mirror of
https://github.com/VictoriaMetrics/VictoriaMetrics.git
synced 2024-11-21 14:44:00 +00:00
vendor: make vendor-update
This commit is contained in:
Aliaksandr Valialkin
parent
0856f225cc
commit
7276d82b1d
271 changed files with 24975 additions and 1941 deletions
46
go.mod
46
go.mod
|
|
@ -9,9 +9,9 @@ require (
|
|||
// Do not use the original github.com/valyala/fasthttp because of issues
|
||||
// like https://github.com/valyala/fasthttp/commit/996610f021ff45fdc98c2ce7884d5fa4e7f9199b
|
||||
github.com/VictoriaMetrics/fasthttp v1.2.0
|
||||
github.com/VictoriaMetrics/metrics v1.23.1
|
||||
github.com/VictoriaMetrics/metricsql v0.56.1
|
||||
github.com/aws/aws-sdk-go v1.44.237
|
||||
github.com/VictoriaMetrics/metrics v1.24.0
|
||||
github.com/VictoriaMetrics/metricsql v0.56.2
|
||||
github.com/aws/aws-sdk-go v1.44.265
|
||||
github.com/cespare/xxhash/v2 v2.2.0
|
||||
|
||||
// TODO: switch back to https://github.com/cheggaaa/pb/v3 when v3-pooling branch
|
||||
|
|
@ -19,27 +19,27 @@ require (
|
|||
// See https://github.com/cheggaaa/pb/pull/192#issuecomment-1121285954 for details.
|
||||
github.com/dmitryk-dk/pb/v3 v3.0.9
|
||||
github.com/golang/snappy v0.0.4
|
||||
github.com/influxdata/influxdb v1.11.0
|
||||
github.com/klauspost/compress v1.16.4
|
||||
github.com/influxdata/influxdb v1.11.1
|
||||
github.com/klauspost/compress v1.16.5
|
||||
github.com/prometheus/prometheus v1.8.2-0.20201119142752-3ad25a6dc3d9
|
||||
github.com/urfave/cli/v2 v2.25.1
|
||||
github.com/urfave/cli/v2 v2.25.3
|
||||
github.com/valyala/fastjson v1.6.4
|
||||
github.com/valyala/fastrand v1.1.0
|
||||
github.com/valyala/fasttemplate v1.2.2
|
||||
github.com/valyala/gozstd v1.19.0
|
||||
github.com/valyala/gozstd v1.20.1
|
||||
github.com/valyala/quicktemplate v1.7.0
|
||||
golang.org/x/net v0.8.0
|
||||
golang.org/x/oauth2 v0.6.0
|
||||
golang.org/x/sys v0.7.0
|
||||
google.golang.org/api v0.116.0
|
||||
golang.org/x/net v0.10.0
|
||||
golang.org/x/oauth2 v0.8.0
|
||||
golang.org/x/sys v0.8.0
|
||||
google.golang.org/api v0.123.0
|
||||
gopkg.in/yaml.v2 v2.4.0
|
||||
)
|
||||
|
||||
require (
|
||||
cloud.google.com/go v0.110.0 // indirect
|
||||
cloud.google.com/go/compute v1.19.0 // indirect
|
||||
cloud.google.com/go v0.110.2 // indirect
|
||||
cloud.google.com/go/compute v1.19.3 // indirect
|
||||
cloud.google.com/go/compute/metadata v0.2.3 // indirect
|
||||
cloud.google.com/go/iam v1.0.0 // indirect
|
||||
cloud.google.com/go/iam v1.0.1 // indirect
|
||||
github.com/VividCortex/ewma v1.2.0 // indirect
|
||||
github.com/beorn7/perks v1.0.1 // indirect
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
|
||||
|
|
@ -50,6 +50,7 @@ require (
|
|||
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
|
||||
github.com/golang/protobuf v1.5.3 // indirect
|
||||
github.com/google/go-cmp v0.5.9 // indirect
|
||||
github.com/google/s2a-go v0.1.3 // indirect
|
||||
github.com/google/uuid v1.3.0 // indirect
|
||||
github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
|
||||
github.com/googleapis/gax-go/v2 v2.8.0 // indirect
|
||||
|
|
@ -60,9 +61,9 @@ require (
|
|||
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
|
||||
github.com/oklog/ulid v1.3.1 // indirect
|
||||
github.com/pkg/errors v0.9.1 // indirect
|
||||
github.com/prometheus/client_golang v1.14.0 // indirect
|
||||
github.com/prometheus/client_model v0.3.0 // indirect
|
||||
github.com/prometheus/common v0.42.0 // indirect
|
||||
github.com/prometheus/client_golang v1.15.1 // indirect
|
||||
github.com/prometheus/client_model v0.4.0 // indirect
|
||||
github.com/prometheus/common v0.43.0 // indirect
|
||||
github.com/prometheus/procfs v0.9.0 // indirect
|
||||
github.com/rivo/uniseg v0.4.4 // indirect
|
||||
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
||||
|
|
@ -70,13 +71,14 @@ require (
|
|||
github.com/valyala/histogram v1.2.0 // indirect
|
||||
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
|
||||
go.opencensus.io v0.24.0 // indirect
|
||||
go.uber.org/atomic v1.10.0 // indirect
|
||||
go.uber.org/atomic v1.11.0 // indirect
|
||||
go.uber.org/goleak v1.1.11-0.20210813005559-691160354723 // indirect
|
||||
golang.org/x/sync v0.1.0 // indirect
|
||||
golang.org/x/text v0.8.0 // indirect
|
||||
golang.org/x/crypto v0.9.0 // indirect
|
||||
golang.org/x/sync v0.2.0 // indirect
|
||||
golang.org/x/text v0.9.0 // indirect
|
||||
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
|
||||
google.golang.org/appengine v1.6.7 // indirect
|
||||
google.golang.org/genproto v0.0.0-20230403163135-c38d8f061ccd // indirect
|
||||
google.golang.org/grpc v1.54.0 // indirect
|
||||
google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
|
||||
google.golang.org/grpc v1.55.0 // indirect
|
||||
google.golang.org/protobuf v1.30.0 // indirect
|
||||
)
|
||||
|
|
|
|||
109
go.sum
109
go.sum
|
|
@ -15,8 +15,8 @@ cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKV
|
|||
cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
|
||||
cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
|
||||
cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
|
||||
cloud.google.com/go v0.110.0 h1:Zc8gqp3+a9/Eyph2KDmcGaPtbKRIoqq4YTlL4NMD0Ys=
|
||||
cloud.google.com/go v0.110.0/go.mod h1:SJnCLqQ0FCFGSZMUNUf84MV3Aia54kn7pi8st7tMzaY=
|
||||
cloud.google.com/go v0.110.2 h1:sdFPBr6xG9/wkBbfhmUz/JmZC7X6LavQgcrVINrKiVA=
|
||||
cloud.google.com/go v0.110.2/go.mod h1:k04UEeEtb6ZBRTv3dZz4CeJC3jKGxyhl0sAiVVquxiw=
|
||||
cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
|
||||
cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
|
||||
cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
|
||||
|
|
@ -24,14 +24,14 @@ cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUM
|
|||
cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
|
||||
cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
|
||||
cloud.google.com/go/bigtable v1.2.0/go.mod h1:JcVAOl45lrTmQfLj7T6TxyMzIN/3FGGcFm+2xVAli2o=
|
||||
cloud.google.com/go/compute v1.19.0 h1:+9zda3WGgW1ZSTlVppLCYFIr48Pa35q1uG2N1itbCEQ=
|
||||
cloud.google.com/go/compute v1.19.0/go.mod h1:rikpw2y+UMidAe9tISo04EHNOIf42RLYF/q8Bs93scU=
|
||||
cloud.google.com/go/compute v1.19.3 h1:DcTwsFgGev/wV5+q8o2fzgcHOaac+DKGC91ZlvpsQds=
|
||||
cloud.google.com/go/compute v1.19.3/go.mod h1:qxvISKp/gYnXkSAD1ppcSOveRAmzxicEv/JlizULFrI=
|
||||
cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
|
||||
cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
|
||||
cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
|
||||
cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
|
||||
cloud.google.com/go/iam v1.0.0 h1:hlQJMovyJJwYjZcTohUH4o1L8Z8kYz+E+W/zktiLCBc=
|
||||
cloud.google.com/go/iam v1.0.0/go.mod h1:ikbQ4f1r91wTmBmmOtBCOtuEOei6taatNXytzB7Cxew=
|
||||
cloud.google.com/go/iam v1.0.1 h1:lyeCAU6jpnVNrE9zGQkTl3WgNgK/X+uWwaw0kynZJMU=
|
||||
cloud.google.com/go/iam v1.0.1/go.mod h1:yR3tmSL8BcZB4bxByRv2jkSIahVmCtfKZwLYGBalRE8=
|
||||
cloud.google.com/go/longrunning v0.4.1 h1:v+yFJOfKC3yZdY6ZUI933pIYdhyhV8S3NpWrXWmg7jM=
|
||||
cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
|
||||
cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
|
||||
|
|
@ -89,10 +89,10 @@ github.com/VictoriaMetrics/fastcache v1.12.1/go.mod h1:tX04vaqcNoQeGLD+ra5pU5sWk
|
|||
github.com/VictoriaMetrics/fasthttp v1.2.0 h1:nd9Wng4DlNtaI27WlYh5mGXCJOmee/2c2blTJwfyU9I=
|
||||
github.com/VictoriaMetrics/fasthttp v1.2.0/go.mod h1:zv5YSmasAoSyv8sBVexfArzFDIGGTN4TfCKAtAw7IfE=
|
||||
github.com/VictoriaMetrics/metrics v1.18.1/go.mod h1:ArjwVz7WpgpegX/JpB0zpNF2h2232kErkEnzH1sxMmA=
|
||||
github.com/VictoriaMetrics/metrics v1.23.1 h1:/j8DzeJBxSpL2qSIdqnRFLvQQhbJyJbbEi22yMm7oL0=
|
||||
github.com/VictoriaMetrics/metrics v1.23.1/go.mod h1:rAr/llLpEnAdTehiNlUxKgnjcOuROSzpw0GvjpEbvFc=
|
||||
github.com/VictoriaMetrics/metricsql v0.56.1 h1:j+W4fA/gtozsZb4PlKDU0Ma2VOgl88xla4FEf29w94g=
|
||||
github.com/VictoriaMetrics/metricsql v0.56.1/go.mod h1:6pP1ZeLVJHqJrHlF6Ij3gmpQIznSsgktEcZgsAWYel0=
|
||||
github.com/VictoriaMetrics/metrics v1.24.0 h1:ILavebReOjYctAGY5QU2F9X0MYvkcrG3aEn2RKa1Zkw=
|
||||
github.com/VictoriaMetrics/metrics v1.24.0/go.mod h1:eFT25kvsTidQFHb6U0oa0rTrDRdz4xTYjpL8+UPohys=
|
||||
github.com/VictoriaMetrics/metricsql v0.56.2 h1:quBAbYOlWMhmdgzFSCr1yjtVcdZYZrVQJ7nR9zor7ZM=
|
||||
github.com/VictoriaMetrics/metricsql v0.56.2/go.mod h1:6pP1ZeLVJHqJrHlF6Ij3gmpQIznSsgktEcZgsAWYel0=
|
||||
github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
|
||||
github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
|
||||
github.com/VividCortex/gohistogram v1.0.0/go.mod h1:Pf5mBqqDxYaXu3hDrrU+w6nw50o/4+TcAqDqk/vUH7g=
|
||||
|
|
@ -128,8 +128,8 @@ github.com/aws/aws-lambda-go v1.13.3/go.mod h1:4UKl9IzQMoD+QF79YdCuzCwp8VbmG4VAQ
|
|||
github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
|
||||
github.com/aws/aws-sdk-go v1.34.28/go.mod h1:H7NKnBqNVzoTJpGfLrQkkD+ytBA93eiDYi/+8rV9s48=
|
||||
github.com/aws/aws-sdk-go v1.35.31/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
|
||||
github.com/aws/aws-sdk-go v1.44.237 h1:gsmVP8eTB6id4tmEsBPcjLlYi1sXtKA047bSn7kJZAI=
|
||||
github.com/aws/aws-sdk-go v1.44.237/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
|
||||
github.com/aws/aws-sdk-go v1.44.265 h1:rlBuD8OYjM5Vfcf7jDa264oVHqlPqY7y7o+JmrjNFUc=
|
||||
github.com/aws/aws-sdk-go v1.44.265/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
|
||||
github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
|
||||
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
|
||||
github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
|
||||
|
|
@ -155,6 +155,11 @@ github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp
|
|||
github.com/clbanning/x2j v0.0.0-20191024224557-825249438eec/go.mod h1:jMjuTZXRI4dUb/I5gc9Hdhagfvm9+RyrPryS/auMzxE=
|
||||
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
|
||||
github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
|
||||
github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
|
||||
github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
|
||||
github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
|
||||
github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
|
||||
github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
|
||||
github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
|
||||
github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
|
||||
github.com/containerd/containerd v1.3.4/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
|
||||
|
|
@ -195,6 +200,8 @@ github.com/envoyproxy/go-control-plane v0.6.9/go.mod h1:SBwIajubJHhxtWwsL9s8ss4s
|
|||
github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
|
||||
github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
|
||||
github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
|
||||
github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
|
||||
github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
|
||||
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
|
||||
github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
|
||||
github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
|
||||
|
|
@ -369,6 +376,7 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
|
|||
github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
|
||||
github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
|
||||
github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
|
||||
github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
|
||||
github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
|
||||
github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
|
||||
github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
|
||||
|
|
@ -408,6 +416,8 @@ github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hf
|
|||
github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
|
||||
github.com/google/pprof v0.0.0-20201117184057-ae444373da19/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
|
||||
github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
|
||||
github.com/google/s2a-go v0.1.3 h1:FAgZmpLl/SXurPEZyCMPBIiiYeTbqfjlbdnCNTAkbGE=
|
||||
github.com/google/s2a-go v0.1.3/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
|
||||
github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
|
|
@ -474,8 +484,8 @@ github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJ
|
|||
github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
|
||||
github.com/influxdata/flux v0.65.1/go.mod h1:J754/zds0vvpfwuq7Gc2wRdVwEodfpCFM7mYlOw2LqY=
|
||||
github.com/influxdata/influxdb v1.8.3/go.mod h1:JugdFhsvvI8gadxOI6noqNeeBHvWNTbfYGtiAn+2jhI=
|
||||
github.com/influxdata/influxdb v1.11.0 h1:0X+ZsbcOWc6AEi5MHee9BYqXCKmz8IZsljrRYjmV8Qg=
|
||||
github.com/influxdata/influxdb v1.11.0/go.mod h1:V93tJcidY0Zh0LtSONZWnXXGDyt20dtVf+Ddp4EnhaA=
|
||||
github.com/influxdata/influxdb v1.11.1 h1:VEkQVMJ83gjpyS2FJuQaSbt4Mu+btGBoZbVq0XwTHGQ=
|
||||
github.com/influxdata/influxdb v1.11.1/go.mod h1:WSTwm8ZvJARODSZJfcxdghcjCQVstHwClgO6MrbnGt0=
|
||||
github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo=
|
||||
github.com/influxdata/influxql v1.1.1-0.20200828144457-65d3ef77d385/go.mod h1:gHp9y86a/pxhjJ+zMjNXiQAA197Xk9wLxaz+fGG+kWk=
|
||||
github.com/influxdata/line-protocol v0.0.0-20180522152040-32c6aa80de5e/go.mod h1:4kt73NQhadE3daL3WhR5EJ/J2ocX0PZzwxQ0gXJ7oFE=
|
||||
|
|
@ -515,8 +525,8 @@ github.com/klauspost/compress v1.4.0/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0
|
|||
github.com/klauspost/compress v1.9.5/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
|
||||
github.com/klauspost/compress v1.13.4/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
|
||||
github.com/klauspost/compress v1.13.5/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
|
||||
github.com/klauspost/compress v1.16.4 h1:91KN02FnsOYhuunwU4ssRe8lc2JosWmizWa91B5v1PU=
|
||||
github.com/klauspost/compress v1.16.4/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
|
||||
github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
|
||||
github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
|
||||
github.com/klauspost/cpuid v0.0.0-20170728055534-ae7887de9fa5/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
|
||||
github.com/klauspost/crc32 v0.0.0-20161016154125-cb6bfca970f6/go.mod h1:+ZoRqAPRLkC4NPOvfYeR5KNOrY6TD+/sAC3HXPZgDYg=
|
||||
github.com/klauspost/pgzip v1.0.2-0.20170402124221-0bf5dcad4ada/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
|
||||
|
|
@ -526,8 +536,8 @@ github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxv
|
|||
github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
|
||||
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
|
||||
github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
|
||||
github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
|
||||
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
|
||||
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
|
||||
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
|
||||
github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
|
||||
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
|
||||
|
|
@ -664,16 +674,16 @@ github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3O
|
|||
github.com/prometheus/client_golang v1.6.0/go.mod h1:ZLOG9ck3JLRdB5MgO8f+lLTe83AXG6ro35rLTxvnIl4=
|
||||
github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
|
||||
github.com/prometheus/client_golang v1.8.0/go.mod h1:O9VU6huf47PktckDQfMTX0Y8tY0/7TSWwj+ITvv0TnM=
|
||||
github.com/prometheus/client_golang v1.14.0 h1:nJdhIvne2eSX/XRAFV9PcvFFRbrjbcTUj0VP62TMhnw=
|
||||
github.com/prometheus/client_golang v1.14.0/go.mod h1:8vpkKitgIVNcqrRBWh1C4TIUQgYNtG/XQE4E/Zae36Y=
|
||||
github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI=
|
||||
github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk=
|
||||
github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
|
||||
github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
|
||||
github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
||||
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
||||
github.com/prometheus/client_model v0.1.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
||||
github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
||||
github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4=
|
||||
github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
|
||||
github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY=
|
||||
github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU=
|
||||
github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
|
||||
github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
|
||||
github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
|
||||
|
|
@ -682,8 +692,8 @@ github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8b
|
|||
github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
|
||||
github.com/prometheus/common v0.14.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
|
||||
github.com/prometheus/common v0.15.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
|
||||
github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
|
||||
github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
|
||||
github.com/prometheus/common v0.43.0 h1:iq+BVjvYLei5f27wiuNiB1DN6DYQkp1c8Bx0Vykh5us=
|
||||
github.com/prometheus/common v0.43.0/go.mod h1:NCvr5cQIh3Y/gy73/RdVtC9r8xxrxwJnB+2lB3BxrFc=
|
||||
github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
|
||||
github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
|
||||
github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
|
||||
|
|
@ -705,6 +715,7 @@ github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6L
|
|||
github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
|
||||
github.com/rogpeppe/go-internal v1.2.2/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
|
||||
github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
|
||||
github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
|
||||
github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
|
||||
github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
|
||||
github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
|
||||
|
|
@ -766,8 +777,8 @@ github.com/uber/jaeger-client-go v2.25.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMW
|
|||
github.com/uber/jaeger-lib v2.4.0+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
|
||||
github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
|
||||
github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
|
||||
github.com/urfave/cli/v2 v2.25.1 h1:zw8dSP7ghX0Gmm8vugrs6q9Ku0wzweqPyshy+syu9Gw=
|
||||
github.com/urfave/cli/v2 v2.25.1/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6fmdJLxc=
|
||||
github.com/urfave/cli/v2 v2.25.3 h1:VJkt6wvEBOoSjPFQvOkv6iWIrsJyCrKGtCtxXWwmGeY=
|
||||
github.com/urfave/cli/v2 v2.25.3/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6fmdJLxc=
|
||||
github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
|
||||
github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
|
||||
github.com/valyala/fasthttp v1.30.0/go.mod h1:2rsYD01CKFrjjsvFxx75KlEUNpWNBY9JWD3K/7o2Cus=
|
||||
|
|
@ -777,8 +788,8 @@ github.com/valyala/fastrand v1.1.0 h1:f+5HkLW4rsgzdNoleUOB69hyT9IlD2ZQh9GyDMfb5G
|
|||
github.com/valyala/fastrand v1.1.0/go.mod h1:HWqCzkrkg6QXT8V2EXWvXCoow7vLwOFN002oeRzjapQ=
|
||||
github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
|
||||
github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
|
||||
github.com/valyala/gozstd v1.19.0 h1:BS0M7sH3dcuyw2SQBrTLprAdGuNxfiH0c4IAM8kX07c=
|
||||
github.com/valyala/gozstd v1.19.0/go.mod h1:y5Ew47GLlP37EkTB+B4s7r6A5rdaeB7ftbl9zoYiIPQ=
|
||||
github.com/valyala/gozstd v1.20.1 h1:xPnnnvjmaDDitMFfDxmQ4vpx0+3CdTg2o3lALvXTU/g=
|
||||
github.com/valyala/gozstd v1.20.1/go.mod h1:y5Ew47GLlP37EkTB+B4s7r6A5rdaeB7ftbl9zoYiIPQ=
|
||||
github.com/valyala/histogram v1.2.0 h1:wyYGAZZt3CpwUiIb9AU/Zbllg1llXyrtApRS815OLoQ=
|
||||
github.com/valyala/histogram v1.2.0/go.mod h1:Hb4kBwb4UxsaNbbbh+RRz8ZR6pdodR57tzWUS3BUzXY=
|
||||
github.com/valyala/quicktemplate v1.7.0 h1:LUPTJmlVcb46OOUY3IeD9DojFpAVbsG+5WFTcjMJzCM=
|
||||
|
|
@ -816,11 +827,12 @@ go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
|
|||
go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
|
||||
go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
|
||||
go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
|
||||
go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
|
||||
go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
|
||||
go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
|
||||
go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
|
||||
go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
|
||||
go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
|
||||
go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
|
||||
go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
|
||||
go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
|
||||
go.uber.org/goleak v1.1.11-0.20210813005559-691160354723 h1:sHOAIxRGBp443oHZIPB+HsUGaksVCXVQENPxwTfQdH4=
|
||||
go.uber.org/goleak v1.1.11-0.20210813005559-691160354723/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
|
||||
|
|
@ -849,6 +861,9 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
|
|||
golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
|
||||
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
||||
golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
|
||||
golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g=
|
||||
golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
|
||||
golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
|
|
@ -929,10 +944,11 @@ golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwY
|
|||
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
|
||||
golang.org/x/net v0.0.0-20210510120150-4163338589ed/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||
golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
|
||||
golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
|
||||
golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
|
||||
golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
|
||||
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
|
||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||
|
|
@ -940,8 +956,8 @@ golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4Iltr
|
|||
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||
golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
|
||||
golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
|
||||
golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw=
|
||||
golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
|
||||
golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8=
|
||||
golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
|
||||
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
|
|
@ -954,8 +970,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
|
|||
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
|
||||
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
|
||||
golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
|
|
@ -1026,8 +1042,8 @@ golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBc
|
|||
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
|
||||
golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
|
||||
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
|
|
@ -1039,9 +1055,10 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
|||
golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||
golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
|
||||
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
|
||||
golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
|
||||
golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
|
||||
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
|
||||
golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
|
|
@ -1143,8 +1160,8 @@ google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
|
|||
google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
|
||||
google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
|
||||
google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
|
||||
google.golang.org/api v0.116.0 h1:09tOPVufPwfm5W4aA8EizGHJ7BcoRDsIareM2a15gO4=
|
||||
google.golang.org/api v0.116.0/go.mod h1:9cD4/t6uvd9naoEJFA+M96d0IuB6BqFuyhpw68+mRGg=
|
||||
google.golang.org/api v0.123.0 h1:yHVU//vA+qkOhm4reEC9LtzHVUCN/IqqNRl1iQ9xE20=
|
||||
google.golang.org/api v0.123.0/go.mod h1:gcitW0lvnyWjSp9nKxAbdHKIZ6vF4aajGueeslZOyms=
|
||||
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
|
||||
google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
|
||||
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
|
||||
|
|
@ -1188,8 +1205,8 @@ google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6D
|
|||
google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||
google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||
google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
|
||||
google.golang.org/genproto v0.0.0-20230403163135-c38d8f061ccd h1:sLpv7bNL1AsX3fdnWh9WVh7ejIzXdOc1RRHGeAmeStU=
|
||||
google.golang.org/genproto v0.0.0-20230403163135-c38d8f061ccd/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
|
||||
google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A=
|
||||
google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
|
||||
google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
|
||||
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
|
||||
google.golang.org/grpc v1.20.0/go.mod h1:chYK+tFQF0nDUGJgXMSgLCQk3phJEuONr2DCgLDdAQM=
|
||||
|
|
@ -1210,8 +1227,10 @@ google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM
|
|||
google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
|
||||
google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
|
||||
google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
|
||||
google.golang.org/grpc v1.54.0 h1:EhTqbhiYeixwWQtAEZAxmV9MGqcjEU2mFx52xCzNyag=
|
||||
google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g=
|
||||
google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
|
||||
google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
|
||||
google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
|
||||
google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
|
||||
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
|
||||
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
|
||||
google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
|
||||
|
|
|
|||
2
vendor/cloud.google.com/go/compute/internal/version.go
generated
vendored
2
vendor/cloud.google.com/go/compute/internal/version.go
generated
vendored
|
|
@ -15,4 +15,4 @@
|
|||
package internal
|
||||
|
||||
// Version is the current tagged release of the library.
|
||||
const Version = "1.19.0"
|
||||
const Version = "1.19.3"
|
||||
|
|
|
|||
7
vendor/cloud.google.com/go/iam/CHANGES.md
generated
vendored
7
vendor/cloud.google.com/go/iam/CHANGES.md
generated
vendored
|
|
@ -1,6 +1,13 @@
|
|||
# Changes
|
||||
|
||||
|
||||
## [1.0.1](https://github.com/googleapis/google-cloud-go/compare/iam/v1.0.0...iam/v1.0.1) (2023-05-08)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **iam:** Update grpc to v1.55.0 ([1147ce0](https://github.com/googleapis/google-cloud-go/commit/1147ce02a990276ca4f8ab7a1ab65c14da4450ef))
|
||||
|
||||
## [1.0.0](https://github.com/googleapis/google-cloud-go/compare/iam/v0.13.0...iam/v1.0.0) (2023-04-04)
|
||||
|
||||
|
||||
|
|
|
|||
22
vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy.pb.go
generated
vendored
22
vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy.pb.go
generated
vendored
|
|
@ -14,7 +14,7 @@
|
|||
|
||||
// Code generated by protoc-gen-go. DO NOT EDIT.
|
||||
// versions:
|
||||
// protoc-gen-go v1.28.1
|
||||
// protoc-gen-go v1.30.0
|
||||
// protoc v3.21.12
|
||||
// source: google/iam/v1/iam_policy.proto
|
||||
|
||||
|
|
@ -342,26 +342,26 @@ var file_google_iam_v1_iam_policy_proto_rawDesc = []byte{
|
|||
0x53, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75,
|
||||
0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d,
|
||||
0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x22, 0x29, 0x82, 0xd3, 0xe4, 0x93,
|
||||
0x02, 0x23, 0x22, 0x1e, 0x2f, 0x76, 0x31, 0x2f, 0x7b, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
|
||||
0x65, 0x3d, 0x2a, 0x2a, 0x7d, 0x3a, 0x73, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69,
|
||||
0x63, 0x79, 0x3a, 0x01, 0x2a, 0x12, 0x74, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50,
|
||||
0x02, 0x23, 0x3a, 0x01, 0x2a, 0x22, 0x1e, 0x2f, 0x76, 0x31, 0x2f, 0x7b, 0x72, 0x65, 0x73, 0x6f,
|
||||
0x75, 0x72, 0x63, 0x65, 0x3d, 0x2a, 0x2a, 0x7d, 0x3a, 0x73, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50,
|
||||
0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x74, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50,
|
||||
0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x22, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69,
|
||||
0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69,
|
||||
0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
|
||||
0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
|
||||
0x22, 0x29, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x23, 0x22, 0x1e, 0x2f, 0x76, 0x31, 0x2f, 0x7b, 0x72,
|
||||
0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x3d, 0x2a, 0x2a, 0x7d, 0x3a, 0x67, 0x65, 0x74, 0x49,
|
||||
0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x01, 0x2a, 0x12, 0x9a, 0x01, 0x0a, 0x12,
|
||||
0x22, 0x29, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x23, 0x3a, 0x01, 0x2a, 0x22, 0x1e, 0x2f, 0x76, 0x31,
|
||||
0x2f, 0x7b, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x3d, 0x2a, 0x2a, 0x7d, 0x3a, 0x67,
|
||||
0x65, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x9a, 0x01, 0x0a, 0x12,
|
||||
0x54, 0x65, 0x73, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f,
|
||||
0x6e, 0x73, 0x12, 0x28, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e,
|
||||
0x76, 0x31, 0x2e, 0x54, 0x65, 0x73, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73,
|
||||
0x73, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x67,
|
||||
0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x65, 0x73,
|
||||
0x74, 0x49, 0x61, 0x6d, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x52,
|
||||
0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2f, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x29, 0x22,
|
||||
0x24, 0x2f, 0x76, 0x31, 0x2f, 0x7b, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x3d, 0x2a,
|
||||
0x2a, 0x7d, 0x3a, 0x74, 0x65, 0x73, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73,
|
||||
0x73, 0x69, 0x6f, 0x6e, 0x73, 0x3a, 0x01, 0x2a, 0x1a, 0x1e, 0xca, 0x41, 0x1b, 0x69, 0x61, 0x6d,
|
||||
0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2f, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x29, 0x3a,
|
||||
0x01, 0x2a, 0x22, 0x24, 0x2f, 0x76, 0x31, 0x2f, 0x7b, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
|
||||
0x65, 0x3d, 0x2a, 0x2a, 0x7d, 0x3a, 0x74, 0x65, 0x73, 0x74, 0x49, 0x61, 0x6d, 0x50, 0x65, 0x72,
|
||||
0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x1e, 0xca, 0x41, 0x1b, 0x69, 0x61, 0x6d,
|
||||
0x2d, 0x6d, 0x65, 0x74, 0x61, 0x2d, 0x61, 0x70, 0x69, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
|
||||
0x61, 0x70, 0x69, 0x73, 0x2e, 0x63, 0x6f, 0x6d, 0x42, 0x7f, 0x0a, 0x11, 0x63, 0x6f, 0x6d, 0x2e,
|
||||
0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x69, 0x61, 0x6d, 0x2e, 0x76, 0x31, 0x42, 0x0e, 0x49,
|
||||
|
|
|
|||
2
vendor/cloud.google.com/go/iam/apiv1/iampb/options.pb.go
generated
vendored
2
vendor/cloud.google.com/go/iam/apiv1/iampb/options.pb.go
generated
vendored
|
|
@ -14,7 +14,7 @@
|
|||
|
||||
// Code generated by protoc-gen-go. DO NOT EDIT.
|
||||
// versions:
|
||||
// protoc-gen-go v1.28.1
|
||||
// protoc-gen-go v1.30.0
|
||||
// protoc v3.21.12
|
||||
// source: google/iam/v1/options.proto
|
||||
|
||||
|
|
|
|||
2
vendor/cloud.google.com/go/iam/apiv1/iampb/policy.pb.go
generated
vendored
2
vendor/cloud.google.com/go/iam/apiv1/iampb/policy.pb.go
generated
vendored
|
|
@ -14,7 +14,7 @@
|
|||
|
||||
// Code generated by protoc-gen-go. DO NOT EDIT.
|
||||
// versions:
|
||||
// protoc-gen-go v1.28.1
|
||||
// protoc-gen-go v1.30.0
|
||||
// protoc v3.21.12
|
||||
// source: google/iam/v1/policy.proto
|
||||
|
||||
|
|
|
|||
578
vendor/cloud.google.com/go/internal/.repo-metadata-full.json
generated
vendored
578
vendor/cloud.google.com/go/internal/.repo-metadata-full.json
generated
vendored
File diff suppressed because it is too large
Load diff
23
vendor/cloud.google.com/go/internal/README.md
generated
vendored
23
vendor/cloud.google.com/go/internal/README.md
generated
vendored
|
|
@ -19,25 +19,26 @@ metadata required. For now, `.repo-metadata-full.json` includes everything.
|
|||
|
||||
## cloudbuild.yaml
|
||||
|
||||
To kick off a build locally run from the repo root:
|
||||
The `cloudbuild.yaml` Cloud Build configuration currently supports:
|
||||
|
||||
* Building a docker container from the `internal/postprocessor/Dockerfile`.
|
||||
|
||||
The build can be run locally in the `google-cloud-go` root directory:
|
||||
|
||||
```bash
|
||||
gcloud builds submit --project=cloud-devrel-kokoro-resources --config=internal/cloudbuild.yaml
|
||||
```
|
||||
|
||||
See the [postprocessor/README](postprocessor/README.md) for instructions
|
||||
regarding updating the post-processor docker container.
|
||||
|
||||
### Updating OwlBot SHA
|
||||
|
||||
You may want to manually update the which version of the post processor will be
|
||||
used -- to do this you need to update the SHA in the OwlBot lock file. Start by
|
||||
running the following commands:
|
||||
You may want to manually update the which version of the post-processor will be
|
||||
used -- to do this you need to update the SHA in the OwlBot lock file.
|
||||
|
||||
```bash
|
||||
docker pull gcr.io/cloud-devrel-public-resources/owlbot-go:latest
|
||||
docker inspect --format='{{index .RepoDigests 0}}' gcr.io/cloud-devrel-public-resources/owlbot-go:latest
|
||||
```
|
||||
|
||||
This will give you a SHA. You can use this value to update the value in
|
||||
`.github/.OwlBot.lock.yaml`.
|
||||
See the [postprocessor/README](postprocessor/README.md) for detailed
|
||||
instructions.
|
||||
|
||||
*Note*: OwlBot will eventually open a pull request to update this value if it
|
||||
discovers a new version of the container.
|
||||
|
|
|
|||
4
vendor/github.com/VictoriaMetrics/metrics/process_metrics_other.go
generated
vendored
4
vendor/github.com/VictoriaMetrics/metrics/process_metrics_other.go
generated
vendored
|
|
@ -1,5 +1,5 @@
|
|||
//go:build !linux
|
||||
// +build !linux
|
||||
//go:build !linux && !windows
|
||||
// +build !linux,!windows
|
||||
|
||||
package metrics
|
||||
|
||||
|
|
|
|||
85
vendor/github.com/VictoriaMetrics/metrics/process_metrics_windows.go
generated
vendored
Normal file
85
vendor/github.com/VictoriaMetrics/metrics/process_metrics_windows.go
generated
vendored
Normal file
|
|
@ -0,0 +1,85 @@
|
|||
//go:build windows
|
||||
// +build windows
|
||||
|
||||
package metrics
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
"syscall"
|
||||
"unsafe"
|
||||
|
||||
"golang.org/x/sys/windows"
|
||||
)
|
||||
|
||||
var (
|
||||
modpsapi = syscall.NewLazyDLL("psapi.dll")
|
||||
modkernel32 = syscall.NewLazyDLL("kernel32.dll")
|
||||
|
||||
// https://learn.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-getprocessmemoryinfo
|
||||
procGetProcessMemoryInfo = modpsapi.NewProc("GetProcessMemoryInfo")
|
||||
procGetProcessHandleCount = modkernel32.NewProc("GetProcessHandleCount")
|
||||
)
|
||||
|
||||
// https://learn.microsoft.com/en-us/windows/win32/api/psapi/ns-psapi-process_memory_counters_ex
|
||||
type processMemoryCounters struct {
|
||||
_ uint32
|
||||
PageFaultCount uint32
|
||||
PeakWorkingSetSize uintptr
|
||||
WorkingSetSize uintptr
|
||||
QuotaPeakPagedPoolUsage uintptr
|
||||
QuotaPagedPoolUsage uintptr
|
||||
QuotaPeakNonPagedPoolUsage uintptr
|
||||
QuotaNonPagedPoolUsage uintptr
|
||||
PagefileUsage uintptr
|
||||
PeakPagefileUsage uintptr
|
||||
PrivateUsage uintptr
|
||||
}
|
||||
|
||||
func writeProcessMetrics(w io.Writer) {
|
||||
h := windows.CurrentProcess()
|
||||
var startTime, exitTime, stime, utime windows.Filetime
|
||||
err := windows.GetProcessTimes(h, &startTime, &exitTime, &stime, &utime)
|
||||
if err != nil {
|
||||
log.Printf("ERROR: metrics: cannot read process times: %s", err)
|
||||
return
|
||||
}
|
||||
var mc processMemoryCounters
|
||||
r1, _, err := procGetProcessMemoryInfo.Call(
|
||||
uintptr(h),
|
||||
uintptr(unsafe.Pointer(&mc)),
|
||||
unsafe.Sizeof(mc),
|
||||
)
|
||||
if r1 != 1 {
|
||||
log.Printf("ERROR: metrics: cannot read process memory information: %s", err)
|
||||
return
|
||||
}
|
||||
stimeSeconds := (uint64(stime.HighDateTime)<<32 + uint64(stime.LowDateTime)) / 1e7
|
||||
utimeSeconds := (uint64(utime.HighDateTime)<<32 + uint64(utime.LowDateTime)) / 1e7
|
||||
fmt.Fprintf(w, "process_cpu_seconds_system_total %d\n", stimeSeconds)
|
||||
fmt.Fprintf(w, "process_cpu_seconds_total %d\n", stimeSeconds+utimeSeconds)
|
||||
fmt.Fprintf(w, "process_cpu_seconds_user_total %d\n", stimeSeconds)
|
||||
fmt.Fprintf(w, "process_pagefaults_total %d\n", mc.PageFaultCount)
|
||||
fmt.Fprintf(w, "process_start_time_seconds %d\n", startTime.Nanoseconds()/1e9)
|
||||
fmt.Fprintf(w, "process_virtual_memory_bytes %d\n", mc.PrivateUsage)
|
||||
fmt.Fprintf(w, "process_resident_memory_peak_bytes %d\n", mc.PeakWorkingSetSize)
|
||||
fmt.Fprintf(w, "process_resident_memory_bytes %d\n", mc.WorkingSetSize)
|
||||
}
|
||||
|
||||
func writeFDMetrics(w io.Writer) {
|
||||
h := windows.CurrentProcess()
|
||||
var count uint32
|
||||
r1, _, err := procGetProcessHandleCount.Call(
|
||||
uintptr(h),
|
||||
uintptr(unsafe.Pointer(&count)),
|
||||
)
|
||||
if r1 != 1 {
|
||||
log.Printf("ERROR: metrics: cannot determine open file descriptors count: %s", err)
|
||||
return
|
||||
}
|
||||
// it seems to be hard-coded limit for 64-bit systems
|
||||
// https://learn.microsoft.com/en-us/archive/blogs/markrussinovich/pushing-the-limits-of-windows-handles#maximum-number-of-handles
|
||||
fmt.Fprintf(w, "process_max_fds %d\n", 16777216)
|
||||
fmt.Fprintf(w, "process_open_fds %d\n", count)
|
||||
}
|
||||
5
vendor/github.com/VictoriaMetrics/metricsql/parser.go
generated
vendored
5
vendor/github.com/VictoriaMetrics/metricsql/parser.go
generated
vendored
|
|
@ -1278,6 +1278,7 @@ func (p *parser) parseWindowAndStep() (*DurationExpr, *DurationExpr, bool, error
|
|||
if err := p.lex.Next(); err != nil {
|
||||
return nil, nil, false, err
|
||||
}
|
||||
|
||||
return window, step, inheritStep, nil
|
||||
}
|
||||
|
||||
|
|
@ -1341,6 +1342,10 @@ func (p *parser) parsePositiveDuration() (*DurationExpr, error) {
|
|||
return nil, fmt.Errorf(`duration: parse error: %s`, err)
|
||||
}
|
||||
}
|
||||
// Verify duration value.
|
||||
if _, err := DurationValue(s, 0); err != nil {
|
||||
return nil, fmt.Errorf(`duration: parse value error: %q: %w`, s, err)
|
||||
}
|
||||
de := &DurationExpr{
|
||||
s: s,
|
||||
}
|
||||
|
|
|
|||
19
vendor/github.com/aws/aws-sdk-go/aws/config.go
generated
vendored
19
vendor/github.com/aws/aws-sdk-go/aws/config.go
generated
vendored
|
|
@ -252,19 +252,8 @@ type Config struct {
|
|||
// and specify a Retryer instead.
|
||||
SleepDelay func(time.Duration)
|
||||
|
||||
// DisableRestProtocolURICleaning will not clean the URL path when making rest protocol requests.
|
||||
// Will default to false. This would only be used for empty directory names in s3 requests.
|
||||
//
|
||||
// Example:
|
||||
// sess := session.Must(session.NewSession(&aws.Config{
|
||||
// DisableRestProtocolURICleaning: aws.Bool(true),
|
||||
// }))
|
||||
//
|
||||
// svc := s3.New(sess)
|
||||
// out, err := svc.GetObject(&s3.GetObjectInput {
|
||||
// Bucket: aws.String("bucketname"),
|
||||
// Key: aws.String("//foo//bar//moo"),
|
||||
// })
|
||||
// Deprecated: This setting no longer has any effect.
|
||||
// RESTful paths are no longer cleaned after request serialization.
|
||||
DisableRestProtocolURICleaning *bool
|
||||
|
||||
// EnableEndpointDiscovery will allow for endpoint discovery on operations that
|
||||
|
|
@ -497,8 +486,8 @@ func (c *Config) WithLowerCaseHeaderMaps(t bool) *Config {
|
|||
return c
|
||||
}
|
||||
|
||||
// WithDisableRestProtocolURICleaning sets a config DisableRestProtocolURICleaning value
|
||||
// returning a Config pointer for chaining.
|
||||
// Deprecated: This setting no longer has any effect.
|
||||
// RESTful paths are no longer cleaned after request serialization.
|
||||
func (c *Config) WithDisableRestProtocolURICleaning(t bool) *Config {
|
||||
c.DisableRestProtocolURICleaning = &t
|
||||
return c
|
||||
|
|
|
|||
1182
vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
generated
vendored
1182
vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
generated
vendored
File diff suppressed because it is too large
Load diff
2
vendor/github.com/aws/aws-sdk-go/aws/version.go
generated
vendored
2
vendor/github.com/aws/aws-sdk-go/aws/version.go
generated
vendored
|
|
@ -5,4 +5,4 @@ package aws
|
|||
const SDKName = "aws-sdk-go"
|
||||
|
||||
// SDKVersion is the version of this SDK
|
||||
const SDKVersion = "1.44.237"
|
||||
const SDKVersion = "1.44.265"
|
||||
|
|
|
|||
17
vendor/github.com/aws/aws-sdk-go/private/protocol/rest/build.go
generated
vendored
17
vendor/github.com/aws/aws-sdk-go/private/protocol/rest/build.go
generated
vendored
|
|
@ -9,7 +9,6 @@ import (
|
|||
"math"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"path"
|
||||
"reflect"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
|
@ -134,9 +133,6 @@ func buildLocationElements(r *request.Request, v reflect.Value, buildGETQuery bo
|
|||
}
|
||||
|
||||
r.HTTPRequest.URL.RawQuery = query.Encode()
|
||||
if !aws.BoolValue(r.Config.DisableRestProtocolURICleaning) {
|
||||
cleanPath(r.HTTPRequest.URL)
|
||||
}
|
||||
}
|
||||
|
||||
func buildBody(r *request.Request, v reflect.Value) {
|
||||
|
|
@ -244,19 +240,6 @@ func buildQueryString(query url.Values, v reflect.Value, name string, tag reflec
|
|||
return nil
|
||||
}
|
||||
|
||||
func cleanPath(u *url.URL) {
|
||||
hasSlash := strings.HasSuffix(u.Path, "/")
|
||||
|
||||
// clean up path, removing duplicate `/`
|
||||
u.Path = path.Clean(u.Path)
|
||||
u.RawPath = path.Clean(u.RawPath)
|
||||
|
||||
if hasSlash && !strings.HasSuffix(u.Path, "/") {
|
||||
u.Path += "/"
|
||||
u.RawPath += "/"
|
||||
}
|
||||
}
|
||||
|
||||
// EscapePath escapes part of a URL path in Amazon style
|
||||
func EscapePath(path string, encodeSep bool) string {
|
||||
var buf bytes.Buffer
|
||||
|
|
|
|||
117
vendor/github.com/aws/aws-sdk-go/private/protocol/restjson/unmarshal_error.go
generated
vendored
117
vendor/github.com/aws/aws-sdk-go/private/protocol/restjson/unmarshal_error.go
generated
vendored
|
|
@ -2,6 +2,7 @@ package restjson
|
|||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"io/ioutil"
|
||||
"net/http"
|
||||
|
|
@ -40,38 +41,22 @@ func (u *UnmarshalTypedError) UnmarshalError(
|
|||
resp *http.Response,
|
||||
respMeta protocol.ResponseMetadata,
|
||||
) (error, error) {
|
||||
|
||||
code := resp.Header.Get(errorTypeHeader)
|
||||
msg := resp.Header.Get(errorMessageHeader)
|
||||
|
||||
body := resp.Body
|
||||
if len(code) == 0 || len(msg) == 0 {
|
||||
// If unable to get code from HTTP headers have to parse JSON message
|
||||
// to determine what kind of exception this will be.
|
||||
var buf bytes.Buffer
|
||||
var jsonErr jsonErrorResponse
|
||||
teeReader := io.TeeReader(resp.Body, &buf)
|
||||
err := jsonutil.UnmarshalJSONError(&jsonErr, teeReader)
|
||||
code, msg, err := unmarshalErrorInfo(resp)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
body = ioutil.NopCloser(&buf)
|
||||
if len(code) == 0 {
|
||||
code = jsonErr.Code
|
||||
}
|
||||
msg = jsonErr.Message
|
||||
fn, ok := u.exceptions[code]
|
||||
if !ok {
|
||||
return awserr.NewRequestFailure(
|
||||
awserr.New(code, msg, nil),
|
||||
respMeta.StatusCode,
|
||||
respMeta.RequestID,
|
||||
), nil
|
||||
}
|
||||
|
||||
// If code has colon separators remove them so can compare against modeled
|
||||
// exception names.
|
||||
code = strings.SplitN(code, ":", 2)[0]
|
||||
|
||||
if fn, ok := u.exceptions[code]; ok {
|
||||
// If exception code is know, use associated constructor to get a value
|
||||
// for the exception that the JSON body can be unmarshaled into.
|
||||
v := fn(respMeta)
|
||||
if err := jsonutil.UnmarshalJSONCaseInsensitive(v, body); err != nil {
|
||||
if err := jsonutil.UnmarshalJSONCaseInsensitive(v, resp.Body); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
|
|
@ -80,14 +65,6 @@ func (u *UnmarshalTypedError) UnmarshalError(
|
|||
}
|
||||
|
||||
return v, nil
|
||||
}
|
||||
|
||||
// fallback to unmodeled generic exceptions
|
||||
return awserr.NewRequestFailure(
|
||||
awserr.New(code, msg, nil),
|
||||
respMeta.StatusCode,
|
||||
respMeta.RequestID,
|
||||
), nil
|
||||
}
|
||||
|
||||
// UnmarshalErrorHandler is a named request handler for unmarshaling restjson
|
||||
|
|
@ -101,36 +78,80 @@ var UnmarshalErrorHandler = request.NamedHandler{
|
|||
func UnmarshalError(r *request.Request) {
|
||||
defer r.HTTPResponse.Body.Close()
|
||||
|
||||
var jsonErr jsonErrorResponse
|
||||
err := jsonutil.UnmarshalJSONError(&jsonErr, r.HTTPResponse.Body)
|
||||
code, msg, err := unmarshalErrorInfo(r.HTTPResponse)
|
||||
if err != nil {
|
||||
r.Error = awserr.NewRequestFailure(
|
||||
awserr.New(request.ErrCodeSerialization,
|
||||
"failed to unmarshal response error", err),
|
||||
awserr.New(request.ErrCodeSerialization, "failed to unmarshal response error", err),
|
||||
r.HTTPResponse.StatusCode,
|
||||
r.RequestID,
|
||||
)
|
||||
return
|
||||
}
|
||||
|
||||
code := r.HTTPResponse.Header.Get(errorTypeHeader)
|
||||
if code == "" {
|
||||
code = jsonErr.Code
|
||||
}
|
||||
msg := r.HTTPResponse.Header.Get(errorMessageHeader)
|
||||
if msg == "" {
|
||||
msg = jsonErr.Message
|
||||
}
|
||||
|
||||
code = strings.SplitN(code, ":", 2)[0]
|
||||
r.Error = awserr.NewRequestFailure(
|
||||
awserr.New(code, jsonErr.Message, nil),
|
||||
awserr.New(code, msg, nil),
|
||||
r.HTTPResponse.StatusCode,
|
||||
r.RequestID,
|
||||
)
|
||||
}
|
||||
|
||||
type jsonErrorResponse struct {
|
||||
Type string `json:"__type"`
|
||||
Code string `json:"code"`
|
||||
Message string `json:"message"`
|
||||
}
|
||||
|
||||
func (j *jsonErrorResponse) SanitizedCode() string {
|
||||
code := j.Code
|
||||
if len(j.Type) > 0 {
|
||||
code = j.Type
|
||||
}
|
||||
return sanitizeCode(code)
|
||||
}
|
||||
|
||||
// Remove superfluous components from a restJson error code.
|
||||
// - If a : character is present, then take only the contents before the
|
||||
// first : character in the value.
|
||||
// - If a # character is present, then take only the contents after the first
|
||||
// # character in the value.
|
||||
//
|
||||
// All of the following error values resolve to FooError:
|
||||
// - FooError
|
||||
// - FooError:http://internal.amazon.com/coral/com.amazon.coral.validate/
|
||||
// - aws.protocoltests.restjson#FooError
|
||||
// - aws.protocoltests.restjson#FooError:http://internal.amazon.com/coral/com.amazon.coral.validate/
|
||||
func sanitizeCode(code string) string {
|
||||
noColon := strings.SplitN(code, ":", 2)[0]
|
||||
hashSplit := strings.SplitN(noColon, "#", 2)
|
||||
return hashSplit[len(hashSplit)-1]
|
||||
}
|
||||
|
||||
// attempt to garner error details from the response, preferring header values
|
||||
// when present
|
||||
func unmarshalErrorInfo(resp *http.Response) (code string, msg string, err error) {
|
||||
code = sanitizeCode(resp.Header.Get(errorTypeHeader))
|
||||
msg = resp.Header.Get(errorMessageHeader)
|
||||
if len(code) > 0 && len(msg) > 0 {
|
||||
return
|
||||
}
|
||||
|
||||
// a modeled error will have to be re-deserialized later, so the body must
|
||||
// be preserved
|
||||
var buf bytes.Buffer
|
||||
tee := io.TeeReader(resp.Body, &buf)
|
||||
defer func() { resp.Body = ioutil.NopCloser(&buf) }()
|
||||
|
||||
var jsonErr jsonErrorResponse
|
||||
if decodeErr := json.NewDecoder(tee).Decode(&jsonErr); decodeErr != nil && decodeErr != io.EOF {
|
||||
err = awserr.NewUnmarshalError(decodeErr, "failed to decode response body", buf.Bytes())
|
||||
return
|
||||
}
|
||||
|
||||
if len(code) == 0 {
|
||||
code = jsonErr.SanitizedCode()
|
||||
}
|
||||
if len(msg) == 0 {
|
||||
msg = jsonErr.Message
|
||||
}
|
||||
return
|
||||
}
|
||||
|
|
|
|||
450
vendor/github.com/aws/aws-sdk-go/service/s3/api.go
generated
vendored
450
vendor/github.com/aws/aws-sdk-go/service/s3/api.go
generated
vendored
|
|
@ -418,18 +418,20 @@ func (c *S3) CopyObjectRequest(input *CopyObjectInput) (req *request.Request, ou
|
|||
// has a default encryption configuration that uses server-side encryption with
|
||||
// an Key Management Service (KMS) key (SSE-KMS), or a customer-provided encryption
|
||||
// key (SSE-C), Amazon S3 uses the corresponding KMS key, or a customer-provided
|
||||
// key to encrypt the target object copy. When you perform a CopyObject operation,
|
||||
// if you want to use a different type of encryption setting for the target
|
||||
// object, you can use other appropriate encryption-related headers to encrypt
|
||||
// the target object with a KMS key, an Amazon S3 managed key, or a customer-provided
|
||||
// key. With server-side encryption, Amazon S3 encrypts your data as it writes
|
||||
// it to disks in its data centers and decrypts the data when you access it.
|
||||
// If the encryption setting in your request is different from the default encryption
|
||||
// configuration of the destination bucket, the encryption setting in your request
|
||||
// takes precedence. If the source object for the copy is stored in Amazon S3
|
||||
// using SSE-C, you must provide the necessary encryption information in your
|
||||
// request so that Amazon S3 can decrypt the object for copying. For more information
|
||||
// about server-side encryption, see Using Server-Side Encryption (https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html).
|
||||
// key to encrypt the target object copy.
|
||||
//
|
||||
// When you perform a CopyObject operation, if you want to use a different type
|
||||
// of encryption setting for the target object, you can use other appropriate
|
||||
// encryption-related headers to encrypt the target object with a KMS key, an
|
||||
// Amazon S3 managed key, or a customer-provided key. With server-side encryption,
|
||||
// Amazon S3 encrypts your data as it writes it to disks in its data centers
|
||||
// and decrypts the data when you access it. If the encryption setting in your
|
||||
// request is different from the default encryption configuration of the destination
|
||||
// bucket, the encryption setting in your request takes precedence. If the source
|
||||
// object for the copy is stored in Amazon S3 using SSE-C, you must provide
|
||||
// the necessary encryption information in your request so that Amazon S3 can
|
||||
// decrypt the object for copying. For more information about server-side encryption,
|
||||
// see Using Server-Side Encryption (https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html).
|
||||
//
|
||||
// If a target object uses SSE-KMS, you can enable an S3 Bucket Key for the
|
||||
// object. For more information, see Amazon S3 Bucket Keys (https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html)
|
||||
|
|
@ -474,6 +476,11 @@ func (c *S3) CopyObjectRequest(input *CopyObjectInput) (req *request.Request, ou
|
|||
// more information, see Storage Classes (https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// If the source object's storage class is GLACIER, you must restore a copy
|
||||
// of this object before you can use it as a source object for the copy operation.
|
||||
// For more information, see RestoreObject (https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html).
|
||||
// For more information, see Copying Objects (https://docs.aws.amazon.com/AmazonS3/latest/dev/CopyingObjectsExamples.html).
|
||||
//
|
||||
// # Versioning
|
||||
//
|
||||
// By default, x-amz-copy-source identifies the current version of an object
|
||||
|
|
@ -489,18 +496,12 @@ func (c *S3) CopyObjectRequest(input *CopyObjectInput) (req *request.Request, ou
|
|||
// If you do not enable versioning or suspend it on the target bucket, the version
|
||||
// ID that Amazon S3 generates is always null.
|
||||
//
|
||||
// If the source object's storage class is GLACIER, you must restore a copy
|
||||
// of this object before you can use it as a source object for the copy operation.
|
||||
// For more information, see RestoreObject (https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html).
|
||||
//
|
||||
// The following operations are related to CopyObject:
|
||||
//
|
||||
// - PutObject (https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html)
|
||||
//
|
||||
// - GetObject (https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html)
|
||||
//
|
||||
// For more information, see Copying Objects (https://docs.aws.amazon.com/AmazonS3/latest/dev/CopyingObjectsExamples.html).
|
||||
//
|
||||
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
|
||||
// with awserr.Error's Code and Message methods to get detailed information about
|
||||
// the error.
|
||||
|
|
@ -663,9 +664,8 @@ func (c *S3) CreateBucketRequest(input *CreateBucketInput) (req *request.Request
|
|||
// request, s3:PutBucketObjectLockConfiguration and s3:PutBucketVersioning
|
||||
// permissions are required.
|
||||
//
|
||||
// - S3 Object Ownership - If your CreateBucket request includes the the
|
||||
// x-amz-object-ownership header, s3:PutBucketOwnershipControls permission
|
||||
// is required.
|
||||
// - S3 Object Ownership - If your CreateBucket request includes the x-amz-object-ownership
|
||||
// header, s3:PutBucketOwnershipControls permission is required.
|
||||
//
|
||||
// The following operations are related to CreateBucket:
|
||||
//
|
||||
|
|
@ -773,7 +773,7 @@ func (c *S3) CreateMultipartUploadRequest(input *CreateMultipartUploadInput) (re
|
|||
// lifecycle configuration. Otherwise, the incomplete multipart upload becomes
|
||||
// eligible for an abort action and Amazon S3 aborts the multipart upload. For
|
||||
// more information, see Aborting Incomplete Multipart Uploads Using a Bucket
|
||||
// Lifecycle Policy (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config).
|
||||
// Lifecycle Configuration (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config).
|
||||
//
|
||||
// For information about the permissions required to use the multipart upload
|
||||
// API, see Multipart Upload and Permissions (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuAndPermissions.html).
|
||||
|
|
@ -812,7 +812,7 @@ func (c *S3) CreateMultipartUploadRequest(input *CreateMultipartUploadInput) (re
|
|||
// provide in UploadPart (https://docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPart.html)
|
||||
// and UploadPartCopy (https://docs.aws.amazon.com/AmazonS3/latest/API/API_UploadPartCopy.html)
|
||||
// requests must match the headers you used in the request to initiate the upload
|
||||
// by using CreateMultipartUpload. you can request that Amazon S3 save the uploaded
|
||||
// by using CreateMultipartUpload. You can request that Amazon S3 save the uploaded
|
||||
// parts encrypted with server-side encryption with an Amazon S3 managed key
|
||||
// (SSE-S3), an Key Management Service (KMS) key (SSE-KMS), or a customer-provided
|
||||
// encryption key (SSE-C).
|
||||
|
|
@ -1009,7 +1009,7 @@ func (c *S3) DeleteBucketRequest(input *DeleteBucketInput) (req *request.Request
|
|||
// Deletes the S3 bucket. All objects (including all object versions and delete
|
||||
// markers) in the bucket must be deleted before the bucket itself can be deleted.
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to DeleteBucket:
|
||||
//
|
||||
// - CreateBucket (https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html)
|
||||
//
|
||||
|
|
@ -1188,7 +1188,7 @@ func (c *S3) DeleteBucketCorsRequest(input *DeleteBucketCorsInput) (req *request
|
|||
// For information about cors, see Enabling Cross-Origin Resource Sharing (https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// Related Resources:
|
||||
// The following operations are related to DeleteBucketCors:
|
||||
//
|
||||
// - PutBucketCors (https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketCors.html)
|
||||
//
|
||||
|
|
@ -1279,7 +1279,7 @@ func (c *S3) DeleteBucketEncryptionRequest(input *DeleteBucketEncryptionInput) (
|
|||
// and Managing Access Permissions to your Amazon S3 Resources (https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-access-control.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to DeleteBucketEncryption:
|
||||
//
|
||||
// - PutBucketEncryption (https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html)
|
||||
//
|
||||
|
|
@ -1833,9 +1833,13 @@ func (c *S3) DeleteBucketPolicyRequest(input *DeleteBucketPolicyInput) (req *req
|
|||
// using an identity that belongs to the bucket owner's account, Amazon S3 returns
|
||||
// a 405 Method Not Allowed error.
|
||||
//
|
||||
// As a security precaution, the root user of the Amazon Web Services account
|
||||
// that owns a bucket can always use this operation, even if the policy explicitly
|
||||
// denies the root user the ability to perform this action.
|
||||
// To ensure that bucket owners don't inadvertently lock themselves out of their
|
||||
// own buckets, the root principal in a bucket owner's Amazon Web Services account
|
||||
// can perform the GetBucketPolicy, PutBucketPolicy, and DeleteBucketPolicy
|
||||
// API actions, even if their bucket policy explicitly denies the root principal's
|
||||
// access. Bucket owner root principals can only be blocked from performing
|
||||
// these API actions by VPC endpoint policies and Amazon Web Services Organizations
|
||||
// policies.
|
||||
//
|
||||
// For more information about bucket policies, see Using Bucket Policies and
|
||||
// UserPolicies (https://docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html).
|
||||
|
|
@ -2603,7 +2607,7 @@ func (c *S3) GetBucketAccelerateConfigurationRequest(input *GetBucketAccelerateC
|
|||
// (https://docs.aws.amazon.com/AmazonS3/latest/dev/transfer-acceleration.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to GetBucketAccelerateConfiguration:
|
||||
//
|
||||
// - PutBucketAccelerateConfiguration (https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAccelerateConfiguration.html)
|
||||
//
|
||||
|
|
@ -2684,8 +2688,14 @@ func (c *S3) GetBucketAclRequest(input *GetBucketAclInput) (req *request.Request
|
|||
// is granted to the anonymous user, you can return the ACL of the bucket without
|
||||
// using an authorization header.
|
||||
//
|
||||
// To use this API against an access point, provide the alias of the access
|
||||
// point in place of the bucket name.
|
||||
// To use this API operation against an access point, provide the alias of the
|
||||
// access point in place of the bucket name.
|
||||
//
|
||||
// To use this API operation against an Object Lambda access point, provide
|
||||
// the alias of the Object Lambda access point in place of the bucket name.
|
||||
// If the Object Lambda access point alias in a request is not valid, the error
|
||||
// code InvalidAccessPointAliasError is returned. For more information about
|
||||
// InvalidAccessPointAliasError, see List of Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList).
|
||||
//
|
||||
// If your bucket uses the bucket owner enforced setting for S3 Object Ownership,
|
||||
// requests to read ACLs are still supported and return the bucket-owner-full-control
|
||||
|
|
@ -2693,7 +2703,7 @@ func (c *S3) GetBucketAclRequest(input *GetBucketAclInput) (req *request.Request
|
|||
// see Controlling object ownership and disabling ACLs (https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to GetBucketAcl:
|
||||
//
|
||||
// - ListObjects (https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjects.html)
|
||||
//
|
||||
|
|
@ -2782,7 +2792,7 @@ func (c *S3) GetBucketAnalyticsConfigurationRequest(input *GetBucketAnalyticsCon
|
|||
// – Storage Class Analysis (https://docs.aws.amazon.com/AmazonS3/latest/dev/analytics-storage-class.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to GetBucketAnalyticsConfiguration:
|
||||
//
|
||||
// - DeleteBucketAnalyticsConfiguration (https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketAnalyticsConfiguration.html)
|
||||
//
|
||||
|
|
@ -2868,8 +2878,14 @@ func (c *S3) GetBucketCorsRequest(input *GetBucketCorsInput) (req *request.Reque
|
|||
// action. By default, the bucket owner has this permission and can grant it
|
||||
// to others.
|
||||
//
|
||||
// To use this API against an access point, provide the alias of the access
|
||||
// point in place of the bucket name.
|
||||
// To use this API operation against an access point, provide the alias of the
|
||||
// access point in place of the bucket name.
|
||||
//
|
||||
// To use this API operation against an Object Lambda access point, provide
|
||||
// the alias of the Object Lambda access point in place of the bucket name.
|
||||
// If the Object Lambda access point alias in a request is not valid, the error
|
||||
// code InvalidAccessPointAliasError is returned. For more information about
|
||||
// InvalidAccessPointAliasError, see List of Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList).
|
||||
//
|
||||
// For more information about CORS, see Enabling Cross-Origin Resource Sharing
|
||||
// (https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html).
|
||||
|
|
@ -3444,14 +3460,18 @@ func (c *S3) GetBucketLocationRequest(input *GetBucketLocationInput) (req *reque
|
|||
// the LocationConstraint request parameter in a CreateBucket request. For more
|
||||
// information, see CreateBucket (https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html).
|
||||
//
|
||||
// To use this implementation of the operation, you must be the bucket owner.
|
||||
// To use this API operation against an access point, provide the alias of the
|
||||
// access point in place of the bucket name.
|
||||
//
|
||||
// To use this API against an access point, provide the alias of the access
|
||||
// point in place of the bucket name.
|
||||
// To use this API operation against an Object Lambda access point, provide
|
||||
// the alias of the Object Lambda access point in place of the bucket name.
|
||||
// If the Object Lambda access point alias in a request is not valid, the error
|
||||
// code InvalidAccessPointAliasError is returned. For more information about
|
||||
// InvalidAccessPointAliasError, see List of Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList).
|
||||
//
|
||||
// For requests made using Amazon Web Services Signature Version 4 (SigV4),
|
||||
// we recommend that you use HeadBucket (https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadBucket.html)
|
||||
// to return the bucket Region instead of GetBucketLocation.
|
||||
// We recommend that you use HeadBucket (https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadBucket.html)
|
||||
// to return the Region that a bucket resides in. For backward compatibility,
|
||||
// Amazon S3 continues to support GetBucketLocation.
|
||||
//
|
||||
// The following operations are related to GetBucketLocation:
|
||||
//
|
||||
|
|
@ -3795,8 +3815,14 @@ func (c *S3) GetBucketNotificationConfigurationRequest(input *GetBucketNotificat
|
|||
// to other users to read this configuration with the s3:GetBucketNotification
|
||||
// permission.
|
||||
//
|
||||
// To use this API against an access point, provide the alias of the access
|
||||
// point in place of the bucket name.
|
||||
// To use this API operation against an access point, provide the alias of the
|
||||
// access point in place of the bucket name.
|
||||
//
|
||||
// To use this API operation against an Object Lambda access point, provide
|
||||
// the alias of the Object Lambda access point in place of the bucket name.
|
||||
// If the Object Lambda access point alias in a request is not valid, the error
|
||||
// code InvalidAccessPointAliasError is returned. For more information about
|
||||
// InvalidAccessPointAliasError, see List of Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList).
|
||||
//
|
||||
// For more information about setting and reading the notification configuration
|
||||
// on a bucket, see Setting Up Notification of Bucket Events (https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html).
|
||||
|
|
@ -3971,12 +3997,22 @@ func (c *S3) GetBucketPolicyRequest(input *GetBucketPolicyInput) (req *request.R
|
|||
// identity that belongs to the bucket owner's account, Amazon S3 returns a
|
||||
// 405 Method Not Allowed error.
|
||||
//
|
||||
// As a security precaution, the root user of the Amazon Web Services account
|
||||
// that owns a bucket can always use this operation, even if the policy explicitly
|
||||
// denies the root user the ability to perform this action.
|
||||
// To ensure that bucket owners don't inadvertently lock themselves out of their
|
||||
// own buckets, the root principal in a bucket owner's Amazon Web Services account
|
||||
// can perform the GetBucketPolicy, PutBucketPolicy, and DeleteBucketPolicy
|
||||
// API actions, even if their bucket policy explicitly denies the root principal's
|
||||
// access. Bucket owner root principals can only be blocked from performing
|
||||
// these API actions by VPC endpoint policies and Amazon Web Services Organizations
|
||||
// policies.
|
||||
//
|
||||
// To use this API against an access point, provide the alias of the access
|
||||
// point in place of the bucket name.
|
||||
// To use this API operation against an access point, provide the alias of the
|
||||
// access point in place of the bucket name.
|
||||
//
|
||||
// To use this API operation against an Object Lambda access point, provide
|
||||
// the alias of the Object Lambda access point in place of the bucket name.
|
||||
// If the Object Lambda access point alias in a request is not valid, the error
|
||||
// code InvalidAccessPointAliasError is returned. For more information about
|
||||
// InvalidAccessPointAliasError, see List of Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList).
|
||||
//
|
||||
// For more information about bucket policies, see Using Bucket Policies and
|
||||
// User Policies (https://docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html).
|
||||
|
|
@ -4506,7 +4542,7 @@ func (c *S3) GetBucketWebsiteRequest(input *GetBucketWebsiteInput) (req *request
|
|||
// bucket owners can allow other users to read the website configuration by
|
||||
// writing a bucket policy granting them the S3:GetBucketWebsite permission.
|
||||
//
|
||||
// The following operations are related to DeleteBucketWebsite:
|
||||
// The following operations are related to GetBucketWebsite:
|
||||
//
|
||||
// - DeleteBucketWebsite (https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketWebsite.html)
|
||||
//
|
||||
|
|
@ -4696,7 +4732,7 @@ func (c *S3) GetObjectRequest(input *GetObjectInput) (req *request.Request, outp
|
|||
//
|
||||
// - response-content-encoding
|
||||
//
|
||||
// # Additional Considerations about Request Headers
|
||||
// # Overriding Response Header Values
|
||||
//
|
||||
// If both of the If-Match and If-Unmodified-Since headers are present in the
|
||||
// request as follows: If-Match condition evaluates to true, and; If-Unmodified-Since
|
||||
|
|
@ -4802,8 +4838,6 @@ func (c *S3) GetObjectAclRequest(input *GetObjectAclInput) (req *request.Request
|
|||
//
|
||||
// This action is not supported by Amazon S3 on Outposts.
|
||||
//
|
||||
// # Versioning
|
||||
//
|
||||
// By default, GET returns ACL information about the current version of an object.
|
||||
// To return ACL information about a different version, use the versionId subresource.
|
||||
//
|
||||
|
|
@ -5590,12 +5624,18 @@ func (c *S3) HeadBucketRequest(input *HeadBucketInput) (req *request.Request, ou
|
|||
// Related to Bucket Subresource Operations (https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-actions.html#using-with-s3-actions-related-to-bucket-subresources)
|
||||
// and Managing Access Permissions to Your Amazon S3 Resources (https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-access-control.html).
|
||||
//
|
||||
// To use this API against an access point, you must provide the alias of the
|
||||
// access point in place of the bucket name or specify the access point ARN.
|
||||
// When using the access point ARN, you must direct requests to the access point
|
||||
// hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.Region.amazonaws.com.
|
||||
// To use this API operation against an access point, you must provide the alias
|
||||
// of the access point in place of the bucket name or specify the access point
|
||||
// ARN. When using the access point ARN, you must direct requests to the access
|
||||
// point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.Region.amazonaws.com.
|
||||
// When using the Amazon Web Services SDKs, you provide the ARN in place of
|
||||
// the bucket name. For more information see, Using access points (https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-access-points.html).
|
||||
// the bucket name. For more information, see Using access points (https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-access-points.html).
|
||||
//
|
||||
// To use this API operation against an Object Lambda access point, provide
|
||||
// the alias of the Object Lambda access point in place of the bucket name.
|
||||
// If the Object Lambda access point alias in a request is not valid, the error
|
||||
// code InvalidAccessPointAliasError is returned. For more information about
|
||||
// InvalidAccessPointAliasError, see List of Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList).
|
||||
//
|
||||
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
|
||||
// with awserr.Error's Code and Message methods to get detailed information about
|
||||
|
|
@ -5725,7 +5765,8 @@ func (c *S3) HeadObjectRequest(input *HeadObjectInput) (req *request.Request, ou
|
|||
// # Permissions
|
||||
//
|
||||
// You need the relevant read object (or version) permission for this operation.
|
||||
// For more information, see Specifying Permissions in a Policy (https://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html).
|
||||
// For more information, see Actions, resources, and condition keys for Amazon
|
||||
// S3 (https://docs.aws.amazon.com/AmazonS3/latest/dev/list_amazons3.html).
|
||||
// If the object you request does not exist, the error Amazon S3 returns depends
|
||||
// on whether you also have the s3:ListBucket permission.
|
||||
//
|
||||
|
|
@ -7225,7 +7266,7 @@ func (c *S3) PutBucketAclRequest(input *PutBucketAclInput) (req *request.Request
|
|||
// object ownership (https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// # Access Permissions
|
||||
// # Permissions
|
||||
//
|
||||
// You can set access permissions using one of the following methods:
|
||||
//
|
||||
|
|
@ -7287,7 +7328,7 @@ func (c *S3) PutBucketAclRequest(input *PutBucketAclInput) (req *request.Request
|
|||
// Regions and endpoints, see Regions and Endpoints (https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region)
|
||||
// in the Amazon Web Services General Reference.
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to PutBucketAcl:
|
||||
//
|
||||
// - CreateBucket (https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html)
|
||||
//
|
||||
|
|
@ -7392,7 +7433,7 @@ func (c *S3) PutBucketAnalyticsConfigurationRequest(input *PutBucketAnalyticsCon
|
|||
// see Permissions Related to Bucket Subresource Operations (https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-actions.html#using-with-s3-actions-related-to-bucket-subresources)
|
||||
// and Managing Access Permissions to Your Amazon S3 Resources (https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-access-control.html).
|
||||
//
|
||||
// Special Errors
|
||||
// PutBucketAnalyticsConfiguration has the following special errors:
|
||||
//
|
||||
// - HTTP Error: HTTP 400 Bad Request Code: InvalidArgument Cause: Invalid
|
||||
// argument.
|
||||
|
|
@ -7405,7 +7446,7 @@ func (c *S3) PutBucketAnalyticsConfigurationRequest(input *PutBucketAnalyticsCon
|
|||
// the owner of the specified bucket, or you do not have the s3:PutAnalyticsConfiguration
|
||||
// bucket permission to set the configuration on the bucket.
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to PutBucketAnalyticsConfiguration:
|
||||
//
|
||||
// - GetBucketAnalyticsConfiguration (https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAnalyticsConfiguration.html)
|
||||
//
|
||||
|
|
@ -7525,7 +7566,7 @@ func (c *S3) PutBucketCorsRequest(input *PutBucketCorsInput) (req *request.Reque
|
|||
// (https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html) in the Amazon
|
||||
// S3 User Guide.
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to PutBucketCors:
|
||||
//
|
||||
// - GetBucketCors (https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketCors.html)
|
||||
//
|
||||
|
|
@ -7633,7 +7674,7 @@ func (c *S3) PutBucketEncryptionRequest(input *PutBucketEncryptionInput) (req *r
|
|||
// and Managing Access Permissions to Your Amazon S3 Resources (https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-access-control.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to PutBucketEncryption:
|
||||
//
|
||||
// - GetBucketEncryption (https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketEncryption.html)
|
||||
//
|
||||
|
|
@ -7743,17 +7784,26 @@ func (c *S3) PutBucketIntelligentTieringConfigurationRequest(input *PutBucketInt
|
|||
// move objects stored in the S3 Intelligent-Tiering storage class to the Archive
|
||||
// Access or Deep Archive Access tier.
|
||||
//
|
||||
// Special Errors
|
||||
// PutBucketIntelligentTieringConfiguration has the following special errors:
|
||||
//
|
||||
// - HTTP 400 Bad Request Error Code: InvalidArgument Cause: Invalid Argument
|
||||
// # HTTP 400 Bad Request Error
|
||||
//
|
||||
// - HTTP 400 Bad Request Error Code: TooManyConfigurations Cause: You are
|
||||
// attempting to create a new configuration but have already reached the
|
||||
// 1,000-configuration limit.
|
||||
// Code: InvalidArgument
|
||||
//
|
||||
// - HTTP 403 Forbidden Error Code: AccessDenied Cause: You are not the owner
|
||||
// of the specified bucket, or you do not have the s3:PutIntelligentTieringConfiguration
|
||||
// bucket permission to set the configuration on the bucket.
|
||||
// Cause: Invalid Argument
|
||||
//
|
||||
// # HTTP 400 Bad Request Error
|
||||
//
|
||||
// Code: TooManyConfigurations
|
||||
//
|
||||
// Cause: You are attempting to create a new configuration but have already
|
||||
// reached the 1,000-configuration limit.
|
||||
//
|
||||
// # HTTP 403 Forbidden Error
|
||||
//
|
||||
// Cause: You are not the owner of the specified bucket, or you do not have
|
||||
// the s3:PutIntelligentTieringConfiguration bucket permission to set the configuration
|
||||
// on the bucket.
|
||||
//
|
||||
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
|
||||
// with awserr.Error's Code and Message methods to get detailed information about
|
||||
|
|
@ -7871,19 +7921,28 @@ func (c *S3) PutBucketInventoryConfigurationRequest(input *PutBucketInventoryCon
|
|||
// and Identity and access management in Amazon S3 (https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-access-control.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// Special Errors
|
||||
// PutBucketInventoryConfiguration has the following special errors:
|
||||
//
|
||||
// - HTTP 400 Bad Request Error Code: InvalidArgument Cause: Invalid Argument
|
||||
// # HTTP 400 Bad Request Error
|
||||
//
|
||||
// - HTTP 400 Bad Request Error Code: TooManyConfigurations Cause: You are
|
||||
// attempting to create a new configuration but have already reached the
|
||||
// 1,000-configuration limit.
|
||||
// Code: InvalidArgument
|
||||
//
|
||||
// - HTTP 403 Forbidden Error Code: AccessDenied Cause: You are not the owner
|
||||
// of the specified bucket, or you do not have the s3:PutInventoryConfiguration
|
||||
// bucket permission to set the configuration on the bucket.
|
||||
// Cause: Invalid Argument
|
||||
//
|
||||
// Related Resources
|
||||
// # HTTP 400 Bad Request Error
|
||||
//
|
||||
// Code: TooManyConfigurations
|
||||
//
|
||||
// Cause: You are attempting to create a new configuration but have already
|
||||
// reached the 1,000-configuration limit.
|
||||
//
|
||||
// # HTTP 403 Forbidden Error
|
||||
//
|
||||
// Cause: You are not the owner of the specified bucket, or you do not have
|
||||
// the s3:PutInventoryConfiguration bucket permission to set the configuration
|
||||
// on the bucket.
|
||||
//
|
||||
// The following operations are related to PutBucketInventoryConfiguration:
|
||||
//
|
||||
// - GetBucketInventoryConfiguration (https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketInventoryConfiguration.html)
|
||||
//
|
||||
|
|
@ -8006,7 +8065,7 @@ func (c *S3) PutBucketLifecycleRequest(input *PutBucketLifecycleInput) (req *req
|
|||
// For more examples of transitioning objects to storage classes such as STANDARD_IA
|
||||
// or ONEZONE_IA, see Examples of Lifecycle Configuration (https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-lifecycle-rules.html#lifecycle-configuration-examples).
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to PutBucketLifecycle:
|
||||
//
|
||||
// - GetBucketLifecycle (https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLifecycle.html)(Deprecated)
|
||||
//
|
||||
|
|
@ -8160,7 +8219,7 @@ func (c *S3) PutBucketLifecycleConfigurationRequest(input *PutBucketLifecycleCon
|
|||
// For more information about permissions, see Managing Access Permissions to
|
||||
// Your Amazon S3 Resources (https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-access-control.html).
|
||||
//
|
||||
// The following are related to PutBucketLifecycleConfiguration:
|
||||
// The following operations are related to PutBucketLifecycleConfiguration:
|
||||
//
|
||||
// - Examples of Lifecycle Configuration (https://docs.aws.amazon.com/AmazonS3/latest/dev/lifecycle-configuration-examples.html)
|
||||
//
|
||||
|
|
@ -8603,8 +8662,6 @@ func (c *S3) PutBucketNotificationConfigurationRequest(input *PutBucketNotificat
|
|||
// messages to your SNS topic. If the message fails, the entire PUT action will
|
||||
// fail, and Amazon S3 will not add the configuration to your bucket.
|
||||
//
|
||||
// # Responses
|
||||
//
|
||||
// If the configuration in the request body includes only one TopicConfiguration
|
||||
// specifying only the s3:ReducedRedundancyLostObject event type, the response
|
||||
// will also include the x-amz-sns-test-message-id header containing the message
|
||||
|
|
@ -8791,9 +8848,13 @@ func (c *S3) PutBucketPolicyRequest(input *PutBucketPolicyInput) (req *request.R
|
|||
// identity that belongs to the bucket owner's account, Amazon S3 returns a
|
||||
// 405 Method Not Allowed error.
|
||||
//
|
||||
// As a security precaution, the root user of the Amazon Web Services account
|
||||
// that owns a bucket can always use this operation, even if the policy explicitly
|
||||
// denies the root user the ability to perform this action.
|
||||
// To ensure that bucket owners don't inadvertently lock themselves out of their
|
||||
// own buckets, the root principal in a bucket owner's Amazon Web Services account
|
||||
// can perform the GetBucketPolicy, PutBucketPolicy, and DeleteBucketPolicy
|
||||
// API actions, even if their bucket policy explicitly denies the root principal's
|
||||
// access. Bucket owner root principals can only be blocked from performing
|
||||
// these API actions by VPC endpoint policies and Amazon Web Services Organizations
|
||||
// policies.
|
||||
//
|
||||
// For more information, see Bucket policy examples (https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html).
|
||||
//
|
||||
|
|
@ -9243,15 +9304,15 @@ func (c *S3) PutBucketVersioningRequest(input *PutBucketVersioningInput) (req *r
|
|||
// you must include the x-amz-mfa request header and the Status and the MfaDelete
|
||||
// request elements in a request to set the versioning state of the bucket.
|
||||
//
|
||||
// If you have an object expiration lifecycle policy in your non-versioned bucket
|
||||
// and you want to maintain the same permanent delete behavior when you enable
|
||||
// versioning, you must add a noncurrent expiration policy. The noncurrent expiration
|
||||
// lifecycle policy will manage the deletes of the noncurrent object versions
|
||||
// in the version-enabled bucket. (A version-enabled bucket maintains one current
|
||||
// and zero or more noncurrent object versions.) For more information, see Lifecycle
|
||||
// and Versioning (https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html#lifecycle-and-other-bucket-config).
|
||||
// If you have an object expiration lifecycle configuration in your non-versioned
|
||||
// bucket and you want to maintain the same permanent delete behavior when you
|
||||
// enable versioning, you must add a noncurrent expiration policy. The noncurrent
|
||||
// expiration lifecycle configuration will manage the deletes of the noncurrent
|
||||
// object versions in the version-enabled bucket. (A version-enabled bucket
|
||||
// maintains one current and zero or more noncurrent object versions.) For more
|
||||
// information, see Lifecycle and Versioning (https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html#lifecycle-and-other-bucket-config).
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to PutBucketVersioning:
|
||||
//
|
||||
// - CreateBucket (https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html)
|
||||
//
|
||||
|
|
@ -9551,7 +9612,7 @@ func (c *S3) PutObjectRequest(input *PutObjectInput) (req *request.Request, outp
|
|||
// in the response. When you enable versioning for a bucket, if Amazon S3 receives
|
||||
// multiple write requests for the same object simultaneously, it stores all
|
||||
// of the objects. For more information about versioning, see Adding Objects
|
||||
// to Versioning Enabled Buckets (https://docs.aws.amazon.com/AmazonS3/latest/dev/AddingObjectstoVersioningEnabledBuckets.html).
|
||||
// to Versioning-Enabled Buckets (https://docs.aws.amazon.com/AmazonS3/latest/dev/AddingObjectstoVersioningEnabledBuckets.html).
|
||||
// For information about returning the versioning state of a bucket, see GetBucketVersioning
|
||||
// (https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketVersioning.html).
|
||||
//
|
||||
|
|
@ -9659,7 +9720,7 @@ func (c *S3) PutObjectAclRequest(input *PutObjectAclInput) (req *request.Request
|
|||
// object ownership (https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// # Access Permissions
|
||||
// # Permissions
|
||||
//
|
||||
// You can set access permissions using one of the following methods:
|
||||
//
|
||||
|
|
@ -9725,7 +9786,7 @@ func (c *S3) PutObjectAclRequest(input *PutObjectAclInput) (req *request.Request
|
|||
// sets the ACL of the current version of an object. To set the ACL of a different
|
||||
// version, use the versionId subresource.
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to PutObjectAcl:
|
||||
//
|
||||
// - CopyObject (https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html)
|
||||
//
|
||||
|
|
@ -10083,7 +10144,7 @@ func (c *S3) PutObjectTaggingRequest(input *PutObjectTaggingInput) (req *request
|
|||
// For information about the Amazon S3 object tagging feature, see Object Tagging
|
||||
// (https://docs.aws.amazon.com/AmazonS3/latest/dev/object-tagging.html).
|
||||
//
|
||||
// Special Errors
|
||||
// PutObjectTagging has the following special errors:
|
||||
//
|
||||
// - Code: InvalidTagError Cause: The tag provided was not a valid tag. This
|
||||
// error can occur if the tag did not pass input validation. For more information,
|
||||
|
|
@ -10097,7 +10158,7 @@ func (c *S3) PutObjectTaggingRequest(input *PutObjectTaggingInput) (req *request
|
|||
// - Code: InternalError Cause: The service was unable to apply the provided
|
||||
// tag to the object.
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to PutObjectTagging:
|
||||
//
|
||||
// - GetObjectTagging (https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTagging.html)
|
||||
//
|
||||
|
|
@ -10194,7 +10255,7 @@ func (c *S3) PutPublicAccessBlockRequest(input *PutPublicAccessBlockInput) (req
|
|||
// For more information about when Amazon S3 considers a bucket or an object
|
||||
// public, see The Meaning of "Public" (https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html#access-control-block-public-access-policy-status).
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to PutPublicAccessBlock:
|
||||
//
|
||||
// - GetPublicAccessBlock (https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetPublicAccessBlock.html)
|
||||
//
|
||||
|
|
@ -10285,29 +10346,29 @@ func (c *S3) RestoreObjectRequest(input *RestoreObjectInput) (req *request.Reque
|
|||
//
|
||||
// - restore an archive - Restore an archived object
|
||||
//
|
||||
// To use this operation, you must have permissions to perform the s3:RestoreObject
|
||||
// action. The bucket owner has this permission by default and can grant this
|
||||
// permission to others. For more information about permissions, see Permissions
|
||||
// Related to Bucket Subresource Operations (https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-actions.html#using-with-s3-actions-related-to-bucket-subresources)
|
||||
// and Managing Access Permissions to Your Amazon S3 Resources (https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-access-control.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// For more information about the S3 structure in the request body, see the
|
||||
// following:
|
||||
//
|
||||
// - PutObject (https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html)
|
||||
// Managing Access with ACLs (https://docs.aws.amazon.com/AmazonS3/latest/dev/S3_ACLs_UsingACLs.html)
|
||||
// in the Amazon S3 User Guide Protecting Data Using Server-Side Encryption
|
||||
// (https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html)
|
||||
//
|
||||
// - Managing Access with ACLs (https://docs.aws.amazon.com/AmazonS3/latest/dev/S3_ACLs_UsingACLs.html)
|
||||
// in the Amazon S3 User Guide
|
||||
//
|
||||
// - Define the SQL expression for the SELECT type of restoration for your
|
||||
// query in the request body's SelectParameters structure. You can use expressions
|
||||
// like the following examples. The following expression returns all records
|
||||
// from the specified object. SELECT * FROM Object Assuming that you are
|
||||
// not using any headers for data stored in the object, you can specify columns
|
||||
// with positional headers. SELECT s._1, s._2 FROM Object s WHERE s._3 >
|
||||
// 100 If you have headers and you set the fileHeaderInfo in the CSV structure
|
||||
// - Protecting Data Using Server-Side Encryption (https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html)
|
||||
// in the Amazon S3 User Guide
|
||||
//
|
||||
// Define the SQL expression for the SELECT type of restoration for your query
|
||||
// in the request body's SelectParameters structure. You can use expressions
|
||||
// like the following examples.
|
||||
//
|
||||
// - The following expression returns all records from the specified object.
|
||||
// SELECT * FROM Object
|
||||
//
|
||||
// - Assuming that you are not using any headers for data stored in the object,
|
||||
// you can specify columns with positional headers. SELECT s._1, s._2 FROM
|
||||
// Object s WHERE s._3 > 100
|
||||
//
|
||||
// - If you have headers and you set the fileHeaderInfo in the CSV structure
|
||||
// in the request body to USE, you can specify headers in the query. (If
|
||||
// you set the fileHeaderInfo field to IGNORE, the first row is skipped for
|
||||
// the query.) You cannot mix ordinal positions with header column names.
|
||||
|
|
@ -10326,7 +10387,7 @@ func (c *S3) RestoreObjectRequest(input *RestoreObjectInput) (req *request.Reque
|
|||
//
|
||||
// - The output results are new Amazon S3 objects. Unlike archive retrievals,
|
||||
// they are stored until explicitly deleted-manually or through a lifecycle
|
||||
// policy.
|
||||
// configuration.
|
||||
//
|
||||
// - You can issue more than one select request on the same Amazon S3 object.
|
||||
// Amazon S3 doesn't duplicate requests, so avoid issuing duplicate requests.
|
||||
|
|
@ -10334,6 +10395,15 @@ func (c *S3) RestoreObjectRequest(input *RestoreObjectInput) (req *request.Reque
|
|||
// - Amazon S3 accepts a select request even if the object has already been
|
||||
// restored. A select request doesn’t return error response 409.
|
||||
//
|
||||
// # Permissions
|
||||
//
|
||||
// To use this operation, you must have permissions to perform the s3:RestoreObject
|
||||
// action. The bucket owner has this permission by default and can grant this
|
||||
// permission to others. For more information about permissions, see Permissions
|
||||
// Related to Bucket Subresource Operations (https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-actions.html#using-with-s3-actions-related-to-bucket-subresources)
|
||||
// and Managing Access Permissions to Your Amazon S3 Resources (https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-access-control.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// # Restoring objects
|
||||
//
|
||||
// Objects that you archive to the S3 Glacier Flexible Retrieval or S3 Glacier
|
||||
|
|
@ -10357,14 +10427,13 @@ func (c *S3) RestoreObjectRequest(input *RestoreObjectInput) (req *request.Reque
|
|||
//
|
||||
// - Expedited - Expedited retrievals allow you to quickly access your data
|
||||
// stored in the S3 Glacier Flexible Retrieval storage class or S3 Intelligent-Tiering
|
||||
// Archive tier when occasional urgent requests for a subset of archives
|
||||
// are required. For all but the largest archived objects (250 MB+), data
|
||||
// accessed using Expedited retrievals is typically made available within
|
||||
// 1–5 minutes. Provisioned capacity ensures that retrieval capacity for
|
||||
// Expedited retrievals is available when you need it. Expedited retrievals
|
||||
// and provisioned capacity are not available for objects stored in the S3
|
||||
// Glacier Deep Archive storage class or S3 Intelligent-Tiering Deep Archive
|
||||
// tier.
|
||||
// Archive tier when occasional urgent requests for restoring archives are
|
||||
// required. For all but the largest archived objects (250 MB+), data accessed
|
||||
// using Expedited retrievals is typically made available within 1–5 minutes.
|
||||
// Provisioned capacity ensures that retrieval capacity for Expedited retrievals
|
||||
// is available when you need it. Expedited retrievals and provisioned capacity
|
||||
// are not available for objects stored in the S3 Glacier Deep Archive storage
|
||||
// class or S3 Intelligent-Tiering Deep Archive tier.
|
||||
//
|
||||
// - Standard - Standard retrievals allow you to access any of your archived
|
||||
// objects within several hours. This is the default option for retrieval
|
||||
|
|
@ -10426,11 +10495,9 @@ func (c *S3) RestoreObjectRequest(input *RestoreObjectInput) (req *request.Reque
|
|||
// - If the object is previously restored, Amazon S3 returns 200 OK in the
|
||||
// response.
|
||||
//
|
||||
// Special Errors
|
||||
//
|
||||
// - Code: RestoreAlreadyInProgress Cause: Object restore is already in progress.
|
||||
// (This error does not apply to SELECT type requests.) HTTP Status Code:
|
||||
// 409 Conflict SOAP Fault Code Prefix: Client
|
||||
// - Special errors: Code: RestoreAlreadyInProgress Cause: Object restore
|
||||
// is already in progress. (This error does not apply to SELECT type requests.)
|
||||
// HTTP Status Code: 409 Conflict SOAP Fault Code Prefix: Client
|
||||
//
|
||||
// - Code: GlacierExpeditedRetrievalNotAvailable Cause: expedited retrievals
|
||||
// are currently not available. Try again later. (Returned if there is insufficient
|
||||
|
|
@ -10438,7 +10505,7 @@ func (c *S3) RestoreObjectRequest(input *RestoreObjectInput) (req *request.Reque
|
|||
// Expedited retrievals and not to S3 Standard or Bulk retrievals.) HTTP
|
||||
// Status Code: 503 SOAP Fault Code Prefix: N/A
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to RestoreObject:
|
||||
//
|
||||
// - PutBucketLifecycleConfiguration (https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLifecycleConfiguration.html)
|
||||
//
|
||||
|
|
@ -10606,7 +10673,7 @@ func (c *S3) SelectObjectContentRequest(input *SelectObjectContentInput) (req *r
|
|||
// For a list of special errors for this operation, see List of SELECT Object
|
||||
// Content Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#SelectObjectContentErrorCodeList)
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to SelectObjectContent:
|
||||
//
|
||||
// - GetObject (https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html)
|
||||
//
|
||||
|
|
@ -10932,14 +10999,14 @@ func (c *S3) UploadPartRequest(input *UploadPartInput) (req *request.Request, ou
|
|||
//
|
||||
// - x-amz-server-side-encryption-customer-key-MD5
|
||||
//
|
||||
// Special Errors
|
||||
// UploadPart has the following special errors:
|
||||
//
|
||||
// - Code: NoSuchUpload Cause: The specified multipart upload does not exist.
|
||||
// The upload ID might be invalid, or the multipart upload might have been
|
||||
// aborted or completed. HTTP Status Code: 404 Not Found SOAP Fault Code
|
||||
// Prefix: Client
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to UploadPart:
|
||||
//
|
||||
// - CreateMultipartUpload (https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateMultipartUpload.html)
|
||||
//
|
||||
|
|
@ -11089,7 +11156,7 @@ func (c *S3) UploadPartCopyRequest(input *UploadPartCopyInput) (req *request.Req
|
|||
//
|
||||
// x-amz-copy-source: /bucket/object?versionId=version id
|
||||
//
|
||||
// Special Errors
|
||||
// Special errors
|
||||
//
|
||||
// - Code: NoSuchUpload Cause: The specified multipart upload does not exist.
|
||||
// The upload ID might be invalid, or the multipart upload might have been
|
||||
|
|
@ -11098,7 +11165,7 @@ func (c *S3) UploadPartCopyRequest(input *UploadPartCopyInput) (req *request.Req
|
|||
// - Code: InvalidRequest Cause: The specified copy source is not supported
|
||||
// as a byte-range copy source. HTTP Status Code: 400 Bad Request
|
||||
//
|
||||
// Related Resources
|
||||
// The following operations are related to UploadPartCopy:
|
||||
//
|
||||
// - CreateMultipartUpload (https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateMultipartUpload.html)
|
||||
//
|
||||
|
|
@ -11264,7 +11331,7 @@ func (c *S3) WriteGetObjectResponseWithContext(ctx aws.Context, input *WriteGetO
|
|||
// Specifies the days since the initiation of an incomplete multipart upload
|
||||
// that Amazon S3 will wait before permanently removing all parts of the upload.
|
||||
// For more information, see Aborting Incomplete Multipart Uploads Using a Bucket
|
||||
// Lifecycle Policy (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config)
|
||||
// Lifecycle Configuration (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config)
|
||||
// in the Amazon S3 User Guide.
|
||||
type AbortIncompleteMultipartUpload struct {
|
||||
_ struct{} `type:"structure"`
|
||||
|
|
@ -14978,7 +15045,7 @@ type CreateMultipartUploadOutput struct {
|
|||
// name in the request, the response includes this header. The header indicates
|
||||
// when the initiated multipart upload becomes eligible for an abort operation.
|
||||
// For more information, see Aborting Incomplete Multipart Uploads Using a Bucket
|
||||
// Lifecycle Policy (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config).
|
||||
// Lifecycle Configuration (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config).
|
||||
//
|
||||
// The response also includes the x-amz-abort-rule-id header that provides the
|
||||
// ID of the lifecycle configuration rule that defines this action.
|
||||
|
|
@ -18081,9 +18148,8 @@ type Error struct {
|
|||
|
||||
// The error code is a string that uniquely identifies an error condition. It
|
||||
// is meant to be read and understood by programs that detect and handle errors
|
||||
// by type.
|
||||
//
|
||||
// Amazon S3 error codes
|
||||
// by type. The following is a list of Amazon S3 error codes. For more information,
|
||||
// see Error responses (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html).
|
||||
//
|
||||
// * Code: AccessDenied Description: Access Denied HTTP Status Code: 403
|
||||
// Forbidden SOAP Fault Code Prefix: Client
|
||||
|
|
@ -18791,6 +18857,15 @@ type GetBucketAclInput struct {
|
|||
|
||||
// Specifies the S3 bucket whose ACL is being requested.
|
||||
//
|
||||
// To use this API operation against an access point, provide the alias of the
|
||||
// access point in place of the bucket name.
|
||||
//
|
||||
// To use this API operation against an Object Lambda access point, provide
|
||||
// the alias of the Object Lambda access point in place of the bucket name.
|
||||
// If the Object Lambda access point alias in a request is not valid, the error
|
||||
// code InvalidAccessPointAliasError is returned. For more information about
|
||||
// InvalidAccessPointAliasError, see List of Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList).
|
||||
//
|
||||
// Bucket is a required field
|
||||
Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
|
||||
|
||||
|
|
@ -19064,6 +19139,15 @@ type GetBucketCorsInput struct {
|
|||
|
||||
// The bucket name for which to get the cors configuration.
|
||||
//
|
||||
// To use this API operation against an access point, provide the alias of the
|
||||
// access point in place of the bucket name.
|
||||
//
|
||||
// To use this API operation against an Object Lambda access point, provide
|
||||
// the alias of the Object Lambda access point in place of the bucket name.
|
||||
// If the Object Lambda access point alias in a request is not valid, the error
|
||||
// code InvalidAccessPointAliasError is returned. For more information about
|
||||
// InvalidAccessPointAliasError, see List of Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList).
|
||||
//
|
||||
// Bucket is a required field
|
||||
Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
|
||||
|
||||
|
|
@ -19834,6 +19918,15 @@ type GetBucketLocationInput struct {
|
|||
|
||||
// The name of the bucket for which to get the location.
|
||||
//
|
||||
// To use this API operation against an access point, provide the alias of the
|
||||
// access point in place of the bucket name.
|
||||
//
|
||||
// To use this API operation against an Object Lambda access point, provide
|
||||
// the alias of the Object Lambda access point in place of the bucket name.
|
||||
// If the Object Lambda access point alias in a request is not valid, the error
|
||||
// code InvalidAccessPointAliasError is returned. For more information about
|
||||
// InvalidAccessPointAliasError, see List of Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList).
|
||||
//
|
||||
// Bucket is a required field
|
||||
Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
|
||||
|
||||
|
|
@ -20229,6 +20322,15 @@ type GetBucketNotificationConfigurationRequest struct {
|
|||
|
||||
// The name of the bucket for which to get the notification configuration.
|
||||
//
|
||||
// To use this API operation against an access point, provide the alias of the
|
||||
// access point in place of the bucket name.
|
||||
//
|
||||
// To use this API operation against an Object Lambda access point, provide
|
||||
// the alias of the Object Lambda access point in place of the bucket name.
|
||||
// If the Object Lambda access point alias in a request is not valid, the error
|
||||
// code InvalidAccessPointAliasError is returned. For more information about
|
||||
// InvalidAccessPointAliasError, see List of Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList).
|
||||
//
|
||||
// Bucket is a required field
|
||||
Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
|
||||
|
||||
|
|
@ -20449,6 +20551,15 @@ type GetBucketPolicyInput struct {
|
|||
|
||||
// The bucket name for which to get the bucket policy.
|
||||
//
|
||||
// To use this API operation against an access point, provide the alias of the
|
||||
// access point in place of the bucket name.
|
||||
//
|
||||
// To use this API operation against an Object Lambda access point, provide
|
||||
// the alias of the Object Lambda access point in place of the bucket name.
|
||||
// If the Object Lambda access point alias in a request is not valid, the error
|
||||
// code InvalidAccessPointAliasError is returned. For more information about
|
||||
// InvalidAccessPointAliasError, see List of Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList).
|
||||
//
|
||||
// Bucket is a required field
|
||||
Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
|
||||
|
||||
|
|
@ -23872,6 +23983,12 @@ type HeadBucketInput struct {
|
|||
// information about access point ARNs, see Using access points (https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-access-points.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
//
|
||||
// When you use this action with an Object Lambda access point, provide the
|
||||
// alias of the Object Lambda access point in place of the bucket name. If the
|
||||
// Object Lambda access point alias in a request is not valid, the error code
|
||||
// InvalidAccessPointAliasError is returned. For more information about InvalidAccessPointAliasError,
|
||||
// see List of Error Codes (https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList).
|
||||
//
|
||||
// When you use this action with Amazon S3 on Outposts, you must direct requests
|
||||
// to the S3 on Outposts hostname. The S3 on Outposts hostname takes the form
|
||||
// AccessPointName-AccountId.outpostID.s3-outposts.Region.amazonaws.com. When
|
||||
|
|
@ -25660,7 +25777,8 @@ type LambdaFunctionConfiguration struct {
|
|||
Events []*string `locationName:"Event" type:"list" flattened:"true" required:"true" enum:"Event"`
|
||||
|
||||
// Specifies object key name filtering rules. For information about key name
|
||||
// filtering, see Configuring Event Notifications (https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
|
||||
// filtering, see Configuring event notifications using object key name filtering
|
||||
// (https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-filtering.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
Filter *NotificationConfigurationFilter `type:"structure"`
|
||||
|
||||
|
|
@ -25800,8 +25918,8 @@ func (s *LifecycleConfiguration) SetRules(v []*Rule) *LifecycleConfiguration {
|
|||
type LifecycleExpiration struct {
|
||||
_ struct{} `type:"structure"`
|
||||
|
||||
// Indicates at what date the object is to be moved or deleted. Should be in
|
||||
// GMT ISO 8601 Format.
|
||||
// Indicates at what date the object is to be moved or deleted. The date value
|
||||
// must conform to the ISO 8601 format. The time is always midnight UTC.
|
||||
Date *time.Time `type:"timestamp" timestampFormat:"iso8601"`
|
||||
|
||||
// Indicates the lifetime, in days, of the objects that are subject to the rule.
|
||||
|
|
@ -25861,7 +25979,7 @@ type LifecycleRule struct {
|
|||
// Specifies the days since the initiation of an incomplete multipart upload
|
||||
// that Amazon S3 will wait before permanently removing all parts of the upload.
|
||||
// For more information, see Aborting Incomplete Multipart Uploads Using a Bucket
|
||||
// Lifecycle Policy (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config)
|
||||
// Lifecycle Configuration (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config)
|
||||
// in the Amazon S3 User Guide.
|
||||
AbortIncompleteMultipartUpload *AbortIncompleteMultipartUpload `type:"structure"`
|
||||
|
||||
|
|
@ -28482,7 +28600,7 @@ type ListPartsOutput struct {
|
|||
// name in the request, then the response includes this header indicating when
|
||||
// the initiated multipart upload will become eligible for abort operation.
|
||||
// For more information, see Aborting Incomplete Multipart Uploads Using a Bucket
|
||||
// Lifecycle Policy (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config).
|
||||
// Lifecycle Configuration (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config).
|
||||
//
|
||||
// The response will also include the x-amz-abort-rule-id header that will provide
|
||||
// the ID of the lifecycle configuration rule that defines this action.
|
||||
|
|
@ -29578,7 +29696,8 @@ func (s *NotificationConfigurationDeprecated) SetTopicConfiguration(v *TopicConf
|
|||
}
|
||||
|
||||
// Specifies object key name filtering rules. For information about key name
|
||||
// filtering, see Configuring Event Notifications (https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
|
||||
// filtering, see Configuring event notifications using object key name filtering
|
||||
// (https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-filtering.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
type NotificationConfigurationFilter struct {
|
||||
_ struct{} `type:"structure"`
|
||||
|
|
@ -36029,7 +36148,8 @@ type QueueConfiguration struct {
|
|||
Events []*string `locationName:"Event" type:"list" flattened:"true" required:"true" enum:"Event"`
|
||||
|
||||
// Specifies object key name filtering rules. For information about key name
|
||||
// filtering, see Configuring Event Notifications (https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
|
||||
// filtering, see Configuring event notifications using object key name filtering
|
||||
// (https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-filtering.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
Filter *NotificationConfigurationFilter `type:"structure"`
|
||||
|
||||
|
|
@ -37434,7 +37554,7 @@ type Rule struct {
|
|||
// Specifies the days since the initiation of an incomplete multipart upload
|
||||
// that Amazon S3 will wait before permanently removing all parts of the upload.
|
||||
// For more information, see Aborting Incomplete Multipart Uploads Using a Bucket
|
||||
// Lifecycle Policy (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config)
|
||||
// Lifecycle Configuration (https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config)
|
||||
// in the Amazon S3 User Guide.
|
||||
AbortIncompleteMultipartUpload *AbortIncompleteMultipartUpload `type:"structure"`
|
||||
|
||||
|
|
@ -38257,11 +38377,12 @@ type ServerSideEncryptionByDefault struct {
|
|||
// and only if SSEAlgorithm is set to aws:kms.
|
||||
//
|
||||
// You can specify the key ID or the Amazon Resource Name (ARN) of the KMS key.
|
||||
// However, if you are using encryption with cross-account or Amazon Web Services
|
||||
// service operations you must use a fully qualified KMS key ARN. For more information,
|
||||
// see Using encryption for cross-account operations (https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html#bucket-encryption-update-bucket-policy).
|
||||
// If you use a key ID, you can run into a LogDestination undeliverable error
|
||||
// when creating a VPC flow log.
|
||||
//
|
||||
// For example:
|
||||
// If you are using encryption with cross-account or Amazon Web Services service
|
||||
// operations you must use a fully qualified KMS key ARN. For more information,
|
||||
// see Using encryption for cross-account operations (https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html#bucket-encryption-update-bucket-policy).
|
||||
//
|
||||
// * Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
|
||||
//
|
||||
|
|
@ -39066,7 +39187,8 @@ type TopicConfiguration struct {
|
|||
Events []*string `locationName:"Event" type:"list" flattened:"true" required:"true" enum:"Event"`
|
||||
|
||||
// Specifies object key name filtering rules. For information about key name
|
||||
// filtering, see Configuring Event Notifications (https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html)
|
||||
// filtering, see Configuring event notifications using object key name filtering
|
||||
// (https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-filtering.html)
|
||||
// in the Amazon S3 User Guide.
|
||||
Filter *NotificationConfigurationFilter `type:"structure"`
|
||||
|
||||
|
|
@ -40541,9 +40663,7 @@ type WriteGetObjectResponseInput struct {
|
|||
ServerSideEncryption *string `location:"header" locationName:"x-amz-fwd-header-x-amz-server-side-encryption" type:"string" enum:"ServerSideEncryption"`
|
||||
|
||||
// The integer status code for an HTTP response of a corresponding GetObject
|
||||
// request.
|
||||
//
|
||||
// Status Codes
|
||||
// request. The following is a list of status codes.
|
||||
//
|
||||
// * 200 - OK
|
||||
//
|
||||
|
|
@ -41804,6 +41924,9 @@ const (
|
|||
|
||||
// ObjectStorageClassGlacierIr is a ObjectStorageClass enum value
|
||||
ObjectStorageClassGlacierIr = "GLACIER_IR"
|
||||
|
||||
// ObjectStorageClassSnow is a ObjectStorageClass enum value
|
||||
ObjectStorageClassSnow = "SNOW"
|
||||
)
|
||||
|
||||
// ObjectStorageClass_Values returns all elements of the ObjectStorageClass enum
|
||||
|
|
@ -41818,6 +41941,7 @@ func ObjectStorageClass_Values() []string {
|
|||
ObjectStorageClassDeepArchive,
|
||||
ObjectStorageClassOutposts,
|
||||
ObjectStorageClassGlacierIr,
|
||||
ObjectStorageClassSnow,
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -42095,6 +42219,9 @@ const (
|
|||
|
||||
// StorageClassGlacierIr is a StorageClass enum value
|
||||
StorageClassGlacierIr = "GLACIER_IR"
|
||||
|
||||
// StorageClassSnow is a StorageClass enum value
|
||||
StorageClassSnow = "SNOW"
|
||||
)
|
||||
|
||||
// StorageClass_Values returns all elements of the StorageClass enum
|
||||
|
|
@ -42109,6 +42236,7 @@ func StorageClass_Values() []string {
|
|||
StorageClassDeepArchive,
|
||||
StorageClassOutposts,
|
||||
StorageClassGlacierIr,
|
||||
StorageClassSnow,
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
135
vendor/github.com/aws/aws-sdk-go/service/sts/api.go
generated
vendored
135
vendor/github.com/aws/aws-sdk-go/service/sts/api.go
generated
vendored
|
|
@ -85,9 +85,9 @@ func (c *STS) AssumeRoleRequest(input *AssumeRoleInput) (req *request.Request, o
|
|||
// assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
|
||||
// in the IAM User Guide.
|
||||
//
|
||||
// When you create a role, you create two policies: A role trust policy that
|
||||
// specifies who can assume the role and a permissions policy that specifies
|
||||
// what can be done with the role. You specify the trusted principal who is
|
||||
// When you create a role, you create two policies: a role trust policy that
|
||||
// specifies who can assume the role, and a permissions policy that specifies
|
||||
// what can be done with the role. You specify the trusted principal that is
|
||||
// allowed to assume the role in the role trust policy.
|
||||
//
|
||||
// To assume a role from a different account, your Amazon Web Services account
|
||||
|
|
@ -96,9 +96,9 @@ func (c *STS) AssumeRoleRequest(input *AssumeRoleInput) (req *request.Request, o
|
|||
// are allowed to delegate that access to users in the account.
|
||||
//
|
||||
// A user who wants to access a role in a different account must also have permissions
|
||||
// that are delegated from the user account administrator. The administrator
|
||||
// must attach a policy that allows the user to call AssumeRole for the ARN
|
||||
// of the role in the other account.
|
||||
// that are delegated from the account administrator. The administrator must
|
||||
// attach a policy that allows the user to call AssumeRole for the ARN of the
|
||||
// role in the other account.
|
||||
//
|
||||
// To allow a user to assume a role in the same account, you can do either of
|
||||
// the following:
|
||||
|
|
@ -517,10 +517,8 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
|
|||
// a user. You can also supply the user with a consistent identity throughout
|
||||
// the lifetime of an application.
|
||||
//
|
||||
// To learn more about Amazon Cognito, see Amazon Cognito Overview (https://docs.aws.amazon.com/mobile/sdkforandroid/developerguide/cognito-auth.html#d0e840)
|
||||
// in Amazon Web Services SDK for Android Developer Guide and Amazon Cognito
|
||||
// Overview (https://docs.aws.amazon.com/mobile/sdkforios/developerguide/cognito-auth.html#d0e664)
|
||||
// in the Amazon Web Services SDK for iOS Developer Guide.
|
||||
// To learn more about Amazon Cognito, see Amazon Cognito identity pools (https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html)
|
||||
// in Amazon Cognito Developer Guide.
|
||||
//
|
||||
// Calling AssumeRoleWithWebIdentity does not require the use of Amazon Web
|
||||
// Services security credentials. Therefore, you can distribute an application
|
||||
|
|
@ -984,11 +982,11 @@ func (c *STS) GetCallerIdentityRequest(input *GetCallerIdentityInput) (req *requ
|
|||
// call the operation.
|
||||
//
|
||||
// No permissions are required to perform this operation. If an administrator
|
||||
// adds a policy to your IAM user or role that explicitly denies access to the
|
||||
// sts:GetCallerIdentity action, you can still perform this operation. Permissions
|
||||
// are not required because the same information is returned when an IAM user
|
||||
// or role is denied access. To view an example response, see I Am Not Authorized
|
||||
// to Perform: iam:DeleteVirtualMFADevice (https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa)
|
||||
// attaches a policy to your identity that explicitly denies access to the sts:GetCallerIdentity
|
||||
// action, you can still perform this operation. Permissions are not required
|
||||
// because the same information is returned when access is denied. To view an
|
||||
// example response, see I Am Not Authorized to Perform: iam:DeleteVirtualMFADevice
|
||||
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa)
|
||||
// in the IAM User Guide.
|
||||
//
|
||||
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
|
||||
|
|
@ -1063,18 +1061,26 @@ func (c *STS) GetFederationTokenRequest(input *GetFederationTokenInput) (req *re
|
|||
// GetFederationToken API operation for AWS Security Token Service.
|
||||
//
|
||||
// Returns a set of temporary security credentials (consisting of an access
|
||||
// key ID, a secret access key, and a security token) for a federated user.
|
||||
// A typical use is in a proxy application that gets temporary security credentials
|
||||
// on behalf of distributed applications inside a corporate network. You must
|
||||
// call the GetFederationToken operation using the long-term security credentials
|
||||
// of an IAM user. As a result, this call is appropriate in contexts where those
|
||||
// credentials can be safely stored, usually in a server-based application.
|
||||
// key ID, a secret access key, and a security token) for a user. A typical
|
||||
// use is in a proxy application that gets temporary security credentials on
|
||||
// behalf of distributed applications inside a corporate network.
|
||||
//
|
||||
// You must call the GetFederationToken operation using the long-term security
|
||||
// credentials of an IAM user. As a result, this call is appropriate in contexts
|
||||
// where those credentials can be safeguarded, usually in a server-based application.
|
||||
// For a comparison of GetFederationToken with the other API operations that
|
||||
// produce temporary credentials, see Requesting Temporary Security Credentials
|
||||
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html)
|
||||
// and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison)
|
||||
// in the IAM User Guide.
|
||||
//
|
||||
// Although it is possible to call GetFederationToken using the security credentials
|
||||
// of an Amazon Web Services account root user rather than an IAM user that
|
||||
// you create for the purpose of a proxy application, we do not recommend it.
|
||||
// For more information, see Safeguard your root user credentials and don't
|
||||
// use them for everyday tasks (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials)
|
||||
// in the IAM User Guide.
|
||||
//
|
||||
// You can create a mobile-based or browser-based app that can authenticate
|
||||
// users using a web identity provider like Login with Amazon, Facebook, Google,
|
||||
// or an OpenID Connect-compatible identity provider. In this case, we recommend
|
||||
|
|
@ -1083,21 +1089,13 @@ func (c *STS) GetFederationTokenRequest(input *GetFederationTokenInput) (req *re
|
|||
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity)
|
||||
// in the IAM User Guide.
|
||||
//
|
||||
// You can also call GetFederationToken using the security credentials of an
|
||||
// Amazon Web Services account root user, but we do not recommend it. Instead,
|
||||
// we recommend that you create an IAM user for the purpose of the proxy application.
|
||||
// Then attach a policy to the IAM user that limits federated users to only
|
||||
// the actions and resources that they need to access. For more information,
|
||||
// see IAM Best Practices (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
|
||||
// in the IAM User Guide.
|
||||
//
|
||||
// # Session duration
|
||||
//
|
||||
// The temporary credentials are valid for the specified duration, from 900
|
||||
// seconds (15 minutes) up to a maximum of 129,600 seconds (36 hours). The default
|
||||
// session duration is 43,200 seconds (12 hours). Temporary credentials obtained
|
||||
// by using the Amazon Web Services account root user credentials have a maximum
|
||||
// duration of 3,600 seconds (1 hour).
|
||||
// by using the root user credentials have a maximum duration of 3,600 seconds
|
||||
// (1 hour).
|
||||
//
|
||||
// # Permissions
|
||||
//
|
||||
|
|
@ -1267,12 +1265,13 @@ func (c *STS) GetSessionTokenRequest(input *GetSessionTokenInput) (req *request.
|
|||
// or IAM user. The credentials consist of an access key ID, a secret access
|
||||
// key, and a security token. Typically, you use GetSessionToken if you want
|
||||
// to use MFA to protect programmatic calls to specific Amazon Web Services
|
||||
// API operations like Amazon EC2 StopInstances. MFA-enabled IAM users would
|
||||
// need to call GetSessionToken and submit an MFA code that is associated with
|
||||
// their MFA device. Using the temporary security credentials that are returned
|
||||
// from the call, IAM users can then make programmatic calls to API operations
|
||||
// that require MFA authentication. If you do not supply a correct MFA code,
|
||||
// then the API returns an access denied error. For a comparison of GetSessionToken
|
||||
// API operations like Amazon EC2 StopInstances.
|
||||
//
|
||||
// MFA-enabled IAM users must call GetSessionToken and submit an MFA code that
|
||||
// is associated with their MFA device. Using the temporary security credentials
|
||||
// that the call returns, IAM users can then make programmatic calls to API
|
||||
// operations that require MFA authentication. An incorrect MFA code causes
|
||||
// the API to return an access denied error. For a comparison of GetSessionToken
|
||||
// with the other API operations that produce temporary credentials, see Requesting
|
||||
// Temporary Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html)
|
||||
// and Comparing the Amazon Web Services STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison)
|
||||
|
|
@ -1287,13 +1286,12 @@ func (c *STS) GetSessionTokenRequest(input *GetSessionTokenInput) (req *request.
|
|||
// # Session Duration
|
||||
//
|
||||
// The GetSessionToken operation must be called by using the long-term Amazon
|
||||
// Web Services security credentials of the Amazon Web Services account root
|
||||
// user or an IAM user. Credentials that are created by IAM users are valid
|
||||
// for the duration that you specify. This duration can range from 900 seconds
|
||||
// (15 minutes) up to a maximum of 129,600 seconds (36 hours), with a default
|
||||
// of 43,200 seconds (12 hours). Credentials based on account credentials can
|
||||
// range from 900 seconds (15 minutes) up to 3,600 seconds (1 hour), with a
|
||||
// default of 1 hour.
|
||||
// Web Services security credentials of an IAM user. Credentials that are created
|
||||
// by IAM users are valid for the duration that you specify. This duration can
|
||||
// range from 900 seconds (15 minutes) up to a maximum of 129,600 seconds (36
|
||||
// hours), with a default of 43,200 seconds (12 hours). Credentials based on
|
||||
// account credentials can range from 900 seconds (15 minutes) up to 3,600 seconds
|
||||
// (1 hour), with a default of 1 hour.
|
||||
//
|
||||
// # Permissions
|
||||
//
|
||||
|
|
@ -1305,20 +1303,20 @@ func (c *STS) GetSessionTokenRequest(input *GetSessionTokenInput) (req *request.
|
|||
//
|
||||
// - You cannot call any STS API except AssumeRole or GetCallerIdentity.
|
||||
//
|
||||
// We recommend that you do not call GetSessionToken with Amazon Web Services
|
||||
// account root user credentials. Instead, follow our best practices (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#create-iam-users)
|
||||
// by creating one or more IAM users, giving them the necessary permissions,
|
||||
// and using IAM users for everyday interaction with Amazon Web Services.
|
||||
// The credentials that GetSessionToken returns are based on permissions associated
|
||||
// with the IAM user whose credentials were used to call the operation. The
|
||||
// temporary credentials have the same permissions as the IAM user.
|
||||
//
|
||||
// The credentials that are returned by GetSessionToken are based on permissions
|
||||
// associated with the user whose credentials were used to call the operation.
|
||||
// If GetSessionToken is called using Amazon Web Services account root user
|
||||
// credentials, the temporary credentials have root user permissions. Similarly,
|
||||
// if GetSessionToken is called using the credentials of an IAM user, the temporary
|
||||
// credentials have the same permissions as the IAM user.
|
||||
// Although it is possible to call GetSessionToken using the security credentials
|
||||
// of an Amazon Web Services account root user rather than an IAM user, we do
|
||||
// not recommend it. If GetSessionToken is called using root user credentials,
|
||||
// the temporary credentials have root user permissions. For more information,
|
||||
// see Safeguard your root user credentials and don't use them for everyday
|
||||
// tasks (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials)
|
||||
// in the IAM User Guide
|
||||
//
|
||||
// For more information about using GetSessionToken to create temporary credentials,
|
||||
// go to Temporary Credentials for Users in Untrusted Environments (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken)
|
||||
// see Temporary Credentials for Users in Untrusted Environments (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken)
|
||||
// in the IAM User Guide.
|
||||
//
|
||||
// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
|
||||
|
|
@ -1900,8 +1898,12 @@ type AssumeRoleWithSAMLInput struct {
|
|||
// For more information, see Configuring a Relying Party and Adding Claims (https://docs.aws.amazon.com/IAM/latest/UserGuide/create-role-saml-IdP-tasks.html)
|
||||
// in the IAM User Guide.
|
||||
//
|
||||
// SAMLAssertion is a sensitive parameter and its value will be
|
||||
// replaced with "sensitive" in string returned by AssumeRoleWithSAMLInput's
|
||||
// String and GoString methods.
|
||||
//
|
||||
// SAMLAssertion is a required field
|
||||
SAMLAssertion *string `min:"4" type:"string" required:"true"`
|
||||
SAMLAssertion *string `min:"4" type:"string" required:"true" sensitive:"true"`
|
||||
}
|
||||
|
||||
// String returns the string representation.
|
||||
|
|
@ -2036,7 +2038,7 @@ type AssumeRoleWithSAMLOutput struct {
|
|||
// IAM.
|
||||
//
|
||||
// The combination of NameQualifier and Subject can be used to uniquely identify
|
||||
// a federated user.
|
||||
// a user.
|
||||
//
|
||||
// The following pseudocode shows how the hash value is calculated:
|
||||
//
|
||||
|
|
@ -2266,8 +2268,12 @@ type AssumeRoleWithWebIdentityInput struct {
|
|||
// the user who is using your application with a web identity provider before
|
||||
// the application makes an AssumeRoleWithWebIdentity call.
|
||||
//
|
||||
// WebIdentityToken is a sensitive parameter and its value will be
|
||||
// replaced with "sensitive" in string returned by AssumeRoleWithWebIdentityInput's
|
||||
// String and GoString methods.
|
||||
//
|
||||
// WebIdentityToken is a required field
|
||||
WebIdentityToken *string `min:"4" type:"string" required:"true"`
|
||||
WebIdentityToken *string `min:"4" type:"string" required:"true" sensitive:"true"`
|
||||
}
|
||||
|
||||
// String returns the string representation.
|
||||
|
|
@ -2573,8 +2579,12 @@ type Credentials struct {
|
|||
|
||||
// The secret access key that can be used to sign requests.
|
||||
//
|
||||
// SecretAccessKey is a sensitive parameter and its value will be
|
||||
// replaced with "sensitive" in string returned by Credentials's
|
||||
// String and GoString methods.
|
||||
//
|
||||
// SecretAccessKey is a required field
|
||||
SecretAccessKey *string `type:"string" required:"true"`
|
||||
SecretAccessKey *string `type:"string" required:"true" sensitive:"true"`
|
||||
|
||||
// The token that users must pass to the service API to use the temporary credentials.
|
||||
//
|
||||
|
|
@ -2922,10 +2932,9 @@ type GetFederationTokenInput struct {
|
|||
// The duration, in seconds, that the session should last. Acceptable durations
|
||||
// for federation sessions range from 900 seconds (15 minutes) to 129,600 seconds
|
||||
// (36 hours), with 43,200 seconds (12 hours) as the default. Sessions obtained
|
||||
// using Amazon Web Services account root user credentials are restricted to
|
||||
// a maximum of 3,600 seconds (one hour). If the specified duration is longer
|
||||
// than one hour, the session obtained by using root user credentials defaults
|
||||
// to one hour.
|
||||
// using root user credentials are restricted to a maximum of 3,600 seconds
|
||||
// (one hour). If the specified duration is longer than one hour, the session
|
||||
// obtained by using root user credentials defaults to one hour.
|
||||
DurationSeconds *int64 `min:"900" type:"integer"`
|
||||
|
||||
// The name of the federated user. The name is used as an identifier for the
|
||||
|
|
|
|||
7
vendor/github.com/aws/aws-sdk-go/service/sts/doc.go
generated
vendored
7
vendor/github.com/aws/aws-sdk-go/service/sts/doc.go
generated
vendored
|
|
@ -4,10 +4,9 @@
|
|||
// requests to AWS Security Token Service.
|
||||
//
|
||||
// Security Token Service (STS) enables you to request temporary, limited-privilege
|
||||
// credentials for Identity and Access Management (IAM) users or for users that
|
||||
// you authenticate (federated users). This guide provides descriptions of the
|
||||
// STS API. For more information about using this service, see Temporary Security
|
||||
// Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html).
|
||||
// credentials for users. This guide provides descriptions of the STS API. For
|
||||
// more information about using this service, see Temporary Security Credentials
|
||||
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html).
|
||||
//
|
||||
// See https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15 for more information on this service.
|
||||
//
|
||||
|
|
|
|||
6
vendor/github.com/google/s2a-go/.gitignore
generated
vendored
Normal file
6
vendor/github.com/google/s2a-go/.gitignore
generated
vendored
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
# Ignore binaries without extension
|
||||
//example/client/client
|
||||
//example/server/server
|
||||
//internal/v2/fakes2av2_server/fakes2av2_server
|
||||
|
||||
.idea/
|
||||
93
vendor/github.com/google/s2a-go/CODE_OF_CONDUCT.md
generated
vendored
Normal file
93
vendor/github.com/google/s2a-go/CODE_OF_CONDUCT.md
generated
vendored
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
# Code of Conduct
|
||||
|
||||
## Our Pledge
|
||||
|
||||
In the interest of fostering an open and welcoming environment, we as
|
||||
contributors and maintainers pledge to making participation in our project and
|
||||
our community a harassment-free experience for everyone, regardless of age, body
|
||||
size, disability, ethnicity, gender identity and expression, level of
|
||||
experience, education, socio-economic status, nationality, personal appearance,
|
||||
race, religion, or sexual identity and orientation.
|
||||
|
||||
## Our Standards
|
||||
|
||||
Examples of behavior that contributes to creating a positive environment
|
||||
include:
|
||||
|
||||
* Using welcoming and inclusive language
|
||||
* Being respectful of differing viewpoints and experiences
|
||||
* Gracefully accepting constructive criticism
|
||||
* Focusing on what is best for the community
|
||||
* Showing empathy towards other community members
|
||||
|
||||
Examples of unacceptable behavior by participants include:
|
||||
|
||||
* The use of sexualized language or imagery and unwelcome sexual attention or
|
||||
advances
|
||||
* Trolling, insulting/derogatory comments, and personal or political attacks
|
||||
* Public or private harassment
|
||||
* Publishing others' private information, such as a physical or electronic
|
||||
address, without explicit permission
|
||||
* Other conduct which could reasonably be considered inappropriate in a
|
||||
professional setting
|
||||
|
||||
## Our Responsibilities
|
||||
|
||||
Project maintainers are responsible for clarifying the standards of acceptable
|
||||
behavior and are expected to take appropriate and fair corrective action in
|
||||
response to any instances of unacceptable behavior.
|
||||
|
||||
Project maintainers have the right and responsibility to remove, edit, or reject
|
||||
comments, commits, code, wiki edits, issues, and other contributions that are
|
||||
not aligned to this Code of Conduct, or to ban temporarily or permanently any
|
||||
contributor for other behaviors that they deem inappropriate, threatening,
|
||||
offensive, or harmful.
|
||||
|
||||
## Scope
|
||||
|
||||
This Code of Conduct applies both within project spaces and in public spaces
|
||||
when an individual is representing the project or its community. Examples of
|
||||
representing a project or community include using an official project e-mail
|
||||
address, posting via an official social media account, or acting as an appointed
|
||||
representative at an online or offline event. Representation of a project may be
|
||||
further defined and clarified by project maintainers.
|
||||
|
||||
This Code of Conduct also applies outside the project spaces when the Project
|
||||
Steward has a reasonable belief that an individual's behavior may have a
|
||||
negative impact on the project or its community.
|
||||
|
||||
## Conflict Resolution
|
||||
|
||||
We do not believe that all conflict is bad; healthy debate and disagreement
|
||||
often yield positive results. However, it is never okay to be disrespectful or
|
||||
to engage in behavior that violates the project’s code of conduct.
|
||||
|
||||
If you see someone violating the code of conduct, you are encouraged to address
|
||||
the behavior directly with those involved. Many issues can be resolved quickly
|
||||
and easily, and this gives people more control over the outcome of their
|
||||
dispute. If you are unable to resolve the matter for any reason, or if the
|
||||
behavior is threatening or harassing, report it. We are dedicated to providing
|
||||
an environment where participants feel welcome and safe.
|
||||
|
||||
Reports should be directed to *[PROJECT STEWARD NAME(s) AND EMAIL(s)]*, the
|
||||
Project Steward(s) for *[PROJECT NAME]*. It is the Project Steward’s duty to
|
||||
receive and address reported violations of the code of conduct. They will then
|
||||
work with a committee consisting of representatives from the Open Source
|
||||
Programs Office and the Google Open Source Strategy team. If for any reason you
|
||||
are uncomfortable reaching out to the Project Steward, please email
|
||||
opensource@google.com.
|
||||
|
||||
We will investigate every complaint, but you may not receive a direct response.
|
||||
We will use our discretion in determining when and how to follow up on reported
|
||||
incidents, which may range from not taking action to permanent expulsion from
|
||||
the project and project-sponsored spaces. We will notify the accused of the
|
||||
report and provide them an opportunity to discuss it before any action is taken.
|
||||
The identity of the reporter will be omitted from the details of the report
|
||||
supplied to the accused. In potentially harmful situations, such as ongoing
|
||||
harassment or threats to anyone's safety, we may take action without notice.
|
||||
|
||||
## Attribution
|
||||
|
||||
This Code of Conduct is adapted from the Contributor Covenant, version 1.4,
|
||||
available at
|
||||
https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
|
||||
29
vendor/github.com/google/s2a-go/CONTRIBUTING.md
generated
vendored
Normal file
29
vendor/github.com/google/s2a-go/CONTRIBUTING.md
generated
vendored
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# How to Contribute
|
||||
|
||||
We'd love to accept your patches and contributions to this project. There are
|
||||
just a few small guidelines you need to follow.
|
||||
|
||||
## Contributor License Agreement
|
||||
|
||||
Contributions to this project must be accompanied by a Contributor License
|
||||
Agreement (CLA). You (or your employer) retain the copyright to your
|
||||
contribution; this simply gives us permission to use and redistribute your
|
||||
contributions as part of the project. Head over to
|
||||
<https://cla.developers.google.com/> to see your current agreements on file or
|
||||
to sign a new one.
|
||||
|
||||
You generally only need to submit a CLA once, so if you've already submitted one
|
||||
(even if it was for a different project), you probably don't need to do it
|
||||
again.
|
||||
|
||||
## Code reviews
|
||||
|
||||
All submissions, including submissions by project members, require review. We
|
||||
use GitHub pull requests for this purpose. Consult
|
||||
[GitHub Help](https://help.github.com/articles/about-pull-requests/) for more
|
||||
information on using pull requests.
|
||||
|
||||
## Community Guidelines
|
||||
|
||||
This project follows
|
||||
[Google's Open Source Community Guidelines](https://opensource.google/conduct/).
|
||||
202
vendor/github.com/google/s2a-go/LICENSE.md
generated
vendored
Normal file
202
vendor/github.com/google/s2a-go/LICENSE.md
generated
vendored
Normal file
|
|
@ -0,0 +1,202 @@
|
|||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright [yyyy] [name of copyright owner]
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
17
vendor/github.com/google/s2a-go/README.md
generated
vendored
Normal file
17
vendor/github.com/google/s2a-go/README.md
generated
vendored
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
# Secure Session Agent Client Libraries
|
||||
|
||||
The Secure Session Agent is a service that enables a workload to offload select
|
||||
operations from the mTLS handshake and protects a workload's private key
|
||||
material from exfiltration. Specifically, the workload asks the Secure Session
|
||||
Agent for the TLS configuration to use during the handshake, to perform private
|
||||
key operations, and to validate the peer certificate chain. The Secure Session
|
||||
Agent's client libraries enable applications to communicate with the Secure
|
||||
Session Agent during the TLS handshake, and to encrypt traffic to the peer
|
||||
after the TLS handshake is complete.
|
||||
|
||||
This repository contains the source code for the Secure Session Agent's Go
|
||||
client libraries, which allow gRPC-Go applications to use the Secure Session
|
||||
Agent. This repository supports the Bazel and Golang build systems.
|
||||
|
||||
All code in this repository is experimental and subject to change. We do not
|
||||
guarantee API stability at this time.
|
||||
167
vendor/github.com/google/s2a-go/fallback/s2a_fallback.go
generated
vendored
Normal file
167
vendor/github.com/google/s2a-go/fallback/s2a_fallback.go
generated
vendored
Normal file
|
|
@ -0,0 +1,167 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2023 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package fallback provides default implementations of fallback options when S2A fails.
|
||||
package fallback
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"fmt"
|
||||
"net"
|
||||
|
||||
"google.golang.org/grpc/credentials"
|
||||
"google.golang.org/grpc/grpclog"
|
||||
)
|
||||
|
||||
const (
|
||||
alpnProtoStrH2 = "h2"
|
||||
alpnProtoStrHTTP = "http/1.1"
|
||||
defaultHTTPSPort = "443"
|
||||
)
|
||||
|
||||
// FallbackTLSConfigGRPC is a tls.Config used by the DefaultFallbackClientHandshakeFunc function.
|
||||
// It supports GRPC use case, thus the alpn is set to 'h2'.
|
||||
var FallbackTLSConfigGRPC = tls.Config{
|
||||
MinVersion: tls.VersionTLS13,
|
||||
ClientSessionCache: nil,
|
||||
NextProtos: []string{alpnProtoStrH2},
|
||||
}
|
||||
|
||||
// FallbackTLSConfigHTTP is a tls.Config used by the DefaultFallbackDialerAndAddress func.
|
||||
// It supports the HTTP use case and the alpn is set to both 'http/1.1' and 'h2'.
|
||||
var FallbackTLSConfigHTTP = tls.Config{
|
||||
MinVersion: tls.VersionTLS13,
|
||||
ClientSessionCache: nil,
|
||||
NextProtos: []string{alpnProtoStrH2, alpnProtoStrHTTP},
|
||||
}
|
||||
|
||||
// ClientHandshake establishes a TLS connection and returns it, plus its auth info.
|
||||
// Inputs:
|
||||
//
|
||||
// targetServer: the server attempted with S2A.
|
||||
// conn: the tcp connection to the server at address targetServer that was passed into S2A's ClientHandshake func.
|
||||
// If fallback is successful, the `conn` should be closed.
|
||||
// err: the error encountered when performing the client-side TLS handshake with S2A.
|
||||
type ClientHandshake func(ctx context.Context, targetServer string, conn net.Conn, err error) (net.Conn, credentials.AuthInfo, error)
|
||||
|
||||
// DefaultFallbackClientHandshakeFunc returns a ClientHandshake function,
|
||||
// which establishes a TLS connection to the provided fallbackAddr, returns the new connection and its auth info.
|
||||
// Example use:
|
||||
//
|
||||
// transportCreds, _ = s2a.NewClientCreds(&s2a.ClientOptions{
|
||||
// S2AAddress: s2aAddress,
|
||||
// FallbackOpts: &s2a.FallbackOptions{ // optional
|
||||
// FallbackClientHandshakeFunc: fallback.DefaultFallbackClientHandshakeFunc(fallbackAddr),
|
||||
// },
|
||||
// })
|
||||
//
|
||||
// The fallback server's certificate must be verifiable using OS root store.
|
||||
// The fallbackAddr is expected to be a network address, e.g. example.com:port. If port is not specified,
|
||||
// it uses default port 443.
|
||||
// In the returned function's TLS config, ClientSessionCache is explicitly set to nil to disable TLS resumption,
|
||||
// and min TLS version is set to 1.3.
|
||||
func DefaultFallbackClientHandshakeFunc(fallbackAddr string) (ClientHandshake, error) {
|
||||
var fallbackDialer = tls.Dialer{Config: &FallbackTLSConfigGRPC}
|
||||
return defaultFallbackClientHandshakeFuncInternal(fallbackAddr, fallbackDialer.DialContext)
|
||||
}
|
||||
|
||||
func defaultFallbackClientHandshakeFuncInternal(fallbackAddr string, dialContextFunc func(context.Context, string, string) (net.Conn, error)) (ClientHandshake, error) {
|
||||
fallbackServerAddr, err := processFallbackAddr(fallbackAddr)
|
||||
if err != nil {
|
||||
if grpclog.V(1) {
|
||||
grpclog.Infof("error processing fallback address [%s]: %v", fallbackAddr, err)
|
||||
}
|
||||
return nil, err
|
||||
}
|
||||
return func(ctx context.Context, targetServer string, conn net.Conn, s2aErr error) (net.Conn, credentials.AuthInfo, error) {
|
||||
fbConn, fbErr := dialContextFunc(ctx, "tcp", fallbackServerAddr)
|
||||
if fbErr != nil {
|
||||
grpclog.Infof("dialing to fallback server %s failed: %v", fallbackServerAddr, fbErr)
|
||||
return nil, nil, fmt.Errorf("dialing to fallback server %s failed: %v; S2A client handshake with %s error: %w", fallbackServerAddr, fbErr, targetServer, s2aErr)
|
||||
}
|
||||
|
||||
tc, success := fbConn.(*tls.Conn)
|
||||
if !success {
|
||||
grpclog.Infof("the connection with fallback server is expected to be tls but isn't")
|
||||
return nil, nil, fmt.Errorf("the connection with fallback server is expected to be tls but isn't; S2A client handshake with %s error: %w", targetServer, s2aErr)
|
||||
}
|
||||
|
||||
tlsInfo := credentials.TLSInfo{
|
||||
State: tc.ConnectionState(),
|
||||
CommonAuthInfo: credentials.CommonAuthInfo{
|
||||
SecurityLevel: credentials.PrivacyAndIntegrity,
|
||||
},
|
||||
}
|
||||
if grpclog.V(1) {
|
||||
grpclog.Infof("ConnectionState.NegotiatedProtocol: %v", tc.ConnectionState().NegotiatedProtocol)
|
||||
grpclog.Infof("ConnectionState.HandshakeComplete: %v", tc.ConnectionState().HandshakeComplete)
|
||||
grpclog.Infof("ConnectionState.ServerName: %v", tc.ConnectionState().ServerName)
|
||||
}
|
||||
conn.Close()
|
||||
return fbConn, tlsInfo, nil
|
||||
}, nil
|
||||
}
|
||||
|
||||
// DefaultFallbackDialerAndAddress returns a TLS dialer and the network address to dial.
|
||||
// Example use:
|
||||
//
|
||||
// fallbackDialer, fallbackServerAddr := fallback.DefaultFallbackDialerAndAddress(fallbackAddr)
|
||||
// dialTLSContext := s2a.NewS2aDialTLSContextFunc(&s2a.ClientOptions{
|
||||
// S2AAddress: s2aAddress, // required
|
||||
// FallbackOpts: &s2a.FallbackOptions{
|
||||
// FallbackDialer: &s2a.FallbackDialer{
|
||||
// Dialer: fallbackDialer,
|
||||
// ServerAddr: fallbackServerAddr,
|
||||
// },
|
||||
// },
|
||||
// })
|
||||
//
|
||||
// The fallback server's certificate should be verifiable using OS root store.
|
||||
// The fallbackAddr is expected to be a network address, e.g. example.com:port. If port is not specified,
|
||||
// it uses default port 443.
|
||||
// In the returned function's TLS config, ClientSessionCache is explicitly set to nil to disable TLS resumption,
|
||||
// and min TLS version is set to 1.3.
|
||||
func DefaultFallbackDialerAndAddress(fallbackAddr string) (*tls.Dialer, string, error) {
|
||||
fallbackServerAddr, err := processFallbackAddr(fallbackAddr)
|
||||
if err != nil {
|
||||
if grpclog.V(1) {
|
||||
grpclog.Infof("error processing fallback address [%s]: %v", fallbackAddr, err)
|
||||
}
|
||||
return nil, "", err
|
||||
}
|
||||
return &tls.Dialer{Config: &FallbackTLSConfigHTTP}, fallbackServerAddr, nil
|
||||
}
|
||||
|
||||
func processFallbackAddr(fallbackAddr string) (string, error) {
|
||||
var fallbackServerAddr string
|
||||
var err error
|
||||
|
||||
if fallbackAddr == "" {
|
||||
return "", fmt.Errorf("empty fallback address")
|
||||
}
|
||||
_, _, err = net.SplitHostPort(fallbackAddr)
|
||||
if err != nil {
|
||||
// fallbackAddr does not have port suffix
|
||||
fallbackServerAddr = net.JoinHostPort(fallbackAddr, defaultHTTPSPort)
|
||||
} else {
|
||||
// FallbackServerAddr already has port suffix
|
||||
fallbackServerAddr = fallbackAddr
|
||||
}
|
||||
return fallbackServerAddr, nil
|
||||
}
|
||||
119
vendor/github.com/google/s2a-go/internal/authinfo/authinfo.go
generated
vendored
Normal file
119
vendor/github.com/google/s2a-go/internal/authinfo/authinfo.go
generated
vendored
Normal file
|
|
@ -0,0 +1,119 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package authinfo provides authentication and authorization information that
|
||||
// results from the TLS handshake.
|
||||
package authinfo
|
||||
|
||||
import (
|
||||
"errors"
|
||||
|
||||
commonpb "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
contextpb "github.com/google/s2a-go/internal/proto/s2a_context_go_proto"
|
||||
grpcpb "github.com/google/s2a-go/internal/proto/s2a_go_proto"
|
||||
"google.golang.org/grpc/credentials"
|
||||
)
|
||||
|
||||
var _ credentials.AuthInfo = (*S2AAuthInfo)(nil)
|
||||
|
||||
const s2aAuthType = "s2a"
|
||||
|
||||
// S2AAuthInfo exposes authentication and authorization information from the
|
||||
// S2A session result to the gRPC stack.
|
||||
type S2AAuthInfo struct {
|
||||
s2aContext *contextpb.S2AContext
|
||||
commonAuthInfo credentials.CommonAuthInfo
|
||||
}
|
||||
|
||||
// NewS2AAuthInfo returns a new S2AAuthInfo object from the S2A session result.
|
||||
func NewS2AAuthInfo(result *grpcpb.SessionResult) (credentials.AuthInfo, error) {
|
||||
return newS2AAuthInfo(result)
|
||||
}
|
||||
|
||||
func newS2AAuthInfo(result *grpcpb.SessionResult) (*S2AAuthInfo, error) {
|
||||
if result == nil {
|
||||
return nil, errors.New("NewS2aAuthInfo given nil session result")
|
||||
}
|
||||
return &S2AAuthInfo{
|
||||
s2aContext: &contextpb.S2AContext{
|
||||
ApplicationProtocol: result.GetApplicationProtocol(),
|
||||
TlsVersion: result.GetState().GetTlsVersion(),
|
||||
Ciphersuite: result.GetState().GetTlsCiphersuite(),
|
||||
PeerIdentity: result.GetPeerIdentity(),
|
||||
LocalIdentity: result.GetLocalIdentity(),
|
||||
PeerCertFingerprint: result.GetPeerCertFingerprint(),
|
||||
LocalCertFingerprint: result.GetLocalCertFingerprint(),
|
||||
IsHandshakeResumed: result.GetState().GetIsHandshakeResumed(),
|
||||
},
|
||||
commonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.PrivacyAndIntegrity},
|
||||
}, nil
|
||||
}
|
||||
|
||||
// AuthType returns the authentication type.
|
||||
func (s *S2AAuthInfo) AuthType() string {
|
||||
return s2aAuthType
|
||||
}
|
||||
|
||||
// ApplicationProtocol returns the application protocol, e.g. "grpc".
|
||||
func (s *S2AAuthInfo) ApplicationProtocol() string {
|
||||
return s.s2aContext.GetApplicationProtocol()
|
||||
}
|
||||
|
||||
// TLSVersion returns the TLS version negotiated during the handshake.
|
||||
func (s *S2AAuthInfo) TLSVersion() commonpb.TLSVersion {
|
||||
return s.s2aContext.GetTlsVersion()
|
||||
}
|
||||
|
||||
// Ciphersuite returns the ciphersuite negotiated during the handshake.
|
||||
func (s *S2AAuthInfo) Ciphersuite() commonpb.Ciphersuite {
|
||||
return s.s2aContext.GetCiphersuite()
|
||||
}
|
||||
|
||||
// PeerIdentity returns the authenticated identity of the peer.
|
||||
func (s *S2AAuthInfo) PeerIdentity() *commonpb.Identity {
|
||||
return s.s2aContext.GetPeerIdentity()
|
||||
}
|
||||
|
||||
// LocalIdentity returns the local identity of the application used during
|
||||
// session setup.
|
||||
func (s *S2AAuthInfo) LocalIdentity() *commonpb.Identity {
|
||||
return s.s2aContext.GetLocalIdentity()
|
||||
}
|
||||
|
||||
// PeerCertFingerprint returns the SHA256 hash of the peer certificate used in
|
||||
// the S2A handshake.
|
||||
func (s *S2AAuthInfo) PeerCertFingerprint() []byte {
|
||||
return s.s2aContext.GetPeerCertFingerprint()
|
||||
}
|
||||
|
||||
// LocalCertFingerprint returns the SHA256 hash of the local certificate used
|
||||
// in the S2A handshake.
|
||||
func (s *S2AAuthInfo) LocalCertFingerprint() []byte {
|
||||
return s.s2aContext.GetLocalCertFingerprint()
|
||||
}
|
||||
|
||||
// IsHandshakeResumed returns true if a cached session was used to resume
|
||||
// the handshake.
|
||||
func (s *S2AAuthInfo) IsHandshakeResumed() bool {
|
||||
return s.s2aContext.GetIsHandshakeResumed()
|
||||
}
|
||||
|
||||
// SecurityLevel returns the security level of the connection.
|
||||
func (s *S2AAuthInfo) SecurityLevel() credentials.SecurityLevel {
|
||||
return s.commonAuthInfo.SecurityLevel
|
||||
}
|
||||
438
vendor/github.com/google/s2a-go/internal/handshaker/handshaker.go
generated
vendored
Normal file
438
vendor/github.com/google/s2a-go/internal/handshaker/handshaker.go
generated
vendored
Normal file
|
|
@ -0,0 +1,438 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package handshaker communicates with the S2A handshaker service.
|
||||
package handshaker
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net"
|
||||
"sync"
|
||||
|
||||
"github.com/google/s2a-go/internal/authinfo"
|
||||
commonpb "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
s2apb "github.com/google/s2a-go/internal/proto/s2a_go_proto"
|
||||
"github.com/google/s2a-go/internal/record"
|
||||
"github.com/google/s2a-go/internal/tokenmanager"
|
||||
grpc "google.golang.org/grpc"
|
||||
"google.golang.org/grpc/codes"
|
||||
"google.golang.org/grpc/credentials"
|
||||
"google.golang.org/grpc/grpclog"
|
||||
)
|
||||
|
||||
var (
|
||||
// appProtocol contains the application protocol accepted by the handshaker.
|
||||
appProtocol = "grpc"
|
||||
// frameLimit is the maximum size of a frame in bytes.
|
||||
frameLimit = 1024 * 64
|
||||
// peerNotRespondingError is the error thrown when the peer doesn't respond.
|
||||
errPeerNotResponding = errors.New("peer is not responding and re-connection should be attempted")
|
||||
)
|
||||
|
||||
// Handshaker defines a handshaker interface.
|
||||
type Handshaker interface {
|
||||
// ClientHandshake starts and completes a TLS handshake from the client side,
|
||||
// and returns a secure connection along with additional auth information.
|
||||
ClientHandshake(ctx context.Context) (net.Conn, credentials.AuthInfo, error)
|
||||
// ServerHandshake starts and completes a TLS handshake from the server side,
|
||||
// and returns a secure connection along with additional auth information.
|
||||
ServerHandshake(ctx context.Context) (net.Conn, credentials.AuthInfo, error)
|
||||
// Close terminates the Handshaker. It should be called when the handshake
|
||||
// is complete.
|
||||
Close() error
|
||||
}
|
||||
|
||||
// ClientHandshakerOptions contains the options needed to configure the S2A
|
||||
// handshaker service on the client-side.
|
||||
type ClientHandshakerOptions struct {
|
||||
// MinTLSVersion specifies the min TLS version supported by the client.
|
||||
MinTLSVersion commonpb.TLSVersion
|
||||
// MaxTLSVersion specifies the max TLS version supported by the client.
|
||||
MaxTLSVersion commonpb.TLSVersion
|
||||
// TLSCiphersuites is the ordered list of ciphersuites supported by the
|
||||
// client.
|
||||
TLSCiphersuites []commonpb.Ciphersuite
|
||||
// TargetIdentities contains a list of allowed server identities. One of the
|
||||
// target identities should match the peer identity in the handshake
|
||||
// result; otherwise, the handshake fails.
|
||||
TargetIdentities []*commonpb.Identity
|
||||
// LocalIdentity is the local identity of the client application. If none is
|
||||
// provided, then the S2A will choose the default identity.
|
||||
LocalIdentity *commonpb.Identity
|
||||
// TargetName is the allowed server name, which may be used for server
|
||||
// authorization check by the S2A if it is provided.
|
||||
TargetName string
|
||||
// EnsureProcessSessionTickets allows users to wait and ensure that all
|
||||
// available session tickets are sent to S2A before a process completes.
|
||||
EnsureProcessSessionTickets *sync.WaitGroup
|
||||
}
|
||||
|
||||
// ServerHandshakerOptions contains the options needed to configure the S2A
|
||||
// handshaker service on the server-side.
|
||||
type ServerHandshakerOptions struct {
|
||||
// MinTLSVersion specifies the min TLS version supported by the server.
|
||||
MinTLSVersion commonpb.TLSVersion
|
||||
// MaxTLSVersion specifies the max TLS version supported by the server.
|
||||
MaxTLSVersion commonpb.TLSVersion
|
||||
// TLSCiphersuites is the ordered list of ciphersuites supported by the
|
||||
// server.
|
||||
TLSCiphersuites []commonpb.Ciphersuite
|
||||
// LocalIdentities is the list of local identities that may be assumed by
|
||||
// the server. If no local identity is specified, then the S2A chooses a
|
||||
// default local identity.
|
||||
LocalIdentities []*commonpb.Identity
|
||||
}
|
||||
|
||||
// s2aHandshaker performs a TLS handshake using the S2A handshaker service.
|
||||
type s2aHandshaker struct {
|
||||
// stream is used to communicate with the S2A handshaker service.
|
||||
stream s2apb.S2AService_SetUpSessionClient
|
||||
// conn is the connection to the peer.
|
||||
conn net.Conn
|
||||
// clientOpts should be non-nil iff the handshaker is client-side.
|
||||
clientOpts *ClientHandshakerOptions
|
||||
// serverOpts should be non-nil iff the handshaker is server-side.
|
||||
serverOpts *ServerHandshakerOptions
|
||||
// isClient determines if the handshaker is client or server side.
|
||||
isClient bool
|
||||
// hsAddr stores the address of the S2A handshaker service.
|
||||
hsAddr string
|
||||
// tokenManager manages access tokens for authenticating to S2A.
|
||||
tokenManager tokenmanager.AccessTokenManager
|
||||
// localIdentities is the set of local identities for whom the
|
||||
// tokenManager should fetch a token when preparing a request to be
|
||||
// sent to S2A.
|
||||
localIdentities []*commonpb.Identity
|
||||
}
|
||||
|
||||
// NewClientHandshaker creates an s2aHandshaker instance that performs a
|
||||
// client-side TLS handshake using the S2A handshaker service.
|
||||
func NewClientHandshaker(ctx context.Context, conn *grpc.ClientConn, c net.Conn, hsAddr string, opts *ClientHandshakerOptions) (Handshaker, error) {
|
||||
stream, err := s2apb.NewS2AServiceClient(conn).SetUpSession(ctx, grpc.WaitForReady(true))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
tokenManager, err := tokenmanager.NewSingleTokenAccessTokenManager()
|
||||
if err != nil {
|
||||
grpclog.Infof("failed to create single token access token manager: %v", err)
|
||||
}
|
||||
return newClientHandshaker(stream, c, hsAddr, opts, tokenManager), nil
|
||||
}
|
||||
|
||||
func newClientHandshaker(stream s2apb.S2AService_SetUpSessionClient, c net.Conn, hsAddr string, opts *ClientHandshakerOptions, tokenManager tokenmanager.AccessTokenManager) *s2aHandshaker {
|
||||
var localIdentities []*commonpb.Identity
|
||||
if opts != nil {
|
||||
localIdentities = []*commonpb.Identity{opts.LocalIdentity}
|
||||
}
|
||||
return &s2aHandshaker{
|
||||
stream: stream,
|
||||
conn: c,
|
||||
clientOpts: opts,
|
||||
isClient: true,
|
||||
hsAddr: hsAddr,
|
||||
tokenManager: tokenManager,
|
||||
localIdentities: localIdentities,
|
||||
}
|
||||
}
|
||||
|
||||
// NewServerHandshaker creates an s2aHandshaker instance that performs a
|
||||
// server-side TLS handshake using the S2A handshaker service.
|
||||
func NewServerHandshaker(ctx context.Context, conn *grpc.ClientConn, c net.Conn, hsAddr string, opts *ServerHandshakerOptions) (Handshaker, error) {
|
||||
stream, err := s2apb.NewS2AServiceClient(conn).SetUpSession(ctx, grpc.WaitForReady(true))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
tokenManager, err := tokenmanager.NewSingleTokenAccessTokenManager()
|
||||
if err != nil {
|
||||
grpclog.Infof("failed to create single token access token manager: %v", err)
|
||||
}
|
||||
return newServerHandshaker(stream, c, hsAddr, opts, tokenManager), nil
|
||||
}
|
||||
|
||||
func newServerHandshaker(stream s2apb.S2AService_SetUpSessionClient, c net.Conn, hsAddr string, opts *ServerHandshakerOptions, tokenManager tokenmanager.AccessTokenManager) *s2aHandshaker {
|
||||
var localIdentities []*commonpb.Identity
|
||||
if opts != nil {
|
||||
localIdentities = opts.LocalIdentities
|
||||
}
|
||||
return &s2aHandshaker{
|
||||
stream: stream,
|
||||
conn: c,
|
||||
serverOpts: opts,
|
||||
isClient: false,
|
||||
hsAddr: hsAddr,
|
||||
tokenManager: tokenManager,
|
||||
localIdentities: localIdentities,
|
||||
}
|
||||
}
|
||||
|
||||
// ClientHandshake performs a client-side TLS handshake using the S2A handshaker
|
||||
// service. When complete, returns a TLS connection.
|
||||
func (h *s2aHandshaker) ClientHandshake(_ context.Context) (net.Conn, credentials.AuthInfo, error) {
|
||||
if !h.isClient {
|
||||
return nil, nil, errors.New("only handshakers created using NewClientHandshaker can perform a client-side handshake")
|
||||
}
|
||||
// Extract the hostname from the target name. The target name is assumed to be an authority.
|
||||
hostname, _, err := net.SplitHostPort(h.clientOpts.TargetName)
|
||||
if err != nil {
|
||||
// If the target name had no host port or could not be parsed, use it as is.
|
||||
hostname = h.clientOpts.TargetName
|
||||
}
|
||||
|
||||
// Prepare a client start message to send to the S2A handshaker service.
|
||||
req := &s2apb.SessionReq{
|
||||
ReqOneof: &s2apb.SessionReq_ClientStart{
|
||||
ClientStart: &s2apb.ClientSessionStartReq{
|
||||
ApplicationProtocols: []string{appProtocol},
|
||||
MinTlsVersion: h.clientOpts.MinTLSVersion,
|
||||
MaxTlsVersion: h.clientOpts.MaxTLSVersion,
|
||||
TlsCiphersuites: h.clientOpts.TLSCiphersuites,
|
||||
TargetIdentities: h.clientOpts.TargetIdentities,
|
||||
LocalIdentity: h.clientOpts.LocalIdentity,
|
||||
TargetName: hostname,
|
||||
},
|
||||
},
|
||||
AuthMechanisms: h.getAuthMechanisms(),
|
||||
}
|
||||
conn, result, err := h.setUpSession(req)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
authInfo, err := authinfo.NewS2AAuthInfo(result)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return conn, authInfo, nil
|
||||
}
|
||||
|
||||
// ServerHandshake performs a server-side TLS handshake using the S2A handshaker
|
||||
// service. When complete, returns a TLS connection.
|
||||
func (h *s2aHandshaker) ServerHandshake(_ context.Context) (net.Conn, credentials.AuthInfo, error) {
|
||||
if h.isClient {
|
||||
return nil, nil, errors.New("only handshakers created using NewServerHandshaker can perform a server-side handshake")
|
||||
}
|
||||
p := make([]byte, frameLimit)
|
||||
n, err := h.conn.Read(p)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
// Prepare a server start message to send to the S2A handshaker service.
|
||||
req := &s2apb.SessionReq{
|
||||
ReqOneof: &s2apb.SessionReq_ServerStart{
|
||||
ServerStart: &s2apb.ServerSessionStartReq{
|
||||
ApplicationProtocols: []string{appProtocol},
|
||||
MinTlsVersion: h.serverOpts.MinTLSVersion,
|
||||
MaxTlsVersion: h.serverOpts.MaxTLSVersion,
|
||||
TlsCiphersuites: h.serverOpts.TLSCiphersuites,
|
||||
LocalIdentities: h.serverOpts.LocalIdentities,
|
||||
InBytes: p[:n],
|
||||
},
|
||||
},
|
||||
AuthMechanisms: h.getAuthMechanisms(),
|
||||
}
|
||||
conn, result, err := h.setUpSession(req)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
authInfo, err := authinfo.NewS2AAuthInfo(result)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return conn, authInfo, nil
|
||||
}
|
||||
|
||||
// setUpSession proxies messages between the peer and the S2A handshaker
|
||||
// service.
|
||||
func (h *s2aHandshaker) setUpSession(req *s2apb.SessionReq) (net.Conn, *s2apb.SessionResult, error) {
|
||||
resp, err := h.accessHandshakerService(req)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
// Check if the returned status is an error.
|
||||
if resp.GetStatus() != nil {
|
||||
if got, want := resp.GetStatus().Code, uint32(codes.OK); got != want {
|
||||
return nil, nil, fmt.Errorf("%v", resp.GetStatus().Details)
|
||||
}
|
||||
}
|
||||
// Calculate the extra unread bytes from the Session. Attempting to consume
|
||||
// more than the bytes sent will throw an error.
|
||||
var extra []byte
|
||||
if req.GetServerStart() != nil {
|
||||
if resp.GetBytesConsumed() > uint32(len(req.GetServerStart().GetInBytes())) {
|
||||
return nil, nil, errors.New("handshaker service consumed bytes value is out-of-bounds")
|
||||
}
|
||||
extra = req.GetServerStart().GetInBytes()[resp.GetBytesConsumed():]
|
||||
}
|
||||
result, extra, err := h.processUntilDone(resp, extra)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
if result.GetLocalIdentity() == nil {
|
||||
return nil, nil, errors.New("local identity must be populated in session result")
|
||||
}
|
||||
|
||||
// Create a new TLS record protocol using the Session Result.
|
||||
newConn, err := record.NewConn(&record.ConnParameters{
|
||||
NetConn: h.conn,
|
||||
Ciphersuite: result.GetState().GetTlsCiphersuite(),
|
||||
TLSVersion: result.GetState().GetTlsVersion(),
|
||||
InTrafficSecret: result.GetState().GetInKey(),
|
||||
OutTrafficSecret: result.GetState().GetOutKey(),
|
||||
UnusedBuf: extra,
|
||||
InSequence: result.GetState().GetInSequence(),
|
||||
OutSequence: result.GetState().GetOutSequence(),
|
||||
HSAddr: h.hsAddr,
|
||||
ConnectionID: result.GetState().GetConnectionId(),
|
||||
LocalIdentity: result.GetLocalIdentity(),
|
||||
EnsureProcessSessionTickets: h.ensureProcessSessionTickets(),
|
||||
})
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return newConn, result, nil
|
||||
}
|
||||
|
||||
func (h *s2aHandshaker) ensureProcessSessionTickets() *sync.WaitGroup {
|
||||
if h.clientOpts == nil {
|
||||
return nil
|
||||
}
|
||||
return h.clientOpts.EnsureProcessSessionTickets
|
||||
}
|
||||
|
||||
// accessHandshakerService sends the session request to the S2A handshaker
|
||||
// service and returns the session response.
|
||||
func (h *s2aHandshaker) accessHandshakerService(req *s2apb.SessionReq) (*s2apb.SessionResp, error) {
|
||||
if err := h.stream.Send(req); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
resp, err := h.stream.Recv()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return resp, nil
|
||||
}
|
||||
|
||||
// processUntilDone continues proxying messages between the peer and the S2A
|
||||
// handshaker service until the handshaker service returns the SessionResult at
|
||||
// the end of the handshake or an error occurs.
|
||||
func (h *s2aHandshaker) processUntilDone(resp *s2apb.SessionResp, unusedBytes []byte) (*s2apb.SessionResult, []byte, error) {
|
||||
for {
|
||||
if len(resp.OutFrames) > 0 {
|
||||
if _, err := h.conn.Write(resp.OutFrames); err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
}
|
||||
if resp.Result != nil {
|
||||
return resp.Result, unusedBytes, nil
|
||||
}
|
||||
buf := make([]byte, frameLimit)
|
||||
n, err := h.conn.Read(buf)
|
||||
if err != nil && err != io.EOF {
|
||||
return nil, nil, err
|
||||
}
|
||||
// If there is nothing to send to the handshaker service and nothing is
|
||||
// received from the peer, then we are stuck. This covers the case when
|
||||
// the peer is not responding. Note that handshaker service connection
|
||||
// issues are caught in accessHandshakerService before we even get
|
||||
// here.
|
||||
if len(resp.OutFrames) == 0 && n == 0 {
|
||||
return nil, nil, errPeerNotResponding
|
||||
}
|
||||
// Append extra bytes from the previous interaction with the handshaker
|
||||
// service with the current buffer read from conn.
|
||||
p := append(unusedBytes, buf[:n]...)
|
||||
// From here on, p and unusedBytes point to the same slice.
|
||||
resp, err = h.accessHandshakerService(&s2apb.SessionReq{
|
||||
ReqOneof: &s2apb.SessionReq_Next{
|
||||
Next: &s2apb.SessionNextReq{
|
||||
InBytes: p,
|
||||
},
|
||||
},
|
||||
AuthMechanisms: h.getAuthMechanisms(),
|
||||
})
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
// Cache the local identity returned by S2A, if it is populated. This
|
||||
// overwrites any existing local identities. This is done because, once the
|
||||
// S2A has selected a local identity, then only that local identity should
|
||||
// be asserted in future requests until the end of the current handshake.
|
||||
if resp.GetLocalIdentity() != nil {
|
||||
h.localIdentities = []*commonpb.Identity{resp.GetLocalIdentity()}
|
||||
}
|
||||
|
||||
// Set unusedBytes based on the handshaker service response.
|
||||
if resp.GetBytesConsumed() > uint32(len(p)) {
|
||||
return nil, nil, errors.New("handshaker service consumed bytes value is out-of-bounds")
|
||||
}
|
||||
unusedBytes = p[resp.GetBytesConsumed():]
|
||||
}
|
||||
}
|
||||
|
||||
// Close shuts down the handshaker and the stream to the S2A handshaker service
|
||||
// when the handshake is complete. It should be called when the caller obtains
|
||||
// the secure connection at the end of the handshake.
|
||||
func (h *s2aHandshaker) Close() error {
|
||||
return h.stream.CloseSend()
|
||||
}
|
||||
|
||||
func (h *s2aHandshaker) getAuthMechanisms() []*s2apb.AuthenticationMechanism {
|
||||
if h.tokenManager == nil {
|
||||
return nil
|
||||
}
|
||||
// First handle the special case when no local identities have been provided
|
||||
// by the application. In this case, an AuthenticationMechanism with no local
|
||||
// identity will be sent.
|
||||
if len(h.localIdentities) == 0 {
|
||||
token, err := h.tokenManager.DefaultToken()
|
||||
if err != nil {
|
||||
grpclog.Infof("unable to get token for empty local identity: %v", err)
|
||||
return nil
|
||||
}
|
||||
return []*s2apb.AuthenticationMechanism{
|
||||
{
|
||||
MechanismOneof: &s2apb.AuthenticationMechanism_Token{
|
||||
Token: token,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// Next, handle the case where the application (or the S2A) has provided
|
||||
// one or more local identities.
|
||||
var authMechanisms []*s2apb.AuthenticationMechanism
|
||||
for _, localIdentity := range h.localIdentities {
|
||||
token, err := h.tokenManager.Token(localIdentity)
|
||||
if err != nil {
|
||||
grpclog.Infof("unable to get token for local identity %v: %v", localIdentity, err)
|
||||
continue
|
||||
}
|
||||
|
||||
authMechanism := &s2apb.AuthenticationMechanism{
|
||||
Identity: localIdentity,
|
||||
MechanismOneof: &s2apb.AuthenticationMechanism_Token{
|
||||
Token: token,
|
||||
},
|
||||
}
|
||||
authMechanisms = append(authMechanisms, authMechanism)
|
||||
}
|
||||
return authMechanisms
|
||||
}
|
||||
92
vendor/github.com/google/s2a-go/internal/handshaker/service/service.go
generated
vendored
Normal file
92
vendor/github.com/google/s2a-go/internal/handshaker/service/service.go
generated
vendored
Normal file
|
|
@ -0,0 +1,92 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package service is a utility for calling the S2A handshaker service.
|
||||
package service
|
||||
|
||||
import (
|
||||
"context"
|
||||
"flag"
|
||||
"net"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"google.golang.org/appengine"
|
||||
"google.golang.org/appengine/socket"
|
||||
grpc "google.golang.org/grpc"
|
||||
"google.golang.org/grpc/grpclog"
|
||||
)
|
||||
|
||||
var (
|
||||
// enableAppEngineDialer indicates whether an AppEngine-specific dial option
|
||||
// should be used.
|
||||
enableAppEngineDialer bool
|
||||
// appEngineDialerHook is an AppEngine-specific dial option that is set
|
||||
// during init time. If nil, then the application is not running on Google
|
||||
// AppEngine.
|
||||
appEngineDialerHook func(context.Context) grpc.DialOption
|
||||
// mu guards hsConnMap and hsDialer.
|
||||
mu sync.Mutex
|
||||
// hsConnMap represents a mapping from an S2A handshaker service address
|
||||
// to a corresponding connection to an S2A handshaker service instance.
|
||||
hsConnMap = make(map[string]*grpc.ClientConn)
|
||||
// hsDialer will be reassigned in tests.
|
||||
hsDialer = grpc.Dial
|
||||
)
|
||||
|
||||
func init() {
|
||||
flag.BoolVar(&enableAppEngineDialer, "s2a_enable_appengine_dialer", false, "If true, opportunistically use AppEngine-specific dialer to call S2A.")
|
||||
if !appengine.IsAppEngine() && !appengine.IsDevAppServer() {
|
||||
return
|
||||
}
|
||||
appEngineDialerHook = func(ctx context.Context) grpc.DialOption {
|
||||
return grpc.WithDialer(func(addr string, timeout time.Duration) (net.Conn, error) {
|
||||
return socket.DialTimeout(ctx, "tcp", addr, timeout)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// Dial dials the S2A handshaker service. If a connection has already been
|
||||
// established, this function returns it. Otherwise, a new connection is
|
||||
// created.
|
||||
func Dial(handshakerServiceAddress string) (*grpc.ClientConn, error) {
|
||||
mu.Lock()
|
||||
defer mu.Unlock()
|
||||
|
||||
hsConn, ok := hsConnMap[handshakerServiceAddress]
|
||||
if !ok {
|
||||
// Create a new connection to the S2A handshaker service. Note that
|
||||
// this connection stays open until the application is closed.
|
||||
grpcOpts := []grpc.DialOption{
|
||||
grpc.WithInsecure(),
|
||||
}
|
||||
if enableAppEngineDialer && appEngineDialerHook != nil {
|
||||
if grpclog.V(1) {
|
||||
grpclog.Info("Using AppEngine-specific dialer to talk to S2A.")
|
||||
}
|
||||
grpcOpts = append(grpcOpts, appEngineDialerHook(context.Background()))
|
||||
}
|
||||
var err error
|
||||
hsConn, err = hsDialer(handshakerServiceAddress, grpcOpts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
hsConnMap[handshakerServiceAddress] = hsConn
|
||||
}
|
||||
return hsConn, nil
|
||||
}
|
||||
389
vendor/github.com/google/s2a-go/internal/proto/common_go_proto/common.pb.go
generated
vendored
Normal file
389
vendor/github.com/google/s2a-go/internal/proto/common_go_proto/common.pb.go
generated
vendored
Normal file
|
|
@ -0,0 +1,389 @@
|
|||
// Copyright 2021 Google LLC
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// https://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
// Code generated by protoc-gen-go. DO NOT EDIT.
|
||||
// versions:
|
||||
// protoc-gen-go v1.30.0
|
||||
// protoc v3.21.12
|
||||
// source: internal/proto/common/common.proto
|
||||
|
||||
package common_go_proto
|
||||
|
||||
import (
|
||||
protoreflect "google.golang.org/protobuf/reflect/protoreflect"
|
||||
protoimpl "google.golang.org/protobuf/runtime/protoimpl"
|
||||
reflect "reflect"
|
||||
sync "sync"
|
||||
)
|
||||
|
||||
const (
|
||||
// Verify that this generated code is sufficiently up-to-date.
|
||||
_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
|
||||
// Verify that runtime/protoimpl is sufficiently up-to-date.
|
||||
_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
|
||||
)
|
||||
|
||||
// The ciphersuites supported by S2A. The name determines the confidentiality,
|
||||
// and authentication ciphers as well as the hash algorithm used for PRF in
|
||||
// TLS 1.2 or HKDF in TLS 1.3. Thus, the components of the name are:
|
||||
// - AEAD -- for encryption and authentication, e.g., AES_128_GCM.
|
||||
// - Hash algorithm -- used in PRF or HKDF, e.g., SHA256.
|
||||
type Ciphersuite int32
|
||||
|
||||
const (
|
||||
Ciphersuite_AES_128_GCM_SHA256 Ciphersuite = 0
|
||||
Ciphersuite_AES_256_GCM_SHA384 Ciphersuite = 1
|
||||
Ciphersuite_CHACHA20_POLY1305_SHA256 Ciphersuite = 2
|
||||
)
|
||||
|
||||
// Enum value maps for Ciphersuite.
|
||||
var (
|
||||
Ciphersuite_name = map[int32]string{
|
||||
0: "AES_128_GCM_SHA256",
|
||||
1: "AES_256_GCM_SHA384",
|
||||
2: "CHACHA20_POLY1305_SHA256",
|
||||
}
|
||||
Ciphersuite_value = map[string]int32{
|
||||
"AES_128_GCM_SHA256": 0,
|
||||
"AES_256_GCM_SHA384": 1,
|
||||
"CHACHA20_POLY1305_SHA256": 2,
|
||||
}
|
||||
)
|
||||
|
||||
func (x Ciphersuite) Enum() *Ciphersuite {
|
||||
p := new(Ciphersuite)
|
||||
*p = x
|
||||
return p
|
||||
}
|
||||
|
||||
func (x Ciphersuite) String() string {
|
||||
return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
|
||||
}
|
||||
|
||||
func (Ciphersuite) Descriptor() protoreflect.EnumDescriptor {
|
||||
return file_internal_proto_common_common_proto_enumTypes[0].Descriptor()
|
||||
}
|
||||
|
||||
func (Ciphersuite) Type() protoreflect.EnumType {
|
||||
return &file_internal_proto_common_common_proto_enumTypes[0]
|
||||
}
|
||||
|
||||
func (x Ciphersuite) Number() protoreflect.EnumNumber {
|
||||
return protoreflect.EnumNumber(x)
|
||||
}
|
||||
|
||||
// Deprecated: Use Ciphersuite.Descriptor instead.
|
||||
func (Ciphersuite) EnumDescriptor() ([]byte, []int) {
|
||||
return file_internal_proto_common_common_proto_rawDescGZIP(), []int{0}
|
||||
}
|
||||
|
||||
// The TLS versions supported by S2A's handshaker module.
|
||||
type TLSVersion int32
|
||||
|
||||
const (
|
||||
TLSVersion_TLS1_2 TLSVersion = 0
|
||||
TLSVersion_TLS1_3 TLSVersion = 1
|
||||
)
|
||||
|
||||
// Enum value maps for TLSVersion.
|
||||
var (
|
||||
TLSVersion_name = map[int32]string{
|
||||
0: "TLS1_2",
|
||||
1: "TLS1_3",
|
||||
}
|
||||
TLSVersion_value = map[string]int32{
|
||||
"TLS1_2": 0,
|
||||
"TLS1_3": 1,
|
||||
}
|
||||
)
|
||||
|
||||
func (x TLSVersion) Enum() *TLSVersion {
|
||||
p := new(TLSVersion)
|
||||
*p = x
|
||||
return p
|
||||
}
|
||||
|
||||
func (x TLSVersion) String() string {
|
||||
return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
|
||||
}
|
||||
|
||||
func (TLSVersion) Descriptor() protoreflect.EnumDescriptor {
|
||||
return file_internal_proto_common_common_proto_enumTypes[1].Descriptor()
|
||||
}
|
||||
|
||||
func (TLSVersion) Type() protoreflect.EnumType {
|
||||
return &file_internal_proto_common_common_proto_enumTypes[1]
|
||||
}
|
||||
|
||||
func (x TLSVersion) Number() protoreflect.EnumNumber {
|
||||
return protoreflect.EnumNumber(x)
|
||||
}
|
||||
|
||||
// Deprecated: Use TLSVersion.Descriptor instead.
|
||||
func (TLSVersion) EnumDescriptor() ([]byte, []int) {
|
||||
return file_internal_proto_common_common_proto_rawDescGZIP(), []int{1}
|
||||
}
|
||||
|
||||
type Identity struct {
|
||||
state protoimpl.MessageState
|
||||
sizeCache protoimpl.SizeCache
|
||||
unknownFields protoimpl.UnknownFields
|
||||
|
||||
// Types that are assignable to IdentityOneof:
|
||||
//
|
||||
// *Identity_SpiffeId
|
||||
// *Identity_Hostname
|
||||
// *Identity_Uid
|
||||
// *Identity_MdbUsername
|
||||
// *Identity_GaiaId
|
||||
IdentityOneof isIdentity_IdentityOneof `protobuf_oneof:"identity_oneof"`
|
||||
// Additional identity-specific attributes.
|
||||
Attributes map[string]string `protobuf:"bytes,3,rep,name=attributes,proto3" json:"attributes,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
|
||||
}
|
||||
|
||||
func (x *Identity) Reset() {
|
||||
*x = Identity{}
|
||||
if protoimpl.UnsafeEnabled {
|
||||
mi := &file_internal_proto_common_common_proto_msgTypes[0]
|
||||
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||
ms.StoreMessageInfo(mi)
|
||||
}
|
||||
}
|
||||
|
||||
func (x *Identity) String() string {
|
||||
return protoimpl.X.MessageStringOf(x)
|
||||
}
|
||||
|
||||
func (*Identity) ProtoMessage() {}
|
||||
|
||||
func (x *Identity) ProtoReflect() protoreflect.Message {
|
||||
mi := &file_internal_proto_common_common_proto_msgTypes[0]
|
||||
if protoimpl.UnsafeEnabled && x != nil {
|
||||
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||
if ms.LoadMessageInfo() == nil {
|
||||
ms.StoreMessageInfo(mi)
|
||||
}
|
||||
return ms
|
||||
}
|
||||
return mi.MessageOf(x)
|
||||
}
|
||||
|
||||
// Deprecated: Use Identity.ProtoReflect.Descriptor instead.
|
||||
func (*Identity) Descriptor() ([]byte, []int) {
|
||||
return file_internal_proto_common_common_proto_rawDescGZIP(), []int{0}
|
||||
}
|
||||
|
||||
func (m *Identity) GetIdentityOneof() isIdentity_IdentityOneof {
|
||||
if m != nil {
|
||||
return m.IdentityOneof
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (x *Identity) GetSpiffeId() string {
|
||||
if x, ok := x.GetIdentityOneof().(*Identity_SpiffeId); ok {
|
||||
return x.SpiffeId
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func (x *Identity) GetHostname() string {
|
||||
if x, ok := x.GetIdentityOneof().(*Identity_Hostname); ok {
|
||||
return x.Hostname
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func (x *Identity) GetUid() string {
|
||||
if x, ok := x.GetIdentityOneof().(*Identity_Uid); ok {
|
||||
return x.Uid
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func (x *Identity) GetMdbUsername() string {
|
||||
if x, ok := x.GetIdentityOneof().(*Identity_MdbUsername); ok {
|
||||
return x.MdbUsername
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func (x *Identity) GetGaiaId() string {
|
||||
if x, ok := x.GetIdentityOneof().(*Identity_GaiaId); ok {
|
||||
return x.GaiaId
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func (x *Identity) GetAttributes() map[string]string {
|
||||
if x != nil {
|
||||
return x.Attributes
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
type isIdentity_IdentityOneof interface {
|
||||
isIdentity_IdentityOneof()
|
||||
}
|
||||
|
||||
type Identity_SpiffeId struct {
|
||||
// The SPIFFE ID of a connection endpoint.
|
||||
SpiffeId string `protobuf:"bytes,1,opt,name=spiffe_id,json=spiffeId,proto3,oneof"`
|
||||
}
|
||||
|
||||
type Identity_Hostname struct {
|
||||
// The hostname of a connection endpoint.
|
||||
Hostname string `protobuf:"bytes,2,opt,name=hostname,proto3,oneof"`
|
||||
}
|
||||
|
||||
type Identity_Uid struct {
|
||||
// The UID of a connection endpoint.
|
||||
Uid string `protobuf:"bytes,4,opt,name=uid,proto3,oneof"`
|
||||
}
|
||||
|
||||
type Identity_MdbUsername struct {
|
||||
// The MDB username of a connection endpoint.
|
||||
MdbUsername string `protobuf:"bytes,5,opt,name=mdb_username,json=mdbUsername,proto3,oneof"`
|
||||
}
|
||||
|
||||
type Identity_GaiaId struct {
|
||||
// The Gaia ID of a connection endpoint.
|
||||
GaiaId string `protobuf:"bytes,6,opt,name=gaia_id,json=gaiaId,proto3,oneof"`
|
||||
}
|
||||
|
||||
func (*Identity_SpiffeId) isIdentity_IdentityOneof() {}
|
||||
|
||||
func (*Identity_Hostname) isIdentity_IdentityOneof() {}
|
||||
|
||||
func (*Identity_Uid) isIdentity_IdentityOneof() {}
|
||||
|
||||
func (*Identity_MdbUsername) isIdentity_IdentityOneof() {}
|
||||
|
||||
func (*Identity_GaiaId) isIdentity_IdentityOneof() {}
|
||||
|
||||
var File_internal_proto_common_common_proto protoreflect.FileDescriptor
|
||||
|
||||
var file_internal_proto_common_common_proto_rawDesc = []byte{
|
||||
0x0a, 0x22, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
|
||||
0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70,
|
||||
0x72, 0x6f, 0x74, 0x6f, 0x12, 0x09, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
|
||||
0xb1, 0x02, 0x0a, 0x08, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x1d, 0x0a, 0x09,
|
||||
0x73, 0x70, 0x69, 0x66, 0x66, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48,
|
||||
0x00, 0x52, 0x08, 0x73, 0x70, 0x69, 0x66, 0x66, 0x65, 0x49, 0x64, 0x12, 0x1c, 0x0a, 0x08, 0x68,
|
||||
0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52,
|
||||
0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x03, 0x75, 0x69, 0x64,
|
||||
0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x03, 0x75, 0x69, 0x64, 0x12, 0x23, 0x0a,
|
||||
0x0c, 0x6d, 0x64, 0x62, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x05, 0x20,
|
||||
0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0b, 0x6d, 0x64, 0x62, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61,
|
||||
0x6d, 0x65, 0x12, 0x19, 0x0a, 0x07, 0x67, 0x61, 0x69, 0x61, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20,
|
||||
0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x06, 0x67, 0x61, 0x69, 0x61, 0x49, 0x64, 0x12, 0x43, 0x0a,
|
||||
0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
|
||||
0x0b, 0x32, 0x23, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x64,
|
||||
0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x2e, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
|
||||
0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
|
||||
0x65, 0x73, 0x1a, 0x3d, 0x0a, 0x0f, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
|
||||
0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
|
||||
0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
|
||||
0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
|
||||
0x01, 0x42, 0x10, 0x0a, 0x0e, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x6f, 0x6e,
|
||||
0x65, 0x6f, 0x66, 0x2a, 0x5b, 0x0a, 0x0b, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73, 0x75, 0x69,
|
||||
0x74, 0x65, 0x12, 0x16, 0x0a, 0x12, 0x41, 0x45, 0x53, 0x5f, 0x31, 0x32, 0x38, 0x5f, 0x47, 0x43,
|
||||
0x4d, 0x5f, 0x53, 0x48, 0x41, 0x32, 0x35, 0x36, 0x10, 0x00, 0x12, 0x16, 0x0a, 0x12, 0x41, 0x45,
|
||||
0x53, 0x5f, 0x32, 0x35, 0x36, 0x5f, 0x47, 0x43, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x33, 0x38, 0x34,
|
||||
0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18, 0x43, 0x48, 0x41, 0x43, 0x48, 0x41, 0x32, 0x30, 0x5f, 0x50,
|
||||
0x4f, 0x4c, 0x59, 0x31, 0x33, 0x30, 0x35, 0x5f, 0x53, 0x48, 0x41, 0x32, 0x35, 0x36, 0x10, 0x02,
|
||||
0x2a, 0x24, 0x0a, 0x0a, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0a,
|
||||
0x0a, 0x06, 0x54, 0x4c, 0x53, 0x31, 0x5f, 0x32, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x54, 0x4c,
|
||||
0x53, 0x31, 0x5f, 0x33, 0x10, 0x01, 0x42, 0x36, 0x5a, 0x34, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
|
||||
0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x73, 0x32, 0x61, 0x2f,
|
||||
0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x63,
|
||||
0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x67, 0x6f, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06,
|
||||
0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
|
||||
}
|
||||
|
||||
var (
|
||||
file_internal_proto_common_common_proto_rawDescOnce sync.Once
|
||||
file_internal_proto_common_common_proto_rawDescData = file_internal_proto_common_common_proto_rawDesc
|
||||
)
|
||||
|
||||
func file_internal_proto_common_common_proto_rawDescGZIP() []byte {
|
||||
file_internal_proto_common_common_proto_rawDescOnce.Do(func() {
|
||||
file_internal_proto_common_common_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_proto_common_common_proto_rawDescData)
|
||||
})
|
||||
return file_internal_proto_common_common_proto_rawDescData
|
||||
}
|
||||
|
||||
var file_internal_proto_common_common_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
|
||||
var file_internal_proto_common_common_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
|
||||
var file_internal_proto_common_common_proto_goTypes = []interface{}{
|
||||
(Ciphersuite)(0), // 0: s2a.proto.Ciphersuite
|
||||
(TLSVersion)(0), // 1: s2a.proto.TLSVersion
|
||||
(*Identity)(nil), // 2: s2a.proto.Identity
|
||||
nil, // 3: s2a.proto.Identity.AttributesEntry
|
||||
}
|
||||
var file_internal_proto_common_common_proto_depIdxs = []int32{
|
||||
3, // 0: s2a.proto.Identity.attributes:type_name -> s2a.proto.Identity.AttributesEntry
|
||||
1, // [1:1] is the sub-list for method output_type
|
||||
1, // [1:1] is the sub-list for method input_type
|
||||
1, // [1:1] is the sub-list for extension type_name
|
||||
1, // [1:1] is the sub-list for extension extendee
|
||||
0, // [0:1] is the sub-list for field type_name
|
||||
}
|
||||
|
||||
func init() { file_internal_proto_common_common_proto_init() }
|
||||
func file_internal_proto_common_common_proto_init() {
|
||||
if File_internal_proto_common_common_proto != nil {
|
||||
return
|
||||
}
|
||||
if !protoimpl.UnsafeEnabled {
|
||||
file_internal_proto_common_common_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
|
||||
switch v := v.(*Identity); i {
|
||||
case 0:
|
||||
return &v.state
|
||||
case 1:
|
||||
return &v.sizeCache
|
||||
case 2:
|
||||
return &v.unknownFields
|
||||
default:
|
||||
return nil
|
||||
}
|
||||
}
|
||||
}
|
||||
file_internal_proto_common_common_proto_msgTypes[0].OneofWrappers = []interface{}{
|
||||
(*Identity_SpiffeId)(nil),
|
||||
(*Identity_Hostname)(nil),
|
||||
(*Identity_Uid)(nil),
|
||||
(*Identity_MdbUsername)(nil),
|
||||
(*Identity_GaiaId)(nil),
|
||||
}
|
||||
type x struct{}
|
||||
out := protoimpl.TypeBuilder{
|
||||
File: protoimpl.DescBuilder{
|
||||
GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
|
||||
RawDescriptor: file_internal_proto_common_common_proto_rawDesc,
|
||||
NumEnums: 2,
|
||||
NumMessages: 2,
|
||||
NumExtensions: 0,
|
||||
NumServices: 0,
|
||||
},
|
||||
GoTypes: file_internal_proto_common_common_proto_goTypes,
|
||||
DependencyIndexes: file_internal_proto_common_common_proto_depIdxs,
|
||||
EnumInfos: file_internal_proto_common_common_proto_enumTypes,
|
||||
MessageInfos: file_internal_proto_common_common_proto_msgTypes,
|
||||
}.Build()
|
||||
File_internal_proto_common_common_proto = out.File
|
||||
file_internal_proto_common_common_proto_rawDesc = nil
|
||||
file_internal_proto_common_common_proto_goTypes = nil
|
||||
file_internal_proto_common_common_proto_depIdxs = nil
|
||||
}
|
||||
267
vendor/github.com/google/s2a-go/internal/proto/s2a_context_go_proto/s2a_context.pb.go
generated
vendored
Normal file
267
vendor/github.com/google/s2a-go/internal/proto/s2a_context_go_proto/s2a_context.pb.go
generated
vendored
Normal file
|
|
@ -0,0 +1,267 @@
|
|||
// Copyright 2021 Google LLC
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// https://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
// Code generated by protoc-gen-go. DO NOT EDIT.
|
||||
// versions:
|
||||
// protoc-gen-go v1.30.0
|
||||
// protoc v3.21.12
|
||||
// source: internal/proto/s2a_context/s2a_context.proto
|
||||
|
||||
package s2a_context_go_proto
|
||||
|
||||
import (
|
||||
common_go_proto "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
protoreflect "google.golang.org/protobuf/reflect/protoreflect"
|
||||
protoimpl "google.golang.org/protobuf/runtime/protoimpl"
|
||||
reflect "reflect"
|
||||
sync "sync"
|
||||
)
|
||||
|
||||
const (
|
||||
// Verify that this generated code is sufficiently up-to-date.
|
||||
_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
|
||||
// Verify that runtime/protoimpl is sufficiently up-to-date.
|
||||
_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
|
||||
)
|
||||
|
||||
type S2AContext struct {
|
||||
state protoimpl.MessageState
|
||||
sizeCache protoimpl.SizeCache
|
||||
unknownFields protoimpl.UnknownFields
|
||||
|
||||
// The application protocol negotiated for this connection, e.g., 'grpc'.
|
||||
ApplicationProtocol string `protobuf:"bytes,1,opt,name=application_protocol,json=applicationProtocol,proto3" json:"application_protocol,omitempty"`
|
||||
// The TLS version number that the S2A's handshaker module used to set up the
|
||||
// session.
|
||||
TlsVersion common_go_proto.TLSVersion `protobuf:"varint,2,opt,name=tls_version,json=tlsVersion,proto3,enum=s2a.proto.TLSVersion" json:"tls_version,omitempty"`
|
||||
// The TLS ciphersuite negotiated by the S2A's handshaker module.
|
||||
Ciphersuite common_go_proto.Ciphersuite `protobuf:"varint,3,opt,name=ciphersuite,proto3,enum=s2a.proto.Ciphersuite" json:"ciphersuite,omitempty"`
|
||||
// The authenticated identity of the peer.
|
||||
PeerIdentity *common_go_proto.Identity `protobuf:"bytes,4,opt,name=peer_identity,json=peerIdentity,proto3" json:"peer_identity,omitempty"`
|
||||
// The local identity used during session setup. This could be:
|
||||
// - The local identity that the client specifies in ClientSessionStartReq.
|
||||
// - One of the local identities that the server specifies in
|
||||
// ServerSessionStartReq.
|
||||
// - If neither client or server specifies local identities, the S2A picks the
|
||||
// default one. In this case, this field will contain that identity.
|
||||
LocalIdentity *common_go_proto.Identity `protobuf:"bytes,5,opt,name=local_identity,json=localIdentity,proto3" json:"local_identity,omitempty"`
|
||||
// The SHA256 hash of the peer certificate used in the handshake.
|
||||
PeerCertFingerprint []byte `protobuf:"bytes,6,opt,name=peer_cert_fingerprint,json=peerCertFingerprint,proto3" json:"peer_cert_fingerprint,omitempty"`
|
||||
// The SHA256 hash of the local certificate used in the handshake.
|
||||
LocalCertFingerprint []byte `protobuf:"bytes,7,opt,name=local_cert_fingerprint,json=localCertFingerprint,proto3" json:"local_cert_fingerprint,omitempty"`
|
||||
// Set to true if a cached session was reused to resume the handshake.
|
||||
IsHandshakeResumed bool `protobuf:"varint,8,opt,name=is_handshake_resumed,json=isHandshakeResumed,proto3" json:"is_handshake_resumed,omitempty"`
|
||||
}
|
||||
|
||||
func (x *S2AContext) Reset() {
|
||||
*x = S2AContext{}
|
||||
if protoimpl.UnsafeEnabled {
|
||||
mi := &file_internal_proto_s2a_context_s2a_context_proto_msgTypes[0]
|
||||
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||
ms.StoreMessageInfo(mi)
|
||||
}
|
||||
}
|
||||
|
||||
func (x *S2AContext) String() string {
|
||||
return protoimpl.X.MessageStringOf(x)
|
||||
}
|
||||
|
||||
func (*S2AContext) ProtoMessage() {}
|
||||
|
||||
func (x *S2AContext) ProtoReflect() protoreflect.Message {
|
||||
mi := &file_internal_proto_s2a_context_s2a_context_proto_msgTypes[0]
|
||||
if protoimpl.UnsafeEnabled && x != nil {
|
||||
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||
if ms.LoadMessageInfo() == nil {
|
||||
ms.StoreMessageInfo(mi)
|
||||
}
|
||||
return ms
|
||||
}
|
||||
return mi.MessageOf(x)
|
||||
}
|
||||
|
||||
// Deprecated: Use S2AContext.ProtoReflect.Descriptor instead.
|
||||
func (*S2AContext) Descriptor() ([]byte, []int) {
|
||||
return file_internal_proto_s2a_context_s2a_context_proto_rawDescGZIP(), []int{0}
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetApplicationProtocol() string {
|
||||
if x != nil {
|
||||
return x.ApplicationProtocol
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetTlsVersion() common_go_proto.TLSVersion {
|
||||
if x != nil {
|
||||
return x.TlsVersion
|
||||
}
|
||||
return common_go_proto.TLSVersion(0)
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetCiphersuite() common_go_proto.Ciphersuite {
|
||||
if x != nil {
|
||||
return x.Ciphersuite
|
||||
}
|
||||
return common_go_proto.Ciphersuite(0)
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetPeerIdentity() *common_go_proto.Identity {
|
||||
if x != nil {
|
||||
return x.PeerIdentity
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetLocalIdentity() *common_go_proto.Identity {
|
||||
if x != nil {
|
||||
return x.LocalIdentity
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetPeerCertFingerprint() []byte {
|
||||
if x != nil {
|
||||
return x.PeerCertFingerprint
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetLocalCertFingerprint() []byte {
|
||||
if x != nil {
|
||||
return x.LocalCertFingerprint
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetIsHandshakeResumed() bool {
|
||||
if x != nil {
|
||||
return x.IsHandshakeResumed
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
var File_internal_proto_s2a_context_s2a_context_proto protoreflect.FileDescriptor
|
||||
|
||||
var file_internal_proto_s2a_context_s2a_context_proto_rawDesc = []byte{
|
||||
0x0a, 0x2c, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
|
||||
0x2f, 0x73, 0x32, 0x61, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x2f, 0x73, 0x32, 0x61,
|
||||
0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x09,
|
||||
0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x22, 0x69, 0x6e, 0x74, 0x65, 0x72,
|
||||
0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
|
||||
0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xc3, 0x03,
|
||||
0x0a, 0x0a, 0x53, 0x32, 0x41, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x12, 0x31, 0x0a, 0x14,
|
||||
0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x70, 0x72, 0x6f, 0x74,
|
||||
0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x61, 0x70, 0x70, 0x6c,
|
||||
0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12,
|
||||
0x36, 0x0a, 0x0b, 0x74, 0x6c, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02,
|
||||
0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
|
||||
0x2e, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x74, 0x6c, 0x73,
|
||||
0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x38, 0x0a, 0x0b, 0x63, 0x69, 0x70, 0x68, 0x65,
|
||||
0x72, 0x73, 0x75, 0x69, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x73,
|
||||
0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73,
|
||||
0x75, 0x69, 0x74, 0x65, 0x52, 0x0b, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x73, 0x75, 0x69, 0x74,
|
||||
0x65, 0x12, 0x38, 0x0a, 0x0d, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69,
|
||||
0x74, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70,
|
||||
0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x0c, 0x70,
|
||||
0x65, 0x65, 0x72, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x3a, 0x0a, 0x0e, 0x6c,
|
||||
0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x18, 0x05, 0x20,
|
||||
0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
|
||||
0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x0d, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49,
|
||||
0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x32, 0x0a, 0x15, 0x70, 0x65, 0x65, 0x72, 0x5f,
|
||||
0x63, 0x65, 0x72, 0x74, 0x5f, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74,
|
||||
0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x13, 0x70, 0x65, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74,
|
||||
0x46, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x12, 0x34, 0x0a, 0x16, 0x6c,
|
||||
0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72,
|
||||
0x70, 0x72, 0x69, 0x6e, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x14, 0x6c, 0x6f, 0x63,
|
||||
0x61, 0x6c, 0x43, 0x65, 0x72, 0x74, 0x46, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e,
|
||||
0x74, 0x12, 0x30, 0x0a, 0x14, 0x69, 0x73, 0x5f, 0x68, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b,
|
||||
0x65, 0x5f, 0x72, 0x65, 0x73, 0x75, 0x6d, 0x65, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52,
|
||||
0x12, 0x69, 0x73, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x52, 0x65, 0x73, 0x75,
|
||||
0x6d, 0x65, 0x64, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
|
||||
0x6d, 0x2f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x73, 0x32, 0x61, 0x2f, 0x69, 0x6e, 0x74,
|
||||
0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x73, 0x32, 0x61, 0x5f,
|
||||
0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x5f, 0x67, 0x6f, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
|
||||
0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
|
||||
}
|
||||
|
||||
var (
|
||||
file_internal_proto_s2a_context_s2a_context_proto_rawDescOnce sync.Once
|
||||
file_internal_proto_s2a_context_s2a_context_proto_rawDescData = file_internal_proto_s2a_context_s2a_context_proto_rawDesc
|
||||
)
|
||||
|
||||
func file_internal_proto_s2a_context_s2a_context_proto_rawDescGZIP() []byte {
|
||||
file_internal_proto_s2a_context_s2a_context_proto_rawDescOnce.Do(func() {
|
||||
file_internal_proto_s2a_context_s2a_context_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_proto_s2a_context_s2a_context_proto_rawDescData)
|
||||
})
|
||||
return file_internal_proto_s2a_context_s2a_context_proto_rawDescData
|
||||
}
|
||||
|
||||
var file_internal_proto_s2a_context_s2a_context_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
|
||||
var file_internal_proto_s2a_context_s2a_context_proto_goTypes = []interface{}{
|
||||
(*S2AContext)(nil), // 0: s2a.proto.S2AContext
|
||||
(common_go_proto.TLSVersion)(0), // 1: s2a.proto.TLSVersion
|
||||
(common_go_proto.Ciphersuite)(0), // 2: s2a.proto.Ciphersuite
|
||||
(*common_go_proto.Identity)(nil), // 3: s2a.proto.Identity
|
||||
}
|
||||
var file_internal_proto_s2a_context_s2a_context_proto_depIdxs = []int32{
|
||||
1, // 0: s2a.proto.S2AContext.tls_version:type_name -> s2a.proto.TLSVersion
|
||||
2, // 1: s2a.proto.S2AContext.ciphersuite:type_name -> s2a.proto.Ciphersuite
|
||||
3, // 2: s2a.proto.S2AContext.peer_identity:type_name -> s2a.proto.Identity
|
||||
3, // 3: s2a.proto.S2AContext.local_identity:type_name -> s2a.proto.Identity
|
||||
4, // [4:4] is the sub-list for method output_type
|
||||
4, // [4:4] is the sub-list for method input_type
|
||||
4, // [4:4] is the sub-list for extension type_name
|
||||
4, // [4:4] is the sub-list for extension extendee
|
||||
0, // [0:4] is the sub-list for field type_name
|
||||
}
|
||||
|
||||
func init() { file_internal_proto_s2a_context_s2a_context_proto_init() }
|
||||
func file_internal_proto_s2a_context_s2a_context_proto_init() {
|
||||
if File_internal_proto_s2a_context_s2a_context_proto != nil {
|
||||
return
|
||||
}
|
||||
if !protoimpl.UnsafeEnabled {
|
||||
file_internal_proto_s2a_context_s2a_context_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
|
||||
switch v := v.(*S2AContext); i {
|
||||
case 0:
|
||||
return &v.state
|
||||
case 1:
|
||||
return &v.sizeCache
|
||||
case 2:
|
||||
return &v.unknownFields
|
||||
default:
|
||||
return nil
|
||||
}
|
||||
}
|
||||
}
|
||||
type x struct{}
|
||||
out := protoimpl.TypeBuilder{
|
||||
File: protoimpl.DescBuilder{
|
||||
GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
|
||||
RawDescriptor: file_internal_proto_s2a_context_s2a_context_proto_rawDesc,
|
||||
NumEnums: 0,
|
||||
NumMessages: 1,
|
||||
NumExtensions: 0,
|
||||
NumServices: 0,
|
||||
},
|
||||
GoTypes: file_internal_proto_s2a_context_s2a_context_proto_goTypes,
|
||||
DependencyIndexes: file_internal_proto_s2a_context_s2a_context_proto_depIdxs,
|
||||
MessageInfos: file_internal_proto_s2a_context_s2a_context_proto_msgTypes,
|
||||
}.Build()
|
||||
File_internal_proto_s2a_context_s2a_context_proto = out.File
|
||||
file_internal_proto_s2a_context_s2a_context_proto_rawDesc = nil
|
||||
file_internal_proto_s2a_context_s2a_context_proto_goTypes = nil
|
||||
file_internal_proto_s2a_context_s2a_context_proto_depIdxs = nil
|
||||
}
|
||||
1377
vendor/github.com/google/s2a-go/internal/proto/s2a_go_proto/s2a.pb.go
generated
vendored
Normal file
1377
vendor/github.com/google/s2a-go/internal/proto/s2a_go_proto/s2a.pb.go
generated
vendored
Normal file
File diff suppressed because it is too large
Load diff
173
vendor/github.com/google/s2a-go/internal/proto/s2a_go_proto/s2a_grpc.pb.go
generated
vendored
Normal file
173
vendor/github.com/google/s2a-go/internal/proto/s2a_go_proto/s2a_grpc.pb.go
generated
vendored
Normal file
|
|
@ -0,0 +1,173 @@
|
|||
// Copyright 2021 Google LLC
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// https://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
|
||||
// versions:
|
||||
// - protoc-gen-go-grpc v1.3.0
|
||||
// - protoc v3.21.12
|
||||
// source: internal/proto/s2a/s2a.proto
|
||||
|
||||
package s2a_go_proto
|
||||
|
||||
import (
|
||||
context "context"
|
||||
grpc "google.golang.org/grpc"
|
||||
codes "google.golang.org/grpc/codes"
|
||||
status "google.golang.org/grpc/status"
|
||||
)
|
||||
|
||||
// This is a compile-time assertion to ensure that this generated file
|
||||
// is compatible with the grpc package it is being compiled against.
|
||||
// Requires gRPC-Go v1.32.0 or later.
|
||||
const _ = grpc.SupportPackageIsVersion7
|
||||
|
||||
const (
|
||||
S2AService_SetUpSession_FullMethodName = "/s2a.proto.S2AService/SetUpSession"
|
||||
)
|
||||
|
||||
// S2AServiceClient is the client API for S2AService service.
|
||||
//
|
||||
// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
|
||||
type S2AServiceClient interface {
|
||||
// S2A service accepts a stream of session setup requests and returns a stream
|
||||
// of session setup responses. The client of this service is expected to send
|
||||
// exactly one client_start or server_start message followed by at least one
|
||||
// next message. Applications running TLS clients can send requests with
|
||||
// resumption_ticket messages only after the session is successfully set up.
|
||||
//
|
||||
// Every time S2A client sends a request, this service sends a response.
|
||||
// However, clients do not have to wait for service response before sending
|
||||
// the next request.
|
||||
SetUpSession(ctx context.Context, opts ...grpc.CallOption) (S2AService_SetUpSessionClient, error)
|
||||
}
|
||||
|
||||
type s2AServiceClient struct {
|
||||
cc grpc.ClientConnInterface
|
||||
}
|
||||
|
||||
func NewS2AServiceClient(cc grpc.ClientConnInterface) S2AServiceClient {
|
||||
return &s2AServiceClient{cc}
|
||||
}
|
||||
|
||||
func (c *s2AServiceClient) SetUpSession(ctx context.Context, opts ...grpc.CallOption) (S2AService_SetUpSessionClient, error) {
|
||||
stream, err := c.cc.NewStream(ctx, &S2AService_ServiceDesc.Streams[0], S2AService_SetUpSession_FullMethodName, opts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
x := &s2AServiceSetUpSessionClient{stream}
|
||||
return x, nil
|
||||
}
|
||||
|
||||
type S2AService_SetUpSessionClient interface {
|
||||
Send(*SessionReq) error
|
||||
Recv() (*SessionResp, error)
|
||||
grpc.ClientStream
|
||||
}
|
||||
|
||||
type s2AServiceSetUpSessionClient struct {
|
||||
grpc.ClientStream
|
||||
}
|
||||
|
||||
func (x *s2AServiceSetUpSessionClient) Send(m *SessionReq) error {
|
||||
return x.ClientStream.SendMsg(m)
|
||||
}
|
||||
|
||||
func (x *s2AServiceSetUpSessionClient) Recv() (*SessionResp, error) {
|
||||
m := new(SessionResp)
|
||||
if err := x.ClientStream.RecvMsg(m); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return m, nil
|
||||
}
|
||||
|
||||
// S2AServiceServer is the server API for S2AService service.
|
||||
// All implementations must embed UnimplementedS2AServiceServer
|
||||
// for forward compatibility
|
||||
type S2AServiceServer interface {
|
||||
// S2A service accepts a stream of session setup requests and returns a stream
|
||||
// of session setup responses. The client of this service is expected to send
|
||||
// exactly one client_start or server_start message followed by at least one
|
||||
// next message. Applications running TLS clients can send requests with
|
||||
// resumption_ticket messages only after the session is successfully set up.
|
||||
//
|
||||
// Every time S2A client sends a request, this service sends a response.
|
||||
// However, clients do not have to wait for service response before sending
|
||||
// the next request.
|
||||
SetUpSession(S2AService_SetUpSessionServer) error
|
||||
mustEmbedUnimplementedS2AServiceServer()
|
||||
}
|
||||
|
||||
// UnimplementedS2AServiceServer must be embedded to have forward compatible implementations.
|
||||
type UnimplementedS2AServiceServer struct {
|
||||
}
|
||||
|
||||
func (UnimplementedS2AServiceServer) SetUpSession(S2AService_SetUpSessionServer) error {
|
||||
return status.Errorf(codes.Unimplemented, "method SetUpSession not implemented")
|
||||
}
|
||||
func (UnimplementedS2AServiceServer) mustEmbedUnimplementedS2AServiceServer() {}
|
||||
|
||||
// UnsafeS2AServiceServer may be embedded to opt out of forward compatibility for this service.
|
||||
// Use of this interface is not recommended, as added methods to S2AServiceServer will
|
||||
// result in compilation errors.
|
||||
type UnsafeS2AServiceServer interface {
|
||||
mustEmbedUnimplementedS2AServiceServer()
|
||||
}
|
||||
|
||||
func RegisterS2AServiceServer(s grpc.ServiceRegistrar, srv S2AServiceServer) {
|
||||
s.RegisterService(&S2AService_ServiceDesc, srv)
|
||||
}
|
||||
|
||||
func _S2AService_SetUpSession_Handler(srv interface{}, stream grpc.ServerStream) error {
|
||||
return srv.(S2AServiceServer).SetUpSession(&s2AServiceSetUpSessionServer{stream})
|
||||
}
|
||||
|
||||
type S2AService_SetUpSessionServer interface {
|
||||
Send(*SessionResp) error
|
||||
Recv() (*SessionReq, error)
|
||||
grpc.ServerStream
|
||||
}
|
||||
|
||||
type s2AServiceSetUpSessionServer struct {
|
||||
grpc.ServerStream
|
||||
}
|
||||
|
||||
func (x *s2AServiceSetUpSessionServer) Send(m *SessionResp) error {
|
||||
return x.ServerStream.SendMsg(m)
|
||||
}
|
||||
|
||||
func (x *s2AServiceSetUpSessionServer) Recv() (*SessionReq, error) {
|
||||
m := new(SessionReq)
|
||||
if err := x.ServerStream.RecvMsg(m); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return m, nil
|
||||
}
|
||||
|
||||
// S2AService_ServiceDesc is the grpc.ServiceDesc for S2AService service.
|
||||
// It's only intended for direct use with grpc.RegisterService,
|
||||
// and not to be introspected or modified (even as a copy)
|
||||
var S2AService_ServiceDesc = grpc.ServiceDesc{
|
||||
ServiceName: "s2a.proto.S2AService",
|
||||
HandlerType: (*S2AServiceServer)(nil),
|
||||
Methods: []grpc.MethodDesc{},
|
||||
Streams: []grpc.StreamDesc{
|
||||
{
|
||||
StreamName: "SetUpSession",
|
||||
Handler: _S2AService_SetUpSession_Handler,
|
||||
ServerStreams: true,
|
||||
ClientStreams: true,
|
||||
},
|
||||
},
|
||||
Metadata: "internal/proto/s2a/s2a.proto",
|
||||
}
|
||||
367
vendor/github.com/google/s2a-go/internal/proto/v2/common_go_proto/common.pb.go
generated
vendored
Normal file
367
vendor/github.com/google/s2a-go/internal/proto/v2/common_go_proto/common.pb.go
generated
vendored
Normal file
|
|
@ -0,0 +1,367 @@
|
|||
// Copyright 2022 Google LLC
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// https://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
// Code generated by protoc-gen-go. DO NOT EDIT.
|
||||
// versions:
|
||||
// protoc-gen-go v1.30.0
|
||||
// protoc v3.21.12
|
||||
// source: internal/proto/v2/common/common.proto
|
||||
|
||||
package common_go_proto
|
||||
|
||||
import (
|
||||
protoreflect "google.golang.org/protobuf/reflect/protoreflect"
|
||||
protoimpl "google.golang.org/protobuf/runtime/protoimpl"
|
||||
reflect "reflect"
|
||||
sync "sync"
|
||||
)
|
||||
|
||||
const (
|
||||
// Verify that this generated code is sufficiently up-to-date.
|
||||
_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
|
||||
// Verify that runtime/protoimpl is sufficiently up-to-date.
|
||||
_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
|
||||
)
|
||||
|
||||
// The TLS 1.0-1.2 ciphersuites that the application can negotiate when using
|
||||
// S2A.
|
||||
type Ciphersuite int32
|
||||
|
||||
const (
|
||||
Ciphersuite_CIPHERSUITE_UNSPECIFIED Ciphersuite = 0
|
||||
Ciphersuite_CIPHERSUITE_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 Ciphersuite = 1
|
||||
Ciphersuite_CIPHERSUITE_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 Ciphersuite = 2
|
||||
Ciphersuite_CIPHERSUITE_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 Ciphersuite = 3
|
||||
Ciphersuite_CIPHERSUITE_ECDHE_RSA_WITH_AES_128_GCM_SHA256 Ciphersuite = 4
|
||||
Ciphersuite_CIPHERSUITE_ECDHE_RSA_WITH_AES_256_GCM_SHA384 Ciphersuite = 5
|
||||
Ciphersuite_CIPHERSUITE_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Ciphersuite = 6
|
||||
)
|
||||
|
||||
// Enum value maps for Ciphersuite.
|
||||
var (
|
||||
Ciphersuite_name = map[int32]string{
|
||||
0: "CIPHERSUITE_UNSPECIFIED",
|
||||
1: "CIPHERSUITE_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
|
||||
2: "CIPHERSUITE_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
|
||||
3: "CIPHERSUITE_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
|
||||
4: "CIPHERSUITE_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
||||
5: "CIPHERSUITE_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
|
||||
6: "CIPHERSUITE_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
|
||||
}
|
||||
Ciphersuite_value = map[string]int32{
|
||||
"CIPHERSUITE_UNSPECIFIED": 0,
|
||||
"CIPHERSUITE_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": 1,
|
||||
"CIPHERSUITE_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": 2,
|
||||
"CIPHERSUITE_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256": 3,
|
||||
"CIPHERSUITE_ECDHE_RSA_WITH_AES_128_GCM_SHA256": 4,
|
||||
"CIPHERSUITE_ECDHE_RSA_WITH_AES_256_GCM_SHA384": 5,
|
||||
"CIPHERSUITE_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256": 6,
|
||||
}
|
||||
)
|
||||
|
||||
func (x Ciphersuite) Enum() *Ciphersuite {
|
||||
p := new(Ciphersuite)
|
||||
*p = x
|
||||
return p
|
||||
}
|
||||
|
||||
func (x Ciphersuite) String() string {
|
||||
return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
|
||||
}
|
||||
|
||||
func (Ciphersuite) Descriptor() protoreflect.EnumDescriptor {
|
||||
return file_internal_proto_v2_common_common_proto_enumTypes[0].Descriptor()
|
||||
}
|
||||
|
||||
func (Ciphersuite) Type() protoreflect.EnumType {
|
||||
return &file_internal_proto_v2_common_common_proto_enumTypes[0]
|
||||
}
|
||||
|
||||
func (x Ciphersuite) Number() protoreflect.EnumNumber {
|
||||
return protoreflect.EnumNumber(x)
|
||||
}
|
||||
|
||||
// Deprecated: Use Ciphersuite.Descriptor instead.
|
||||
func (Ciphersuite) EnumDescriptor() ([]byte, []int) {
|
||||
return file_internal_proto_v2_common_common_proto_rawDescGZIP(), []int{0}
|
||||
}
|
||||
|
||||
// The TLS versions supported by S2A's handshaker module.
|
||||
type TLSVersion int32
|
||||
|
||||
const (
|
||||
TLSVersion_TLS_VERSION_UNSPECIFIED TLSVersion = 0
|
||||
TLSVersion_TLS_VERSION_1_0 TLSVersion = 1
|
||||
TLSVersion_TLS_VERSION_1_1 TLSVersion = 2
|
||||
TLSVersion_TLS_VERSION_1_2 TLSVersion = 3
|
||||
TLSVersion_TLS_VERSION_1_3 TLSVersion = 4
|
||||
)
|
||||
|
||||
// Enum value maps for TLSVersion.
|
||||
var (
|
||||
TLSVersion_name = map[int32]string{
|
||||
0: "TLS_VERSION_UNSPECIFIED",
|
||||
1: "TLS_VERSION_1_0",
|
||||
2: "TLS_VERSION_1_1",
|
||||
3: "TLS_VERSION_1_2",
|
||||
4: "TLS_VERSION_1_3",
|
||||
}
|
||||
TLSVersion_value = map[string]int32{
|
||||
"TLS_VERSION_UNSPECIFIED": 0,
|
||||
"TLS_VERSION_1_0": 1,
|
||||
"TLS_VERSION_1_1": 2,
|
||||
"TLS_VERSION_1_2": 3,
|
||||
"TLS_VERSION_1_3": 4,
|
||||
}
|
||||
)
|
||||
|
||||
func (x TLSVersion) Enum() *TLSVersion {
|
||||
p := new(TLSVersion)
|
||||
*p = x
|
||||
return p
|
||||
}
|
||||
|
||||
func (x TLSVersion) String() string {
|
||||
return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
|
||||
}
|
||||
|
||||
func (TLSVersion) Descriptor() protoreflect.EnumDescriptor {
|
||||
return file_internal_proto_v2_common_common_proto_enumTypes[1].Descriptor()
|
||||
}
|
||||
|
||||
func (TLSVersion) Type() protoreflect.EnumType {
|
||||
return &file_internal_proto_v2_common_common_proto_enumTypes[1]
|
||||
}
|
||||
|
||||
func (x TLSVersion) Number() protoreflect.EnumNumber {
|
||||
return protoreflect.EnumNumber(x)
|
||||
}
|
||||
|
||||
// Deprecated: Use TLSVersion.Descriptor instead.
|
||||
func (TLSVersion) EnumDescriptor() ([]byte, []int) {
|
||||
return file_internal_proto_v2_common_common_proto_rawDescGZIP(), []int{1}
|
||||
}
|
||||
|
||||
// The side in the TLS connection.
|
||||
type ConnectionSide int32
|
||||
|
||||
const (
|
||||
ConnectionSide_CONNECTION_SIDE_UNSPECIFIED ConnectionSide = 0
|
||||
ConnectionSide_CONNECTION_SIDE_CLIENT ConnectionSide = 1
|
||||
ConnectionSide_CONNECTION_SIDE_SERVER ConnectionSide = 2
|
||||
)
|
||||
|
||||
// Enum value maps for ConnectionSide.
|
||||
var (
|
||||
ConnectionSide_name = map[int32]string{
|
||||
0: "CONNECTION_SIDE_UNSPECIFIED",
|
||||
1: "CONNECTION_SIDE_CLIENT",
|
||||
2: "CONNECTION_SIDE_SERVER",
|
||||
}
|
||||
ConnectionSide_value = map[string]int32{
|
||||
"CONNECTION_SIDE_UNSPECIFIED": 0,
|
||||
"CONNECTION_SIDE_CLIENT": 1,
|
||||
"CONNECTION_SIDE_SERVER": 2,
|
||||
}
|
||||
)
|
||||
|
||||
func (x ConnectionSide) Enum() *ConnectionSide {
|
||||
p := new(ConnectionSide)
|
||||
*p = x
|
||||
return p
|
||||
}
|
||||
|
||||
func (x ConnectionSide) String() string {
|
||||
return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
|
||||
}
|
||||
|
||||
func (ConnectionSide) Descriptor() protoreflect.EnumDescriptor {
|
||||
return file_internal_proto_v2_common_common_proto_enumTypes[2].Descriptor()
|
||||
}
|
||||
|
||||
func (ConnectionSide) Type() protoreflect.EnumType {
|
||||
return &file_internal_proto_v2_common_common_proto_enumTypes[2]
|
||||
}
|
||||
|
||||
func (x ConnectionSide) Number() protoreflect.EnumNumber {
|
||||
return protoreflect.EnumNumber(x)
|
||||
}
|
||||
|
||||
// Deprecated: Use ConnectionSide.Descriptor instead.
|
||||
func (ConnectionSide) EnumDescriptor() ([]byte, []int) {
|
||||
return file_internal_proto_v2_common_common_proto_rawDescGZIP(), []int{2}
|
||||
}
|
||||
|
||||
// The ALPN protocols that the application can negotiate during a TLS handshake.
|
||||
type AlpnProtocol int32
|
||||
|
||||
const (
|
||||
AlpnProtocol_ALPN_PROTOCOL_UNSPECIFIED AlpnProtocol = 0
|
||||
AlpnProtocol_ALPN_PROTOCOL_GRPC AlpnProtocol = 1
|
||||
AlpnProtocol_ALPN_PROTOCOL_HTTP2 AlpnProtocol = 2
|
||||
AlpnProtocol_ALPN_PROTOCOL_HTTP1_1 AlpnProtocol = 3
|
||||
)
|
||||
|
||||
// Enum value maps for AlpnProtocol.
|
||||
var (
|
||||
AlpnProtocol_name = map[int32]string{
|
||||
0: "ALPN_PROTOCOL_UNSPECIFIED",
|
||||
1: "ALPN_PROTOCOL_GRPC",
|
||||
2: "ALPN_PROTOCOL_HTTP2",
|
||||
3: "ALPN_PROTOCOL_HTTP1_1",
|
||||
}
|
||||
AlpnProtocol_value = map[string]int32{
|
||||
"ALPN_PROTOCOL_UNSPECIFIED": 0,
|
||||
"ALPN_PROTOCOL_GRPC": 1,
|
||||
"ALPN_PROTOCOL_HTTP2": 2,
|
||||
"ALPN_PROTOCOL_HTTP1_1": 3,
|
||||
}
|
||||
)
|
||||
|
||||
func (x AlpnProtocol) Enum() *AlpnProtocol {
|
||||
p := new(AlpnProtocol)
|
||||
*p = x
|
||||
return p
|
||||
}
|
||||
|
||||
func (x AlpnProtocol) String() string {
|
||||
return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
|
||||
}
|
||||
|
||||
func (AlpnProtocol) Descriptor() protoreflect.EnumDescriptor {
|
||||
return file_internal_proto_v2_common_common_proto_enumTypes[3].Descriptor()
|
||||
}
|
||||
|
||||
func (AlpnProtocol) Type() protoreflect.EnumType {
|
||||
return &file_internal_proto_v2_common_common_proto_enumTypes[3]
|
||||
}
|
||||
|
||||
func (x AlpnProtocol) Number() protoreflect.EnumNumber {
|
||||
return protoreflect.EnumNumber(x)
|
||||
}
|
||||
|
||||
// Deprecated: Use AlpnProtocol.Descriptor instead.
|
||||
func (AlpnProtocol) EnumDescriptor() ([]byte, []int) {
|
||||
return file_internal_proto_v2_common_common_proto_rawDescGZIP(), []int{3}
|
||||
}
|
||||
|
||||
var File_internal_proto_v2_common_common_proto protoreflect.FileDescriptor
|
||||
|
||||
var file_internal_proto_v2_common_common_proto_rawDesc = []byte{
|
||||
0x0a, 0x25, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
|
||||
0x2f, 0x76, 0x32, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
|
||||
0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0c, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f,
|
||||
0x74, 0x6f, 0x2e, 0x76, 0x32, 0x2a, 0xee, 0x02, 0x0a, 0x0b, 0x43, 0x69, 0x70, 0x68, 0x65, 0x72,
|
||||
0x73, 0x75, 0x69, 0x74, 0x65, 0x12, 0x1b, 0x0a, 0x17, 0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x53,
|
||||
0x55, 0x49, 0x54, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44,
|
||||
0x10, 0x00, 0x12, 0x33, 0x0a, 0x2f, 0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x53, 0x55, 0x49, 0x54,
|
||||
0x45, 0x5f, 0x45, 0x43, 0x44, 0x48, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x57, 0x49,
|
||||
0x54, 0x48, 0x5f, 0x41, 0x45, 0x53, 0x5f, 0x31, 0x32, 0x38, 0x5f, 0x47, 0x43, 0x4d, 0x5f, 0x53,
|
||||
0x48, 0x41, 0x32, 0x35, 0x36, 0x10, 0x01, 0x12, 0x33, 0x0a, 0x2f, 0x43, 0x49, 0x50, 0x48, 0x45,
|
||||
0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x48, 0x45, 0x5f, 0x45, 0x43, 0x44,
|
||||
0x53, 0x41, 0x5f, 0x57, 0x49, 0x54, 0x48, 0x5f, 0x41, 0x45, 0x53, 0x5f, 0x32, 0x35, 0x36, 0x5f,
|
||||
0x47, 0x43, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x33, 0x38, 0x34, 0x10, 0x02, 0x12, 0x39, 0x0a, 0x35,
|
||||
0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x48,
|
||||
0x45, 0x5f, 0x45, 0x43, 0x44, 0x53, 0x41, 0x5f, 0x57, 0x49, 0x54, 0x48, 0x5f, 0x43, 0x48, 0x41,
|
||||
0x43, 0x48, 0x41, 0x32, 0x30, 0x5f, 0x50, 0x4f, 0x4c, 0x59, 0x31, 0x33, 0x30, 0x35, 0x5f, 0x53,
|
||||
0x48, 0x41, 0x32, 0x35, 0x36, 0x10, 0x03, 0x12, 0x31, 0x0a, 0x2d, 0x43, 0x49, 0x50, 0x48, 0x45,
|
||||
0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x48, 0x45, 0x5f, 0x52, 0x53, 0x41,
|
||||
0x5f, 0x57, 0x49, 0x54, 0x48, 0x5f, 0x41, 0x45, 0x53, 0x5f, 0x31, 0x32, 0x38, 0x5f, 0x47, 0x43,
|
||||
0x4d, 0x5f, 0x53, 0x48, 0x41, 0x32, 0x35, 0x36, 0x10, 0x04, 0x12, 0x31, 0x0a, 0x2d, 0x43, 0x49,
|
||||
0x50, 0x48, 0x45, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x45, 0x43, 0x44, 0x48, 0x45, 0x5f,
|
||||
0x52, 0x53, 0x41, 0x5f, 0x57, 0x49, 0x54, 0x48, 0x5f, 0x41, 0x45, 0x53, 0x5f, 0x32, 0x35, 0x36,
|
||||
0x5f, 0x47, 0x43, 0x4d, 0x5f, 0x53, 0x48, 0x41, 0x33, 0x38, 0x34, 0x10, 0x05, 0x12, 0x37, 0x0a,
|
||||
0x33, 0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x53, 0x55, 0x49, 0x54, 0x45, 0x5f, 0x45, 0x43, 0x44,
|
||||
0x48, 0x45, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x57, 0x49, 0x54, 0x48, 0x5f, 0x43, 0x48, 0x41, 0x43,
|
||||
0x48, 0x41, 0x32, 0x30, 0x5f, 0x50, 0x4f, 0x4c, 0x59, 0x31, 0x33, 0x30, 0x35, 0x5f, 0x53, 0x48,
|
||||
0x41, 0x32, 0x35, 0x36, 0x10, 0x06, 0x2a, 0x7d, 0x0a, 0x0a, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72,
|
||||
0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1b, 0x0a, 0x17, 0x54, 0x4c, 0x53, 0x5f, 0x56, 0x45, 0x52, 0x53,
|
||||
0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
|
||||
0x00, 0x12, 0x13, 0x0a, 0x0f, 0x54, 0x4c, 0x53, 0x5f, 0x56, 0x45, 0x52, 0x53, 0x49, 0x4f, 0x4e,
|
||||
0x5f, 0x31, 0x5f, 0x30, 0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x54, 0x4c, 0x53, 0x5f, 0x56, 0x45,
|
||||
0x52, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x31, 0x5f, 0x31, 0x10, 0x02, 0x12, 0x13, 0x0a, 0x0f, 0x54,
|
||||
0x4c, 0x53, 0x5f, 0x56, 0x45, 0x52, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x31, 0x5f, 0x32, 0x10, 0x03,
|
||||
0x12, 0x13, 0x0a, 0x0f, 0x54, 0x4c, 0x53, 0x5f, 0x56, 0x45, 0x52, 0x53, 0x49, 0x4f, 0x4e, 0x5f,
|
||||
0x31, 0x5f, 0x33, 0x10, 0x04, 0x2a, 0x69, 0x0a, 0x0e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
|
||||
0x69, 0x6f, 0x6e, 0x53, 0x69, 0x64, 0x65, 0x12, 0x1f, 0x0a, 0x1b, 0x43, 0x4f, 0x4e, 0x4e, 0x45,
|
||||
0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x53, 0x49, 0x44, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45,
|
||||
0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1a, 0x0a, 0x16, 0x43, 0x4f, 0x4e, 0x4e,
|
||||
0x45, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x53, 0x49, 0x44, 0x45, 0x5f, 0x43, 0x4c, 0x49, 0x45,
|
||||
0x4e, 0x54, 0x10, 0x01, 0x12, 0x1a, 0x0a, 0x16, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x49,
|
||||
0x4f, 0x4e, 0x5f, 0x53, 0x49, 0x44, 0x45, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x10, 0x02,
|
||||
0x2a, 0x79, 0x0a, 0x0c, 0x41, 0x6c, 0x70, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
|
||||
0x12, 0x1d, 0x0a, 0x19, 0x41, 0x4c, 0x50, 0x4e, 0x5f, 0x50, 0x52, 0x4f, 0x54, 0x4f, 0x43, 0x4f,
|
||||
0x4c, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
|
||||
0x16, 0x0a, 0x12, 0x41, 0x4c, 0x50, 0x4e, 0x5f, 0x50, 0x52, 0x4f, 0x54, 0x4f, 0x43, 0x4f, 0x4c,
|
||||
0x5f, 0x47, 0x52, 0x50, 0x43, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x41, 0x4c, 0x50, 0x4e, 0x5f,
|
||||
0x50, 0x52, 0x4f, 0x54, 0x4f, 0x43, 0x4f, 0x4c, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x32, 0x10, 0x02,
|
||||
0x12, 0x19, 0x0a, 0x15, 0x41, 0x4c, 0x50, 0x4e, 0x5f, 0x50, 0x52, 0x4f, 0x54, 0x4f, 0x43, 0x4f,
|
||||
0x4c, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x31, 0x5f, 0x31, 0x10, 0x03, 0x42, 0x39, 0x5a, 0x37, 0x67,
|
||||
0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
|
||||
0x2f, 0x73, 0x32, 0x61, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72,
|
||||
0x6f, 0x74, 0x6f, 0x2f, 0x76, 0x32, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x67, 0x6f,
|
||||
0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
|
||||
}
|
||||
|
||||
var (
|
||||
file_internal_proto_v2_common_common_proto_rawDescOnce sync.Once
|
||||
file_internal_proto_v2_common_common_proto_rawDescData = file_internal_proto_v2_common_common_proto_rawDesc
|
||||
)
|
||||
|
||||
func file_internal_proto_v2_common_common_proto_rawDescGZIP() []byte {
|
||||
file_internal_proto_v2_common_common_proto_rawDescOnce.Do(func() {
|
||||
file_internal_proto_v2_common_common_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_proto_v2_common_common_proto_rawDescData)
|
||||
})
|
||||
return file_internal_proto_v2_common_common_proto_rawDescData
|
||||
}
|
||||
|
||||
var file_internal_proto_v2_common_common_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
|
||||
var file_internal_proto_v2_common_common_proto_goTypes = []interface{}{
|
||||
(Ciphersuite)(0), // 0: s2a.proto.v2.Ciphersuite
|
||||
(TLSVersion)(0), // 1: s2a.proto.v2.TLSVersion
|
||||
(ConnectionSide)(0), // 2: s2a.proto.v2.ConnectionSide
|
||||
(AlpnProtocol)(0), // 3: s2a.proto.v2.AlpnProtocol
|
||||
}
|
||||
var file_internal_proto_v2_common_common_proto_depIdxs = []int32{
|
||||
0, // [0:0] is the sub-list for method output_type
|
||||
0, // [0:0] is the sub-list for method input_type
|
||||
0, // [0:0] is the sub-list for extension type_name
|
||||
0, // [0:0] is the sub-list for extension extendee
|
||||
0, // [0:0] is the sub-list for field type_name
|
||||
}
|
||||
|
||||
func init() { file_internal_proto_v2_common_common_proto_init() }
|
||||
func file_internal_proto_v2_common_common_proto_init() {
|
||||
if File_internal_proto_v2_common_common_proto != nil {
|
||||
return
|
||||
}
|
||||
type x struct{}
|
||||
out := protoimpl.TypeBuilder{
|
||||
File: protoimpl.DescBuilder{
|
||||
GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
|
||||
RawDescriptor: file_internal_proto_v2_common_common_proto_rawDesc,
|
||||
NumEnums: 4,
|
||||
NumMessages: 0,
|
||||
NumExtensions: 0,
|
||||
NumServices: 0,
|
||||
},
|
||||
GoTypes: file_internal_proto_v2_common_common_proto_goTypes,
|
||||
DependencyIndexes: file_internal_proto_v2_common_common_proto_depIdxs,
|
||||
EnumInfos: file_internal_proto_v2_common_common_proto_enumTypes,
|
||||
}.Build()
|
||||
File_internal_proto_v2_common_common_proto = out.File
|
||||
file_internal_proto_v2_common_common_proto_rawDesc = nil
|
||||
file_internal_proto_v2_common_common_proto_goTypes = nil
|
||||
file_internal_proto_v2_common_common_proto_depIdxs = nil
|
||||
}
|
||||
248
vendor/github.com/google/s2a-go/internal/proto/v2/s2a_context_go_proto/s2a_context.pb.go
generated
vendored
Normal file
248
vendor/github.com/google/s2a-go/internal/proto/v2/s2a_context_go_proto/s2a_context.pb.go
generated
vendored
Normal file
|
|
@ -0,0 +1,248 @@
|
|||
// Copyright 2022 Google LLC
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// https://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
// Code generated by protoc-gen-go. DO NOT EDIT.
|
||||
// versions:
|
||||
// protoc-gen-go v1.30.0
|
||||
// protoc v3.21.12
|
||||
// source: internal/proto/v2/s2a_context/s2a_context.proto
|
||||
|
||||
package s2a_context_go_proto
|
||||
|
||||
import (
|
||||
common_go_proto "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
protoreflect "google.golang.org/protobuf/reflect/protoreflect"
|
||||
protoimpl "google.golang.org/protobuf/runtime/protoimpl"
|
||||
reflect "reflect"
|
||||
sync "sync"
|
||||
)
|
||||
|
||||
const (
|
||||
// Verify that this generated code is sufficiently up-to-date.
|
||||
_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
|
||||
// Verify that runtime/protoimpl is sufficiently up-to-date.
|
||||
_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
|
||||
)
|
||||
|
||||
type S2AContext struct {
|
||||
state protoimpl.MessageState
|
||||
sizeCache protoimpl.SizeCache
|
||||
unknownFields protoimpl.UnknownFields
|
||||
|
||||
// The SPIFFE ID from the peer leaf certificate, if present.
|
||||
//
|
||||
// This field is only populated if the leaf certificate is a valid SPIFFE
|
||||
// SVID; in particular, there is a unique URI SAN and this URI SAN is a valid
|
||||
// SPIFFE ID.
|
||||
LeafCertSpiffeId string `protobuf:"bytes,1,opt,name=leaf_cert_spiffe_id,json=leafCertSpiffeId,proto3" json:"leaf_cert_spiffe_id,omitempty"`
|
||||
// The URIs that are present in the SubjectAltName extension of the peer leaf
|
||||
// certificate.
|
||||
//
|
||||
// Note that the extracted URIs are not validated and may not be properly
|
||||
// formatted.
|
||||
LeafCertUris []string `protobuf:"bytes,2,rep,name=leaf_cert_uris,json=leafCertUris,proto3" json:"leaf_cert_uris,omitempty"`
|
||||
// The DNSNames that are present in the SubjectAltName extension of the peer
|
||||
// leaf certificate.
|
||||
LeafCertDnsnames []string `protobuf:"bytes,3,rep,name=leaf_cert_dnsnames,json=leafCertDnsnames,proto3" json:"leaf_cert_dnsnames,omitempty"`
|
||||
// The (ordered) list of fingerprints in the certificate chain used to verify
|
||||
// the given leaf certificate. The order MUST be from leaf certificate
|
||||
// fingerprint to root certificate fingerprint.
|
||||
//
|
||||
// A fingerprint is the base-64 encoding of the SHA256 hash of the
|
||||
// DER-encoding of a certificate. The list MAY be populated even if the peer
|
||||
// certificate chain was NOT validated successfully.
|
||||
PeerCertificateChainFingerprints []string `protobuf:"bytes,4,rep,name=peer_certificate_chain_fingerprints,json=peerCertificateChainFingerprints,proto3" json:"peer_certificate_chain_fingerprints,omitempty"`
|
||||
// The local identity used during session setup.
|
||||
LocalIdentity *common_go_proto.Identity `protobuf:"bytes,5,opt,name=local_identity,json=localIdentity,proto3" json:"local_identity,omitempty"`
|
||||
// The SHA256 hash of the DER-encoding of the local leaf certificate used in
|
||||
// the handshake.
|
||||
LocalLeafCertFingerprint []byte `protobuf:"bytes,6,opt,name=local_leaf_cert_fingerprint,json=localLeafCertFingerprint,proto3" json:"local_leaf_cert_fingerprint,omitempty"`
|
||||
}
|
||||
|
||||
func (x *S2AContext) Reset() {
|
||||
*x = S2AContext{}
|
||||
if protoimpl.UnsafeEnabled {
|
||||
mi := &file_internal_proto_v2_s2a_context_s2a_context_proto_msgTypes[0]
|
||||
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||
ms.StoreMessageInfo(mi)
|
||||
}
|
||||
}
|
||||
|
||||
func (x *S2AContext) String() string {
|
||||
return protoimpl.X.MessageStringOf(x)
|
||||
}
|
||||
|
||||
func (*S2AContext) ProtoMessage() {}
|
||||
|
||||
func (x *S2AContext) ProtoReflect() protoreflect.Message {
|
||||
mi := &file_internal_proto_v2_s2a_context_s2a_context_proto_msgTypes[0]
|
||||
if protoimpl.UnsafeEnabled && x != nil {
|
||||
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
||||
if ms.LoadMessageInfo() == nil {
|
||||
ms.StoreMessageInfo(mi)
|
||||
}
|
||||
return ms
|
||||
}
|
||||
return mi.MessageOf(x)
|
||||
}
|
||||
|
||||
// Deprecated: Use S2AContext.ProtoReflect.Descriptor instead.
|
||||
func (*S2AContext) Descriptor() ([]byte, []int) {
|
||||
return file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescGZIP(), []int{0}
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetLeafCertSpiffeId() string {
|
||||
if x != nil {
|
||||
return x.LeafCertSpiffeId
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetLeafCertUris() []string {
|
||||
if x != nil {
|
||||
return x.LeafCertUris
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetLeafCertDnsnames() []string {
|
||||
if x != nil {
|
||||
return x.LeafCertDnsnames
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetPeerCertificateChainFingerprints() []string {
|
||||
if x != nil {
|
||||
return x.PeerCertificateChainFingerprints
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetLocalIdentity() *common_go_proto.Identity {
|
||||
if x != nil {
|
||||
return x.LocalIdentity
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (x *S2AContext) GetLocalLeafCertFingerprint() []byte {
|
||||
if x != nil {
|
||||
return x.LocalLeafCertFingerprint
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
var File_internal_proto_v2_s2a_context_s2a_context_proto protoreflect.FileDescriptor
|
||||
|
||||
var file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc = []byte{
|
||||
0x0a, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
|
||||
0x2f, 0x76, 0x32, 0x2f, 0x73, 0x32, 0x61, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x2f,
|
||||
0x73, 0x32, 0x61, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74,
|
||||
0x6f, 0x12, 0x0c, 0x73, 0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x76, 0x32, 0x1a,
|
||||
0x22, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
|
||||
0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72,
|
||||
0x6f, 0x74, 0x6f, 0x22, 0xd9, 0x02, 0x0a, 0x0a, 0x53, 0x32, 0x41, 0x43, 0x6f, 0x6e, 0x74, 0x65,
|
||||
0x78, 0x74, 0x12, 0x2d, 0x0a, 0x13, 0x6c, 0x65, 0x61, 0x66, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f,
|
||||
0x73, 0x70, 0x69, 0x66, 0x66, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
|
||||
0x10, 0x6c, 0x65, 0x61, 0x66, 0x43, 0x65, 0x72, 0x74, 0x53, 0x70, 0x69, 0x66, 0x66, 0x65, 0x49,
|
||||
0x64, 0x12, 0x24, 0x0a, 0x0e, 0x6c, 0x65, 0x61, 0x66, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x75,
|
||||
0x72, 0x69, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x65, 0x61, 0x66, 0x43,
|
||||
0x65, 0x72, 0x74, 0x55, 0x72, 0x69, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x6c, 0x65, 0x61, 0x66, 0x5f,
|
||||
0x63, 0x65, 0x72, 0x74, 0x5f, 0x64, 0x6e, 0x73, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x03, 0x20,
|
||||
0x03, 0x28, 0x09, 0x52, 0x10, 0x6c, 0x65, 0x61, 0x66, 0x43, 0x65, 0x72, 0x74, 0x44, 0x6e, 0x73,
|
||||
0x6e, 0x61, 0x6d, 0x65, 0x73, 0x12, 0x4d, 0x0a, 0x23, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x63, 0x65,
|
||||
0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x5f,
|
||||
0x66, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x04, 0x20, 0x03,
|
||||
0x28, 0x09, 0x52, 0x20, 0x70, 0x65, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
|
||||
0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x46, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72,
|
||||
0x69, 0x6e, 0x74, 0x73, 0x12, 0x3a, 0x0a, 0x0e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x69, 0x64,
|
||||
0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x73,
|
||||
0x32, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74,
|
||||
0x79, 0x52, 0x0d, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79,
|
||||
0x12, 0x3d, 0x0a, 0x1b, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x6c, 0x65, 0x61, 0x66, 0x5f, 0x63,
|
||||
0x65, 0x72, 0x74, 0x5f, 0x66, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x18,
|
||||
0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x18, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x4c, 0x65, 0x61, 0x66,
|
||||
0x43, 0x65, 0x72, 0x74, 0x46, 0x69, 0x6e, 0x67, 0x65, 0x72, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x42,
|
||||
0x3e, 0x5a, 0x3c, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x6f,
|
||||
0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x73, 0x32, 0x61, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61,
|
||||
0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x76, 0x32, 0x2f, 0x73, 0x32, 0x61, 0x5f, 0x63,
|
||||
0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x5f, 0x67, 0x6f, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
|
||||
0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
|
||||
}
|
||||
|
||||
var (
|
||||
file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescOnce sync.Once
|
||||
file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescData = file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc
|
||||
)
|
||||
|
||||
func file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescGZIP() []byte {
|
||||
file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescOnce.Do(func() {
|
||||
file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescData)
|
||||
})
|
||||
return file_internal_proto_v2_s2a_context_s2a_context_proto_rawDescData
|
||||
}
|
||||
|
||||
var file_internal_proto_v2_s2a_context_s2a_context_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
|
||||
var file_internal_proto_v2_s2a_context_s2a_context_proto_goTypes = []interface{}{
|
||||
(*S2AContext)(nil), // 0: s2a.proto.v2.S2AContext
|
||||
(*common_go_proto.Identity)(nil), // 1: s2a.proto.Identity
|
||||
}
|
||||
var file_internal_proto_v2_s2a_context_s2a_context_proto_depIdxs = []int32{
|
||||
1, // 0: s2a.proto.v2.S2AContext.local_identity:type_name -> s2a.proto.Identity
|
||||
1, // [1:1] is the sub-list for method output_type
|
||||
1, // [1:1] is the sub-list for method input_type
|
||||
1, // [1:1] is the sub-list for extension type_name
|
||||
1, // [1:1] is the sub-list for extension extendee
|
||||
0, // [0:1] is the sub-list for field type_name
|
||||
}
|
||||
|
||||
func init() { file_internal_proto_v2_s2a_context_s2a_context_proto_init() }
|
||||
func file_internal_proto_v2_s2a_context_s2a_context_proto_init() {
|
||||
if File_internal_proto_v2_s2a_context_s2a_context_proto != nil {
|
||||
return
|
||||
}
|
||||
if !protoimpl.UnsafeEnabled {
|
||||
file_internal_proto_v2_s2a_context_s2a_context_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
|
||||
switch v := v.(*S2AContext); i {
|
||||
case 0:
|
||||
return &v.state
|
||||
case 1:
|
||||
return &v.sizeCache
|
||||
case 2:
|
||||
return &v.unknownFields
|
||||
default:
|
||||
return nil
|
||||
}
|
||||
}
|
||||
}
|
||||
type x struct{}
|
||||
out := protoimpl.TypeBuilder{
|
||||
File: protoimpl.DescBuilder{
|
||||
GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
|
||||
RawDescriptor: file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc,
|
||||
NumEnums: 0,
|
||||
NumMessages: 1,
|
||||
NumExtensions: 0,
|
||||
NumServices: 0,
|
||||
},
|
||||
GoTypes: file_internal_proto_v2_s2a_context_s2a_context_proto_goTypes,
|
||||
DependencyIndexes: file_internal_proto_v2_s2a_context_s2a_context_proto_depIdxs,
|
||||
MessageInfos: file_internal_proto_v2_s2a_context_s2a_context_proto_msgTypes,
|
||||
}.Build()
|
||||
File_internal_proto_v2_s2a_context_s2a_context_proto = out.File
|
||||
file_internal_proto_v2_s2a_context_s2a_context_proto_rawDesc = nil
|
||||
file_internal_proto_v2_s2a_context_s2a_context_proto_goTypes = nil
|
||||
file_internal_proto_v2_s2a_context_s2a_context_proto_depIdxs = nil
|
||||
}
|
||||
2480
vendor/github.com/google/s2a-go/internal/proto/v2/s2a_go_proto/s2a.pb.go
generated
vendored
Normal file
2480
vendor/github.com/google/s2a-go/internal/proto/v2/s2a_go_proto/s2a.pb.go
generated
vendored
Normal file
File diff suppressed because it is too large
Load diff
159
vendor/github.com/google/s2a-go/internal/proto/v2/s2a_go_proto/s2a_grpc.pb.go
generated
vendored
Normal file
159
vendor/github.com/google/s2a-go/internal/proto/v2/s2a_go_proto/s2a_grpc.pb.go
generated
vendored
Normal file
|
|
@ -0,0 +1,159 @@
|
|||
// Copyright 2022 Google LLC
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// https://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
|
||||
// versions:
|
||||
// - protoc-gen-go-grpc v1.3.0
|
||||
// - protoc v3.21.12
|
||||
// source: internal/proto/v2/s2a/s2a.proto
|
||||
|
||||
package s2a_go_proto
|
||||
|
||||
import (
|
||||
context "context"
|
||||
grpc "google.golang.org/grpc"
|
||||
codes "google.golang.org/grpc/codes"
|
||||
status "google.golang.org/grpc/status"
|
||||
)
|
||||
|
||||
// This is a compile-time assertion to ensure that this generated file
|
||||
// is compatible with the grpc package it is being compiled against.
|
||||
// Requires gRPC-Go v1.32.0 or later.
|
||||
const _ = grpc.SupportPackageIsVersion7
|
||||
|
||||
const (
|
||||
S2AService_SetUpSession_FullMethodName = "/s2a.proto.v2.S2AService/SetUpSession"
|
||||
)
|
||||
|
||||
// S2AServiceClient is the client API for S2AService service.
|
||||
//
|
||||
// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
|
||||
type S2AServiceClient interface {
|
||||
// SetUpSession is a bidirectional stream used by applications to offload
|
||||
// operations from the TLS handshake.
|
||||
SetUpSession(ctx context.Context, opts ...grpc.CallOption) (S2AService_SetUpSessionClient, error)
|
||||
}
|
||||
|
||||
type s2AServiceClient struct {
|
||||
cc grpc.ClientConnInterface
|
||||
}
|
||||
|
||||
func NewS2AServiceClient(cc grpc.ClientConnInterface) S2AServiceClient {
|
||||
return &s2AServiceClient{cc}
|
||||
}
|
||||
|
||||
func (c *s2AServiceClient) SetUpSession(ctx context.Context, opts ...grpc.CallOption) (S2AService_SetUpSessionClient, error) {
|
||||
stream, err := c.cc.NewStream(ctx, &S2AService_ServiceDesc.Streams[0], S2AService_SetUpSession_FullMethodName, opts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
x := &s2AServiceSetUpSessionClient{stream}
|
||||
return x, nil
|
||||
}
|
||||
|
||||
type S2AService_SetUpSessionClient interface {
|
||||
Send(*SessionReq) error
|
||||
Recv() (*SessionResp, error)
|
||||
grpc.ClientStream
|
||||
}
|
||||
|
||||
type s2AServiceSetUpSessionClient struct {
|
||||
grpc.ClientStream
|
||||
}
|
||||
|
||||
func (x *s2AServiceSetUpSessionClient) Send(m *SessionReq) error {
|
||||
return x.ClientStream.SendMsg(m)
|
||||
}
|
||||
|
||||
func (x *s2AServiceSetUpSessionClient) Recv() (*SessionResp, error) {
|
||||
m := new(SessionResp)
|
||||
if err := x.ClientStream.RecvMsg(m); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return m, nil
|
||||
}
|
||||
|
||||
// S2AServiceServer is the server API for S2AService service.
|
||||
// All implementations must embed UnimplementedS2AServiceServer
|
||||
// for forward compatibility
|
||||
type S2AServiceServer interface {
|
||||
// SetUpSession is a bidirectional stream used by applications to offload
|
||||
// operations from the TLS handshake.
|
||||
SetUpSession(S2AService_SetUpSessionServer) error
|
||||
mustEmbedUnimplementedS2AServiceServer()
|
||||
}
|
||||
|
||||
// UnimplementedS2AServiceServer must be embedded to have forward compatible implementations.
|
||||
type UnimplementedS2AServiceServer struct {
|
||||
}
|
||||
|
||||
func (UnimplementedS2AServiceServer) SetUpSession(S2AService_SetUpSessionServer) error {
|
||||
return status.Errorf(codes.Unimplemented, "method SetUpSession not implemented")
|
||||
}
|
||||
func (UnimplementedS2AServiceServer) mustEmbedUnimplementedS2AServiceServer() {}
|
||||
|
||||
// UnsafeS2AServiceServer may be embedded to opt out of forward compatibility for this service.
|
||||
// Use of this interface is not recommended, as added methods to S2AServiceServer will
|
||||
// result in compilation errors.
|
||||
type UnsafeS2AServiceServer interface {
|
||||
mustEmbedUnimplementedS2AServiceServer()
|
||||
}
|
||||
|
||||
func RegisterS2AServiceServer(s grpc.ServiceRegistrar, srv S2AServiceServer) {
|
||||
s.RegisterService(&S2AService_ServiceDesc, srv)
|
||||
}
|
||||
|
||||
func _S2AService_SetUpSession_Handler(srv interface{}, stream grpc.ServerStream) error {
|
||||
return srv.(S2AServiceServer).SetUpSession(&s2AServiceSetUpSessionServer{stream})
|
||||
}
|
||||
|
||||
type S2AService_SetUpSessionServer interface {
|
||||
Send(*SessionResp) error
|
||||
Recv() (*SessionReq, error)
|
||||
grpc.ServerStream
|
||||
}
|
||||
|
||||
type s2AServiceSetUpSessionServer struct {
|
||||
grpc.ServerStream
|
||||
}
|
||||
|
||||
func (x *s2AServiceSetUpSessionServer) Send(m *SessionResp) error {
|
||||
return x.ServerStream.SendMsg(m)
|
||||
}
|
||||
|
||||
func (x *s2AServiceSetUpSessionServer) Recv() (*SessionReq, error) {
|
||||
m := new(SessionReq)
|
||||
if err := x.ServerStream.RecvMsg(m); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return m, nil
|
||||
}
|
||||
|
||||
// S2AService_ServiceDesc is the grpc.ServiceDesc for S2AService service.
|
||||
// It's only intended for direct use with grpc.RegisterService,
|
||||
// and not to be introspected or modified (even as a copy)
|
||||
var S2AService_ServiceDesc = grpc.ServiceDesc{
|
||||
ServiceName: "s2a.proto.v2.S2AService",
|
||||
HandlerType: (*S2AServiceServer)(nil),
|
||||
Methods: []grpc.MethodDesc{},
|
||||
Streams: []grpc.StreamDesc{
|
||||
{
|
||||
StreamName: "SetUpSession",
|
||||
Handler: _S2AService_SetUpSession_Handler,
|
||||
ServerStreams: true,
|
||||
ClientStreams: true,
|
||||
},
|
||||
},
|
||||
Metadata: "internal/proto/v2/s2a/s2a.proto",
|
||||
}
|
||||
34
vendor/github.com/google/s2a-go/internal/record/internal/aeadcrypter/aeadcrypter.go
generated
vendored
Normal file
34
vendor/github.com/google/s2a-go/internal/record/internal/aeadcrypter/aeadcrypter.go
generated
vendored
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package aeadcrypter provides the interface for AEAD cipher implementations
|
||||
// used by S2A's record protocol.
|
||||
package aeadcrypter
|
||||
|
||||
// S2AAEADCrypter is the interface for an AEAD cipher used by the S2A record
|
||||
// protocol.
|
||||
type S2AAEADCrypter interface {
|
||||
// Encrypt encrypts the plaintext and computes the tag of dst and plaintext.
|
||||
// dst and plaintext may fully overlap or not at all.
|
||||
Encrypt(dst, plaintext, nonce, aad []byte) ([]byte, error)
|
||||
// Decrypt decrypts ciphertext and verifies the tag. dst and ciphertext may
|
||||
// fully overlap or not at all.
|
||||
Decrypt(dst, ciphertext, nonce, aad []byte) ([]byte, error)
|
||||
// TagSize returns the tag size in bytes.
|
||||
TagSize() int
|
||||
}
|
||||
70
vendor/github.com/google/s2a-go/internal/record/internal/aeadcrypter/aesgcm.go
generated
vendored
Normal file
70
vendor/github.com/google/s2a-go/internal/record/internal/aeadcrypter/aesgcm.go
generated
vendored
Normal file
|
|
@ -0,0 +1,70 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
package aeadcrypter
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
// Supported key sizes in bytes.
|
||||
const (
|
||||
AES128GCMKeySize = 16
|
||||
AES256GCMKeySize = 32
|
||||
)
|
||||
|
||||
// aesgcm is the struct that holds an AES-GCM cipher for the S2A AEAD crypter.
|
||||
type aesgcm struct {
|
||||
aead cipher.AEAD
|
||||
}
|
||||
|
||||
// NewAESGCM creates an AES-GCM crypter instance. Note that the key must be
|
||||
// either 128 bits or 256 bits.
|
||||
func NewAESGCM(key []byte) (S2AAEADCrypter, error) {
|
||||
if len(key) != AES128GCMKeySize && len(key) != AES256GCMKeySize {
|
||||
return nil, fmt.Errorf("%d or %d bytes, given: %d", AES128GCMKeySize, AES256GCMKeySize, len(key))
|
||||
}
|
||||
c, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
a, err := cipher.NewGCM(c)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &aesgcm{aead: a}, nil
|
||||
}
|
||||
|
||||
// Encrypt is the encryption function. dst can contain bytes at the beginning of
|
||||
// the ciphertext that will not be encrypted but will be authenticated. If dst
|
||||
// has enough capacity to hold these bytes, the ciphertext and the tag, no
|
||||
// allocation and copy operations will be performed. dst and plaintext may
|
||||
// fully overlap or not at all.
|
||||
func (s *aesgcm) Encrypt(dst, plaintext, nonce, aad []byte) ([]byte, error) {
|
||||
return encrypt(s.aead, dst, plaintext, nonce, aad)
|
||||
}
|
||||
|
||||
func (s *aesgcm) Decrypt(dst, ciphertext, nonce, aad []byte) ([]byte, error) {
|
||||
return decrypt(s.aead, dst, ciphertext, nonce, aad)
|
||||
}
|
||||
|
||||
func (s *aesgcm) TagSize() int {
|
||||
return TagSize
|
||||
}
|
||||
67
vendor/github.com/google/s2a-go/internal/record/internal/aeadcrypter/chachapoly.go
generated
vendored
Normal file
67
vendor/github.com/google/s2a-go/internal/record/internal/aeadcrypter/chachapoly.go
generated
vendored
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
package aeadcrypter
|
||||
|
||||
import (
|
||||
"crypto/cipher"
|
||||
"fmt"
|
||||
|
||||
"golang.org/x/crypto/chacha20poly1305"
|
||||
)
|
||||
|
||||
// Supported key size in bytes.
|
||||
const (
|
||||
Chacha20Poly1305KeySize = 32
|
||||
)
|
||||
|
||||
// chachapoly is the struct that holds a CHACHA-POLY cipher for the S2A AEAD
|
||||
// crypter.
|
||||
type chachapoly struct {
|
||||
aead cipher.AEAD
|
||||
}
|
||||
|
||||
// NewChachaPoly creates a Chacha-Poly crypter instance. Note that the key must
|
||||
// be Chacha20Poly1305KeySize bytes in length.
|
||||
func NewChachaPoly(key []byte) (S2AAEADCrypter, error) {
|
||||
if len(key) != Chacha20Poly1305KeySize {
|
||||
return nil, fmt.Errorf("%d bytes, given: %d", Chacha20Poly1305KeySize, len(key))
|
||||
}
|
||||
c, err := chacha20poly1305.New(key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &chachapoly{aead: c}, nil
|
||||
}
|
||||
|
||||
// Encrypt is the encryption function. dst can contain bytes at the beginning of
|
||||
// the ciphertext that will not be encrypted but will be authenticated. If dst
|
||||
// has enough capacity to hold these bytes, the ciphertext and the tag, no
|
||||
// allocation and copy operations will be performed. dst and plaintext may
|
||||
// fully overlap or not at all.
|
||||
func (s *chachapoly) Encrypt(dst, plaintext, nonce, aad []byte) ([]byte, error) {
|
||||
return encrypt(s.aead, dst, plaintext, nonce, aad)
|
||||
}
|
||||
|
||||
func (s *chachapoly) Decrypt(dst, ciphertext, nonce, aad []byte) ([]byte, error) {
|
||||
return decrypt(s.aead, dst, ciphertext, nonce, aad)
|
||||
}
|
||||
|
||||
func (s *chachapoly) TagSize() int {
|
||||
return TagSize
|
||||
}
|
||||
92
vendor/github.com/google/s2a-go/internal/record/internal/aeadcrypter/common.go
generated
vendored
Normal file
92
vendor/github.com/google/s2a-go/internal/record/internal/aeadcrypter/common.go
generated
vendored
Normal file
|
|
@ -0,0 +1,92 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
package aeadcrypter
|
||||
|
||||
import (
|
||||
"crypto/cipher"
|
||||
"fmt"
|
||||
)
|
||||
|
||||
const (
|
||||
// TagSize is the tag size in bytes for AES-128-GCM-SHA256,
|
||||
// AES-256-GCM-SHA384, and CHACHA20-POLY1305-SHA256.
|
||||
TagSize = 16
|
||||
// NonceSize is the size of the nonce in number of bytes for
|
||||
// AES-128-GCM-SHA256, AES-256-GCM-SHA384, and CHACHA20-POLY1305-SHA256.
|
||||
NonceSize = 12
|
||||
// SHA256DigestSize is the digest size of sha256 in bytes.
|
||||
SHA256DigestSize = 32
|
||||
// SHA384DigestSize is the digest size of sha384 in bytes.
|
||||
SHA384DigestSize = 48
|
||||
)
|
||||
|
||||
// sliceForAppend takes a slice and a requested number of bytes. It returns a
|
||||
// slice with the contents of the given slice followed by that many bytes and a
|
||||
// second slice that aliases into it and contains only the extra bytes. If the
|
||||
// original slice has sufficient capacity then no allocation is performed.
|
||||
func sliceForAppend(in []byte, n int) (head, tail []byte) {
|
||||
if total := len(in) + n; cap(in) >= total {
|
||||
head = in[:total]
|
||||
} else {
|
||||
head = make([]byte, total)
|
||||
copy(head, in)
|
||||
}
|
||||
tail = head[len(in):]
|
||||
return head, tail
|
||||
}
|
||||
|
||||
// encrypt is the encryption function for an AEAD crypter. aead determines
|
||||
// the type of AEAD crypter. dst can contain bytes at the beginning of the
|
||||
// ciphertext that will not be encrypted but will be authenticated. If dst has
|
||||
// enough capacity to hold these bytes, the ciphertext and the tag, no
|
||||
// allocation and copy operations will be performed. dst and plaintext may
|
||||
// fully overlap or not at all.
|
||||
func encrypt(aead cipher.AEAD, dst, plaintext, nonce, aad []byte) ([]byte, error) {
|
||||
if len(nonce) != NonceSize {
|
||||
return nil, fmt.Errorf("nonce size must be %d bytes. received: %d", NonceSize, len(nonce))
|
||||
}
|
||||
// If we need to allocate an output buffer, we want to include space for
|
||||
// the tag to avoid forcing the caller to reallocate as well.
|
||||
dlen := len(dst)
|
||||
dst, out := sliceForAppend(dst, len(plaintext)+TagSize)
|
||||
data := out[:len(plaintext)]
|
||||
copy(data, plaintext) // data may fully overlap plaintext
|
||||
|
||||
// Seal appends the ciphertext and the tag to its first argument and
|
||||
// returns the updated slice. However, sliceForAppend above ensures that
|
||||
// dst has enough capacity to avoid a reallocation and copy due to the
|
||||
// append.
|
||||
dst = aead.Seal(dst[:dlen], nonce, data, aad)
|
||||
return dst, nil
|
||||
}
|
||||
|
||||
// decrypt is the decryption function for an AEAD crypter, where aead determines
|
||||
// the type of AEAD crypter, and dst the destination bytes for the decrypted
|
||||
// ciphertext. The dst buffer may fully overlap with plaintext or not at all.
|
||||
func decrypt(aead cipher.AEAD, dst, ciphertext, nonce, aad []byte) ([]byte, error) {
|
||||
if len(nonce) != NonceSize {
|
||||
return nil, fmt.Errorf("nonce size must be %d bytes. received: %d", NonceSize, len(nonce))
|
||||
}
|
||||
// If dst is equal to ciphertext[:0], ciphertext storage is reused.
|
||||
plaintext, err := aead.Open(dst, nonce, ciphertext, aad)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("message auth failed: %v", err)
|
||||
}
|
||||
return plaintext, nil
|
||||
}
|
||||
98
vendor/github.com/google/s2a-go/internal/record/internal/halfconn/ciphersuite.go
generated
vendored
Normal file
98
vendor/github.com/google/s2a-go/internal/record/internal/halfconn/ciphersuite.go
generated
vendored
Normal file
|
|
@ -0,0 +1,98 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
package halfconn
|
||||
|
||||
import (
|
||||
"crypto/sha256"
|
||||
"crypto/sha512"
|
||||
"fmt"
|
||||
"hash"
|
||||
|
||||
s2apb "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
"github.com/google/s2a-go/internal/record/internal/aeadcrypter"
|
||||
)
|
||||
|
||||
// ciphersuite is the interface for retrieving ciphersuite-specific information
|
||||
// and utilities.
|
||||
type ciphersuite interface {
|
||||
// keySize returns the key size in bytes. This refers to the key used by
|
||||
// the AEAD crypter. This is derived by calling HKDF expand on the traffic
|
||||
// secret.
|
||||
keySize() int
|
||||
// nonceSize returns the nonce size in bytes.
|
||||
nonceSize() int
|
||||
// trafficSecretSize returns the traffic secret size in bytes. This refers
|
||||
// to the secret used to derive the traffic key and nonce, as specified in
|
||||
// https://tools.ietf.org/html/rfc8446#section-7.
|
||||
trafficSecretSize() int
|
||||
// hashFunction returns the hash function for the ciphersuite.
|
||||
hashFunction() func() hash.Hash
|
||||
// aeadCrypter takes a key and creates an AEAD crypter for the ciphersuite
|
||||
// using that key.
|
||||
aeadCrypter(key []byte) (aeadcrypter.S2AAEADCrypter, error)
|
||||
}
|
||||
|
||||
func newCiphersuite(ciphersuite s2apb.Ciphersuite) (ciphersuite, error) {
|
||||
switch ciphersuite {
|
||||
case s2apb.Ciphersuite_AES_128_GCM_SHA256:
|
||||
return &aesgcm128sha256{}, nil
|
||||
case s2apb.Ciphersuite_AES_256_GCM_SHA384:
|
||||
return &aesgcm256sha384{}, nil
|
||||
case s2apb.Ciphersuite_CHACHA20_POLY1305_SHA256:
|
||||
return &chachapolysha256{}, nil
|
||||
default:
|
||||
return nil, fmt.Errorf("unrecognized ciphersuite: %v", ciphersuite)
|
||||
}
|
||||
}
|
||||
|
||||
// aesgcm128sha256 is the AES-128-GCM-SHA256 implementation of the ciphersuite
|
||||
// interface.
|
||||
type aesgcm128sha256 struct{}
|
||||
|
||||
func (aesgcm128sha256) keySize() int { return aeadcrypter.AES128GCMKeySize }
|
||||
func (aesgcm128sha256) nonceSize() int { return aeadcrypter.NonceSize }
|
||||
func (aesgcm128sha256) trafficSecretSize() int { return aeadcrypter.SHA256DigestSize }
|
||||
func (aesgcm128sha256) hashFunction() func() hash.Hash { return sha256.New }
|
||||
func (aesgcm128sha256) aeadCrypter(key []byte) (aeadcrypter.S2AAEADCrypter, error) {
|
||||
return aeadcrypter.NewAESGCM(key)
|
||||
}
|
||||
|
||||
// aesgcm256sha384 is the AES-256-GCM-SHA384 implementation of the ciphersuite
|
||||
// interface.
|
||||
type aesgcm256sha384 struct{}
|
||||
|
||||
func (aesgcm256sha384) keySize() int { return aeadcrypter.AES256GCMKeySize }
|
||||
func (aesgcm256sha384) nonceSize() int { return aeadcrypter.NonceSize }
|
||||
func (aesgcm256sha384) trafficSecretSize() int { return aeadcrypter.SHA384DigestSize }
|
||||
func (aesgcm256sha384) hashFunction() func() hash.Hash { return sha512.New384 }
|
||||
func (aesgcm256sha384) aeadCrypter(key []byte) (aeadcrypter.S2AAEADCrypter, error) {
|
||||
return aeadcrypter.NewAESGCM(key)
|
||||
}
|
||||
|
||||
// chachapolysha256 is the ChaChaPoly-SHA256 implementation of the ciphersuite
|
||||
// interface.
|
||||
type chachapolysha256 struct{}
|
||||
|
||||
func (chachapolysha256) keySize() int { return aeadcrypter.Chacha20Poly1305KeySize }
|
||||
func (chachapolysha256) nonceSize() int { return aeadcrypter.NonceSize }
|
||||
func (chachapolysha256) trafficSecretSize() int { return aeadcrypter.SHA256DigestSize }
|
||||
func (chachapolysha256) hashFunction() func() hash.Hash { return sha256.New }
|
||||
func (chachapolysha256) aeadCrypter(key []byte) (aeadcrypter.S2AAEADCrypter, error) {
|
||||
return aeadcrypter.NewChachaPoly(key)
|
||||
}
|
||||
60
vendor/github.com/google/s2a-go/internal/record/internal/halfconn/counter.go
generated
vendored
Normal file
60
vendor/github.com/google/s2a-go/internal/record/internal/halfconn/counter.go
generated
vendored
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
package halfconn
|
||||
|
||||
import "errors"
|
||||
|
||||
// counter is a 64-bit counter.
|
||||
type counter struct {
|
||||
val uint64
|
||||
hasOverflowed bool
|
||||
}
|
||||
|
||||
// newCounter creates a new counter with the initial value set to val.
|
||||
func newCounter(val uint64) counter {
|
||||
return counter{val: val}
|
||||
}
|
||||
|
||||
// value returns the current value of the counter.
|
||||
func (c *counter) value() (uint64, error) {
|
||||
if c.hasOverflowed {
|
||||
return 0, errors.New("counter has overflowed")
|
||||
}
|
||||
return c.val, nil
|
||||
}
|
||||
|
||||
// increment increments the counter and checks for overflow.
|
||||
func (c *counter) increment() {
|
||||
// If the counter is already invalid due to overflow, there is no need to
|
||||
// increase it. We check for the hasOverflowed flag in the call to value().
|
||||
if c.hasOverflowed {
|
||||
return
|
||||
}
|
||||
c.val++
|
||||
if c.val == 0 {
|
||||
c.hasOverflowed = true
|
||||
}
|
||||
}
|
||||
|
||||
// reset sets the counter value to zero and sets the hasOverflowed flag to
|
||||
// false.
|
||||
func (c *counter) reset() {
|
||||
c.val = 0
|
||||
c.hasOverflowed = false
|
||||
}
|
||||
59
vendor/github.com/google/s2a-go/internal/record/internal/halfconn/expander.go
generated
vendored
Normal file
59
vendor/github.com/google/s2a-go/internal/record/internal/halfconn/expander.go
generated
vendored
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
package halfconn
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"hash"
|
||||
|
||||
"golang.org/x/crypto/hkdf"
|
||||
)
|
||||
|
||||
// hkdfExpander is the interface for the HKDF expansion function; see
|
||||
// https://tools.ietf.org/html/rfc5869 for details. its use in TLS 1.3 is
|
||||
// specified in https://tools.ietf.org/html/rfc8446#section-7.2
|
||||
type hkdfExpander interface {
|
||||
// expand takes a secret, a label, and the output length in bytes, and
|
||||
// returns the resulting expanded key.
|
||||
expand(secret, label []byte, length int) ([]byte, error)
|
||||
}
|
||||
|
||||
// defaultHKDFExpander is the default HKDF expander which uses Go's crypto/hkdf
|
||||
// for HKDF expansion.
|
||||
type defaultHKDFExpander struct {
|
||||
h func() hash.Hash
|
||||
}
|
||||
|
||||
// newDefaultHKDFExpander creates an instance of the default HKDF expander
|
||||
// using the given hash function.
|
||||
func newDefaultHKDFExpander(h func() hash.Hash) hkdfExpander {
|
||||
return &defaultHKDFExpander{h: h}
|
||||
}
|
||||
|
||||
func (d *defaultHKDFExpander) expand(secret, label []byte, length int) ([]byte, error) {
|
||||
outBuf := make([]byte, length)
|
||||
n, err := hkdf.Expand(d.h, secret, label).Read(outBuf)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("hkdf.Expand.Read failed with error: %v", err)
|
||||
}
|
||||
if n < length {
|
||||
return nil, fmt.Errorf("hkdf.Expand.Read returned unexpected length, got %d, want %d", n, length)
|
||||
}
|
||||
return outBuf, nil
|
||||
}
|
||||
193
vendor/github.com/google/s2a-go/internal/record/internal/halfconn/halfconn.go
generated
vendored
Normal file
193
vendor/github.com/google/s2a-go/internal/record/internal/halfconn/halfconn.go
generated
vendored
Normal file
|
|
@ -0,0 +1,193 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package halfconn manages the inbound or outbound traffic of a TLS 1.3
|
||||
// connection.
|
||||
package halfconn
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"sync"
|
||||
|
||||
s2apb "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
"github.com/google/s2a-go/internal/record/internal/aeadcrypter"
|
||||
"golang.org/x/crypto/cryptobyte"
|
||||
)
|
||||
|
||||
// The constants below were taken from Section 7.2 and 7.3 in
|
||||
// https://tools.ietf.org/html/rfc8446#section-7. They are used as the label
|
||||
// in HKDF-Expand-Label.
|
||||
const (
|
||||
tls13Key = "tls13 key"
|
||||
tls13Nonce = "tls13 iv"
|
||||
tls13Update = "tls13 traffic upd"
|
||||
)
|
||||
|
||||
// S2AHalfConnection stores the state of the TLS 1.3 connection in the
|
||||
// inbound or outbound direction.
|
||||
type S2AHalfConnection struct {
|
||||
cs ciphersuite
|
||||
expander hkdfExpander
|
||||
// mutex guards sequence, aeadCrypter, trafficSecret, and nonce.
|
||||
mutex sync.Mutex
|
||||
aeadCrypter aeadcrypter.S2AAEADCrypter
|
||||
sequence counter
|
||||
trafficSecret []byte
|
||||
nonce []byte
|
||||
}
|
||||
|
||||
// New creates a new instance of S2AHalfConnection given a ciphersuite and a
|
||||
// traffic secret.
|
||||
func New(ciphersuite s2apb.Ciphersuite, trafficSecret []byte, sequence uint64) (*S2AHalfConnection, error) {
|
||||
cs, err := newCiphersuite(ciphersuite)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to create new ciphersuite: %v", ciphersuite)
|
||||
}
|
||||
if cs.trafficSecretSize() != len(trafficSecret) {
|
||||
return nil, fmt.Errorf("supplied traffic secret must be %v bytes, given: %v bytes", cs.trafficSecretSize(), len(trafficSecret))
|
||||
}
|
||||
|
||||
hc := &S2AHalfConnection{cs: cs, expander: newDefaultHKDFExpander(cs.hashFunction()), sequence: newCounter(sequence), trafficSecret: trafficSecret}
|
||||
if err = hc.updateCrypterAndNonce(hc.trafficSecret); err != nil {
|
||||
return nil, fmt.Errorf("failed to create half connection using traffic secret: %v", err)
|
||||
}
|
||||
|
||||
return hc, nil
|
||||
}
|
||||
|
||||
// Encrypt encrypts the plaintext and computes the tag of dst and plaintext.
|
||||
// dst and plaintext may fully overlap or not at all. Note that the sequence
|
||||
// number will still be incremented on failure, unless the sequence has
|
||||
// overflowed.
|
||||
func (hc *S2AHalfConnection) Encrypt(dst, plaintext, aad []byte) ([]byte, error) {
|
||||
hc.mutex.Lock()
|
||||
sequence, err := hc.getAndIncrementSequence()
|
||||
if err != nil {
|
||||
hc.mutex.Unlock()
|
||||
return nil, err
|
||||
}
|
||||
nonce := hc.maskedNonce(sequence)
|
||||
crypter := hc.aeadCrypter
|
||||
hc.mutex.Unlock()
|
||||
return crypter.Encrypt(dst, plaintext, nonce, aad)
|
||||
}
|
||||
|
||||
// Decrypt decrypts ciphertext and verifies the tag. dst and ciphertext may
|
||||
// fully overlap or not at all. Note that the sequence number will still be
|
||||
// incremented on failure, unless the sequence has overflowed.
|
||||
func (hc *S2AHalfConnection) Decrypt(dst, ciphertext, aad []byte) ([]byte, error) {
|
||||
hc.mutex.Lock()
|
||||
sequence, err := hc.getAndIncrementSequence()
|
||||
if err != nil {
|
||||
hc.mutex.Unlock()
|
||||
return nil, err
|
||||
}
|
||||
nonce := hc.maskedNonce(sequence)
|
||||
crypter := hc.aeadCrypter
|
||||
hc.mutex.Unlock()
|
||||
return crypter.Decrypt(dst, ciphertext, nonce, aad)
|
||||
}
|
||||
|
||||
// UpdateKey advances the traffic secret key, as specified in
|
||||
// https://tools.ietf.org/html/rfc8446#section-7.2. In addition, it derives
|
||||
// a new key and nonce, and resets the sequence number.
|
||||
func (hc *S2AHalfConnection) UpdateKey() error {
|
||||
hc.mutex.Lock()
|
||||
defer hc.mutex.Unlock()
|
||||
|
||||
var err error
|
||||
hc.trafficSecret, err = hc.deriveSecret(hc.trafficSecret, []byte(tls13Update), hc.cs.trafficSecretSize())
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to derive traffic secret: %v", err)
|
||||
}
|
||||
|
||||
if err = hc.updateCrypterAndNonce(hc.trafficSecret); err != nil {
|
||||
return fmt.Errorf("failed to update half connection: %v", err)
|
||||
}
|
||||
|
||||
hc.sequence.reset()
|
||||
return nil
|
||||
}
|
||||
|
||||
// TagSize returns the tag size in bytes of the underlying AEAD crypter.
|
||||
func (hc *S2AHalfConnection) TagSize() int {
|
||||
return hc.aeadCrypter.TagSize()
|
||||
}
|
||||
|
||||
// updateCrypterAndNonce takes a new traffic secret and updates the crypter
|
||||
// and nonce. Note that the mutex must be held while calling this function.
|
||||
func (hc *S2AHalfConnection) updateCrypterAndNonce(newTrafficSecret []byte) error {
|
||||
key, err := hc.deriveSecret(newTrafficSecret, []byte(tls13Key), hc.cs.keySize())
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to update key: %v", err)
|
||||
}
|
||||
|
||||
hc.nonce, err = hc.deriveSecret(newTrafficSecret, []byte(tls13Nonce), hc.cs.nonceSize())
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to update nonce: %v", err)
|
||||
}
|
||||
|
||||
hc.aeadCrypter, err = hc.cs.aeadCrypter(key)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to update AEAD crypter: %v", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// getAndIncrement returns the current sequence number and increments it. Note
|
||||
// that the mutex must be held while calling this function.
|
||||
func (hc *S2AHalfConnection) getAndIncrementSequence() (uint64, error) {
|
||||
sequence, err := hc.sequence.value()
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
hc.sequence.increment()
|
||||
return sequence, nil
|
||||
}
|
||||
|
||||
// maskedNonce creates a copy of the nonce that is masked with the sequence
|
||||
// number. Note that the mutex must be held while calling this function.
|
||||
func (hc *S2AHalfConnection) maskedNonce(sequence uint64) []byte {
|
||||
const uint64Size = 8
|
||||
nonce := make([]byte, len(hc.nonce))
|
||||
copy(nonce, hc.nonce)
|
||||
for i := 0; i < uint64Size; i++ {
|
||||
nonce[aeadcrypter.NonceSize-uint64Size+i] ^= byte(sequence >> uint64(56-uint64Size*i))
|
||||
}
|
||||
return nonce
|
||||
}
|
||||
|
||||
// deriveSecret implements the Derive-Secret function, as specified in
|
||||
// https://tools.ietf.org/html/rfc8446#section-7.1.
|
||||
func (hc *S2AHalfConnection) deriveSecret(secret, label []byte, length int) ([]byte, error) {
|
||||
var hkdfLabel cryptobyte.Builder
|
||||
hkdfLabel.AddUint16(uint16(length))
|
||||
hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
|
||||
b.AddBytes(label)
|
||||
})
|
||||
// Append an empty `Context` field to the label, as specified in the RFC.
|
||||
// The half connection does not use the `Context` field.
|
||||
hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
|
||||
b.AddBytes([]byte(""))
|
||||
})
|
||||
hkdfLabelBytes, err := hkdfLabel.Bytes()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("deriveSecret failed: %v", err)
|
||||
}
|
||||
return hc.expander.expand(secret, hkdfLabelBytes, length)
|
||||
}
|
||||
757
vendor/github.com/google/s2a-go/internal/record/record.go
generated
vendored
Normal file
757
vendor/github.com/google/s2a-go/internal/record/record.go
generated
vendored
Normal file
|
|
@ -0,0 +1,757 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package record implements the TLS 1.3 record protocol used by the S2A
|
||||
// transport credentials.
|
||||
package record
|
||||
|
||||
import (
|
||||
"encoding/binary"
|
||||
"errors"
|
||||
"fmt"
|
||||
"math"
|
||||
"net"
|
||||
"sync"
|
||||
|
||||
commonpb "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
"github.com/google/s2a-go/internal/record/internal/halfconn"
|
||||
"github.com/google/s2a-go/internal/tokenmanager"
|
||||
"google.golang.org/grpc/grpclog"
|
||||
)
|
||||
|
||||
// recordType is the `ContentType` as described in
|
||||
// https://tools.ietf.org/html/rfc8446#section-5.1.
|
||||
type recordType byte
|
||||
|
||||
const (
|
||||
alert recordType = 21
|
||||
handshake recordType = 22
|
||||
applicationData recordType = 23
|
||||
)
|
||||
|
||||
// keyUpdateRequest is the `KeyUpdateRequest` as described in
|
||||
// https://tools.ietf.org/html/rfc8446#section-4.6.3.
|
||||
type keyUpdateRequest byte
|
||||
|
||||
const (
|
||||
updateNotRequested keyUpdateRequest = 0
|
||||
updateRequested keyUpdateRequest = 1
|
||||
)
|
||||
|
||||
// alertDescription is the `AlertDescription` as described in
|
||||
// https://tools.ietf.org/html/rfc8446#section-6.
|
||||
type alertDescription byte
|
||||
|
||||
const (
|
||||
closeNotify alertDescription = 0
|
||||
)
|
||||
|
||||
// sessionTicketState is used to determine whether session tickets have not yet
|
||||
// been received, are in the process of being received, or have finished
|
||||
// receiving.
|
||||
type sessionTicketState byte
|
||||
|
||||
const (
|
||||
ticketsNotYetReceived sessionTicketState = 0
|
||||
receivingTickets sessionTicketState = 1
|
||||
notReceivingTickets sessionTicketState = 2
|
||||
)
|
||||
|
||||
const (
|
||||
// The TLS 1.3-specific constants below (tlsRecordMaxPlaintextSize,
|
||||
// tlsRecordHeaderSize, tlsRecordTypeSize) were taken from
|
||||
// https://tools.ietf.org/html/rfc8446#section-5.1.
|
||||
|
||||
// tlsRecordMaxPlaintextSize is the maximum size in bytes of the plaintext
|
||||
// in a single TLS 1.3 record.
|
||||
tlsRecordMaxPlaintextSize = 16384 // 2^14
|
||||
// tlsRecordTypeSize is the size in bytes of the TLS 1.3 record type.
|
||||
tlsRecordTypeSize = 1
|
||||
// tlsTagSize is the size in bytes of the tag of the following three
|
||||
// ciphersuites: AES-128-GCM-SHA256, AES-256-GCM-SHA384,
|
||||
// CHACHA20-POLY1305-SHA256.
|
||||
tlsTagSize = 16
|
||||
// tlsRecordMaxPayloadSize is the maximum size in bytes of the payload in a
|
||||
// single TLS 1.3 record. This is the maximum size of the plaintext plus the
|
||||
// record type byte and 16 bytes of the tag.
|
||||
tlsRecordMaxPayloadSize = tlsRecordMaxPlaintextSize + tlsRecordTypeSize + tlsTagSize
|
||||
// tlsRecordHeaderTypeSize is the size in bytes of the TLS 1.3 record
|
||||
// header type.
|
||||
tlsRecordHeaderTypeSize = 1
|
||||
// tlsRecordHeaderLegacyRecordVersionSize is the size in bytes of the TLS
|
||||
// 1.3 record header legacy record version.
|
||||
tlsRecordHeaderLegacyRecordVersionSize = 2
|
||||
// tlsRecordHeaderPayloadLengthSize is the size in bytes of the TLS 1.3
|
||||
// record header payload length.
|
||||
tlsRecordHeaderPayloadLengthSize = 2
|
||||
// tlsRecordHeaderSize is the size in bytes of the TLS 1.3 record header.
|
||||
tlsRecordHeaderSize = tlsRecordHeaderTypeSize + tlsRecordHeaderLegacyRecordVersionSize + tlsRecordHeaderPayloadLengthSize
|
||||
// tlsRecordMaxSize
|
||||
tlsRecordMaxSize = tlsRecordMaxPayloadSize + tlsRecordHeaderSize
|
||||
// tlsApplicationData is the application data type of the TLS 1.3 record
|
||||
// header.
|
||||
tlsApplicationData = 23
|
||||
// tlsLegacyRecordVersion is the legacy record version of the TLS record.
|
||||
tlsLegacyRecordVersion = 3
|
||||
// tlsAlertSize is the size in bytes of an alert of TLS 1.3.
|
||||
tlsAlertSize = 2
|
||||
)
|
||||
|
||||
const (
|
||||
// These are TLS 1.3 handshake-specific constants.
|
||||
|
||||
// tlsHandshakeNewSessionTicketType is the prefix of a handshake new session
|
||||
// ticket message of TLS 1.3.
|
||||
tlsHandshakeNewSessionTicketType = 4
|
||||
// tlsHandshakeKeyUpdateType is the prefix of a handshake key update message
|
||||
// of TLS 1.3.
|
||||
tlsHandshakeKeyUpdateType = 24
|
||||
// tlsHandshakeMsgTypeSize is the size in bytes of the TLS 1.3 handshake
|
||||
// message type field.
|
||||
tlsHandshakeMsgTypeSize = 1
|
||||
// tlsHandshakeLengthSize is the size in bytes of the TLS 1.3 handshake
|
||||
// message length field.
|
||||
tlsHandshakeLengthSize = 3
|
||||
// tlsHandshakeKeyUpdateMsgSize is the size in bytes of the TLS 1.3
|
||||
// handshake key update message.
|
||||
tlsHandshakeKeyUpdateMsgSize = 1
|
||||
// tlsHandshakePrefixSize is the size in bytes of the prefix of the TLS 1.3
|
||||
// handshake message.
|
||||
tlsHandshakePrefixSize = 4
|
||||
// tlsMaxSessionTicketSize is the maximum size of a NewSessionTicket message
|
||||
// in TLS 1.3. This is the sum of the max sizes of all the fields in the
|
||||
// NewSessionTicket struct specified in
|
||||
// https://tools.ietf.org/html/rfc8446#section-4.6.1.
|
||||
tlsMaxSessionTicketSize = 131338
|
||||
)
|
||||
|
||||
const (
|
||||
// outBufMaxRecords is the maximum number of records that can fit in the
|
||||
// ourRecordsBuf buffer.
|
||||
outBufMaxRecords = 16
|
||||
// outBufMaxSize is the maximum size (in bytes) of the outRecordsBuf buffer.
|
||||
outBufMaxSize = outBufMaxRecords * tlsRecordMaxSize
|
||||
// maxAllowedTickets is the maximum number of session tickets that are
|
||||
// allowed. The number of tickets are limited to ensure that the size of the
|
||||
// ticket queue does not grow indefinitely. S2A also keeps a limit on the
|
||||
// number of tickets that it caches.
|
||||
maxAllowedTickets = 5
|
||||
)
|
||||
|
||||
// preConstructedKeyUpdateMsg holds the key update message. This is needed as an
|
||||
// optimization so that the same message does not need to be constructed every
|
||||
// time a key update message is sent.
|
||||
var preConstructedKeyUpdateMsg = buildKeyUpdateRequest()
|
||||
|
||||
// conn represents a secured TLS connection. It implements the net.Conn
|
||||
// interface.
|
||||
type conn struct {
|
||||
net.Conn
|
||||
// inConn is the half connection responsible for decrypting incoming bytes.
|
||||
inConn *halfconn.S2AHalfConnection
|
||||
// outConn is the half connection responsible for encrypting outgoing bytes.
|
||||
outConn *halfconn.S2AHalfConnection
|
||||
// pendingApplicationData holds data that has been read from the connection
|
||||
// and decrypted, but has not yet been returned by Read.
|
||||
pendingApplicationData []byte
|
||||
// unusedBuf holds data read from the network that has not yet been
|
||||
// decrypted. This data might not consist of a complete record. It may
|
||||
// consist of several records, the last of which could be incomplete.
|
||||
unusedBuf []byte
|
||||
// outRecordsBuf is a buffer used to store outgoing TLS records before
|
||||
// they are written to the network.
|
||||
outRecordsBuf []byte
|
||||
// nextRecord stores the next record info in the unusedBuf buffer.
|
||||
nextRecord []byte
|
||||
// overheadSize is the overhead size in bytes of each TLS 1.3 record, which
|
||||
// is computed as overheadSize = header size + record type byte + tag size.
|
||||
// Note that there is no padding by zeros in the overhead calculation.
|
||||
overheadSize int
|
||||
// readMutex guards against concurrent calls to Read. This is required since
|
||||
// Close may be called during a Read.
|
||||
readMutex sync.Mutex
|
||||
// writeMutex guards against concurrent calls to Write. This is required
|
||||
// since Close may be called during a Write, and also because a key update
|
||||
// message may be written during a Read.
|
||||
writeMutex sync.Mutex
|
||||
// handshakeBuf holds handshake messages while they are being processed.
|
||||
handshakeBuf []byte
|
||||
// ticketState is the current processing state of the session tickets.
|
||||
ticketState sessionTicketState
|
||||
// sessionTickets holds the completed session tickets until they are sent to
|
||||
// the handshaker service for processing.
|
||||
sessionTickets [][]byte
|
||||
// ticketSender sends session tickets to the S2A handshaker service.
|
||||
ticketSender s2aTicketSender
|
||||
// callComplete is a channel that blocks closing the record protocol until a
|
||||
// pending call to the S2A completes.
|
||||
callComplete chan bool
|
||||
}
|
||||
|
||||
// ConnParameters holds the parameters used for creating a new conn object.
|
||||
type ConnParameters struct {
|
||||
// NetConn is the TCP connection to the peer. This parameter is required.
|
||||
NetConn net.Conn
|
||||
// Ciphersuite is the TLS ciphersuite negotiated by the S2A handshaker
|
||||
// service. This parameter is required.
|
||||
Ciphersuite commonpb.Ciphersuite
|
||||
// TLSVersion is the TLS version number negotiated by the S2A handshaker
|
||||
// service. This parameter is required.
|
||||
TLSVersion commonpb.TLSVersion
|
||||
// InTrafficSecret is the traffic secret used to derive the session key for
|
||||
// the inbound direction. This parameter is required.
|
||||
InTrafficSecret []byte
|
||||
// OutTrafficSecret is the traffic secret used to derive the session key
|
||||
// for the outbound direction. This parameter is required.
|
||||
OutTrafficSecret []byte
|
||||
// UnusedBuf is the data read from the network that has not yet been
|
||||
// decrypted. This parameter is optional. If not provided, then no
|
||||
// application data was sent in the same flight of messages as the final
|
||||
// handshake message.
|
||||
UnusedBuf []byte
|
||||
// InSequence is the sequence number of the next, incoming, TLS record.
|
||||
// This parameter is required.
|
||||
InSequence uint64
|
||||
// OutSequence is the sequence number of the next, outgoing, TLS record.
|
||||
// This parameter is required.
|
||||
OutSequence uint64
|
||||
// HSAddr stores the address of the S2A handshaker service. This parameter
|
||||
// is optional. If not provided, then TLS resumption is disabled.
|
||||
HSAddr string
|
||||
// ConnectionId is the connection identifier that was created and sent by
|
||||
// S2A at the end of a handshake.
|
||||
ConnectionID uint64
|
||||
// LocalIdentity is the local identity that was used by S2A during session
|
||||
// setup and included in the session result.
|
||||
LocalIdentity *commonpb.Identity
|
||||
// EnsureProcessSessionTickets allows users to wait and ensure that all
|
||||
// available session tickets are sent to S2A before a process completes.
|
||||
EnsureProcessSessionTickets *sync.WaitGroup
|
||||
}
|
||||
|
||||
// NewConn creates a TLS record protocol that wraps the TCP connection.
|
||||
func NewConn(o *ConnParameters) (net.Conn, error) {
|
||||
if o == nil {
|
||||
return nil, errors.New("conn options must not be nil")
|
||||
}
|
||||
if o.TLSVersion != commonpb.TLSVersion_TLS1_3 {
|
||||
return nil, errors.New("TLS version must be TLS 1.3")
|
||||
}
|
||||
|
||||
inConn, err := halfconn.New(o.Ciphersuite, o.InTrafficSecret, o.InSequence)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to create inbound half connection: %v", err)
|
||||
}
|
||||
outConn, err := halfconn.New(o.Ciphersuite, o.OutTrafficSecret, o.OutSequence)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to create outbound half connection: %v", err)
|
||||
}
|
||||
|
||||
// The tag size for the in/out connections should be the same.
|
||||
overheadSize := tlsRecordHeaderSize + tlsRecordTypeSize + inConn.TagSize()
|
||||
var unusedBuf []byte
|
||||
if o.UnusedBuf == nil {
|
||||
// We pre-allocate unusedBuf to be of size
|
||||
// 2*tlsRecordMaxSize-1 during initialization. We only read from the
|
||||
// network into unusedBuf when unusedBuf does not contain a complete
|
||||
// record and the incomplete record is at most tlsRecordMaxSize-1
|
||||
// (bytes). And we read at most tlsRecordMaxSize bytes of data from the
|
||||
// network into unusedBuf at one time. Therefore, 2*tlsRecordMaxSize-1
|
||||
// is large enough to buffer data read from the network.
|
||||
unusedBuf = make([]byte, 0, 2*tlsRecordMaxSize-1)
|
||||
} else {
|
||||
unusedBuf = make([]byte, len(o.UnusedBuf))
|
||||
copy(unusedBuf, o.UnusedBuf)
|
||||
}
|
||||
|
||||
tokenManager, err := tokenmanager.NewSingleTokenAccessTokenManager()
|
||||
if err != nil {
|
||||
grpclog.Infof("failed to create single token access token manager: %v", err)
|
||||
}
|
||||
|
||||
s2aConn := &conn{
|
||||
Conn: o.NetConn,
|
||||
inConn: inConn,
|
||||
outConn: outConn,
|
||||
unusedBuf: unusedBuf,
|
||||
outRecordsBuf: make([]byte, tlsRecordMaxSize),
|
||||
nextRecord: unusedBuf,
|
||||
overheadSize: overheadSize,
|
||||
ticketState: ticketsNotYetReceived,
|
||||
// Pre-allocate the buffer for one session ticket message and the max
|
||||
// plaintext size. This is the largest size that handshakeBuf will need
|
||||
// to hold. The largest incomplete handshake message is the
|
||||
// [handshake header size] + [max session ticket size] - 1.
|
||||
// Then, tlsRecordMaxPlaintextSize is the maximum size that will be
|
||||
// appended to the handshakeBuf before the handshake message is
|
||||
// completed. Therefore, the buffer size below should be large enough to
|
||||
// buffer any handshake messages.
|
||||
handshakeBuf: make([]byte, 0, tlsHandshakePrefixSize+tlsMaxSessionTicketSize+tlsRecordMaxPlaintextSize-1),
|
||||
ticketSender: &ticketSender{
|
||||
hsAddr: o.HSAddr,
|
||||
connectionID: o.ConnectionID,
|
||||
localIdentity: o.LocalIdentity,
|
||||
tokenManager: tokenManager,
|
||||
ensureProcessSessionTickets: o.EnsureProcessSessionTickets,
|
||||
},
|
||||
callComplete: make(chan bool),
|
||||
}
|
||||
return s2aConn, nil
|
||||
}
|
||||
|
||||
// Read reads and decrypts a TLS 1.3 record from the underlying connection, and
|
||||
// copies any application data received from the peer into b. If the size of the
|
||||
// payload is greater than len(b), Read retains the remaining bytes in an
|
||||
// internal buffer, and subsequent calls to Read will read from this buffer
|
||||
// until it is exhausted. At most 1 TLS record worth of application data is
|
||||
// written to b for each call to Read.
|
||||
//
|
||||
// Note that for the user to efficiently call this method, the user should
|
||||
// ensure that the buffer b is allocated such that the buffer does not have any
|
||||
// unused segments. This can be done by calling Read via io.ReadFull, which
|
||||
// continually calls Read until the specified buffer has been filled. Also note
|
||||
// that the user should close the connection via Close() if an error is thrown
|
||||
// by a call to Read.
|
||||
func (p *conn) Read(b []byte) (n int, err error) {
|
||||
p.readMutex.Lock()
|
||||
defer p.readMutex.Unlock()
|
||||
// Check if p.pendingApplication data has leftover application data from
|
||||
// the previous call to Read.
|
||||
if len(p.pendingApplicationData) == 0 {
|
||||
// Read a full record from the wire.
|
||||
record, err := p.readFullRecord()
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
// Now we have a complete record, so split the header and validate it
|
||||
// The TLS record is split into 2 pieces: the record header and the
|
||||
// payload. The payload has the following form:
|
||||
// [payload] = [ciphertext of application data]
|
||||
// + [ciphertext of record type byte]
|
||||
// + [(optionally) ciphertext of padding by zeros]
|
||||
// + [tag]
|
||||
header, payload, err := splitAndValidateHeader(record)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
// Decrypt the ciphertext.
|
||||
p.pendingApplicationData, err = p.inConn.Decrypt(payload[:0], payload, header)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
// Remove the padding by zeros and the record type byte from the
|
||||
// p.pendingApplicationData buffer.
|
||||
msgType, err := p.stripPaddingAndType()
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
// Check that the length of the plaintext after stripping the padding
|
||||
// and record type byte is under the maximum plaintext size.
|
||||
if len(p.pendingApplicationData) > tlsRecordMaxPlaintextSize {
|
||||
return 0, errors.New("plaintext size larger than maximum")
|
||||
}
|
||||
// The expected message types are application data, alert, and
|
||||
// handshake. For application data, the bytes are directly copied into
|
||||
// b. For an alert, the type of the alert is checked and the connection
|
||||
// is closed on a close notify alert. For a handshake message, the
|
||||
// handshake message type is checked. The handshake message type can be
|
||||
// a key update type, for which we advance the traffic secret, and a
|
||||
// new session ticket type, for which we send the received ticket to S2A
|
||||
// for processing.
|
||||
switch msgType {
|
||||
case applicationData:
|
||||
if len(p.handshakeBuf) > 0 {
|
||||
return 0, errors.New("application data received while processing fragmented handshake messages")
|
||||
}
|
||||
if p.ticketState == receivingTickets {
|
||||
p.ticketState = notReceivingTickets
|
||||
grpclog.Infof("Sending session tickets to S2A.")
|
||||
p.ticketSender.sendTicketsToS2A(p.sessionTickets, p.callComplete)
|
||||
}
|
||||
case alert:
|
||||
return 0, p.handleAlertMessage()
|
||||
case handshake:
|
||||
if err = p.handleHandshakeMessage(); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return 0, nil
|
||||
default:
|
||||
return 0, errors.New("unknown record type")
|
||||
}
|
||||
}
|
||||
// Write as much application data as possible to b, the output buffer.
|
||||
n = copy(b, p.pendingApplicationData)
|
||||
p.pendingApplicationData = p.pendingApplicationData[n:]
|
||||
return n, nil
|
||||
}
|
||||
|
||||
// Write divides b into segments of size tlsRecordMaxPlaintextSize, builds a
|
||||
// TLS 1.3 record (of type "application data") from each segment, and sends
|
||||
// the record to the peer. It returns the number of plaintext bytes that were
|
||||
// successfully sent to the peer.
|
||||
func (p *conn) Write(b []byte) (n int, err error) {
|
||||
p.writeMutex.Lock()
|
||||
defer p.writeMutex.Unlock()
|
||||
return p.writeTLSRecord(b, tlsApplicationData)
|
||||
}
|
||||
|
||||
// writeTLSRecord divides b into segments of size maxPlaintextBytesPerRecord,
|
||||
// builds a TLS 1.3 record (of type recordType) from each segment, and sends
|
||||
// the record to the peer. It returns the number of plaintext bytes that were
|
||||
// successfully sent to the peer.
|
||||
func (p *conn) writeTLSRecord(b []byte, recordType byte) (n int, err error) {
|
||||
// Create a record of only header, record type, and tag if given empty
|
||||
// byte array.
|
||||
if len(b) == 0 {
|
||||
recordEndIndex, _, err := p.buildRecord(b, recordType, 0)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
|
||||
// Write the bytes stored in outRecordsBuf to p.Conn. Since we return
|
||||
// the number of plaintext bytes written without overhead, we will
|
||||
// always return 0 while p.Conn.Write returns the entire record length.
|
||||
_, err = p.Conn.Write(p.outRecordsBuf[:recordEndIndex])
|
||||
return 0, err
|
||||
}
|
||||
|
||||
numRecords := int(math.Ceil(float64(len(b)) / float64(tlsRecordMaxPlaintextSize)))
|
||||
totalRecordsSize := len(b) + numRecords*p.overheadSize
|
||||
partialBSize := len(b)
|
||||
if totalRecordsSize > outBufMaxSize {
|
||||
totalRecordsSize = outBufMaxSize
|
||||
partialBSize = outBufMaxRecords * tlsRecordMaxPlaintextSize
|
||||
}
|
||||
if len(p.outRecordsBuf) < totalRecordsSize {
|
||||
p.outRecordsBuf = make([]byte, totalRecordsSize)
|
||||
}
|
||||
for bStart := 0; bStart < len(b); bStart += partialBSize {
|
||||
bEnd := bStart + partialBSize
|
||||
if bEnd > len(b) {
|
||||
bEnd = len(b)
|
||||
}
|
||||
partialB := b[bStart:bEnd]
|
||||
recordEndIndex := 0
|
||||
for len(partialB) > 0 {
|
||||
recordEndIndex, partialB, err = p.buildRecord(partialB, recordType, recordEndIndex)
|
||||
if err != nil {
|
||||
// Return the amount of bytes written prior to the error.
|
||||
return bStart, err
|
||||
}
|
||||
}
|
||||
// Write the bytes stored in outRecordsBuf to p.Conn. If there is an
|
||||
// error, calculate the total number of plaintext bytes of complete
|
||||
// records successfully written to the peer and return it.
|
||||
nn, err := p.Conn.Write(p.outRecordsBuf[:recordEndIndex])
|
||||
if err != nil {
|
||||
numberOfCompletedRecords := int(math.Floor(float64(nn) / float64(tlsRecordMaxSize)))
|
||||
return bStart + numberOfCompletedRecords*tlsRecordMaxPlaintextSize, err
|
||||
}
|
||||
}
|
||||
return len(b), nil
|
||||
}
|
||||
|
||||
// buildRecord builds a TLS 1.3 record of type recordType from plaintext,
|
||||
// and writes the record to outRecordsBuf at recordStartIndex. The record will
|
||||
// have at most tlsRecordMaxPlaintextSize bytes of payload. It returns the
|
||||
// index of outRecordsBuf where the current record ends, as well as any
|
||||
// remaining plaintext bytes.
|
||||
func (p *conn) buildRecord(plaintext []byte, recordType byte, recordStartIndex int) (n int, remainingPlaintext []byte, err error) {
|
||||
// Construct the payload, which consists of application data and record type.
|
||||
dataLen := len(plaintext)
|
||||
if dataLen > tlsRecordMaxPlaintextSize {
|
||||
dataLen = tlsRecordMaxPlaintextSize
|
||||
}
|
||||
remainingPlaintext = plaintext[dataLen:]
|
||||
newRecordBuf := p.outRecordsBuf[recordStartIndex:]
|
||||
|
||||
copy(newRecordBuf[tlsRecordHeaderSize:], plaintext[:dataLen])
|
||||
newRecordBuf[tlsRecordHeaderSize+dataLen] = recordType
|
||||
payload := newRecordBuf[tlsRecordHeaderSize : tlsRecordHeaderSize+dataLen+1] // 1 is for the recordType.
|
||||
// Construct the header.
|
||||
newRecordBuf[0] = tlsApplicationData
|
||||
newRecordBuf[1] = tlsLegacyRecordVersion
|
||||
newRecordBuf[2] = tlsLegacyRecordVersion
|
||||
binary.BigEndian.PutUint16(newRecordBuf[3:], uint16(len(payload)+tlsTagSize))
|
||||
header := newRecordBuf[:tlsRecordHeaderSize]
|
||||
|
||||
// Encrypt the payload using header as aad.
|
||||
encryptedPayload, err := p.outConn.Encrypt(newRecordBuf[tlsRecordHeaderSize:][:0], payload, header)
|
||||
if err != nil {
|
||||
return 0, plaintext, err
|
||||
}
|
||||
recordStartIndex += len(header) + len(encryptedPayload)
|
||||
return recordStartIndex, remainingPlaintext, nil
|
||||
}
|
||||
|
||||
func (p *conn) Close() error {
|
||||
p.readMutex.Lock()
|
||||
defer p.readMutex.Unlock()
|
||||
p.writeMutex.Lock()
|
||||
defer p.writeMutex.Unlock()
|
||||
// If p.ticketState is equal to notReceivingTickets, then S2A has
|
||||
// been sent a flight of session tickets, and we must wait for the
|
||||
// call to S2A to complete before closing the record protocol.
|
||||
if p.ticketState == notReceivingTickets {
|
||||
<-p.callComplete
|
||||
grpclog.Infof("Safe to close the connection because sending tickets to S2A is (already) complete.")
|
||||
}
|
||||
return p.Conn.Close()
|
||||
}
|
||||
|
||||
// stripPaddingAndType strips the padding by zeros and record type from
|
||||
// p.pendingApplicationData and returns the record type. Note that
|
||||
// p.pendingApplicationData should be of the form:
|
||||
// [application data] + [record type byte] + [trailing zeros]
|
||||
func (p *conn) stripPaddingAndType() (recordType, error) {
|
||||
if len(p.pendingApplicationData) == 0 {
|
||||
return 0, errors.New("application data had length 0")
|
||||
}
|
||||
i := len(p.pendingApplicationData) - 1
|
||||
// Search for the index of the record type byte.
|
||||
for i > 0 {
|
||||
if p.pendingApplicationData[i] != 0 {
|
||||
break
|
||||
}
|
||||
i--
|
||||
}
|
||||
rt := recordType(p.pendingApplicationData[i])
|
||||
p.pendingApplicationData = p.pendingApplicationData[:i]
|
||||
return rt, nil
|
||||
}
|
||||
|
||||
// readFullRecord reads from the wire until a record is completed and returns
|
||||
// the full record.
|
||||
func (p *conn) readFullRecord() (fullRecord []byte, err error) {
|
||||
fullRecord, p.nextRecord, err = parseReadBuffer(p.nextRecord, tlsRecordMaxPayloadSize)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// Check whether the next record to be decrypted has been completely
|
||||
// received.
|
||||
if len(fullRecord) == 0 {
|
||||
copy(p.unusedBuf, p.nextRecord)
|
||||
p.unusedBuf = p.unusedBuf[:len(p.nextRecord)]
|
||||
// Always copy next incomplete record to the beginning of the
|
||||
// unusedBuf buffer and reset nextRecord to it.
|
||||
p.nextRecord = p.unusedBuf
|
||||
}
|
||||
// Keep reading from the wire until we have a complete record.
|
||||
for len(fullRecord) == 0 {
|
||||
if len(p.unusedBuf) == cap(p.unusedBuf) {
|
||||
tmp := make([]byte, len(p.unusedBuf), cap(p.unusedBuf)+tlsRecordMaxSize)
|
||||
copy(tmp, p.unusedBuf)
|
||||
p.unusedBuf = tmp
|
||||
}
|
||||
n, err := p.Conn.Read(p.unusedBuf[len(p.unusedBuf):min(cap(p.unusedBuf), len(p.unusedBuf)+tlsRecordMaxSize)])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
p.unusedBuf = p.unusedBuf[:len(p.unusedBuf)+n]
|
||||
fullRecord, p.nextRecord, err = parseReadBuffer(p.unusedBuf, tlsRecordMaxPayloadSize)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
return fullRecord, nil
|
||||
}
|
||||
|
||||
// parseReadBuffer parses the provided buffer and returns a full record and any
|
||||
// remaining bytes in that buffer. If the record is incomplete, nil is returned
|
||||
// for the first return value and the given byte buffer is returned for the
|
||||
// second return value. The length of the payload specified by the header should
|
||||
// not be greater than maxLen, otherwise an error is returned. Note that this
|
||||
// function does not allocate or copy any buffers.
|
||||
func parseReadBuffer(b []byte, maxLen uint16) (fullRecord, remaining []byte, err error) {
|
||||
// If the header is not complete, return the provided buffer as remaining
|
||||
// buffer.
|
||||
if len(b) < tlsRecordHeaderSize {
|
||||
return nil, b, nil
|
||||
}
|
||||
msgLenField := b[tlsRecordHeaderTypeSize+tlsRecordHeaderLegacyRecordVersionSize : tlsRecordHeaderSize]
|
||||
length := binary.BigEndian.Uint16(msgLenField)
|
||||
if length > maxLen {
|
||||
return nil, nil, fmt.Errorf("record length larger than the limit %d", maxLen)
|
||||
}
|
||||
if len(b) < int(length)+tlsRecordHeaderSize {
|
||||
// Record is not complete yet.
|
||||
return nil, b, nil
|
||||
}
|
||||
return b[:tlsRecordHeaderSize+length], b[tlsRecordHeaderSize+length:], nil
|
||||
}
|
||||
|
||||
// splitAndValidateHeader splits the header from the payload in the TLS 1.3
|
||||
// record and returns them. Note that the header is checked for validity, and an
|
||||
// error is returned when an invalid header is parsed. Also note that this
|
||||
// function does not allocate or copy any buffers.
|
||||
func splitAndValidateHeader(record []byte) (header, payload []byte, err error) {
|
||||
if len(record) < tlsRecordHeaderSize {
|
||||
return nil, nil, fmt.Errorf("record was smaller than the header size")
|
||||
}
|
||||
header = record[:tlsRecordHeaderSize]
|
||||
payload = record[tlsRecordHeaderSize:]
|
||||
if header[0] != tlsApplicationData {
|
||||
return nil, nil, fmt.Errorf("incorrect type in the header")
|
||||
}
|
||||
// Check the legacy record version, which should be 0x03, 0x03.
|
||||
if header[1] != 0x03 || header[2] != 0x03 {
|
||||
return nil, nil, fmt.Errorf("incorrect legacy record version in the header")
|
||||
}
|
||||
return header, payload, nil
|
||||
}
|
||||
|
||||
// handleAlertMessage handles an alert message.
|
||||
func (p *conn) handleAlertMessage() error {
|
||||
if len(p.pendingApplicationData) != tlsAlertSize {
|
||||
return errors.New("invalid alert message size")
|
||||
}
|
||||
alertType := p.pendingApplicationData[1]
|
||||
// Clear the body of the alert message.
|
||||
p.pendingApplicationData = p.pendingApplicationData[:0]
|
||||
if alertType == byte(closeNotify) {
|
||||
return errors.New("received a close notify alert")
|
||||
}
|
||||
// TODO(matthewstevenson88): Add support for more alert types.
|
||||
return fmt.Errorf("received an unrecognized alert type: %v", alertType)
|
||||
}
|
||||
|
||||
// parseHandshakeHeader parses a handshake message from the handshake buffer.
|
||||
// It returns the message type, the message length, the message, the raw message
|
||||
// that includes the type and length bytes and a flag indicating whether the
|
||||
// handshake message has been fully parsed. i.e. whether the entire handshake
|
||||
// message was in the handshake buffer.
|
||||
func (p *conn) parseHandshakeMsg() (msgType byte, msgLen uint32, msg []byte, rawMsg []byte, ok bool) {
|
||||
// Handle the case where the 4 byte handshake header is fragmented.
|
||||
if len(p.handshakeBuf) < tlsHandshakePrefixSize {
|
||||
return 0, 0, nil, nil, false
|
||||
}
|
||||
msgType = p.handshakeBuf[0]
|
||||
msgLen = bigEndianInt24(p.handshakeBuf[tlsHandshakeMsgTypeSize : tlsHandshakeMsgTypeSize+tlsHandshakeLengthSize])
|
||||
if msgLen > uint32(len(p.handshakeBuf)-tlsHandshakePrefixSize) {
|
||||
return 0, 0, nil, nil, false
|
||||
}
|
||||
msg = p.handshakeBuf[tlsHandshakePrefixSize : tlsHandshakePrefixSize+msgLen]
|
||||
rawMsg = p.handshakeBuf[:tlsHandshakeMsgTypeSize+tlsHandshakeLengthSize+msgLen]
|
||||
p.handshakeBuf = p.handshakeBuf[tlsHandshakePrefixSize+msgLen:]
|
||||
return msgType, msgLen, msg, rawMsg, true
|
||||
}
|
||||
|
||||
// handleHandshakeMessage handles a handshake message. Note that the first
|
||||
// complete handshake message from the handshake buffer is removed, if it
|
||||
// exists.
|
||||
func (p *conn) handleHandshakeMessage() error {
|
||||
// Copy the pending application data to the handshake buffer. At this point,
|
||||
// we are guaranteed that the pending application data contains only parts
|
||||
// of a handshake message.
|
||||
p.handshakeBuf = append(p.handshakeBuf, p.pendingApplicationData...)
|
||||
p.pendingApplicationData = p.pendingApplicationData[:0]
|
||||
// Several handshake messages may be coalesced into a single record.
|
||||
// Continue reading them until the handshake buffer is empty.
|
||||
for len(p.handshakeBuf) > 0 {
|
||||
handshakeMsgType, msgLen, msg, rawMsg, ok := p.parseHandshakeMsg()
|
||||
if !ok {
|
||||
// The handshake could not be fully parsed, so read in another
|
||||
// record and try again later.
|
||||
break
|
||||
}
|
||||
switch handshakeMsgType {
|
||||
case tlsHandshakeKeyUpdateType:
|
||||
if msgLen != tlsHandshakeKeyUpdateMsgSize {
|
||||
return errors.New("invalid handshake key update message length")
|
||||
}
|
||||
if len(p.handshakeBuf) != 0 {
|
||||
return errors.New("key update message must be the last message of a handshake record")
|
||||
}
|
||||
if err := p.handleKeyUpdateMsg(msg); err != nil {
|
||||
return err
|
||||
}
|
||||
case tlsHandshakeNewSessionTicketType:
|
||||
// Ignore tickets that are received after a batch of tickets has
|
||||
// been sent to S2A.
|
||||
if p.ticketState == notReceivingTickets {
|
||||
continue
|
||||
}
|
||||
if p.ticketState == ticketsNotYetReceived {
|
||||
p.ticketState = receivingTickets
|
||||
}
|
||||
p.sessionTickets = append(p.sessionTickets, rawMsg)
|
||||
if len(p.sessionTickets) == maxAllowedTickets {
|
||||
p.ticketState = notReceivingTickets
|
||||
grpclog.Infof("Sending session tickets to S2A.")
|
||||
p.ticketSender.sendTicketsToS2A(p.sessionTickets, p.callComplete)
|
||||
}
|
||||
default:
|
||||
return errors.New("unknown handshake message type")
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func buildKeyUpdateRequest() []byte {
|
||||
b := make([]byte, tlsHandshakePrefixSize+tlsHandshakeKeyUpdateMsgSize)
|
||||
b[0] = tlsHandshakeKeyUpdateType
|
||||
b[1] = 0
|
||||
b[2] = 0
|
||||
b[3] = tlsHandshakeKeyUpdateMsgSize
|
||||
b[4] = byte(updateNotRequested)
|
||||
return b
|
||||
}
|
||||
|
||||
// handleKeyUpdateMsg handles a key update message.
|
||||
func (p *conn) handleKeyUpdateMsg(msg []byte) error {
|
||||
keyUpdateRequest := msg[0]
|
||||
if keyUpdateRequest != byte(updateNotRequested) &&
|
||||
keyUpdateRequest != byte(updateRequested) {
|
||||
return errors.New("invalid handshake key update message")
|
||||
}
|
||||
if err := p.inConn.UpdateKey(); err != nil {
|
||||
return err
|
||||
}
|
||||
// Send a key update message back to the peer if requested.
|
||||
if keyUpdateRequest == byte(updateRequested) {
|
||||
p.writeMutex.Lock()
|
||||
defer p.writeMutex.Unlock()
|
||||
n, err := p.writeTLSRecord(preConstructedKeyUpdateMsg, byte(handshake))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if n != tlsHandshakePrefixSize+tlsHandshakeKeyUpdateMsgSize {
|
||||
return errors.New("key update request message wrote less bytes than expected")
|
||||
}
|
||||
if err = p.outConn.UpdateKey(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// bidEndianInt24 converts the given byte buffer of at least size 3 and
|
||||
// outputs the resulting 24 bit integer as a uint32. This is needed because
|
||||
// TLS 1.3 requires 3 byte integers, and the binary.BigEndian package does
|
||||
// not provide a way to transform a byte buffer into a 3 byte integer.
|
||||
func bigEndianInt24(b []byte) uint32 {
|
||||
_ = b[2] // bounds check hint to compiler; see golang.org/issue/14808
|
||||
return uint32(b[2]) | uint32(b[1])<<8 | uint32(b[0])<<16
|
||||
}
|
||||
|
||||
func min(a, b int) int {
|
||||
if a < b {
|
||||
return a
|
||||
}
|
||||
return b
|
||||
}
|
||||
176
vendor/github.com/google/s2a-go/internal/record/ticketsender.go
generated
vendored
Normal file
176
vendor/github.com/google/s2a-go/internal/record/ticketsender.go
generated
vendored
Normal file
|
|
@ -0,0 +1,176 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
package record
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/google/s2a-go/internal/handshaker/service"
|
||||
commonpb "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
s2apb "github.com/google/s2a-go/internal/proto/s2a_go_proto"
|
||||
"github.com/google/s2a-go/internal/tokenmanager"
|
||||
"google.golang.org/grpc/codes"
|
||||
"google.golang.org/grpc/grpclog"
|
||||
)
|
||||
|
||||
// sessionTimeout is the timeout for creating a session with the S2A handshaker
|
||||
// service.
|
||||
const sessionTimeout = time.Second * 5
|
||||
|
||||
// s2aTicketSender sends session tickets to the S2A handshaker service.
|
||||
type s2aTicketSender interface {
|
||||
// sendTicketsToS2A sends the given session tickets to the S2A handshaker
|
||||
// service.
|
||||
sendTicketsToS2A(sessionTickets [][]byte, callComplete chan bool)
|
||||
}
|
||||
|
||||
// ticketStream is the stream used to send and receive session information.
|
||||
type ticketStream interface {
|
||||
Send(*s2apb.SessionReq) error
|
||||
Recv() (*s2apb.SessionResp, error)
|
||||
}
|
||||
|
||||
type ticketSender struct {
|
||||
// hsAddr stores the address of the S2A handshaker service.
|
||||
hsAddr string
|
||||
// connectionID is the connection identifier that was created and sent by
|
||||
// S2A at the end of a handshake.
|
||||
connectionID uint64
|
||||
// localIdentity is the local identity that was used by S2A during session
|
||||
// setup and included in the session result.
|
||||
localIdentity *commonpb.Identity
|
||||
// tokenManager manages access tokens for authenticating to S2A.
|
||||
tokenManager tokenmanager.AccessTokenManager
|
||||
// ensureProcessSessionTickets allows users to wait and ensure that all
|
||||
// available session tickets are sent to S2A before a process completes.
|
||||
ensureProcessSessionTickets *sync.WaitGroup
|
||||
}
|
||||
|
||||
// sendTicketsToS2A sends the given sessionTickets to the S2A handshaker
|
||||
// service. This is done asynchronously and writes to the error logs if an error
|
||||
// occurs.
|
||||
func (t *ticketSender) sendTicketsToS2A(sessionTickets [][]byte, callComplete chan bool) {
|
||||
// Note that the goroutine is in the function rather than at the caller
|
||||
// because the fake ticket sender used for testing must run synchronously
|
||||
// so that the session tickets can be accessed from it after the tests have
|
||||
// been run.
|
||||
if t.ensureProcessSessionTickets != nil {
|
||||
t.ensureProcessSessionTickets.Add(1)
|
||||
}
|
||||
go func() {
|
||||
if err := func() error {
|
||||
defer func() {
|
||||
if t.ensureProcessSessionTickets != nil {
|
||||
t.ensureProcessSessionTickets.Done()
|
||||
}
|
||||
}()
|
||||
hsConn, err := service.Dial(t.hsAddr)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
client := s2apb.NewS2AServiceClient(hsConn)
|
||||
ctx, cancel := context.WithTimeout(context.Background(), sessionTimeout)
|
||||
defer cancel()
|
||||
session, err := client.SetUpSession(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() {
|
||||
if err := session.CloseSend(); err != nil {
|
||||
grpclog.Error(err)
|
||||
}
|
||||
}()
|
||||
return t.writeTicketsToStream(session, sessionTickets)
|
||||
}(); err != nil {
|
||||
grpclog.Errorf("failed to send resumption tickets to S2A with identity: %v, %v",
|
||||
t.localIdentity, err)
|
||||
}
|
||||
callComplete <- true
|
||||
close(callComplete)
|
||||
}()
|
||||
}
|
||||
|
||||
// writeTicketsToStream writes the given session tickets to the given stream.
|
||||
func (t *ticketSender) writeTicketsToStream(stream ticketStream, sessionTickets [][]byte) error {
|
||||
if err := stream.Send(
|
||||
&s2apb.SessionReq{
|
||||
ReqOneof: &s2apb.SessionReq_ResumptionTicket{
|
||||
ResumptionTicket: &s2apb.ResumptionTicketReq{
|
||||
InBytes: sessionTickets,
|
||||
ConnectionId: t.connectionID,
|
||||
LocalIdentity: t.localIdentity,
|
||||
},
|
||||
},
|
||||
AuthMechanisms: t.getAuthMechanisms(),
|
||||
},
|
||||
); err != nil {
|
||||
return err
|
||||
}
|
||||
sessionResp, err := stream.Recv()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if sessionResp.GetStatus().GetCode() != uint32(codes.OK) {
|
||||
return fmt.Errorf("s2a session ticket response had error status: %v, %v",
|
||||
sessionResp.GetStatus().GetCode(), sessionResp.GetStatus().GetDetails())
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (t *ticketSender) getAuthMechanisms() []*s2apb.AuthenticationMechanism {
|
||||
if t.tokenManager == nil {
|
||||
return nil
|
||||
}
|
||||
// First handle the special case when no local identity has been provided
|
||||
// by the application. In this case, an AuthenticationMechanism with no local
|
||||
// identity will be sent.
|
||||
if t.localIdentity == nil {
|
||||
token, err := t.tokenManager.DefaultToken()
|
||||
if err != nil {
|
||||
grpclog.Infof("unable to get token for empty local identity: %v", err)
|
||||
return nil
|
||||
}
|
||||
return []*s2apb.AuthenticationMechanism{
|
||||
{
|
||||
MechanismOneof: &s2apb.AuthenticationMechanism_Token{
|
||||
Token: token,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// Next, handle the case where the application (or the S2A) has specified
|
||||
// a local identity.
|
||||
token, err := t.tokenManager.Token(t.localIdentity)
|
||||
if err != nil {
|
||||
grpclog.Infof("unable to get token for local identity %v: %v", t.localIdentity, err)
|
||||
return nil
|
||||
}
|
||||
return []*s2apb.AuthenticationMechanism{
|
||||
{
|
||||
Identity: t.localIdentity,
|
||||
MechanismOneof: &s2apb.AuthenticationMechanism_Token{
|
||||
Token: token,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
70
vendor/github.com/google/s2a-go/internal/tokenmanager/tokenmanager.go
generated
vendored
Normal file
70
vendor/github.com/google/s2a-go/internal/tokenmanager/tokenmanager.go
generated
vendored
Normal file
|
|
@ -0,0 +1,70 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package tokenmanager provides tokens for authenticating to S2A.
|
||||
package tokenmanager
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
commonpb "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
)
|
||||
|
||||
const (
|
||||
s2aAccessTokenEnvironmentVariable = "S2A_ACCESS_TOKEN"
|
||||
)
|
||||
|
||||
// AccessTokenManager manages tokens for authenticating to S2A.
|
||||
type AccessTokenManager interface {
|
||||
// DefaultToken returns a token that an application with no specified local
|
||||
// identity must use to authenticate to S2A.
|
||||
DefaultToken() (token string, err error)
|
||||
// Token returns a token that an application with local identity equal to
|
||||
// identity must use to authenticate to S2A.
|
||||
Token(identity *commonpb.Identity) (token string, err error)
|
||||
}
|
||||
|
||||
type singleTokenAccessTokenManager struct {
|
||||
token string
|
||||
}
|
||||
|
||||
// NewSingleTokenAccessTokenManager returns a new AccessTokenManager instance
|
||||
// that will always manage the same token.
|
||||
//
|
||||
// The token to be managed is read from the s2aAccessTokenEnvironmentVariable
|
||||
// environment variable. If this environment variable is not set, then this
|
||||
// function returns an error.
|
||||
func NewSingleTokenAccessTokenManager() (AccessTokenManager, error) {
|
||||
token, variableExists := os.LookupEnv(s2aAccessTokenEnvironmentVariable)
|
||||
if !variableExists {
|
||||
return nil, fmt.Errorf("%s environment variable is not set", s2aAccessTokenEnvironmentVariable)
|
||||
}
|
||||
return &singleTokenAccessTokenManager{token: token}, nil
|
||||
}
|
||||
|
||||
// DefaultToken always returns the token managed by the
|
||||
// singleTokenAccessTokenManager.
|
||||
func (m *singleTokenAccessTokenManager) DefaultToken() (string, error) {
|
||||
return m.token, nil
|
||||
}
|
||||
|
||||
// Token always returns the token managed by the singleTokenAccessTokenManager.
|
||||
func (m *singleTokenAccessTokenManager) Token(*commonpb.Identity) (string, error) {
|
||||
return m.token, nil
|
||||
}
|
||||
1
vendor/github.com/google/s2a-go/internal/v2/README.md
generated
vendored
Normal file
1
vendor/github.com/google/s2a-go/internal/v2/README.md
generated
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
**This directory has the implementation of the S2Av2's gRPC-Go client libraries**
|
||||
120
vendor/github.com/google/s2a-go/internal/v2/certverifier/certverifier.go
generated
vendored
Normal file
120
vendor/github.com/google/s2a-go/internal/v2/certverifier/certverifier.go
generated
vendored
Normal file
|
|
@ -0,0 +1,120 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package certverifier offloads verifications to S2Av2.
|
||||
package certverifier
|
||||
|
||||
import (
|
||||
"crypto/x509"
|
||||
"fmt"
|
||||
|
||||
"google.golang.org/grpc/codes"
|
||||
"google.golang.org/grpc/grpclog"
|
||||
|
||||
s2av2pb "github.com/google/s2a-go/internal/proto/v2/s2a_go_proto"
|
||||
)
|
||||
|
||||
// VerifyClientCertificateChain builds a SessionReq, sends it to S2Av2 and
|
||||
// receives a SessionResp.
|
||||
func VerifyClientCertificateChain(verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode, cstream s2av2pb.S2AService_SetUpSessionClient) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
|
||||
return func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
|
||||
// Offload verification to S2Av2.
|
||||
if grpclog.V(1) {
|
||||
grpclog.Infof("Sending request to S2Av2 for client peer cert chain validation.")
|
||||
}
|
||||
if err := cstream.Send(&s2av2pb.SessionReq{
|
||||
ReqOneof: &s2av2pb.SessionReq_ValidatePeerCertificateChainReq{
|
||||
ValidatePeerCertificateChainReq: &s2av2pb.ValidatePeerCertificateChainReq{
|
||||
Mode: verificationMode,
|
||||
PeerOneof: &s2av2pb.ValidatePeerCertificateChainReq_ClientPeer_{
|
||||
ClientPeer: &s2av2pb.ValidatePeerCertificateChainReq_ClientPeer{
|
||||
CertificateChain: rawCerts,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}); err != nil {
|
||||
grpclog.Infof("Failed to send request to S2Av2 for client peer cert chain validation.")
|
||||
return err
|
||||
}
|
||||
|
||||
// Get the response from S2Av2.
|
||||
resp, err := cstream.Recv()
|
||||
if err != nil {
|
||||
grpclog.Infof("Failed to receive client peer cert chain validation response from S2Av2.")
|
||||
return err
|
||||
}
|
||||
|
||||
// Parse the response.
|
||||
if (resp.GetStatus() != nil) && (resp.GetStatus().Code != uint32(codes.OK)) {
|
||||
return fmt.Errorf("failed to offload client cert verification to S2A: %d, %v", resp.GetStatus().Code, resp.GetStatus().Details)
|
||||
|
||||
}
|
||||
|
||||
if resp.GetValidatePeerCertificateChainResp().ValidationResult != s2av2pb.ValidatePeerCertificateChainResp_SUCCESS {
|
||||
return fmt.Errorf("client cert verification failed: %v", resp.GetValidatePeerCertificateChainResp().ValidationDetails)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
// VerifyServerCertificateChain builds a SessionReq, sends it to S2Av2 and
|
||||
// receives a SessionResp.
|
||||
func VerifyServerCertificateChain(hostname string, verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode, cstream s2av2pb.S2AService_SetUpSessionClient) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
|
||||
return func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
|
||||
// Offload verification to S2Av2.
|
||||
if grpclog.V(1) {
|
||||
grpclog.Infof("Sending request to S2Av2 for server peer cert chain validation.")
|
||||
}
|
||||
if err := cstream.Send(&s2av2pb.SessionReq{
|
||||
ReqOneof: &s2av2pb.SessionReq_ValidatePeerCertificateChainReq{
|
||||
ValidatePeerCertificateChainReq: &s2av2pb.ValidatePeerCertificateChainReq{
|
||||
Mode: verificationMode,
|
||||
PeerOneof: &s2av2pb.ValidatePeerCertificateChainReq_ServerPeer_{
|
||||
ServerPeer: &s2av2pb.ValidatePeerCertificateChainReq_ServerPeer{
|
||||
CertificateChain: rawCerts,
|
||||
ServerHostname: hostname,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}); err != nil {
|
||||
grpclog.Infof("Failed to send request to S2Av2 for server peer cert chain validation.")
|
||||
return err
|
||||
}
|
||||
|
||||
// Get the response from S2Av2.
|
||||
resp, err := cstream.Recv()
|
||||
if err != nil {
|
||||
grpclog.Infof("Failed to receive server peer cert chain validation response from S2Av2.")
|
||||
return err
|
||||
}
|
||||
|
||||
// Parse the response.
|
||||
if (resp.GetStatus() != nil) && (resp.GetStatus().Code != uint32(codes.OK)) {
|
||||
return fmt.Errorf("failed to offload server cert verification to S2A: %d, %v", resp.GetStatus().Code, resp.GetStatus().Details)
|
||||
}
|
||||
|
||||
if resp.GetValidatePeerCertificateChainResp().ValidationResult != s2av2pb.ValidatePeerCertificateChainResp_SUCCESS {
|
||||
return fmt.Errorf("server cert verification failed: %v", resp.GetValidatePeerCertificateChainResp().ValidationDetails)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
}
|
||||
BIN
vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_intermediate_cert.der
generated
vendored
Normal file
BIN
vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_intermediate_cert.der
generated
vendored
Normal file
Binary file not shown.
BIN
vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_leaf_cert.der
generated
vendored
Normal file
BIN
vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_leaf_cert.der
generated
vendored
Normal file
Binary file not shown.
BIN
vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_root_cert.der
generated
vendored
Normal file
BIN
vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_root_cert.der
generated
vendored
Normal file
Binary file not shown.
BIN
vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_intermediate_cert.der
generated
vendored
Normal file
BIN
vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_intermediate_cert.der
generated
vendored
Normal file
Binary file not shown.
BIN
vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_leaf_cert.der
generated
vendored
Normal file
BIN
vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_leaf_cert.der
generated
vendored
Normal file
Binary file not shown.
BIN
vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_root_cert.der
generated
vendored
Normal file
BIN
vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_root_cert.der
generated
vendored
Normal file
Binary file not shown.
185
vendor/github.com/google/s2a-go/internal/v2/remotesigner/remotesigner.go
generated
vendored
Normal file
185
vendor/github.com/google/s2a-go/internal/v2/remotesigner/remotesigner.go
generated
vendored
Normal file
|
|
@ -0,0 +1,185 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package remotesigner offloads private key operations to S2Av2.
|
||||
package remotesigner
|
||||
|
||||
import (
|
||||
"crypto"
|
||||
"crypto/rsa"
|
||||
"crypto/x509"
|
||||
"fmt"
|
||||
"io"
|
||||
|
||||
"google.golang.org/grpc/codes"
|
||||
"google.golang.org/grpc/grpclog"
|
||||
|
||||
s2av2pb "github.com/google/s2a-go/internal/proto/v2/s2a_go_proto"
|
||||
)
|
||||
|
||||
// remoteSigner implementes the crypto.Signer interface.
|
||||
type remoteSigner struct {
|
||||
leafCert *x509.Certificate
|
||||
cstream s2av2pb.S2AService_SetUpSessionClient
|
||||
}
|
||||
|
||||
// New returns an instance of RemoteSigner, an implementation of the
|
||||
// crypto.Signer interface.
|
||||
func New(leafCert *x509.Certificate, cstream s2av2pb.S2AService_SetUpSessionClient) crypto.Signer {
|
||||
return &remoteSigner{leafCert, cstream}
|
||||
}
|
||||
|
||||
func (s *remoteSigner) Public() crypto.PublicKey {
|
||||
return s.leafCert.PublicKey
|
||||
}
|
||||
|
||||
func (s *remoteSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error) {
|
||||
signatureAlgorithm, err := getSignatureAlgorithm(opts, s.leafCert)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
req, err := getSignReq(signatureAlgorithm, digest)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if grpclog.V(1) {
|
||||
grpclog.Infof("Sending request to S2Av2 for signing operation.")
|
||||
}
|
||||
if err := s.cstream.Send(&s2av2pb.SessionReq{
|
||||
ReqOneof: &s2av2pb.SessionReq_OffloadPrivateKeyOperationReq{
|
||||
OffloadPrivateKeyOperationReq: req,
|
||||
},
|
||||
}); err != nil {
|
||||
grpclog.Infof("Failed to send request to S2Av2 for signing operation.")
|
||||
return nil, err
|
||||
}
|
||||
|
||||
resp, err := s.cstream.Recv()
|
||||
if err != nil {
|
||||
grpclog.Infof("Failed to receive signing operation response from S2Av2.")
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if (resp.GetStatus() != nil) && (resp.GetStatus().Code != uint32(codes.OK)) {
|
||||
return nil, fmt.Errorf("failed to offload signing with private key to S2A: %d, %v", resp.GetStatus().Code, resp.GetStatus().Details)
|
||||
}
|
||||
|
||||
return resp.GetOffloadPrivateKeyOperationResp().GetOutBytes(), nil
|
||||
}
|
||||
|
||||
// getCert returns the leafCert field in s.
|
||||
func (s *remoteSigner) getCert() *x509.Certificate {
|
||||
return s.leafCert
|
||||
}
|
||||
|
||||
// getStream returns the cstream field in s.
|
||||
func (s *remoteSigner) getStream() s2av2pb.S2AService_SetUpSessionClient {
|
||||
return s.cstream
|
||||
}
|
||||
|
||||
func getSignReq(signatureAlgorithm s2av2pb.SignatureAlgorithm, digest []byte) (*s2av2pb.OffloadPrivateKeyOperationReq, error) {
|
||||
if (signatureAlgorithm == s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_RSA_PKCS1_SHA256) || (signatureAlgorithm == s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_ECDSA_SECP256R1_SHA256) || (signatureAlgorithm == s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_RSA_PSS_RSAE_SHA256) {
|
||||
return &s2av2pb.OffloadPrivateKeyOperationReq{
|
||||
Operation: s2av2pb.OffloadPrivateKeyOperationReq_SIGN,
|
||||
SignatureAlgorithm: signatureAlgorithm,
|
||||
InBytes: &s2av2pb.OffloadPrivateKeyOperationReq_Sha256Digest{
|
||||
Sha256Digest: digest,
|
||||
},
|
||||
}, nil
|
||||
} else if (signatureAlgorithm == s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_RSA_PKCS1_SHA384) || (signatureAlgorithm == s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_ECDSA_SECP384R1_SHA384) || (signatureAlgorithm == s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_RSA_PSS_RSAE_SHA384) {
|
||||
return &s2av2pb.OffloadPrivateKeyOperationReq{
|
||||
Operation: s2av2pb.OffloadPrivateKeyOperationReq_SIGN,
|
||||
SignatureAlgorithm: signatureAlgorithm,
|
||||
InBytes: &s2av2pb.OffloadPrivateKeyOperationReq_Sha384Digest{
|
||||
Sha384Digest: digest,
|
||||
},
|
||||
}, nil
|
||||
} else if (signatureAlgorithm == s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_RSA_PKCS1_SHA512) || (signatureAlgorithm == s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_ECDSA_SECP521R1_SHA512) || (signatureAlgorithm == s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_RSA_PSS_RSAE_SHA512) || (signatureAlgorithm == s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_ED25519) {
|
||||
return &s2av2pb.OffloadPrivateKeyOperationReq{
|
||||
Operation: s2av2pb.OffloadPrivateKeyOperationReq_SIGN,
|
||||
SignatureAlgorithm: signatureAlgorithm,
|
||||
InBytes: &s2av2pb.OffloadPrivateKeyOperationReq_Sha512Digest{
|
||||
Sha512Digest: digest,
|
||||
},
|
||||
}, nil
|
||||
} else {
|
||||
return nil, fmt.Errorf("unknown signature algorithm: %v", signatureAlgorithm)
|
||||
}
|
||||
}
|
||||
|
||||
// getSignatureAlgorithm returns the signature algorithm that S2A must use when
|
||||
// performing a signing operation that has been offloaded by an application
|
||||
// using the crypto/tls libraries.
|
||||
func getSignatureAlgorithm(opts crypto.SignerOpts, leafCert *x509.Certificate) (s2av2pb.SignatureAlgorithm, error) {
|
||||
if opts == nil || leafCert == nil {
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_UNSPECIFIED, fmt.Errorf("unknown signature algorithm")
|
||||
}
|
||||
switch leafCert.PublicKeyAlgorithm {
|
||||
case x509.RSA:
|
||||
if rsaPSSOpts, ok := opts.(*rsa.PSSOptions); ok {
|
||||
return rsaPSSAlgorithm(rsaPSSOpts)
|
||||
}
|
||||
return rsaPPKCS1Algorithm(opts)
|
||||
case x509.ECDSA:
|
||||
return ecdsaAlgorithm(opts)
|
||||
case x509.Ed25519:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_ED25519, nil
|
||||
default:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_UNSPECIFIED, fmt.Errorf("unknown signature algorithm: %q", leafCert.PublicKeyAlgorithm)
|
||||
}
|
||||
}
|
||||
|
||||
func rsaPSSAlgorithm(opts *rsa.PSSOptions) (s2av2pb.SignatureAlgorithm, error) {
|
||||
switch opts.HashFunc() {
|
||||
case crypto.SHA256:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_RSA_PSS_RSAE_SHA256, nil
|
||||
case crypto.SHA384:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_RSA_PSS_RSAE_SHA384, nil
|
||||
case crypto.SHA512:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_RSA_PSS_RSAE_SHA512, nil
|
||||
default:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_UNSPECIFIED, fmt.Errorf("unknown signature algorithm")
|
||||
}
|
||||
}
|
||||
|
||||
func rsaPPKCS1Algorithm(opts crypto.SignerOpts) (s2av2pb.SignatureAlgorithm, error) {
|
||||
switch opts.HashFunc() {
|
||||
case crypto.SHA256:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_RSA_PKCS1_SHA256, nil
|
||||
case crypto.SHA384:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_RSA_PKCS1_SHA384, nil
|
||||
case crypto.SHA512:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_RSA_PKCS1_SHA512, nil
|
||||
default:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_UNSPECIFIED, fmt.Errorf("unknown signature algorithm")
|
||||
}
|
||||
}
|
||||
|
||||
func ecdsaAlgorithm(opts crypto.SignerOpts) (s2av2pb.SignatureAlgorithm, error) {
|
||||
switch opts.HashFunc() {
|
||||
case crypto.SHA256:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_ECDSA_SECP256R1_SHA256, nil
|
||||
case crypto.SHA384:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_ECDSA_SECP384R1_SHA384, nil
|
||||
case crypto.SHA512:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_ECDSA_SECP521R1_SHA512, nil
|
||||
default:
|
||||
return s2av2pb.SignatureAlgorithm_S2A_SSL_SIGN_UNSPECIFIED, fmt.Errorf("unknown signature algorithm")
|
||||
}
|
||||
}
|
||||
BIN
vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.der
generated
vendored
Normal file
BIN
vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.der
generated
vendored
Normal file
Binary file not shown.
24
vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.pem
generated
vendored
Normal file
24
vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIID8TCCAtmgAwIBAgIUKXNlBRVe6UepjQUijIFPZBd/4qYwDQYJKoZIhvcNAQEL
|
||||
BQAwgYcxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTESMBAGA1UEBwwJU3Vubnl2
|
||||
YWxlMRAwDgYDVQQKDAdDb21wYW55MREwDwYDVQQLDAhEaXZpc2lvbjEWMBQGA1UE
|
||||
AwwNczJhX3Rlc3RfY2VydDEaMBgGCSqGSIb3DQEJARYLeHl6QHh5ei5jb20wHhcN
|
||||
MjIwNTMxMjAwMzE1WhcNNDIwNTI2MjAwMzE1WjCBhzELMAkGA1UEBhMCVVMxCzAJ
|
||||
BgNVBAgMAkNBMRIwEAYDVQQHDAlTdW5ueXZhbGUxEDAOBgNVBAoMB0NvbXBhbnkx
|
||||
ETAPBgNVBAsMCERpdmlzaW9uMRYwFAYDVQQDDA1zMmFfdGVzdF9jZXJ0MRowGAYJ
|
||||
KoZIhvcNAQkBFgt4eXpAeHl6LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
|
||||
AQoCggEBAOOFuIucH7XXfohGxKd3uR/ihUA/LdduR9I8kfpUEbq5BOt8xZe5/Yn9
|
||||
a1ozEHVW6cOAbHbnwAR8tkSgZ/t42QIA2k77HWU1Jh2xiEIsJivo3imm4/kZWuR0
|
||||
OqPh7MhzxpR/hvNwpI5mJsAVBWFMa5KtecFZLnyZtwHylrRN1QXzuLrOxuKFufK3
|
||||
RKbTABScn5RbZL976H/jgfSeXrbt242NrIoBnVe6fRbekbq2DQ6zFArbQMUgHjHK
|
||||
P0UqBgdr1QmHfi9KytFyx9BTP3gXWnWIu+bY7/v7qKJMHFwGETo+dCLWYevJL316
|
||||
HnLfhApDMfP8U+Yv/y1N/YvgaSOSlEcCAwEAAaNTMFEwHQYDVR0OBBYEFKhAU4nu
|
||||
0h/lrnggbIGvx4ej0WklMB8GA1UdIwQYMBaAFKhAU4nu0h/lrnggbIGvx4ej0Wkl
|
||||
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAE/6NghzQ5fu6yR6
|
||||
EHKbj/YMrFdT7aGn5n2sAf7wJ33LIhiFHkpWBsVlm7rDtZtwhe891ZK/P60anlg9
|
||||
/P0Ua53tSRVRmCvTnEbXWOVMN4is6MsR7BlmzUxl4AtIn7jbeifEwRL7B4xDYmdA
|
||||
QrQnsqoz45dLgS5xK4WDqXATP09Q91xQDuhud/b+A4jrvgwFASmL7rMIZbp4f1JQ
|
||||
nlnl/9VoTBQBvJiWkDUtQDMpRLtauddEkv4AGz75p5IspXWD6cOemuh2iQec11xD
|
||||
X20rs2WZbAcAiUa3nmy8OKYw435vmpj8gp39WYbX/Yx9TymrFFbVY92wYn+quTco
|
||||
pKklVz0=
|
||||
-----END CERTIFICATE-----
|
||||
27
vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_key.pem
generated
vendored
Normal file
27
vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_key.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEogIBAAKCAQEA44W4i5wftdd+iEbEp3e5H+KFQD8t125H0jyR+lQRurkE63zF
|
||||
l7n9if1rWjMQdVbpw4BsdufABHy2RKBn+3jZAgDaTvsdZTUmHbGIQiwmK+jeKabj
|
||||
+Rla5HQ6o+HsyHPGlH+G83CkjmYmwBUFYUxrkq15wVkufJm3AfKWtE3VBfO4us7G
|
||||
4oW58rdEptMAFJyflFtkv3vof+OB9J5etu3bjY2sigGdV7p9Ft6RurYNDrMUCttA
|
||||
xSAeMco/RSoGB2vVCYd+L0rK0XLH0FM/eBdadYi75tjv+/uookwcXAYROj50ItZh
|
||||
68kvfXoect+ECkMx8/xT5i//LU39i+BpI5KURwIDAQABAoIBABgyjo/6iLzUMFbZ
|
||||
/+w3pW6orrdIgN2akvTfED9pVYFgUA+jc3hRhY95bkNnjuaL2cy7Cc4Tk65mfRQL
|
||||
Y0OxdJLr+EvSFSxAXM9npDA1ddHRsF8JqtFBSxNk8R+g1Yf0GDiO35Fgd3/ViWWA
|
||||
VtQkRoSRApP3oiQKTRZd8H04keFR+PvmDk/Lq11l3Kc24A1PevKIPX1oI990ggw9
|
||||
9i4uSV+cnuMxmcI9xxJtgwdDFdjr39l2arLOHr4s6LGoV2IOdXHNlv5xRqWUZ0FH
|
||||
MDHowkLgwDrdSTnNeaVNkce14Gqx+bd4hNaLCdKXMpedBTEmrut3f3hdV1kKjaKt
|
||||
aqRYr8ECgYEA/YDGZY2jvFoHHBywlqmEMFrrCvQGH51m5R1Ntpkzr+Rh3YCmrpvq
|
||||
xgwJXING0PUw3dz+xrH5lJICrfNE5Kt3fPu1rAEy+13mYsNowghtUq2Rtu0Hsjjx
|
||||
2E3Bf8vEB6RNBMmGkUpTTIAroGF5tpJoRvfnWax+k4pFdrKYFtyZdNcCgYEA5cNv
|
||||
EPltvOobjTXlUmtVP3n27KZN2aXexTcagLzRxE9CV4cYySENl3KuOMmccaZpIl6z
|
||||
aHk6BT4X+M0LqElNUczrInfVqI+SGAFLGy7W6CJaqSr6cpyFUP/fosKpm6wKGgLq
|
||||
udHfpvz5rckhKd8kJxFLvhGOK9yN5qpzih0gfhECgYAJfwRvk3G5wYmYpP58dlcs
|
||||
VIuPenqsPoI3PPTHTU/hW+XKnWIhElgmGRdUrto9Q6IT/Y5RtSMLTLjq+Tzwb/fm
|
||||
56rziYv2XJsfwgAvnI8z1Kqrto9ePsHYf3krJ1/thVsZPc9bq/QY3ohD1sLvcuaT
|
||||
GgBBnLOVJU3a12/ZE2RwOwKBgF0csWMAoj8/5IB6if+3ral2xOGsl7oPZVMo/J2V
|
||||
Z7EVqb4M6rd/pKFugTpUQgkwtkSOekhpcGD1hAN5HTNK2YG/+L5UMAsKe9sskwJm
|
||||
HgOfAHy0BSDzW3ey6i9skg2bT9Cww+0gJ3Hl7U1HSCBO5LjMYpSZSrNtwzfqdb5Q
|
||||
BX3xAoGARZdR28Ej3+/+0+fz47Yu2h4z0EI/EbrudLOWY936jIeAVwHckI3+BuqH
|
||||
qR4poj1gfbnMxNuI9UzIXzjEmGewx9kDZ7IYnvloZKqoVQODO5GlKF2ja6IcMNlh
|
||||
GCNdD6PSAS6HcmalmWo9sj+1YMkrl+GJikKZqVBHrHNwMGAG67w=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
BIN
vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.der
generated
vendored
Normal file
BIN
vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.der
generated
vendored
Normal file
Binary file not shown.
24
vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.pem
generated
vendored
Normal file
24
vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIID8TCCAtmgAwIBAgIUKCoDuLtiZXvhsBY2RoDm0ugizJ8wDQYJKoZIhvcNAQEL
|
||||
BQAwgYcxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTESMBAGA1UEBwwJU3Vubnl2
|
||||
YWxlMRAwDgYDVQQKDAdDb21wYW55MREwDwYDVQQLDAhEaXZpc2lvbjEWMBQGA1UE
|
||||
AwwNczJhX3Rlc3RfY2VydDEaMBgGCSqGSIb3DQEJARYLeHl6QHh5ei5jb20wHhcN
|
||||
MjIwNTMxMjAwODI1WhcNNDIwNTI2MjAwODI1WjCBhzELMAkGA1UEBhMCVVMxCzAJ
|
||||
BgNVBAgMAkNBMRIwEAYDVQQHDAlTdW5ueXZhbGUxEDAOBgNVBAoMB0NvbXBhbnkx
|
||||
ETAPBgNVBAsMCERpdmlzaW9uMRYwFAYDVQQDDA1zMmFfdGVzdF9jZXJ0MRowGAYJ
|
||||
KoZIhvcNAQkBFgt4eXpAeHl6LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
|
||||
AQoCggEBAKK1++PXQ+M3hjYH/v0K4UEYl5ljzpNM1i52eQM+gFooojT87PDSaphT
|
||||
fs0PXy/PTAjHBEvPhWpOpmQXfJNYzjwcCvg66hbqkv++/VTZiFLAsHagzkEz+FRJ
|
||||
qT5Eq7G5FLyw1izX1uxyPN7tAEWEEg7eqsiaXD3Cq8+TYN9cjirPeF7RZF8yFCYE
|
||||
xqvbo+Yc6RL6xw19iXVTfctRgQe581KQuIY5/LXo3dWDEilFdsADAe8XAEcO64es
|
||||
Ow0g1UvXLnpXSE151kXBFb3sKH/ZjCecDYMCIMEb4sWLSblkSxJ5sNSmXIG4wtr2
|
||||
Qnii7CXZgnVYraQE/Jyh+NMQANuoSdMCAwEAAaNTMFEwHQYDVR0OBBYEFAyQQQuM
|
||||
ab+YUQqjK8dVVOoHVFmXMB8GA1UdIwQYMBaAFAyQQQuMab+YUQqjK8dVVOoHVFmX
|
||||
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBADj0vQ6ykWhicoqR
|
||||
e6VZMwlEJV7/DSvWWKBd9MUjfKye0A4565ya5lmnzP3DiD3nqGe3miqmLsXKDs+X
|
||||
POqlPXTWIamP7D4MJ32XtSLwZB4ru+I+Ao/P/VngPepoRPQoBnzHe7jww0rokqxl
|
||||
AZERjlbTUwUAy/BPWPSzSJZ2j0tcs6ZLDNyYzpK4ao8R9/1VmQ92Tcp3feJs1QTg
|
||||
odRQc3om/AkWOwsll+oyX0UbJeHkFHiLanUPXbdh+/BkSvZJ8ynL+feSDdaurPe+
|
||||
PSfnqLtQft9/neecGRdEaQzzzSFVQUVQzTdK1Q7hA7b55b2HvIa3ktDiks+sJsYN
|
||||
Dhm6uZM=
|
||||
-----END CERTIFICATE-----
|
||||
27
vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_key.pem
generated
vendored
Normal file
27
vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_key.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAorX749dD4zeGNgf+/QrhQRiXmWPOk0zWLnZ5Az6AWiiiNPzs
|
||||
8NJqmFN+zQ9fL89MCMcES8+Fak6mZBd8k1jOPBwK+DrqFuqS/779VNmIUsCwdqDO
|
||||
QTP4VEmpPkSrsbkUvLDWLNfW7HI83u0ARYQSDt6qyJpcPcKrz5Ng31yOKs94XtFk
|
||||
XzIUJgTGq9uj5hzpEvrHDX2JdVN9y1GBB7nzUpC4hjn8tejd1YMSKUV2wAMB7xcA
|
||||
Rw7rh6w7DSDVS9cueldITXnWRcEVvewof9mMJ5wNgwIgwRvixYtJuWRLEnmw1KZc
|
||||
gbjC2vZCeKLsJdmCdVitpAT8nKH40xAA26hJ0wIDAQABAoIBACaNR+lsD8G+XiZf
|
||||
LqN1+HkcAo9tfnyYMAdCOtnx7SdviT9Uzi8hK/B7mAeuJLeHPlS2EuaDfPD7QaFl
|
||||
jza6S+MiIdc+3kgfvESsVAnOoOY6kZUJ9NSuI6CU82y1iJjLaYZrv9NQMLRFPPb0
|
||||
4KOX709mosB1EnXvshW0rbc+jtDFhrm1SxMt+k9TuzmMxjbOeW4LOLXPgU8X1T3Q
|
||||
Xy0hMZZtcgBs9wFIo8yCtmOixax9pnFE8rRltgDxTodn9LLdz1FieyntNgDksZ0P
|
||||
nt4kV7Mqly7ELaea+Foaj244mKsesic2e3GhAlMRLun/VSunSf7mOCxfpITB8dp1
|
||||
drDhOYECgYEA19151dVxRcviuovN6Dar+QszMTnU8pDJ8BjLFjXjP/hNBBwMTHDE
|
||||
duMuWk2qnwZqMooI/shxrF/ufmTgS0CFrh2+ANBZu27vWConJNXcyNtdigI4wt50
|
||||
L0Y2qcZn2mg67qFXHwoR3QNwrwnPwEjRXA09at9CSRZzcwDQ0ETXhYsCgYEAwPaG
|
||||
06QdK8Zyly7TTzZJwxzv9uGiqzodmGtX6NEKjgij2JaCxHpukqZBJoqa0jKeK1cm
|
||||
eNVkOvT5ff9TMzarSHQLr3pZen2/oVLb5gaFkbcJt/klv9Fd+ZRilHY3i6QwS6pD
|
||||
uMiPOWS4DrLHDRVoVlAZTDjT1RVwwTs+P2NhJdkCgYEAsriXysbxBYyMp05gqEW7
|
||||
lHIFbFgpSrs9th+Q5U6wW6JEgYaHWDJ1NslY80MiZI93FWjbkbZ7BvBWESeL3EIL
|
||||
a+EMErht0pVCbIhZ6FF4foPAqia0wAJVx14mm+G80kNBp5jE/NnleEsE3KcO7nBb
|
||||
hg8gLn+x7bk81JZ0TDrzBYkCgYEAuQKluv47SeF3tSScTfKLPpvcKCWmxe1uutkQ
|
||||
7JShPhVioyOMNb39jnYBOWbjkm4d4QgqRuiytSR0oi3QI+Ziy5EYMyNn713qAk9j
|
||||
r2TJZDDPDKnBW+zt4YI4EohWMXk3JRUW4XDKggjjwJQA7bZ812TtHHvP/xoThfG7
|
||||
eSNb3eECgYBw6ssgCtMrdvQiEmjKVX/9yI38mvC2kSGyzbrQnGUfgqRGomRpeZuD
|
||||
B5E3kysA4td5pT5lvcLgSW0TbOz+YbiriXjwOihPIelCvc9gE2eOUI71/byUWPFz
|
||||
7u5F/xQ4NaGr5suLF+lBC6h7pSbM4El9lIHQAQadpuEdzHqrw+hs3g==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
311
vendor/github.com/google/s2a-go/internal/v2/s2av2.go
generated
vendored
Normal file
311
vendor/github.com/google/s2a-go/internal/v2/s2av2.go
generated
vendored
Normal file
|
|
@ -0,0 +1,311 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package v2 provides the S2Av2 transport credentials used by a gRPC
|
||||
// application.
|
||||
package v2
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"errors"
|
||||
"flag"
|
||||
"net"
|
||||
"time"
|
||||
|
||||
"github.com/golang/protobuf/proto"
|
||||
"github.com/google/s2a-go/fallback"
|
||||
"github.com/google/s2a-go/internal/handshaker/service"
|
||||
"github.com/google/s2a-go/internal/tokenmanager"
|
||||
"github.com/google/s2a-go/internal/v2/tlsconfigstore"
|
||||
"google.golang.org/grpc"
|
||||
"google.golang.org/grpc/credentials"
|
||||
"google.golang.org/grpc/grpclog"
|
||||
|
||||
commonpbv1 "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
s2av2pb "github.com/google/s2a-go/internal/proto/v2/s2a_go_proto"
|
||||
)
|
||||
|
||||
const (
|
||||
s2aSecurityProtocol = "tls"
|
||||
)
|
||||
|
||||
var S2ATimeout = flag.Duration("s2a_timeout", 3*time.Second, "Timeout enforced on the connection to the S2A service for handshake.")
|
||||
|
||||
type s2av2TransportCreds struct {
|
||||
info *credentials.ProtocolInfo
|
||||
isClient bool
|
||||
serverName string
|
||||
s2av2Address string
|
||||
tokenManager *tokenmanager.AccessTokenManager
|
||||
// localIdentity should only be used by the client.
|
||||
localIdentity *commonpbv1.Identity
|
||||
// localIdentities should only be used by the server.
|
||||
localIdentities []*commonpbv1.Identity
|
||||
verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode
|
||||
fallbackClientHandshake fallback.ClientHandshake
|
||||
}
|
||||
|
||||
// NewClientCreds returns a client-side transport credentials object that uses
|
||||
// the S2Av2 to establish a secure connection with a server.
|
||||
func NewClientCreds(s2av2Address string, localIdentity *commonpbv1.Identity, verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode, fallbackClientHandshakeFunc fallback.ClientHandshake) (credentials.TransportCredentials, error) {
|
||||
// Create an AccessTokenManager instance to use to authenticate to S2Av2.
|
||||
accessTokenManager, err := tokenmanager.NewSingleTokenAccessTokenManager()
|
||||
|
||||
creds := &s2av2TransportCreds{
|
||||
info: &credentials.ProtocolInfo{
|
||||
SecurityProtocol: s2aSecurityProtocol,
|
||||
},
|
||||
isClient: true,
|
||||
serverName: "",
|
||||
s2av2Address: s2av2Address,
|
||||
localIdentity: localIdentity,
|
||||
verificationMode: verificationMode,
|
||||
fallbackClientHandshake: fallbackClientHandshakeFunc,
|
||||
}
|
||||
if err != nil {
|
||||
creds.tokenManager = nil
|
||||
} else {
|
||||
creds.tokenManager = &accessTokenManager
|
||||
}
|
||||
if grpclog.V(1) {
|
||||
grpclog.Info("Created client S2Av2 transport credentials.")
|
||||
}
|
||||
return creds, nil
|
||||
}
|
||||
|
||||
// NewServerCreds returns a server-side transport credentials object that uses
|
||||
// the S2Av2 to establish a secure connection with a client.
|
||||
func NewServerCreds(s2av2Address string, localIdentities []*commonpbv1.Identity, verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode) (credentials.TransportCredentials, error) {
|
||||
// Create an AccessTokenManager instance to use to authenticate to S2Av2.
|
||||
accessTokenManager, err := tokenmanager.NewSingleTokenAccessTokenManager()
|
||||
creds := &s2av2TransportCreds{
|
||||
info: &credentials.ProtocolInfo{
|
||||
SecurityProtocol: s2aSecurityProtocol,
|
||||
},
|
||||
isClient: false,
|
||||
s2av2Address: s2av2Address,
|
||||
localIdentities: localIdentities,
|
||||
verificationMode: verificationMode,
|
||||
}
|
||||
if err != nil {
|
||||
creds.tokenManager = nil
|
||||
} else {
|
||||
creds.tokenManager = &accessTokenManager
|
||||
}
|
||||
if grpclog.V(1) {
|
||||
grpclog.Info("Created server S2Av2 transport credentials.")
|
||||
}
|
||||
return creds, nil
|
||||
}
|
||||
|
||||
// ClientHandshake performs a client-side mTLS handshake using the S2Av2.
|
||||
func (c *s2av2TransportCreds) ClientHandshake(ctx context.Context, serverAuthority string, rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
|
||||
if !c.isClient {
|
||||
return nil, nil, errors.New("client handshake called using server transport credentials")
|
||||
}
|
||||
// Remove the port from serverAuthority.
|
||||
serverName := removeServerNamePort(serverAuthority)
|
||||
timeoutCtx, cancel := context.WithTimeout(ctx, *S2ATimeout)
|
||||
defer cancel()
|
||||
cstream, err := createStream(timeoutCtx, c.s2av2Address)
|
||||
if err != nil {
|
||||
grpclog.Infof("Failed to connect to S2Av2: %v", err)
|
||||
if c.fallbackClientHandshake != nil {
|
||||
return c.fallbackClientHandshake(ctx, serverAuthority, rawConn, err)
|
||||
}
|
||||
return nil, nil, err
|
||||
}
|
||||
defer cstream.CloseSend()
|
||||
if grpclog.V(1) {
|
||||
grpclog.Infof("Connected to S2Av2.")
|
||||
}
|
||||
var config *tls.Config
|
||||
|
||||
var tokenManager tokenmanager.AccessTokenManager
|
||||
if c.tokenManager == nil {
|
||||
tokenManager = nil
|
||||
} else {
|
||||
tokenManager = *c.tokenManager
|
||||
}
|
||||
|
||||
if c.serverName == "" {
|
||||
config, err = tlsconfigstore.GetTLSConfigurationForClient(serverName, cstream, tokenManager, c.localIdentity, c.verificationMode)
|
||||
if err != nil {
|
||||
grpclog.Info("Failed to get client TLS config from S2Av2: %v", err)
|
||||
if c.fallbackClientHandshake != nil {
|
||||
return c.fallbackClientHandshake(ctx, serverAuthority, rawConn, err)
|
||||
}
|
||||
return nil, nil, err
|
||||
}
|
||||
} else {
|
||||
config, err = tlsconfigstore.GetTLSConfigurationForClient(c.serverName, cstream, tokenManager, c.localIdentity, c.verificationMode)
|
||||
if err != nil {
|
||||
grpclog.Info("Failed to get client TLS config from S2Av2: %v", err)
|
||||
if c.fallbackClientHandshake != nil {
|
||||
return c.fallbackClientHandshake(ctx, serverAuthority, rawConn, err)
|
||||
}
|
||||
return nil, nil, err
|
||||
}
|
||||
}
|
||||
if grpclog.V(1) {
|
||||
grpclog.Infof("Got client TLS config from S2Av2.")
|
||||
}
|
||||
creds := credentials.NewTLS(config)
|
||||
|
||||
conn, authInfo, err := creds.ClientHandshake(ctx, serverName, rawConn)
|
||||
if err != nil {
|
||||
grpclog.Infof("Failed to do client handshake using S2Av2: %v", err)
|
||||
if c.fallbackClientHandshake != nil {
|
||||
return c.fallbackClientHandshake(ctx, serverAuthority, rawConn, err)
|
||||
}
|
||||
return nil, nil, err
|
||||
}
|
||||
grpclog.Infof("Successfully done client handshake using S2Av2 to: %s", serverName)
|
||||
|
||||
return conn, authInfo, err
|
||||
}
|
||||
|
||||
// ServerHandshake performs a server-side mTLS handshake using the S2Av2.
|
||||
func (c *s2av2TransportCreds) ServerHandshake(rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
|
||||
if c.isClient {
|
||||
return nil, nil, errors.New("server handshake called using client transport credentials")
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(context.Background(), *S2ATimeout)
|
||||
defer cancel()
|
||||
cstream, err := createStream(ctx, c.s2av2Address)
|
||||
if err != nil {
|
||||
grpclog.Infof("Failed to connect to S2Av2: %v", err)
|
||||
return nil, nil, err
|
||||
}
|
||||
defer cstream.CloseSend()
|
||||
if grpclog.V(1) {
|
||||
grpclog.Infof("Connected to S2Av2.")
|
||||
}
|
||||
|
||||
var tokenManager tokenmanager.AccessTokenManager
|
||||
if c.tokenManager == nil {
|
||||
tokenManager = nil
|
||||
} else {
|
||||
tokenManager = *c.tokenManager
|
||||
}
|
||||
|
||||
config, err := tlsconfigstore.GetTLSConfigurationForServer(cstream, tokenManager, c.localIdentities, c.verificationMode)
|
||||
if err != nil {
|
||||
grpclog.Infof("Failed to get server TLS config from S2Av2: %v", err)
|
||||
return nil, nil, err
|
||||
}
|
||||
if grpclog.V(1) {
|
||||
grpclog.Infof("Got server TLS config from S2Av2.")
|
||||
}
|
||||
creds := credentials.NewTLS(config)
|
||||
return creds.ServerHandshake(rawConn)
|
||||
}
|
||||
|
||||
// Info returns protocol info of s2av2TransportCreds.
|
||||
func (c *s2av2TransportCreds) Info() credentials.ProtocolInfo {
|
||||
return *c.info
|
||||
}
|
||||
|
||||
// Clone makes a deep copy of s2av2TransportCreds.
|
||||
func (c *s2av2TransportCreds) Clone() credentials.TransportCredentials {
|
||||
info := *c.info
|
||||
serverName := c.serverName
|
||||
fallbackClientHandshake := c.fallbackClientHandshake
|
||||
|
||||
s2av2Address := c.s2av2Address
|
||||
var tokenManager tokenmanager.AccessTokenManager
|
||||
if c.tokenManager == nil {
|
||||
tokenManager = nil
|
||||
} else {
|
||||
tokenManager = *c.tokenManager
|
||||
}
|
||||
verificationMode := c.verificationMode
|
||||
var localIdentity *commonpbv1.Identity
|
||||
if c.localIdentity != nil {
|
||||
localIdentity = proto.Clone(c.localIdentity).(*commonpbv1.Identity)
|
||||
}
|
||||
var localIdentities []*commonpbv1.Identity
|
||||
if c.localIdentities != nil {
|
||||
localIdentities = make([]*commonpbv1.Identity, len(c.localIdentities))
|
||||
for i, localIdentity := range c.localIdentities {
|
||||
localIdentities[i] = proto.Clone(localIdentity).(*commonpbv1.Identity)
|
||||
}
|
||||
}
|
||||
creds := &s2av2TransportCreds{
|
||||
info: &info,
|
||||
isClient: c.isClient,
|
||||
serverName: serverName,
|
||||
fallbackClientHandshake: fallbackClientHandshake,
|
||||
s2av2Address: s2av2Address,
|
||||
localIdentity: localIdentity,
|
||||
localIdentities: localIdentities,
|
||||
verificationMode: verificationMode,
|
||||
}
|
||||
if c.tokenManager == nil {
|
||||
creds.tokenManager = nil
|
||||
} else {
|
||||
creds.tokenManager = &tokenManager
|
||||
}
|
||||
return creds
|
||||
}
|
||||
|
||||
// NewClientTLSConfig returns a tls.Config instance that uses S2Av2 to establish a TLS connection as
|
||||
// a client. The tls.Config MUST only be used to establish a single TLS connection.
|
||||
func NewClientTLSConfig(
|
||||
ctx context.Context,
|
||||
s2av2Address string,
|
||||
tokenManager tokenmanager.AccessTokenManager,
|
||||
verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode,
|
||||
serverName string) (*tls.Config, error) {
|
||||
cstream, err := createStream(ctx, s2av2Address)
|
||||
if err != nil {
|
||||
grpclog.Infof("Failed to connect to S2Av2: %v", err)
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return tlsconfigstore.GetTLSConfigurationForClient(removeServerNamePort(serverName), cstream, tokenManager, nil, verificationMode)
|
||||
}
|
||||
|
||||
// OverrideServerName sets the ServerName in the s2av2TransportCreds protocol
|
||||
// info. The ServerName MUST be a hostname.
|
||||
func (c *s2av2TransportCreds) OverrideServerName(serverNameOverride string) error {
|
||||
serverName := removeServerNamePort(serverNameOverride)
|
||||
c.info.ServerName = serverName
|
||||
c.serverName = serverName
|
||||
return nil
|
||||
}
|
||||
|
||||
// Remove the trailing port from server name.
|
||||
func removeServerNamePort(serverName string) string {
|
||||
name, _, err := net.SplitHostPort(serverName)
|
||||
if err != nil {
|
||||
name = serverName
|
||||
}
|
||||
return name
|
||||
}
|
||||
|
||||
func createStream(ctx context.Context, s2av2Address string) (s2av2pb.S2AService_SetUpSessionClient, error) {
|
||||
// TODO(rmehta19): Consider whether to close the connection to S2Av2.
|
||||
conn, err := service.Dial(s2av2Address)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
client := s2av2pb.NewS2AServiceClient(conn)
|
||||
return client.SetUpSession(ctx, []grpc.CallOption{}...)
|
||||
}
|
||||
24
vendor/github.com/google/s2a-go/internal/v2/testdata/client_cert.pem
generated
vendored
Normal file
24
vendor/github.com/google/s2a-go/internal/v2/testdata/client_cert.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIID8TCCAtmgAwIBAgIUKXNlBRVe6UepjQUijIFPZBd/4qYwDQYJKoZIhvcNAQEL
|
||||
BQAwgYcxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTESMBAGA1UEBwwJU3Vubnl2
|
||||
YWxlMRAwDgYDVQQKDAdDb21wYW55MREwDwYDVQQLDAhEaXZpc2lvbjEWMBQGA1UE
|
||||
AwwNczJhX3Rlc3RfY2VydDEaMBgGCSqGSIb3DQEJARYLeHl6QHh5ei5jb20wHhcN
|
||||
MjIwNTMxMjAwMzE1WhcNNDIwNTI2MjAwMzE1WjCBhzELMAkGA1UEBhMCVVMxCzAJ
|
||||
BgNVBAgMAkNBMRIwEAYDVQQHDAlTdW5ueXZhbGUxEDAOBgNVBAoMB0NvbXBhbnkx
|
||||
ETAPBgNVBAsMCERpdmlzaW9uMRYwFAYDVQQDDA1zMmFfdGVzdF9jZXJ0MRowGAYJ
|
||||
KoZIhvcNAQkBFgt4eXpAeHl6LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
|
||||
AQoCggEBAOOFuIucH7XXfohGxKd3uR/ihUA/LdduR9I8kfpUEbq5BOt8xZe5/Yn9
|
||||
a1ozEHVW6cOAbHbnwAR8tkSgZ/t42QIA2k77HWU1Jh2xiEIsJivo3imm4/kZWuR0
|
||||
OqPh7MhzxpR/hvNwpI5mJsAVBWFMa5KtecFZLnyZtwHylrRN1QXzuLrOxuKFufK3
|
||||
RKbTABScn5RbZL976H/jgfSeXrbt242NrIoBnVe6fRbekbq2DQ6zFArbQMUgHjHK
|
||||
P0UqBgdr1QmHfi9KytFyx9BTP3gXWnWIu+bY7/v7qKJMHFwGETo+dCLWYevJL316
|
||||
HnLfhApDMfP8U+Yv/y1N/YvgaSOSlEcCAwEAAaNTMFEwHQYDVR0OBBYEFKhAU4nu
|
||||
0h/lrnggbIGvx4ej0WklMB8GA1UdIwQYMBaAFKhAU4nu0h/lrnggbIGvx4ej0Wkl
|
||||
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAE/6NghzQ5fu6yR6
|
||||
EHKbj/YMrFdT7aGn5n2sAf7wJ33LIhiFHkpWBsVlm7rDtZtwhe891ZK/P60anlg9
|
||||
/P0Ua53tSRVRmCvTnEbXWOVMN4is6MsR7BlmzUxl4AtIn7jbeifEwRL7B4xDYmdA
|
||||
QrQnsqoz45dLgS5xK4WDqXATP09Q91xQDuhud/b+A4jrvgwFASmL7rMIZbp4f1JQ
|
||||
nlnl/9VoTBQBvJiWkDUtQDMpRLtauddEkv4AGz75p5IspXWD6cOemuh2iQec11xD
|
||||
X20rs2WZbAcAiUa3nmy8OKYw435vmpj8gp39WYbX/Yx9TymrFFbVY92wYn+quTco
|
||||
pKklVz0=
|
||||
-----END CERTIFICATE-----
|
||||
27
vendor/github.com/google/s2a-go/internal/v2/testdata/client_key.pem
generated
vendored
Normal file
27
vendor/github.com/google/s2a-go/internal/v2/testdata/client_key.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEogIBAAKCAQEA44W4i5wftdd+iEbEp3e5H+KFQD8t125H0jyR+lQRurkE63zF
|
||||
l7n9if1rWjMQdVbpw4BsdufABHy2RKBn+3jZAgDaTvsdZTUmHbGIQiwmK+jeKabj
|
||||
+Rla5HQ6o+HsyHPGlH+G83CkjmYmwBUFYUxrkq15wVkufJm3AfKWtE3VBfO4us7G
|
||||
4oW58rdEptMAFJyflFtkv3vof+OB9J5etu3bjY2sigGdV7p9Ft6RurYNDrMUCttA
|
||||
xSAeMco/RSoGB2vVCYd+L0rK0XLH0FM/eBdadYi75tjv+/uookwcXAYROj50ItZh
|
||||
68kvfXoect+ECkMx8/xT5i//LU39i+BpI5KURwIDAQABAoIBABgyjo/6iLzUMFbZ
|
||||
/+w3pW6orrdIgN2akvTfED9pVYFgUA+jc3hRhY95bkNnjuaL2cy7Cc4Tk65mfRQL
|
||||
Y0OxdJLr+EvSFSxAXM9npDA1ddHRsF8JqtFBSxNk8R+g1Yf0GDiO35Fgd3/ViWWA
|
||||
VtQkRoSRApP3oiQKTRZd8H04keFR+PvmDk/Lq11l3Kc24A1PevKIPX1oI990ggw9
|
||||
9i4uSV+cnuMxmcI9xxJtgwdDFdjr39l2arLOHr4s6LGoV2IOdXHNlv5xRqWUZ0FH
|
||||
MDHowkLgwDrdSTnNeaVNkce14Gqx+bd4hNaLCdKXMpedBTEmrut3f3hdV1kKjaKt
|
||||
aqRYr8ECgYEA/YDGZY2jvFoHHBywlqmEMFrrCvQGH51m5R1Ntpkzr+Rh3YCmrpvq
|
||||
xgwJXING0PUw3dz+xrH5lJICrfNE5Kt3fPu1rAEy+13mYsNowghtUq2Rtu0Hsjjx
|
||||
2E3Bf8vEB6RNBMmGkUpTTIAroGF5tpJoRvfnWax+k4pFdrKYFtyZdNcCgYEA5cNv
|
||||
EPltvOobjTXlUmtVP3n27KZN2aXexTcagLzRxE9CV4cYySENl3KuOMmccaZpIl6z
|
||||
aHk6BT4X+M0LqElNUczrInfVqI+SGAFLGy7W6CJaqSr6cpyFUP/fosKpm6wKGgLq
|
||||
udHfpvz5rckhKd8kJxFLvhGOK9yN5qpzih0gfhECgYAJfwRvk3G5wYmYpP58dlcs
|
||||
VIuPenqsPoI3PPTHTU/hW+XKnWIhElgmGRdUrto9Q6IT/Y5RtSMLTLjq+Tzwb/fm
|
||||
56rziYv2XJsfwgAvnI8z1Kqrto9ePsHYf3krJ1/thVsZPc9bq/QY3ohD1sLvcuaT
|
||||
GgBBnLOVJU3a12/ZE2RwOwKBgF0csWMAoj8/5IB6if+3ral2xOGsl7oPZVMo/J2V
|
||||
Z7EVqb4M6rd/pKFugTpUQgkwtkSOekhpcGD1hAN5HTNK2YG/+L5UMAsKe9sskwJm
|
||||
HgOfAHy0BSDzW3ey6i9skg2bT9Cww+0gJ3Hl7U1HSCBO5LjMYpSZSrNtwzfqdb5Q
|
||||
BX3xAoGARZdR28Ej3+/+0+fz47Yu2h4z0EI/EbrudLOWY936jIeAVwHckI3+BuqH
|
||||
qR4poj1gfbnMxNuI9UzIXzjEmGewx9kDZ7IYnvloZKqoVQODO5GlKF2ja6IcMNlh
|
||||
GCNdD6PSAS6HcmalmWo9sj+1YMkrl+GJikKZqVBHrHNwMGAG67w=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
24
vendor/github.com/google/s2a-go/internal/v2/testdata/server_cert.pem
generated
vendored
Normal file
24
vendor/github.com/google/s2a-go/internal/v2/testdata/server_cert.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIID8TCCAtmgAwIBAgIUKCoDuLtiZXvhsBY2RoDm0ugizJ8wDQYJKoZIhvcNAQEL
|
||||
BQAwgYcxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTESMBAGA1UEBwwJU3Vubnl2
|
||||
YWxlMRAwDgYDVQQKDAdDb21wYW55MREwDwYDVQQLDAhEaXZpc2lvbjEWMBQGA1UE
|
||||
AwwNczJhX3Rlc3RfY2VydDEaMBgGCSqGSIb3DQEJARYLeHl6QHh5ei5jb20wHhcN
|
||||
MjIwNTMxMjAwODI1WhcNNDIwNTI2MjAwODI1WjCBhzELMAkGA1UEBhMCVVMxCzAJ
|
||||
BgNVBAgMAkNBMRIwEAYDVQQHDAlTdW5ueXZhbGUxEDAOBgNVBAoMB0NvbXBhbnkx
|
||||
ETAPBgNVBAsMCERpdmlzaW9uMRYwFAYDVQQDDA1zMmFfdGVzdF9jZXJ0MRowGAYJ
|
||||
KoZIhvcNAQkBFgt4eXpAeHl6LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
|
||||
AQoCggEBAKK1++PXQ+M3hjYH/v0K4UEYl5ljzpNM1i52eQM+gFooojT87PDSaphT
|
||||
fs0PXy/PTAjHBEvPhWpOpmQXfJNYzjwcCvg66hbqkv++/VTZiFLAsHagzkEz+FRJ
|
||||
qT5Eq7G5FLyw1izX1uxyPN7tAEWEEg7eqsiaXD3Cq8+TYN9cjirPeF7RZF8yFCYE
|
||||
xqvbo+Yc6RL6xw19iXVTfctRgQe581KQuIY5/LXo3dWDEilFdsADAe8XAEcO64es
|
||||
Ow0g1UvXLnpXSE151kXBFb3sKH/ZjCecDYMCIMEb4sWLSblkSxJ5sNSmXIG4wtr2
|
||||
Qnii7CXZgnVYraQE/Jyh+NMQANuoSdMCAwEAAaNTMFEwHQYDVR0OBBYEFAyQQQuM
|
||||
ab+YUQqjK8dVVOoHVFmXMB8GA1UdIwQYMBaAFAyQQQuMab+YUQqjK8dVVOoHVFmX
|
||||
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBADj0vQ6ykWhicoqR
|
||||
e6VZMwlEJV7/DSvWWKBd9MUjfKye0A4565ya5lmnzP3DiD3nqGe3miqmLsXKDs+X
|
||||
POqlPXTWIamP7D4MJ32XtSLwZB4ru+I+Ao/P/VngPepoRPQoBnzHe7jww0rokqxl
|
||||
AZERjlbTUwUAy/BPWPSzSJZ2j0tcs6ZLDNyYzpK4ao8R9/1VmQ92Tcp3feJs1QTg
|
||||
odRQc3om/AkWOwsll+oyX0UbJeHkFHiLanUPXbdh+/BkSvZJ8ynL+feSDdaurPe+
|
||||
PSfnqLtQft9/neecGRdEaQzzzSFVQUVQzTdK1Q7hA7b55b2HvIa3ktDiks+sJsYN
|
||||
Dhm6uZM=
|
||||
-----END CERTIFICATE-----
|
||||
27
vendor/github.com/google/s2a-go/internal/v2/testdata/server_key.pem
generated
vendored
Normal file
27
vendor/github.com/google/s2a-go/internal/v2/testdata/server_key.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAorX749dD4zeGNgf+/QrhQRiXmWPOk0zWLnZ5Az6AWiiiNPzs
|
||||
8NJqmFN+zQ9fL89MCMcES8+Fak6mZBd8k1jOPBwK+DrqFuqS/779VNmIUsCwdqDO
|
||||
QTP4VEmpPkSrsbkUvLDWLNfW7HI83u0ARYQSDt6qyJpcPcKrz5Ng31yOKs94XtFk
|
||||
XzIUJgTGq9uj5hzpEvrHDX2JdVN9y1GBB7nzUpC4hjn8tejd1YMSKUV2wAMB7xcA
|
||||
Rw7rh6w7DSDVS9cueldITXnWRcEVvewof9mMJ5wNgwIgwRvixYtJuWRLEnmw1KZc
|
||||
gbjC2vZCeKLsJdmCdVitpAT8nKH40xAA26hJ0wIDAQABAoIBACaNR+lsD8G+XiZf
|
||||
LqN1+HkcAo9tfnyYMAdCOtnx7SdviT9Uzi8hK/B7mAeuJLeHPlS2EuaDfPD7QaFl
|
||||
jza6S+MiIdc+3kgfvESsVAnOoOY6kZUJ9NSuI6CU82y1iJjLaYZrv9NQMLRFPPb0
|
||||
4KOX709mosB1EnXvshW0rbc+jtDFhrm1SxMt+k9TuzmMxjbOeW4LOLXPgU8X1T3Q
|
||||
Xy0hMZZtcgBs9wFIo8yCtmOixax9pnFE8rRltgDxTodn9LLdz1FieyntNgDksZ0P
|
||||
nt4kV7Mqly7ELaea+Foaj244mKsesic2e3GhAlMRLun/VSunSf7mOCxfpITB8dp1
|
||||
drDhOYECgYEA19151dVxRcviuovN6Dar+QszMTnU8pDJ8BjLFjXjP/hNBBwMTHDE
|
||||
duMuWk2qnwZqMooI/shxrF/ufmTgS0CFrh2+ANBZu27vWConJNXcyNtdigI4wt50
|
||||
L0Y2qcZn2mg67qFXHwoR3QNwrwnPwEjRXA09at9CSRZzcwDQ0ETXhYsCgYEAwPaG
|
||||
06QdK8Zyly7TTzZJwxzv9uGiqzodmGtX6NEKjgij2JaCxHpukqZBJoqa0jKeK1cm
|
||||
eNVkOvT5ff9TMzarSHQLr3pZen2/oVLb5gaFkbcJt/klv9Fd+ZRilHY3i6QwS6pD
|
||||
uMiPOWS4DrLHDRVoVlAZTDjT1RVwwTs+P2NhJdkCgYEAsriXysbxBYyMp05gqEW7
|
||||
lHIFbFgpSrs9th+Q5U6wW6JEgYaHWDJ1NslY80MiZI93FWjbkbZ7BvBWESeL3EIL
|
||||
a+EMErht0pVCbIhZ6FF4foPAqia0wAJVx14mm+G80kNBp5jE/NnleEsE3KcO7nBb
|
||||
hg8gLn+x7bk81JZ0TDrzBYkCgYEAuQKluv47SeF3tSScTfKLPpvcKCWmxe1uutkQ
|
||||
7JShPhVioyOMNb39jnYBOWbjkm4d4QgqRuiytSR0oi3QI+Ziy5EYMyNn713qAk9j
|
||||
r2TJZDDPDKnBW+zt4YI4EohWMXk3JRUW4XDKggjjwJQA7bZ812TtHHvP/xoThfG7
|
||||
eSNb3eECgYBw6ssgCtMrdvQiEmjKVX/9yI38mvC2kSGyzbrQnGUfgqRGomRpeZuD
|
||||
B5E3kysA4td5pT5lvcLgSW0TbOz+YbiriXjwOihPIelCvc9gE2eOUI71/byUWPFz
|
||||
7u5F/xQ4NaGr5suLF+lBC6h7pSbM4El9lIHQAQadpuEdzHqrw+hs3g==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
24
vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_cert.pem
generated
vendored
Normal file
24
vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_cert.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIID8TCCAtmgAwIBAgIUKXNlBRVe6UepjQUijIFPZBd/4qYwDQYJKoZIhvcNAQEL
|
||||
BQAwgYcxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTESMBAGA1UEBwwJU3Vubnl2
|
||||
YWxlMRAwDgYDVQQKDAdDb21wYW55MREwDwYDVQQLDAhEaXZpc2lvbjEWMBQGA1UE
|
||||
AwwNczJhX3Rlc3RfY2VydDEaMBgGCSqGSIb3DQEJARYLeHl6QHh5ei5jb20wHhcN
|
||||
MjIwNTMxMjAwMzE1WhcNNDIwNTI2MjAwMzE1WjCBhzELMAkGA1UEBhMCVVMxCzAJ
|
||||
BgNVBAgMAkNBMRIwEAYDVQQHDAlTdW5ueXZhbGUxEDAOBgNVBAoMB0NvbXBhbnkx
|
||||
ETAPBgNVBAsMCERpdmlzaW9uMRYwFAYDVQQDDA1zMmFfdGVzdF9jZXJ0MRowGAYJ
|
||||
KoZIhvcNAQkBFgt4eXpAeHl6LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
|
||||
AQoCggEBAOOFuIucH7XXfohGxKd3uR/ihUA/LdduR9I8kfpUEbq5BOt8xZe5/Yn9
|
||||
a1ozEHVW6cOAbHbnwAR8tkSgZ/t42QIA2k77HWU1Jh2xiEIsJivo3imm4/kZWuR0
|
||||
OqPh7MhzxpR/hvNwpI5mJsAVBWFMa5KtecFZLnyZtwHylrRN1QXzuLrOxuKFufK3
|
||||
RKbTABScn5RbZL976H/jgfSeXrbt242NrIoBnVe6fRbekbq2DQ6zFArbQMUgHjHK
|
||||
P0UqBgdr1QmHfi9KytFyx9BTP3gXWnWIu+bY7/v7qKJMHFwGETo+dCLWYevJL316
|
||||
HnLfhApDMfP8U+Yv/y1N/YvgaSOSlEcCAwEAAaNTMFEwHQYDVR0OBBYEFKhAU4nu
|
||||
0h/lrnggbIGvx4ej0WklMB8GA1UdIwQYMBaAFKhAU4nu0h/lrnggbIGvx4ej0Wkl
|
||||
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAE/6NghzQ5fu6yR6
|
||||
EHKbj/YMrFdT7aGn5n2sAf7wJ33LIhiFHkpWBsVlm7rDtZtwhe891ZK/P60anlg9
|
||||
/P0Ua53tSRVRmCvTnEbXWOVMN4is6MsR7BlmzUxl4AtIn7jbeifEwRL7B4xDYmdA
|
||||
QrQnsqoz45dLgS5xK4WDqXATP09Q91xQDuhud/b+A4jrvgwFASmL7rMIZbp4f1JQ
|
||||
nlnl/9VoTBQBvJiWkDUtQDMpRLtauddEkv4AGz75p5IspXWD6cOemuh2iQec11xD
|
||||
X20rs2WZbAcAiUa3nmy8OKYw435vmpj8gp39WYbX/Yx9TymrFFbVY92wYn+quTco
|
||||
pKklVz0=
|
||||
-----END CERTIFICATE-----
|
||||
27
vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_key.pem
generated
vendored
Normal file
27
vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_key.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEogIBAAKCAQEA44W4i5wftdd+iEbEp3e5H+KFQD8t125H0jyR+lQRurkE63zF
|
||||
l7n9if1rWjMQdVbpw4BsdufABHy2RKBn+3jZAgDaTvsdZTUmHbGIQiwmK+jeKabj
|
||||
+Rla5HQ6o+HsyHPGlH+G83CkjmYmwBUFYUxrkq15wVkufJm3AfKWtE3VBfO4us7G
|
||||
4oW58rdEptMAFJyflFtkv3vof+OB9J5etu3bjY2sigGdV7p9Ft6RurYNDrMUCttA
|
||||
xSAeMco/RSoGB2vVCYd+L0rK0XLH0FM/eBdadYi75tjv+/uookwcXAYROj50ItZh
|
||||
68kvfXoect+ECkMx8/xT5i//LU39i+BpI5KURwIDAQABAoIBABgyjo/6iLzUMFbZ
|
||||
/+w3pW6orrdIgN2akvTfED9pVYFgUA+jc3hRhY95bkNnjuaL2cy7Cc4Tk65mfRQL
|
||||
Y0OxdJLr+EvSFSxAXM9npDA1ddHRsF8JqtFBSxNk8R+g1Yf0GDiO35Fgd3/ViWWA
|
||||
VtQkRoSRApP3oiQKTRZd8H04keFR+PvmDk/Lq11l3Kc24A1PevKIPX1oI990ggw9
|
||||
9i4uSV+cnuMxmcI9xxJtgwdDFdjr39l2arLOHr4s6LGoV2IOdXHNlv5xRqWUZ0FH
|
||||
MDHowkLgwDrdSTnNeaVNkce14Gqx+bd4hNaLCdKXMpedBTEmrut3f3hdV1kKjaKt
|
||||
aqRYr8ECgYEA/YDGZY2jvFoHHBywlqmEMFrrCvQGH51m5R1Ntpkzr+Rh3YCmrpvq
|
||||
xgwJXING0PUw3dz+xrH5lJICrfNE5Kt3fPu1rAEy+13mYsNowghtUq2Rtu0Hsjjx
|
||||
2E3Bf8vEB6RNBMmGkUpTTIAroGF5tpJoRvfnWax+k4pFdrKYFtyZdNcCgYEA5cNv
|
||||
EPltvOobjTXlUmtVP3n27KZN2aXexTcagLzRxE9CV4cYySENl3KuOMmccaZpIl6z
|
||||
aHk6BT4X+M0LqElNUczrInfVqI+SGAFLGy7W6CJaqSr6cpyFUP/fosKpm6wKGgLq
|
||||
udHfpvz5rckhKd8kJxFLvhGOK9yN5qpzih0gfhECgYAJfwRvk3G5wYmYpP58dlcs
|
||||
VIuPenqsPoI3PPTHTU/hW+XKnWIhElgmGRdUrto9Q6IT/Y5RtSMLTLjq+Tzwb/fm
|
||||
56rziYv2XJsfwgAvnI8z1Kqrto9ePsHYf3krJ1/thVsZPc9bq/QY3ohD1sLvcuaT
|
||||
GgBBnLOVJU3a12/ZE2RwOwKBgF0csWMAoj8/5IB6if+3ral2xOGsl7oPZVMo/J2V
|
||||
Z7EVqb4M6rd/pKFugTpUQgkwtkSOekhpcGD1hAN5HTNK2YG/+L5UMAsKe9sskwJm
|
||||
HgOfAHy0BSDzW3ey6i9skg2bT9Cww+0gJ3Hl7U1HSCBO5LjMYpSZSrNtwzfqdb5Q
|
||||
BX3xAoGARZdR28Ej3+/+0+fz47Yu2h4z0EI/EbrudLOWY936jIeAVwHckI3+BuqH
|
||||
qR4poj1gfbnMxNuI9UzIXzjEmGewx9kDZ7IYnvloZKqoVQODO5GlKF2ja6IcMNlh
|
||||
GCNdD6PSAS6HcmalmWo9sj+1YMkrl+GJikKZqVBHrHNwMGAG67w=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
24
vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_cert.pem
generated
vendored
Normal file
24
vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_cert.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIID8TCCAtmgAwIBAgIUKCoDuLtiZXvhsBY2RoDm0ugizJ8wDQYJKoZIhvcNAQEL
|
||||
BQAwgYcxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTESMBAGA1UEBwwJU3Vubnl2
|
||||
YWxlMRAwDgYDVQQKDAdDb21wYW55MREwDwYDVQQLDAhEaXZpc2lvbjEWMBQGA1UE
|
||||
AwwNczJhX3Rlc3RfY2VydDEaMBgGCSqGSIb3DQEJARYLeHl6QHh5ei5jb20wHhcN
|
||||
MjIwNTMxMjAwODI1WhcNNDIwNTI2MjAwODI1WjCBhzELMAkGA1UEBhMCVVMxCzAJ
|
||||
BgNVBAgMAkNBMRIwEAYDVQQHDAlTdW5ueXZhbGUxEDAOBgNVBAoMB0NvbXBhbnkx
|
||||
ETAPBgNVBAsMCERpdmlzaW9uMRYwFAYDVQQDDA1zMmFfdGVzdF9jZXJ0MRowGAYJ
|
||||
KoZIhvcNAQkBFgt4eXpAeHl6LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
|
||||
AQoCggEBAKK1++PXQ+M3hjYH/v0K4UEYl5ljzpNM1i52eQM+gFooojT87PDSaphT
|
||||
fs0PXy/PTAjHBEvPhWpOpmQXfJNYzjwcCvg66hbqkv++/VTZiFLAsHagzkEz+FRJ
|
||||
qT5Eq7G5FLyw1izX1uxyPN7tAEWEEg7eqsiaXD3Cq8+TYN9cjirPeF7RZF8yFCYE
|
||||
xqvbo+Yc6RL6xw19iXVTfctRgQe581KQuIY5/LXo3dWDEilFdsADAe8XAEcO64es
|
||||
Ow0g1UvXLnpXSE151kXBFb3sKH/ZjCecDYMCIMEb4sWLSblkSxJ5sNSmXIG4wtr2
|
||||
Qnii7CXZgnVYraQE/Jyh+NMQANuoSdMCAwEAAaNTMFEwHQYDVR0OBBYEFAyQQQuM
|
||||
ab+YUQqjK8dVVOoHVFmXMB8GA1UdIwQYMBaAFAyQQQuMab+YUQqjK8dVVOoHVFmX
|
||||
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBADj0vQ6ykWhicoqR
|
||||
e6VZMwlEJV7/DSvWWKBd9MUjfKye0A4565ya5lmnzP3DiD3nqGe3miqmLsXKDs+X
|
||||
POqlPXTWIamP7D4MJ32XtSLwZB4ru+I+Ao/P/VngPepoRPQoBnzHe7jww0rokqxl
|
||||
AZERjlbTUwUAy/BPWPSzSJZ2j0tcs6ZLDNyYzpK4ao8R9/1VmQ92Tcp3feJs1QTg
|
||||
odRQc3om/AkWOwsll+oyX0UbJeHkFHiLanUPXbdh+/BkSvZJ8ynL+feSDdaurPe+
|
||||
PSfnqLtQft9/neecGRdEaQzzzSFVQUVQzTdK1Q7hA7b55b2HvIa3ktDiks+sJsYN
|
||||
Dhm6uZM=
|
||||
-----END CERTIFICATE-----
|
||||
27
vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_key.pem
generated
vendored
Normal file
27
vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_key.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAorX749dD4zeGNgf+/QrhQRiXmWPOk0zWLnZ5Az6AWiiiNPzs
|
||||
8NJqmFN+zQ9fL89MCMcES8+Fak6mZBd8k1jOPBwK+DrqFuqS/779VNmIUsCwdqDO
|
||||
QTP4VEmpPkSrsbkUvLDWLNfW7HI83u0ARYQSDt6qyJpcPcKrz5Ng31yOKs94XtFk
|
||||
XzIUJgTGq9uj5hzpEvrHDX2JdVN9y1GBB7nzUpC4hjn8tejd1YMSKUV2wAMB7xcA
|
||||
Rw7rh6w7DSDVS9cueldITXnWRcEVvewof9mMJ5wNgwIgwRvixYtJuWRLEnmw1KZc
|
||||
gbjC2vZCeKLsJdmCdVitpAT8nKH40xAA26hJ0wIDAQABAoIBACaNR+lsD8G+XiZf
|
||||
LqN1+HkcAo9tfnyYMAdCOtnx7SdviT9Uzi8hK/B7mAeuJLeHPlS2EuaDfPD7QaFl
|
||||
jza6S+MiIdc+3kgfvESsVAnOoOY6kZUJ9NSuI6CU82y1iJjLaYZrv9NQMLRFPPb0
|
||||
4KOX709mosB1EnXvshW0rbc+jtDFhrm1SxMt+k9TuzmMxjbOeW4LOLXPgU8X1T3Q
|
||||
Xy0hMZZtcgBs9wFIo8yCtmOixax9pnFE8rRltgDxTodn9LLdz1FieyntNgDksZ0P
|
||||
nt4kV7Mqly7ELaea+Foaj244mKsesic2e3GhAlMRLun/VSunSf7mOCxfpITB8dp1
|
||||
drDhOYECgYEA19151dVxRcviuovN6Dar+QszMTnU8pDJ8BjLFjXjP/hNBBwMTHDE
|
||||
duMuWk2qnwZqMooI/shxrF/ufmTgS0CFrh2+ANBZu27vWConJNXcyNtdigI4wt50
|
||||
L0Y2qcZn2mg67qFXHwoR3QNwrwnPwEjRXA09at9CSRZzcwDQ0ETXhYsCgYEAwPaG
|
||||
06QdK8Zyly7TTzZJwxzv9uGiqzodmGtX6NEKjgij2JaCxHpukqZBJoqa0jKeK1cm
|
||||
eNVkOvT5ff9TMzarSHQLr3pZen2/oVLb5gaFkbcJt/klv9Fd+ZRilHY3i6QwS6pD
|
||||
uMiPOWS4DrLHDRVoVlAZTDjT1RVwwTs+P2NhJdkCgYEAsriXysbxBYyMp05gqEW7
|
||||
lHIFbFgpSrs9th+Q5U6wW6JEgYaHWDJ1NslY80MiZI93FWjbkbZ7BvBWESeL3EIL
|
||||
a+EMErht0pVCbIhZ6FF4foPAqia0wAJVx14mm+G80kNBp5jE/NnleEsE3KcO7nBb
|
||||
hg8gLn+x7bk81JZ0TDrzBYkCgYEAuQKluv47SeF3tSScTfKLPpvcKCWmxe1uutkQ
|
||||
7JShPhVioyOMNb39jnYBOWbjkm4d4QgqRuiytSR0oi3QI+Ziy5EYMyNn713qAk9j
|
||||
r2TJZDDPDKnBW+zt4YI4EohWMXk3JRUW4XDKggjjwJQA7bZ812TtHHvP/xoThfG7
|
||||
eSNb3eECgYBw6ssgCtMrdvQiEmjKVX/9yI38mvC2kSGyzbrQnGUfgqRGomRpeZuD
|
||||
B5E3kysA4td5pT5lvcLgSW0TbOz+YbiriXjwOihPIelCvc9gE2eOUI71/byUWPFz
|
||||
7u5F/xQ4NaGr5suLF+lBC6h7pSbM4El9lIHQAQadpuEdzHqrw+hs3g==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
403
vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/tlsconfigstore.go
generated
vendored
Normal file
403
vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/tlsconfigstore.go
generated
vendored
Normal file
|
|
@ -0,0 +1,403 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package tlsconfigstore offloads operations to S2Av2.
|
||||
package tlsconfigstore
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/google/s2a-go/internal/tokenmanager"
|
||||
"github.com/google/s2a-go/internal/v2/certverifier"
|
||||
"github.com/google/s2a-go/internal/v2/remotesigner"
|
||||
"google.golang.org/grpc/codes"
|
||||
"google.golang.org/grpc/grpclog"
|
||||
|
||||
commonpbv1 "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
commonpb "github.com/google/s2a-go/internal/proto/v2/common_go_proto"
|
||||
s2av2pb "github.com/google/s2a-go/internal/proto/v2/s2a_go_proto"
|
||||
)
|
||||
|
||||
const (
|
||||
// HTTP/2
|
||||
h2 = "h2"
|
||||
)
|
||||
|
||||
// GetTLSConfigurationForClient returns a tls.Config instance for use by a client application.
|
||||
func GetTLSConfigurationForClient(serverHostname string, cstream s2av2pb.S2AService_SetUpSessionClient, tokenManager tokenmanager.AccessTokenManager, localIdentity *commonpbv1.Identity, verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode) (*tls.Config, error) {
|
||||
authMechanisms := getAuthMechanisms(tokenManager, []*commonpbv1.Identity{localIdentity})
|
||||
|
||||
if grpclog.V(1) {
|
||||
grpclog.Infof("Sending request to S2Av2 for client TLS config.")
|
||||
}
|
||||
// Send request to S2Av2 for config.
|
||||
if err := cstream.Send(&s2av2pb.SessionReq{
|
||||
LocalIdentity: localIdentity,
|
||||
AuthenticationMechanisms: authMechanisms,
|
||||
ReqOneof: &s2av2pb.SessionReq_GetTlsConfigurationReq{
|
||||
GetTlsConfigurationReq: &s2av2pb.GetTlsConfigurationReq{
|
||||
ConnectionSide: commonpb.ConnectionSide_CONNECTION_SIDE_CLIENT,
|
||||
},
|
||||
},
|
||||
}); err != nil {
|
||||
grpclog.Infof("Failed to send request to S2Av2 for client TLS config")
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Get the response containing config from S2Av2.
|
||||
resp, err := cstream.Recv()
|
||||
if err != nil {
|
||||
grpclog.Infof("Failed to receive client TLS config response from S2Av2.")
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// TODO(rmehta19): Add unit test for this if statement.
|
||||
if (resp.GetStatus() != nil) && (resp.GetStatus().Code != uint32(codes.OK)) {
|
||||
return nil, fmt.Errorf("failed to get TLS configuration from S2A: %d, %v", resp.GetStatus().Code, resp.GetStatus().Details)
|
||||
}
|
||||
|
||||
// Extract TLS configiguration from SessionResp.
|
||||
tlsConfig := resp.GetGetTlsConfigurationResp().GetClientTlsConfiguration()
|
||||
|
||||
var cert tls.Certificate
|
||||
for i, v := range tlsConfig.CertificateChain {
|
||||
// Populate Certificates field.
|
||||
block, _ := pem.Decode([]byte(v))
|
||||
if block == nil {
|
||||
return nil, errors.New("certificate in CertificateChain obtained from S2Av2 is empty")
|
||||
}
|
||||
x509Cert, err := x509.ParseCertificate(block.Bytes)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
cert.Certificate = append(cert.Certificate, x509Cert.Raw)
|
||||
if i == 0 {
|
||||
cert.Leaf = x509Cert
|
||||
}
|
||||
}
|
||||
|
||||
if len(tlsConfig.CertificateChain) > 0 {
|
||||
cert.PrivateKey = remotesigner.New(cert.Leaf, cstream)
|
||||
if cert.PrivateKey == nil {
|
||||
return nil, errors.New("failed to retrieve Private Key from Remote Signer Library")
|
||||
}
|
||||
}
|
||||
|
||||
minVersion, maxVersion, err := getTLSMinMaxVersionsClient(tlsConfig)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Create mTLS credentials for client.
|
||||
config := &tls.Config{
|
||||
VerifyPeerCertificate: certverifier.VerifyServerCertificateChain(serverHostname, verificationMode, cstream),
|
||||
ServerName: serverHostname,
|
||||
InsecureSkipVerify: true, // NOLINT
|
||||
ClientSessionCache: nil,
|
||||
SessionTicketsDisabled: true,
|
||||
MinVersion: minVersion,
|
||||
MaxVersion: maxVersion,
|
||||
NextProtos: []string{h2},
|
||||
}
|
||||
if len(tlsConfig.CertificateChain) > 0 {
|
||||
config.Certificates = []tls.Certificate{cert}
|
||||
}
|
||||
return config, nil
|
||||
}
|
||||
|
||||
// GetTLSConfigurationForServer returns a tls.Config instance for use by a server application.
|
||||
func GetTLSConfigurationForServer(cstream s2av2pb.S2AService_SetUpSessionClient, tokenManager tokenmanager.AccessTokenManager, localIdentities []*commonpbv1.Identity, verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode) (*tls.Config, error) {
|
||||
return &tls.Config{
|
||||
GetConfigForClient: ClientConfig(tokenManager, localIdentities, verificationMode, cstream),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// ClientConfig builds a TLS config for a server to establish a secure
|
||||
// connection with a client, based on SNI communicated during ClientHello.
|
||||
// Ensures that server presents the correct certificate to establish a TLS
|
||||
// connection.
|
||||
func ClientConfig(tokenManager tokenmanager.AccessTokenManager, localIdentities []*commonpbv1.Identity, verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode, cstream s2av2pb.S2AService_SetUpSessionClient) func(chi *tls.ClientHelloInfo) (*tls.Config, error) {
|
||||
return func(chi *tls.ClientHelloInfo) (*tls.Config, error) {
|
||||
tlsConfig, err := getServerConfigFromS2Av2(tokenManager, localIdentities, chi.ServerName, cstream)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var cert tls.Certificate
|
||||
for i, v := range tlsConfig.CertificateChain {
|
||||
// Populate Certificates field.
|
||||
block, _ := pem.Decode([]byte(v))
|
||||
if block == nil {
|
||||
return nil, errors.New("certificate in CertificateChain obtained from S2Av2 is empty")
|
||||
}
|
||||
x509Cert, err := x509.ParseCertificate(block.Bytes)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
cert.Certificate = append(cert.Certificate, x509Cert.Raw)
|
||||
if i == 0 {
|
||||
cert.Leaf = x509Cert
|
||||
}
|
||||
}
|
||||
|
||||
cert.PrivateKey = remotesigner.New(cert.Leaf, cstream)
|
||||
if cert.PrivateKey == nil {
|
||||
return nil, errors.New("failed to retrieve Private Key from Remote Signer Library")
|
||||
}
|
||||
|
||||
minVersion, maxVersion, err := getTLSMinMaxVersionsServer(tlsConfig)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
clientAuth := getTLSClientAuthType(tlsConfig)
|
||||
|
||||
var cipherSuites []uint16
|
||||
cipherSuites = getCipherSuites(tlsConfig.Ciphersuites)
|
||||
|
||||
// Create mTLS credentials for server.
|
||||
return &tls.Config{
|
||||
Certificates: []tls.Certificate{cert},
|
||||
VerifyPeerCertificate: certverifier.VerifyClientCertificateChain(verificationMode, cstream),
|
||||
ClientAuth: clientAuth,
|
||||
CipherSuites: cipherSuites,
|
||||
SessionTicketsDisabled: true,
|
||||
MinVersion: minVersion,
|
||||
MaxVersion: maxVersion,
|
||||
NextProtos: []string{h2},
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
|
||||
func getCipherSuites(tlsConfigCipherSuites []commonpb.Ciphersuite) []uint16 {
|
||||
var tlsGoCipherSuites []uint16
|
||||
for _, v := range tlsConfigCipherSuites {
|
||||
s := getTLSCipherSuite(v)
|
||||
if s != 0xffff {
|
||||
tlsGoCipherSuites = append(tlsGoCipherSuites, s)
|
||||
}
|
||||
}
|
||||
return tlsGoCipherSuites
|
||||
}
|
||||
|
||||
func getTLSCipherSuite(tlsCipherSuite commonpb.Ciphersuite) uint16 {
|
||||
switch tlsCipherSuite {
|
||||
case commonpb.Ciphersuite_CIPHERSUITE_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
|
||||
return tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
case commonpb.Ciphersuite_CIPHERSUITE_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
|
||||
return tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||
case commonpb.Ciphersuite_CIPHERSUITE_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
|
||||
return tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
case commonpb.Ciphersuite_CIPHERSUITE_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
|
||||
return tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
case commonpb.Ciphersuite_CIPHERSUITE_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
|
||||
return tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
case commonpb.Ciphersuite_CIPHERSUITE_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
|
||||
return tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
default:
|
||||
return 0xffff
|
||||
}
|
||||
}
|
||||
|
||||
func getServerConfigFromS2Av2(tokenManager tokenmanager.AccessTokenManager, localIdentities []*commonpbv1.Identity, sni string, cstream s2av2pb.S2AService_SetUpSessionClient) (*s2av2pb.GetTlsConfigurationResp_ServerTlsConfiguration, error) {
|
||||
authMechanisms := getAuthMechanisms(tokenManager, localIdentities)
|
||||
var locID *commonpbv1.Identity
|
||||
if localIdentities != nil {
|
||||
locID = localIdentities[0]
|
||||
}
|
||||
|
||||
if err := cstream.Send(&s2av2pb.SessionReq{
|
||||
LocalIdentity: locID,
|
||||
AuthenticationMechanisms: authMechanisms,
|
||||
ReqOneof: &s2av2pb.SessionReq_GetTlsConfigurationReq{
|
||||
GetTlsConfigurationReq: &s2av2pb.GetTlsConfigurationReq{
|
||||
ConnectionSide: commonpb.ConnectionSide_CONNECTION_SIDE_SERVER,
|
||||
Sni: sni,
|
||||
},
|
||||
},
|
||||
}); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
resp, err := cstream.Recv()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// TODO(rmehta19): Add unit test for this if statement.
|
||||
if (resp.GetStatus() != nil) && (resp.GetStatus().Code != uint32(codes.OK)) {
|
||||
return nil, fmt.Errorf("failed to get TLS configuration from S2A: %d, %v", resp.GetStatus().Code, resp.GetStatus().Details)
|
||||
}
|
||||
|
||||
return resp.GetGetTlsConfigurationResp().GetServerTlsConfiguration(), nil
|
||||
}
|
||||
|
||||
func getTLSClientAuthType(tlsConfig *s2av2pb.GetTlsConfigurationResp_ServerTlsConfiguration) tls.ClientAuthType {
|
||||
var clientAuth tls.ClientAuthType
|
||||
switch x := tlsConfig.RequestClientCertificate; x {
|
||||
case s2av2pb.GetTlsConfigurationResp_ServerTlsConfiguration_DONT_REQUEST_CLIENT_CERTIFICATE:
|
||||
clientAuth = tls.NoClientCert
|
||||
case s2av2pb.GetTlsConfigurationResp_ServerTlsConfiguration_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY:
|
||||
clientAuth = tls.RequestClientCert
|
||||
case s2av2pb.GetTlsConfigurationResp_ServerTlsConfiguration_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY:
|
||||
// This case actually maps to tls.VerifyClientCertIfGiven. However this
|
||||
// mapping triggers normal verification, followed by custom verification,
|
||||
// specified in VerifyPeerCertificate. To bypass normal verification, and
|
||||
// only do custom verification we set clientAuth to RequireAnyClientCert or
|
||||
// RequestClientCert. See https://github.com/google/s2a-go/pull/43 for full
|
||||
// discussion.
|
||||
clientAuth = tls.RequireAnyClientCert
|
||||
case s2av2pb.GetTlsConfigurationResp_ServerTlsConfiguration_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY:
|
||||
clientAuth = tls.RequireAnyClientCert
|
||||
case s2av2pb.GetTlsConfigurationResp_ServerTlsConfiguration_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY:
|
||||
// This case actually maps to tls.RequireAndVerifyClientCert. However this
|
||||
// mapping triggers normal verification, followed by custom verification,
|
||||
// specified in VerifyPeerCertificate. To bypass normal verification, and
|
||||
// only do custom verification we set clientAuth to RequireAnyClientCert or
|
||||
// RequestClientCert. See https://github.com/google/s2a-go/pull/43 for full
|
||||
// discussion.
|
||||
clientAuth = tls.RequireAnyClientCert
|
||||
default:
|
||||
clientAuth = tls.RequireAnyClientCert
|
||||
}
|
||||
return clientAuth
|
||||
}
|
||||
|
||||
func getAuthMechanisms(tokenManager tokenmanager.AccessTokenManager, localIdentities []*commonpbv1.Identity) []*s2av2pb.AuthenticationMechanism {
|
||||
if tokenManager == nil {
|
||||
return nil
|
||||
}
|
||||
if len(localIdentities) == 0 {
|
||||
token, err := tokenManager.DefaultToken()
|
||||
if err != nil {
|
||||
grpclog.Infof("Unable to get token for empty local identity: %v", err)
|
||||
return nil
|
||||
}
|
||||
return []*s2av2pb.AuthenticationMechanism{
|
||||
{
|
||||
MechanismOneof: &s2av2pb.AuthenticationMechanism_Token{
|
||||
Token: token,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
var authMechanisms []*s2av2pb.AuthenticationMechanism
|
||||
for _, localIdentity := range localIdentities {
|
||||
if localIdentity == nil {
|
||||
token, err := tokenManager.DefaultToken()
|
||||
if err != nil {
|
||||
grpclog.Infof("Unable to get default token for local identity %v: %v", localIdentity, err)
|
||||
continue
|
||||
}
|
||||
authMechanisms = append(authMechanisms, &s2av2pb.AuthenticationMechanism{
|
||||
Identity: localIdentity,
|
||||
MechanismOneof: &s2av2pb.AuthenticationMechanism_Token{
|
||||
Token: token,
|
||||
},
|
||||
})
|
||||
} else {
|
||||
token, err := tokenManager.Token(localIdentity)
|
||||
if err != nil {
|
||||
grpclog.Infof("Unable to get token for local identity %v: %v", localIdentity, err)
|
||||
continue
|
||||
}
|
||||
authMechanisms = append(authMechanisms, &s2av2pb.AuthenticationMechanism{
|
||||
Identity: localIdentity,
|
||||
MechanismOneof: &s2av2pb.AuthenticationMechanism_Token{
|
||||
Token: token,
|
||||
},
|
||||
})
|
||||
}
|
||||
}
|
||||
return authMechanisms
|
||||
}
|
||||
|
||||
// TODO(rmehta19): refactor switch statements into a helper function.
|
||||
func getTLSMinMaxVersionsClient(tlsConfig *s2av2pb.GetTlsConfigurationResp_ClientTlsConfiguration) (uint16, uint16, error) {
|
||||
// Map S2Av2 TLSVersion to consts defined in tls package.
|
||||
var minVersion uint16
|
||||
var maxVersion uint16
|
||||
switch x := tlsConfig.MinTlsVersion; x {
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_0:
|
||||
minVersion = tls.VersionTLS10
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_1:
|
||||
minVersion = tls.VersionTLS11
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_2:
|
||||
minVersion = tls.VersionTLS12
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_3:
|
||||
minVersion = tls.VersionTLS13
|
||||
default:
|
||||
return minVersion, maxVersion, fmt.Errorf("S2Av2 provided invalid MinTlsVersion: %v", x)
|
||||
}
|
||||
|
||||
switch x := tlsConfig.MaxTlsVersion; x {
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_0:
|
||||
maxVersion = tls.VersionTLS10
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_1:
|
||||
maxVersion = tls.VersionTLS11
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_2:
|
||||
maxVersion = tls.VersionTLS12
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_3:
|
||||
maxVersion = tls.VersionTLS13
|
||||
default:
|
||||
return minVersion, maxVersion, fmt.Errorf("S2Av2 provided invalid MaxTlsVersion: %v", x)
|
||||
}
|
||||
if minVersion > maxVersion {
|
||||
return minVersion, maxVersion, errors.New("S2Av2 provided minVersion > maxVersion")
|
||||
}
|
||||
return minVersion, maxVersion, nil
|
||||
}
|
||||
|
||||
func getTLSMinMaxVersionsServer(tlsConfig *s2av2pb.GetTlsConfigurationResp_ServerTlsConfiguration) (uint16, uint16, error) {
|
||||
// Map S2Av2 TLSVersion to consts defined in tls package.
|
||||
var minVersion uint16
|
||||
var maxVersion uint16
|
||||
switch x := tlsConfig.MinTlsVersion; x {
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_0:
|
||||
minVersion = tls.VersionTLS10
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_1:
|
||||
minVersion = tls.VersionTLS11
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_2:
|
||||
minVersion = tls.VersionTLS12
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_3:
|
||||
minVersion = tls.VersionTLS13
|
||||
default:
|
||||
return minVersion, maxVersion, fmt.Errorf("S2Av2 provided invalid MinTlsVersion: %v", x)
|
||||
}
|
||||
|
||||
switch x := tlsConfig.MaxTlsVersion; x {
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_0:
|
||||
maxVersion = tls.VersionTLS10
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_1:
|
||||
maxVersion = tls.VersionTLS11
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_2:
|
||||
maxVersion = tls.VersionTLS12
|
||||
case commonpb.TLSVersion_TLS_VERSION_1_3:
|
||||
maxVersion = tls.VersionTLS13
|
||||
default:
|
||||
return minVersion, maxVersion, fmt.Errorf("S2Av2 provided invalid MaxTlsVersion: %v", x)
|
||||
}
|
||||
if minVersion > maxVersion {
|
||||
return minVersion, maxVersion, errors.New("S2Av2 provided minVersion > maxVersion")
|
||||
}
|
||||
return minVersion, maxVersion, nil
|
||||
}
|
||||
409
vendor/github.com/google/s2a-go/s2a.go
generated
vendored
Normal file
409
vendor/github.com/google/s2a-go/s2a.go
generated
vendored
Normal file
|
|
@ -0,0 +1,409 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
// Package s2a provides the S2A transport credentials used by a gRPC
|
||||
// application.
|
||||
package s2a
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/golang/protobuf/proto"
|
||||
"github.com/google/s2a-go/fallback"
|
||||
"github.com/google/s2a-go/internal/handshaker"
|
||||
"github.com/google/s2a-go/internal/handshaker/service"
|
||||
"github.com/google/s2a-go/internal/tokenmanager"
|
||||
"github.com/google/s2a-go/internal/v2"
|
||||
"google.golang.org/grpc/credentials"
|
||||
"google.golang.org/grpc/grpclog"
|
||||
|
||||
commonpb "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
s2av2pb "github.com/google/s2a-go/internal/proto/v2/s2a_go_proto"
|
||||
)
|
||||
|
||||
const (
|
||||
s2aSecurityProtocol = "tls"
|
||||
// defaultTimeout specifies the default server handshake timeout.
|
||||
defaultTimeout = 30.0 * time.Second
|
||||
)
|
||||
|
||||
// s2aTransportCreds are the transport credentials required for establishing
|
||||
// a secure connection using the S2A. They implement the
|
||||
// credentials.TransportCredentials interface.
|
||||
type s2aTransportCreds struct {
|
||||
info *credentials.ProtocolInfo
|
||||
minTLSVersion commonpb.TLSVersion
|
||||
maxTLSVersion commonpb.TLSVersion
|
||||
// tlsCiphersuites contains the ciphersuites used in the S2A connection.
|
||||
// Note that these are currently unconfigurable.
|
||||
tlsCiphersuites []commonpb.Ciphersuite
|
||||
// localIdentity should only be used by the client.
|
||||
localIdentity *commonpb.Identity
|
||||
// localIdentities should only be used by the server.
|
||||
localIdentities []*commonpb.Identity
|
||||
// targetIdentities should only be used by the client.
|
||||
targetIdentities []*commonpb.Identity
|
||||
isClient bool
|
||||
s2aAddr string
|
||||
ensureProcessSessionTickets *sync.WaitGroup
|
||||
}
|
||||
|
||||
// NewClientCreds returns a client-side transport credentials object that uses
|
||||
// the S2A to establish a secure connection with a server.
|
||||
func NewClientCreds(opts *ClientOptions) (credentials.TransportCredentials, error) {
|
||||
if opts == nil {
|
||||
return nil, errors.New("nil client options")
|
||||
}
|
||||
var targetIdentities []*commonpb.Identity
|
||||
for _, targetIdentity := range opts.TargetIdentities {
|
||||
protoTargetIdentity, err := toProtoIdentity(targetIdentity)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
targetIdentities = append(targetIdentities, protoTargetIdentity)
|
||||
}
|
||||
localIdentity, err := toProtoIdentity(opts.LocalIdentity)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if opts.EnableLegacyMode {
|
||||
return &s2aTransportCreds{
|
||||
info: &credentials.ProtocolInfo{
|
||||
SecurityProtocol: s2aSecurityProtocol,
|
||||
},
|
||||
minTLSVersion: commonpb.TLSVersion_TLS1_3,
|
||||
maxTLSVersion: commonpb.TLSVersion_TLS1_3,
|
||||
tlsCiphersuites: []commonpb.Ciphersuite{
|
||||
commonpb.Ciphersuite_AES_128_GCM_SHA256,
|
||||
commonpb.Ciphersuite_AES_256_GCM_SHA384,
|
||||
commonpb.Ciphersuite_CHACHA20_POLY1305_SHA256,
|
||||
},
|
||||
localIdentity: localIdentity,
|
||||
targetIdentities: targetIdentities,
|
||||
isClient: true,
|
||||
s2aAddr: opts.S2AAddress,
|
||||
ensureProcessSessionTickets: opts.EnsureProcessSessionTickets,
|
||||
}, nil
|
||||
}
|
||||
verificationMode := getVerificationMode(opts.VerificationMode)
|
||||
var fallbackFunc fallback.ClientHandshake
|
||||
if opts.FallbackOpts != nil && opts.FallbackOpts.FallbackClientHandshakeFunc != nil {
|
||||
fallbackFunc = opts.FallbackOpts.FallbackClientHandshakeFunc
|
||||
}
|
||||
return v2.NewClientCreds(opts.S2AAddress, localIdentity, verificationMode, fallbackFunc)
|
||||
}
|
||||
|
||||
// NewServerCreds returns a server-side transport credentials object that uses
|
||||
// the S2A to establish a secure connection with a client.
|
||||
func NewServerCreds(opts *ServerOptions) (credentials.TransportCredentials, error) {
|
||||
if opts == nil {
|
||||
return nil, errors.New("nil server options")
|
||||
}
|
||||
var localIdentities []*commonpb.Identity
|
||||
for _, localIdentity := range opts.LocalIdentities {
|
||||
protoLocalIdentity, err := toProtoIdentity(localIdentity)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
localIdentities = append(localIdentities, protoLocalIdentity)
|
||||
}
|
||||
if opts.EnableLegacyMode {
|
||||
return &s2aTransportCreds{
|
||||
info: &credentials.ProtocolInfo{
|
||||
SecurityProtocol: s2aSecurityProtocol,
|
||||
},
|
||||
minTLSVersion: commonpb.TLSVersion_TLS1_3,
|
||||
maxTLSVersion: commonpb.TLSVersion_TLS1_3,
|
||||
tlsCiphersuites: []commonpb.Ciphersuite{
|
||||
commonpb.Ciphersuite_AES_128_GCM_SHA256,
|
||||
commonpb.Ciphersuite_AES_256_GCM_SHA384,
|
||||
commonpb.Ciphersuite_CHACHA20_POLY1305_SHA256,
|
||||
},
|
||||
localIdentities: localIdentities,
|
||||
isClient: false,
|
||||
s2aAddr: opts.S2AAddress,
|
||||
}, nil
|
||||
}
|
||||
verificationMode := getVerificationMode(opts.VerificationMode)
|
||||
return v2.NewServerCreds(opts.S2AAddress, localIdentities, verificationMode)
|
||||
}
|
||||
|
||||
// ClientHandshake initiates a client-side TLS handshake using the S2A.
|
||||
func (c *s2aTransportCreds) ClientHandshake(ctx context.Context, serverAuthority string, rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
|
||||
if !c.isClient {
|
||||
return nil, nil, errors.New("client handshake called using server transport credentials")
|
||||
}
|
||||
|
||||
// Connect to the S2A.
|
||||
hsConn, err := service.Dial(c.s2aAddr)
|
||||
if err != nil {
|
||||
grpclog.Infof("Failed to connect to S2A: %v", err)
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
var cancel context.CancelFunc
|
||||
ctx, cancel = context.WithCancel(ctx)
|
||||
defer cancel()
|
||||
|
||||
opts := &handshaker.ClientHandshakerOptions{
|
||||
MinTLSVersion: c.minTLSVersion,
|
||||
MaxTLSVersion: c.maxTLSVersion,
|
||||
TLSCiphersuites: c.tlsCiphersuites,
|
||||
TargetIdentities: c.targetIdentities,
|
||||
LocalIdentity: c.localIdentity,
|
||||
TargetName: serverAuthority,
|
||||
EnsureProcessSessionTickets: c.ensureProcessSessionTickets,
|
||||
}
|
||||
chs, err := handshaker.NewClientHandshaker(ctx, hsConn, rawConn, c.s2aAddr, opts)
|
||||
if err != nil {
|
||||
grpclog.Infof("Call to handshaker.NewClientHandshaker failed: %v", err)
|
||||
return nil, nil, err
|
||||
}
|
||||
defer func() {
|
||||
if err != nil {
|
||||
if closeErr := chs.Close(); closeErr != nil {
|
||||
grpclog.Infof("Close failed unexpectedly: %v", err)
|
||||
err = fmt.Errorf("%v: close unexpectedly failed: %v", err, closeErr)
|
||||
}
|
||||
}
|
||||
}()
|
||||
|
||||
secConn, authInfo, err := chs.ClientHandshake(context.Background())
|
||||
if err != nil {
|
||||
grpclog.Infof("Handshake failed: %v", err)
|
||||
return nil, nil, err
|
||||
}
|
||||
return secConn, authInfo, nil
|
||||
}
|
||||
|
||||
// ServerHandshake initiates a server-side TLS handshake using the S2A.
|
||||
func (c *s2aTransportCreds) ServerHandshake(rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
|
||||
if c.isClient {
|
||||
return nil, nil, errors.New("server handshake called using client transport credentials")
|
||||
}
|
||||
|
||||
// Connect to the S2A.
|
||||
hsConn, err := service.Dial(c.s2aAddr)
|
||||
if err != nil {
|
||||
grpclog.Infof("Failed to connect to S2A: %v", err)
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), defaultTimeout)
|
||||
defer cancel()
|
||||
|
||||
opts := &handshaker.ServerHandshakerOptions{
|
||||
MinTLSVersion: c.minTLSVersion,
|
||||
MaxTLSVersion: c.maxTLSVersion,
|
||||
TLSCiphersuites: c.tlsCiphersuites,
|
||||
LocalIdentities: c.localIdentities,
|
||||
}
|
||||
shs, err := handshaker.NewServerHandshaker(ctx, hsConn, rawConn, c.s2aAddr, opts)
|
||||
if err != nil {
|
||||
grpclog.Infof("Call to handshaker.NewServerHandshaker failed: %v", err)
|
||||
return nil, nil, err
|
||||
}
|
||||
defer func() {
|
||||
if err != nil {
|
||||
if closeErr := shs.Close(); closeErr != nil {
|
||||
grpclog.Infof("Close failed unexpectedly: %v", err)
|
||||
err = fmt.Errorf("%v: close unexpectedly failed: %v", err, closeErr)
|
||||
}
|
||||
}
|
||||
}()
|
||||
|
||||
secConn, authInfo, err := shs.ServerHandshake(context.Background())
|
||||
if err != nil {
|
||||
grpclog.Infof("Handshake failed: %v", err)
|
||||
return nil, nil, err
|
||||
}
|
||||
return secConn, authInfo, nil
|
||||
}
|
||||
|
||||
func (c *s2aTransportCreds) Info() credentials.ProtocolInfo {
|
||||
return *c.info
|
||||
}
|
||||
|
||||
func (c *s2aTransportCreds) Clone() credentials.TransportCredentials {
|
||||
info := *c.info
|
||||
var localIdentity *commonpb.Identity
|
||||
if c.localIdentity != nil {
|
||||
localIdentity = proto.Clone(c.localIdentity).(*commonpb.Identity)
|
||||
}
|
||||
var localIdentities []*commonpb.Identity
|
||||
if c.localIdentities != nil {
|
||||
localIdentities = make([]*commonpb.Identity, len(c.localIdentities))
|
||||
for i, localIdentity := range c.localIdentities {
|
||||
localIdentities[i] = proto.Clone(localIdentity).(*commonpb.Identity)
|
||||
}
|
||||
}
|
||||
var targetIdentities []*commonpb.Identity
|
||||
if c.targetIdentities != nil {
|
||||
targetIdentities = make([]*commonpb.Identity, len(c.targetIdentities))
|
||||
for i, targetIdentity := range c.targetIdentities {
|
||||
targetIdentities[i] = proto.Clone(targetIdentity).(*commonpb.Identity)
|
||||
}
|
||||
}
|
||||
return &s2aTransportCreds{
|
||||
info: &info,
|
||||
minTLSVersion: c.minTLSVersion,
|
||||
maxTLSVersion: c.maxTLSVersion,
|
||||
tlsCiphersuites: c.tlsCiphersuites,
|
||||
localIdentity: localIdentity,
|
||||
localIdentities: localIdentities,
|
||||
targetIdentities: targetIdentities,
|
||||
isClient: c.isClient,
|
||||
s2aAddr: c.s2aAddr,
|
||||
}
|
||||
}
|
||||
|
||||
func (c *s2aTransportCreds) OverrideServerName(serverNameOverride string) error {
|
||||
c.info.ServerName = serverNameOverride
|
||||
return nil
|
||||
}
|
||||
|
||||
// TLSClientConfigOptions specifies parameters for creating client TLS config.
|
||||
type TLSClientConfigOptions struct {
|
||||
// ServerName is required by s2a as the expected name when verifying the hostname found in server's certificate.
|
||||
// tlsConfig, _ := factory.Build(ctx, &s2a.TLSClientConfigOptions{
|
||||
// ServerName: "example.com",
|
||||
// })
|
||||
ServerName string
|
||||
}
|
||||
|
||||
// TLSClientConfigFactory defines the interface for a client TLS config factory.
|
||||
type TLSClientConfigFactory interface {
|
||||
Build(ctx context.Context, opts *TLSClientConfigOptions) (*tls.Config, error)
|
||||
}
|
||||
|
||||
// NewTLSClientConfigFactory returns an instance of s2aTLSClientConfigFactory.
|
||||
func NewTLSClientConfigFactory(opts *ClientOptions) (TLSClientConfigFactory, error) {
|
||||
if opts == nil {
|
||||
return nil, fmt.Errorf("opts must be non-nil")
|
||||
}
|
||||
if opts.EnableLegacyMode {
|
||||
return nil, fmt.Errorf("NewTLSClientConfigFactory only supports S2Av2")
|
||||
}
|
||||
tokenManager, err := tokenmanager.NewSingleTokenAccessTokenManager()
|
||||
if err != nil {
|
||||
// The only possible error is: access token not set in the environment,
|
||||
// which is okay in environments other than serverless.
|
||||
grpclog.Infof("Access token manager not initialized: %v", err)
|
||||
return &s2aTLSClientConfigFactory{
|
||||
s2av2Address: opts.S2AAddress,
|
||||
tokenManager: nil,
|
||||
verificationMode: getVerificationMode(opts.VerificationMode),
|
||||
}, nil
|
||||
}
|
||||
return &s2aTLSClientConfigFactory{
|
||||
s2av2Address: opts.S2AAddress,
|
||||
tokenManager: tokenManager,
|
||||
verificationMode: getVerificationMode(opts.VerificationMode),
|
||||
}, nil
|
||||
}
|
||||
|
||||
type s2aTLSClientConfigFactory struct {
|
||||
s2av2Address string
|
||||
tokenManager tokenmanager.AccessTokenManager
|
||||
verificationMode s2av2pb.ValidatePeerCertificateChainReq_VerificationMode
|
||||
}
|
||||
|
||||
func (f *s2aTLSClientConfigFactory) Build(
|
||||
ctx context.Context, opts *TLSClientConfigOptions) (*tls.Config, error) {
|
||||
serverName := ""
|
||||
if opts != nil && opts.ServerName != "" {
|
||||
serverName = opts.ServerName
|
||||
}
|
||||
return v2.NewClientTLSConfig(ctx, f.s2av2Address, f.tokenManager, f.verificationMode, serverName)
|
||||
}
|
||||
|
||||
func getVerificationMode(verificationMode VerificationModeType) s2av2pb.ValidatePeerCertificateChainReq_VerificationMode {
|
||||
switch verificationMode {
|
||||
case ConnectToGoogle:
|
||||
return s2av2pb.ValidatePeerCertificateChainReq_CONNECT_TO_GOOGLE
|
||||
case Spiffe:
|
||||
return s2av2pb.ValidatePeerCertificateChainReq_SPIFFE
|
||||
default:
|
||||
return s2av2pb.ValidatePeerCertificateChainReq_UNSPECIFIED
|
||||
}
|
||||
}
|
||||
|
||||
// NewS2ADialTLSContextFunc returns a dialer which establishes an MTLS connection using S2A.
|
||||
// Example use with http.RoundTripper:
|
||||
//
|
||||
// dialTLSContext := s2a.NewS2aDialTLSContextFunc(&s2a.ClientOptions{
|
||||
// S2AAddress: s2aAddress, // required
|
||||
// })
|
||||
// transport := http.DefaultTransport
|
||||
// transport.DialTLSContext = dialTLSContext
|
||||
func NewS2ADialTLSContextFunc(opts *ClientOptions) func(ctx context.Context, network, addr string) (net.Conn, error) {
|
||||
|
||||
return func(ctx context.Context, network, addr string) (net.Conn, error) {
|
||||
|
||||
fallback := func(err error) (net.Conn, error) {
|
||||
if opts.FallbackOpts != nil && opts.FallbackOpts.FallbackDialer != nil &&
|
||||
opts.FallbackOpts.FallbackDialer.Dialer != nil && opts.FallbackOpts.FallbackDialer.ServerAddr != "" {
|
||||
fbDialer := opts.FallbackOpts.FallbackDialer
|
||||
grpclog.Infof("fall back to dial: %s", fbDialer.ServerAddr)
|
||||
fbConn, fbErr := fbDialer.Dialer.DialContext(ctx, network, fbDialer.ServerAddr)
|
||||
if fbErr != nil {
|
||||
return nil, fmt.Errorf("error fallback to %s: %v; S2A error: %w", fbDialer.ServerAddr, fbErr, err)
|
||||
}
|
||||
return fbConn, nil
|
||||
}
|
||||
return nil, err
|
||||
}
|
||||
|
||||
factory, err := NewTLSClientConfigFactory(opts)
|
||||
if err != nil {
|
||||
grpclog.Infof("error creating S2A client config factory: %v", err)
|
||||
return fallback(err)
|
||||
}
|
||||
|
||||
serverName, _, err := net.SplitHostPort(addr)
|
||||
if err != nil {
|
||||
serverName = addr
|
||||
}
|
||||
timeoutCtx, cancel := context.WithTimeout(ctx, *v2.S2ATimeout)
|
||||
defer cancel()
|
||||
s2aTLSConfig, err := factory.Build(timeoutCtx, &TLSClientConfigOptions{
|
||||
ServerName: serverName,
|
||||
})
|
||||
if err != nil {
|
||||
grpclog.Infof("error building S2A TLS config: %v", err)
|
||||
return fallback(err)
|
||||
}
|
||||
|
||||
s2aDialer := &tls.Dialer{
|
||||
Config: s2aTLSConfig,
|
||||
}
|
||||
c, err := s2aDialer.DialContext(ctx, network, addr)
|
||||
if err != nil {
|
||||
grpclog.Infof("error dialing with S2A to %s: %v", addr, err)
|
||||
return fallback(err)
|
||||
}
|
||||
grpclog.Infof("success dialing MTLS to %s with S2A", addr)
|
||||
return c, nil
|
||||
}
|
||||
}
|
||||
197
vendor/github.com/google/s2a-go/s2a_options.go
generated
vendored
Normal file
197
vendor/github.com/google/s2a-go/s2a_options.go
generated
vendored
Normal file
|
|
@ -0,0 +1,197 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
package s2a
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"errors"
|
||||
"sync"
|
||||
|
||||
"github.com/google/s2a-go/fallback"
|
||||
|
||||
s2apb "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
)
|
||||
|
||||
// Identity is the interface for S2A identities.
|
||||
type Identity interface {
|
||||
// Name returns the name of the identity.
|
||||
Name() string
|
||||
}
|
||||
|
||||
type spiffeID struct {
|
||||
spiffeID string
|
||||
}
|
||||
|
||||
func (s *spiffeID) Name() string { return s.spiffeID }
|
||||
|
||||
// NewSpiffeID creates a SPIFFE ID from id.
|
||||
func NewSpiffeID(id string) Identity {
|
||||
return &spiffeID{spiffeID: id}
|
||||
}
|
||||
|
||||
type hostname struct {
|
||||
hostname string
|
||||
}
|
||||
|
||||
func (h *hostname) Name() string { return h.hostname }
|
||||
|
||||
// NewHostname creates a hostname from name.
|
||||
func NewHostname(name string) Identity {
|
||||
return &hostname{hostname: name}
|
||||
}
|
||||
|
||||
type uid struct {
|
||||
uid string
|
||||
}
|
||||
|
||||
func (h *uid) Name() string { return h.uid }
|
||||
|
||||
// NewUID creates a UID from name.
|
||||
func NewUID(name string) Identity {
|
||||
return &uid{uid: name}
|
||||
}
|
||||
|
||||
// VerificationModeType specifies the mode that S2A must use to verify the peer
|
||||
// certificate chain.
|
||||
type VerificationModeType int
|
||||
|
||||
// Three types of verification modes.
|
||||
const (
|
||||
Unspecified = iota
|
||||
ConnectToGoogle
|
||||
Spiffe
|
||||
)
|
||||
|
||||
// ClientOptions contains the client-side options used to establish a secure
|
||||
// channel using the S2A handshaker service.
|
||||
type ClientOptions struct {
|
||||
// TargetIdentities contains a list of allowed server identities. One of the
|
||||
// target identities should match the peer identity in the handshake
|
||||
// result; otherwise, the handshake fails.
|
||||
TargetIdentities []Identity
|
||||
// LocalIdentity is the local identity of the client application. If none is
|
||||
// provided, then the S2A will choose the default identity, if one exists.
|
||||
LocalIdentity Identity
|
||||
// S2AAddress is the address of the S2A.
|
||||
S2AAddress string
|
||||
// EnsureProcessSessionTickets waits for all session tickets to be sent to
|
||||
// S2A before a process completes.
|
||||
//
|
||||
// This functionality is crucial for processes that complete very soon after
|
||||
// using S2A to establish a TLS connection, but it can be ignored for longer
|
||||
// lived processes.
|
||||
//
|
||||
// Usage example:
|
||||
// func main() {
|
||||
// var ensureProcessSessionTickets sync.WaitGroup
|
||||
// clientOpts := &s2a.ClientOptions{
|
||||
// EnsureProcessSessionTickets: &ensureProcessSessionTickets,
|
||||
// // Set other members.
|
||||
// }
|
||||
// creds, _ := s2a.NewClientCreds(clientOpts)
|
||||
// conn, _ := grpc.Dial(serverAddr, grpc.WithTransportCredentials(creds))
|
||||
// defer conn.Close()
|
||||
//
|
||||
// // Make RPC call.
|
||||
//
|
||||
// // The process terminates right after the RPC call ends.
|
||||
// // ensureProcessSessionTickets can be used to ensure resumption
|
||||
// // tickets are fully processed. If the process is long-lived, using
|
||||
// // ensureProcessSessionTickets is not necessary.
|
||||
// ensureProcessSessionTickets.Wait()
|
||||
// }
|
||||
EnsureProcessSessionTickets *sync.WaitGroup
|
||||
// If true, enables the use of legacy S2Av1.
|
||||
EnableLegacyMode bool
|
||||
// VerificationMode specifies the mode that S2A must use to verify the
|
||||
// peer certificate chain.
|
||||
VerificationMode VerificationModeType
|
||||
|
||||
// Optional fallback after dialing with S2A fails.
|
||||
FallbackOpts *FallbackOptions
|
||||
}
|
||||
|
||||
// FallbackOptions prescribes the fallback logic that should be taken if the application fails to connect with S2A.
|
||||
type FallbackOptions struct {
|
||||
// FallbackClientHandshakeFunc is used to specify fallback behavior when calling s2a.NewClientCreds().
|
||||
// It will be called by ClientHandshake function, after handshake with S2A fails.
|
||||
// s2a.NewClientCreds() ignores the other FallbackDialer field.
|
||||
FallbackClientHandshakeFunc fallback.ClientHandshake
|
||||
|
||||
// FallbackDialer is used to specify fallback behavior when calling s2a.NewS2aDialTLSContextFunc().
|
||||
// It passes in a custom fallback dialer and server address to use after dialing with S2A fails.
|
||||
// s2a.NewS2aDialTLSContextFunc() ignores the other FallbackClientHandshakeFunc field.
|
||||
FallbackDialer *FallbackDialer
|
||||
}
|
||||
|
||||
// FallbackDialer contains a fallback tls.Dialer and a server address to connect to.
|
||||
type FallbackDialer struct {
|
||||
// Dialer specifies a fallback tls.Dialer.
|
||||
Dialer *tls.Dialer
|
||||
// ServerAddr is used by Dialer to establish fallback connection.
|
||||
ServerAddr string
|
||||
}
|
||||
|
||||
// DefaultClientOptions returns the default client options.
|
||||
func DefaultClientOptions(s2aAddress string) *ClientOptions {
|
||||
return &ClientOptions{
|
||||
S2AAddress: s2aAddress,
|
||||
VerificationMode: ConnectToGoogle,
|
||||
}
|
||||
}
|
||||
|
||||
// ServerOptions contains the server-side options used to establish a secure
|
||||
// channel using the S2A handshaker service.
|
||||
type ServerOptions struct {
|
||||
// LocalIdentities is the list of local identities that may be assumed by
|
||||
// the server. If no local identity is specified, then the S2A chooses a
|
||||
// default local identity, if one exists.
|
||||
LocalIdentities []Identity
|
||||
// S2AAddress is the address of the S2A.
|
||||
S2AAddress string
|
||||
// If true, enables the use of legacy S2Av1.
|
||||
EnableLegacyMode bool
|
||||
// VerificationMode specifies the mode that S2A must use to verify the
|
||||
// peer certificate chain.
|
||||
VerificationMode VerificationModeType
|
||||
}
|
||||
|
||||
// DefaultServerOptions returns the default server options.
|
||||
func DefaultServerOptions(s2aAddress string) *ServerOptions {
|
||||
return &ServerOptions{
|
||||
S2AAddress: s2aAddress,
|
||||
VerificationMode: ConnectToGoogle,
|
||||
}
|
||||
}
|
||||
|
||||
func toProtoIdentity(identity Identity) (*s2apb.Identity, error) {
|
||||
if identity == nil {
|
||||
return nil, nil
|
||||
}
|
||||
switch id := identity.(type) {
|
||||
case *spiffeID:
|
||||
return &s2apb.Identity{IdentityOneof: &s2apb.Identity_SpiffeId{SpiffeId: id.Name()}}, nil
|
||||
case *hostname:
|
||||
return &s2apb.Identity{IdentityOneof: &s2apb.Identity_Hostname{Hostname: id.Name()}}, nil
|
||||
case *uid:
|
||||
return &s2apb.Identity{IdentityOneof: &s2apb.Identity_Uid{Uid: id.Name()}}, nil
|
||||
default:
|
||||
return nil, errors.New("unrecognized identity type")
|
||||
}
|
||||
}
|
||||
79
vendor/github.com/google/s2a-go/s2a_utils.go
generated
vendored
Normal file
79
vendor/github.com/google/s2a-go/s2a_utils.go
generated
vendored
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
/*
|
||||
*
|
||||
* Copyright 2021 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
*/
|
||||
|
||||
package s2a
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
|
||||
commonpb "github.com/google/s2a-go/internal/proto/common_go_proto"
|
||||
"google.golang.org/grpc/credentials"
|
||||
"google.golang.org/grpc/peer"
|
||||
)
|
||||
|
||||
// AuthInfo exposes security information from the S2A to the application.
|
||||
type AuthInfo interface {
|
||||
// AuthType returns the authentication type.
|
||||
AuthType() string
|
||||
// ApplicationProtocol returns the application protocol, e.g. "grpc".
|
||||
ApplicationProtocol() string
|
||||
// TLSVersion returns the TLS version negotiated during the handshake.
|
||||
TLSVersion() commonpb.TLSVersion
|
||||
// Ciphersuite returns the ciphersuite negotiated during the handshake.
|
||||
Ciphersuite() commonpb.Ciphersuite
|
||||
// PeerIdentity returns the authenticated identity of the peer.
|
||||
PeerIdentity() *commonpb.Identity
|
||||
// LocalIdentity returns the local identity of the application used during
|
||||
// session setup.
|
||||
LocalIdentity() *commonpb.Identity
|
||||
// PeerCertFingerprint returns the SHA256 hash of the peer certificate used in
|
||||
// the S2A handshake.
|
||||
PeerCertFingerprint() []byte
|
||||
// LocalCertFingerprint returns the SHA256 hash of the local certificate used
|
||||
// in the S2A handshake.
|
||||
LocalCertFingerprint() []byte
|
||||
// IsHandshakeResumed returns true if a cached session was used to resume
|
||||
// the handshake.
|
||||
IsHandshakeResumed() bool
|
||||
// SecurityLevel returns the security level of the connection.
|
||||
SecurityLevel() credentials.SecurityLevel
|
||||
}
|
||||
|
||||
// AuthInfoFromPeer extracts the authinfo.S2AAuthInfo object from the given
|
||||
// peer, if it exists. This API should be used by gRPC clients after
|
||||
// obtaining a peer object using the grpc.Peer() CallOption.
|
||||
func AuthInfoFromPeer(p *peer.Peer) (AuthInfo, error) {
|
||||
s2aAuthInfo, ok := p.AuthInfo.(AuthInfo)
|
||||
if !ok {
|
||||
return nil, errors.New("no S2AAuthInfo found in Peer")
|
||||
}
|
||||
return s2aAuthInfo, nil
|
||||
}
|
||||
|
||||
// AuthInfoFromContext extracts the authinfo.S2AAuthInfo object from the given
|
||||
// context, if it exists. This API should be used by gRPC server RPC handlers
|
||||
// to get information about the peer. On the client-side, use the grpc.Peer()
|
||||
// CallOption and the AuthInfoFromPeer function.
|
||||
func AuthInfoFromContext(ctx context.Context) (AuthInfo, error) {
|
||||
p, ok := peer.FromContext(ctx)
|
||||
if !ok {
|
||||
return nil, errors.New("no Peer found in Context")
|
||||
}
|
||||
return AuthInfoFromPeer(p)
|
||||
}
|
||||
24
vendor/github.com/google/s2a-go/testdata/client_cert.pem
generated
vendored
Normal file
24
vendor/github.com/google/s2a-go/testdata/client_cert.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIID8TCCAtmgAwIBAgIUKXNlBRVe6UepjQUijIFPZBd/4qYwDQYJKoZIhvcNAQEL
|
||||
BQAwgYcxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTESMBAGA1UEBwwJU3Vubnl2
|
||||
YWxlMRAwDgYDVQQKDAdDb21wYW55MREwDwYDVQQLDAhEaXZpc2lvbjEWMBQGA1UE
|
||||
AwwNczJhX3Rlc3RfY2VydDEaMBgGCSqGSIb3DQEJARYLeHl6QHh5ei5jb20wHhcN
|
||||
MjIwNTMxMjAwMzE1WhcNNDIwNTI2MjAwMzE1WjCBhzELMAkGA1UEBhMCVVMxCzAJ
|
||||
BgNVBAgMAkNBMRIwEAYDVQQHDAlTdW5ueXZhbGUxEDAOBgNVBAoMB0NvbXBhbnkx
|
||||
ETAPBgNVBAsMCERpdmlzaW9uMRYwFAYDVQQDDA1zMmFfdGVzdF9jZXJ0MRowGAYJ
|
||||
KoZIhvcNAQkBFgt4eXpAeHl6LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
|
||||
AQoCggEBAOOFuIucH7XXfohGxKd3uR/ihUA/LdduR9I8kfpUEbq5BOt8xZe5/Yn9
|
||||
a1ozEHVW6cOAbHbnwAR8tkSgZ/t42QIA2k77HWU1Jh2xiEIsJivo3imm4/kZWuR0
|
||||
OqPh7MhzxpR/hvNwpI5mJsAVBWFMa5KtecFZLnyZtwHylrRN1QXzuLrOxuKFufK3
|
||||
RKbTABScn5RbZL976H/jgfSeXrbt242NrIoBnVe6fRbekbq2DQ6zFArbQMUgHjHK
|
||||
P0UqBgdr1QmHfi9KytFyx9BTP3gXWnWIu+bY7/v7qKJMHFwGETo+dCLWYevJL316
|
||||
HnLfhApDMfP8U+Yv/y1N/YvgaSOSlEcCAwEAAaNTMFEwHQYDVR0OBBYEFKhAU4nu
|
||||
0h/lrnggbIGvx4ej0WklMB8GA1UdIwQYMBaAFKhAU4nu0h/lrnggbIGvx4ej0Wkl
|
||||
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAE/6NghzQ5fu6yR6
|
||||
EHKbj/YMrFdT7aGn5n2sAf7wJ33LIhiFHkpWBsVlm7rDtZtwhe891ZK/P60anlg9
|
||||
/P0Ua53tSRVRmCvTnEbXWOVMN4is6MsR7BlmzUxl4AtIn7jbeifEwRL7B4xDYmdA
|
||||
QrQnsqoz45dLgS5xK4WDqXATP09Q91xQDuhud/b+A4jrvgwFASmL7rMIZbp4f1JQ
|
||||
nlnl/9VoTBQBvJiWkDUtQDMpRLtauddEkv4AGz75p5IspXWD6cOemuh2iQec11xD
|
||||
X20rs2WZbAcAiUa3nmy8OKYw435vmpj8gp39WYbX/Yx9TymrFFbVY92wYn+quTco
|
||||
pKklVz0=
|
||||
-----END CERTIFICATE-----
|
||||
27
vendor/github.com/google/s2a-go/testdata/client_key.pem
generated
vendored
Normal file
27
vendor/github.com/google/s2a-go/testdata/client_key.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEogIBAAKCAQEA44W4i5wftdd+iEbEp3e5H+KFQD8t125H0jyR+lQRurkE63zF
|
||||
l7n9if1rWjMQdVbpw4BsdufABHy2RKBn+3jZAgDaTvsdZTUmHbGIQiwmK+jeKabj
|
||||
+Rla5HQ6o+HsyHPGlH+G83CkjmYmwBUFYUxrkq15wVkufJm3AfKWtE3VBfO4us7G
|
||||
4oW58rdEptMAFJyflFtkv3vof+OB9J5etu3bjY2sigGdV7p9Ft6RurYNDrMUCttA
|
||||
xSAeMco/RSoGB2vVCYd+L0rK0XLH0FM/eBdadYi75tjv+/uookwcXAYROj50ItZh
|
||||
68kvfXoect+ECkMx8/xT5i//LU39i+BpI5KURwIDAQABAoIBABgyjo/6iLzUMFbZ
|
||||
/+w3pW6orrdIgN2akvTfED9pVYFgUA+jc3hRhY95bkNnjuaL2cy7Cc4Tk65mfRQL
|
||||
Y0OxdJLr+EvSFSxAXM9npDA1ddHRsF8JqtFBSxNk8R+g1Yf0GDiO35Fgd3/ViWWA
|
||||
VtQkRoSRApP3oiQKTRZd8H04keFR+PvmDk/Lq11l3Kc24A1PevKIPX1oI990ggw9
|
||||
9i4uSV+cnuMxmcI9xxJtgwdDFdjr39l2arLOHr4s6LGoV2IOdXHNlv5xRqWUZ0FH
|
||||
MDHowkLgwDrdSTnNeaVNkce14Gqx+bd4hNaLCdKXMpedBTEmrut3f3hdV1kKjaKt
|
||||
aqRYr8ECgYEA/YDGZY2jvFoHHBywlqmEMFrrCvQGH51m5R1Ntpkzr+Rh3YCmrpvq
|
||||
xgwJXING0PUw3dz+xrH5lJICrfNE5Kt3fPu1rAEy+13mYsNowghtUq2Rtu0Hsjjx
|
||||
2E3Bf8vEB6RNBMmGkUpTTIAroGF5tpJoRvfnWax+k4pFdrKYFtyZdNcCgYEA5cNv
|
||||
EPltvOobjTXlUmtVP3n27KZN2aXexTcagLzRxE9CV4cYySENl3KuOMmccaZpIl6z
|
||||
aHk6BT4X+M0LqElNUczrInfVqI+SGAFLGy7W6CJaqSr6cpyFUP/fosKpm6wKGgLq
|
||||
udHfpvz5rckhKd8kJxFLvhGOK9yN5qpzih0gfhECgYAJfwRvk3G5wYmYpP58dlcs
|
||||
VIuPenqsPoI3PPTHTU/hW+XKnWIhElgmGRdUrto9Q6IT/Y5RtSMLTLjq+Tzwb/fm
|
||||
56rziYv2XJsfwgAvnI8z1Kqrto9ePsHYf3krJ1/thVsZPc9bq/QY3ohD1sLvcuaT
|
||||
GgBBnLOVJU3a12/ZE2RwOwKBgF0csWMAoj8/5IB6if+3ral2xOGsl7oPZVMo/J2V
|
||||
Z7EVqb4M6rd/pKFugTpUQgkwtkSOekhpcGD1hAN5HTNK2YG/+L5UMAsKe9sskwJm
|
||||
HgOfAHy0BSDzW3ey6i9skg2bT9Cww+0gJ3Hl7U1HSCBO5LjMYpSZSrNtwzfqdb5Q
|
||||
BX3xAoGARZdR28Ej3+/+0+fz47Yu2h4z0EI/EbrudLOWY936jIeAVwHckI3+BuqH
|
||||
qR4poj1gfbnMxNuI9UzIXzjEmGewx9kDZ7IYnvloZKqoVQODO5GlKF2ja6IcMNlh
|
||||
GCNdD6PSAS6HcmalmWo9sj+1YMkrl+GJikKZqVBHrHNwMGAG67w=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
24
vendor/github.com/google/s2a-go/testdata/server_cert.pem
generated
vendored
Normal file
24
vendor/github.com/google/s2a-go/testdata/server_cert.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIID8TCCAtmgAwIBAgIUKCoDuLtiZXvhsBY2RoDm0ugizJ8wDQYJKoZIhvcNAQEL
|
||||
BQAwgYcxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTESMBAGA1UEBwwJU3Vubnl2
|
||||
YWxlMRAwDgYDVQQKDAdDb21wYW55MREwDwYDVQQLDAhEaXZpc2lvbjEWMBQGA1UE
|
||||
AwwNczJhX3Rlc3RfY2VydDEaMBgGCSqGSIb3DQEJARYLeHl6QHh5ei5jb20wHhcN
|
||||
MjIwNTMxMjAwODI1WhcNNDIwNTI2MjAwODI1WjCBhzELMAkGA1UEBhMCVVMxCzAJ
|
||||
BgNVBAgMAkNBMRIwEAYDVQQHDAlTdW5ueXZhbGUxEDAOBgNVBAoMB0NvbXBhbnkx
|
||||
ETAPBgNVBAsMCERpdmlzaW9uMRYwFAYDVQQDDA1zMmFfdGVzdF9jZXJ0MRowGAYJ
|
||||
KoZIhvcNAQkBFgt4eXpAeHl6LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
|
||||
AQoCggEBAKK1++PXQ+M3hjYH/v0K4UEYl5ljzpNM1i52eQM+gFooojT87PDSaphT
|
||||
fs0PXy/PTAjHBEvPhWpOpmQXfJNYzjwcCvg66hbqkv++/VTZiFLAsHagzkEz+FRJ
|
||||
qT5Eq7G5FLyw1izX1uxyPN7tAEWEEg7eqsiaXD3Cq8+TYN9cjirPeF7RZF8yFCYE
|
||||
xqvbo+Yc6RL6xw19iXVTfctRgQe581KQuIY5/LXo3dWDEilFdsADAe8XAEcO64es
|
||||
Ow0g1UvXLnpXSE151kXBFb3sKH/ZjCecDYMCIMEb4sWLSblkSxJ5sNSmXIG4wtr2
|
||||
Qnii7CXZgnVYraQE/Jyh+NMQANuoSdMCAwEAAaNTMFEwHQYDVR0OBBYEFAyQQQuM
|
||||
ab+YUQqjK8dVVOoHVFmXMB8GA1UdIwQYMBaAFAyQQQuMab+YUQqjK8dVVOoHVFmX
|
||||
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBADj0vQ6ykWhicoqR
|
||||
e6VZMwlEJV7/DSvWWKBd9MUjfKye0A4565ya5lmnzP3DiD3nqGe3miqmLsXKDs+X
|
||||
POqlPXTWIamP7D4MJ32XtSLwZB4ru+I+Ao/P/VngPepoRPQoBnzHe7jww0rokqxl
|
||||
AZERjlbTUwUAy/BPWPSzSJZ2j0tcs6ZLDNyYzpK4ao8R9/1VmQ92Tcp3feJs1QTg
|
||||
odRQc3om/AkWOwsll+oyX0UbJeHkFHiLanUPXbdh+/BkSvZJ8ynL+feSDdaurPe+
|
||||
PSfnqLtQft9/neecGRdEaQzzzSFVQUVQzTdK1Q7hA7b55b2HvIa3ktDiks+sJsYN
|
||||
Dhm6uZM=
|
||||
-----END CERTIFICATE-----
|
||||
27
vendor/github.com/google/s2a-go/testdata/server_key.pem
generated
vendored
Normal file
27
vendor/github.com/google/s2a-go/testdata/server_key.pem
generated
vendored
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAorX749dD4zeGNgf+/QrhQRiXmWPOk0zWLnZ5Az6AWiiiNPzs
|
||||
8NJqmFN+zQ9fL89MCMcES8+Fak6mZBd8k1jOPBwK+DrqFuqS/779VNmIUsCwdqDO
|
||||
QTP4VEmpPkSrsbkUvLDWLNfW7HI83u0ARYQSDt6qyJpcPcKrz5Ng31yOKs94XtFk
|
||||
XzIUJgTGq9uj5hzpEvrHDX2JdVN9y1GBB7nzUpC4hjn8tejd1YMSKUV2wAMB7xcA
|
||||
Rw7rh6w7DSDVS9cueldITXnWRcEVvewof9mMJ5wNgwIgwRvixYtJuWRLEnmw1KZc
|
||||
gbjC2vZCeKLsJdmCdVitpAT8nKH40xAA26hJ0wIDAQABAoIBACaNR+lsD8G+XiZf
|
||||
LqN1+HkcAo9tfnyYMAdCOtnx7SdviT9Uzi8hK/B7mAeuJLeHPlS2EuaDfPD7QaFl
|
||||
jza6S+MiIdc+3kgfvESsVAnOoOY6kZUJ9NSuI6CU82y1iJjLaYZrv9NQMLRFPPb0
|
||||
4KOX709mosB1EnXvshW0rbc+jtDFhrm1SxMt+k9TuzmMxjbOeW4LOLXPgU8X1T3Q
|
||||
Xy0hMZZtcgBs9wFIo8yCtmOixax9pnFE8rRltgDxTodn9LLdz1FieyntNgDksZ0P
|
||||
nt4kV7Mqly7ELaea+Foaj244mKsesic2e3GhAlMRLun/VSunSf7mOCxfpITB8dp1
|
||||
drDhOYECgYEA19151dVxRcviuovN6Dar+QszMTnU8pDJ8BjLFjXjP/hNBBwMTHDE
|
||||
duMuWk2qnwZqMooI/shxrF/ufmTgS0CFrh2+ANBZu27vWConJNXcyNtdigI4wt50
|
||||
L0Y2qcZn2mg67qFXHwoR3QNwrwnPwEjRXA09at9CSRZzcwDQ0ETXhYsCgYEAwPaG
|
||||
06QdK8Zyly7TTzZJwxzv9uGiqzodmGtX6NEKjgij2JaCxHpukqZBJoqa0jKeK1cm
|
||||
eNVkOvT5ff9TMzarSHQLr3pZen2/oVLb5gaFkbcJt/klv9Fd+ZRilHY3i6QwS6pD
|
||||
uMiPOWS4DrLHDRVoVlAZTDjT1RVwwTs+P2NhJdkCgYEAsriXysbxBYyMp05gqEW7
|
||||
lHIFbFgpSrs9th+Q5U6wW6JEgYaHWDJ1NslY80MiZI93FWjbkbZ7BvBWESeL3EIL
|
||||
a+EMErht0pVCbIhZ6FF4foPAqia0wAJVx14mm+G80kNBp5jE/NnleEsE3KcO7nBb
|
||||
hg8gLn+x7bk81JZ0TDrzBYkCgYEAuQKluv47SeF3tSScTfKLPpvcKCWmxe1uutkQ
|
||||
7JShPhVioyOMNb39jnYBOWbjkm4d4QgqRuiytSR0oi3QI+Ziy5EYMyNn713qAk9j
|
||||
r2TJZDDPDKnBW+zt4YI4EohWMXk3JRUW4XDKggjjwJQA7bZ812TtHHvP/xoThfG7
|
||||
eSNb3eECgYBw6ssgCtMrdvQiEmjKVX/9yI38mvC2kSGyzbrQnGUfgqRGomRpeZuD
|
||||
B5E3kysA4td5pT5lvcLgSW0TbOz+YbiriXjwOihPIelCvc9gE2eOUI71/byUWPFz
|
||||
7u5F/xQ4NaGr5suLF+lBC6h7pSbM4El9lIHQAQadpuEdzHqrw+hs3g==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
9
vendor/github.com/klauspost/compress/README.md
generated
vendored
9
vendor/github.com/klauspost/compress/README.md
generated
vendored
|
|
@ -16,6 +16,15 @@ This package provides various compression algorithms.
|
|||
|
||||
# changelog
|
||||
|
||||
* Apr 5, 2023 - [v1.16.4](https://github.com/klauspost/compress/releases/tag/v1.16.4)
|
||||
* zstd: Improve zstd best efficiency by @greatroar and @klauspost in https://github.com/klauspost/compress/pull/784
|
||||
* zstd: Respect WithAllLitEntropyCompression https://github.com/klauspost/compress/pull/792
|
||||
* zstd: Fix amd64 not always detecting corrupt data https://github.com/klauspost/compress/pull/785
|
||||
* zstd: Various minor improvements by @greatroar in https://github.com/klauspost/compress/pull/788 https://github.com/klauspost/compress/pull/794 https://github.com/klauspost/compress/pull/795
|
||||
* s2: Fix huge block overflow https://github.com/klauspost/compress/pull/779
|
||||
* s2: Allow CustomEncoder fallback https://github.com/klauspost/compress/pull/780
|
||||
* gzhttp: Suppport ResponseWriter Unwrap() in gzhttp handler by @jgimenez in https://github.com/klauspost/compress/pull/799
|
||||
|
||||
* Mar 13, 2023 - [v1.16.1](https://github.com/klauspost/compress/releases/tag/v1.16.1)
|
||||
* zstd: Speed up + improve best encoder by @greatroar in https://github.com/klauspost/compress/pull/776
|
||||
* gzhttp: Add optional [BREACH mitigation](https://github.com/klauspost/compress/tree/master/gzhttp#breach-mitigation). https://github.com/klauspost/compress/pull/762 https://github.com/klauspost/compress/pull/768 https://github.com/klauspost/compress/pull/769 https://github.com/klauspost/compress/pull/770 https://github.com/klauspost/compress/pull/767
|
||||
|
|
|
|||
29
vendor/github.com/klauspost/compress/gzip/gunzip.go
generated
vendored
29
vendor/github.com/klauspost/compress/gzip/gunzip.go
generated
vendored
|
|
@ -288,10 +288,35 @@ func (z *Reader) Read(p []byte) (n int, err error) {
|
|||
return n, nil
|
||||
}
|
||||
|
||||
// Support the io.WriteTo interface for io.Copy and friends.
|
||||
type crcer interface {
|
||||
io.Writer
|
||||
Sum32() uint32
|
||||
Reset()
|
||||
}
|
||||
type crcUpdater struct {
|
||||
z *Reader
|
||||
}
|
||||
|
||||
func (c *crcUpdater) Write(p []byte) (int, error) {
|
||||
c.z.digest = crc32.Update(c.z.digest, crc32.IEEETable, p)
|
||||
return len(p), nil
|
||||
}
|
||||
|
||||
func (c *crcUpdater) Sum32() uint32 {
|
||||
return c.z.digest
|
||||
}
|
||||
|
||||
func (c *crcUpdater) Reset() {
|
||||
c.z.digest = 0
|
||||
}
|
||||
|
||||
// WriteTo support the io.WriteTo interface for io.Copy and friends.
|
||||
func (z *Reader) WriteTo(w io.Writer) (int64, error) {
|
||||
total := int64(0)
|
||||
crcWriter := crc32.NewIEEE()
|
||||
crcWriter := crcer(crc32.NewIEEE())
|
||||
if z.digest != 0 {
|
||||
crcWriter = &crcUpdater{z: z}
|
||||
}
|
||||
for {
|
||||
if z.err != nil {
|
||||
if z.err == io.EOF {
|
||||
|
|
|
|||
2
vendor/github.com/klauspost/compress/zstd/bytebuf.go
generated
vendored
2
vendor/github.com/klauspost/compress/zstd/bytebuf.go
generated
vendored
|
|
@ -109,7 +109,7 @@ func (r *readerWrapper) readBig(n int, dst []byte) ([]byte, error) {
|
|||
}
|
||||
|
||||
func (r *readerWrapper) readByte() (byte, error) {
|
||||
n2, err := r.r.Read(r.tmp[:1])
|
||||
n2, err := io.ReadFull(r.r, r.tmp[:1])
|
||||
if err != nil {
|
||||
if err == io.EOF {
|
||||
err = io.ErrUnexpectedEOF
|
||||
|
|
|
|||
26
vendor/github.com/prometheus/client_golang/prometheus/counter.go
generated
vendored
26
vendor/github.com/prometheus/client_golang/prometheus/counter.go
generated
vendored
|
|
@ -59,6 +59,18 @@ type ExemplarAdder interface {
|
|||
// CounterOpts is an alias for Opts. See there for doc comments.
|
||||
type CounterOpts Opts
|
||||
|
||||
// CounterVecOpts bundles the options to create a CounterVec metric.
|
||||
// It is mandatory to set CounterOpts, see there for mandatory fields. VariableLabels
|
||||
// is optional and can safely be left to its default value.
|
||||
type CounterVecOpts struct {
|
||||
CounterOpts
|
||||
|
||||
// VariableLabels are used to partition the metric vector by the given set
|
||||
// of labels. Each label value will be constrained with the optional Contraint
|
||||
// function, if provided.
|
||||
VariableLabels ConstrainableLabels
|
||||
}
|
||||
|
||||
// NewCounter creates a new Counter based on the provided CounterOpts.
|
||||
//
|
||||
// The returned implementation also implements ExemplarAdder. It is safe to
|
||||
|
|
@ -174,16 +186,24 @@ type CounterVec struct {
|
|||
// NewCounterVec creates a new CounterVec based on the provided CounterOpts and
|
||||
// partitioned by the given label names.
|
||||
func NewCounterVec(opts CounterOpts, labelNames []string) *CounterVec {
|
||||
desc := NewDesc(
|
||||
return V2.NewCounterVec(CounterVecOpts{
|
||||
CounterOpts: opts,
|
||||
VariableLabels: UnconstrainedLabels(labelNames),
|
||||
})
|
||||
}
|
||||
|
||||
// NewCounterVec creates a new CounterVec based on the provided CounterVecOpts.
|
||||
func (v2) NewCounterVec(opts CounterVecOpts) *CounterVec {
|
||||
desc := V2.NewDesc(
|
||||
BuildFQName(opts.Namespace, opts.Subsystem, opts.Name),
|
||||
opts.Help,
|
||||
labelNames,
|
||||
opts.VariableLabels,
|
||||
opts.ConstLabels,
|
||||
)
|
||||
return &CounterVec{
|
||||
MetricVec: NewMetricVec(desc, func(lvs ...string) Metric {
|
||||
if len(lvs) != len(desc.variableLabels) {
|
||||
panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels, lvs))
|
||||
panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels.labelNames(), lvs))
|
||||
}
|
||||
result := &counter{desc: desc, labelPairs: MakeLabelPairs(desc, lvs), now: time.Now}
|
||||
result.init(result) // Init self-collection.
|
||||
|
|
|
|||
46
vendor/github.com/prometheus/client_golang/prometheus/desc.go
generated
vendored
46
vendor/github.com/prometheus/client_golang/prometheus/desc.go
generated
vendored
|
|
@ -14,20 +14,16 @@
|
|||
package prometheus
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"github.com/cespare/xxhash/v2"
|
||||
|
||||
"github.com/prometheus/client_golang/prometheus/internal"
|
||||
|
||||
//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
|
||||
"github.com/golang/protobuf/proto"
|
||||
"github.com/prometheus/common/model"
|
||||
|
||||
"github.com/cespare/xxhash/v2"
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
"github.com/prometheus/common/model"
|
||||
"google.golang.org/protobuf/proto"
|
||||
)
|
||||
|
||||
// Desc is the descriptor used by every Prometheus Metric. It is essentially
|
||||
|
|
@ -54,9 +50,9 @@ type Desc struct {
|
|||
// constLabelPairs contains precalculated DTO label pairs based on
|
||||
// the constant labels.
|
||||
constLabelPairs []*dto.LabelPair
|
||||
// variableLabels contains names of labels for which the metric
|
||||
// maintains variable values.
|
||||
variableLabels []string
|
||||
// variableLabels contains names of labels and normalization function for
|
||||
// which the metric maintains variable values.
|
||||
variableLabels ConstrainedLabels
|
||||
// id is a hash of the values of the ConstLabels and fqName. This
|
||||
// must be unique among all registered descriptors and can therefore be
|
||||
// used as an identifier of the descriptor.
|
||||
|
|
@ -80,10 +76,24 @@ type Desc struct {
|
|||
// For constLabels, the label values are constant. Therefore, they are fully
|
||||
// specified in the Desc. See the Collector example for a usage pattern.
|
||||
func NewDesc(fqName, help string, variableLabels []string, constLabels Labels) *Desc {
|
||||
return V2.NewDesc(fqName, help, UnconstrainedLabels(variableLabels), constLabels)
|
||||
}
|
||||
|
||||
// NewDesc allocates and initializes a new Desc. Errors are recorded in the Desc
|
||||
// and will be reported on registration time. variableLabels and constLabels can
|
||||
// be nil if no such labels should be set. fqName must not be empty.
|
||||
//
|
||||
// variableLabels only contain the label names and normalization functions. Their
|
||||
// label values are variable and therefore not part of the Desc. (They are managed
|
||||
// within the Metric.)
|
||||
//
|
||||
// For constLabels, the label values are constant. Therefore, they are fully
|
||||
// specified in the Desc. See the Collector example for a usage pattern.
|
||||
func (v2) NewDesc(fqName, help string, variableLabels ConstrainableLabels, constLabels Labels) *Desc {
|
||||
d := &Desc{
|
||||
fqName: fqName,
|
||||
help: help,
|
||||
variableLabels: variableLabels,
|
||||
variableLabels: variableLabels.constrainedLabels(),
|
||||
}
|
||||
if !model.IsValidMetricName(model.LabelValue(fqName)) {
|
||||
d.err = fmt.Errorf("%q is not a valid metric name", fqName)
|
||||
|
|
@ -93,7 +103,7 @@ func NewDesc(fqName, help string, variableLabels []string, constLabels Labels) *
|
|||
// their sorted label names) plus the fqName (at position 0).
|
||||
labelValues := make([]string, 1, len(constLabels)+1)
|
||||
labelValues[0] = fqName
|
||||
labelNames := make([]string, 0, len(constLabels)+len(variableLabels))
|
||||
labelNames := make([]string, 0, len(constLabels)+len(d.variableLabels))
|
||||
labelNameSet := map[string]struct{}{}
|
||||
// First add only the const label names and sort them...
|
||||
for labelName := range constLabels {
|
||||
|
|
@ -118,16 +128,16 @@ func NewDesc(fqName, help string, variableLabels []string, constLabels Labels) *
|
|||
// Now add the variable label names, but prefix them with something that
|
||||
// cannot be in a regular label name. That prevents matching the label
|
||||
// dimension with a different mix between preset and variable labels.
|
||||
for _, labelName := range variableLabels {
|
||||
if !checkLabelName(labelName) {
|
||||
d.err = fmt.Errorf("%q is not a valid label name for metric %q", labelName, fqName)
|
||||
for _, label := range d.variableLabels {
|
||||
if !checkLabelName(label.Name) {
|
||||
d.err = fmt.Errorf("%q is not a valid label name for metric %q", label.Name, fqName)
|
||||
return d
|
||||
}
|
||||
labelNames = append(labelNames, "$"+labelName)
|
||||
labelNameSet[labelName] = struct{}{}
|
||||
labelNames = append(labelNames, "$"+label.Name)
|
||||
labelNameSet[label.Name] = struct{}{}
|
||||
}
|
||||
if len(labelNames) != len(labelNameSet) {
|
||||
d.err = errors.New("duplicate label names")
|
||||
d.err = fmt.Errorf("duplicate label names in constant and variable labels for metric %q", fqName)
|
||||
return d
|
||||
}
|
||||
|
||||
|
|
|
|||
26
vendor/github.com/prometheus/client_golang/prometheus/gauge.go
generated
vendored
26
vendor/github.com/prometheus/client_golang/prometheus/gauge.go
generated
vendored
|
|
@ -55,6 +55,18 @@ type Gauge interface {
|
|||
// GaugeOpts is an alias for Opts. See there for doc comments.
|
||||
type GaugeOpts Opts
|
||||
|
||||
// GaugeVecOpts bundles the options to create a GaugeVec metric.
|
||||
// It is mandatory to set GaugeOpts, see there for mandatory fields. VariableLabels
|
||||
// is optional and can safely be left to its default value.
|
||||
type GaugeVecOpts struct {
|
||||
GaugeOpts
|
||||
|
||||
// VariableLabels are used to partition the metric vector by the given set
|
||||
// of labels. Each label value will be constrained with the optional Contraint
|
||||
// function, if provided.
|
||||
VariableLabels ConstrainableLabels
|
||||
}
|
||||
|
||||
// NewGauge creates a new Gauge based on the provided GaugeOpts.
|
||||
//
|
||||
// The returned implementation is optimized for a fast Set method. If you have a
|
||||
|
|
@ -138,16 +150,24 @@ type GaugeVec struct {
|
|||
// NewGaugeVec creates a new GaugeVec based on the provided GaugeOpts and
|
||||
// partitioned by the given label names.
|
||||
func NewGaugeVec(opts GaugeOpts, labelNames []string) *GaugeVec {
|
||||
desc := NewDesc(
|
||||
return V2.NewGaugeVec(GaugeVecOpts{
|
||||
GaugeOpts: opts,
|
||||
VariableLabels: UnconstrainedLabels(labelNames),
|
||||
})
|
||||
}
|
||||
|
||||
// NewGaugeVec creates a new GaugeVec based on the provided GaugeVecOpts.
|
||||
func (v2) NewGaugeVec(opts GaugeVecOpts) *GaugeVec {
|
||||
desc := V2.NewDesc(
|
||||
BuildFQName(opts.Namespace, opts.Subsystem, opts.Name),
|
||||
opts.Help,
|
||||
labelNames,
|
||||
opts.VariableLabels,
|
||||
opts.ConstLabels,
|
||||
)
|
||||
return &GaugeVec{
|
||||
MetricVec: NewMetricVec(desc, func(lvs ...string) Metric {
|
||||
if len(lvs) != len(desc.variableLabels) {
|
||||
panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels, lvs))
|
||||
panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels.labelNames(), lvs))
|
||||
}
|
||||
result := &gauge{desc: desc, labelPairs: MakeLabelPairs(desc, lvs)}
|
||||
result.init(result) // Init self-collection.
|
||||
|
|
|
|||
7
vendor/github.com/prometheus/client_golang/prometheus/go_collector_latest.go
generated
vendored
7
vendor/github.com/prometheus/client_golang/prometheus/go_collector_latest.go
generated
vendored
|
|
@ -23,11 +23,10 @@ import (
|
|||
"strings"
|
||||
"sync"
|
||||
|
||||
//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
|
||||
"github.com/golang/protobuf/proto"
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
|
||||
"github.com/prometheus/client_golang/prometheus/internal"
|
||||
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
"google.golang.org/protobuf/proto"
|
||||
)
|
||||
|
||||
const (
|
||||
|
|
|
|||
51
vendor/github.com/prometheus/client_golang/prometheus/histogram.go
generated
vendored
51
vendor/github.com/prometheus/client_golang/prometheus/histogram.go
generated
vendored
|
|
@ -22,10 +22,9 @@ import (
|
|||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
|
||||
"github.com/golang/protobuf/proto"
|
||||
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
|
||||
"google.golang.org/protobuf/proto"
|
||||
)
|
||||
|
||||
// nativeHistogramBounds for the frac of observed values. Only relevant for
|
||||
|
|
@ -469,6 +468,18 @@ type HistogramOpts struct {
|
|||
NativeHistogramMaxZeroThreshold float64
|
||||
}
|
||||
|
||||
// HistogramVecOpts bundles the options to create a HistogramVec metric.
|
||||
// It is mandatory to set HistogramOpts, see there for mandatory fields. VariableLabels
|
||||
// is optional and can safely be left to its default value.
|
||||
type HistogramVecOpts struct {
|
||||
HistogramOpts
|
||||
|
||||
// VariableLabels are used to partition the metric vector by the given set
|
||||
// of labels. Each label value will be constrained with the optional Contraint
|
||||
// function, if provided.
|
||||
VariableLabels ConstrainableLabels
|
||||
}
|
||||
|
||||
// NewHistogram creates a new Histogram based on the provided HistogramOpts. It
|
||||
// panics if the buckets in HistogramOpts are not in strictly increasing order.
|
||||
//
|
||||
|
|
@ -489,11 +500,11 @@ func NewHistogram(opts HistogramOpts) Histogram {
|
|||
|
||||
func newHistogram(desc *Desc, opts HistogramOpts, labelValues ...string) Histogram {
|
||||
if len(desc.variableLabels) != len(labelValues) {
|
||||
panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels, labelValues))
|
||||
panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels.labelNames(), labelValues))
|
||||
}
|
||||
|
||||
for _, n := range desc.variableLabels {
|
||||
if n == bucketLabel {
|
||||
if n.Name == bucketLabel {
|
||||
panic(errBucketLabelNotAllowed)
|
||||
}
|
||||
}
|
||||
|
|
@ -544,16 +555,12 @@ func newHistogram(desc *Desc, opts HistogramOpts, labelValues ...string) Histogr
|
|||
}
|
||||
// Finally we know the final length of h.upperBounds and can make buckets
|
||||
// for both counts as well as exemplars:
|
||||
h.counts[0] = &histogramCounts{
|
||||
buckets: make([]uint64, len(h.upperBounds)),
|
||||
nativeHistogramZeroThresholdBits: math.Float64bits(h.nativeHistogramZeroThreshold),
|
||||
nativeHistogramSchema: h.nativeHistogramSchema,
|
||||
}
|
||||
h.counts[1] = &histogramCounts{
|
||||
buckets: make([]uint64, len(h.upperBounds)),
|
||||
nativeHistogramZeroThresholdBits: math.Float64bits(h.nativeHistogramZeroThreshold),
|
||||
nativeHistogramSchema: h.nativeHistogramSchema,
|
||||
}
|
||||
h.counts[0] = &histogramCounts{buckets: make([]uint64, len(h.upperBounds))}
|
||||
atomic.StoreUint64(&h.counts[0].nativeHistogramZeroThresholdBits, math.Float64bits(h.nativeHistogramZeroThreshold))
|
||||
atomic.StoreInt32(&h.counts[0].nativeHistogramSchema, h.nativeHistogramSchema)
|
||||
h.counts[1] = &histogramCounts{buckets: make([]uint64, len(h.upperBounds))}
|
||||
atomic.StoreUint64(&h.counts[1].nativeHistogramZeroThresholdBits, math.Float64bits(h.nativeHistogramZeroThreshold))
|
||||
atomic.StoreInt32(&h.counts[1].nativeHistogramSchema, h.nativeHistogramSchema)
|
||||
h.exemplars = make([]atomic.Value, len(h.upperBounds)+1)
|
||||
|
||||
h.init(h) // Init self-collection.
|
||||
|
|
@ -1034,15 +1041,23 @@ type HistogramVec struct {
|
|||
// NewHistogramVec creates a new HistogramVec based on the provided HistogramOpts and
|
||||
// partitioned by the given label names.
|
||||
func NewHistogramVec(opts HistogramOpts, labelNames []string) *HistogramVec {
|
||||
desc := NewDesc(
|
||||
return V2.NewHistogramVec(HistogramVecOpts{
|
||||
HistogramOpts: opts,
|
||||
VariableLabels: UnconstrainedLabels(labelNames),
|
||||
})
|
||||
}
|
||||
|
||||
// NewHistogramVec creates a new HistogramVec based on the provided HistogramVecOpts.
|
||||
func (v2) NewHistogramVec(opts HistogramVecOpts) *HistogramVec {
|
||||
desc := V2.NewDesc(
|
||||
BuildFQName(opts.Namespace, opts.Subsystem, opts.Name),
|
||||
opts.Help,
|
||||
labelNames,
|
||||
opts.VariableLabels,
|
||||
opts.ConstLabels,
|
||||
)
|
||||
return &HistogramVec{
|
||||
MetricVec: NewMetricVec(desc, func(lvs ...string) Metric {
|
||||
return newHistogram(desc, opts, lvs...)
|
||||
return newHistogram(desc, opts.HistogramOpts, lvs...)
|
||||
}),
|
||||
}
|
||||
}
|
||||
|
|
|
|||
72
vendor/github.com/prometheus/client_golang/prometheus/labels.go
generated
vendored
72
vendor/github.com/prometheus/client_golang/prometheus/labels.go
generated
vendored
|
|
@ -32,6 +32,78 @@ import (
|
|||
// create a Desc.
|
||||
type Labels map[string]string
|
||||
|
||||
// ConstrainedLabels represents a label name and its constrain function
|
||||
// to normalize label values. This type is commonly used when constructing
|
||||
// metric vector Collectors.
|
||||
type ConstrainedLabel struct {
|
||||
Name string
|
||||
Constraint func(string) string
|
||||
}
|
||||
|
||||
func (cl ConstrainedLabel) Constrain(v string) string {
|
||||
if cl.Constraint == nil {
|
||||
return v
|
||||
}
|
||||
return cl.Constraint(v)
|
||||
}
|
||||
|
||||
// ConstrainableLabels is an interface that allows creating of labels that can
|
||||
// be optionally constrained.
|
||||
//
|
||||
// prometheus.V2().NewCounterVec(CounterVecOpts{
|
||||
// CounterOpts: {...}, // Usual CounterOpts fields
|
||||
// VariableLabels: []ConstrainedLabels{
|
||||
// {Name: "A"},
|
||||
// {Name: "B", Constraint: func(v string) string { ... }},
|
||||
// },
|
||||
// })
|
||||
type ConstrainableLabels interface {
|
||||
constrainedLabels() ConstrainedLabels
|
||||
labelNames() []string
|
||||
}
|
||||
|
||||
// ConstrainedLabels represents a collection of label name -> constrain function
|
||||
// to normalize label values. This type is commonly used when constructing
|
||||
// metric vector Collectors.
|
||||
type ConstrainedLabels []ConstrainedLabel
|
||||
|
||||
func (cls ConstrainedLabels) constrainedLabels() ConstrainedLabels {
|
||||
return cls
|
||||
}
|
||||
|
||||
func (cls ConstrainedLabels) labelNames() []string {
|
||||
names := make([]string, len(cls))
|
||||
for i, label := range cls {
|
||||
names[i] = label.Name
|
||||
}
|
||||
return names
|
||||
}
|
||||
|
||||
// UnconstrainedLabels represents collection of label without any constraint on
|
||||
// their value. Thus, it is simply a collection of label names.
|
||||
//
|
||||
// UnconstrainedLabels([]string{ "A", "B" })
|
||||
//
|
||||
// is equivalent to
|
||||
//
|
||||
// ConstrainedLabels {
|
||||
// { Name: "A" },
|
||||
// { Name: "B" },
|
||||
// }
|
||||
type UnconstrainedLabels []string
|
||||
|
||||
func (uls UnconstrainedLabels) constrainedLabels() ConstrainedLabels {
|
||||
constrainedLabels := make([]ConstrainedLabel, len(uls))
|
||||
for i, l := range uls {
|
||||
constrainedLabels[i] = ConstrainedLabel{Name: l}
|
||||
}
|
||||
return constrainedLabels
|
||||
}
|
||||
|
||||
func (uls UnconstrainedLabels) labelNames() []string {
|
||||
return uls
|
||||
}
|
||||
|
||||
// reservedLabelPrefix is a prefix which is not legal in user-supplied
|
||||
// label names.
|
||||
const reservedLabelPrefix = "__"
|
||||
|
|
|
|||
6
vendor/github.com/prometheus/client_golang/prometheus/metric.go
generated
vendored
6
vendor/github.com/prometheus/client_golang/prometheus/metric.go
generated
vendored
|
|
@ -20,11 +20,9 @@ import (
|
|||
"strings"
|
||||
"time"
|
||||
|
||||
//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
|
||||
"github.com/golang/protobuf/proto"
|
||||
"github.com/prometheus/common/model"
|
||||
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
"github.com/prometheus/common/model"
|
||||
"google.golang.org/protobuf/proto"
|
||||
)
|
||||
|
||||
var separatorByteSlice = []byte{model.SeparatorByte} // For convenient use with xxhash.
|
||||
|
|
|
|||
19
vendor/github.com/prometheus/client_golang/prometheus/registry.go
generated
vendored
19
vendor/github.com/prometheus/client_golang/prometheus/registry.go
generated
vendored
|
|
@ -21,18 +21,17 @@ import (
|
|||
"path/filepath"
|
||||
"runtime"
|
||||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"unicode/utf8"
|
||||
|
||||
"github.com/cespare/xxhash/v2"
|
||||
//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
|
||||
"github.com/golang/protobuf/proto"
|
||||
"github.com/prometheus/common/expfmt"
|
||||
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
|
||||
"github.com/prometheus/client_golang/prometheus/internal"
|
||||
|
||||
"github.com/cespare/xxhash/v2"
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
"github.com/prometheus/common/expfmt"
|
||||
"google.golang.org/protobuf/proto"
|
||||
)
|
||||
|
||||
const (
|
||||
|
|
@ -933,6 +932,10 @@ func checkMetricConsistency(
|
|||
h.WriteString(lp.GetValue())
|
||||
h.Write(separatorByteSlice)
|
||||
}
|
||||
if dtoMetric.TimestampMs != nil {
|
||||
h.WriteString(strconv.FormatInt(*(dtoMetric.TimestampMs), 10))
|
||||
h.Write(separatorByteSlice)
|
||||
}
|
||||
hSum := h.Sum64()
|
||||
if _, exists := metricHashes[hSum]; exists {
|
||||
return fmt.Errorf(
|
||||
|
|
@ -962,7 +965,7 @@ func checkDescConsistency(
|
|||
copy(lpsFromDesc, desc.constLabelPairs)
|
||||
for _, l := range desc.variableLabels {
|
||||
lpsFromDesc = append(lpsFromDesc, &dto.LabelPair{
|
||||
Name: proto.String(l),
|
||||
Name: proto.String(l.Name),
|
||||
})
|
||||
}
|
||||
if len(lpsFromDesc) != len(dtoMetric.Label) {
|
||||
|
|
|
|||
39
vendor/github.com/prometheus/client_golang/prometheus/summary.go
generated
vendored
39
vendor/github.com/prometheus/client_golang/prometheus/summary.go
generated
vendored
|
|
@ -22,11 +22,10 @@ import (
|
|||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
"github.com/beorn7/perks/quantile"
|
||||
//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
|
||||
"github.com/golang/protobuf/proto"
|
||||
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
|
||||
"github.com/beorn7/perks/quantile"
|
||||
"google.golang.org/protobuf/proto"
|
||||
)
|
||||
|
||||
// quantileLabel is used for the label that defines the quantile in a
|
||||
|
|
@ -148,6 +147,18 @@ type SummaryOpts struct {
|
|||
BufCap uint32
|
||||
}
|
||||
|
||||
// SummaryVecOpts bundles the options to create a SummaryVec metric.
|
||||
// It is mandatory to set SummaryOpts, see there for mandatory fields. VariableLabels
|
||||
// is optional and can safely be left to its default value.
|
||||
type SummaryVecOpts struct {
|
||||
SummaryOpts
|
||||
|
||||
// VariableLabels are used to partition the metric vector by the given set
|
||||
// of labels. Each label value will be constrained with the optional Contraint
|
||||
// function, if provided.
|
||||
VariableLabels ConstrainableLabels
|
||||
}
|
||||
|
||||
// Problem with the sliding-window decay algorithm... The Merge method of
|
||||
// perk/quantile is actually not working as advertised - and it might be
|
||||
// unfixable, as the underlying algorithm is apparently not capable of merging
|
||||
|
|
@ -178,11 +189,11 @@ func NewSummary(opts SummaryOpts) Summary {
|
|||
|
||||
func newSummary(desc *Desc, opts SummaryOpts, labelValues ...string) Summary {
|
||||
if len(desc.variableLabels) != len(labelValues) {
|
||||
panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels, labelValues))
|
||||
panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels.labelNames(), labelValues))
|
||||
}
|
||||
|
||||
for _, n := range desc.variableLabels {
|
||||
if n == quantileLabel {
|
||||
if n.Name == quantileLabel {
|
||||
panic(errQuantileLabelNotAllowed)
|
||||
}
|
||||
}
|
||||
|
|
@ -530,20 +541,28 @@ type SummaryVec struct {
|
|||
// it is handled by the Prometheus server internally, “quantile” is an illegal
|
||||
// label name. NewSummaryVec will panic if this label name is used.
|
||||
func NewSummaryVec(opts SummaryOpts, labelNames []string) *SummaryVec {
|
||||
for _, ln := range labelNames {
|
||||
return V2.NewSummaryVec(SummaryVecOpts{
|
||||
SummaryOpts: opts,
|
||||
VariableLabels: UnconstrainedLabels(labelNames),
|
||||
})
|
||||
}
|
||||
|
||||
// NewSummaryVec creates a new SummaryVec based on the provided SummaryVecOpts.
|
||||
func (v2) NewSummaryVec(opts SummaryVecOpts) *SummaryVec {
|
||||
for _, ln := range opts.VariableLabels.labelNames() {
|
||||
if ln == quantileLabel {
|
||||
panic(errQuantileLabelNotAllowed)
|
||||
}
|
||||
}
|
||||
desc := NewDesc(
|
||||
desc := V2.NewDesc(
|
||||
BuildFQName(opts.Namespace, opts.Subsystem, opts.Name),
|
||||
opts.Help,
|
||||
labelNames,
|
||||
opts.VariableLabels,
|
||||
opts.ConstLabels,
|
||||
)
|
||||
return &SummaryVec{
|
||||
MetricVec: NewMetricVec(desc, func(lvs ...string) Metric {
|
||||
return newSummary(desc, opts, lvs...)
|
||||
return newSummary(desc, opts.SummaryOpts, lvs...)
|
||||
}),
|
||||
}
|
||||
}
|
||||
|
|
|
|||
28
vendor/github.com/prometheus/client_golang/prometheus/timer.go
generated
vendored
28
vendor/github.com/prometheus/client_golang/prometheus/timer.go
generated
vendored
|
|
@ -23,7 +23,9 @@ type Timer struct {
|
|||
}
|
||||
|
||||
// NewTimer creates a new Timer. The provided Observer is used to observe a
|
||||
// duration in seconds. Timer is usually used to time a function call in the
|
||||
// duration in seconds. If the Observer implements ExemplarObserver, passing exemplar
|
||||
// later on will be also supported.
|
||||
// Timer is usually used to time a function call in the
|
||||
// following way:
|
||||
//
|
||||
// func TimeMe() {
|
||||
|
|
@ -31,6 +33,14 @@ type Timer struct {
|
|||
// defer timer.ObserveDuration()
|
||||
// // Do actual work.
|
||||
// }
|
||||
//
|
||||
// or
|
||||
//
|
||||
// func TimeMeWithExemplar() {
|
||||
// timer := NewTimer(myHistogram)
|
||||
// defer timer.ObserveDurationWithExemplar(exemplar)
|
||||
// // Do actual work.
|
||||
// }
|
||||
func NewTimer(o Observer) *Timer {
|
||||
return &Timer{
|
||||
begin: time.Now(),
|
||||
|
|
@ -53,3 +63,19 @@ func (t *Timer) ObserveDuration() time.Duration {
|
|||
}
|
||||
return d
|
||||
}
|
||||
|
||||
// ObserveDurationWithExemplar is like ObserveDuration, but it will also
|
||||
// observe exemplar with the duration unless exemplar is nil or provided Observer can't
|
||||
// be casted to ExemplarObserver.
|
||||
func (t *Timer) ObserveDurationWithExemplar(exemplar Labels) time.Duration {
|
||||
d := time.Since(t.begin)
|
||||
eo, ok := t.observer.(ExemplarObserver)
|
||||
if ok && exemplar != nil {
|
||||
eo.ObserveWithExemplar(d.Seconds(), exemplar)
|
||||
return d
|
||||
}
|
||||
if t.observer != nil {
|
||||
t.observer.Observe(d.Seconds())
|
||||
}
|
||||
return d
|
||||
}
|
||||
|
|
|
|||
10
vendor/github.com/prometheus/client_golang/prometheus/value.go
generated
vendored
10
vendor/github.com/prometheus/client_golang/prometheus/value.go
generated
vendored
|
|
@ -19,13 +19,11 @@ import (
|
|||
"time"
|
||||
"unicode/utf8"
|
||||
|
||||
//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
|
||||
"github.com/golang/protobuf/proto"
|
||||
"google.golang.org/protobuf/types/known/timestamppb"
|
||||
|
||||
"github.com/prometheus/client_golang/prometheus/internal"
|
||||
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
"google.golang.org/protobuf/proto"
|
||||
"google.golang.org/protobuf/types/known/timestamppb"
|
||||
)
|
||||
|
||||
// ValueType is an enumeration of metric types that represent a simple value.
|
||||
|
|
@ -188,9 +186,9 @@ func MakeLabelPairs(desc *Desc, labelValues []string) []*dto.LabelPair {
|
|||
return desc.constLabelPairs
|
||||
}
|
||||
labelPairs := make([]*dto.LabelPair, 0, totalLen)
|
||||
for i, n := range desc.variableLabels {
|
||||
for i, l := range desc.variableLabels {
|
||||
labelPairs = append(labelPairs, &dto.LabelPair{
|
||||
Name: proto.String(n),
|
||||
Name: proto.String(l.Name),
|
||||
Value: proto.String(labelValues[i]),
|
||||
})
|
||||
}
|
||||
|
|
|
|||
54
vendor/github.com/prometheus/client_golang/prometheus/vec.go
generated
vendored
54
vendor/github.com/prometheus/client_golang/prometheus/vec.go
generated
vendored
|
|
@ -72,6 +72,7 @@ func NewMetricVec(desc *Desc, newMetric func(lvs ...string) Metric) *MetricVec {
|
|||
// with a performance overhead (for creating and processing the Labels map).
|
||||
// See also the CounterVec example.
|
||||
func (m *MetricVec) DeleteLabelValues(lvs ...string) bool {
|
||||
lvs = constrainLabelValues(m.desc, lvs, m.curry)
|
||||
h, err := m.hashLabelValues(lvs)
|
||||
if err != nil {
|
||||
return false
|
||||
|
|
@ -91,6 +92,7 @@ func (m *MetricVec) DeleteLabelValues(lvs ...string) bool {
|
|||
// This method is used for the same purpose as DeleteLabelValues(...string). See
|
||||
// there for pros and cons of the two methods.
|
||||
func (m *MetricVec) Delete(labels Labels) bool {
|
||||
labels = constrainLabels(m.desc, labels)
|
||||
h, err := m.hashLabels(labels)
|
||||
if err != nil {
|
||||
return false
|
||||
|
|
@ -106,6 +108,7 @@ func (m *MetricVec) Delete(labels Labels) bool {
|
|||
// Note that curried labels will never be matched if deleting from the curried vector.
|
||||
// To match curried labels with DeletePartialMatch, it must be called on the base vector.
|
||||
func (m *MetricVec) DeletePartialMatch(labels Labels) int {
|
||||
labels = constrainLabels(m.desc, labels)
|
||||
return m.metricMap.deleteByLabels(labels, m.curry)
|
||||
}
|
||||
|
||||
|
|
@ -145,10 +148,10 @@ func (m *MetricVec) CurryWith(labels Labels) (*MetricVec, error) {
|
|||
iCurry int
|
||||
)
|
||||
for i, label := range m.desc.variableLabels {
|
||||
val, ok := labels[label]
|
||||
val, ok := labels[label.Name]
|
||||
if iCurry < len(oldCurry) && oldCurry[iCurry].index == i {
|
||||
if ok {
|
||||
return nil, fmt.Errorf("label name %q is already curried", label)
|
||||
return nil, fmt.Errorf("label name %q is already curried", label.Name)
|
||||
}
|
||||
newCurry = append(newCurry, oldCurry[iCurry])
|
||||
iCurry++
|
||||
|
|
@ -156,7 +159,7 @@ func (m *MetricVec) CurryWith(labels Labels) (*MetricVec, error) {
|
|||
if !ok {
|
||||
continue // Label stays uncurried.
|
||||
}
|
||||
newCurry = append(newCurry, curriedLabelValue{i, val})
|
||||
newCurry = append(newCurry, curriedLabelValue{i, label.Constrain(val)})
|
||||
}
|
||||
}
|
||||
if l := len(oldCurry) + len(labels) - len(newCurry); l > 0 {
|
||||
|
|
@ -199,6 +202,7 @@ func (m *MetricVec) CurryWith(labels Labels) (*MetricVec, error) {
|
|||
// a wrapper around MetricVec, implementing a vector for a specific Metric
|
||||
// implementation, for example GaugeVec.
|
||||
func (m *MetricVec) GetMetricWithLabelValues(lvs ...string) (Metric, error) {
|
||||
lvs = constrainLabelValues(m.desc, lvs, m.curry)
|
||||
h, err := m.hashLabelValues(lvs)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
|
|
@ -224,6 +228,7 @@ func (m *MetricVec) GetMetricWithLabelValues(lvs ...string) (Metric, error) {
|
|||
// around MetricVec, implementing a vector for a specific Metric implementation,
|
||||
// for example GaugeVec.
|
||||
func (m *MetricVec) GetMetricWith(labels Labels) (Metric, error) {
|
||||
labels = constrainLabels(m.desc, labels)
|
||||
h, err := m.hashLabels(labels)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
|
|
@ -266,16 +271,16 @@ func (m *MetricVec) hashLabels(labels Labels) (uint64, error) {
|
|||
iCurry int
|
||||
)
|
||||
for i, label := range m.desc.variableLabels {
|
||||
val, ok := labels[label]
|
||||
val, ok := labels[label.Name]
|
||||
if iCurry < len(curry) && curry[iCurry].index == i {
|
||||
if ok {
|
||||
return 0, fmt.Errorf("label name %q is already curried", label)
|
||||
return 0, fmt.Errorf("label name %q is already curried", label.Name)
|
||||
}
|
||||
h = m.hashAdd(h, curry[iCurry].value)
|
||||
iCurry++
|
||||
} else {
|
||||
if !ok {
|
||||
return 0, fmt.Errorf("label name %q missing in label map", label)
|
||||
return 0, fmt.Errorf("label name %q missing in label map", label.Name)
|
||||
}
|
||||
h = m.hashAdd(h, val)
|
||||
}
|
||||
|
|
@ -453,7 +458,7 @@ func valueMatchesVariableOrCurriedValue(targetValue string, index int, values []
|
|||
func matchPartialLabels(desc *Desc, values []string, labels Labels, curry []curriedLabelValue) bool {
|
||||
for l, v := range labels {
|
||||
// Check if the target label exists in our metrics and get the index.
|
||||
varLabelIndex, validLabel := indexOf(l, desc.variableLabels)
|
||||
varLabelIndex, validLabel := indexOf(l, desc.variableLabels.labelNames())
|
||||
if validLabel {
|
||||
// Check the value of that label against the target value.
|
||||
// We don't consider curried values in partial matches.
|
||||
|
|
@ -605,7 +610,7 @@ func matchLabels(desc *Desc, values []string, labels Labels, curry []curriedLabe
|
|||
iCurry++
|
||||
continue
|
||||
}
|
||||
if values[i] != labels[k] {
|
||||
if values[i] != labels[k.Name] {
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
|
@ -621,7 +626,7 @@ func extractLabelValues(desc *Desc, labels Labels, curry []curriedLabelValue) []
|
|||
iCurry++
|
||||
continue
|
||||
}
|
||||
labelValues[i] = labels[k]
|
||||
labelValues[i] = labels[k.Name]
|
||||
}
|
||||
return labelValues
|
||||
}
|
||||
|
|
@ -640,3 +645,34 @@ func inlineLabelValues(lvs []string, curry []curriedLabelValue) []string {
|
|||
}
|
||||
return labelValues
|
||||
}
|
||||
|
||||
func constrainLabels(desc *Desc, labels Labels) Labels {
|
||||
constrainedValues := make(Labels, len(labels))
|
||||
for l, v := range labels {
|
||||
if i, ok := indexOf(l, desc.variableLabels.labelNames()); ok {
|
||||
constrainedValues[l] = desc.variableLabels[i].Constrain(v)
|
||||
continue
|
||||
}
|
||||
constrainedValues[l] = v
|
||||
}
|
||||
return constrainedValues
|
||||
}
|
||||
|
||||
func constrainLabelValues(desc *Desc, lvs []string, curry []curriedLabelValue) []string {
|
||||
constrainedValues := make([]string, len(lvs))
|
||||
var iCurry, iLVs int
|
||||
for i := 0; i < len(lvs)+len(curry); i++ {
|
||||
if iCurry < len(curry) && curry[iCurry].index == i {
|
||||
iCurry++
|
||||
continue
|
||||
}
|
||||
|
||||
if i < len(desc.variableLabels) {
|
||||
constrainedValues[iLVs] = desc.variableLabels[i].Constrain(lvs[iLVs])
|
||||
} else {
|
||||
constrainedValues[iLVs] = lvs[iLVs]
|
||||
}
|
||||
iLVs++
|
||||
}
|
||||
return constrainedValues
|
||||
}
|
||||
|
|
|
|||
23
vendor/github.com/prometheus/client_golang/prometheus/vnext.go
generated
vendored
Normal file
23
vendor/github.com/prometheus/client_golang/prometheus/vnext.go
generated
vendored
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
// Copyright 2022 The Prometheus Authors
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package prometheus
|
||||
|
||||
type v2 struct{}
|
||||
|
||||
// V2 is a struct that can be referenced to access experimental API that might
|
||||
// be present in v2 of client golang someday. It offers extended functionality
|
||||
// of v1 with slightly changed API. It is acceptable to use some pieces from v1
|
||||
// and e.g `prometheus.NewGauge` and some from v2 e.g. `prometheus.V2.NewDesc`
|
||||
// in the same codebase.
|
||||
var V2 = v2{}
|
||||
8
vendor/github.com/prometheus/client_golang/prometheus/wrap.go
generated
vendored
8
vendor/github.com/prometheus/client_golang/prometheus/wrap.go
generated
vendored
|
|
@ -17,12 +17,10 @@ import (
|
|||
"fmt"
|
||||
"sort"
|
||||
|
||||
//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
|
||||
"github.com/golang/protobuf/proto"
|
||||
"github.com/prometheus/client_golang/prometheus/internal"
|
||||
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
|
||||
"github.com/prometheus/client_golang/prometheus/internal"
|
||||
"google.golang.org/protobuf/proto"
|
||||
)
|
||||
|
||||
// WrapRegistererWith returns a Registerer wrapping the provided
|
||||
|
|
@ -206,7 +204,7 @@ func wrapDesc(desc *Desc, prefix string, labels Labels) *Desc {
|
|||
constLabels[ln] = lv
|
||||
}
|
||||
// NewDesc will do remaining validations.
|
||||
newDesc := NewDesc(prefix+desc.fqName, desc.help, desc.variableLabels, constLabels)
|
||||
newDesc := V2.NewDesc(prefix+desc.fqName, desc.help, desc.variableLabels, constLabels)
|
||||
// Propagate errors if there was any. This will override any errer
|
||||
// created by NewDesc above, i.e. earlier errors get precedence.
|
||||
if desc.err != nil {
|
||||
|
|
|
|||
1490
vendor/github.com/prometheus/client_model/go/metrics.pb.go
generated
vendored
1490
vendor/github.com/prometheus/client_model/go/metrics.pb.go
generated
vendored
File diff suppressed because it is too large
Load diff
5
vendor/github.com/prometheus/common/expfmt/decode.go
generated
vendored
5
vendor/github.com/prometheus/common/expfmt/decode.go
generated
vendored
|
|
@ -132,7 +132,10 @@ func (d *textDecoder) Decode(v *dto.MetricFamily) error {
|
|||
}
|
||||
// Pick off one MetricFamily per Decode until there's nothing left.
|
||||
for key, fam := range d.fams {
|
||||
*v = *fam
|
||||
v.Name = fam.Name
|
||||
v.Help = fam.Help
|
||||
v.Type = fam.Type
|
||||
v.Metric = fam.Metric
|
||||
delete(d.fams, key)
|
||||
return nil
|
||||
}
|
||||
|
|
|
|||
13
vendor/github.com/prometheus/common/expfmt/encode.go
generated
vendored
13
vendor/github.com/prometheus/common/expfmt/encode.go
generated
vendored
|
|
@ -18,9 +18,9 @@ import (
|
|||
"io"
|
||||
"net/http"
|
||||
|
||||
"github.com/golang/protobuf/proto" //nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
|
||||
"github.com/matttproud/golang_protobuf_extensions/pbutil"
|
||||
"github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg"
|
||||
"google.golang.org/protobuf/encoding/prototext"
|
||||
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
)
|
||||
|
|
@ -99,8 +99,11 @@ func NegotiateIncludingOpenMetrics(h http.Header) Format {
|
|||
if ac.Type == "text" && ac.SubType == "plain" && (ver == TextVersion || ver == "") {
|
||||
return FmtText
|
||||
}
|
||||
if ac.Type+"/"+ac.SubType == OpenMetricsType && (ver == OpenMetricsVersion || ver == "") {
|
||||
return FmtOpenMetrics
|
||||
if ac.Type+"/"+ac.SubType == OpenMetricsType && (ver == OpenMetricsVersion_0_0_1 || ver == OpenMetricsVersion_1_0_0 || ver == "") {
|
||||
if ver == OpenMetricsVersion_1_0_0 {
|
||||
return FmtOpenMetrics_1_0_0
|
||||
}
|
||||
return FmtOpenMetrics_0_0_1
|
||||
}
|
||||
}
|
||||
return FmtText
|
||||
|
|
@ -133,7 +136,7 @@ func NewEncoder(w io.Writer, format Format) Encoder {
|
|||
case FmtProtoText:
|
||||
return encoderCloser{
|
||||
encode: func(v *dto.MetricFamily) error {
|
||||
_, err := fmt.Fprintln(w, proto.MarshalTextString(v))
|
||||
_, err := fmt.Fprintln(w, prototext.Format(v))
|
||||
return err
|
||||
},
|
||||
close: func() error { return nil },
|
||||
|
|
@ -146,7 +149,7 @@ func NewEncoder(w io.Writer, format Format) Encoder {
|
|||
},
|
||||
close: func() error { return nil },
|
||||
}
|
||||
case FmtOpenMetrics:
|
||||
case FmtOpenMetrics_0_0_1, FmtOpenMetrics_1_0_0:
|
||||
return encoderCloser{
|
||||
encode: func(v *dto.MetricFamily) error {
|
||||
_, err := MetricFamilyToOpenMetrics(w, v)
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue