Package: google.golang.org/grpc/credentials/alts/internal/conn

package conn Import Path google.golang.org/grpc/credentials/alts/internal/conn (on go.dev) Dependency Relation imports 12 packages, and imported by one package Involved Source Files aeadrekey.go aes128gcm.go aes128gcmrekey.go common.go counter.go d➜ record.go Package conn contains an implementation of a secure channel created by gRPC handshakers. utils.go Package-Level Type Names (total 8, in which 4 are exported) /* sort exporteds by: alphabet | popularity */ type ALTSRecordCrypto (interface) ALTSRecordCrypto is the interface for gRPC ALTS record protocol. Methods (total 3, all are exported) ( T) Decrypt(dst, ciphertext []byte) ([]byte, error) Decrypt decrypts ciphertext and verify the tag (if any). dst and ciphertext may alias exactly or not at all. To reuse ciphertext's storage for the decrypted output, use ciphertext[:0] as dst. ( T) Encrypt(dst, plaintext []byte) ([]byte, error) Encrypt encrypts the plaintext and computes the tag (if any) of dst and plaintext. dst and plaintext may fully overlap or not at all. ( T) EncryptionOverhead() int EncryptionOverhead returns the tag size (if any) in bytes. Implemented By (at least 2, neither is exported) /* 2+ unexporteds ... *//* 2+ unexporteds: */ *aes128gcm *aes128gcmRekey As Outputs Of (at least 2, both are exported) func NewAES128GCM(side core.Side, key []byte) (ALTSRecordCrypto, error) func NewAES128GCMRekey(side core.Side, key []byte) (ALTSRecordCrypto, error) type ALTSRecordFunc (func) ALTSRecordFunc is a function type for factory functions that create ALTSRecordCrypto instances. As Inputs Of (at least one exported) func RegisterProtocol(protocol string, f ALTSRecordFunc) error type Counter (struct) Counter is a 96-bit, little-endian counter. Fields (total 3, none are exported) /* 3 unexporteds ... *//* 3 unexporteds: */ invalid bool overflowLen int value [12]byte Methods (total 2, both are exported) (*T) Inc() Inc increments the counter and checks for overflow. (*T) Value() ([]byte, error) Value returns the current value of the counter as a byte slice. As Outputs Of (at least 3, all are exported) func CounterFromValue(value []byte, overflowLen int) (c Counter) func NewInCounter(s core.Side, overflowLen int) (c Counter) func NewOutCounter(s core.Side, overflowLen int) (c Counter) type KeySizeError int (basic type) KeySizeError signals that the given key does not have the correct size. Methods (only one, which is exported) ( T) Error() string Implements (at least one exported) T : error /* 4 unexporteds ... *//* 4 unexporteds: */ type aes128gcm (struct) aes128gcm is the struct that holds necessary information for ALTS record. The counter value is NOT included in the payload during the encryption and decryption operations. Fields (total 3, none are exported) /* 3 unexporteds ... *//* 3 unexporteds: */ aead cipher.AEAD inCounter Counter inCounter is used in ALTS record to check that incoming counters are as expected, since ALTS record guarantees that messages are unwrapped in the same order that the peer wrapped them. outCounter Counter Methods (total 3, all are exported) (*T) Decrypt(dst, ciphertext []byte) ([]byte, error) (*T) Encrypt(dst, plaintext []byte) ([]byte, error) Encrypt is the encryption function. dst can contain bytes at the beginning of the ciphertext that will not be encrypted but will be authenticated. If dst has enough capacity to hold these bytes, the ciphertext and the tag, no allocation and copy operations will be performed. dst and plaintext do not overlap. (*T) EncryptionOverhead() int Implements (at least one exported) *T : ALTSRecordCrypto type aes128gcmRekey (struct) aes128gcmRekey is the struct that holds necessary information for ALTS record. The counter value is NOT included in the payload during the encryption and decryption operations. Fields (total 4, none are exported) /* 4 unexporteds ... *//* 4 unexporteds: */ inAEAD cipher.AEAD inCounter Counter inCounter is used in ALTS record to check that incoming counters are as expected, since ALTS record guarantees that messages are unwrapped in the same order that the peer wrapped them. outAEAD cipher.AEAD outCounter Counter Methods (total 3, all are exported) (*T) Decrypt(dst, ciphertext []byte) ([]byte, error) (*T) Encrypt(dst, plaintext []byte) ([]byte, error) Encrypt is the encryption function. dst can contain bytes at the beginning of the ciphertext that will not be encrypted but will be authenticated. If dst has enough capacity to hold these bytes, the ciphertext and the tag, no allocation and copy operations will be performed. dst and plaintext do not overlap. (*T) EncryptionOverhead() int Implements (at least one exported) *T : ALTSRecordCrypto type conn (struct) conn represents a secured connection. It implements the net.Conn interface. Fields (total 8, in which 1 are exported) Conn net.Conn /* 7 unexporteds ... *//* 7 unexporteds: */ buf []byte buf holds data that has been read from the connection and decrypted, but has not yet been returned by Read. crypto ALTSRecordCrypto nextFrame []byte nextFrame stores the next frame (in protected buffer) info. overhead int overhead is the calculated overhead of each frame. payloadLengthLimit int protected []byte protected holds data read from the network but have not yet been decrypted. This data might not compose a complete frame. writeBuf []byte writeBuf is a buffer used to contain encrypted frames before being written to the network. Methods (total 8, all are exported) ( T) Close() error Close closes the connection. Any blocked Read or Write operations will be unblocked and return errors. ( T) LocalAddr() net.Addr LocalAddr returns the local network address. (*T) Read(b []byte) (n int, err error) Read reads and decrypts a frame from the underlying connection, and copies the decrypted payload into b. If the size of the payload is greater than len(b), Read retains the remaining bytes in an internal buffer, and subsequent calls to Read will read from this buffer until it is exhausted. ( T) RemoteAddr() net.Addr RemoteAddr returns the remote network address. ( T) SetDeadline(t time.Time) error SetDeadline sets the read and write deadlines associated with the connection. It is equivalent to calling both SetReadDeadline and SetWriteDeadline. A deadline is an absolute time after which I/O operations fail instead of blocking. The deadline applies to all future and pending I/O, not just the immediately following call to Read or Write. After a deadline has been exceeded, the connection can be refreshed by setting a deadline in the future. If the deadline is exceeded a call to Read or Write or to other I/O methods will return an error that wraps os.ErrDeadlineExceeded. This can be tested using errors.Is(err, os.ErrDeadlineExceeded). The error's Timeout method will return true, but note that there are other possible errors for which the Timeout method will return true even if the deadline has not been exceeded. An idle timeout can be implemented by repeatedly extending the deadline after successful Read or Write calls. A zero value for t means I/O operations will not time out. ( T) SetReadDeadline(t time.Time) error SetReadDeadline sets the deadline for future Read calls and any currently-blocked Read call. A zero value for t means Read will not time out. ( T) SetWriteDeadline(t time.Time) error SetWriteDeadline sets the deadline for future Write calls and any currently-blocked Write call. Even if write times out, it may return n > 0, indicating that some of the data was successfully written. A zero value for t means Write will not time out. (*T) Write(b []byte) (n int, err error) Write encrypts, frames, and writes bytes from b to the underlying connection. Implements (at least 11, all are exported) *T : github.com/go-git/go-git/v5/plumbing/protocol/packp/sideband.Progress *T : github.com/jbenet/go-context/io.Reader *T : github.com/jbenet/go-context/io.Writer T : io.Closer *T : io.ReadCloser *T : io.Reader *T : io.ReadWriteCloser *T : io.ReadWriter *T : io.WriteCloser *T : io.Writer *T : net.Conn type rekeyAEAD (struct) rekeyAEAD holds the necessary information for an AEAD based on AES-GCM that performs nonce-based key derivation and XORs the nonce with a random mask. Fields (total 5, none are exported) /* 5 unexporteds ... *//* 5 unexporteds: */ gcmAEAD cipher.AEAD kdfCounter []byte kdfKey []byte nonceBuf []byte nonceMask []byte Methods (total 5, in which 4 are exported) (*T) NonceSize() int NonceSize returns the required nonce size. (*T) Open(dst, nonce, ciphertext, additionalData []byte) ([]byte, error) Open rekeys if nonce[2:8] is different than in the last call, masks the nonce, and calls Open for aes128gcm. (*T) Overhead() int Overhead returns the ciphertext overhead. (*T) Seal(dst, nonce, plaintext, additionalData []byte) []byte Seal rekeys if nonce[2:8] is different than in the last call, masks the nonce, and calls Seal for aes128gcm. /* one unexported ... *//* one unexported: */ (*T) rekeyIfRequired(nonce []byte) error rekeyIfRequired creates a new aes128gcm AEAD if the existing AEAD is nil or cannot be used with given nonce. Implements (at least one exported) *T : crypto/cipher.AEAD As Outputs Of (at least one unexported) /* at least one unexported ... *//* at least one unexported: */ func newRekeyAEAD(key []byte) (*rekeyAEAD, error) Package-Level Functions (total 14, in which 10 are exported) func CounterFromValue(value []byte, overflowLen int) (c Counter) CounterFromValue creates a new counter given an initial value. func CounterSide(c []byte) core.Side CounterSide returns the connection side (client/server) a sequence counter is associated with. func NewAES128GCM(side core.Side, key []byte) (ALTSRecordCrypto, error) NewAES128GCM creates an instance that uses aes128gcm for ALTS record. func NewAES128GCMRekey(side core.Side, key []byte) (ALTSRecordCrypto, error) NewAES128GCMRekey creates an instance that uses aes128gcm with rekeying for ALTS record. The key argument should be 44 bytes, the first 32 bytes are used as a key for HKDF-expand and the remainining 12 bytes are used as a random mask for the counter. func NewConn(c net.Conn, side core.Side, recordProtocol string, key []byte, protected []byte) (net.Conn, error) NewConn creates a new secure channel instance given the other party role and handshaking result. func NewInCounter(s core.Side, overflowLen int) (c Counter) NewInCounter returns an incoming counter initialized to the starting sequence number for the client/server side of a connection. This is used in ALTS record to check that incoming counters are as expected, since ALTS record guarantees that messages are unwrapped in the same order that the peer wrapped them. func NewOutCounter(s core.Side, overflowLen int) (c Counter) NewOutCounter returns an outgoing counter initialized to the starting sequence number for the client/server side of a connection. func ParseFramedMsg(b []byte, maxLen uint32) ([]byte, []byte, error) ParseFramedMsg parse the provided buffer and returns a frame of the format msgLength+msg and any remaining bytes in that buffer. func RegisterProtocol(protocol string, f ALTSRecordFunc) error RegisterProtocol register a ALTS record encryption protocol. func SliceForAppend(in []byte, n int) (head, tail []byte) SliceForAppend takes a slice and a requested number of bytes. It returns a slice with the contents of the given slice followed by that many bytes and a second slice that aliases into it and contains only the extra bytes. If the original slice has sufficient capacity then no allocation is performed. /* 4 unexporteds ... *//* 4 unexporteds: */ func hkdfExpand(key, info []byte) []byte hkdfExpand computes the first 16 bytes of the HKDF-expand function defined in RFC5869. func maskNonce(dst, nonce, mask []byte) maskNonce XORs the given nonce with the mask and stores the result in dst. func min(a, b int) int func newRekeyAEAD(key []byte) (*rekeyAEAD, error) newRekeyAEAD creates a new instance of aes128gcm with rekeying. The key argument should be 44 bytes, the first 32 bytes are used as a key for HKDF-expand and the remainining 12 bytes are used as a random mask for the counter. Package-Level Variables (total 3, in which 1 are exported) var ErrAuth error ErrAuth occurs on authentication failure. /* 2 unexporteds ... *//* 2 unexporteds: */ var errInvalidCounter error var protocols map[string]ALTSRecordFunc Package-Level Constants (total 17, in which 2 are exported) const GcmTagSize = 16 GcmTagSize is the GCM tag size is the difference in length between plaintext and ciphertext. From crypto/cipher/gcm.go in Go crypto library. const MsgLenFieldSize = 4 MsgLenFieldSize is the byte size of the frame length field of a framed message. /* 15 unexporteds ... *//* 15 unexporteds: */ const aeadKeyLen = 16 const altsRecordDefaultLength = 4096 // 4KiB The default bytes size of a ALTS record message. const altsRecordLengthLimit = 1048576 // 1 MiB The bytes size limit for a ALTS record message. const altsRecordMsgType uint32 = 6 Message type value included in ALTS record framing. const altsWriteBufferInitialSize = 32768 // 32KiB The initial write buffer size. const altsWriteBufferMaxSize = 524288 // 512KiB The maximum write buffer size. This *must* be multiple of altsRecordDefaultLength. const counterLen = 12 const kdfCounterLen = 6 const kdfCounterOffset = 2 const kdfKeyLen = 32 const msgTypeFieldSize = 4 The byte size of the message type field of a framed message. const nonceLen = 12 const overflowLenAES128GCM = 5 Overflow length n in bytes, never encrypt more than 2^(n*8) frames (in each direction). const overflowLenAES128GCMRekey = 8 Overflow length n in bytes, never encrypt more than 2^(n*8) frames (in each direction). const sizeUint64 = 8

The pages are generated with Golds v0.3.2-preview. (GOOS=darwin GOARCH=amd64) Golds is a Go 101 project developed by Tapir Liu. PR and bug reports are welcome and can be submitted to the issue list. Please follow @Go100and1 (reachable from the left QR code) to get the latest news of Golds.