modulepackage
0.2.13
Repository: https://github.com/hashicorp/nodeenrollment.git
Documentation: pkg.go.dev
# README
Node Enrollment
IMPORTANT
This is a repo for an internal HashiCorp library to facilitate sharing its functionality across HashiCorp projects. It is public so that our community versions can successfully import and build it, however it should not be considered to be a supported library outside of HashiCorp.
# Packages
No description provided by the author
No description provided by the author
Protocol provides a listener and dial function that can be used to easily integrate this library into other applications.
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
# Functions
ContainsKnownAlpnProto performs a simple check to see if one our defined ALPN protos is contained in the given set.
DecryptMessage takes any a value encrypted with EncryptMessage and a valid key source that implements X25519KeyProducer and decrypts the message into the given proto.Message.
EncryptMessage takes any proto.Message and a valid key source that implements X25519KeyProducer.
GetOpts iterates the inbound Options and returns a struct and any errors.
No description provided by the author
KeyIdFromPkix derives the library-specific key ID from the PKIX-encoed public key.
SubjectKeyInfoAndKeyIdFromPubKey returns the PKIX-encoded public key and the library-specific key ID derived from it.
WithActivationToken is used to pass an activation token; typically this will be to pass a server-generated activation token as the nonce for a request.
WithAlpnProtoPrefix is used to convey information about which proto is being used to handle a connection.
WithCertificateLifetime allows overriding a default duration for certificate creation.
WithExpectedPublicKey allows indicating a public key that we expect to be the key signed by a certificate.
WithExtraAlpnProtos is used to allow passing additional ALPN protos in via a ClientHello message, e.g.
WithLogger allows passing in a logger to use for debugging purposes.
WithMaximumActivationTokenLifetime allows overriding a default duration for server-led activation token lifetime.
WithNativeConns, if set to true, indicates to use the native protocol package conn type to return from the split listener listeners.
WithNonce is used at various points for encoding nonces in certs or expecting them there.
WithNotAfterClockSkew allows overriding a default duration for certificate NotAfter clock skew handling.
WithNotBeforeClockSkew allows overriding a default duration for certificate NotBefore clock skew handling.
WithRandomReader allows specifying a reader to use in place of the default (crypto/rand.Reader).
WithRegistrationWrapper can be used when fetching node credentials to provide registration information.
WithReinitializeRoots, if set to true, indicates that the existing roots should be removed entirely before rotation.
WithServerName is used to pass a server name to include in a TLS config.
WithSkipStorage allows indicating that the newly generated resource should not be stored in storage, but simply returned in-memory only, useful for tests or cases where the storage implementation wants to manage storage lifecycle (e.g.
WithState allows passing state in to some registration functions to round trip to NodeInformation storage.
WithStorageWrapper will cause the library to wrap any sensitive information (private keys, nonces, etc.) with the given wrapper prior to writing to storage, and to unwrap when reading from storage.
WithTestErrorContains is used in some tests to pass expected error values.
WithTlsVerifyOptionsFunc allows specifying a custom TLS certificate VerifyFunc, useful for testing.
WithWrappingRegistrationFlowApplicationSpecificParams allows passing extra application specific parameters when using the wrapping registration flow.
# Constants
AuthenticateNodeNextProtoV1Prefix is the ALPN NextProto used when a node is trying to authenticate.
CertificatePreferenceV1Prefix is the ALPN NextProto used by a node to indicate a certificate preference, since we can't use ServerName.
CommonDnsName is a name we can use in the absence of anything more specific.
CurrentId is a const for when we are fetching the "current" value for various purposes.
DefaultCertificateLifetime is the default duration of a certificate, set to two weeks.
The default amount of time for a signed fetch request validity period.
This is the default time that an server-led activation token is alive.
DefaultNotAfterClockSkewDuration is the time to subtract from NotBefore to account for some clock skew.
DefaultNotBeforeClockSkewDuration is the time to subtract from NotBefore to account for some clock skew.
FetchNodeCredsNextProtoV1Prefix is the ALPN NextProto used when a node is trying to fetch credentials.
KeyIdNumWords is the number of words to generate from a hash of the public key to serve as the key ID.
No description provided by the author
NextId is a const for when we are fetching the "next" value for various purposes.
NonceSize is our defined nonce size, in bytes.
The ID that will always be used for storing root certificate messages.
NodeEnrollment Server-Led Activation Token.
# Variables
ErrNotAuthorized is a common error that we can return to indicate that a node is still awaiting authentication after attempting to fetch credentials.
ErrNotFound is a common error to use when a value is not found in storage.
# Interfaces
CleanableStorage is an interface that can optionally be implemented by storage implementations to indicate that there is a cleanup function that can be run when storage usage is complete.
MessageWithId is a proto message that is required to implement a GetId function, which will be immediately satisfied by any message with an `string id = X;` parameter.
MessageWithNodeId is a proto message that is required to implement a GetNodeId function, which will be immediately satisfied by any message with an `string node_id = X;` parameter.
NodeIdLoader is an interface for to store values.
Storage is an interface for to store values.
X25519KeyProducer is an interface that can be satisfied by an underlying type that produces an encryption key via X25519, along with a key identifier used for AAD and embedding in the wrapping data.