoded/cert"
            key: "/path/to/pem/encoded/key"
root_cas: # Set of root authorities to use when verifying a server certificate.
    bytes:
        -   cert: "<FULL PEM ENCODED CERTIFICATE AS A STRING>"
            key: "<FULL PEM ENCODED KEY AS A STRING>"
        -   cert: "<FULL PEM ENCODED CERTIFICATE AS A STRING>"
            key: "<FULL PEM ENCODED KEY AS A STRING>"
    files:
        -   cert: "/path/to/pem/encoded/cert"
            key: "/path/to/pem/encoded/key"
        -   cert: "/path/to/pem/encoded/cert"
            key: "/path/to/pem/encoded/key"
client_cas: # Set of root authorities to use when verifying a client certificate.
    bytes:
        -   cert: "<FULL PEM ENCODED CERTIFICATE AS A STRING>"
            key: "<FULL PEM ENCODED KEY AS A STRING>"
        -   cert: "<FULL PEM ENCODED CERTIFICATE AS A STRING>"
            key: "<FULL PEM ENCODED KEY AS A STRING>"
    files:
        -   cert: "/path/to/pem/encoded/cert"
            key: "/path/to/pem/encoded/key"
        -   cert: "/path/to/pem/encoded/cert"
            key: "/path/to/pem/encoded/key"

License

Copyright 2019 Kevin Conway

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Documentation

Index

• type CertPoolConfig
• type CertPoolConstructor
  • func NewCertPoolConstructor() *CertPoolConstructor
  • func (c *CertPoolConstructor) New(ctx context.Context, conf *CertPoolConfig) (*x509.CertPool, error)
  • func (c *CertPoolConstructor) Settings() *CertPoolConfig
• type CertificateByteConfig
• type CertificateByteConstructor
  • func NewCertificateByteConstructor() *CertificateByteConstructor
  • func (c *CertificateByteConstructor) New(ctx context.Context, conf *CertificateByteConfig) (tls.Certificate, error)
  • func (c *CertificateByteConstructor) Settings() *CertificateByteConfig
• type CertificateConfig
• type CertificateConstructor
  • func NewCertificateConstructor() *CertificateConstructor
  • func (c *CertificateConstructor) New(ctx context.Context, conf *CertificateConfig) ([]tls.Certificate, error)
  • func (c *CertificateConstructor) Settings() *CertificateConfig
• type CertificateFileConfig
• type CertificateFileConstructor
  • func NewCertificateFileConstructor() *CertificateFileConstructor
  • func (c *CertificateFileConstructor) New(ctx context.Context, conf *CertificateFileConfig) (tls.Certificate, error)
  • func (c *CertificateFileConstructor) Settings() *CertificateFileConfig
• type Config
• type Constructor
  • func NewConstructor() *Constructor
  • func (c *Constructor) New(ctx context.Context, conf *Config) (*tls.Config, error)
  • func (c *Constructor) Settings() *Config
• type RandConfig
• type RandConstructor
  • func NewRandConstructor() *RandConstructor
  • func (c *RandConstructor) New(ctx context.Context, conf *RandConfig) (io.Reader, error)
  • func (c *RandConstructor) Settings() *RandConfig
• type RandCryptoConfig
• type RandCryptoConstructor
  • func NewRandCryptoConstructor() *RandCryptoConstructor
  • func (c *RandCryptoConstructor) New(ctx context.Context, conf *RandCryptoConfig) (io.Reader, error)
  • func (c *RandCryptoConstructor) Settings() *RandCryptoConfig
• type RandZeroConfig
• type RandZeroConstructor
  • func NewRandZeroConstructor() *RandZeroConstructor
  • func (c *RandZeroConstructor) New(ctx context.Context, conf *RandZeroConfig) (io.Reader, error)
  • func (c *RandZeroConstructor) Settings() *RandZeroConfig

Types

type CertPoolConfig

type CertPoolConfig struct {
	CertificateConfig
}

CertPoolConfig is a container for options related to client certificate pool construction.

type CertPoolConstructor

type CertPoolConstructor struct {
	Certificates *CertificateConstructor
}

CertPoolConstructor builds a client x509 certificate pool that is used to verify server certificates.

func NewCertPoolConstructor

func NewCertPoolConstructor() *CertPoolConstructor

NewCertPoolConstructor generates a default constructor.

func (*CertPoolConstructor) New

func (c *CertPoolConstructor) New(ctx context.Context, conf *CertPoolConfig) (*x509.CertPool, error)

New generates an x509 certificate pool. If not custom certificates are defined then it defaults to nil which triggers the default TLS configuration behavior in Go.

func (*CertPoolConstructor) Settings

func (c *CertPoolConstructor) Settings() *CertPoolConfig

Settings generates the default configurations.

type CertificateByteConfig

type CertificateByteConfig struct {
	Cert string
	Key  string
}

CertificateByteConfig contains settings for loading a cert from provided byte strings. This is used in cases where the full cert and key blocks are provided as configuration rather than being pre-stored on a host.

type CertificateByteConstructor

type CertificateByteConstructor struct{}

CertificateByteConstructor is used to load certs from byte strings.

func NewCertificateByteConstructor

func NewCertificateByteConstructor() *CertificateByteConstructor

NewCertificateByteConstructor generates a default CertificateByteConstructor.

func (*CertificateByteConstructor) New

func (c *CertificateByteConstructor) New(ctx context.Context, conf *CertificateByteConfig) (tls.Certificate, error)

New constructs a certificate from byte strings.

func (*CertificateByteConstructor) Settings

func (c *CertificateByteConstructor) Settings() *CertificateByteConfig

Settings generates the default configuration.

type CertificateConfig

type CertificateConfig struct {
	Files []CertificateFileConfig
	Bytes []CertificateByteConfig
}

CertificateConfig is an aggregate container for certificate options.

type CertificateConstructor

type CertificateConstructor struct {
	Files *CertificateFileConstructor
	Bytes *CertificateByteConstructor
}

CertificateConstructor is an aggregate constructor for generate certificates.

func NewCertificateConstructor

func NewCertificateConstructor() *CertificateConstructor

NewCertificateConstructor generates a default constructor.

func (*CertificateConstructor) New

func (c *CertificateConstructor) New(ctx context.Context, conf *CertificateConfig) ([]tls.Certificate, error)

New generates a slice of certifcates to use

func (*CertificateConstructor) Settings

func (c *CertificateConstructor) Settings() *CertificateConfig

Settings generates the default configuration.

type CertificateFileConfig

type CertificateFileConfig struct {
	Cert string
	Key  string
}

CertificateFileConfig contains settings for loading a cert from a local file. Each value represents a file path.

type CertificateFileConstructor

type CertificateFileConstructor struct{}

CertificateFileConstructor is used to load certs from local files.

func NewCertificateFileConstructor

func NewCertificateFileConstructor() *CertificateFileConstructor

NewCertificateFileConstructor generates a default CertificateFileConstructor.

func (*CertificateFileConstructor) New

func (c *CertificateFileConstructor) New(ctx context.Context, conf *CertificateFileConfig) (tls.Certificate, error)

New constructs a certificate from file paths.

func (*CertificateFileConstructor) Settings

func (c *CertificateFileConstructor) Settings() *CertificateFileConfig

Settings generates the default configuration.

type Config

type Config struct {
	Rand               *RandConfig
	Certificates       *CertificateConfig
	RootCAs            *CertPoolConfig
	ClientCAs          *CertPoolConfig
	ServerName         *string
	ClientAuth         *string
	InsecureSkipVerify *bool
}

Config contains settings for constructing a tls.Config.

type Constructor

type Constructor struct {
	Rand         *RandConstructor
	Certificates *CertificateConstructor
	RootCAs      *CertPoolConstructor
	ClientCAs    *CertPoolConstructor
}

Constructor creates tls.Configuration instances.

func NewConstructor

func NewConstructor() *Constructor

NewConstructor generates a default constructor.

func (*Constructor) New

func (c *Constructor) New(ctx context.Context, conf *Config) (*tls.Config, error)

New generates a tls.Configuration.

func (*Constructor) Settings

func (c *Constructor) Settings() *Config

Settings generates the default configurations.

type RandConfig

type RandConfig struct {
	Zero   *RandZeroConfig
	Crypto *RandCryptoConfig
	Choice string
}

RandConfig is an aggregate of all random related options.

type RandConstructor

type RandConstructor struct {
	Zero   *RandZeroConstructor
	Crypto *RandCryptoConstructor
}

RandConstructor selects between available choices.

func NewRandConstructor

func NewRandConstructor() *RandConstructor

NewRandConstructor generates a default constructor.

func (*RandConstructor) New

func (c *RandConstructor) New(ctx context.Context, conf *RandConfig) (io.Reader, error)

New selects a random implementation.

func (*RandConstructor) Settings

func (c *RandConstructor) Settings() *RandConfig

Settings generates the default configuration.

type RandCryptoConfig

type RandCryptoConfig struct{}

RandCryptoConfig contains configuration options for the crypto/rand source.

type RandCryptoConstructor

type RandCryptoConstructor struct{}

RandCryptoConstructor generates a crypto/rand based random source.

func NewRandCryptoConstructor

func NewRandCryptoConstructor() *RandCryptoConstructor

NewRandCryptoConstructor generates a default constructor.

func (*RandCryptoConstructor) New

func (c *RandCryptoConstructor) New(ctx context.Context, conf *RandCryptoConfig) (io.Reader, error)

New generates a crypto/rand based random source.

func (*RandCryptoConstructor) Settings

func (c *RandCryptoConstructor) Settings() *RandCryptoConfig

Settings generates the default constructor input.

type RandZeroConfig

type RandZeroConfig struct{}

RandZeroConfig contains configuration options for the zero random source.

type RandZeroConstructor

type RandZeroConstructor struct{}

RandZeroConstructor generates a zero based random source.

func NewRandZeroConstructor

func NewRandZeroConstructor() *RandZeroConstructor

NewRandZeroConstructor generates a default constructor.

func (*RandZeroConstructor) New

func (c *RandZeroConstructor) New(ctx context.Context, conf *RandZeroConfig) (io.Reader, error)

New generates a zero based random source.

func (*RandZeroConstructor) Settings

func (c *RandZeroConstructor) Settings() *RandZeroConfig

Settings generates the default constructor input.