[mtls] make some types and functions public

Make public the necessary functions and types to allow other packages to register identity and roots providers.

- Types `CertificatePrimitive` and `RootsPrimitive`
- Driver registration functions: `RegisterIdentityDriver`, `RegisterRootDriver`
- `newDialContextFunc` -> `MakeDialContextFunc`
- `newTlsCertificate` -> `MakeTlsCertificate`

diff --git a/mtls/identity.go b/mtls/identity.go
index 2f527d483f862321a284243154e171602146bd8f..4631a2b75566d1e8ac870352acf01cdfe8d64ae5 100644 (file)
--- a/mtls/identity.go
+++ b/mtls/identity.go
@@ -66,7 +66,7 @@ type identityDriver struct {
 
 var identityDrivers []*identityDriver
 
-func registerIdentityDriver(name string, load identityLoaderFunc) {
+func RegisterIdentityDriver(name string, load identityLoaderFunc) {
        driver := &identityDriver{
                name: name,
                load: load,
@@ -131,7 +131,7 @@ func (id *substantiatedIdentity) IsValid() bool {
        return identityIsValid(id.CertificateProvider)
 }
 
-func identityIsValid(id certificatePrimitive) bool {
+func identityIsValid(id CertificatePrimitive) bool {
        cert, err := id.LeafCertificate()
        if err != nil {
                return false

diff --git a/mtls/provider_anonymous.go b/mtls/provider_anonymous.go
index 0a0ea57e2832350b2a6b5d8cca04d5378e3cbcc1..20eea61d0c1097a4892b348b5a8d40d9dc6bb429 100644 (file)
--- a/mtls/provider_anonymous.go
+++ b/mtls/provider_anonymous.go
@@ -44,10 +44,10 @@ func (a *anonymousIdentity) PrivateKey() (crypto.PrivateKey, error) {
 }
 
 func (a *anonymousIdentity) NewDialContextFunc() DialContextFunc {
-       return newDialContextFunc(a)
+       return MakeDialContextFunc(a)
 }
 
-func (a *anonymousIdentity) newTlsCertificate() (*tls.Certificate, error) {
+func (a *anonymousIdentity) NewTlsCertificate() (*tls.Certificate, error) {
        return nil, nil
 }
 

diff --git a/mtls/provider_file.go b/mtls/provider_file.go
index 3b2952d3d9c6ca9431bd4826a55332ebb616cb9c..4767051e9182e9c372c76c1310917ae59931532f 100644 (file)
--- a/mtls/provider_file.go
+++ b/mtls/provider_file.go
@@ -471,19 +471,19 @@ func (c *FileBackedCertificate) TlsConfig(ctx context.Context) (*tls.Config, err
 }
 
 func (c *FileBackedCertificate) GetCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-       return c.newTlsCertificate()
+       return c.NewTlsCertificate()
 }
 
 func (c *FileBackedCertificate) GetClientCertificate(reqInfo *tls.CertificateRequestInfo) (*tls.Certificate, error) {
-       return c.newTlsCertificate()
+       return c.NewTlsCertificate()
 }
 
-func (c *FileBackedCertificate) newTlsCertificate() (*tls.Certificate, error) {
-       return newTlsCertificate(c)
+func (c *FileBackedCertificate) NewTlsCertificate() (*tls.Certificate, error) {
+       return MakeTlsCertificate(c)
 }
 
 func (c *FileBackedCertificate) NewDialContextFunc() DialContextFunc {
-       return newDialContextFunc(c)
+       return MakeDialContextFunc(c)
 }
 
 func (c *FileBackedCertificate) notifyEvent(filePath string, op fsnotify.Op) {
@@ -578,22 +578,22 @@ func init() {
        flag.StringVar(&sslCertsBaseDir, "tls.certs-dir", sslCertsBaseDir, "directory to look under for public-site SSL certificates (NOT mTLS certs)")
        flag.Func("mtls.certs-dir", "additional directory to search for mTLS certificates", appendMtlsCertificateDir)
 
-       registerIdentityDriver("file_service_global", func(serviceName string) (CertificateProvider, error) {
+       RegisterIdentityDriver("file_service_global", func(serviceName string) (CertificateProvider, error) {
                return LoadServiceIdentityFromFilesystem(serviceName)
        })
-       registerIdentityDriver("file_service_csi_spiffe", func(serviceName string) (CertificateProvider, error) {
+       RegisterIdentityDriver("file_service_csi_spiffe", func(serviceName string) (CertificateProvider, error) {
                return LoadServiceIdentityFromKubernetesCSIDriverSPIFFE(serviceName)
        })
-       registerIdentityDriver("file_user_home", func(_ string) (CertificateProvider, error) {
+       RegisterIdentityDriver("file_user_home", func(_ string) (CertificateProvider, error) {
                return LoadUserIdentityFromFilesystem()
        })
-       registerRootDriver("file_etc_mtls", func() (rootsPrimitive, error) {
+       RegisterRootDriver("file_etc_mtls", func() (RootsPrimitive, error) {
                return defaultFileBackedRoots, nil
        })
-       registerRootDriver("file_csi_spiffe", func() (rootsPrimitive, error) {
+       RegisterRootDriver("file_csi_spiffe", func() (RootsPrimitive, error) {
                return csiSpiffeRoots, nil
        })
-       registerRootDriver("file_csi_spiffe_altname", func() (rootsPrimitive, error) {
+       RegisterRootDriver("file_csi_spiffe_altname", func() (RootsPrimitive, error) {
                return csiSpiffeRootsAltName, nil
        })
 }

diff --git a/mtls/provider_interface.go b/mtls/provider_interface.go
index f42f122b5d96749f5ab9e9c9a78589f7360169bc..031909f0928eaa3547b437bec5d8f68bcbb6c793 100644 (file)
--- a/mtls/provider_interface.go
+++ b/mtls/provider_interface.go
@@ -12,25 +12,25 @@ import (
 type DialContextFunc func(context.Context, string, string) (net.Conn, error)
 
 type CertificateProvider interface {
-       certificatePrimitive
+       CertificatePrimitive
 
        TlsConfig(context.Context) (*tls.Config, error)
        NewDialContextFunc() DialContextFunc
 }
 
-type rootsPrimitive interface {
+type RootsPrimitive interface {
        RootCertificates() ([]*x509.Certificate, error)
        IntermediateCertificates() ([]*x509.Certificate, error)
 }
 
-type certificatePrimitive interface {
+type CertificatePrimitive interface {
        RootCertificate() (*x509.Certificate, error)
        IntermediateCertificates() ([]*x509.Certificate, error)
 
        LeafCertificate() (*x509.Certificate, error)
        PrivateKey() (crypto.PrivateKey, error)
 
-       newTlsCertificate() (*tls.Certificate, error)
+       NewTlsCertificate() (*tls.Certificate, error)
 }
 
 type inaccessibleCertificate struct{}
@@ -53,7 +53,7 @@ func (c *inaccessibleCertificate) PrivateKey() (crypto.PrivateKey, error) {
        return nil, ErrCertificateInaccessible
 }
 
-func (c *inaccessibleCertificate) newTlsCertificate() (*tls.Certificate, error) {
+func (c *inaccessibleCertificate) NewTlsCertificate() (*tls.Certificate, error) {
        return nil, ErrCertificateInaccessible
 }
 
@@ -62,5 +62,5 @@ func (c *inaccessibleCertificate) TlsConfig(ctx context.Context) (*tls.Config, e
 }
 
 func (c *inaccessibleCertificate) NewDialContextFunc() DialContextFunc {
-       return newDialContextFunc(c)
+       return MakeDialContextFunc(c)
 }

diff --git a/mtls/provider_keychain_macos.go b/mtls/provider_keychain_macos.go
index 0d174e141fb87f26a87034dfd67c2e6bb13c9f29..fcc0129596e80147f76115fc990ceac3a0bd7ed6 100644 (file)
--- a/mtls/provider_keychain_macos.go
+++ b/mtls/provider_keychain_macos.go
@@ -27,7 +27,7 @@ import (
 )
 
 type macosKeychainCertificate struct {
-       certificatePrimitive
+       CertificatePrimitive
 
        ints []*x509.Certificate
        root *x509.Certificate
@@ -118,12 +118,12 @@ func (c *macosKeychainCertificate) PrivateKey() (crypto.PrivateKey, error) {
        return c.pkey, nil
 }
 
-func (c *macosKeychainCertificate) newTlsCertificate() (*tls.Certificate, error) {
-       return newTlsCertificate(c)
+func (c *macosKeychainCertificate) NewTlsCertificate() (*tls.Certificate, error) {
+       return MakeTlsCertificate(c)
 }
 
 func (c *macosKeychainCertificate) NewDialContextFunc() DialContextFunc {
-       return newDialContextFunc(c)
+       return MakeDialContextFunc(c)
 }
 
 func (c *macosKeychainCertificate) TlsConfig(ctx context.Context) (*tls.Config, error) {
@@ -136,11 +136,11 @@ func (c *macosKeychainCertificate) TlsConfig(ctx context.Context) (*tls.Config,
 }
 
 func (c *macosKeychainCertificate) GetCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-       return c.newTlsCertificate()
+       return c.NewTlsCertificate()
 }
 
 func (c *macosKeychainCertificate) GetClientCertificate(reqInfo *tls.CertificateRequestInfo) (*tls.Certificate, error) {
-       return c.newTlsCertificate()
+       return c.NewTlsCertificate()
 }
 
 func getMtlsIntermediatesFromMacKeychain() ([]*x509.Certificate, error) {
@@ -448,9 +448,9 @@ func (kcr *macosKeychainRoots) IntermediateCertificates() ([]*x509.Certificate,
 func init() {
        kcLogger = log.WithPrefix("mtls.macOSKeychain")
 
-       registerIdentityDriver("macos_keychain", NewCertificateFromMacKeychain)
+       RegisterIdentityDriver("macos_keychain", NewCertificateFromMacKeychain)
 
-       registerRootDriver("macos_keychain", func() (rootsPrimitive, error) {
+       RegisterRootDriver("macos_keychain", func() (RootsPrimitive, error) {
                return &macosKeychainRoots{}, nil
        })
 }

diff --git a/mtls/provider_shared.go b/mtls/provider_shared.go
index 183e017e018fd10a61115e22e37914dc242ab90b..79da91ce0d76f868a8d2cabea96bd2d27fd4e3b2 100644 (file)
--- a/mtls/provider_shared.go
+++ b/mtls/provider_shared.go
@@ -6,7 +6,7 @@ import (
        "net"
 )
 
-func newTlsCertificate(id certificatePrimitive) (*tls.Certificate, error) {
+func MakeTlsCertificate(id CertificatePrimitive) (*tls.Certificate, error) {
        leafCertificate, err := id.LeafCertificate()
        if err != nil {
                return nil, err
@@ -32,7 +32,7 @@ func newTlsCertificate(id certificatePrimitive) (*tls.Certificate, error) {
        }, nil
 }
 
-func newDialContextFunc(id CertificateProvider) DialContextFunc {
+func MakeDialContextFunc(id CertificateProvider) DialContextFunc {
        dcf := func(ctx context.Context, network, addr string) (net.Conn, error) {
                c, err := id.TlsConfig(ctx)
                if err != nil {

diff --git a/mtls/provider_tpm2_pkcs11.go b/mtls/provider_tpm2_pkcs11.go
index aafd50b6b8ec83591bd3302b934e705ed33d6ecd..5f74a61ddf899f179426a8dc204116c59d98291c 100644 (file)
--- a/mtls/provider_tpm2_pkcs11.go
+++ b/mtls/provider_tpm2_pkcs11.go
@@ -17,7 +17,7 @@ import (
 var tpmLogger = log.WithPrefix("mtls.provider_tpm2_pkcs11")
 
 type TPMBackedCertificate struct {
-       certificatePrimitive
+       CertificatePrimitive
 
        p11 *p11
 }
@@ -91,11 +91,11 @@ func (c *TPMBackedCertificate) RootCertificate() (*x509.Certificate, error) {
 }
 
 func (c *TPMBackedCertificate) getCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-       return newTlsCertificate(c)
+       return MakeTlsCertificate(c)
 }
 
 func (c *TPMBackedCertificate) getClientCertificate(reqInfo *tls.CertificateRequestInfo) (*tls.Certificate, error) {
-       return newTlsCertificate(c)
+       return MakeTlsCertificate(c)
 }
 
 func (c *TPMBackedCertificate) TlsConfig(ctx context.Context) (*tls.Config, error) {
@@ -108,11 +108,11 @@ func (c *TPMBackedCertificate) TlsConfig(ctx context.Context) (*tls.Config, erro
 }
 
 func (c *TPMBackedCertificate) NewDialContextFunc() DialContextFunc {
-       return newDialContextFunc(c)
+       return MakeDialContextFunc(c)
 }
 
 func init() {
-       registerIdentityDriver("tpm2-pkcs11", func(_ string) (CertificateProvider, error) {
+       RegisterIdentityDriver("tpm2-pkcs11", func(_ string) (CertificateProvider, error) {
                return NewTPMBackedCertificate()
        })
 }

diff --git a/mtls/verify_roots.go b/mtls/verify_roots.go
index 37f4e2837b29740fe91789aa23daf8cade6cddcb..b52159f62812f2d2ce85fef8a110612395d49b8d 100644 (file)
--- a/mtls/verify_roots.go
+++ b/mtls/verify_roots.go
@@ -14,10 +14,10 @@ type tlsVerifyPeerCertificatesFunc = func(rawCerts [][]byte, verifiedChains [][]
 
 type rootDriver struct {
        name string
-       load func() (rootsPrimitive, error)
+       load func() (RootsPrimitive, error)
 }
 
-func registerRootDriver(name string, load func() (rootsPrimitive, error)) {
+func RegisterRootDriver(name string, load func() (RootsPrimitive, error)) {
        if rootsDrivers == nil {
                rootsDrivers = make([]*rootDriver, 0)
        }