gw

package module

Go to main page

Versions in this module

v0

v0.5.0

Sep 9, 2026

Changes in this version

+ const SM2ReasonChainBuild

+ const SM2ReasonChainSignature

+ const SM2ReasonChainUntrusted

+ const SM2ReasonChainValidity

+ const SM2ReasonMissingAIC

+ const SM2ReasonMixedChain

+ const SM2ReasonNotSM2Cert

+ const SM2ReasonNotSupported

+ const SM2ReasonParseCert

+ const SM2ReasonParsePublicKey

+ const SM2ReasonPublicKeyType

+ const SM2ReasonSignature

+ var ErrSM2NotSupported = errors.New("SM2 not supported: build with -tags gmsm")

+ var OIDSM2Curve = asn1.ObjectIdentifier

+ var OIDSM2WithSM3 = asn1.ObjectIdentifier

+ var OIDSM3 = asn1.ObjectIdentifier

+ func IsSM2Certificate(der []byte) bool

+ func ParseSM2Certificate(der []byte) (*x509.Certificate, error)

+ func VerifySM2CertificateChain(leafDER []byte, intermediates, roots [][]byte, nows ...time.Time) (*x509.Certificate, error)

+ func VerifySM2Signature(pub, digest, sig []byte) error

+ type SM2BundleInput struct

+ AuditLogger *AuditLogger

+ Data []byte

+ Intermediates [][]byte

+ LeafDER []byte

+ MappingName string

+ Now time.Time

+ RequireAIC bool

+ Roots [][]byte

+ Signature []byte

+ SrcIP string

+ Target string

+ type SM2BundleResult struct

+ AIC *AIC

+ Cert *x509.Certificate

+ func VerifySM2Bundle(in SM2BundleInput) (*SM2BundleResult, error)

+ type SM2VerifyError struct

+ Code string

+ Detail string

+ func (e *SM2VerifyError) Error() string

v0.5.0-experimental

Sep 9, 2026

v0.4.7

Sep 4, 2026

v0.4.6

Sep 3, 2026

v0.4.5

Sep 2, 2026

v0.4.4

Sep 1, 2026

v0.4.3

Sep 1, 2026

v0.4.2

Sep 1, 2026

v0.4.1

Sep 1, 2026

v0.4.0

Sep 1, 2026

Changes in this version

+ const MaxAmplificationDefault

+ const MaxPostingsPerKey

+ func NewReplayNonceStore(ttl time.Duration, max int) *memReplayStore

+ func VerifyProofBounded(leaf []byte, proof []ProofStep, root []byte, maxProofLen int) bool

type AuditChain

+ func (c *AuditChain) SealChecked(entries [][]byte, previousRoot string) (*SealedTree, error)

+ func (c *AuditChain) VerifyContinuity() error

type CRLCache

+ func (c *CRLCache) IsRevokedCert(cert *x509.Certificate) (bool, error)

+ type CRLRevokedFunc func(caDN string, serial *big.Int) (bool, error)

type ConfirmedRenewalManager

+ func (m *ConfirmedRenewalManager) SetOldCertVerifier(fn func(serial string, oldCert *x509.Certificate) error)

+ func (m *ConfirmedRenewalManager) SetPrincipalCertVerifier(fn func(*x509.Certificate) error)

+ func (m *ConfirmedRenewalManager) SetRenewalDAFreshness(maxAge time.Duration)

+ func (m *ConfirmedRenewalManager) SetRenewalNonceStore(s *memReplayStore)

type IssueRequest

+ OldSerial string

type JWTVerifier

+ func (v *JWTVerifier) SetBearerPolicy(expectedIssuer string, expectedAudience []string, nonces aicjwt.NonceStore)

+ type JWTVerifyOptions struct

+ ExpectedAudience []string

+ ExpectedIssuer string

+ NonceStore aicjwt.NonceStore

+ PresenterKey crypto.PublicKey

+ RequireJtiNonceMatch bool

+ StatusChecker aicjwt.StatusChecker

type OCSPCache

+ func (c *OCSPCache) SetCRLChecker(fn CRLRevokedFunc)

type RenewalRequest

+ RequesterKeyHash string

type TLSConfig

+ JWTAudience []string

+ JWTIssuer string

+ JWTReplayProtection *bool

type UDPExtra

+ MaxAmplification int

+ RequirePlaintextRelayRateLimit *bool

+ func (u *UDPExtra) MaxAmplificationFactor() int

+ func (u *UDPExtra) RequirePlaintextRelayRateLimitEnabled() bool

v0.3.0

Aug 31, 2026

Changes in this version

+ func SynthesizeCertFromJWT(outer *aicjwt.OuterClaims) (*x509.Certificate, error)

+ type JWTVerifier struct

+ func LoadJWTVerifier(caFiles ...string) (*JWTVerifier, error)

+ func NewJWTVerifier(cas []*x509.Certificate) *JWTVerifier

+ func (v *JWTVerifier) VerifyBearer(token string, now time.Time) (*x509.Certificate, *aicjwt.OuterClaims, error)

type TLSConfig

+ JWTCAFile string

v0.2.0

Aug 26, 2026

Changes in this version

+ const ConstraintAuditRequiredKey

+ const ConstraintHardTimeoutKey

+ const ConstraintIdleTimeoutKey

+ const ConstraintReadOnlyKey

+ const HardTimeoutMax

+ const HardTimeoutMin

+ const IdleTimeoutMax

+ const IdleTimeoutMin

v0.1.0

Aug 24, 2026

Changes in this version

+ const CompletedHeaderValue

+ const ConstraintCIDRKey

+ const ConstraintConcurrentKey

+ const ConstraintGeoFenceKey

+ const ConstraintTimeWindowKey

+ const DefaultConnExpiryCheckInterval

+ const DefaultDAAgeMax

+ const DefaultMaskRune

+ const DefaultMaxChainLength

+ const DefaultRenewInterval

+ const DefaultRenewPct

+ const DefaultRenewWindow

+ const DefaultRenewalConfirmTimeout

+ const HeaderTaskID

+ const HeaderTaskStatus

+ const MaxConcurrentMax

+ const MaxConcurrentMin

+ const OCSPFallbackAllow

+ const OCSPFallbackCRL

+ const OCSPFallbackDeny

+ const OfflineLifetimeLimit

+ const PluginTypeAllowlist

+ const PluginTypeDenylist

+ const PluginTypeRBAC

+ const PluginTypeWebhook

+ const ProtocolDTLS

+ const ProtocolGRPC

+ const ProtocolH2C

+ const ProtocolH3

+ const ProtocolHTTP1

+ const ProtocolHTTP2

+ const ProtocolQUIC

+ const ProtocolTCP

+ const ProtocolUDP

+ const ProtocolWS

+ const ProtocolWSS

+ const RBACPermDelete

+ const RBACPermExec

+ const RBACPermRead

+ const RBACPermWrite

+ const RoleAdmin

+ const RoleAudit

+ const RoleDeploy

+ const RoleOps

+ const RolePrefix

+ const RoleRead

+ const RoleWild

+ const TLSModeMTLS

+ const TLSModeNone

+ const TLSModeServer

+ var AIAOID = asn1.ObjectIdentifier

+ var ErrNoTask = fmt.Errorf("task not found")

+ var MetricAICActiveAgents = NewMetricGauge("aic_active_agents", "Currently active AIC agents")

+ var MetricAICAdmissionDuration = NewMetricHistogram("aic_admission_duration_ms", "AIC admission check duration in milliseconds", ...)

+ var MetricAICAdmissionTotal = NewMetricCounter("aic_admission_total", "Total AIC admission checks", "decision")

+ var MetricAICBufferQueueDepth = NewMetricGauge("aic_buffer_queue_depth", "Current AIC capability buffer queue depth")

+ var MetricAICCertIssuedTotal = NewMetricCounter("aic_cert_issued_total", "Total AIC certificates issued")

+ var MetricAICCertRevokedTotal = NewMetricCounter("aic_cert_revoked_total", "Total AIC certificates revoked")

+ var MetricAICRenewalTotal = NewMetricCounter("aic_renewal_total", "Total AIC certificate renewals")

+ var OCSPOID = asn1.ObjectIdentifier

+ var OIDOfflineRBAC = asn1.ObjectIdentifier

+ var OIDPrincipalProfile = asn1.ObjectIdentifier

+ var OIDRenewalToken = asn1.ObjectIdentifier

+ var OIDSHA256 = pki.OIDSHA256

+ var OIDSHA384 = pki.OIDSHA384

+ var OIDSHA512 = pki.OIDSHA512

+ var OIDSigECDSAWithSHA256 = pki.OIDSigECDSAWithSHA256

+ var OIDSigECDSAWithSHA384 = pki.OIDSigECDSAWithSHA384

+ var OIDSigECDSAWithSHA512 = pki.OIDSigECDSAWithSHA512

+ var OIDSigEd25519 = pki.OIDSigEd25519

+ var OIDSigRSAPSSWithSHA256 = pki.OIDSigRSAPSSWithSHA256

+ var OIDSigRSAWithSHA256 = pki.OIDSigRSAWithSHA256

+ var OIDSigRSAWithSHA384 = pki.OIDSigRSAWithSHA384

+ var OIDSigRSAWithSHA512 = pki.OIDSigRSAWithSHA512

+ var SecureCipherSuites = []uint16

+ var Version = "0.1.0"

+ func AICFingerprint(cert *x509.Certificate) string

+ func ApplyJSONConfig[T any](target *T) func([]byte) error

+ func ArchiveAuditFile(path string) error

+ func AuditDuration(start time.Time, entry *AuditEntry)

+ func BaseTLSConfig(cipherSuites []string, minTLSVersion string) *tls.Config

+ func BuildCipherSuites(names []string) []uint16

+ func BuildPluginsFromConfig(reg *PluginRegistry, cfgs PluginConfigs) error

+ func CheckAuthorizationConstraints(constraints []Capability, clientIP string) error

+ func CheckAuthorizationConstraintsAt(constraints []Capability, clientIP, timeHHMM string) error

+ func CheckDAFreshness(ts time.Time, now time.Time, maxAge time.Duration) error

+ func CheckDelegatedAgentCert(cert *x509.Certificate, gs *GatewaySessionExtension) string

+ func CheckDelegatedAgentHeaders(cert *x509.Certificate, r *http.Request) string

+ func CheckRole(roles []string, allowed []string) bool

+ func ClientTLSConfig(caCertFile, certFile, keyFile string, cipherSuites []string, ...) (*tls.Config, error)

+ func ConstraintRecheckLoop(aicConstraints, paConstraints []Capability, clientIP string, ...)

+ func DAHash(cert *x509.Certificate) string

+ func DAHashFromAIC(aic *AIC) string

+ func DecodeBase64(s string) ([]byte, error)

+ func DelegatedAgentServerIdentity(cert *x509.Certificate, principal string, gs *GatewaySessionExtension) (user string, expiry time.Time, reason string)

+ func EffectiveDelegationCapabilities(chain []*x509.Certificate, principalCaps []pki.Capability, maxChainLen int) ([]pki.Capability, error)

+ func EffectiveDelegationCapabilitiesFromAIC(chain []*x509.Certificate, topPrincipal *x509.Certificate, maxChainLen int) ([]pki.Capability, error)

+ func EncodeBase64(data []byte) string

+ func ExtractOCSPURL(cert *x509.Certificate) string

+ func ExtractPolicyRoles(cert *x509.Certificate) []string

+ func ExtractRoles(cert *x509.Certificate) []string

+ func ExtractSPIFFEIDFromCert(cert *x509.Certificate) string

+ func FetchOCSPResponseRaw(cert, issuer *x509.Certificate, ocspURL string) ([]byte, error)

+ func FilterAuditFile(file string, since time.Time, action string, cn, serial, mapping string) error

+ func FindStartOffsetByTime(file string, target time.Time) (int64, error)

+ func HasAIC(cert *x509.Certificate) bool

+ func HasDelegatedAgentOU(cert *x509.Certificate) bool

+ func HashLeaf(data []byte) []byte

+ func HashNode(left, right []byte) []byte

+ func IsAdminOU(ou string) bool

+ func IsReloadSignal(_ os.Signal) bool — windows/amd64

+ func IsReloadSignal(sig os.Signal) bool — darwin/amd64, js/wasm, linux/amd64

+ func KeyHashHex(cert *x509.Certificate) string

+ func LoadCA(caCertFile string) (*x509.CertPool, error)

+ func LoadCACert(caCertFile string) (*x509.Certificate, error)

+ func LoadCAFromFile(path string) (*x509.CertPool, error)

+ func LoadCert(certFile, keyFile string) (*tls.Certificate, error)

+ func LoadGatewayPolicy(policyPath, sigSuffix string, opts *PolicyVerifyOptions, require bool) error

+ func LogAdmission(result AdmissionResult, clientIP string, logger *slog.Logger)

+ func LogPluginDecision(logger *AuditLogger, entry PluginAuditEntry)

+ func MTLSServerConfig(caCertFile string, cert *tls.Certificate, cipherSuites []string, ...) (*tls.Config, error)

+ func MakeConfirmedRenewalConfirmHandler(m *ConfirmedRenewalManager, tr Translator, lang string) http.HandlerFunc

+ func MakeConfirmedRenewalRejectHandler(m *ConfirmedRenewalManager, tr Translator, lang string) http.HandlerFunc

+ func MakeConfirmedRenewalRequestHandler(m *ConfirmedRenewalManager, tr Translator, lang string) http.HandlerFunc

+ func MakeConfirmedRenewalStatusHandler(m *ConfirmedRenewalManager, tr Translator, lang string) http.HandlerFunc

+ func MakeDisconnectByAgentHandler(registry *ConnRegistry, tr Translator, lang string) http.HandlerFunc

+ func MakeDisconnectByUserHandler(registry *ConnRegistry, tr Translator, lang string) http.HandlerFunc

+ func MarshalTSARequest(req TimeStampReq) ([]byte, error)

+ func MaskCertSerial(serial string) string

+ func MaskEmail(email string) string

+ func MaskFilePath(path string) string

+ func MaskString(s string, visible int) string

+ func MaskToken(token string) string

+ func MatchCapability(id, pattern string) bool

+ func MatchCapabilityPriority(id, pattern string) int

+ func MatchCapabilityRules(id string, rules []pki.CapabilityRule) pki.CapabilityRuleMatch

+ func MustVerifyCurrentExecutable(roots *x509.CertPool)

+ func NeedRenew(cert *x509.Certificate, renewalWindow time.Duration) bool

+ func NeedRenewPct(cert *x509.Certificate, pct float64) bool

+ func NeedRevoke(cert *x509.Certificate) bool

+ func NewChainHTTPClient(tlsConfig *tls.Config) *http.Client

+ func NormalizeSerial(serial *big.Int) string

+ func OfflineLifetimeFor(ocspFallback string) time.Duration

+ func PEMRootPool(pemData []byte) (*x509.CertPool, error)

+ func ParseCertPEM(data []byte) (*x509.Certificate, error)

+ func ParseCertPEMFile(path string) (*x509.Certificate, error)

+ func ParsePEMCert(data []byte) (*x509.Certificate, error)

+ func ParsePrivateKeyPEM(data []byte) (crypto.Signer, error)

+ func ParsePrivateKeyPEMFile(path string) (crypto.Signer, error)

+ func PeerCertRoles(r *http.Request) []string

+ func PluginTypeName(p CapabilityPlugin) string

+ func RegisterConstraint(ev ConstraintEvaluator) error

+ func RegisterCounter(m *MetricCounter)

+ func RegisterGauge(m *MetricGauge)

+ func RegisterGeoResolver(name string, fn GeoResolver)

+ func RegisterHistogram(m *MetricHistogram)

+ func RegisterParameterValidator(v ParameterValidator) error

+ func RegisterPlugin(p CapabilityPlugin) error

+ func RegisterReloadSignal(_ chan os.Signal) — windows/amd64

+ func RegisterReloadSignal(sigCh chan os.Signal) — darwin/amd64, js/wasm, linux/amd64

+ func RenderMetrics(buildInfo string) string

+ func RenewalLoop(cfg *IssueConfig, cn, san string, certFile, keyFile string, ...)

+ func ReplaceConstraint(ev ConstraintEvaluator) error

+ func RequireRoles(r *http.Request, allowedRoles []string) bool

+ func ResetConstraints()

+ func ResetParameterValidators()

+ func ResetPlugins()

+ func SanitizeString(s string) string

+ func ServerTLSConfig(cert *tls.Certificate, cipherSuites []string, minTLSVersion string) *tls.Config

+ func SetAuthorizationPolicy(p *AuthorizationPolicy)

+ func SetGlobalCapabilityRegistry(cr CapabilityRegistry)

+ func SignPolicy(policyData []byte, cert *x509.Certificate, signer crypto.Signer) ([]byte, error)

+ func SignerHasAdminOU(cert *x509.Certificate) bool

+ func StartOCSPStapling(tlsCert *tls.Certificate, cfg *tls.Config, caCertFile string, ...)

+ func TLSVersionFromString(s string) uint16

+ func TaskCompletedFromHeader(h func(string) string, fallbackID string) (string, bool)

+ func TaskIDFromHeader(h func(string) string) string

+ func TrackDuration(start time.Time, d *DurationTracker)

+ func ValidateAIC(aic *AIC) error

+ func VerifyAuditEntry(data []byte, tsaClient *TSAClient) error

+ func VerifyBelongTo(handshake, auth *x509.Certificate, roots *x509.CertPool) error

+ func VerifyBundle(bundle *CredentialBundle, roots *x509.CertPool) error

+ func VerifyCurrentExecutable(roots *x509.CertPool) error

+ func VerifyDelegationAuth(aic *AIC, userCert *x509.Certificate) error

+ func VerifyDelegationChain(chain []*x509.Certificate, topPrincipal *x509.Certificate, maxDepth int) error

+ func VerifyDelegationChainWithCaps(chain []*x509.Certificate, topPrincipal *x509.Certificate, ...) ([]pki.Capability, error)

+ func VerifyLayer2(chain []*x509.Certificate, cfg *PipelineConfig, roles []string) (AdmissionResult, *Layer2Result)

+ func VerifyPrincipalKeyHash(agent, principal *x509.Certificate) error

+ func VerifyProof(leaf []byte, proof []ProofStep, root []byte) bool

+ func VerifySPIFFESAN(cert *x509.Certificate, expectedID string) bool

+ func VerifySelf(exePath string, roots *x509.CertPool) (*x509.Certificate, error)

+ func VerifySelfWithOptions(exePath string, opts SelfVerifyOptions) (*x509.Certificate, error)

+ func VerifySignedBinary(data, sig []byte, roots *x509.CertPool) (*x509.Certificate, error)

+ func VerifySignedPolicy(sigDER, policyData []byte, roots *x509.CertPool, requireAdminOU bool) (*x509.Certificate, error)

+ func WriteMgmtError(w http.ResponseWriter, status int, message string)

+ func WriteMgmtJSON(w http.ResponseWriter, status int, v interface{})

+ type AIC = pki.AIC

+ func ParseAIC(cert *x509.Certificate) (*AIC, error)

+ type AdmissionConfig struct

+ AuditLogger *AuditLogger

+ CheckDAAge bool

+ ClientIP string

+ CredentialBundle *CredentialBundle

+ DAAgeMax time.Duration

+ DisallowRepresentative bool

+ EnforceCapSizeConstraints bool

+ EnforceConstraints bool

+ EnforceSize32 bool

+ NonceCache *NonceCache

+ RejectOverflow bool

+ RequireAIC bool

+ RequireGatewaySession bool

+ RequireUserAuth bool

+ RequireUserPermission bool

+ RequiredCapabilities []string

+ RequiredProtocol string

+ RequiredRuleId string

+ StrictConstraints bool

+ UserCert *x509.Certificate

+ UserCertResolver func(keyHash []byte) (*x509.Certificate, error)

+ func (c AdmissionConfig) Validate() error

+ type AdmissionResult struct

+ AIC *AIC

+ Decision DecisionResult

+ EffectiveCaps []Capability

+ GatewaySession *GatewaySessionExtension

+ PrincipalAuthorization *PrincipalAuthorization

+ PrincipalUid string

+ Reason string

+ func CheckAdmission(cert *x509.Certificate, cfg AdmissionConfig) AdmissionResult

+ type AggregateSource struct

+ func NewAggregateSource() *AggregateSource

+ func (a *AggregateSource) Name() string

+ func (a *AggregateSource) Set(name string, val float64)

+ func (a *AggregateSource) Value() (float64, bool)

+ type AlarmClient struct

+ func NewAlarmClient(cfg *AlarmConfig) *AlarmClient

+ func (a *AlarmClient) AddSource(s AlarmSource)

+ func (a *AlarmClient) Start(stopCh chan struct{})

+ func (a *AlarmClient) Stop()

+ type AlarmConfig struct

+ Interval int

+ Receivers []AlarmReceiver

+ Rules []AlarmRule

+ type AlarmReceiver struct

+ Name string

+ Secret string

+ Type string

+ Webhook string

+ type AlarmRule struct

+ Cooldown int

+ Metric string

+ Name string

+ Operator string

+ Receiver string

+ Threshold float64

+ type AlarmSource interface

+ Name func() string

+ Value func() (float64, bool)

+ type AlgorithmIdentifier = pki.AlgorithmIdentifier

+ type AuditAction string

+ const ActionCompleted

+ const ActionConnected

+ const ActionDenied

+ const ActionDisconnected

+ const ActionNoRoute

+ const ActionPluginDecision

+ const ActionProxied

+ const ActionRevoked

+ const ActionUnknownConstraint

+ const ActionWSClose

+ const ActionWSConnect

+ type AuditChain struct

+ func NewAuditChain(batchSize int, onSeal func(root []byte)) *AuditChain

+ func (c *AuditChain) BatchCount() int

+ func (c *AuditChain) Dump() string

+ func (c *AuditChain) GetTree(batchNumber int) *SealedTree

+ func (c *AuditChain) LatestRoot() string

+ func (c *AuditChain) LatestRootBytes() []byte

+ func (c *AuditChain) Seal(entries [][]byte, previousRoot string) *SealedTree

+ func (c *AuditChain) Verify(batchNumber int, leaf []byte, proof []ProofStep) (bool, error)

+ func (c *AuditChain) VerifyJSON(req *VerifyRequest) *VerifyResponse

+ type AuditEntry struct

+ AICFingerprint string

+ Action string

+ AgentId string

+ BytesIn int64

+ BytesOut int64

+ Capabilities []string

+ ClientCN string

+ ClientSerial string

+ DaHash string

+ Decision string

+ DelegationMode int

+ DenyReason string

+ Duration string

+ GatewayId string

+ Level string

+ Mapping string

+ PolicyVersion uint64

+ PrincipalUid string

+ Protocol string

+ Roles []string

+ SPIFFEID string

+ SessionId string

+ SrcIP string

+ Target string

+ TargetID string

+ Time string

+ TraceId string

+ func NewAuditEntryDenied(srcIP, mappingName, target, reason string, cert *x509.Certificate) AuditEntry

+ func NewAuditEntryFromConn(srcIP, mappingName, target string, cert *x509.Certificate) AuditEntry

+ func ReadAuditEntries(file string, filter AuditFilter) ([]AuditEntry, error)

+ func (e *AuditEntry) SetV12Fields(protocol, gatewayId, traceId, sessionId, decision string)

+ func (e *AuditEntry) WithEvidenceFingerprints(cert *x509.Certificate) *AuditEntry

+ type AuditFilter struct

+ Action string

+ ClientCN string

+ Limit int

+ Mapping string

+ Offset int

+ Serial string

+ Since time.Time

+ Sort string

+ Until time.Time

+ type AuditIndex struct

+ func NewAuditIndex(path string) (*AuditIndex, error)

+ func (idx *AuditIndex) Close() error

+ func (idx *AuditIndex) DBPath() string

+ func (idx *AuditIndex) Drop() error

+ func (idx *AuditIndex) Index(entry *AuditEntry) error

+ func (idx *AuditIndex) IndexFTS(entry *AuditEntry) error

+ func (idx *AuditIndex) Search(q *AuditIndexQuery) ([]AuditIndexEntry, error)

+ func (idx *AuditIndex) SearchFTS(query string, limit int) ([]AuditIndexEntry, error)

+ func (idx *AuditIndex) Size() (int64, error)

+ type AuditIndexEntry struct

+ Action string

+ CN string

+ Hash string

+ RawEntry string

+ Serial string

+ Target string

+ Time int64

+ type AuditIndexQuery struct

+ CN string

+ Limit int

+ Offset int

+ Serial string

+ Since int64

+ Until int64

+ type AuditLogger struct

+ func NewAuditLogger(file string, tsa *TSAClient, maxSize int64, maxBak int) (*AuditLogger, error)

+ func (l *AuditLogger) Close() error

+ func (l *AuditLogger) Dropped() int64

+ func (l *AuditLogger) File() string

+ func (l *AuditLogger) Log(entry AuditEntry)

+ type AuditVerifier struct

+ type AuthorizationPolicy struct

+ CapabilityParameters map[string]map[string]any

+ GatewayNamespaces map[string]PolicyNamespace

+ OUMapping map[string]string

+ Roles map[string]PolicyRole

+ Version string

+ func GetAuthorizationPolicy() *AuthorizationPolicy

+ func LoadAuthorizationPolicy(policyPath, sigSuffix string, opts *PolicyVerifyOptions) (*AuthorizationPolicy, error)

+ func ParseAuthorizationPolicy(data []byte) (*AuthorizationPolicy, error)

+ func (p *AuthorizationPolicy) HasGrant(role, capability string) bool

+ func (p *AuthorizationPolicy) HasParamDefault(scheme, capID, param string) (any, bool)

+ func (p *AuthorizationPolicy) IntersectGrants(roles []string, aicCapIds []string) []string

+ func (p *AuthorizationPolicy) ParamDefaults(scheme, capID string) map[string]any

+ func (p *AuthorizationPolicy) RoleByOU(ou string) string

+ func (p *AuthorizationPolicy) RoleGrants(role string) []string

+ type AutoIssueResult struct

+ CN string

+ CertFile string

+ KeyFile string

+ Result *IssueResult

+ func AutoIssueCert(cfg *IssueConfig, cn, san string) (*AutoIssueResult, error)

+ type CRLCache struct

+ func NewCRLCache(caCert *x509.Certificate, url string, refreshSec int, translator Translator, ...) *CRLCache

+ func (c *CRLCache) ForceRefresh() error

+ func (c *CRLCache) IsRevoked(caDN string, serial *big.Int) (bool, error)

+ func (c *CRLCache) LastRefresh() time.Time

+ func (c *CRLCache) Start(stop <-chan struct{})

+ func (c *CRLCache) Stats() (int, time.Time, time.Time)

+ type Capability = pki.Capability

+ type CapabilityPlugin = pki.CapabilityPlugin

+ type CapabilityRegistry interface

+ Enabled func() bool

+ ValidateCapability func(formatted string) error

+ func GetGlobalCapabilityRegistry() CapabilityRegistry

+ type ChainPeerConfig struct

+ Name string

+ TLSConfig *tls.Config

+ URL string

+ type ChainRef struct

+ BatchNumber int

+ CapturedAt int64

+ Peer string

+ Previous string

+ Root string

+ Size int

+ Timestamp string

+ type ChainRefStore struct

+ func NewChainRefStore() *ChainRefStore

+ func (s *ChainRefStore) CompareRef(peer string, theirs *SealedTree) (bool, ChainRef, string)

+ func (s *ChainRefStore) Len() int

+ func (s *ChainRefStore) PeerRefs() []ChainRef

+ func (s *ChainRefStore) Record(ref ChainRef)

+ type ChainSyncClient struct

+ HTTPClient *http.Client

+ Peer string

+ Timeout time.Duration

+ URL string

+ func (c *ChainSyncClient) Fetch() (*SealedTree, error)

+ type ChainSyncer struct

+ Interval time.Duration

+ Peers []ChainSyncClient

+ Store *ChainRefStore

+ func NewChainSyncer(store *ChainRefStore, peers []ChainSyncClient, interval time.Duration) *ChainSyncer

+ func (s *ChainSyncer) Start()

+ func (s *ChainSyncer) Stop()

+ type CloseFunc func()

+ type ConfigWatcher struct

+ func ConfigWatcherFromCLI(url string, tlsConfig *tls.Config, onChange func([]byte) error) *ConfigWatcher

+ func NewConfigWatcher(url string, tlsConfig *tls.Config, interval time.Duration, ...) *ConfigWatcher

+ func (w *ConfigWatcher) Start()

+ func (w *ConfigWatcher) Stop()

+ type ConfirmedRenewalManager struct

+ func NewConfirmedRenewalManager(issueCfg *IssueConfig, registry *ConnExpiryRegistry, ...) *ConfirmedRenewalManager

+ func (m *ConfirmedRenewalManager) Confirm(conf *RenewalConfirmation) (*IssueResult, error)

+ func (m *ConfirmedRenewalManager) CurrentSessionID() string

+ func (m *ConfirmedRenewalManager) Issued() *IssueResult

+ func (m *ConfirmedRenewalManager) Reason() string

+ func (m *ConfirmedRenewalManager) Reject(reason string)

+ func (m *ConfirmedRenewalManager) RequestRenewal(req *RenewalRequest) error

+ func (m *ConfirmedRenewalManager) Reset()

+ func (m *ConfirmedRenewalManager) SetTimeout(d time.Duration)

+ func (m *ConfirmedRenewalManager) State() RenewalState

+ type ConnExpiryRegistry struct

+ func NewConnExpiryRegistry() *ConnExpiryRegistry

+ func (r *ConnExpiryRegistry) Certificate(serial string) *x509.Certificate

+ func (r *ConnExpiryRegistry) Connections(serial string) int64

+ func (r *ConnExpiryRegistry) Len() int

+ func (r *ConnExpiryRegistry) Register(serial string, cert *x509.Certificate) func()

+ func (r *ConnExpiryRegistry) Renewed(serial string) bool

+ func (r *ConnExpiryRegistry) SerialNumbers() []string

+ func (r *ConnExpiryRegistry) ShouldSkipRevoke(serial string) bool

+ func (r *ConnExpiryRegistry) StartExpiryLoop(interval time.Duration, stopCh <-chan struct{}) func()

+ func (r *ConnExpiryRegistry) Unregister(serial string)

+ func (r *ConnExpiryRegistry) UpdateCert(serial string, cert *x509.Certificate) bool

+ type ConnRegistry struct

+ func NewConnRegistry() *ConnRegistry

+ func (r *ConnRegistry) DisconnectByAgentId(agentId string) int

+ func (r *ConnRegistry) DisconnectByPrincipalUid(principalUid string) int

+ func (r *ConnRegistry) ListByAgentId() map[string]int

+ func (r *ConnRegistry) ListByIP() map[string]int

+ func (r *ConnRegistry) ListConnections() []ConnectionInfo

+ func (r *ConnRegistry) Register(agentId, principalUid string, close CloseFunc) func()

+ func (r *ConnRegistry) RegisterConn(agentId, principalUid, srcIP, protocol, serial string, close CloseFunc) func()

+ func (r *ConnRegistry) Stats() (total int)

+ type ConnectionInfo struct

+ AgentId string

+ Established int64

+ ID uint64

+ PrincipalUid string

+ Protocol string

+ Serial string

+ SrcIP string

+ type ConnectionTracker struct

+ func NewConnectionTracker() *ConnectionTracker

+ func (t *ConnectionTracker) Add(serial string, max int64) bool

+ func (t *ConnectionTracker) Count(serial string) int64

+ func (t *ConnectionTracker) Remove(serial string)

+ func (t *ConnectionTracker) Render() string

+ func (t *ConnectionTracker) Snapshot() map[string]int64

+ func (t *ConnectionTracker) Total() int64

+ type ConstraintContext struct

+ ClientIP string

+ Now time.Time

+ type ConstraintEvaluator interface

+ CapabilityId func() string

+ Evaluate func(cap *Capability, ctx *ConstraintContext) error

+ type ConstraintRegistry struct

+ func NewConstraintRegistry() *ConstraintRegistry

+ func (r *ConstraintRegistry) Find(capabilityId string) (ConstraintEvaluator, error)

+ func (r *ConstraintRegistry) Keys() []string

+ func (r *ConstraintRegistry) Len() int

+ func (r *ConstraintRegistry) Register(ev ConstraintEvaluator) error

+ func (r *ConstraintRegistry) Remove(capabilityId string)

+ func (r *ConstraintRegistry) Replace(ev ConstraintEvaluator) error

+ func (r *ConstraintRegistry) Reset()

+ type ContentInfo struct

+ Content asn1.RawValue

+ ContentType asn1.ObjectIdentifier

+ type ControlHandler func(msg ControlMessage) error

+ type ControlMessage struct

+ AgentId string

+ KeyHash string

+ MsgID string

+ Reason string

+ Serial string

+ Source string

+ Timestamp int64

+ Type ControlMessageType

+ Version uint64

+ type ControlMessageType string

+ const ControlDedupWindow

+ const ControlDisconnect

+ const ControlPeerSync

+ const ControlRevoke

+ type CredentialBundle struct

+ AgentChain []*x509.Certificate

+ CACerts []*x509.Certificate

+ PrincipalChain []*x509.Certificate

+ func NewCredentialBundle(agentChain, principalChain, caCerts []*x509.Certificate) (*CredentialBundle, error)

+ func ParseCredentialBundlePEM(data []byte) (*CredentialBundle, error)

+ func (b *CredentialBundle) Agent() *x509.Certificate

+ func (b *CredentialBundle) Principal() *x509.Certificate

+ type DecisionResult int

+ const DecisionAllow

+ const DecisionDeny

+ const DecisionNeedAuth

+ type DelegationAuthTBS = pki.DelegationAuthTBS

+ type DelegationAuthorization = pki.DelegationAuthorization

+ func SignRenewalDA(req *RenewalRequest, key crypto.Signer, nonce []byte, ts time.Time, ...) (DelegationAuthorization, error)

+ type DelegationChainVerifier struct

+ MaxChainLength int

+ MaxDepth int

+ func (v *DelegationChainVerifier) Verify(chain []*x509.Certificate, topPrincipal *x509.Certificate) error

+ type DelegationMode = pki.DelegationMode

+ const DelegationAuthorized

+ const DelegationRepresentative

+ type DelegationPolicy = pki.DelegationPolicy

+ type DurationTracker struct

+ func (d *DurationTracker) Add(dur time.Duration)

+ type ExtField = pki.ExtField

+ type ExternalPolicyRef = pki.ExternalPolicyRef

+ type GatewaySessionConfig struct

+ AllowedCIDRs []string

+ HardTimeout int

+ MaxConcurrent int

+ MaxRetries int

+ type GatewaySessionExtension = pki.GatewaySessionExtension

+ func ParseGatewaySessionExtension(cert *x509.Certificate) (*GatewaySessionExtension, error)

+ type GeoResolver func(ip string) (string, error)

+ type HTTPExtra struct

+ ForwardClientCert *bool

+ ForwardClientCertDER *bool

+ ReadHeaderTimeoutSec int

+ TLSTermination *bool

+ WriteTimeoutSec int

+ func (h *HTTPExtra) ForwardClientCertDEREnabled() bool

+ func (h *HTTPExtra) ForwardClientCertEnabled() bool

+ func (h *HTTPExtra) ReadHeaderTimeout() time.Duration

+ func (h *HTTPExtra) TLSTerminationEnabled() bool

+ func (h *HTTPExtra) WriteTimeout() time.Duration

+ type HTTPFacts = pki.HTTPFacts

+ type IssueClient struct

+ func NewIssueClient(cfg IssueConfig) (*IssueClient, error)

+ func (c *IssueClient) Issue(req *IssueRequest) (*IssueResult, error)

+ type IssueConfig struct

+ CACertFile string

+ CertFile string

+ CoreURL string

+ DefaultCA string

+ DefaultKeyType string

+ DefaultValidity int

+ KeyFile string

+ RenewalIntervalSec int

+ RetryCount int

+ Timeout time.Duration

+ func (c *IssueConfig) RenewalInterval() time.Duration

+ type IssueRequest struct

+ AgentId string

+ AgentType *int

+ CA string

+ CN string

+ GatewaySession *GatewaySessionConfig

+ KeyType string

+ MarketAccessId string

+ Profile string

+ SAN string

+ Validity int

+ type IssueResult struct

+ CA string

+ CertPEM string

+ CommonName string

+ KeyPEM string

+ SerialNumber string

+ func (r *IssueResult) Certificate() (*x509.Certificate, error)

+ type KeyDerivationParams = pki.KeyDerivationParams

+ type Layer1Result struct

+ Reason string

+ Roles []string

+ Verified bool

+ func VerifyLayer1(chain []*x509.Certificate, cfg *PipelineConfig) *Layer1Result

+ type Layer2Result struct

+ AIC *AIC

+ GatewaySession *GatewaySessionExtension

+ PrincipalAuthorization *PrincipalAuthorization

+ PrincipalUid string

+ Reason string

+ Verified bool

+ type Layer3Result struct

+ Reason string

+ Verified bool

+ func VerifyLayer3(chain []*x509.Certificate, cfg *PipelineConfig) *Layer3Result

+ type ManagementServer struct

+ func NewManagementServer(cfg ManagementServerConfig) *ManagementServer

+ func (ms *ManagementServer) RegisterHandler(pattern string, handler http.HandlerFunc, allowedRoles ...string)

+ func (ms *ManagementServer) RegisterRawHandler(pattern string, handler http.HandlerFunc)

+ func (ms *ManagementServer) SetConfirmedRenewalManager(m *ConfirmedRenewalManager)

+ func (ms *ManagementServer) SetPolicyManager(pm *PolicyManager)

+ func (ms *ManagementServer) Start() error

+ func (ms *ManagementServer) Stop()

+ func (ms *ManagementServer) UpdatePluginRegistry(reg *PluginRegistry)

+ type ManagementServerConfig struct

+ AuditChain *AuditChain

+ AuditIndex *AuditIndex

+ AuditLogger *AuditLogger

+ BuildInfo string

+ ChainRefs *ChainRefStore

+ ConfirmedRenewalManager *ConfirmedRenewalManager

+ ConnRegistry *ConnRegistry

+ Lang string

+ Listen string

+ PluginRegistry *PluginRegistry

+ PolicyManager *PolicyManager

+ TLSConfig *tls.Config

+ Translator Translator

+ type MerkleTree struct

+ func NewMerkleTree(leaves [][]byte) *MerkleTree

+ func (m *MerkleTree) Proof(leafIndex int) ([]ProofStep, error)

+ func (m *MerkleTree) Root() []byte

+ func (m *MerkleTree) RootHex() string

+ type MeshConfig struct

+ DialTimeout time.Duration

+ LocalName string

+ Peers []MeshPeer

+ PingInterval time.Duration

+ TLSConfig *tls.Config

+ type MeshManager struct

+ func NewMeshManager(cfg MeshConfig) *MeshManager

+ func (m *MeshManager) Broadcast(msg ControlMessage) error

+ func (m *MeshManager) BroadcastDisconnect(agentId, reason string) error

+ func (m *MeshManager) BroadcastPeerSync(version uint64) error

+ func (m *MeshManager) BroadcastRevoke(serial, keyHash string) error

+ func (m *MeshManager) Forward(peerName string, conn net.Conn) error

+ func (m *MeshManager) HandleControlMessage(conn io.ReadWriter) error

+ func (m *MeshManager) HealthyPeers() []MeshPeer

+ func (m *MeshManager) NewControlMessage(typ ControlMessageType) ControlMessage

+ func (m *MeshManager) SelectPeer(tags map[string]string) *MeshPeer

+ func (m *MeshManager) SendControl(peerName string, msg ControlMessage) error

+ func (m *MeshManager) ServeControlListener(l net.Listener)

+ func (m *MeshManager) SetControlHandler(fn ControlHandler)

+ func (m *MeshManager) Start() error

+ func (m *MeshManager) StartDedupCleanup(interval time.Duration)

+ func (m *MeshManager) Stop()

+ type MeshPeer struct

+ Address string

+ Name string

+ Tags map[string]string

+ Weight int

+ type MessageImprint struct

+ HashAlgorithm AlgorithmIdentifier

+ HashedMessage []byte

+ type MetricCounter struct

+ func NewMetricCounter(name, help string, labels ...string) *MetricCounter

+ func (c *MetricCounter) Add(n uint64, labelValues ...string)

+ func (c *MetricCounter) Count(labelValues ...string) uint64

+ func (c *MetricCounter) Inc(labelValues ...string)

+ type MetricGauge struct

+ func NewMetricGauge(name, help string, labels ...string) *MetricGauge

+ func (g *MetricGauge) Add(delta int64, labelValues ...string)

+ func (g *MetricGauge) Set(n int64, labelValues ...string)

+ func (g *MetricGauge) Value(labelValues ...string) int64

+ type MetricHistogram struct

+ func NewMetricHistogram(name, help string, labels []string, bounds ...float64) *MetricHistogram

+ func (h *MetricHistogram) Observe(v float64, labelValues ...string)

+ type MetricSource struct

+ func NewMetricSource(name string, val float64) *MetricSource

+ func (m *MetricSource) Name() string

+ func (m *MetricSource) Value() (float64, bool)

+ type MuxStream struct

+ func (s *MuxStream) Close() error

+ func (s *MuxStream) LocalAddr() net.Addr

+ func (s *MuxStream) LocalID() uint32

+ func (s *MuxStream) Read(b []byte) (int, error)

+ func (s *MuxStream) RemoteAddr() net.Addr

+ func (s *MuxStream) RemoteID() uint32

+ func (s *MuxStream) SetDeadline(t time.Time) error

+ func (s *MuxStream) SetReadDeadline(t time.Time) error

+ func (s *MuxStream) SetWriteDeadline(t time.Time) error

+ func (s *MuxStream) Write(b []byte) (int, error)

+ type NonceCache struct

+ func NewNonceCache() *NonceCache

+ func (nc *NonceCache) CheckAndAdd(scope string, nonce []byte) bool

+ func (nc *NonceCache) Len() int

+ func (nc *NonceCache) Stop()

+ type OCSPCache struct

+ func NewOCSPCache(ttl time.Duration, fallback string, translator Translator, lang string) *OCSPCache

+ func (c *OCSPCache) Check(cert, issuer *x509.Certificate) error

+ func (c *OCSPCache) Flush()

+ func (c *OCSPCache) Stats() (int, int)

+ type OfflineRBAC struct

+ func NewOfflineRBAC(roles []string) *OfflineRBAC

+ func NewOfflineRBACFromCert(cert *x509.Certificate) *OfflineRBAC

+ func (r *OfflineRBAC) CheckRole(allowed []string) bool

+ type OfflineRBACCheckOptions struct

+ Issuer *x509.Certificate

+ RequiredPerm int

+ TargetResource string

+ type OfflineRBACDecision struct

+ Allowed bool

+ Reason string

+ func OfflineRBACCheck(ext *OfflineRbacExt, opts OfflineRBACCheckOptions) OfflineRBACDecision

+ type OfflineRbacExt struct

+ NotAfter time.Time

+ NotBefore time.Time

+ PermissionBitmap asn1.BitString

+ ResourceScope []string

+ RoleId string

+ TrustAnchorHash []byte

+ Version int

+ func ParseOfflineRBAC(cert *x509.Certificate) *OfflineRbacExt

+ type PKIStatusInfo struct

+ Status int

+ type ParameterValidator interface

+ Scheme func() string

+ Validate func(granted, declared Capability) error

+ var MaxRowsValidator ParameterValidator = maxRowsValidator{}

+ type ParameterValidatorRegistry struct

+ func BuiltinParameterValidators() *ParameterValidatorRegistry

+ func NewParameterValidatorRegistry() *ParameterValidatorRegistry

+ func (r *ParameterValidatorRegistry) Find(schemeID string) (ParameterValidator, error)

+ func (r *ParameterValidatorRegistry) Keys() []string

+ func (r *ParameterValidatorRegistry) Len() int

+ func (r *ParameterValidatorRegistry) Register(v ParameterValidator) error

+ func (r *ParameterValidatorRegistry) Reset()

+ func (r *ParameterValidatorRegistry) ValidateCapability(granted, declared Capability) error

+ type PermissionDef = pki.PermissionDef

+ type PermissionLevel = pki.PermissionLevel

+ const PermissionAuto

+ const PermissionRequiresApproval

+ type PipelineCheck int

+ const CheckFullChain

+ const CheckLeafOnly

+ type PipelineConfig struct

+ AllowRoles []string

+ AllowedSPIFFEIDs []string

+ AuditLogger *AuditLogger

+ CRLCache *CRLCache

+ CapabilityPluginRegistry *PluginRegistry

+ CapabilityPluginResolver func(agentID string) (version uint64, reg *PluginRegistry)

+ CapabilityRegistry CapabilityRegistry

+ CheckScope PipelineCheck

+ ClientIP string

+ CredentialBundle *CredentialBundle

+ DisallowRepresentative bool

+ EnforceCapSizeConstraints bool

+ EnforceConstraints bool

+ EnforceSize32 bool

+ HTTPFacts *HTTPFacts

+ MaxConnsPerCert int

+ NonceCache *NonceCache

+ OCSPCache *OCSPCache

+ OfflineMaxCertLifetime time.Duration

+ ParameterValidators *ParameterValidatorRegistry

+ PolicyServer PolicyServer

+ PolicyVersion uint64

+ RejectOverflow bool

+ RequireAIC bool

+ RequireGS bool

+ RequireSPIFFE bool

+ RequireUserAuth bool

+ RequireUserPermission bool

+ RequiredCapabilities []string

+ RequiredProtocol string

+ RequiredRuleId string

+ RiskMonitor *RiskMonitor

+ SPIFFETrustDomain string

+ StrictConstraints bool

+ UserCert *x509.Certificate

+ UserCertResolver func(keyHash []byte) (*x509.Certificate, error)

+ type PipelineResult struct

+ AIC *AIC

+ AgentId string

+ DenyReason string

+ GatewaySession *GatewaySessionExtension

+ Granted bool

+ Principal string

+ PrincipalAuthorization *PrincipalAuthorization

+ Roles []string

+ SPIFFEID string

+ Serial string

+ SessionConstraint SessionConstraint

+ func RunAccessPipeline(chain []*x509.Certificate, cfg *PipelineConfig) *PipelineResult

+ func VerifyTrustLayers(chain []*x509.Certificate, cfg *PipelineConfig) *PipelineResult

+ type PluginAuditEntry struct

+ CapabilityID string

+ ClientCN string

+ DaHash string

+ Decision string

+ Level string

+ PolicyVersion uint64

+ Principal string

+ Reason string

+ Scheme string

+ type PluginConfig struct

+ Config map[string]interface{}

+ Type string

+ type PluginConfigs map[string]*PluginConfig

+ type PluginContext = pki.PluginContext

+ type PluginDecision = pki.PluginDecision

+ const PluginAllow

+ const PluginBypass

+ const PluginDeny

+ type PluginRegistry = pki.PluginRegistry

+ func NewPluginRegistry() *PluginRegistry

+ type PluginResult = pki.PluginResult

+ func CheckOperationCapability(reg *PluginRegistry, cap *Capability, ctx *PluginContext) (*PluginResult, error)

+ func ExecutePlugin(schemeID string, cap *pki.Capability, ctx *PluginContext) (*PluginResult, error)

+ type PluginSummary struct

+ Scheme string

+ Type string

+ type PolicyBranch struct

+ AgentID string

+ Comment string

+ ID string

+ Priority int

+ Version uint64

+ type PolicyManager struct

+ MaxHistory int

+ MinRollbackVersion uint64

+ func NewPolicyManager(registry *PluginRegistry) *PolicyManager

+ func (pm *PolicyManager) ActiveSnapshot() *PolicySnapshot

+ func (pm *PolicyManager) Branches() []PolicyBranch

+ func (pm *PolicyManager) ClearBranches()

+ func (pm *PolicyManager) CurrentVersion() uint64

+ func (pm *PolicyManager) History() []*PolicySnapshot

+ func (pm *PolicyManager) Publish(configs PluginConfigs, source, operator string) (uint64, error)

+ func (pm *PolicyManager) Registry() *PluginRegistry

+ func (pm *PolicyManager) Reset()

+ func (pm *PolicyManager) Rollback(version uint64, source, operator string) (uint64, error)

+ func (pm *PolicyManager) SelectRegistry(agentID string) (uint64, *PluginRegistry)

+ func (pm *PolicyManager) SetBranches(branches []PolicyBranch) error

+ type PolicyNamespace struct

+ DisplayName string

+ Grants []string

+ Prefix string

+ type PolicyRole struct

+ DisplayName string

+ Grants []string

+ Profiles []string

+ Scope []string

+ type PolicyServer interface

+ CheckOnline func(leaf *x509.Certificate, aic *AIC) error

+ Name func() string

+ type PolicySigningConfig struct

+ CAFile string

+ Enabled bool

+ Require bool

+ RequireAdminOU *bool

+ SigSuffix string

+ func (ps *PolicySigningConfig) BuildPolicyVerifyOptions(tlsClientCA string) (*PolicyVerifyOptions, error)

+ type PolicySigningIdentity struct

+ Cert *x509.Certificate

+ Key crypto.Signer

+ func LoadPolicySigningIdentity(certPEM, keyPEM string) (*PolicySigningIdentity, error)

+ type PolicySnapshot struct

+ Configs PluginConfigs

+ Operator string

+ RolledBackFrom uint64

+ Source string

+ Timestamp time.Time

+ Version uint64

+ func (s *PolicySnapshot) SnapshotJSON() map[string]interface{}

+ type PolicyVerifyOptions struct

+ RequireAdminOU bool

+ Roots *x509.CertPool

+ type PrincipalAuthorization = pki.PrincipalAuthorization

+ func ParseUserPermissionExtension(cert *x509.Certificate) (*PrincipalAuthorization, error)

+ type PrincipalProfile struct

+ CertHash string

+ CommonName string

+ OrganizationalUnit []string

+ PrincipalUID string

+ Roles []string

+ UserPermission *UserPermission

+ func ParsePrincipalProfile(cert *x509.Certificate, aic *AIC, up *UserPermission) (*PrincipalProfile, error)

+ func (p *PrincipalProfile) AllowsDelegationMode(mode int) bool

+ func (p *PrincipalProfile) HasRole(role string) bool

+ type PrincipalProfileAttribute struct

+ Type string

+ Value string

+ type PrincipalProfileExtension struct

+ Attributes []PrincipalProfileAttribute

+ Version int

+ func ParsePrincipalProfileExtension(cert *x509.Certificate) *PrincipalProfileExtension

+ type PrincipalUid = pki.PrincipalUid

+ func MakePrincipalUidFromCert(realm, identifier string, certDER []byte) PrincipalUid

+ func ParsePrincipalUid(s string) (PrincipalUid, error)

+ type ProofStep struct

+ Left bool

+ Sibling []byte

+ type ProofStepJSON struct

+ Left bool

+ Sibling string

+ type Reason = pki.Reason

+ type RenewalConfirmation struct

+ DA DelegationAuthorization

+ KeyHash []byte

+ PrincipalCert *x509.Certificate

+ SessionID string

+ type RenewalDAPayload struct

+ Nonce []byte

+ ReasonCode string

+ ReasonDesc string

+ RequestedLifetime int

+ SignatureAlgorithm string

+ SignatureValue []byte

+ Timestamp string

+ func DAToPayload(da DelegationAuthorization) RenewalDAPayload

+ type RenewalRequest struct

+ AgentId string

+ CA string

+ CN string

+ Capabilities []Capability

+ OldCert *x509.Certificate

+ OldSerial string

+ PrincipalUid string

+ Profile string

+ SAN string

+ SessionID string

+ Validity int

+ type RenewalState int

+ const RenewalAwaitingConfirmation

+ const RenewalConfirmed

+ const RenewalIdle

+ const RenewalRejected

+ func (s RenewalState) String() string

+ type RenewalTokenExt struct

+ NewKeyHash []byte

+ Nonce []byte

+ OldCertSerial []byte

+ PrincipalUid PrincipalUid

+ Timestamp time.Time

+ ValidityPeriod int

+ Version int

+ func ParseRenewalToken(exts []pkix.Extension) (*RenewalTokenExt, error)

+ func (r *RenewalTokenExt) IsExpired() bool

+ func (r *RenewalTokenExt) ValidateConstraints() error

+ func (r *RenewalTokenExt) VerifyNonce() bool

+ type ResourceScope = pki.ResourceScope

+ type RevokeRequest struct

+ Reason string

+ type Revoker struct

+ func NewRevoker(cfg RevokerConfig) (*Revoker, error)

+ func (r *Revoker) Registry() *ConnExpiryRegistry

+ func (r *Revoker) RevokeClientCert(cert *x509.Certificate, audit *AuditLogger)

+ func (r *Revoker) RevokeClientCertForced(cert *x509.Certificate, audit *AuditLogger)

+ func (r *Revoker) SetConnRegistry(reg *ConnExpiryRegistry)

+ type RevokerConfig struct

+ CAMap map[string]string

+ CoreURL string

+ MTLSCertFile string

+ MTLSKeyFile string

+ RetryCount int

+ Timeout time.Duration

+ type RiskMonitor struct

+ func NewRiskMonitor(cfg RiskMonitorConfig) *RiskMonitor

+ func (m *RiskMonitor) RecordViolation(v RiskViolation) bool

+ func (m *RiskMonitor) Rules() []RiskRule

+ func (m *RiskMonitor) SetRules(rules []RiskRule)

+ func (m *RiskMonitor) Violations(agentId string) int

+ type RiskMonitorConfig struct

+ Logger *slog.Logger

+ OnAction func(agentId, action, reason string)

+ Rules []RiskRule

+ type RiskRule struct

+ Action string

+ Name string

+ Reason string

+ Signals []string

+ Threshold int

+ WindowSeconds int

+ type RiskViolation struct

+ AgentId string

+ At int64

+ CapabilityId string

+ Details string

+ Signal string

+ type RoleDef = pki.RoleDef

+ type RotatingFile struct

+ func NewRotatingFile(path string, maxSize int64, maxBak int) (*RotatingFile, error)

+ func (r *RotatingFile) Close() error

+ func (r *RotatingFile) Write(p []byte) (int, error)

+ type SPIFFEID struct

+ Path string

+ TrustDomain string

+ func ExtractSPIFFEID(cert *x509.Certificate) *SPIFFEID

+ func ParseSPIFFEID(id string) (*SPIFFEID, error)

+ func (s *SPIFFEID) Equal(other *SPIFFEID) bool

+ func (s *SPIFFEID) String() string

+ type SealedTree struct

+ BatchNumber int

+ Previous string

+ Root string

+ Size int

+ Timestamp string

+ type SelfVerifyOptions struct

+ RequireExecutable bool

+ Roots *x509.CertPool

+ SigPath string

+ type SessionConstraint struct

+ HardTimeout int

+ MaxConcurrent int

+ MaxRetries int

+ type SignedAuditEntry struct

+ Entry AuditEntry

+ TST string

+ type SnapshotSource struct

+ func NewSnapshotSource(fn func() map[string]float64) *SnapshotSource

+ func (s *SnapshotSource) Name() string

+ func (s *SnapshotSource) Value() (float64, bool)

+ type StopGuard struct

+ func NewStopGuard() *StopGuard

+ func (s *StopGuard) IsStopped() bool

+ func (s *StopGuard) Reset()

+ func (s *StopGuard) Stop() bool

+ func (s *StopGuard) StopChan() <-chan struct{}

+ type StreamMux struct

+ func NewStreamMux(conn net.Conn) *StreamMux

+ func (m *StreamMux) Accept() (*MuxStream, error)

+ func (m *StreamMux) Close() error

+ func (m *StreamMux) Open() (*MuxStream, error)

+ type TCPExtra struct

+ ConstraintRecheckSec int

+ DialTimeoutSec int

+ HealthCheckSec int

+ HealthCheckURL string

+ MaxConnectionDurationSec int

+ RenewalEnabled *bool

+ RenewalWindowSec int

+ RequireDelegation *bool

+ SessionTimeoutSec int

+ func (t *TCPExtra) ConstraintRecheckInterval() time.Duration

+ func (t *TCPExtra) DialTimeout() time.Duration

+ func (t *TCPExtra) HealthCheckInterval() time.Duration

+ func (t *TCPExtra) MaxConnectionDuration() time.Duration

+ func (t *TCPExtra) RenewalEnabledOrDefault() bool

+ func (t *TCPExtra) RenewalWindow() time.Duration

+ func (t *TCPExtra) RequireDelegationEnabled() bool

+ func (t *TCPExtra) SessionTimeout() time.Duration

+ type TLSConfig struct

+ AllowRoles []string

+ AllowedSPIFFEIDs []string

+ AuditFile string

+ AuditMaxBackups int

+ AuditMaxSizeMB int

+ CACertFile string

+ CRLRefreshSec int

+ CRLURL string

+ CapabilityScheme string

+ CertFile string

+ CipherSuites []string

+ DisallowRepresentative *bool

+ DisconnectOnExpiry *bool

+ IdleTimeoutSec int

+ KeyFile string

+ MaxConnsPerCert int

+ MaxConnsPerIP int

+ MaxTotalConns int

+ MinTLSVersion string

+ Mode string

+ OCSPCacheTTLSec int

+ OCSPFallback string

+ RequireAIC *bool

+ RequireSPIFFE *bool

+ RequireUserAuth *bool

+ RequiredCapabilities []string

+ SPIFFETrustDomain string

+ TSACertFile string

+ TSAURL string

+ func (t *TLSConfig) AuditMaxBackupCount() int

+ func (t *TLSConfig) AuditMaxSize() int64

+ func (t *TLSConfig) CRLRefreshDuration() time.Duration

+ func (t *TLSConfig) DisallowRepresentativeEnabled() bool

+ func (t *TLSConfig) DisconnectOnExpiryEnabled() bool

+ func (t *TLSConfig) IdleTimeout() time.Duration

+ func (t *TLSConfig) RequireAICEnabled() bool

+ func (t *TLSConfig) RequireSPIFFEEnabled() bool

+ func (t *TLSConfig) RequireUserAuthEnabled() bool

+ func (t *TLSConfig) ToGoTLSConfig() *tls.Config

+ type TSAClient struct

+ CACert *x509.Certificate

+ HTTPClient *http.Client

+ SignFunc func(data []byte) ([]byte, error)

+ URL string

+ func NewTSAClient(url string) *TSAClient

+ func (t *TSAClient) SetCACert(certFile string) error

+ func (t *TSAClient) SetMaxTSTAge(d time.Duration)

+ func (t *TSAClient) Sign(data []byte) (tstDER []byte, err error)

+ func (t *TSAClient) Verify(entryJSON, tstDER []byte) error

+ type TSAProofEntry struct

+ Batch int

+ Root string

+ TST string

+ Time string

+ type TSAProofLogger struct

+ func NewTSAProofLogger(path string, tsa *TSAClient, chain *AuditChain, intervalSec int) *TSAProofLogger

+ func (l *TSAProofLogger) Close() error

+ func (l *TSAProofLogger) SetAuditChain(chain *AuditChain)

+ func (l *TSAProofLogger) Start(stopCh chan struct{})

+ func (l *TSAProofLogger) Stop()

+ type TSTInfo struct

+ Accuracy asn1.RawValue

+ GenTime time.Time

+ MessageImprint MessageImprint

+ Nonce *int

+ Ordering bool

+ Policy asn1.ObjectIdentifier

+ SerialNumber int

+ TSA asn1.RawValue

+ Version int

+ func UnmarshalTimestampToken(data []byte) (*TSTInfo, error)

+ type TaskRecord struct

+ AgentID string

+ Created int64

+ Note string

+ RevokeAt int64

+ Revoked bool

+ Serial string

+ Status TaskStatus

+ TaskID string

+ type TaskRegistry struct

+ func NewTaskRegistry() *TaskRegistry

+ func (r *TaskRegistry) Complete(taskID string, now int64) *TaskRecord

+ func (r *TaskRegistry) Len() int

+ func (r *TaskRegistry) List() []TaskRecord

+ func (r *TaskRegistry) Lookup(taskID string) *TaskRecord

+ func (r *TaskRegistry) Register(taskID, serial, agentID, note string, now int64) *TaskRecord

+ func (r *TaskRegistry) Unregister(taskID string) *TaskRecord

+ type TaskStatus string

+ const TaskActive

+ const TaskCompleted

+ type TimeStampReq struct

+ CertReq bool

+ Extensions []asn1.RawValue

+ MessageImprint MessageImprint

+ Nonce *int

+ ReqPolicy asn1.ObjectIdentifier

+ Version int

+ type TimeStampResp struct

+ Status PKIStatusInfo

+ TimeStampToken asn1.RawValue

+ type TokenBucket struct

+ func NewTokenBucket(rate float64, burst int64) *TokenBucket

+ func (tb *TokenBucket) Allow(n int) bool

+ func (tb *TokenBucket) SetBurst(burst int64)

+ func (tb *TokenBucket) SetRate(rate float64)

+ func (tb *TokenBucket) WaitN(n int)

+ type Translator interface

+ T func(lang, key string, args ...any) string

+ type TrustLayer int

+ const Layer1Identity

+ const Layer2Representation

+ const Layer3OnlineAuthorization

+ func (l TrustLayer) String() string

+ type UDPExtra struct

+ ConnectionBPS int64

+ ConnectionBurst int64

+ DisconnectOnExpirySec int

+ MaxPktsPerIP int

+ MaxTotalPkts int

+ RequireDelegation *bool

+ func (u *UDPExtra) DisconnectOnExpiryEnabled() bool

+ func (u *UDPExtra) RequireDelegationEnabled() bool

+ type UserPermission = pki.UserPermission

+ type VerifyRequest struct

+ Batch int

+ Leaf string

+ Proof []ProofStepJSON

+ type VerifyResponse struct

+ Error string

+ Valid bool

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL