Temporarily remove imgcrypt in CRI to fix circular dependency
Signed-off-by: Derek McGowan <derek@mcg.dev>
This commit is contained in:
Derek McGowan
parent
192168038e
commit
638b474c81
8
go.mod
8
go.mod
@ -17,7 +17,6 @@ require (
|
||||
github.com/containerd/fifo v1.1.0
|
||||
github.com/containerd/go-cni v1.1.9
|
||||
github.com/containerd/go-runc v1.1.0
|
||||
github.com/containerd/imgcrypt v1.1.7
|
||||
github.com/containerd/log v0.1.0
|
||||
github.com/containerd/nri v0.5.0
|
||||
github.com/containerd/ttrpc v1.2.2
|
||||
@ -83,8 +82,6 @@ require (
|
||||
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
|
||||
github.com/cespare/xxhash/v2 v2.2.0 // indirect
|
||||
github.com/cilium/ebpf v0.9.1 // indirect
|
||||
github.com/containerd/typeurl v1.0.2 // indirect
|
||||
github.com/containers/ocicrypt v1.1.6 // indirect
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
|
||||
github.com/emicklei/go-restful/v3 v3.10.2 // indirect
|
||||
github.com/go-logr/logr v1.2.4 // indirect
|
||||
@ -100,7 +97,6 @@ require (
|
||||
github.com/json-iterator/go v1.1.12 // indirect
|
||||
github.com/klauspost/cpuid/v2 v2.2.5 // indirect
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
|
||||
github.com/miekg/pkcs11 v1.1.1 // indirect
|
||||
github.com/moby/spdystream v0.2.0 // indirect
|
||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
||||
github.com/modern-go/reflect2 v1.0.2 // indirect
|
||||
@ -110,15 +106,12 @@ require (
|
||||
github.com/prometheus/common v0.44.0 // indirect
|
||||
github.com/prometheus/procfs v0.10.1 // indirect
|
||||
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
||||
github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980 // indirect
|
||||
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
|
||||
github.com/vishvananda/netns v0.0.4 // indirect
|
||||
go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 // indirect
|
||||
go.opencensus.io v0.24.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.14.0 // indirect
|
||||
go.opentelemetry.io/otel/metric v0.37.0 // indirect
|
||||
go.opentelemetry.io/proto/otlp v0.19.0 // indirect
|
||||
golang.org/x/crypto v0.14.0 // indirect
|
||||
golang.org/x/mod v0.12.0 // indirect
|
||||
golang.org/x/net v0.17.0 // indirect
|
||||
golang.org/x/oauth2 v0.10.0 // indirect
|
||||
@ -130,7 +123,6 @@ require (
|
||||
google.golang.org/genproto v0.0.0-20230720185612-659f7aaaa771 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20230726155614-23370e0ffb3e // indirect
|
||||
gopkg.in/inf.v0 v0.9.1 // indirect
|
||||
gopkg.in/square/go-jose.v2 v2.6.0 // indirect
|
||||
gopkg.in/yaml.v2 v2.4.0 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||
k8s.io/api v0.28.2 // indirect
|
||||
|
||||
@ -33,8 +33,6 @@ import (
|
||||
"sync/atomic"
|
||||
"time"
|
||||
|
||||
"github.com/containerd/imgcrypt"
|
||||
"github.com/containerd/imgcrypt/images/encryption"
|
||||
imagedigest "github.com/opencontainers/go-digest"
|
||||
imagespec "github.com/opencontainers/image-spec/specs-go/v1"
|
||||
runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
|
||||
@ -171,7 +169,8 @@ func (c *CRIImageService) PullImage(ctx context.Context, r *runtime.PullImageReq
|
||||
}),
|
||||
}
|
||||
|
||||
pullOpts = append(pullOpts, c.encryptedImagesPullOpts()...)
|
||||
// Temporarily removed for v2 upgrade
|
||||
//pullOpts = append(pullOpts, c.encryptedImagesPullOpts()...)
|
||||
if !c.config.ContainerdConfig.DisableSnapshotAnnotations {
|
||||
pullOpts = append(pullOpts,
|
||||
containerd.WithImageHandlerWrapper(snpkg.AppendInfoHandlerWrapper(ref)))
|
||||
@ -545,15 +544,16 @@ func newTransport() *http.Transport {
|
||||
|
||||
// encryptedImagesPullOpts returns the necessary list of pull options required
|
||||
// for decryption of encrypted images based on the cri decryption configuration.
|
||||
func (c *CRIImageService) encryptedImagesPullOpts() []containerd.RemoteOpt {
|
||||
if c.config.ImageDecryption.KeyModel == criconfig.KeyModelNode {
|
||||
ltdd := imgcrypt.Payload{}
|
||||
decUnpackOpt := encryption.WithUnpackConfigApplyOpts(encryption.WithDecryptedUnpack(<dd))
|
||||
opt := containerd.WithUnpackOpts([]containerd.UnpackOpt{decUnpackOpt})
|
||||
return []containerd.RemoteOpt{opt}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
// Temporarily removed for v2 upgrade
|
||||
//func (c *CRIImageService) encryptedImagesPullOpts() []containerd.RemoteOpt {
|
||||
// if c.config.ImageDecryption.KeyModel == criconfig.KeyModelNode {
|
||||
// ltdd := imgcrypt.Payload{}
|
||||
// decUnpackOpt := encryption.WithUnpackConfigApplyOpts(encryption.WithDecryptedUnpack(<dd))
|
||||
// opt := containerd.WithUnpackOpts([]containerd.UnpackOpt{decUnpackOpt})
|
||||
// return []containerd.RemoteOpt{opt}
|
||||
// }
|
||||
// return nil
|
||||
//}
|
||||
|
||||
const (
|
||||
// minPullProgressReportInternal is used to prevent the reporter from
|
||||
|
||||
@ -348,32 +348,33 @@ func TestDefaultScheme(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestEncryptedImagePullOpts(t *testing.T) {
|
||||
for _, test := range []struct {
|
||||
desc string
|
||||
keyModel string
|
||||
expectedOpts int
|
||||
}{
|
||||
{
|
||||
desc: "node key model should return one unpack opt",
|
||||
keyModel: criconfig.KeyModelNode,
|
||||
expectedOpts: 1,
|
||||
},
|
||||
{
|
||||
desc: "no key model selected should default to node key model",
|
||||
keyModel: "",
|
||||
expectedOpts: 0,
|
||||
},
|
||||
} {
|
||||
test := test
|
||||
t.Run(test.desc, func(t *testing.T) {
|
||||
c := newTestCRIService()
|
||||
c.config.ImageDecryption.KeyModel = test.keyModel
|
||||
got := len(c.encryptedImagesPullOpts())
|
||||
assert.Equal(t, test.expectedOpts, got)
|
||||
})
|
||||
}
|
||||
}
|
||||
// Temporarily remove for v2 upgrade
|
||||
//func TestEncryptedImagePullOpts(t *testing.T) {
|
||||
// for _, test := range []struct {
|
||||
// desc string
|
||||
// keyModel string
|
||||
// expectedOpts int
|
||||
// }{
|
||||
// {
|
||||
// desc: "node key model should return one unpack opt",
|
||||
// keyModel: criconfig.KeyModelNode,
|
||||
// expectedOpts: 1,
|
||||
// },
|
||||
// {
|
||||
// desc: "no key model selected should default to node key model",
|
||||
// keyModel: "",
|
||||
// expectedOpts: 0,
|
||||
// },
|
||||
// } {
|
||||
// test := test
|
||||
// t.Run(test.desc, func(t *testing.T) {
|
||||
// c := newTestCRIService()
|
||||
// c.config.ImageDecryption.KeyModel = test.keyModel
|
||||
// got := len(c.encryptedImagesPullOpts())
|
||||
// assert.Equal(t, test.expectedOpts, got)
|
||||
// })
|
||||
// }
|
||||
//}
|
||||
|
||||
func TestSnapshotterFromPodSandboxConfig(t *testing.T) {
|
||||
defaultSnashotter := "native"
|
||||
|
||||
2
vendor/github.com/containerd/imgcrypt/.gitignore
generated
vendored
2
vendor/github.com/containerd/imgcrypt/.gitignore
generated
vendored
@ -1,2 +0,0 @@
|
||||
*~
|
||||
/bin/
|
||||
20
vendor/github.com/containerd/imgcrypt/.golangci.yml
generated
vendored
20
vendor/github.com/containerd/imgcrypt/.golangci.yml
generated
vendored
@ -1,20 +0,0 @@
|
||||
linters:
|
||||
enable:
|
||||
- structcheck
|
||||
- varcheck
|
||||
- staticcheck
|
||||
- unconvert
|
||||
- gofmt
|
||||
- goimports
|
||||
- revive
|
||||
- ineffassign
|
||||
- vet
|
||||
- unused
|
||||
- misspell
|
||||
|
||||
run:
|
||||
skip-dirs:
|
||||
- cmd/ctr/commands/run
|
||||
- cmd/ctr/commands/images
|
||||
- cmd\\ctr\\commands\\run
|
||||
- cmd\\ctr\\commands\\images
|
||||
48
vendor/github.com/containerd/imgcrypt/CHANGES
generated
vendored
48
vendor/github.com/containerd/imgcrypt/CHANGES
generated
vendored
@ -1,48 +0,0 @@
|
||||
CHANGES
|
||||
|
||||
v1.1.7:
|
||||
- Added support for zstd-compressed layers
|
||||
- Update to ocicrypt v1.1.6 for zstd-related dependencies
|
||||
- Update to containerd v1.6.8
|
||||
- Sync'ed ctr-enc with upstream ctr changes to import command
|
||||
- Add support for --all-platforms to encrypt command of ctr-enc
|
||||
|
||||
v1.1.6:
|
||||
- Update to ocicrypt v1.1.5 for yaml v3.0 dependency
|
||||
- Update to containerd v1.6.6 for runc v1.1.2 dependency
|
||||
|
||||
v1.1.5:
|
||||
- Update to ocicrypt v1.1.4; sha256 is the default now for padding in OAEP
|
||||
for pkcs11; Set OCICRYPT_OAEP_HASHALG=sha1 environment variable to force
|
||||
sha1 usage, which is required for example for SoftHSM 2.6.1.
|
||||
|
||||
v1.1.4:
|
||||
- Fixed issue in CheckAuthorization() callpath for images with a ManifestList
|
||||
- CVE-2022-24778
|
||||
- Fix: https://github.com/containerd/imgcrypt/commit/6fdd9818a4d8142107b7ecd767d839c9707700d9
|
||||
- Added test case covering this
|
||||
- Updated to ocicrypt 1.1.3
|
||||
- Updated to containerd 1.6.1
|
||||
|
||||
v1.1.3:
|
||||
- Release v1.1.3 addresses issue #62 due to re-tagging of v1.1.2
|
||||
- docs: update referenced containerd project branch to main
|
||||
- Update linter to match containerd repo
|
||||
- Update CI golang version
|
||||
- Updated to containerd 1.5.8
|
||||
|
||||
v1.1.2:
|
||||
- Decouple CreateCryptoConfig() from github.com/urfave/cli
|
||||
- Updated to containerd 1.5.7
|
||||
- Implemented ConvertFunc for image en- and decryption
|
||||
- Replace pkg/errors with errors package
|
||||
- Updated to ocicrypt 1.1.2
|
||||
- Sync'ed ctr-enc with ctr of containerd-1.5.0
|
||||
|
||||
v1.1.1:
|
||||
- rebased on ocicrypt 1.1.1
|
||||
|
||||
v1.1.0:
|
||||
- rebased on ocicrypt 1.1.0
|
||||
- added pkcs11 support; experimental
|
||||
- added keyprovider support
|
||||
191
vendor/github.com/containerd/imgcrypt/LICENSE
generated
vendored
191
vendor/github.com/containerd/imgcrypt/LICENSE
generated
vendored
@ -1,191 +0,0 @@
|
||||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
https://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
Copyright The containerd Authors
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
9
vendor/github.com/containerd/imgcrypt/MAINTAINERS
generated
vendored
9
vendor/github.com/containerd/imgcrypt/MAINTAINERS
generated
vendored
@ -1,9 +0,0 @@
|
||||
# imgcrypt maintainers
|
||||
#
|
||||
# As a containerd sub-project, containerd maintainers are also included from https://github.com/containerd/project/blob/main/MAINTAINERS.
|
||||
# See https://github.com/containerd/project/blob/main/GOVERNANCE.md for description of maintainer role
|
||||
#
|
||||
# MAINTAINERS
|
||||
# GitHub ID, Name, Email address
|
||||
stefanberger, Stefan Berger, stefanb@linux.ibm.com
|
||||
lumjjb, Brandon Lum, lumjjb@gmail.com
|
||||
67
vendor/github.com/containerd/imgcrypt/Makefile
generated
vendored
67
vendor/github.com/containerd/imgcrypt/Makefile
generated
vendored
@ -1,67 +0,0 @@
|
||||
# Copyright The containerd Authors.
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
|
||||
# Base path used to install.
|
||||
DESTDIR ?= /usr/local
|
||||
|
||||
VERSION=$(shell git describe --match 'v[0-9]*' --dirty='.m' --always)
|
||||
|
||||
CTR_LDFLAGS=-ldflags '-X github.com/containerd/containerd/version.Version=$(VERSION)'
|
||||
COMMANDS=ctd-decoder ctr-enc
|
||||
RELEASE_COMMANDS=ctd-decoder
|
||||
|
||||
BINARIES=$(addprefix bin/,$(COMMANDS))
|
||||
RELEASE_BINARIES=$(addprefix bin/,$(RELEASE_COMMANDS))
|
||||
|
||||
.PHONY: check build ctd-decoder
|
||||
|
||||
all: build
|
||||
|
||||
build: $(BINARIES)
|
||||
|
||||
FORCE:
|
||||
|
||||
bin/ctd-decoder: cmd/ctd-decoder FORCE
|
||||
go build -o $@ -v ./cmd/ctd-decoder/
|
||||
|
||||
bin/ctr-enc: cmd/ctr FORCE
|
||||
go build -o $@ ${CTR_LDFLAGS} -v ./cmd/ctr/
|
||||
|
||||
check:
|
||||
@echo "$@"
|
||||
@golangci-lint run
|
||||
@script/check_format.sh
|
||||
|
||||
install:
|
||||
@echo "$@"
|
||||
@mkdir -p $(DESTDIR)/bin
|
||||
@install $(BINARIES) $(DESTDIR)/bin
|
||||
|
||||
containerd-release:
|
||||
@echo "$@"
|
||||
@mkdir -p $(DESTDIR)/bin
|
||||
@install $(RELEASE_BINARIES) $(DESTDIR)/bin
|
||||
|
||||
uninstall:
|
||||
@echo "$@"
|
||||
@rm -f $(addprefix $(DESTDIR)/bin/,$(notdir $(BINARIES)))
|
||||
|
||||
clean:
|
||||
@echo "$@"
|
||||
@rm -f $(BINARIES)
|
||||
|
||||
test:
|
||||
@echo "$@"
|
||||
@go test ./...
|
||||
107
vendor/github.com/containerd/imgcrypt/README.md
generated
vendored
107
vendor/github.com/containerd/imgcrypt/README.md
generated
vendored
@ -1,107 +0,0 @@
|
||||
# imgcrypt image encryption library and command line tool
|
||||
|
||||
Project `imgcrypt` is a non-core subproject of containerd.
|
||||
|
||||
The `imgcrypt` library provides API exensions for containerd to support encrypted container images and implements
|
||||
the `ctd-decoder` command line tool for use by containerd to decrypt encrypted container images. An extended version
|
||||
of containerd's `ctr` tool (`ctr-enc`) with support for encrypting and decrypting container images is also provided.
|
||||
|
||||
`imgcrypt` relies on the [`ocicrypt`](https://github.com/containers/ocicrypt) library for crypto functions on image layers.
|
||||
|
||||
# Usage
|
||||
|
||||
`imgcrypt` requires containerd 1.3 or later. Containerd 1.4 or later is required when used with Kubernetes.
|
||||
For configuration instructions for kubernetes, please consult the [CRI decryption document](https://github.com/containerd/containerd/blob/main/docs/cri/decryption.md).
|
||||
|
||||
Build and install `imgcrypt`:
|
||||
|
||||
```
|
||||
# make
|
||||
# sudo make install
|
||||
```
|
||||
|
||||
Start containerd with a configuration file that looks as follows. To avoid interference with a containerd from a Docker
|
||||
installation we use /tmp for directories. Also, we build containerd 1.3 from the source but do not install it.
|
||||
|
||||
```
|
||||
# cat config.toml
|
||||
disable_plugins = ["cri"]
|
||||
root = "/tmp/var/lib/containerd"
|
||||
state = "/tmp/run/containerd"
|
||||
[grpc]
|
||||
address = "/tmp/run/containerd/containerd.sock"
|
||||
uid = 0
|
||||
gid = 0
|
||||
[stream_processors]
|
||||
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
|
||||
accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
|
||||
returns = "application/vnd.oci.image.layer.v1.tar+gzip"
|
||||
path = "/usr/local/bin/ctd-decoder"
|
||||
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar.zstd"]
|
||||
accepts = ["application/vnd.oci.image.layer.v1.tar+zstd+encrypted"]
|
||||
returns = "application/vnd.oci.image.layer.v1.tar+zstd"
|
||||
path = "/usr/local/bin/ctd-decoder"
|
||||
[stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
|
||||
accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
|
||||
returns = "application/vnd.oci.image.layer.v1.tar"
|
||||
path = "/usr/local/bin/ctd-decoder"
|
||||
|
||||
# sudo ~/src/github.com/containerd/containerd/bin/containerd -c config.toml
|
||||
```
|
||||
|
||||
Create an RSA key pair using the openssl command line tool and encrypted an image:
|
||||
|
||||
```
|
||||
# openssl genrsa -out mykey.pem
|
||||
Generating RSA private key, 2048 bit long modulus (2 primes)
|
||||
...............................................+++++
|
||||
............................+++++
|
||||
e is 65537 (0x010001)
|
||||
# openssl rsa -in mykey.pem -pubout -out mypubkey.pem
|
||||
writing RSA key
|
||||
# sudo chmod 0666 /tmp/run/containerd/containerd.sock
|
||||
# CTR="/usr/local/bin/ctr-enc -a /tmp/run/containerd/containerd.sock"
|
||||
# $CTR images pull --all-platforms docker.io/library/bash:latest
|
||||
[...]
|
||||
# $CTR images layerinfo --platform linux/amd64 docker.io/library/bash:latest
|
||||
# DIGEST PLATFORM SIZE ENCRYPTION RECIPIENTS
|
||||
0 sha256:9d48c3bd43c520dc2784e868a780e976b207cbf493eaff8c6596eb871cbd9609 linux/amd64 2789669
|
||||
1 sha256:7dd01fd971d4ec7058c5636a505327b24e5fc8bd7f62816a9d518472bd9b15c0 linux/amd64 3174665
|
||||
2 sha256:691cfbca522787898c8b37f063dd20e5524e7d103e1a3b298bd2e2b8da54faf5 linux/amd64 340
|
||||
# $CTR images encrypt --recipient jwe:mypubkey.pem --platform linux/amd64 docker.io/library/bash:latest bash.enc:latest
|
||||
Encrypting docker.io/library/bash:latest to bash.enc:latest
|
||||
$ $CTR images layerinfo --platform linux/amd64 bash.enc:latest
|
||||
# DIGEST PLATFORM SIZE ENCRYPTION RECIPIENTS
|
||||
0 sha256:360be141b01f69b25427a9085b36ba8ad7d7a335449013fa6b32c1ecb894ab5b linux/amd64 2789669 jwe [jwe]
|
||||
1 sha256:ac601e66cdd275ee0e10afead03a2722e153a60982122d2d369880ea54fe82f8 linux/amd64 3174665 jwe [jwe]
|
||||
2 sha256:41e47064fd00424e328915ad2f7f716bd86ea2d0d8315edaf33ecaa6a2464530 linux/amd64 340 jwe [jwe]
|
||||
```
|
||||
|
||||
Start a local image registry so we can push the encrypted image to it. A recent versions of the registry is required
|
||||
to accept encrypted container images.
|
||||
```
|
||||
# docker pull registry:latest
|
||||
# docker run -d -p 5000:5000 --restart=always --name registry registry
|
||||
```
|
||||
|
||||
Push the encrypted image to the local registry, pull it using `ctr-enc`, and then run the image.
|
||||
```
|
||||
# $CTR images tag bash.enc:latest localhost:5000/bash.enc:latest
|
||||
# $CTR images push localhost:5000/bash.enc:latest
|
||||
# $CTR images rm localhost:5000/bash.enc:latest bash.enc:latest
|
||||
# $CTR images pull localhost:5000/bash.enc:latest
|
||||
# sudo $CTR run --rm localhost:5000/bash.enc:latest test echo 'Hello World!'
|
||||
ctr: you are not authorized to use this image: missing private key needed for decryption
|
||||
# sudo $CTR run --rm --key mykey.pem localhost:5000/bash.enc:latest test echo 'Hello World!'
|
||||
Hello World!
|
||||
```
|
||||
|
||||
## Project details
|
||||
|
||||
**imgcrypt** is a non-core containerd sub-project, licensed under the [Apache 2.0 license](./LICENSE).
|
||||
As a containerd sub-project, you will find the:
|
||||
* [Project governance](https://github.com/containerd/project/blob/main/GOVERNANCE.md),
|
||||
* [Maintainers](MAINTAINERS),
|
||||
* and [Contributing guidelines](https://github.com/containerd/project/blob/main/CONTRIBUTING.md)
|
||||
|
||||
information in our [`containerd/project`](https://github.com/containerd/project) repository.
|
||||
42
vendor/github.com/containerd/imgcrypt/images/encryption/any.go
generated
vendored
42
vendor/github.com/containerd/imgcrypt/images/encryption/any.go
generated
vendored
@ -1,42 +0,0 @@
|
||||
/*
|
||||
Copyright The containerd Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package encryption
|
||||
|
||||
import "github.com/gogo/protobuf/types"
|
||||
|
||||
// pbAny takes proto-generated Any type.
|
||||
// https://developers.google.com/protocol-buffers/docs/proto3#any
|
||||
type pbAny interface {
|
||||
GetTypeUrl() string
|
||||
GetValue() []byte
|
||||
}
|
||||
|
||||
func fromAny(from pbAny) *types.Any {
|
||||
if from == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
pbany, ok := from.(*types.Any)
|
||||
if ok {
|
||||
return pbany
|
||||
}
|
||||
|
||||
return &types.Any{
|
||||
TypeUrl: from.GetTypeUrl(),
|
||||
Value: from.GetValue(),
|
||||
}
|
||||
}
|
||||
80
vendor/github.com/containerd/imgcrypt/images/encryption/client.go
generated
vendored
80
vendor/github.com/containerd/imgcrypt/images/encryption/client.go
generated
vendored
@ -1,80 +0,0 @@
|
||||
/*
|
||||
Copyright The containerd Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package encryption
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
"github.com/containerd/containerd"
|
||||
"github.com/containerd/containerd/containers"
|
||||
"github.com/containerd/containerd/diff"
|
||||
"github.com/containerd/containerd/errdefs"
|
||||
"github.com/containerd/imgcrypt"
|
||||
"github.com/containerd/typeurl"
|
||||
|
||||
encconfig "github.com/containers/ocicrypt/config"
|
||||
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
|
||||
)
|
||||
|
||||
// WithDecryptedUnpack allows to pass parameters the 'layertool' needs to the applier
|
||||
func WithDecryptedUnpack(data *imgcrypt.Payload) diff.ApplyOpt {
|
||||
return func(_ context.Context, desc ocispec.Descriptor, c *diff.ApplyConfig) error {
|
||||
data.Descriptor = desc
|
||||
any, err := typeurl.MarshalAny(data)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to marshal payload: %w", err)
|
||||
}
|
||||
|
||||
for _, id := range imgcrypt.PayloadToolIDs {
|
||||
setProcessorPayload(c, id, any)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
// WithUnpackConfigApplyOpts allows to pass an ApplyOpt
|
||||
func WithUnpackConfigApplyOpts(opt diff.ApplyOpt) containerd.UnpackOpt {
|
||||
return func(_ context.Context, uc *containerd.UnpackConfig) error {
|
||||
uc.ApplyOpts = append(uc.ApplyOpts, opt)
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
// WithUnpackOpts is used to add unpack options to the unpacker.
|
||||
func WithUnpackOpts(opts []containerd.UnpackOpt) containerd.RemoteOpt {
|
||||
return func(_ *containerd.Client, c *containerd.RemoteContext) error {
|
||||
c.UnpackOpts = append(c.UnpackOpts, opts...)
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
// WithAuthorizationCheck checks the authorization of keys used for encrypted containers
|
||||
// be checked upon creation of a container
|
||||
func WithAuthorizationCheck(dc *encconfig.DecryptConfig) containerd.NewContainerOpts {
|
||||
return func(ctx context.Context, client *containerd.Client, c *containers.Container) error {
|
||||
image, err := client.ImageService().Get(ctx, c.Image)
|
||||
if errdefs.IsNotFound(err) {
|
||||
// allow creation of container without a existing image
|
||||
return nil
|
||||
} else if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return CheckAuthorization(ctx, client.ContentStore(), image.Target, dc)
|
||||
}
|
||||
}
|
||||
512
vendor/github.com/containerd/imgcrypt/images/encryption/encryption.go
generated
vendored
512
vendor/github.com/containerd/imgcrypt/images/encryption/encryption.go
generated
vendored
@ -1,512 +0,0 @@
|
||||
/*
|
||||
Copyright The containerd Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package encryption
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"math/rand"
|
||||
|
||||
"github.com/containerd/containerd/content"
|
||||
"github.com/containerd/containerd/errdefs"
|
||||
"github.com/containerd/containerd/images"
|
||||
"github.com/containerd/containerd/images/converter"
|
||||
"github.com/containerd/containerd/platforms"
|
||||
|
||||
"github.com/containers/ocicrypt"
|
||||
encconfig "github.com/containers/ocicrypt/config"
|
||||
encocispec "github.com/containers/ocicrypt/spec"
|
||||
"github.com/opencontainers/go-digest"
|
||||
"github.com/opencontainers/image-spec/specs-go"
|
||||
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
|
||||
)
|
||||
|
||||
type cryptoOp int
|
||||
|
||||
const (
|
||||
cryptoOpEncrypt cryptoOp = iota
|
||||
cryptoOpDecrypt = iota
|
||||
cryptoOpUnwrapOnly = iota
|
||||
)
|
||||
|
||||
// LayerFilter allows to select Layers by certain criteria
|
||||
type LayerFilter func(desc ocispec.Descriptor) bool
|
||||
|
||||
// isLocalPlatform determines whether the given platform matches the local one
|
||||
func isLocalPlatform(platform *ocispec.Platform) bool {
|
||||
matcher := platforms.NewMatcher(*platform)
|
||||
|
||||
return matcher.Match(platforms.DefaultSpec())
|
||||
}
|
||||
|
||||
// IsEncryptedDiff returns true if mediaType is a known encrypted media type.
|
||||
func IsEncryptedDiff(ctx context.Context, mediaType string) bool {
|
||||
switch mediaType {
|
||||
case encocispec.MediaTypeLayerZstdEnc, encocispec.MediaTypeLayerGzipEnc, encocispec.MediaTypeLayerEnc:
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// HasEncryptedLayer returns true if any LayerInfo indicates that the layer is encrypted
|
||||
func HasEncryptedLayer(ctx context.Context, layerInfos []ocispec.Descriptor) bool {
|
||||
for i := 0; i < len(layerInfos); i++ {
|
||||
if IsEncryptedDiff(ctx, layerInfos[i].MediaType) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// encryptLayer encrypts the layer using the CryptoConfig and creates a new OCI Descriptor.
|
||||
// A call to this function may also only manipulate the wrapped keys list.
|
||||
// The caller is expected to store the returned encrypted data and OCI Descriptor
|
||||
func encryptLayer(cc *encconfig.CryptoConfig, dataReader content.ReaderAt, desc ocispec.Descriptor) (ocispec.Descriptor, io.Reader, ocicrypt.EncryptLayerFinalizer, error) {
|
||||
var (
|
||||
size int64
|
||||
d digest.Digest
|
||||
err error
|
||||
)
|
||||
|
||||
encLayerReader, encLayerFinalizer, err := ocicrypt.EncryptLayer(cc.EncryptConfig, ocicrypt.ReaderFromReaderAt(dataReader), desc)
|
||||
if err != nil {
|
||||
return ocispec.Descriptor{}, nil, nil, err
|
||||
}
|
||||
|
||||
// were data touched ?
|
||||
if encLayerReader != nil {
|
||||
size = 0
|
||||
d = ""
|
||||
} else {
|
||||
size = desc.Size
|
||||
d = desc.Digest
|
||||
}
|
||||
|
||||
newDesc := ocispec.Descriptor{
|
||||
Digest: d,
|
||||
Size: size,
|
||||
Platform: desc.Platform,
|
||||
}
|
||||
|
||||
switch desc.MediaType {
|
||||
case images.MediaTypeDockerSchema2LayerGzip:
|
||||
newDesc.MediaType = encocispec.MediaTypeLayerGzipEnc
|
||||
case images.MediaTypeDockerSchema2Layer:
|
||||
newDesc.MediaType = encocispec.MediaTypeLayerEnc
|
||||
case encocispec.MediaTypeLayerGzipEnc:
|
||||
newDesc.MediaType = encocispec.MediaTypeLayerGzipEnc
|
||||
case encocispec.MediaTypeLayerZstdEnc:
|
||||
newDesc.MediaType = encocispec.MediaTypeLayerZstdEnc
|
||||
case encocispec.MediaTypeLayerEnc:
|
||||
newDesc.MediaType = encocispec.MediaTypeLayerEnc
|
||||
|
||||
// TODO: Mediatypes to be added in ocispec
|
||||
case ocispec.MediaTypeImageLayerGzip:
|
||||
newDesc.MediaType = encocispec.MediaTypeLayerGzipEnc
|
||||
case ocispec.MediaTypeImageLayerZstd:
|
||||
newDesc.MediaType = encocispec.MediaTypeLayerZstdEnc
|
||||
case ocispec.MediaTypeImageLayer:
|
||||
newDesc.MediaType = encocispec.MediaTypeLayerEnc
|
||||
|
||||
default:
|
||||
return ocispec.Descriptor{}, nil, nil, fmt.Errorf("unsupporter layer MediaType: %s", desc.MediaType)
|
||||
}
|
||||
|
||||
return newDesc, encLayerReader, encLayerFinalizer, nil
|
||||
}
|
||||
|
||||
// DecryptLayer decrypts the layer using the DecryptConfig and creates a new OCI Descriptor.
|
||||
// The caller is expected to store the returned plain data and OCI Descriptor
|
||||
func DecryptLayer(dc *encconfig.DecryptConfig, dataReader io.Reader, desc ocispec.Descriptor, unwrapOnly bool) (ocispec.Descriptor, io.Reader, digest.Digest, error) {
|
||||
resultReader, layerDigest, err := ocicrypt.DecryptLayer(dc, dataReader, desc, unwrapOnly)
|
||||
if err != nil || unwrapOnly {
|
||||
return ocispec.Descriptor{}, nil, "", err
|
||||
}
|
||||
|
||||
newDesc := ocispec.Descriptor{
|
||||
Size: 0,
|
||||
Platform: desc.Platform,
|
||||
}
|
||||
|
||||
switch desc.MediaType {
|
||||
case encocispec.MediaTypeLayerGzipEnc:
|
||||
newDesc.MediaType = images.MediaTypeDockerSchema2LayerGzip
|
||||
case encocispec.MediaTypeLayerZstdEnc:
|
||||
newDesc.MediaType = ocispec.MediaTypeImageLayerZstd
|
||||
case encocispec.MediaTypeLayerEnc:
|
||||
newDesc.MediaType = images.MediaTypeDockerSchema2Layer
|
||||
default:
|
||||
return ocispec.Descriptor{}, nil, "", fmt.Errorf("unsupporter layer MediaType: %s", desc.MediaType)
|
||||
}
|
||||
return newDesc, resultReader, layerDigest, nil
|
||||
}
|
||||
|
||||
// decryptLayer decrypts the layer using the CryptoConfig and creates a new OCI Descriptor.
|
||||
// The caller is expected to store the returned plain data and OCI Descriptor
|
||||
func decryptLayer(cc *encconfig.CryptoConfig, dataReader content.ReaderAt, desc ocispec.Descriptor, unwrapOnly bool) (ocispec.Descriptor, io.Reader, error) {
|
||||
resultReader, d, err := ocicrypt.DecryptLayer(cc.DecryptConfig, ocicrypt.ReaderFromReaderAt(dataReader), desc, unwrapOnly)
|
||||
if err != nil || unwrapOnly {
|
||||
return ocispec.Descriptor{}, nil, err
|
||||
}
|
||||
|
||||
newDesc := ocispec.Descriptor{
|
||||
Digest: d,
|
||||
Size: 0,
|
||||
Platform: desc.Platform,
|
||||
}
|
||||
|
||||
switch desc.MediaType {
|
||||
case encocispec.MediaTypeLayerGzipEnc:
|
||||
newDesc.MediaType = images.MediaTypeDockerSchema2LayerGzip
|
||||
case encocispec.MediaTypeLayerZstdEnc:
|
||||
newDesc.MediaType = ocispec.MediaTypeImageLayerZstd
|
||||
case encocispec.MediaTypeLayerEnc:
|
||||
newDesc.MediaType = images.MediaTypeDockerSchema2Layer
|
||||
default:
|
||||
return ocispec.Descriptor{}, nil, fmt.Errorf("unsupporter layer MediaType: %s", desc.MediaType)
|
||||
}
|
||||
return newDesc, resultReader, nil
|
||||
}
|
||||
|
||||
// cryptLayer handles the changes due to encryption or decryption of a layer
|
||||
func cryptLayer(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, cryptoOp cryptoOp) (ocispec.Descriptor, error) {
|
||||
var (
|
||||
resultReader io.Reader
|
||||
newDesc ocispec.Descriptor
|
||||
encLayerFinalizer ocicrypt.EncryptLayerFinalizer
|
||||
)
|
||||
|
||||
dataReader, err := cs.ReaderAt(ctx, desc)
|
||||
if err != nil {
|
||||
return ocispec.Descriptor{}, err
|
||||
}
|
||||
defer dataReader.Close()
|
||||
|
||||
if cryptoOp == cryptoOpEncrypt {
|
||||
newDesc, resultReader, encLayerFinalizer, err = encryptLayer(cc, dataReader, desc)
|
||||
} else {
|
||||
newDesc, resultReader, err = decryptLayer(cc, dataReader, desc, cryptoOp == cryptoOpUnwrapOnly)
|
||||
}
|
||||
if err != nil || cryptoOp == cryptoOpUnwrapOnly {
|
||||
return ocispec.Descriptor{}, err
|
||||
}
|
||||
|
||||
newDesc.Annotations = ocicrypt.FilterOutAnnotations(desc.Annotations)
|
||||
|
||||
// some operations, such as changing recipients, may not touch the layer at all
|
||||
if resultReader != nil {
|
||||
var ref string
|
||||
// If we have the digest, write blob with checks
|
||||
haveDigest := newDesc.Digest.String() != ""
|
||||
if haveDigest {
|
||||
ref = fmt.Sprintf("layer-%s", newDesc.Digest.String())
|
||||
} else {
|
||||
ref = fmt.Sprintf("blob-%d-%d", rand.Int(), rand.Int())
|
||||
}
|
||||
|
||||
if haveDigest {
|
||||
if err := content.WriteBlob(ctx, cs, ref, resultReader, newDesc); err != nil {
|
||||
return ocispec.Descriptor{}, fmt.Errorf("failed to write config: %w", err)
|
||||
}
|
||||
} else {
|
||||
newDesc.Digest, newDesc.Size, err = ingestReader(ctx, cs, ref, resultReader)
|
||||
if err != nil {
|
||||
return ocispec.Descriptor{}, err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// After performing encryption, call finalizer to get annotations
|
||||
if encLayerFinalizer != nil {
|
||||
annotations, err := encLayerFinalizer()
|
||||
if err != nil {
|
||||
return ocispec.Descriptor{}, fmt.Errorf("error getting annotations from encLayer finalizer: %w", err)
|
||||
}
|
||||
for k, v := range annotations {
|
||||
newDesc.Annotations[k] = v
|
||||
}
|
||||
}
|
||||
return newDesc, err
|
||||
}
|
||||
|
||||
func ingestReader(ctx context.Context, cs content.Ingester, ref string, r io.Reader) (digest.Digest, int64, error) {
|
||||
cw, err := content.OpenWriter(ctx, cs, content.WithRef(ref))
|
||||
if err != nil {
|
||||
return "", 0, fmt.Errorf("failed to open writer: %w", err)
|
||||
}
|
||||
defer cw.Close()
|
||||
|
||||
if _, err := content.CopyReader(cw, r); err != nil {
|
||||
return "", 0, fmt.Errorf("copy failed: %w", err)
|
||||
}
|
||||
|
||||
st, err := cw.Status()
|
||||
if err != nil {
|
||||
return "", 0, fmt.Errorf("failed to get state: %w", err)
|
||||
}
|
||||
|
||||
if err := cw.Commit(ctx, st.Offset, ""); err != nil {
|
||||
if !errdefs.IsAlreadyExists(err) {
|
||||
return "", 0, fmt.Errorf("failed commit on ref %q: %w", ref, err)
|
||||
}
|
||||
}
|
||||
|
||||
return cw.Digest(), st.Offset, nil
|
||||
}
|
||||
|
||||
// Encrypt or decrypt all the Children of a given descriptor
|
||||
func cryptChildren(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp, thisPlatform *ocispec.Platform) (ocispec.Descriptor, bool, error) {
|
||||
children, err := images.Children(ctx, cs, desc)
|
||||
if err != nil {
|
||||
if errdefs.IsNotFound(err) {
|
||||
return desc, false, nil
|
||||
}
|
||||
return ocispec.Descriptor{}, false, err
|
||||
}
|
||||
|
||||
var newLayers []ocispec.Descriptor
|
||||
var config ocispec.Descriptor
|
||||
modified := false
|
||||
|
||||
for _, child := range children {
|
||||
// we only encrypt child layers and have to update their parents if encryption happened
|
||||
switch child.MediaType {
|
||||
case images.MediaTypeDockerSchema2Config, ocispec.MediaTypeImageConfig:
|
||||
config = child
|
||||
case images.MediaTypeDockerSchema2LayerGzip, images.MediaTypeDockerSchema2Layer,
|
||||
ocispec.MediaTypeImageLayerGzip, ocispec.MediaTypeImageLayer,
|
||||
ocispec.MediaTypeImageLayerZstd:
|
||||
if cryptoOp == cryptoOpEncrypt && lf(child) {
|
||||
nl, err := cryptLayer(ctx, cs, child, cc, cryptoOp)
|
||||
if err != nil {
|
||||
return ocispec.Descriptor{}, false, err
|
||||
}
|
||||
modified = true
|
||||
newLayers = append(newLayers, nl)
|
||||
} else {
|
||||
newLayers = append(newLayers, child)
|
||||
}
|
||||
case encocispec.MediaTypeLayerGzipEnc, encocispec.MediaTypeLayerZstdEnc, encocispec.MediaTypeLayerEnc:
|
||||
// this one can be decrypted but also its recipients list changed
|
||||
if lf(child) {
|
||||
nl, err := cryptLayer(ctx, cs, child, cc, cryptoOp)
|
||||
if err != nil || cryptoOp == cryptoOpUnwrapOnly {
|
||||
return ocispec.Descriptor{}, false, err
|
||||
}
|
||||
modified = true
|
||||
newLayers = append(newLayers, nl)
|
||||
} else {
|
||||
newLayers = append(newLayers, child)
|
||||
}
|
||||
case images.MediaTypeDockerSchema2LayerForeign, images.MediaTypeDockerSchema2LayerForeignGzip:
|
||||
// never encrypt/decrypt
|
||||
newLayers = append(newLayers, child)
|
||||
default:
|
||||
return ocispec.Descriptor{}, false, fmt.Errorf("bad/unhandled MediaType %s in encryptChildren", child.MediaType)
|
||||
}
|
||||
}
|
||||
|
||||
if modified && len(newLayers) > 0 {
|
||||
newManifest := ocispec.Manifest{
|
||||
Versioned: specs.Versioned{
|
||||
SchemaVersion: 2,
|
||||
},
|
||||
Config: config,
|
||||
Layers: newLayers,
|
||||
}
|
||||
|
||||
mb, err := json.MarshalIndent(newManifest, "", " ")
|
||||
if err != nil {
|
||||
return ocispec.Descriptor{}, false, fmt.Errorf("failed to marshal image: %w", err)
|
||||
}
|
||||
|
||||
newDesc := ocispec.Descriptor{
|
||||
MediaType: ocispec.MediaTypeImageManifest,
|
||||
Size: int64(len(mb)),
|
||||
Digest: digest.Canonical.FromBytes(mb),
|
||||
Platform: desc.Platform,
|
||||
}
|
||||
|
||||
labels := map[string]string{}
|
||||
labels["containerd.io/gc.ref.content.0"] = newManifest.Config.Digest.String()
|
||||
for i, ch := range newManifest.Layers {
|
||||
labels[fmt.Sprintf("containerd.io/gc.ref.content.%d", i+1)] = ch.Digest.String()
|
||||
}
|
||||
|
||||
ref := fmt.Sprintf("manifest-%s", newDesc.Digest.String())
|
||||
|
||||
if err := content.WriteBlob(ctx, cs, ref, bytes.NewReader(mb), newDesc, content.WithLabels(labels)); err != nil {
|
||||
return ocispec.Descriptor{}, false, fmt.Errorf("failed to write config: %w", err)
|
||||
}
|
||||
return newDesc, true, nil
|
||||
}
|
||||
|
||||
return desc, modified, nil
|
||||
}
|
||||
|
||||
// cryptManifest encrypts or decrypts the children of a top level manifest
|
||||
func cryptManifest(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp) (ocispec.Descriptor, bool, error) {
|
||||
p, err := content.ReadBlob(ctx, cs, desc)
|
||||
if err != nil {
|
||||
return ocispec.Descriptor{}, false, err
|
||||
}
|
||||
var manifest ocispec.Manifest
|
||||
if err := json.Unmarshal(p, &manifest); err != nil {
|
||||
return ocispec.Descriptor{}, false, err
|
||||
}
|
||||
platform := platforms.DefaultSpec()
|
||||
newDesc, modified, err := cryptChildren(ctx, cs, desc, cc, lf, cryptoOp, &platform)
|
||||
if err != nil || cryptoOp == cryptoOpUnwrapOnly {
|
||||
return ocispec.Descriptor{}, false, err
|
||||
}
|
||||
return newDesc, modified, nil
|
||||
}
|
||||
|
||||
// cryptManifestList encrypts or decrypts the children of a top level manifest list
|
||||
func cryptManifestList(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp) (ocispec.Descriptor, bool, error) {
|
||||
// read the index; if any layer is encrypted and any manifests change we will need to rewrite it
|
||||
b, err := content.ReadBlob(ctx, cs, desc)
|
||||
if err != nil {
|
||||
return ocispec.Descriptor{}, false, err
|
||||
}
|
||||
|
||||
var index ocispec.Index
|
||||
if err := json.Unmarshal(b, &index); err != nil {
|
||||
return ocispec.Descriptor{}, false, err
|
||||
}
|
||||
|
||||
var newManifests []ocispec.Descriptor
|
||||
modified := false
|
||||
for _, manifest := range index.Manifests {
|
||||
if cryptoOp == cryptoOpUnwrapOnly && !isLocalPlatform(manifest.Platform) {
|
||||
continue
|
||||
}
|
||||
newManifest, m, err := cryptChildren(ctx, cs, manifest, cc, lf, cryptoOp, manifest.Platform)
|
||||
if err != nil || cryptoOp == cryptoOpUnwrapOnly {
|
||||
return ocispec.Descriptor{}, false, err
|
||||
}
|
||||
if m {
|
||||
modified = true
|
||||
}
|
||||
newManifests = append(newManifests, newManifest)
|
||||
}
|
||||
if cryptoOp == cryptoOpUnwrapOnly {
|
||||
return ocispec.Descriptor{}, false, fmt.Errorf("No manifest found for local platform")
|
||||
}
|
||||
|
||||
if modified {
|
||||
// we need to update the index
|
||||
newIndex := ocispec.Index{
|
||||
Versioned: index.Versioned,
|
||||
Manifests: newManifests,
|
||||
}
|
||||
|
||||
mb, err := json.MarshalIndent(newIndex, "", " ")
|
||||
if err != nil {
|
||||
return ocispec.Descriptor{}, false, fmt.Errorf("failed to marshal index: %w", err)
|
||||
}
|
||||
|
||||
newDesc := ocispec.Descriptor{
|
||||
MediaType: ocispec.MediaTypeImageIndex,
|
||||
Size: int64(len(mb)),
|
||||
Digest: digest.Canonical.FromBytes(mb),
|
||||
}
|
||||
|
||||
labels := map[string]string{}
|
||||
for i, m := range newIndex.Manifests {
|
||||
labels[fmt.Sprintf("containerd.io/gc.ref.content.%d", i)] = m.Digest.String()
|
||||
}
|
||||
|
||||
ref := fmt.Sprintf("index-%s", newDesc.Digest.String())
|
||||
|
||||
if err = content.WriteBlob(ctx, cs, ref, bytes.NewReader(mb), newDesc, content.WithLabels(labels)); err != nil {
|
||||
return ocispec.Descriptor{}, false, fmt.Errorf("failed to write index: %w", err)
|
||||
}
|
||||
return newDesc, true, nil
|
||||
}
|
||||
|
||||
return desc, false, nil
|
||||
}
|
||||
|
||||
// cryptImage is the dispatcher to encrypt/decrypt an image; it accepts either an OCI descriptor
|
||||
// representing a manifest list or a single manifest
|
||||
func cryptImage(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp) (ocispec.Descriptor, bool, error) {
|
||||
if cc == nil {
|
||||
return ocispec.Descriptor{}, false, errors.New("invalid argument: CryptoConfig must not be nil")
|
||||
}
|
||||
switch desc.MediaType {
|
||||
case ocispec.MediaTypeImageIndex, images.MediaTypeDockerSchema2ManifestList:
|
||||
return cryptManifestList(ctx, cs, desc, cc, lf, cryptoOp)
|
||||
case ocispec.MediaTypeImageManifest, images.MediaTypeDockerSchema2Manifest:
|
||||
return cryptManifest(ctx, cs, desc, cc, lf, cryptoOp)
|
||||
default:
|
||||
return ocispec.Descriptor{}, false, fmt.Errorf("unhandled media type: %s", desc.MediaType)
|
||||
}
|
||||
}
|
||||
|
||||
// EncryptImage encrypts an image; it accepts either an OCI descriptor representing a manifest list or a single manifest
|
||||
func EncryptImage(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter) (ocispec.Descriptor, bool, error) {
|
||||
return cryptImage(ctx, cs, desc, cc, lf, cryptoOpEncrypt)
|
||||
}
|
||||
|
||||
// DecryptImage decrypts an image; it accepts either an OCI descriptor representing a manifest list or a single manifest
|
||||
func DecryptImage(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter) (ocispec.Descriptor, bool, error) {
|
||||
return cryptImage(ctx, cs, desc, cc, lf, cryptoOpDecrypt)
|
||||
}
|
||||
|
||||
// GetImageEncryptConverter returns a converter function for image encryption
|
||||
func GetImageEncryptConverter(cc *encconfig.CryptoConfig, lf LayerFilter) converter.ConvertFunc {
|
||||
return func(ctx context.Context, cs content.Store, desc ocispec.Descriptor) (*ocispec.Descriptor, error) {
|
||||
newDesc, _, err := EncryptImage(ctx, cs, desc, cc, lf)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &newDesc, nil
|
||||
}
|
||||
}
|
||||
|
||||
// GetImageDecryptConverter returns a converter function for image decryption
|
||||
func GetImageDecryptConverter(cc *encconfig.CryptoConfig, lf LayerFilter) converter.ConvertFunc {
|
||||
return func(ctx context.Context, cs content.Store, desc ocispec.Descriptor) (*ocispec.Descriptor, error) {
|
||||
newDesc, _, err := DecryptImage(ctx, cs, desc, cc, lf)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &newDesc, nil
|
||||
}
|
||||
}
|
||||
|
||||
// CheckAuthorization checks whether a user has the right keys to be allowed to access an image (every layer)
|
||||
// It takes decrypting of the layers only as far as decrypting the asymmetrically encrypted data
|
||||
// The decryption is only done for the current platform
|
||||
func CheckAuthorization(ctx context.Context, cs content.Store, desc ocispec.Descriptor, dc *encconfig.DecryptConfig) error {
|
||||
cc := encconfig.InitDecryption(dc.Parameters)
|
||||
|
||||
lf := func(desc ocispec.Descriptor) bool {
|
||||
return true
|
||||
}
|
||||
|
||||
_, _, err := cryptImage(ctx, cs, desc, &cc, lf, cryptoOpUnwrapOnly)
|
||||
if err != nil {
|
||||
return fmt.Errorf("you are not authorized to use this image: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
53
vendor/github.com/containerd/imgcrypt/images/encryption/payload.go
generated
vendored
53
vendor/github.com/containerd/imgcrypt/images/encryption/payload.go
generated
vendored
@ -1,53 +0,0 @@
|
||||
/*
|
||||
Copyright The containerd Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package encryption
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
|
||||
"github.com/containerd/containerd/diff"
|
||||
"github.com/gogo/protobuf/types"
|
||||
)
|
||||
|
||||
var processorPayloadsUseGogo bool
|
||||
|
||||
func init() {
|
||||
var c = &diff.ApplyConfig{}
|
||||
var pbany *types.Any
|
||||
|
||||
pp := reflect.TypeOf(c.ProcessorPayloads)
|
||||
processorPayloadsUseGogo = pp.Elem() == reflect.TypeOf(pbany)
|
||||
}
|
||||
|
||||
func clearProcessorPayloads(c *diff.ApplyConfig) {
|
||||
var empty = reflect.MakeMap(reflect.TypeOf(c.ProcessorPayloads))
|
||||
reflect.ValueOf(&c.ProcessorPayloads).Elem().Set(empty)
|
||||
}
|
||||
|
||||
func setProcessorPayload(c *diff.ApplyConfig, id string, value pbAny) {
|
||||
if c.ProcessorPayloads == nil {
|
||||
clearProcessorPayloads(c)
|
||||
}
|
||||
|
||||
var v reflect.Value
|
||||
if processorPayloadsUseGogo {
|
||||
v = reflect.ValueOf(fromAny(value))
|
||||
} else {
|
||||
v = reflect.ValueOf(value)
|
||||
}
|
||||
reflect.ValueOf(c.ProcessorPayloads).SetMapIndex(reflect.ValueOf(id), v)
|
||||
}
|
||||
44
vendor/github.com/containerd/imgcrypt/payload.go
generated
vendored
44
vendor/github.com/containerd/imgcrypt/payload.go
generated
vendored
@ -1,44 +0,0 @@
|
||||
/*
|
||||
Copyright The containerd Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package imgcrypt
|
||||
|
||||
import (
|
||||
"github.com/containerd/typeurl"
|
||||
|
||||
encconfig "github.com/containers/ocicrypt/config"
|
||||
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
|
||||
)
|
||||
|
||||
const (
|
||||
PayloadURI = "io.containerd.ocicrypt.v1.Payload"
|
||||
)
|
||||
|
||||
var PayloadToolIDs = []string{
|
||||
"io.containerd.ocicrypt.decoder.v1.tar",
|
||||
"io.containerd.ocicrypt.decoder.v1.tar.gzip",
|
||||
}
|
||||
|
||||
func init() {
|
||||
typeurl.Register(&Payload{}, PayloadURI)
|
||||
}
|
||||
|
||||
// Payload holds data that the external layer decryption tool
|
||||
// needs for decrypting a layer
|
||||
type Payload struct {
|
||||
DecryptConfig encconfig.DecryptConfig
|
||||
Descriptor ocispec.Descriptor
|
||||
}
|
||||
2
vendor/github.com/containerd/typeurl/.gitignore
generated
vendored
2
vendor/github.com/containerd/typeurl/.gitignore
generated
vendored
@ -1,2 +0,0 @@
|
||||
*.test
|
||||
coverage.txt
|
||||
191
vendor/github.com/containerd/typeurl/LICENSE
generated
vendored
191
vendor/github.com/containerd/typeurl/LICENSE
generated
vendored
@ -1,191 +0,0 @@
|
||||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
https://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
Copyright The containerd Authors
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
20
vendor/github.com/containerd/typeurl/README.md
generated
vendored
20
vendor/github.com/containerd/typeurl/README.md
generated
vendored
@ -1,20 +0,0 @@
|
||||
# typeurl
|
||||
|
||||
[](https://pkg.go.dev/github.com/containerd/typeurl)
|
||||
[](https://github.com/containerd/typeurl/actions?query=workflow%3ACI)
|
||||
[](https://codecov.io/gh/containerd/typeurl)
|
||||
[](https://goreportcard.com/report/github.com/containerd/typeurl)
|
||||
|
||||
A Go package for managing the registration, marshaling, and unmarshaling of encoded types.
|
||||
|
||||
This package helps when types are sent over a GRPC API and marshaled as a [protobuf.Any](https://github.com/gogo/protobuf/blob/master/protobuf/google/protobuf/any.proto).
|
||||
|
||||
## Project details
|
||||
|
||||
**typeurl** is a containerd sub-project, licensed under the [Apache 2.0 license](./LICENSE).
|
||||
As a containerd sub-project, you will find the:
|
||||
* [Project governance](https://github.com/containerd/project/blob/master/GOVERNANCE.md),
|
||||
* [Maintainers](https://github.com/containerd/project/blob/master/MAINTAINERS),
|
||||
* and [Contributing guidelines](https://github.com/containerd/project/blob/master/CONTRIBUTING.md)
|
||||
|
||||
information in our [`containerd/project`](https://github.com/containerd/project) repository.
|
||||
83
vendor/github.com/containerd/typeurl/doc.go
generated
vendored
83
vendor/github.com/containerd/typeurl/doc.go
generated
vendored
@ -1,83 +0,0 @@
|
||||
/*
|
||||
Copyright The containerd Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package typeurl
|
||||
|
||||
// Package typeurl assists with managing the registration, marshaling, and
|
||||
// unmarshaling of types encoded as protobuf.Any.
|
||||
//
|
||||
// A protobuf.Any is a proto message that can contain any arbitrary data. It
|
||||
// consists of two components, a TypeUrl and a Value, and its proto definition
|
||||
// looks like this:
|
||||
//
|
||||
// message Any {
|
||||
// string type_url = 1;
|
||||
// bytes value = 2;
|
||||
// }
|
||||
//
|
||||
// The TypeUrl is used to distinguish the contents from other proto.Any
|
||||
// messages. This typeurl library manages these URLs to enable automagic
|
||||
// marshaling and unmarshaling of the contents.
|
||||
//
|
||||
// For example, consider this go struct:
|
||||
//
|
||||
// type Foo struct {
|
||||
// Field1 string
|
||||
// Field2 string
|
||||
// }
|
||||
//
|
||||
// To use typeurl, types must first be registered. This is typically done in
|
||||
// the init function
|
||||
//
|
||||
// func init() {
|
||||
// typeurl.Register(&Foo{}, "Foo")
|
||||
// }
|
||||
//
|
||||
// This will register the type Foo with the url path "Foo". The arguments to
|
||||
// Register are variadic, and are used to construct a url path. Consider this
|
||||
// example, from the github.com/containerd/containerd/client package:
|
||||
//
|
||||
// func init() {
|
||||
// const prefix = "types.containerd.io"
|
||||
// // register TypeUrls for commonly marshaled external types
|
||||
// major := strconv.Itoa(specs.VersionMajor)
|
||||
// typeurl.Register(&specs.Spec{}, prefix, "opencontainers/runtime-spec", major, "Spec")
|
||||
// // this function has more Register calls, which are elided.
|
||||
// }
|
||||
//
|
||||
// This registers several types under a more complex url, which ends up mapping
|
||||
// to `types.containerd.io/opencontainers/runtime-spec/1/Spec` (or some other
|
||||
// value for major).
|
||||
//
|
||||
// Once a type is registered, it can be marshaled to a proto.Any message simply
|
||||
// by calling `MarshalAny`, like this:
|
||||
//
|
||||
// foo := &Foo{Field1: "value1", Field2: "value2"}
|
||||
// anyFoo, err := typeurl.MarshalAny(foo)
|
||||
//
|
||||
// MarshalAny will resolve the correct URL for the type. If the type in
|
||||
// question implements the proto.Message interface, then it will be marshaled
|
||||
// as a proto message. Otherwise, it will be marshaled as json. This means that
|
||||
// typeurl will work on any arbitrary data, whether or not it has a proto
|
||||
// definition, as long as it can be serialized to json.
|
||||
//
|
||||
// To unmarshal, the process is simply inverse:
|
||||
//
|
||||
// iface, err := typeurl.UnmarshalAny(anyFoo)
|
||||
// foo := iface.(*Foo)
|
||||
//
|
||||
// The correct type is automatically chosen from the type registry, and the
|
||||
// returned interface can be cast straight to that type.
|
||||
214
vendor/github.com/containerd/typeurl/types.go
generated
vendored
214
vendor/github.com/containerd/typeurl/types.go
generated
vendored
@ -1,214 +0,0 @@
|
||||
/*
|
||||
Copyright The containerd Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package typeurl
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"path"
|
||||
"reflect"
|
||||
"sync"
|
||||
|
||||
"github.com/gogo/protobuf/proto"
|
||||
"github.com/gogo/protobuf/types"
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
var (
|
||||
mu sync.RWMutex
|
||||
registry = make(map[reflect.Type]string)
|
||||
)
|
||||
|
||||
// Definitions of common error types used throughout typeurl.
|
||||
//
|
||||
// These error types are used with errors.Wrap and errors.Wrapf to add context
|
||||
// to an error.
|
||||
//
|
||||
// To detect an error class, use errors.Is() functions to tell whether an
|
||||
// error is of this type.
|
||||
var (
|
||||
ErrNotFound = errors.New("not found")
|
||||
)
|
||||
|
||||
// Register a type with a base URL for JSON marshaling. When the MarshalAny and
|
||||
// UnmarshalAny functions are called they will treat the Any type value as JSON.
|
||||
// To use protocol buffers for handling the Any value the proto.Register
|
||||
// function should be used instead of this function.
|
||||
func Register(v interface{}, args ...string) {
|
||||
var (
|
||||
t = tryDereference(v)
|
||||
p = path.Join(args...)
|
||||
)
|
||||
mu.Lock()
|
||||
defer mu.Unlock()
|
||||
if et, ok := registry[t]; ok {
|
||||
if et != p {
|
||||
panic(errors.Errorf("type registered with alternate path %q != %q", et, p))
|
||||
}
|
||||
return
|
||||
}
|
||||
registry[t] = p
|
||||
}
|
||||
|
||||
// TypeURL returns the type url for a registered type.
|
||||
func TypeURL(v interface{}) (string, error) {
|
||||
mu.RLock()
|
||||
u, ok := registry[tryDereference(v)]
|
||||
mu.RUnlock()
|
||||
if !ok {
|
||||
// fallback to the proto registry if it is a proto message
|
||||
pb, ok := v.(proto.Message)
|
||||
if !ok {
|
||||
return "", errors.Wrapf(ErrNotFound, "type %s", reflect.TypeOf(v))
|
||||
}
|
||||
return proto.MessageName(pb), nil
|
||||
}
|
||||
return u, nil
|
||||
}
|
||||
|
||||
// Is returns true if the type of the Any is the same as v.
|
||||
func Is(any *types.Any, v interface{}) bool {
|
||||
// call to check that v is a pointer
|
||||
tryDereference(v)
|
||||
url, err := TypeURL(v)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
return any.TypeUrl == url
|
||||
}
|
||||
|
||||
// MarshalAny marshals the value v into an any with the correct TypeUrl.
|
||||
// If the provided object is already a proto.Any message, then it will be
|
||||
// returned verbatim. If it is of type proto.Message, it will be marshaled as a
|
||||
// protocol buffer. Otherwise, the object will be marshaled to json.
|
||||
func MarshalAny(v interface{}) (*types.Any, error) {
|
||||
var marshal func(v interface{}) ([]byte, error)
|
||||
switch t := v.(type) {
|
||||
case *types.Any:
|
||||
// avoid reserializing the type if we have an any.
|
||||
return t, nil
|
||||
case proto.Message:
|
||||
marshal = func(v interface{}) ([]byte, error) {
|
||||
return proto.Marshal(t)
|
||||
}
|
||||
default:
|
||||
marshal = json.Marshal
|
||||
}
|
||||
|
||||
url, err := TypeURL(v)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
data, err := marshal(v)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &types.Any{
|
||||
TypeUrl: url,
|
||||
Value: data,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// UnmarshalAny unmarshals the any type into a concrete type.
|
||||
func UnmarshalAny(any *types.Any) (interface{}, error) {
|
||||
return UnmarshalByTypeURL(any.TypeUrl, any.Value)
|
||||
}
|
||||
|
||||
// UnmarshalByTypeURL unmarshals the given type and value to into a concrete type.
|
||||
func UnmarshalByTypeURL(typeURL string, value []byte) (interface{}, error) {
|
||||
return unmarshal(typeURL, value, nil)
|
||||
}
|
||||
|
||||
// UnmarshalTo unmarshals the any type into a concrete type passed in the out
|
||||
// argument. It is identical to UnmarshalAny, but lets clients provide a
|
||||
// destination type through the out argument.
|
||||
func UnmarshalTo(any *types.Any, out interface{}) error {
|
||||
return UnmarshalToByTypeURL(any.TypeUrl, any.Value, out)
|
||||
}
|
||||
|
||||
// UnmarshalTo unmarshals the given type and value into a concrete type passed
|
||||
// in the out argument. It is identical to UnmarshalByTypeURL, but lets clients
|
||||
// provide a destination type through the out argument.
|
||||
func UnmarshalToByTypeURL(typeURL string, value []byte, out interface{}) error {
|
||||
_, err := unmarshal(typeURL, value, out)
|
||||
return err
|
||||
}
|
||||
|
||||
func unmarshal(typeURL string, value []byte, v interface{}) (interface{}, error) {
|
||||
t, err := getTypeByUrl(typeURL)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if v == nil {
|
||||
v = reflect.New(t.t).Interface()
|
||||
} else {
|
||||
// Validate interface type provided by client
|
||||
vURL, err := TypeURL(v)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if typeURL != vURL {
|
||||
return nil, errors.Errorf("can't unmarshal type %q to output %q", typeURL, vURL)
|
||||
}
|
||||
}
|
||||
|
||||
if t.isProto {
|
||||
err = proto.Unmarshal(value, v.(proto.Message))
|
||||
} else {
|
||||
err = json.Unmarshal(value, v)
|
||||
}
|
||||
|
||||
return v, err
|
||||
}
|
||||
|
||||
type urlType struct {
|
||||
t reflect.Type
|
||||
isProto bool
|
||||
}
|
||||
|
||||
func getTypeByUrl(url string) (urlType, error) {
|
||||
mu.RLock()
|
||||
for t, u := range registry {
|
||||
if u == url {
|
||||
mu.RUnlock()
|
||||
return urlType{
|
||||
t: t,
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
mu.RUnlock()
|
||||
// fallback to proto registry
|
||||
t := proto.MessageType(url)
|
||||
if t != nil {
|
||||
return urlType{
|
||||
// get the underlying Elem because proto returns a pointer to the type
|
||||
t: t.Elem(),
|
||||
isProto: true,
|
||||
}, nil
|
||||
}
|
||||
return urlType{}, errors.Wrapf(ErrNotFound, "type with url %s", url)
|
||||
}
|
||||
|
||||
func tryDereference(v interface{}) reflect.Type {
|
||||
t := reflect.TypeOf(v)
|
||||
if t.Kind() == reflect.Ptr {
|
||||
// require check of pointer but dereference to register
|
||||
return t.Elem()
|
||||
}
|
||||
panic("v is not a pointer to a type")
|
||||
}
|
||||
29
vendor/github.com/containers/ocicrypt/.travis.yml
generated
vendored
29
vendor/github.com/containers/ocicrypt/.travis.yml
generated
vendored
@ -1,29 +0,0 @@
|
||||
dist: bionic
|
||||
language: go
|
||||
|
||||
os:
|
||||
- linux
|
||||
|
||||
go:
|
||||
- "1.13.x"
|
||||
- "1.16.x"
|
||||
|
||||
matrix:
|
||||
include:
|
||||
- os: linux
|
||||
|
||||
addons:
|
||||
apt:
|
||||
packages:
|
||||
- gnutls-bin
|
||||
- softhsm2
|
||||
|
||||
go_import_path: github.com/containers/ocicrypt
|
||||
|
||||
install:
|
||||
- curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.46.2
|
||||
|
||||
script:
|
||||
- make
|
||||
- make check
|
||||
- make test
|
||||
10
vendor/github.com/containers/ocicrypt/ADOPTERS.md
generated
vendored
10
vendor/github.com/containers/ocicrypt/ADOPTERS.md
generated
vendored
@ -1,10 +0,0 @@
|
||||
Below are list of adopters of the `ocicrypt` library or supports use of OCI encrypted images:
|
||||
- [skopeo](https://github.com/containers/skopeo)
|
||||
- [buildah](https://github.com/containers/buildah)
|
||||
- [containerd](https://github.com/containerd/imgcrypt)
|
||||
- [nerdctl](https://github.com/containerd/nerdctl)
|
||||
- [distribution](https://github.com/distribution/distribution)
|
||||
|
||||
Below are the list of projects that are in the process of adopting support:
|
||||
- [quay](https://github.com/quay/quay)
|
||||
- [kata-containers](https://github.com/kata-containers/kata-containers)
|
||||
3
vendor/github.com/containers/ocicrypt/CODE-OF-CONDUCT.md
generated
vendored
3
vendor/github.com/containers/ocicrypt/CODE-OF-CONDUCT.md
generated
vendored
@ -1,3 +0,0 @@
|
||||
## The OCIcrypt Library Project Community Code of Conduct
|
||||
|
||||
The OCIcrypt Library project follows the [Containers Community Code of Conduct](https://github.com/containers/common/blob/master/CODE-OF-CONDUCT.md).
|
||||
189
vendor/github.com/containers/ocicrypt/LICENSE
generated
vendored
189
vendor/github.com/containers/ocicrypt/LICENSE
generated
vendored
@ -1,189 +0,0 @@
|
||||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
https://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
https://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
6
vendor/github.com/containers/ocicrypt/MAINTAINERS
generated
vendored
6
vendor/github.com/containers/ocicrypt/MAINTAINERS
generated
vendored
@ -1,6 +0,0 @@
|
||||
# ocicrypt maintainers
|
||||
#
|
||||
# Github ID, Name, Email Address
|
||||
lumjjb, Brandon Lum, lumjjb@gmail.com
|
||||
stefanberger, Stefan Berger, stefanb@linux.ibm.com
|
||||
arronwy, Arron Wang, arron.wang@intel.com
|
||||
34
vendor/github.com/containers/ocicrypt/Makefile
generated
vendored
34
vendor/github.com/containers/ocicrypt/Makefile
generated
vendored
@ -1,34 +0,0 @@
|
||||
# Copyright The containerd Authors.
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
.PHONY: check build decoder generate-protobuf
|
||||
|
||||
all: build
|
||||
|
||||
FORCE:
|
||||
|
||||
check:
|
||||
golangci-lint run
|
||||
|
||||
build: vendor
|
||||
go build ./...
|
||||
|
||||
vendor:
|
||||
go mod tidy
|
||||
|
||||
test:
|
||||
go test ./... -test.v
|
||||
|
||||
generate-protobuf:
|
||||
protoc -I utils/keyprovider/ utils/keyprovider/keyprovider.proto --go_out=plugins=grpc:utils/keyprovider
|
||||
50
vendor/github.com/containers/ocicrypt/README.md
generated
vendored
50
vendor/github.com/containers/ocicrypt/README.md
generated
vendored
@ -1,50 +0,0 @@
|
||||
# OCIcrypt Library
|
||||
|
||||
The `ocicrypt` library is the OCI image spec implementation of container image encryption. More details of the spec can be seen in the [OCI repository](https://github.com/opencontainers/image-spec/pull/775). The purpose of this library is to encode spec structures and consts in code, as well as provide a consistent implementation of image encryption across container runtimes and build tools.
|
||||
|
||||
Consumers of OCIcrypt:
|
||||
|
||||
- [containerd/imgcrypt](https://github.com/containerd/imgcrypt)
|
||||
- [cri-o](https://github.com/cri-o/cri-o)
|
||||
- [skopeo](https://github.com/containers/skopeo)
|
||||
|
||||
|
||||
## Usage
|
||||
|
||||
There are various levels of usage for this library. The main consumers of these would be runtime/build tools, and a more specific use would be in the ability to extend cryptographic function.
|
||||
|
||||
### Runtime/Build tool usage
|
||||
|
||||
The general exposed interface a runtime/build tool would use, would be to perform encryption or decryption of layers:
|
||||
|
||||
```
|
||||
package "github.com/containers/ocicrypt"
|
||||
func EncryptLayer(ec *config.EncryptConfig, encOrPlainLayerReader io.Reader, desc ocispec.Descriptor) (io.Reader, EncryptLayerFinalizer, error)
|
||||
func DecryptLayer(dc *config.DecryptConfig, encLayerReader io.Reader, desc ocispec.Descriptor, unwrapOnly bool) (io.Reader, digest.Digest, error)
|
||||
```
|
||||
|
||||
The settings/parameters to these functions can be specified via creation of an encryption config with the `github.com/containers/ocicrypt/config` package. We note that because setting of annotations and other fields of the layer descriptor is done through various means in different runtimes/build tools, it is the responsibility of the caller to still ensure that the layer descriptor follows the OCI specification (i.e. encoding, setting annotations, etc.).
|
||||
|
||||
|
||||
### Crypto Agility and Extensibility
|
||||
|
||||
The implementation for both symmetric and asymmetric encryption used in this library are behind 2 main interfaces, which users can extend if need be. These are in the following packages:
|
||||
- github.com/containers/ocicrypt/blockcipher - LayerBlockCipher interface for block ciphers
|
||||
- github.com/containers/ocicrypt/keywrap - KeyWrapper interface for key wrapping
|
||||
|
||||
We note that adding interfaces here is risky outside the OCI spec is not recommended, unless for very specialized and confined usecases. Please open an issue or PR if there is a general usecase that could be added to the OCI spec.
|
||||
|
||||
|
||||
#### Keyprovider interface
|
||||
|
||||
As part of the keywrap interface, there is a [keyprovider](https://github.com/containers/ocicrypt/blob/main/docs/keyprovider.md) implementation that allows one to call out to a binary or service.
|
||||
|
||||
|
||||
## Security Issues
|
||||
|
||||
We consider security issues related to this library critical. Please report and security related issues by emailing maintainers in the [MAINTAINERS](MAINTAINERS) file.
|
||||
|
||||
|
||||
## Ocicrypt Pkcs11 Support
|
||||
|
||||
Ocicrypt Pkcs11 support is currently experiemental. For more details, please refer to the [this document](docs/pkcs11.md).
|
||||
3
vendor/github.com/containers/ocicrypt/SECURITY.md
generated
vendored
3
vendor/github.com/containers/ocicrypt/SECURITY.md
generated
vendored
@ -1,3 +0,0 @@
|
||||
## Security and Disclosure Information Policy for the OCIcrypt Library Project
|
||||
|
||||
The OCIcrypt Library Project follows the [Security and Disclosure Information Policy](https://github.com/containers/common/blob/master/SECURITY.md) for the Containers Projects.
|
||||
160
vendor/github.com/containers/ocicrypt/blockcipher/blockcipher.go
generated
vendored
160
vendor/github.com/containers/ocicrypt/blockcipher/blockcipher.go
generated
vendored
@ -1,160 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package blockcipher
|
||||
|
||||
import (
|
||||
"io"
|
||||
|
||||
"github.com/opencontainers/go-digest"
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
// LayerCipherType is the ciphertype as specified in the layer metadata
|
||||
type LayerCipherType string
|
||||
|
||||
// TODO: Should be obtained from OCI spec once included
|
||||
const (
|
||||
AES256CTR LayerCipherType = "AES_256_CTR_HMAC_SHA256"
|
||||
)
|
||||
|
||||
// PrivateLayerBlockCipherOptions includes the information required to encrypt/decrypt
|
||||
// an image which are sensitive and should not be in plaintext
|
||||
type PrivateLayerBlockCipherOptions struct {
|
||||
// SymmetricKey represents the symmetric key used for encryption/decryption
|
||||
// This field should be populated by Encrypt/Decrypt calls
|
||||
SymmetricKey []byte `json:"symkey"`
|
||||
|
||||
// Digest is the digest of the original data for verification.
|
||||
// This is NOT populated by Encrypt/Decrypt calls
|
||||
Digest digest.Digest `json:"digest"`
|
||||
|
||||
// CipherOptions contains the cipher metadata used for encryption/decryption
|
||||
// This field should be populated by Encrypt/Decrypt calls
|
||||
CipherOptions map[string][]byte `json:"cipheroptions"`
|
||||
}
|
||||
|
||||
// PublicLayerBlockCipherOptions includes the information required to encrypt/decrypt
|
||||
// an image which are public and can be deduplicated in plaintext across multiple
|
||||
// recipients
|
||||
type PublicLayerBlockCipherOptions struct {
|
||||
// CipherType denotes the cipher type according to the list of OCI suppported
|
||||
// cipher types.
|
||||
CipherType LayerCipherType `json:"cipher"`
|
||||
|
||||
// Hmac contains the hmac string to help verify encryption
|
||||
Hmac []byte `json:"hmac"`
|
||||
|
||||
// CipherOptions contains the cipher metadata used for encryption/decryption
|
||||
// This field should be populated by Encrypt/Decrypt calls
|
||||
CipherOptions map[string][]byte `json:"cipheroptions"`
|
||||
}
|
||||
|
||||
// LayerBlockCipherOptions contains the public and private LayerBlockCipherOptions
|
||||
// required to encrypt/decrypt an image
|
||||
type LayerBlockCipherOptions struct {
|
||||
Public PublicLayerBlockCipherOptions
|
||||
Private PrivateLayerBlockCipherOptions
|
||||
}
|
||||
|
||||
// LayerBlockCipher returns a provider for encrypt/decrypt functionality
|
||||
// for handling the layer data for a specific algorithm
|
||||
type LayerBlockCipher interface {
|
||||
// GenerateKey creates a symmetric key
|
||||
GenerateKey() ([]byte, error)
|
||||
// Encrypt takes in layer data and returns the ciphertext and relevant LayerBlockCipherOptions
|
||||
Encrypt(layerDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, Finalizer, error)
|
||||
// Decrypt takes in layer ciphertext data and returns the plaintext and relevant LayerBlockCipherOptions
|
||||
Decrypt(layerDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, LayerBlockCipherOptions, error)
|
||||
}
|
||||
|
||||
// LayerBlockCipherHandler is the handler for encrypt/decrypt for layers
|
||||
type LayerBlockCipherHandler struct {
|
||||
cipherMap map[LayerCipherType]LayerBlockCipher
|
||||
}
|
||||
|
||||
// Finalizer is called after data blobs are written, and returns the LayerBlockCipherOptions for the encrypted blob
|
||||
type Finalizer func() (LayerBlockCipherOptions, error)
|
||||
|
||||
// GetOpt returns the value of the cipher option and if the option exists
|
||||
func (lbco LayerBlockCipherOptions) GetOpt(key string) (value []byte, ok bool) {
|
||||
if v, ok := lbco.Public.CipherOptions[key]; ok {
|
||||
return v, ok
|
||||
} else if v, ok := lbco.Private.CipherOptions[key]; ok {
|
||||
return v, ok
|
||||
} else {
|
||||
return nil, false
|
||||
}
|
||||
}
|
||||
|
||||
func wrapFinalizerWithType(fin Finalizer, typ LayerCipherType) Finalizer {
|
||||
return func() (LayerBlockCipherOptions, error) {
|
||||
lbco, err := fin()
|
||||
if err != nil {
|
||||
return LayerBlockCipherOptions{}, err
|
||||
}
|
||||
lbco.Public.CipherType = typ
|
||||
return lbco, err
|
||||
}
|
||||
}
|
||||
|
||||
// Encrypt is the handler for the layer decryption routine
|
||||
func (h *LayerBlockCipherHandler) Encrypt(plainDataReader io.Reader, typ LayerCipherType) (io.Reader, Finalizer, error) {
|
||||
if c, ok := h.cipherMap[typ]; ok {
|
||||
sk, err := c.GenerateKey()
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
opt := LayerBlockCipherOptions{
|
||||
Private: PrivateLayerBlockCipherOptions{
|
||||
SymmetricKey: sk,
|
||||
},
|
||||
}
|
||||
encDataReader, fin, err := c.Encrypt(plainDataReader, opt)
|
||||
if err == nil {
|
||||
fin = wrapFinalizerWithType(fin, typ)
|
||||
}
|
||||
return encDataReader, fin, err
|
||||
}
|
||||
return nil, nil, errors.Errorf("unsupported cipher type: %s", typ)
|
||||
}
|
||||
|
||||
// Decrypt is the handler for the layer decryption routine
|
||||
func (h *LayerBlockCipherHandler) Decrypt(encDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, LayerBlockCipherOptions, error) {
|
||||
typ := opt.Public.CipherType
|
||||
if typ == "" {
|
||||
return nil, LayerBlockCipherOptions{}, errors.New("no cipher type provided")
|
||||
}
|
||||
if c, ok := h.cipherMap[LayerCipherType(typ)]; ok {
|
||||
return c.Decrypt(encDataReader, opt)
|
||||
}
|
||||
return nil, LayerBlockCipherOptions{}, errors.Errorf("unsupported cipher type: %s", typ)
|
||||
}
|
||||
|
||||
// NewLayerBlockCipherHandler returns a new default handler
|
||||
func NewLayerBlockCipherHandler() (*LayerBlockCipherHandler, error) {
|
||||
h := LayerBlockCipherHandler{
|
||||
cipherMap: map[LayerCipherType]LayerBlockCipher{},
|
||||
}
|
||||
|
||||
var err error
|
||||
h.cipherMap[AES256CTR], err = NewAESCTRLayerBlockCipher(256)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "unable to set up Cipher AES-256-CTR")
|
||||
}
|
||||
|
||||
return &h, nil
|
||||
}
|
||||
193
vendor/github.com/containers/ocicrypt/blockcipher/blockcipher_aes_ctr.go
generated
vendored
193
vendor/github.com/containers/ocicrypt/blockcipher/blockcipher_aes_ctr.go
generated
vendored
@ -1,193 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package blockcipher
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"crypto/hmac"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"fmt"
|
||||
"hash"
|
||||
"io"
|
||||
|
||||
"github.com/containers/ocicrypt/utils"
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
// AESCTRLayerBlockCipher implements the AES CTR stream cipher
|
||||
type AESCTRLayerBlockCipher struct {
|
||||
keylen int // in bytes
|
||||
reader io.Reader
|
||||
encrypt bool
|
||||
stream cipher.Stream
|
||||
err error
|
||||
hmac hash.Hash
|
||||
expHmac []byte
|
||||
doneEncrypting bool
|
||||
}
|
||||
|
||||
type aesctrcryptor struct {
|
||||
bc *AESCTRLayerBlockCipher
|
||||
}
|
||||
|
||||
// NewAESCTRLayerBlockCipher returns a new AES SIV block cipher of 256 or 512 bits
|
||||
func NewAESCTRLayerBlockCipher(bits int) (LayerBlockCipher, error) {
|
||||
if bits != 256 {
|
||||
return nil, errors.New("AES CTR bit count not supported")
|
||||
}
|
||||
return &AESCTRLayerBlockCipher{keylen: bits / 8}, nil
|
||||
}
|
||||
|
||||
func (r *aesctrcryptor) Read(p []byte) (int, error) {
|
||||
var (
|
||||
o int
|
||||
)
|
||||
|
||||
if r.bc.err != nil {
|
||||
return 0, r.bc.err
|
||||
}
|
||||
|
||||
o, err := utils.FillBuffer(r.bc.reader, p)
|
||||
if err != nil {
|
||||
if err == io.EOF {
|
||||
r.bc.err = err
|
||||
} else {
|
||||
return 0, err
|
||||
}
|
||||
}
|
||||
|
||||
if !r.bc.encrypt {
|
||||
if _, err := r.bc.hmac.Write(p[:o]); err != nil {
|
||||
r.bc.err = errors.Wrapf(err, "could not write to hmac")
|
||||
return 0, r.bc.err
|
||||
}
|
||||
|
||||
if r.bc.err == io.EOF {
|
||||
// Before we return EOF we let the HMAC comparison
|
||||
// provide a verdict
|
||||
if !hmac.Equal(r.bc.hmac.Sum(nil), r.bc.expHmac) {
|
||||
r.bc.err = fmt.Errorf("could not properly decrypt byte stream; exp hmac: '%x', actual hmac: '%s'", r.bc.expHmac, r.bc.hmac.Sum(nil))
|
||||
return 0, r.bc.err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
r.bc.stream.XORKeyStream(p[:o], p[:o])
|
||||
|
||||
if r.bc.encrypt {
|
||||
if _, err := r.bc.hmac.Write(p[:o]); err != nil {
|
||||
r.bc.err = errors.Wrapf(err, "could not write to hmac")
|
||||
return 0, r.bc.err
|
||||
}
|
||||
|
||||
if r.bc.err == io.EOF {
|
||||
// Final data encrypted; Do the 'then-MAC' part
|
||||
r.bc.doneEncrypting = true
|
||||
}
|
||||
}
|
||||
|
||||
return o, r.bc.err
|
||||
}
|
||||
|
||||
// init initializes an instance
|
||||
func (bc *AESCTRLayerBlockCipher) init(encrypt bool, reader io.Reader, opts LayerBlockCipherOptions) (LayerBlockCipherOptions, error) {
|
||||
var (
|
||||
err error
|
||||
)
|
||||
|
||||
key := opts.Private.SymmetricKey
|
||||
if len(key) != bc.keylen {
|
||||
return LayerBlockCipherOptions{}, fmt.Errorf("invalid key length of %d bytes; need %d bytes", len(key), bc.keylen)
|
||||
}
|
||||
|
||||
nonce, ok := opts.GetOpt("nonce")
|
||||
if !ok {
|
||||
nonce = make([]byte, aes.BlockSize)
|
||||
if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
|
||||
return LayerBlockCipherOptions{}, errors.Wrap(err, "unable to generate random nonce")
|
||||
}
|
||||
}
|
||||
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return LayerBlockCipherOptions{}, errors.Wrap(err, "aes.NewCipher failed")
|
||||
}
|
||||
|
||||
bc.reader = reader
|
||||
bc.encrypt = encrypt
|
||||
bc.stream = cipher.NewCTR(block, nonce)
|
||||
bc.err = nil
|
||||
bc.hmac = hmac.New(sha256.New, key)
|
||||
bc.expHmac = opts.Public.Hmac
|
||||
bc.doneEncrypting = false
|
||||
|
||||
if !encrypt && len(bc.expHmac) == 0 {
|
||||
return LayerBlockCipherOptions{}, errors.New("HMAC is not provided for decryption process")
|
||||
}
|
||||
|
||||
lbco := LayerBlockCipherOptions{
|
||||
Private: PrivateLayerBlockCipherOptions{
|
||||
SymmetricKey: key,
|
||||
CipherOptions: map[string][]byte{
|
||||
"nonce": nonce,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
return lbco, nil
|
||||
}
|
||||
|
||||
// GenerateKey creates a synmmetric key
|
||||
func (bc *AESCTRLayerBlockCipher) GenerateKey() ([]byte, error) {
|
||||
key := make([]byte, bc.keylen)
|
||||
if _, err := io.ReadFull(rand.Reader, key); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return key, nil
|
||||
}
|
||||
|
||||
// Encrypt takes in layer data and returns the ciphertext and relevant LayerBlockCipherOptions
|
||||
func (bc *AESCTRLayerBlockCipher) Encrypt(plainDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, Finalizer, error) {
|
||||
lbco, err := bc.init(true, plainDataReader, opt)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
finalizer := func() (LayerBlockCipherOptions, error) {
|
||||
if !bc.doneEncrypting {
|
||||
return LayerBlockCipherOptions{}, errors.New("Read()ing not complete, unable to finalize")
|
||||
}
|
||||
if lbco.Public.CipherOptions == nil {
|
||||
lbco.Public.CipherOptions = map[string][]byte{}
|
||||
}
|
||||
lbco.Public.Hmac = bc.hmac.Sum(nil)
|
||||
return lbco, nil
|
||||
}
|
||||
return &aesctrcryptor{bc}, finalizer, nil
|
||||
}
|
||||
|
||||
// Decrypt takes in layer ciphertext data and returns the plaintext and relevant LayerBlockCipherOptions
|
||||
func (bc *AESCTRLayerBlockCipher) Decrypt(encDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, LayerBlockCipherOptions, error) {
|
||||
lbco, err := bc.init(false, encDataReader, opt)
|
||||
if err != nil {
|
||||
return nil, LayerBlockCipherOptions{}, err
|
||||
}
|
||||
|
||||
return utils.NewDelayedReader(&aesctrcryptor{bc}, 1024*10), lbco, nil
|
||||
}
|
||||
114
vendor/github.com/containers/ocicrypt/config/config.go
generated
vendored
114
vendor/github.com/containers/ocicrypt/config/config.go
generated
vendored
@ -1,114 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package config
|
||||
|
||||
// EncryptConfig is the container image PGP encryption configuration holding
|
||||
// the identifiers of those that will be able to decrypt the container and
|
||||
// the PGP public keyring file data that contains their public keys.
|
||||
type EncryptConfig struct {
|
||||
// map holding 'gpg-recipients', 'gpg-pubkeyringfile', 'pubkeys', 'x509s'
|
||||
Parameters map[string][][]byte
|
||||
|
||||
DecryptConfig DecryptConfig
|
||||
}
|
||||
|
||||
// DecryptConfig wraps the Parameters map that holds the decryption key
|
||||
type DecryptConfig struct {
|
||||
// map holding 'privkeys', 'x509s', 'gpg-privatekeys'
|
||||
Parameters map[string][][]byte
|
||||
}
|
||||
|
||||
// CryptoConfig is a common wrapper for EncryptConfig and DecrypConfig that can
|
||||
// be passed through functions that share much code for encryption and decryption
|
||||
type CryptoConfig struct {
|
||||
EncryptConfig *EncryptConfig
|
||||
DecryptConfig *DecryptConfig
|
||||
}
|
||||
|
||||
// InitDecryption initialized a CryptoConfig object with parameters used for decryption
|
||||
func InitDecryption(dcparameters map[string][][]byte) CryptoConfig {
|
||||
return CryptoConfig{
|
||||
DecryptConfig: &DecryptConfig{
|
||||
Parameters: dcparameters,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// InitEncryption initializes a CryptoConfig object with parameters used for encryption
|
||||
// It also takes dcparameters that may be needed for decryption when adding a recipient
|
||||
// to an already encrypted image
|
||||
func InitEncryption(parameters, dcparameters map[string][][]byte) CryptoConfig {
|
||||
return CryptoConfig{
|
||||
EncryptConfig: &EncryptConfig{
|
||||
Parameters: parameters,
|
||||
DecryptConfig: DecryptConfig{
|
||||
Parameters: dcparameters,
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// CombineCryptoConfigs takes a CryptoConfig list and creates a single CryptoConfig
|
||||
// containing the crypto configuration of all the key bundles
|
||||
func CombineCryptoConfigs(ccs []CryptoConfig) CryptoConfig {
|
||||
ecparam := map[string][][]byte{}
|
||||
ecdcparam := map[string][][]byte{}
|
||||
dcparam := map[string][][]byte{}
|
||||
|
||||
for _, cc := range ccs {
|
||||
if ec := cc.EncryptConfig; ec != nil {
|
||||
addToMap(ecparam, ec.Parameters)
|
||||
addToMap(ecdcparam, ec.DecryptConfig.Parameters)
|
||||
}
|
||||
|
||||
if dc := cc.DecryptConfig; dc != nil {
|
||||
addToMap(dcparam, dc.Parameters)
|
||||
}
|
||||
}
|
||||
|
||||
return CryptoConfig{
|
||||
EncryptConfig: &EncryptConfig{
|
||||
Parameters: ecparam,
|
||||
DecryptConfig: DecryptConfig{
|
||||
Parameters: ecdcparam,
|
||||
},
|
||||
},
|
||||
DecryptConfig: &DecryptConfig{
|
||||
Parameters: dcparam,
|
||||
},
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
// AttachDecryptConfig adds DecryptConfig to the field of EncryptConfig so that
|
||||
// the decryption parameters can be used to add recipients to an existing image
|
||||
// if the user is able to decrypt it.
|
||||
func (ec *EncryptConfig) AttachDecryptConfig(dc *DecryptConfig) {
|
||||
if dc != nil {
|
||||
addToMap(ec.DecryptConfig.Parameters, dc.Parameters)
|
||||
}
|
||||
}
|
||||
|
||||
func addToMap(orig map[string][][]byte, add map[string][][]byte) {
|
||||
for k, v := range add {
|
||||
if ov, ok := orig[k]; ok {
|
||||
orig[k] = append(ov, v...)
|
||||
} else {
|
||||
orig[k] = v
|
||||
}
|
||||
}
|
||||
}
|
||||
245
vendor/github.com/containers/ocicrypt/config/constructors.go
generated
vendored
245
vendor/github.com/containers/ocicrypt/config/constructors.go
generated
vendored
@ -1,245 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package config
|
||||
|
||||
import (
|
||||
"github.com/containers/ocicrypt/crypto/pkcs11"
|
||||
"strings"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
"gopkg.in/yaml.v3"
|
||||
)
|
||||
|
||||
// EncryptWithJwe returns a CryptoConfig to encrypt with jwe public keys
|
||||
func EncryptWithJwe(pubKeys [][]byte) (CryptoConfig, error) {
|
||||
dc := DecryptConfig{}
|
||||
ep := map[string][][]byte{
|
||||
"pubkeys": pubKeys,
|
||||
}
|
||||
|
||||
return CryptoConfig{
|
||||
EncryptConfig: &EncryptConfig{
|
||||
Parameters: ep,
|
||||
DecryptConfig: dc,
|
||||
},
|
||||
DecryptConfig: &dc,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// EncryptWithPkcs7 returns a CryptoConfig to encrypt with pkcs7 x509 certs
|
||||
func EncryptWithPkcs7(x509s [][]byte) (CryptoConfig, error) {
|
||||
dc := DecryptConfig{}
|
||||
|
||||
ep := map[string][][]byte{
|
||||
"x509s": x509s,
|
||||
}
|
||||
|
||||
return CryptoConfig{
|
||||
EncryptConfig: &EncryptConfig{
|
||||
Parameters: ep,
|
||||
DecryptConfig: dc,
|
||||
},
|
||||
DecryptConfig: &dc,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// EncryptWithGpg returns a CryptoConfig to encrypt with configured gpg parameters
|
||||
func EncryptWithGpg(gpgRecipients [][]byte, gpgPubRingFile []byte) (CryptoConfig, error) {
|
||||
dc := DecryptConfig{}
|
||||
ep := map[string][][]byte{
|
||||
"gpg-recipients": gpgRecipients,
|
||||
"gpg-pubkeyringfile": {gpgPubRingFile},
|
||||
}
|
||||
|
||||
return CryptoConfig{
|
||||
EncryptConfig: &EncryptConfig{
|
||||
Parameters: ep,
|
||||
DecryptConfig: dc,
|
||||
},
|
||||
DecryptConfig: &dc,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// EncryptWithPkcs11 returns a CryptoConfig to encrypt with configured pkcs11 parameters
|
||||
func EncryptWithPkcs11(pkcs11Config *pkcs11.Pkcs11Config, pkcs11Pubkeys, pkcs11Yamls [][]byte) (CryptoConfig, error) {
|
||||
dc := DecryptConfig{}
|
||||
ep := map[string][][]byte{}
|
||||
|
||||
if len(pkcs11Yamls) > 0 {
|
||||
if pkcs11Config == nil {
|
||||
return CryptoConfig{}, errors.New("pkcs11Config must not be nil")
|
||||
}
|
||||
p11confYaml, err := yaml.Marshal(pkcs11Config)
|
||||
if err != nil {
|
||||
return CryptoConfig{}, errors.Wrapf(err, "Could not marshal Pkcs11Config to Yaml")
|
||||
}
|
||||
|
||||
dc = DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"pkcs11-config": {p11confYaml},
|
||||
},
|
||||
}
|
||||
ep["pkcs11-yamls"] = pkcs11Yamls
|
||||
}
|
||||
if len(pkcs11Pubkeys) > 0 {
|
||||
ep["pkcs11-pubkeys"] = pkcs11Pubkeys
|
||||
}
|
||||
|
||||
return CryptoConfig{
|
||||
EncryptConfig: &EncryptConfig{
|
||||
Parameters: ep,
|
||||
DecryptConfig: dc,
|
||||
},
|
||||
DecryptConfig: &dc,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// EncryptWithKeyProvider returns a CryptoConfig to encrypt with configured keyprovider parameters
|
||||
func EncryptWithKeyProvider(keyProviders [][]byte) (CryptoConfig, error) {
|
||||
dc := DecryptConfig{}
|
||||
ep := make(map[string][][]byte)
|
||||
for _, keyProvider := range keyProviders {
|
||||
keyProvidersStr := string(keyProvider)
|
||||
idx := strings.Index(keyProvidersStr, ":")
|
||||
if idx > 0 {
|
||||
ep[keyProvidersStr[:idx]] = append(ep[keyProvidersStr[:idx]], []byte(keyProvidersStr[idx+1:]))
|
||||
} else {
|
||||
ep[keyProvidersStr] = append(ep[keyProvidersStr], []byte("Enabled"))
|
||||
}
|
||||
}
|
||||
|
||||
return CryptoConfig{
|
||||
EncryptConfig: &EncryptConfig{
|
||||
Parameters: ep,
|
||||
DecryptConfig: dc,
|
||||
},
|
||||
DecryptConfig: &dc,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// DecryptWithKeyProvider returns a CryptoConfig to decrypt with configured keyprovider parameters
|
||||
func DecryptWithKeyProvider(keyProviders [][]byte) (CryptoConfig, error) {
|
||||
dp := make(map[string][][]byte)
|
||||
ep := map[string][][]byte{}
|
||||
for _, keyProvider := range keyProviders {
|
||||
keyProvidersStr := string(keyProvider)
|
||||
idx := strings.Index(keyProvidersStr, ":")
|
||||
if idx > 0 {
|
||||
dp[keyProvidersStr[:idx]] = append(dp[keyProvidersStr[:idx]], []byte(keyProvidersStr[idx+1:]))
|
||||
} else {
|
||||
dp[keyProvidersStr] = append(dp[keyProvidersStr], []byte("Enabled"))
|
||||
}
|
||||
}
|
||||
dc := DecryptConfig{
|
||||
Parameters: dp,
|
||||
}
|
||||
return CryptoConfig{
|
||||
EncryptConfig: &EncryptConfig{
|
||||
Parameters: ep,
|
||||
DecryptConfig: dc,
|
||||
},
|
||||
DecryptConfig: &dc,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// DecryptWithPrivKeys returns a CryptoConfig to decrypt with configured private keys
|
||||
func DecryptWithPrivKeys(privKeys [][]byte, privKeysPasswords [][]byte) (CryptoConfig, error) {
|
||||
if len(privKeys) != len(privKeysPasswords) {
|
||||
return CryptoConfig{}, errors.New("Length of privKeys should match length of privKeysPasswords")
|
||||
}
|
||||
|
||||
dc := DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"privkeys": privKeys,
|
||||
"privkeys-passwords": privKeysPasswords,
|
||||
},
|
||||
}
|
||||
|
||||
ep := map[string][][]byte{}
|
||||
|
||||
return CryptoConfig{
|
||||
EncryptConfig: &EncryptConfig{
|
||||
Parameters: ep,
|
||||
DecryptConfig: dc,
|
||||
},
|
||||
DecryptConfig: &dc,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// DecryptWithX509s returns a CryptoConfig to decrypt with configured x509 certs
|
||||
func DecryptWithX509s(x509s [][]byte) (CryptoConfig, error) {
|
||||
dc := DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"x509s": x509s,
|
||||
},
|
||||
}
|
||||
|
||||
ep := map[string][][]byte{}
|
||||
|
||||
return CryptoConfig{
|
||||
EncryptConfig: &EncryptConfig{
|
||||
Parameters: ep,
|
||||
DecryptConfig: dc,
|
||||
},
|
||||
DecryptConfig: &dc,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// DecryptWithGpgPrivKeys returns a CryptoConfig to decrypt with configured gpg private keys
|
||||
func DecryptWithGpgPrivKeys(gpgPrivKeys, gpgPrivKeysPwds [][]byte) (CryptoConfig, error) {
|
||||
dc := DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"gpg-privatekeys": gpgPrivKeys,
|
||||
"gpg-privatekeys-passwords": gpgPrivKeysPwds,
|
||||
},
|
||||
}
|
||||
|
||||
ep := map[string][][]byte{}
|
||||
|
||||
return CryptoConfig{
|
||||
EncryptConfig: &EncryptConfig{
|
||||
Parameters: ep,
|
||||
DecryptConfig: dc,
|
||||
},
|
||||
DecryptConfig: &dc,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// DecryptWithPkcs11Yaml returns a CryptoConfig to decrypt with pkcs11 YAML formatted key files
|
||||
func DecryptWithPkcs11Yaml(pkcs11Config *pkcs11.Pkcs11Config, pkcs11Yamls [][]byte) (CryptoConfig, error) {
|
||||
p11confYaml, err := yaml.Marshal(pkcs11Config)
|
||||
if err != nil {
|
||||
return CryptoConfig{}, errors.Wrapf(err, "Could not marshal Pkcs11Config to Yaml")
|
||||
}
|
||||
|
||||
dc := DecryptConfig{
|
||||
Parameters: map[string][][]byte{
|
||||
"pkcs11-yamls": pkcs11Yamls,
|
||||
"pkcs11-config": {p11confYaml},
|
||||
},
|
||||
}
|
||||
|
||||
ep := map[string][][]byte{}
|
||||
|
||||
return CryptoConfig{
|
||||
EncryptConfig: &EncryptConfig{
|
||||
Parameters: ep,
|
||||
DecryptConfig: dc,
|
||||
},
|
||||
DecryptConfig: &dc,
|
||||
}, nil
|
||||
}
|
||||
81
vendor/github.com/containers/ocicrypt/config/keyprovider-config/config.go
generated
vendored
81
vendor/github.com/containers/ocicrypt/config/keyprovider-config/config.go
generated
vendored
@ -1,81 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package config
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"github.com/pkg/errors"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
)
|
||||
|
||||
// Command describes the structure of command, it consist of path and args, where path defines the location of
|
||||
// binary executable and args are passed on to the binary executable
|
||||
type Command struct {
|
||||
Path string `json:"path,omitempty"`
|
||||
Args []string `json:"args,omitempty"`
|
||||
}
|
||||
|
||||
// KeyProviderAttrs describes the structure of key provider, it defines the way of invocation to key provider
|
||||
type KeyProviderAttrs struct {
|
||||
Command *Command `json:"cmd,omitempty"`
|
||||
Grpc string `json:"grpc,omitempty"`
|
||||
}
|
||||
|
||||
// OcicryptConfig represents the format of an ocicrypt_provider.conf config file
|
||||
type OcicryptConfig struct {
|
||||
KeyProviderConfig map[string]KeyProviderAttrs `json:"key-providers"`
|
||||
}
|
||||
|
||||
const ENVVARNAME = "OCICRYPT_KEYPROVIDER_CONFIG"
|
||||
|
||||
// parseConfigFile parses a configuration file; it is not an error if the configuration file does
|
||||
// not exist, so no error is returned.
|
||||
func parseConfigFile(filename string) (*OcicryptConfig, error) {
|
||||
// a non-existent config file is not an error
|
||||
_, err := os.Stat(filename)
|
||||
if os.IsNotExist(err) {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
data, err := ioutil.ReadFile(filename)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
ic := &OcicryptConfig{}
|
||||
err = json.Unmarshal(data, ic)
|
||||
return ic, err
|
||||
}
|
||||
|
||||
// getConfiguration tries to read the configuration file at the following locations
|
||||
// ${OCICRYPT_KEYPROVIDER_CONFIG} == "/etc/ocicrypt_keyprovider.yaml"
|
||||
// If no configuration file could be found or read a null pointer is returned
|
||||
func GetConfiguration() (*OcicryptConfig, error) {
|
||||
var ic *OcicryptConfig
|
||||
var err error
|
||||
filename := os.Getenv(ENVVARNAME)
|
||||
if len(filename) > 0 {
|
||||
ic, err = parseConfigFile(filename)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "Error while parsing keyprovider config file")
|
||||
}
|
||||
} else {
|
||||
return nil, nil
|
||||
}
|
||||
return ic, nil
|
||||
}
|
||||
134
vendor/github.com/containers/ocicrypt/crypto/pkcs11/common.go
generated
vendored
134
vendor/github.com/containers/ocicrypt/crypto/pkcs11/common.go
generated
vendored
@ -1,134 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package pkcs11
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"github.com/pkg/errors"
|
||||
pkcs11uri "github.com/stefanberger/go-pkcs11uri"
|
||||
"gopkg.in/yaml.v3"
|
||||
)
|
||||
|
||||
// Pkcs11KeyFile describes the format of the pkcs11 (private) key file.
|
||||
// It also carries pkcs11 module related environment variables that are transferred to the
|
||||
// Pkcs11URI object and activated when the pkcs11 module is used.
|
||||
type Pkcs11KeyFile struct {
|
||||
Pkcs11 struct {
|
||||
Uri string `yaml:"uri"`
|
||||
} `yaml:"pkcs11"`
|
||||
Module struct {
|
||||
Env map[string]string `yaml:"env,omitempty"`
|
||||
} `yaml:"module"`
|
||||
}
|
||||
|
||||
// Pkcs11KeyFileObject is a representation of the Pkcs11KeyFile with the pkcs11 URI as an object
|
||||
type Pkcs11KeyFileObject struct {
|
||||
Uri *pkcs11uri.Pkcs11URI
|
||||
}
|
||||
|
||||
// ParsePkcs11Uri parses a pkcs11 URI
|
||||
func ParsePkcs11Uri(uri string) (*pkcs11uri.Pkcs11URI, error) {
|
||||
p11uri := pkcs11uri.New()
|
||||
err := p11uri.Parse(uri)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "Could not parse Pkcs11URI from file")
|
||||
}
|
||||
return p11uri, err
|
||||
}
|
||||
|
||||
// ParsePkcs11KeyFile parses a pkcs11 key file holding a pkcs11 URI describing a private key.
|
||||
// The file has the following yaml format:
|
||||
// pkcs11:
|
||||
// - uri : <pkcs11 uri>
|
||||
// An error is returned if the pkcs11 URI is malformed
|
||||
func ParsePkcs11KeyFile(yamlstr []byte) (*Pkcs11KeyFileObject, error) {
|
||||
p11keyfile := Pkcs11KeyFile{}
|
||||
|
||||
err := yaml.Unmarshal([]byte(yamlstr), &p11keyfile)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "Could not unmarshal pkcs11 keyfile")
|
||||
}
|
||||
|
||||
p11uri, err := ParsePkcs11Uri(p11keyfile.Pkcs11.Uri)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
p11uri.SetEnvMap(p11keyfile.Module.Env)
|
||||
|
||||
return &Pkcs11KeyFileObject{Uri: p11uri}, err
|
||||
}
|
||||
|
||||
// IsPkcs11PrivateKey checks whether the given YAML represents a Pkcs11 private key
|
||||
func IsPkcs11PrivateKey(yamlstr []byte) bool {
|
||||
_, err := ParsePkcs11KeyFile(yamlstr)
|
||||
return err == nil
|
||||
}
|
||||
|
||||
// IsPkcs11PublicKey checks whether the given YAML represents a Pkcs11 public key
|
||||
func IsPkcs11PublicKey(yamlstr []byte) bool {
|
||||
_, err := ParsePkcs11KeyFile(yamlstr)
|
||||
return err == nil
|
||||
}
|
||||
|
||||
// Pkcs11Config describes the layout of a pkcs11 config file
|
||||
// The file has the following yaml format:
|
||||
// module-directories:
|
||||
// - /usr/lib64/pkcs11/
|
||||
// allowd-module-paths
|
||||
// - /usr/lib64/pkcs11/libsofthsm2.so
|
||||
type Pkcs11Config struct {
|
||||
ModuleDirectories []string `yaml:"module-directories"`
|
||||
AllowedModulePaths []string `yaml:"allowed-module-paths"`
|
||||
}
|
||||
|
||||
// GetDefaultModuleDirectories returns module directories covering
|
||||
// a variety of Linux distros
|
||||
func GetDefaultModuleDirectories() []string {
|
||||
dirs := []string{
|
||||
"/usr/lib64/pkcs11/", // Fedora,RHEL,openSUSE
|
||||
"/usr/lib/pkcs11/", // Fedora,ArchLinux
|
||||
"/usr/local/lib/pkcs11/",
|
||||
"/usr/lib/softhsm/", // Debian,Ubuntu
|
||||
}
|
||||
|
||||
// Debian directory: /usr/lib/(x86_64|aarch64|arm|powerpc64le|s390x)-linux-gnu/
|
||||
hosttype, ostype, q := getHostAndOsType()
|
||||
if len(hosttype) > 0 {
|
||||
dir := fmt.Sprintf("/usr/lib/%s-%s-%s/", hosttype, ostype, q)
|
||||
dirs = append(dirs, dir)
|
||||
}
|
||||
return dirs
|
||||
}
|
||||
|
||||
// GetDefaultModuleDirectoresFormatted returns the default module directories formatted for YAML
|
||||
func GetDefaultModuleDirectoriesYaml(indent string) string {
|
||||
res := ""
|
||||
|
||||
for _, dir := range GetDefaultModuleDirectories() {
|
||||
res += indent + "- " + dir + "\n"
|
||||
}
|
||||
return res
|
||||
}
|
||||
|
||||
// ParsePkcs11ConfigFile parses a pkcs11 config file hat influences the module search behavior
|
||||
// as well as the set of modules that users are allowed to use
|
||||
func ParsePkcs11ConfigFile(yamlstr []byte) (*Pkcs11Config, error) {
|
||||
p11conf := Pkcs11Config{}
|
||||
|
||||
err := yaml.Unmarshal([]byte(yamlstr), &p11conf)
|
||||
if err != nil {
|
||||
return &p11conf, errors.Wrapf(err, "Could not parse Pkcs11Config")
|
||||
}
|
||||
return &p11conf, nil
|
||||
}
|
||||
485
vendor/github.com/containers/ocicrypt/crypto/pkcs11/pkcs11helpers.go
generated
vendored
485
vendor/github.com/containers/ocicrypt/crypto/pkcs11/pkcs11helpers.go
generated
vendored
@ -1,485 +0,0 @@
|
||||
// +build cgo
|
||||
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package pkcs11
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"crypto/rsa"
|
||||
"crypto/sha1"
|
||||
"crypto/sha256"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"hash"
|
||||
"net/url"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/miekg/pkcs11"
|
||||
"github.com/pkg/errors"
|
||||
pkcs11uri "github.com/stefanberger/go-pkcs11uri"
|
||||
)
|
||||
|
||||
var (
|
||||
// OAEPLabel defines the label we use for OAEP encryption; this cannot be changed
|
||||
OAEPLabel = []byte("")
|
||||
|
||||
// OAEPSha1Params describes the OAEP parameters with sha1 hash algorithm; needed by SoftHSM
|
||||
OAEPSha1Params = &pkcs11.OAEPParams{
|
||||
HashAlg: pkcs11.CKM_SHA_1,
|
||||
MGF: pkcs11.CKG_MGF1_SHA1,
|
||||
SourceType: pkcs11.CKZ_DATA_SPECIFIED,
|
||||
SourceData: OAEPLabel,
|
||||
}
|
||||
// OAEPSha256Params describes the OAEP parameters with sha256 hash algorithm
|
||||
OAEPSha256Params = &pkcs11.OAEPParams{
|
||||
HashAlg: pkcs11.CKM_SHA256,
|
||||
MGF: pkcs11.CKG_MGF1_SHA256,
|
||||
SourceType: pkcs11.CKZ_DATA_SPECIFIED,
|
||||
SourceData: OAEPLabel,
|
||||
}
|
||||
)
|
||||
|
||||
// rsaPublicEncryptOAEP encrypts the given plaintext with the given *rsa.PublicKey; the
|
||||
// environment variable OCICRYPT_OAEP_HASHALG can be set to 'sha1' to force usage of sha1 for OAEP (SoftHSM).
|
||||
// This function is needed by clients who are using a public key file for pkcs11 encryption
|
||||
func rsaPublicEncryptOAEP(pubKey *rsa.PublicKey, plaintext []byte) ([]byte, string, error) {
|
||||
var (
|
||||
hashfunc hash.Hash
|
||||
hashalg string
|
||||
)
|
||||
|
||||
oaephash := os.Getenv("OCICRYPT_OAEP_HASHALG")
|
||||
// The default is sha256 (previously was sha1)
|
||||
switch strings.ToLower(oaephash) {
|
||||
case "sha1":
|
||||
hashfunc = sha1.New()
|
||||
hashalg = "sha1"
|
||||
case "sha256", "":
|
||||
hashfunc = sha256.New()
|
||||
hashalg = "sha256"
|
||||
default:
|
||||
return nil, "", errors.Errorf("Unsupported OAEP hash '%s'", oaephash)
|
||||
}
|
||||
ciphertext, err := rsa.EncryptOAEP(hashfunc, rand.Reader, pubKey, plaintext, OAEPLabel)
|
||||
if err != nil {
|
||||
return nil, "", errors.Wrapf(err, "rss.EncryptOAEP failed")
|
||||
}
|
||||
|
||||
return ciphertext, hashalg, nil
|
||||
}
|
||||
|
||||
// pkcs11UriGetLoginParameters gets the parameters necessary for login from the Pkcs11URI
|
||||
// PIN and module are mandatory; slot-id is optional and if not found -1 will be returned
|
||||
// For a privateKeyOperation a PIN is required and if none is given, this function will return an error
|
||||
func pkcs11UriGetLoginParameters(p11uri *pkcs11uri.Pkcs11URI, privateKeyOperation bool) (string, string, int64, error) {
|
||||
var (
|
||||
pin string
|
||||
err error
|
||||
)
|
||||
if privateKeyOperation {
|
||||
if !p11uri.HasPIN() {
|
||||
return "", "", 0, errors.New("Missing PIN for private key operation")
|
||||
}
|
||||
}
|
||||
// some devices require a PIN to find a *public* key object, others don't
|
||||
pin, _ = p11uri.GetPIN()
|
||||
|
||||
module, err := p11uri.GetModule()
|
||||
if err != nil {
|
||||
return "", "", 0, errors.Wrap(err, "No module available in pkcs11 URI")
|
||||
}
|
||||
|
||||
slotid := int64(-1)
|
||||
|
||||
slot, ok := p11uri.GetPathAttribute("slot-id", false)
|
||||
if ok {
|
||||
slotid, err = strconv.ParseInt(slot, 10, 64)
|
||||
if err != nil {
|
||||
return "", "", 0, errors.Wrap(err, "slot-id is not a valid number")
|
||||
}
|
||||
if slotid < 0 {
|
||||
return "", "", 0, fmt.Errorf("slot-id is a negative number")
|
||||
}
|
||||
if uint64(slotid) > 0xffffffff {
|
||||
return "", "", 0, fmt.Errorf("slot-id is larger than 32 bit")
|
||||
}
|
||||
}
|
||||
|
||||
return pin, module, slotid, nil
|
||||
}
|
||||
|
||||
// pkcs11UriGetKeyIdAndLabel gets the key label by retrieving the value of the 'object' attribute
|
||||
func pkcs11UriGetKeyIdAndLabel(p11uri *pkcs11uri.Pkcs11URI) (string, string, error) {
|
||||
keyid, ok2 := p11uri.GetPathAttribute("id", false)
|
||||
label, ok1 := p11uri.GetPathAttribute("object", false)
|
||||
if !ok1 && !ok2 {
|
||||
return "", "", errors.New("Neither 'id' nor 'object' attributes were found in pkcs11 URI")
|
||||
}
|
||||
return keyid, label, nil
|
||||
}
|
||||
|
||||
// pkcs11OpenSession opens a session with a pkcs11 device at the given slot and logs in with the given PIN
|
||||
func pkcs11OpenSession(p11ctx *pkcs11.Ctx, slotid uint, pin string) (session pkcs11.SessionHandle, err error) {
|
||||
session, err = p11ctx.OpenSession(uint(slotid), pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
|
||||
if err != nil {
|
||||
return 0, errors.Wrapf(err, "OpenSession to slot %d failed", slotid)
|
||||
}
|
||||
if len(pin) > 0 {
|
||||
err = p11ctx.Login(session, pkcs11.CKU_USER, pin)
|
||||
if err != nil {
|
||||
_ = p11ctx.CloseSession(session)
|
||||
return 0, errors.Wrap(err, "Could not login to device")
|
||||
}
|
||||
}
|
||||
return session, nil
|
||||
}
|
||||
|
||||
// pkcs11UriLogin uses the given pkcs11 URI to select the pkcs11 module (share libary) and to get
|
||||
// the PIN to use for login; if the URI contains a slot-id, the given slot-id will be used, otherwise
|
||||
// one slot after the other will be attempted and the first one where login succeeds will be used
|
||||
func pkcs11UriLogin(p11uri *pkcs11uri.Pkcs11URI, privateKeyOperation bool) (ctx *pkcs11.Ctx, session pkcs11.SessionHandle, err error) {
|
||||
pin, module, slotid, err := pkcs11UriGetLoginParameters(p11uri, privateKeyOperation)
|
||||
if err != nil {
|
||||
return nil, 0, err
|
||||
}
|
||||
|
||||
p11ctx := pkcs11.New(module)
|
||||
if p11ctx == nil {
|
||||
return nil, 0, errors.New("Please check module path, input is: " + module)
|
||||
}
|
||||
|
||||
err = p11ctx.Initialize()
|
||||
if err != nil {
|
||||
p11Err := err.(pkcs11.Error)
|
||||
if p11Err != pkcs11.CKR_CRYPTOKI_ALREADY_INITIALIZED {
|
||||
return nil, 0, errors.Wrap(err, "Initialize failed")
|
||||
}
|
||||
}
|
||||
|
||||
if slotid >= 0 {
|
||||
session, err := pkcs11OpenSession(p11ctx, uint(slotid), pin)
|
||||
return p11ctx, session, err
|
||||
} else {
|
||||
slots, err := p11ctx.GetSlotList(true)
|
||||
if err != nil {
|
||||
return nil, 0, errors.Wrap(err, "GetSlotList failed")
|
||||
}
|
||||
|
||||
tokenlabel, ok := p11uri.GetPathAttribute("token", false)
|
||||
if !ok {
|
||||
return nil, 0, errors.New("Missing 'token' attribute since 'slot-id' was not given")
|
||||
}
|
||||
|
||||
for _, slot := range slots {
|
||||
ti, err := p11ctx.GetTokenInfo(slot)
|
||||
if err != nil || ti.Label != tokenlabel {
|
||||
continue
|
||||
}
|
||||
|
||||
session, err = pkcs11OpenSession(p11ctx, slot, pin)
|
||||
if err == nil {
|
||||
return p11ctx, session, err
|
||||
}
|
||||
}
|
||||
if len(pin) > 0 {
|
||||
return nil, 0, errors.New("Could not create session to any slot and/or log in")
|
||||
}
|
||||
return nil, 0, errors.New("Could not create session to any slot")
|
||||
}
|
||||
}
|
||||
|
||||
func pkcs11Logout(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) {
|
||||
_ = ctx.Logout(session)
|
||||
_ = ctx.CloseSession(session)
|
||||
_ = ctx.Finalize()
|
||||
ctx.Destroy()
|
||||
}
|
||||
|
||||
// findObject finds an object of the given class with the given keyid and/or label
|
||||
func findObject(p11ctx *pkcs11.Ctx, session pkcs11.SessionHandle, class uint, keyid, label string) (pkcs11.ObjectHandle, error) {
|
||||
msg := ""
|
||||
|
||||
template := []*pkcs11.Attribute{
|
||||
pkcs11.NewAttribute(pkcs11.CKA_CLASS, class),
|
||||
}
|
||||
if len(label) > 0 {
|
||||
template = append(template, pkcs11.NewAttribute(pkcs11.CKA_LABEL, label))
|
||||
msg = fmt.Sprintf("label '%s'", label)
|
||||
}
|
||||
if len(keyid) > 0 {
|
||||
template = append(template, pkcs11.NewAttribute(pkcs11.CKA_ID, keyid))
|
||||
if len(msg) > 0 {
|
||||
msg += " and "
|
||||
}
|
||||
msg += url.PathEscape(keyid)
|
||||
}
|
||||
|
||||
if err := p11ctx.FindObjectsInit(session, template); err != nil {
|
||||
return 0, errors.Wrap(err, "FindObjectsInit failed")
|
||||
}
|
||||
|
||||
obj, _, err := p11ctx.FindObjects(session, 100)
|
||||
if err != nil {
|
||||
return 0, errors.Wrap(err, "FindObjects failed")
|
||||
}
|
||||
|
||||
if err := p11ctx.FindObjectsFinal(session); err != nil {
|
||||
return 0, errors.Wrap(err, "FindObjectsFinal failed")
|
||||
}
|
||||
if len(obj) > 1 {
|
||||
return 0, errors.Errorf("There are too many (=%d) keys with %s", len(obj), msg)
|
||||
} else if len(obj) == 1 {
|
||||
return obj[0], nil
|
||||
}
|
||||
|
||||
return 0, errors.Errorf("Could not find any object with %s", msg)
|
||||
}
|
||||
|
||||
// publicEncryptOAEP uses a public key described by a pkcs11 URI to OAEP encrypt the given plaintext
|
||||
func publicEncryptOAEP(pubKey *Pkcs11KeyFileObject, plaintext []byte) ([]byte, string, error) {
|
||||
oldenv, err := setEnvVars(pubKey.Uri.GetEnvMap())
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
defer restoreEnv(oldenv)
|
||||
|
||||
p11ctx, session, err := pkcs11UriLogin(pubKey.Uri, false)
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
defer pkcs11Logout(p11ctx, session)
|
||||
|
||||
keyid, label, err := pkcs11UriGetKeyIdAndLabel(pubKey.Uri)
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
|
||||
p11PubKey, err := findObject(p11ctx, session, pkcs11.CKO_PUBLIC_KEY, keyid, label)
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
|
||||
var hashalg string
|
||||
|
||||
var oaep *pkcs11.OAEPParams
|
||||
oaephash := os.Getenv("OCICRYPT_OAEP_HASHALG")
|
||||
// The default is sha256 (previously was sha1)
|
||||
switch strings.ToLower(oaephash) {
|
||||
case "sha1":
|
||||
oaep = OAEPSha1Params
|
||||
hashalg = "sha1"
|
||||
case "sha256", "":
|
||||
oaep = OAEPSha256Params
|
||||
hashalg = "sha256"
|
||||
default:
|
||||
return nil, "", errors.Errorf("Unsupported OAEP hash '%s'", oaephash)
|
||||
}
|
||||
|
||||
err = p11ctx.EncryptInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_RSA_PKCS_OAEP, oaep)}, p11PubKey)
|
||||
if err != nil {
|
||||
return nil, "", errors.Wrap(err, "EncryptInit error")
|
||||
}
|
||||
|
||||
ciphertext, err := p11ctx.Encrypt(session, plaintext)
|
||||
if err != nil {
|
||||
return nil, "", errors.Wrap(err, "Encrypt failed")
|
||||
}
|
||||
return ciphertext, hashalg, nil
|
||||
}
|
||||
|
||||
// privateDecryptOAEP uses a pkcs11 URI describing a private key to OAEP decrypt a ciphertext
|
||||
func privateDecryptOAEP(privKeyObj *Pkcs11KeyFileObject, ciphertext []byte, hashalg string) ([]byte, error) {
|
||||
oldenv, err := setEnvVars(privKeyObj.Uri.GetEnvMap())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer restoreEnv(oldenv)
|
||||
|
||||
p11ctx, session, err := pkcs11UriLogin(privKeyObj.Uri, true)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer pkcs11Logout(p11ctx, session)
|
||||
|
||||
keyid, label, err := pkcs11UriGetKeyIdAndLabel(privKeyObj.Uri)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
p11PrivKey, err := findObject(p11ctx, session, pkcs11.CKO_PRIVATE_KEY, keyid, label)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var oaep *pkcs11.OAEPParams
|
||||
|
||||
// An empty string from the Hash in the JSON historically defaults to sha1.
|
||||
switch hashalg {
|
||||
case "sha1", "":
|
||||
oaep = OAEPSha1Params
|
||||
case "sha256":
|
||||
oaep = OAEPSha256Params
|
||||
default:
|
||||
return nil, errors.Errorf("Unsupported hash algorithm '%s' for decryption", hashalg)
|
||||
}
|
||||
|
||||
err = p11ctx.DecryptInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_RSA_PKCS_OAEP, oaep)}, p11PrivKey)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "DecryptInit failed")
|
||||
}
|
||||
plaintext, err := p11ctx.Decrypt(session, ciphertext)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "Decrypt failed")
|
||||
}
|
||||
return plaintext, err
|
||||
}
|
||||
|
||||
//
|
||||
// The following part deals with the JSON formatted message for multiple pkcs11 recipients
|
||||
//
|
||||
|
||||
// Pkcs11Blob holds the encrypted blobs for all recipients; this is what we will put into the image's annotations
|
||||
type Pkcs11Blob struct {
|
||||
Version uint `json:"version"`
|
||||
Recipients []Pkcs11Recipient `json:"recipients"`
|
||||
}
|
||||
|
||||
// Pkcs11Recipient holds the b64-encoded and encrypted blob for a particular recipient
|
||||
type Pkcs11Recipient struct {
|
||||
Version uint `json:"version"`
|
||||
Blob string `json:"blob"`
|
||||
Hash string `json:"hash,omitempty"`
|
||||
}
|
||||
|
||||
// EncryptMultiple encrypts for one or multiple pkcs11 devices; the public keys passed to this function
|
||||
// may either be *rsa.PublicKey or *pkcs11uri.Pkcs11URI; the returned byte array is a JSON string of the
|
||||
// following format:
|
||||
// {
|
||||
// recipients: [ // recipient list
|
||||
// {
|
||||
// "version": 0,
|
||||
// "blob": <base64 encoded RSA OAEP encrypted blob>,
|
||||
// "hash": <hash used for OAEP other than 'sha256'>
|
||||
// } ,
|
||||
// {
|
||||
// "version": 0,
|
||||
// "blob": <base64 encoded RSA OAEP encrypted blob>,
|
||||
// "hash": <hash used for OAEP other than 'sha256'>
|
||||
// } ,
|
||||
// [...]
|
||||
// ]
|
||||
// }
|
||||
func EncryptMultiple(pubKeys []interface{}, data []byte) ([]byte, error) {
|
||||
var (
|
||||
ciphertext []byte
|
||||
err error
|
||||
pkcs11blob Pkcs11Blob = Pkcs11Blob{Version: 0}
|
||||
hashalg string
|
||||
)
|
||||
|
||||
for _, pubKey := range pubKeys {
|
||||
switch pkey := pubKey.(type) {
|
||||
case *rsa.PublicKey:
|
||||
ciphertext, hashalg, err = rsaPublicEncryptOAEP(pkey, data)
|
||||
case *Pkcs11KeyFileObject:
|
||||
ciphertext, hashalg, err = publicEncryptOAEP(pkey, data)
|
||||
default:
|
||||
err = errors.Errorf("Unsupported key object type for pkcs11 public key")
|
||||
}
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
recipient := Pkcs11Recipient{
|
||||
Version: 0,
|
||||
Blob: base64.StdEncoding.EncodeToString(ciphertext),
|
||||
Hash: hashalg,
|
||||
}
|
||||
|
||||
pkcs11blob.Recipients = append(pkcs11blob.Recipients, recipient)
|
||||
}
|
||||
return json.Marshal(&pkcs11blob)
|
||||
}
|
||||
|
||||
// Decrypt tries to decrypt one of the recipients' blobs using a pkcs11 private key.
|
||||
// The input pkcs11blobstr is a string with the following format:
|
||||
// {
|
||||
// recipients: [ // recipient list
|
||||
// {
|
||||
// "version": 0,
|
||||
// "blob": <base64 encoded RSA OAEP encrypted blob>,
|
||||
// "hash": <hash used for OAEP other than 'sha1'>
|
||||
// } ,
|
||||
// {
|
||||
// "version": 0,
|
||||
// "blob": <base64 encoded RSA OAEP encrypted blob>,
|
||||
// "hash": <hash used for OAEP other than 'sha1'>
|
||||
// } ,
|
||||
// [...]
|
||||
// }
|
||||
// Note: More recent versions of this code explicitly write 'sha1'
|
||||
// while older versions left it empty in case of 'sha1'.
|
||||
//
|
||||
func Decrypt(privKeyObjs []*Pkcs11KeyFileObject, pkcs11blobstr []byte) ([]byte, error) {
|
||||
pkcs11blob := Pkcs11Blob{}
|
||||
err := json.Unmarshal(pkcs11blobstr, &pkcs11blob)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "Could not parse Pkcs11Blob")
|
||||
}
|
||||
switch pkcs11blob.Version {
|
||||
case 0:
|
||||
// latest supported version
|
||||
default:
|
||||
return nil, errors.Errorf("Found Pkcs11Blob with version %d but maximum supported version is 0.", pkcs11blob.Version)
|
||||
}
|
||||
// since we do trial and error, collect all encountered errors
|
||||
errs := ""
|
||||
|
||||
for _, recipient := range pkcs11blob.Recipients {
|
||||
switch recipient.Version {
|
||||
case 0:
|
||||
// last supported version
|
||||
default:
|
||||
return nil, errors.Errorf("Found Pkcs11Recipient with version %d but maximum supported version is 0.", recipient.Version)
|
||||
}
|
||||
|
||||
ciphertext, err := base64.StdEncoding.DecodeString(recipient.Blob)
|
||||
if err != nil || len(ciphertext) == 0 {
|
||||
// This should never happen... we skip over decoding issues
|
||||
errs += fmt.Sprintf("Base64 decoding failed: %s\n", err)
|
||||
continue
|
||||
}
|
||||
// try all keys until one works
|
||||
for _, privKeyObj := range privKeyObjs {
|
||||
plaintext, err := privateDecryptOAEP(privKeyObj, ciphertext, recipient.Hash)
|
||||
if err == nil {
|
||||
return plaintext, nil
|
||||
}
|
||||
if uri, err2 := privKeyObj.Uri.Format(); err2 == nil {
|
||||
errs += fmt.Sprintf("%s : %s\n", uri, err)
|
||||
} else {
|
||||
errs += fmt.Sprintf("%s\n", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return nil, errors.Errorf("Could not find a pkcs11 key for decryption:\n%s", errs)
|
||||
}
|
||||
31
vendor/github.com/containers/ocicrypt/crypto/pkcs11/pkcs11helpers_nocgo.go
generated
vendored
31
vendor/github.com/containers/ocicrypt/crypto/pkcs11/pkcs11helpers_nocgo.go
generated
vendored
@ -1,31 +0,0 @@
|
||||
// +build !cgo
|
||||
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package pkcs11
|
||||
|
||||
import (
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
func EncryptMultiple(pubKeys []interface{}, data []byte) ([]byte, error) {
|
||||
return nil, errors.Errorf("ocicrypt pkcs11 not supported on this build")
|
||||
}
|
||||
|
||||
func Decrypt(privKeyObjs []*Pkcs11KeyFileObject, pkcs11blobstr []byte) ([]byte, error) {
|
||||
return nil, errors.Errorf("ocicrypt pkcs11 not supported on this build")
|
||||
}
|
||||
114
vendor/github.com/containers/ocicrypt/crypto/pkcs11/utils.go
generated
vendored
114
vendor/github.com/containers/ocicrypt/crypto/pkcs11/utils.go
generated
vendored
@ -1,114 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package pkcs11
|
||||
|
||||
import (
|
||||
"os"
|
||||
"runtime"
|
||||
"strings"
|
||||
"sync"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
var (
|
||||
envLock sync.Mutex
|
||||
)
|
||||
|
||||
// setEnvVars sets the environment variables given in the map and locks the environment from
|
||||
// modification with the same function; if successful, you *must* call restoreEnv with the return
|
||||
// value from this function
|
||||
func setEnvVars(env map[string]string) ([]string, error) {
|
||||
envLock.Lock()
|
||||
|
||||
if len(env) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
oldenv := os.Environ()
|
||||
|
||||
for k, v := range env {
|
||||
err := os.Setenv(k, v)
|
||||
if err != nil {
|
||||
restoreEnv(oldenv)
|
||||
return nil, errors.Wrapf(err, "Could not set environment variable '%s' to '%s'", k, v)
|
||||
}
|
||||
}
|
||||
|
||||
return oldenv, nil
|
||||
}
|
||||
|
||||
func arrayToMap(elements []string) map[string]string {
|
||||
o := make(map[string]string)
|
||||
|
||||
for _, element := range elements {
|
||||
p := strings.SplitN(element, "=", 2)
|
||||
if len(p) == 2 {
|
||||
o[p[0]] = p[1]
|
||||
}
|
||||
}
|
||||
|
||||
return o
|
||||
}
|
||||
|
||||
// restoreEnv restores the environment to be exactly as given in the array of strings
|
||||
// and unlocks the lock
|
||||
func restoreEnv(envs []string) {
|
||||
if envs != nil && len(envs) >= 0 {
|
||||
target := arrayToMap(envs)
|
||||
curr := arrayToMap(os.Environ())
|
||||
|
||||
for nc, vc := range curr {
|
||||
vt, ok := target[nc]
|
||||
if !ok {
|
||||
os.Unsetenv(nc)
|
||||
} else if vc == vt {
|
||||
delete(target, nc)
|
||||
}
|
||||
}
|
||||
|
||||
for nt, vt := range target {
|
||||
os.Setenv(nt, vt)
|
||||
}
|
||||
}
|
||||
|
||||
envLock.Unlock()
|
||||
}
|
||||
|
||||
func getHostAndOsType() (string, string, string) {
|
||||
ht := ""
|
||||
ot := ""
|
||||
st := ""
|
||||
switch runtime.GOOS {
|
||||
case "linux":
|
||||
ot = "linux"
|
||||
st = "gnu"
|
||||
switch runtime.GOARCH {
|
||||
case "arm":
|
||||
ht = "arm"
|
||||
case "arm64":
|
||||
ht = "aarch64"
|
||||
case "amd64":
|
||||
ht = "x86_64"
|
||||
case "ppc64le":
|
||||
ht = "powerpc64le"
|
||||
case "s390x":
|
||||
ht = "s390x"
|
||||
}
|
||||
}
|
||||
return ht, ot, st
|
||||
}
|
||||
356
vendor/github.com/containers/ocicrypt/encryption.go
generated
vendored
356
vendor/github.com/containers/ocicrypt/encryption.go
generated
vendored
@ -1,356 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package ocicrypt
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
keyproviderconfig "github.com/containers/ocicrypt/config/keyprovider-config"
|
||||
"github.com/containers/ocicrypt/keywrap/keyprovider"
|
||||
"io"
|
||||
"strings"
|
||||
|
||||
"github.com/containers/ocicrypt/blockcipher"
|
||||
"github.com/containers/ocicrypt/config"
|
||||
"github.com/containers/ocicrypt/keywrap"
|
||||
"github.com/containers/ocicrypt/keywrap/jwe"
|
||||
"github.com/containers/ocicrypt/keywrap/pgp"
|
||||
"github.com/containers/ocicrypt/keywrap/pkcs11"
|
||||
"github.com/containers/ocicrypt/keywrap/pkcs7"
|
||||
"github.com/opencontainers/go-digest"
|
||||
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
|
||||
"github.com/pkg/errors"
|
||||
log "github.com/sirupsen/logrus"
|
||||
)
|
||||
|
||||
// EncryptLayerFinalizer is a finalizer run to return the annotations to set for
|
||||
// the encrypted layer
|
||||
type EncryptLayerFinalizer func() (map[string]string, error)
|
||||
|
||||
func init() {
|
||||
keyWrappers = make(map[string]keywrap.KeyWrapper)
|
||||
keyWrapperAnnotations = make(map[string]string)
|
||||
RegisterKeyWrapper("pgp", pgp.NewKeyWrapper())
|
||||
RegisterKeyWrapper("jwe", jwe.NewKeyWrapper())
|
||||
RegisterKeyWrapper("pkcs7", pkcs7.NewKeyWrapper())
|
||||
RegisterKeyWrapper("pkcs11", pkcs11.NewKeyWrapper())
|
||||
ic, err := keyproviderconfig.GetConfiguration()
|
||||
if err != nil {
|
||||
log.Error(err)
|
||||
} else if ic != nil {
|
||||
for provider, attrs := range ic.KeyProviderConfig {
|
||||
RegisterKeyWrapper("provider."+provider, keyprovider.NewKeyWrapper(provider, attrs))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
var keyWrappers map[string]keywrap.KeyWrapper
|
||||
var keyWrapperAnnotations map[string]string
|
||||
|
||||
// RegisterKeyWrapper allows to register key wrappers by their encryption scheme
|
||||
func RegisterKeyWrapper(scheme string, iface keywrap.KeyWrapper) {
|
||||
keyWrappers[scheme] = iface
|
||||
keyWrapperAnnotations[iface.GetAnnotationID()] = scheme
|
||||
}
|
||||
|
||||
// GetKeyWrapper looks up the encryptor interface given an encryption scheme (gpg, jwe)
|
||||
func GetKeyWrapper(scheme string) keywrap.KeyWrapper {
|
||||
return keyWrappers[scheme]
|
||||
}
|
||||
|
||||
// GetWrappedKeysMap returns a map of wrappedKeys as values in a
|
||||
// map with the encryption scheme(s) as the key(s)
|
||||
func GetWrappedKeysMap(desc ocispec.Descriptor) map[string]string {
|
||||
wrappedKeysMap := make(map[string]string)
|
||||
|
||||
for annotationsID, scheme := range keyWrapperAnnotations {
|
||||
if annotation, ok := desc.Annotations[annotationsID]; ok {
|
||||
wrappedKeysMap[scheme] = annotation
|
||||
}
|
||||
}
|
||||
return wrappedKeysMap
|
||||
}
|
||||
|
||||
// EncryptLayer encrypts the layer by running one encryptor after the other
|
||||
func EncryptLayer(ec *config.EncryptConfig, encOrPlainLayerReader io.Reader, desc ocispec.Descriptor) (io.Reader, EncryptLayerFinalizer, error) {
|
||||
var (
|
||||
encLayerReader io.Reader
|
||||
err error
|
||||
encrypted bool
|
||||
bcFin blockcipher.Finalizer
|
||||
privOptsData []byte
|
||||
pubOptsData []byte
|
||||
)
|
||||
|
||||
if ec == nil {
|
||||
return nil, nil, errors.New("EncryptConfig must not be nil")
|
||||
}
|
||||
|
||||
for annotationsID := range keyWrapperAnnotations {
|
||||
annotation := desc.Annotations[annotationsID]
|
||||
if annotation != "" {
|
||||
privOptsData, err = decryptLayerKeyOptsData(&ec.DecryptConfig, desc)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
pubOptsData, err = getLayerPubOpts(desc)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
// already encrypted!
|
||||
encrypted = true
|
||||
}
|
||||
}
|
||||
|
||||
if !encrypted {
|
||||
encLayerReader, bcFin, err = commonEncryptLayer(encOrPlainLayerReader, desc.Digest, blockcipher.AES256CTR)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
}
|
||||
|
||||
encLayerFinalizer := func() (map[string]string, error) {
|
||||
// If layer was already encrypted, bcFin should be nil, use existing optsData
|
||||
if bcFin != nil {
|
||||
opts, err := bcFin()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
privOptsData, err = json.Marshal(opts.Private)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "could not JSON marshal opts")
|
||||
}
|
||||
pubOptsData, err = json.Marshal(opts.Public)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "could not JSON marshal opts")
|
||||
}
|
||||
}
|
||||
|
||||
newAnnotations := make(map[string]string)
|
||||
keysWrapped := false
|
||||
if len(keyWrapperAnnotations) == 0 {
|
||||
return nil, errors.New("missing Annotations needed for decryption")
|
||||
}
|
||||
for annotationsID, scheme := range keyWrapperAnnotations {
|
||||
b64Annotations := desc.Annotations[annotationsID]
|
||||
keywrapper := GetKeyWrapper(scheme)
|
||||
b64Annotations, err = preWrapKeys(keywrapper, ec, b64Annotations, privOptsData)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if b64Annotations != "" {
|
||||
keysWrapped = true
|
||||
newAnnotations[annotationsID] = b64Annotations
|
||||
}
|
||||
}
|
||||
|
||||
if !keysWrapped {
|
||||
return nil, errors.New("no wrapped keys produced by encryption")
|
||||
}
|
||||
newAnnotations["org.opencontainers.image.enc.pubopts"] = base64.StdEncoding.EncodeToString(pubOptsData)
|
||||
|
||||
if len(newAnnotations) == 0 {
|
||||
return nil, errors.New("no encryptor found to handle encryption")
|
||||
}
|
||||
|
||||
return newAnnotations, err
|
||||
}
|
||||
|
||||
// if nothing was encrypted, we just return encLayer = nil
|
||||
return encLayerReader, encLayerFinalizer, err
|
||||
|
||||
}
|
||||
|
||||
// preWrapKeys calls WrapKeys and handles the base64 encoding and concatenation of the
|
||||
// annotation data
|
||||
func preWrapKeys(keywrapper keywrap.KeyWrapper, ec *config.EncryptConfig, b64Annotations string, optsData []byte) (string, error) {
|
||||
newAnnotation, err := keywrapper.WrapKeys(ec, optsData)
|
||||
if err != nil || len(newAnnotation) == 0 {
|
||||
return b64Annotations, err
|
||||
}
|
||||
b64newAnnotation := base64.StdEncoding.EncodeToString(newAnnotation)
|
||||
if b64Annotations == "" {
|
||||
return b64newAnnotation, nil
|
||||
}
|
||||
return b64Annotations + "," + b64newAnnotation, nil
|
||||
}
|
||||
|
||||
// DecryptLayer decrypts a layer trying one keywrap.KeyWrapper after the other to see whether it
|
||||
// can apply the provided private key
|
||||
// If unwrapOnly is set we will only try to decrypt the layer encryption key and return
|
||||
func DecryptLayer(dc *config.DecryptConfig, encLayerReader io.Reader, desc ocispec.Descriptor, unwrapOnly bool) (io.Reader, digest.Digest, error) {
|
||||
if dc == nil {
|
||||
return nil, "", errors.New("DecryptConfig must not be nil")
|
||||
}
|
||||
privOptsData, err := decryptLayerKeyOptsData(dc, desc)
|
||||
if err != nil || unwrapOnly {
|
||||
return nil, "", err
|
||||
}
|
||||
|
||||
var pubOptsData []byte
|
||||
pubOptsData, err = getLayerPubOpts(desc)
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
|
||||
return commonDecryptLayer(encLayerReader, privOptsData, pubOptsData)
|
||||
}
|
||||
|
||||
func decryptLayerKeyOptsData(dc *config.DecryptConfig, desc ocispec.Descriptor) ([]byte, error) {
|
||||
privKeyGiven := false
|
||||
errs := ""
|
||||
if len(keyWrapperAnnotations) == 0 {
|
||||
return nil, errors.New("missing Annotations needed for decryption")
|
||||
}
|
||||
for annotationsID, scheme := range keyWrapperAnnotations {
|
||||
b64Annotation := desc.Annotations[annotationsID]
|
||||
if b64Annotation != "" {
|
||||
keywrapper := GetKeyWrapper(scheme)
|
||||
|
||||
if keywrapper.NoPossibleKeys(dc.Parameters) {
|
||||
continue
|
||||
}
|
||||
|
||||
if len(keywrapper.GetPrivateKeys(dc.Parameters)) > 0 {
|
||||
privKeyGiven = true
|
||||
}
|
||||
optsData, err := preUnwrapKey(keywrapper, dc, b64Annotation)
|
||||
if err != nil {
|
||||
// try next keywrap.KeyWrapper
|
||||
errs += fmt.Sprintf("%s\n", err)
|
||||
continue
|
||||
}
|
||||
if optsData == nil {
|
||||
// try next keywrap.KeyWrapper
|
||||
continue
|
||||
}
|
||||
return optsData, nil
|
||||
}
|
||||
}
|
||||
if !privKeyGiven {
|
||||
return nil, errors.New("missing private key needed for decryption")
|
||||
}
|
||||
return nil, errors.Errorf("no suitable key unwrapper found or none of the private keys could be used for decryption:\n%s", errs)
|
||||
}
|
||||
|
||||
func getLayerPubOpts(desc ocispec.Descriptor) ([]byte, error) {
|
||||
pubOptsString := desc.Annotations["org.opencontainers.image.enc.pubopts"]
|
||||
if pubOptsString == "" {
|
||||
return json.Marshal(blockcipher.PublicLayerBlockCipherOptions{})
|
||||
}
|
||||
return base64.StdEncoding.DecodeString(pubOptsString)
|
||||
}
|
||||
|
||||
// preUnwrapKey decodes the comma separated base64 strings and calls the Unwrap function
|
||||
// of the given keywrapper with it and returns the result in case the Unwrap functions
|
||||
// does not return an error. If all attempts fail, an error is returned.
|
||||
func preUnwrapKey(keywrapper keywrap.KeyWrapper, dc *config.DecryptConfig, b64Annotations string) ([]byte, error) {
|
||||
if b64Annotations == "" {
|
||||
return nil, nil
|
||||
}
|
||||
errs := ""
|
||||
for _, b64Annotation := range strings.Split(b64Annotations, ",") {
|
||||
annotation, err := base64.StdEncoding.DecodeString(b64Annotation)
|
||||
if err != nil {
|
||||
return nil, errors.New("could not base64 decode the annotation")
|
||||
}
|
||||
optsData, err := keywrapper.UnwrapKey(dc, annotation)
|
||||
if err != nil {
|
||||
errs += fmt.Sprintf("- %s\n", err)
|
||||
continue
|
||||
}
|
||||
return optsData, nil
|
||||
}
|
||||
return nil, errors.Errorf("no suitable key found for decrypting layer key:\n%s", errs)
|
||||
}
|
||||
|
||||
// commonEncryptLayer is a function to encrypt the plain layer using a new random
|
||||
// symmetric key and return the LayerBlockCipherHandler's JSON in string form for
|
||||
// later use during decryption
|
||||
func commonEncryptLayer(plainLayerReader io.Reader, d digest.Digest, typ blockcipher.LayerCipherType) (io.Reader, blockcipher.Finalizer, error) {
|
||||
lbch, err := blockcipher.NewLayerBlockCipherHandler()
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
encLayerReader, bcFin, err := lbch.Encrypt(plainLayerReader, typ)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
newBcFin := func() (blockcipher.LayerBlockCipherOptions, error) {
|
||||
lbco, err := bcFin()
|
||||
if err != nil {
|
||||
return blockcipher.LayerBlockCipherOptions{}, err
|
||||
}
|
||||
lbco.Private.Digest = d
|
||||
return lbco, nil
|
||||
}
|
||||
|
||||
return encLayerReader, newBcFin, err
|
||||
}
|
||||
|
||||
// commonDecryptLayer decrypts an encrypted layer previously encrypted with commonEncryptLayer
|
||||
// by passing along the optsData
|
||||
func commonDecryptLayer(encLayerReader io.Reader, privOptsData []byte, pubOptsData []byte) (io.Reader, digest.Digest, error) {
|
||||
privOpts := blockcipher.PrivateLayerBlockCipherOptions{}
|
||||
err := json.Unmarshal(privOptsData, &privOpts)
|
||||
if err != nil {
|
||||
return nil, "", errors.Wrapf(err, "could not JSON unmarshal privOptsData")
|
||||
}
|
||||
|
||||
lbch, err := blockcipher.NewLayerBlockCipherHandler()
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
|
||||
pubOpts := blockcipher.PublicLayerBlockCipherOptions{}
|
||||
if len(pubOptsData) > 0 {
|
||||
err := json.Unmarshal(pubOptsData, &pubOpts)
|
||||
if err != nil {
|
||||
return nil, "", errors.Wrapf(err, "could not JSON unmarshal pubOptsData")
|
||||
}
|
||||
}
|
||||
|
||||
opts := blockcipher.LayerBlockCipherOptions{
|
||||
Private: privOpts,
|
||||
Public: pubOpts,
|
||||
}
|
||||
|
||||
plainLayerReader, opts, err := lbch.Decrypt(encLayerReader, opts)
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
|
||||
return plainLayerReader, opts.Private.Digest, nil
|
||||
}
|
||||
|
||||
// FilterOutAnnotations filters out the annotations belonging to the image encryption 'namespace'
|
||||
// and returns a map with those taken out
|
||||
func FilterOutAnnotations(annotations map[string]string) map[string]string {
|
||||
a := make(map[string]string)
|
||||
if len(annotations) > 0 {
|
||||
for k, v := range annotations {
|
||||
if strings.HasPrefix(k, "org.opencontainers.image.enc.") {
|
||||
continue
|
||||
}
|
||||
a[k] = v
|
||||
}
|
||||
}
|
||||
return a
|
||||
}
|
||||
425
vendor/github.com/containers/ocicrypt/gpg.go
generated
vendored
425
vendor/github.com/containers/ocicrypt/gpg.go
generated
vendored
@ -1,425 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package ocicrypt
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"os/exec"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
ocispec "github.com/opencontainers/image-spec/specs-go/v1"
|
||||
"github.com/pkg/errors"
|
||||
"golang.org/x/term"
|
||||
)
|
||||
|
||||
// GPGVersion enum representing the GPG client version to use.
|
||||
type GPGVersion int
|
||||
|
||||
const (
|
||||
// GPGv2 signifies gpgv2+
|
||||
GPGv2 GPGVersion = iota
|
||||
// GPGv1 signifies gpgv1+
|
||||
GPGv1
|
||||
// GPGVersionUndetermined signifies gpg client version undetermined
|
||||
GPGVersionUndetermined
|
||||
)
|
||||
|
||||
// GPGClient defines an interface for wrapping the gpg command line tools
|
||||
type GPGClient interface {
|
||||
// ReadGPGPubRingFile gets the byte sequence of the gpg public keyring
|
||||
ReadGPGPubRingFile() ([]byte, error)
|
||||
// GetGPGPrivateKey gets the private key bytes of a keyid given a passphrase
|
||||
GetGPGPrivateKey(keyid uint64, passphrase string) ([]byte, error)
|
||||
// GetSecretKeyDetails gets the details of a secret key
|
||||
GetSecretKeyDetails(keyid uint64) ([]byte, bool, error)
|
||||
// GetKeyDetails gets the details of a public key
|
||||
GetKeyDetails(keyid uint64) ([]byte, bool, error)
|
||||
// ResolveRecipients resolves PGP key ids to user names
|
||||
ResolveRecipients([]string) []string
|
||||
}
|
||||
|
||||
// gpgClient contains generic gpg client information
|
||||
type gpgClient struct {
|
||||
gpgHomeDir string
|
||||
}
|
||||
|
||||
// gpgv2Client is a gpg2 client
|
||||
type gpgv2Client struct {
|
||||
gpgClient
|
||||
}
|
||||
|
||||
// gpgv1Client is a gpg client
|
||||
type gpgv1Client struct {
|
||||
gpgClient
|
||||
}
|
||||
|
||||
// GuessGPGVersion guesses the version of gpg. Defaults to gpg2 if exists, if
|
||||
// not defaults to regular gpg.
|
||||
func GuessGPGVersion() GPGVersion {
|
||||
if err := exec.Command("gpg2", "--version").Run(); err == nil {
|
||||
return GPGv2
|
||||
} else if err := exec.Command("gpg", "--version").Run(); err == nil {
|
||||
return GPGv1
|
||||
} else {
|
||||
return GPGVersionUndetermined
|
||||
}
|
||||
}
|
||||
|
||||
// NewGPGClient creates a new GPGClient object representing the given version
|
||||
// and using the given home directory
|
||||
func NewGPGClient(gpgVersion, gpgHomeDir string) (GPGClient, error) {
|
||||
v := new(GPGVersion)
|
||||
switch gpgVersion {
|
||||
case "v1":
|
||||
*v = GPGv1
|
||||
case "v2":
|
||||
*v = GPGv2
|
||||
default:
|
||||
v = nil
|
||||
}
|
||||
return newGPGClient(v, gpgHomeDir)
|
||||
}
|
||||
|
||||
func newGPGClient(version *GPGVersion, homedir string) (GPGClient, error) {
|
||||
var gpgVersion GPGVersion
|
||||
if version != nil {
|
||||
gpgVersion = *version
|
||||
} else {
|
||||
gpgVersion = GuessGPGVersion()
|
||||
}
|
||||
|
||||
switch gpgVersion {
|
||||
case GPGv1:
|
||||
return &gpgv1Client{
|
||||
gpgClient: gpgClient{gpgHomeDir: homedir},
|
||||
}, nil
|
||||
case GPGv2:
|
||||
return &gpgv2Client{
|
||||
gpgClient: gpgClient{gpgHomeDir: homedir},
|
||||
}, nil
|
||||
case GPGVersionUndetermined:
|
||||
return nil, fmt.Errorf("unable to determine GPG version")
|
||||
default:
|
||||
return nil, fmt.Errorf("unhandled case: NewGPGClient")
|
||||
}
|
||||
}
|
||||
|
||||
// GetGPGPrivateKey gets the bytes of a specified keyid, supplying a passphrase
|
||||
func (gc *gpgv2Client) GetGPGPrivateKey(keyid uint64, passphrase string) ([]byte, error) {
|
||||
var args []string
|
||||
|
||||
if gc.gpgHomeDir != "" {
|
||||
args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
|
||||
}
|
||||
|
||||
rfile, wfile, err := os.Pipe()
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "could not create pipe")
|
||||
}
|
||||
defer func() {
|
||||
rfile.Close()
|
||||
wfile.Close()
|
||||
}()
|
||||
// fill pipe in background
|
||||
go func(passphrase string) {
|
||||
_, _ = wfile.Write([]byte(passphrase))
|
||||
wfile.Close()
|
||||
}(passphrase)
|
||||
|
||||
args = append(args, []string{"--pinentry-mode", "loopback", "--batch", "--passphrase-fd", fmt.Sprintf("%d", 3), "--export-secret-key", fmt.Sprintf("0x%x", keyid)}...)
|
||||
|
||||
cmd := exec.Command("gpg2", args...)
|
||||
cmd.ExtraFiles = []*os.File{rfile}
|
||||
|
||||
return runGPGGetOutput(cmd)
|
||||
}
|
||||
|
||||
// ReadGPGPubRingFile reads the GPG public key ring file
|
||||
func (gc *gpgv2Client) ReadGPGPubRingFile() ([]byte, error) {
|
||||
var args []string
|
||||
|
||||
if gc.gpgHomeDir != "" {
|
||||
args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
|
||||
}
|
||||
args = append(args, []string{"--batch", "--export"}...)
|
||||
|
||||
cmd := exec.Command("gpg2", args...)
|
||||
|
||||
return runGPGGetOutput(cmd)
|
||||
}
|
||||
|
||||
func (gc *gpgv2Client) getKeyDetails(option string, keyid uint64) ([]byte, bool, error) {
|
||||
var args []string
|
||||
|
||||
if gc.gpgHomeDir != "" {
|
||||
args = []string{"--homedir", gc.gpgHomeDir}
|
||||
}
|
||||
args = append(args, option, fmt.Sprintf("0x%x", keyid))
|
||||
|
||||
cmd := exec.Command("gpg2", args...)
|
||||
|
||||
keydata, err := runGPGGetOutput(cmd)
|
||||
return keydata, err == nil, err
|
||||
}
|
||||
|
||||
// GetSecretKeyDetails retrieves the secret key details of key with keyid.
|
||||
// returns a byte array of the details and a bool if the key exists
|
||||
func (gc *gpgv2Client) GetSecretKeyDetails(keyid uint64) ([]byte, bool, error) {
|
||||
return gc.getKeyDetails("-K", keyid)
|
||||
}
|
||||
|
||||
// GetKeyDetails retrieves the public key details of key with keyid.
|
||||
// returns a byte array of the details and a bool if the key exists
|
||||
func (gc *gpgv2Client) GetKeyDetails(keyid uint64) ([]byte, bool, error) {
|
||||
return gc.getKeyDetails("-k", keyid)
|
||||
}
|
||||
|
||||
// ResolveRecipients converts PGP keyids to email addresses, if possible
|
||||
func (gc *gpgv2Client) ResolveRecipients(recipients []string) []string {
|
||||
return resolveRecipients(gc, recipients)
|
||||
}
|
||||
|
||||
// GetGPGPrivateKey gets the bytes of a specified keyid, supplying a passphrase
|
||||
func (gc *gpgv1Client) GetGPGPrivateKey(keyid uint64, _ string) ([]byte, error) {
|
||||
var args []string
|
||||
|
||||
if gc.gpgHomeDir != "" {
|
||||
args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
|
||||
}
|
||||
args = append(args, []string{"--batch", "--export-secret-key", fmt.Sprintf("0x%x", keyid)}...)
|
||||
|
||||
cmd := exec.Command("gpg", args...)
|
||||
|
||||
return runGPGGetOutput(cmd)
|
||||
}
|
||||
|
||||
// ReadGPGPubRingFile reads the GPG public key ring file
|
||||
func (gc *gpgv1Client) ReadGPGPubRingFile() ([]byte, error) {
|
||||
var args []string
|
||||
|
||||
if gc.gpgHomeDir != "" {
|
||||
args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
|
||||
}
|
||||
args = append(args, []string{"--batch", "--export"}...)
|
||||
|
||||
cmd := exec.Command("gpg", args...)
|
||||
|
||||
return runGPGGetOutput(cmd)
|
||||
}
|
||||
|
||||
func (gc *gpgv1Client) getKeyDetails(option string, keyid uint64) ([]byte, bool, error) {
|
||||
var args []string
|
||||
|
||||
if gc.gpgHomeDir != "" {
|
||||
args = []string{"--homedir", gc.gpgHomeDir}
|
||||
}
|
||||
args = append(args, option, fmt.Sprintf("0x%x", keyid))
|
||||
|
||||
cmd := exec.Command("gpg", args...)
|
||||
|
||||
keydata, err := runGPGGetOutput(cmd)
|
||||
|
||||
return keydata, err == nil, err
|
||||
}
|
||||
|
||||
// GetSecretKeyDetails retrieves the secret key details of key with keyid.
|
||||
// returns a byte array of the details and a bool if the key exists
|
||||
func (gc *gpgv1Client) GetSecretKeyDetails(keyid uint64) ([]byte, bool, error) {
|
||||
return gc.getKeyDetails("-K", keyid)
|
||||
}
|
||||
|
||||
// GetKeyDetails retrieves the public key details of key with keyid.
|
||||
// returns a byte array of the details and a bool if the key exists
|
||||
func (gc *gpgv1Client) GetKeyDetails(keyid uint64) ([]byte, bool, error) {
|
||||
return gc.getKeyDetails("-k", keyid)
|
||||
}
|
||||
|
||||
// ResolveRecipients converts PGP keyids to email addresses, if possible
|
||||
func (gc *gpgv1Client) ResolveRecipients(recipients []string) []string {
|
||||
return resolveRecipients(gc, recipients)
|
||||
}
|
||||
|
||||
// runGPGGetOutput runs the GPG commandline and returns stdout as byte array
|
||||
// and any stderr in the error
|
||||
func runGPGGetOutput(cmd *exec.Cmd) ([]byte, error) {
|
||||
stdout, err := cmd.StdoutPipe()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
stderr, err := cmd.StderrPipe()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := cmd.Start(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
stdoutstr, err2 := ioutil.ReadAll(stdout)
|
||||
stderrstr, _ := ioutil.ReadAll(stderr)
|
||||
|
||||
if err := cmd.Wait(); err != nil {
|
||||
return nil, fmt.Errorf("error from %s: %s", cmd.Path, string(stderrstr))
|
||||
}
|
||||
|
||||
return stdoutstr, err2
|
||||
}
|
||||
|
||||
// resolveRecipients walks the list of recipients and attempts to convert
|
||||
// all keyIds to email addresses; if something goes wrong during the
|
||||
// conversion of a recipient, the original string is returned for that
|
||||
// recpient
|
||||
func resolveRecipients(gc GPGClient, recipients []string) []string {
|
||||
var result []string
|
||||
|
||||
for _, recipient := range recipients {
|
||||
keyID, err := strconv.ParseUint(recipient, 0, 64)
|
||||
if err != nil {
|
||||
result = append(result, recipient)
|
||||
} else {
|
||||
details, found, _ := gc.GetKeyDetails(keyID)
|
||||
if !found {
|
||||
result = append(result, recipient)
|
||||
} else {
|
||||
email := extractEmailFromDetails(details)
|
||||
if email == "" {
|
||||
result = append(result, recipient)
|
||||
} else {
|
||||
result = append(result, email)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
var emailPattern = regexp.MustCompile(`uid\s+\[.*\]\s.*\s<(?P<email>.+)>`)
|
||||
|
||||
func extractEmailFromDetails(details []byte) string {
|
||||
loc := emailPattern.FindSubmatchIndex(details)
|
||||
if len(loc) == 0 {
|
||||
return ""
|
||||
}
|
||||
return string(emailPattern.Expand(nil, []byte("$email"), details, loc))
|
||||
}
|
||||
|
||||
// uint64ToStringArray converts an array of uint64's to an array of strings
|
||||
// by applying a format string to each uint64
|
||||
func uint64ToStringArray(format string, in []uint64) []string {
|
||||
var ret []string
|
||||
|
||||
for _, v := range in {
|
||||
ret = append(ret, fmt.Sprintf(format, v))
|
||||
}
|
||||
return ret
|
||||
}
|
||||
|
||||
// GPGGetPrivateKey walks the list of layerInfos and tries to decrypt the
|
||||
// wrapped symmetric keys. For this it determines whether a private key is
|
||||
// in the GPGVault or on this system and prompts for the passwords for those
|
||||
// that are available. If we do not find a private key on the system for
|
||||
// getting to the symmetric key of a layer then an error is generated.
|
||||
func GPGGetPrivateKey(descs []ocispec.Descriptor, gpgClient GPGClient, gpgVault GPGVault, mustFindKey bool) (gpgPrivKeys [][]byte, gpgPrivKeysPwds [][]byte, err error) {
|
||||
// PrivateKeyData describes a private key
|
||||
type PrivateKeyData struct {
|
||||
KeyData []byte
|
||||
KeyDataPassword []byte
|
||||
}
|
||||
var pkd PrivateKeyData
|
||||
keyIDPasswordMap := make(map[uint64]PrivateKeyData)
|
||||
|
||||
for _, desc := range descs {
|
||||
for scheme, b64pgpPackets := range GetWrappedKeysMap(desc) {
|
||||
if scheme != "pgp" {
|
||||
continue
|
||||
}
|
||||
keywrapper := GetKeyWrapper(scheme)
|
||||
if keywrapper == nil {
|
||||
return nil, nil, errors.Errorf("could not get KeyWrapper for %s\n", scheme)
|
||||
}
|
||||
keyIds, err := keywrapper.GetKeyIdsFromPacket(b64pgpPackets)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
found := false
|
||||
for _, keyid := range keyIds {
|
||||
// do we have this key? -- first check the vault
|
||||
if gpgVault != nil {
|
||||
_, keydata := gpgVault.GetGPGPrivateKey(keyid)
|
||||
if len(keydata) > 0 {
|
||||
pkd = PrivateKeyData{
|
||||
KeyData: keydata,
|
||||
KeyDataPassword: nil, // password not supported in this case
|
||||
}
|
||||
keyIDPasswordMap[keyid] = pkd
|
||||
found = true
|
||||
break
|
||||
}
|
||||
} else if gpgClient != nil {
|
||||
// check the local system's gpg installation
|
||||
keyinfo, haveKey, _ := gpgClient.GetSecretKeyDetails(keyid)
|
||||
// this may fail if the key is not here; we ignore the error
|
||||
if !haveKey {
|
||||
// key not on this system
|
||||
continue
|
||||
}
|
||||
|
||||
_, found = keyIDPasswordMap[keyid]
|
||||
if !found {
|
||||
fmt.Printf("Passphrase required for Key id 0x%x: \n%v", keyid, string(keyinfo))
|
||||
fmt.Printf("Enter passphrase for key with Id 0x%x: ", keyid)
|
||||
|
||||
password, err := term.ReadPassword(int(os.Stdin.Fd()))
|
||||
fmt.Printf("\n")
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
keydata, err := gpgClient.GetGPGPrivateKey(keyid, string(password))
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
pkd = PrivateKeyData{
|
||||
KeyData: keydata,
|
||||
KeyDataPassword: password,
|
||||
}
|
||||
keyIDPasswordMap[keyid] = pkd
|
||||
found = true
|
||||
}
|
||||
break
|
||||
} else {
|
||||
return nil, nil, errors.New("no GPGVault or GPGClient passed")
|
||||
}
|
||||
}
|
||||
if !found && len(b64pgpPackets) > 0 && mustFindKey {
|
||||
ids := uint64ToStringArray("0x%x", keyIds)
|
||||
|
||||
return nil, nil, errors.Errorf("missing key for decryption of layer %x of %s. Need one of the following keys: %s", desc.Digest, desc.Platform, strings.Join(ids, ", "))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for _, pkd := range keyIDPasswordMap {
|
||||
gpgPrivKeys = append(gpgPrivKeys, pkd.KeyData)
|
||||
gpgPrivKeysPwds = append(gpgPrivKeysPwds, pkd.KeyDataPassword)
|
||||
}
|
||||
|
||||
return gpgPrivKeys, gpgPrivKeysPwds, nil
|
||||
}
|
||||
100
vendor/github.com/containers/ocicrypt/gpgvault.go
generated
vendored
100
vendor/github.com/containers/ocicrypt/gpgvault.go
generated
vendored
@ -1,100 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package ocicrypt
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"io/ioutil"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
"golang.org/x/crypto/openpgp"
|
||||
"golang.org/x/crypto/openpgp/packet"
|
||||
)
|
||||
|
||||
// GPGVault defines an interface for wrapping multiple secret key rings
|
||||
type GPGVault interface {
|
||||
// AddSecretKeyRingData adds a secret keyring via its raw byte array
|
||||
AddSecretKeyRingData(gpgSecretKeyRingData []byte) error
|
||||
// AddSecretKeyRingDataArray adds secret keyring via its raw byte arrays
|
||||
AddSecretKeyRingDataArray(gpgSecretKeyRingDataArray [][]byte) error
|
||||
// AddSecretKeyRingFiles adds secret keyrings given their filenames
|
||||
AddSecretKeyRingFiles(filenames []string) error
|
||||
// GetGPGPrivateKey gets the private key bytes of a keyid given a passphrase
|
||||
GetGPGPrivateKey(keyid uint64) ([]openpgp.Key, []byte)
|
||||
}
|
||||
|
||||
// gpgVault wraps an array of gpgSecretKeyRing
|
||||
type gpgVault struct {
|
||||
entityLists []openpgp.EntityList
|
||||
keyDataList [][]byte // the raw data original passed in
|
||||
}
|
||||
|
||||
// NewGPGVault creates an empty GPGVault
|
||||
func NewGPGVault() GPGVault {
|
||||
return &gpgVault{}
|
||||
}
|
||||
|
||||
// AddSecretKeyRingData adds a secret keyring's to the gpgVault; the raw byte
|
||||
// array read from the file must be passed and will be parsed by this function
|
||||
func (g *gpgVault) AddSecretKeyRingData(gpgSecretKeyRingData []byte) error {
|
||||
// read the private keys
|
||||
r := bytes.NewReader(gpgSecretKeyRingData)
|
||||
entityList, err := openpgp.ReadKeyRing(r)
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "could not read keyring")
|
||||
}
|
||||
g.entityLists = append(g.entityLists, entityList)
|
||||
g.keyDataList = append(g.keyDataList, gpgSecretKeyRingData)
|
||||
return nil
|
||||
}
|
||||
|
||||
// AddSecretKeyRingDataArray adds secret keyrings to the gpgVault; the raw byte
|
||||
// arrays read from files must be passed
|
||||
func (g *gpgVault) AddSecretKeyRingDataArray(gpgSecretKeyRingDataArray [][]byte) error {
|
||||
for _, gpgSecretKeyRingData := range gpgSecretKeyRingDataArray {
|
||||
if err := g.AddSecretKeyRingData(gpgSecretKeyRingData); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// AddSecretKeyRingFiles adds the secret key rings given their filenames
|
||||
func (g *gpgVault) AddSecretKeyRingFiles(filenames []string) error {
|
||||
for _, filename := range filenames {
|
||||
gpgSecretKeyRingData, err := ioutil.ReadFile(filename)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
err = g.AddSecretKeyRingData(gpgSecretKeyRingData)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetGPGPrivateKey gets the bytes of a specified keyid, supplying a passphrase
|
||||
func (g *gpgVault) GetGPGPrivateKey(keyid uint64) ([]openpgp.Key, []byte) {
|
||||
for i, el := range g.entityLists {
|
||||
decKeys := el.KeysByIdUsage(keyid, packet.KeyFlagEncryptCommunications)
|
||||
if len(decKeys) > 0 {
|
||||
return decKeys, g.keyDataList[i]
|
||||
}
|
||||
}
|
||||
return nil, nil
|
||||
}
|
||||
136
vendor/github.com/containers/ocicrypt/keywrap/jwe/keywrapper_jwe.go
generated
vendored
136
vendor/github.com/containers/ocicrypt/keywrap/jwe/keywrapper_jwe.go
generated
vendored
@ -1,136 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package jwe
|
||||
|
||||
import (
|
||||
"crypto/ecdsa"
|
||||
|
||||
"github.com/containers/ocicrypt/config"
|
||||
"github.com/containers/ocicrypt/keywrap"
|
||||
"github.com/containers/ocicrypt/utils"
|
||||
"github.com/pkg/errors"
|
||||
jose "gopkg.in/square/go-jose.v2"
|
||||
)
|
||||
|
||||
type jweKeyWrapper struct {
|
||||
}
|
||||
|
||||
func (kw *jweKeyWrapper) GetAnnotationID() string {
|
||||
return "org.opencontainers.image.enc.keys.jwe"
|
||||
}
|
||||
|
||||
// NewKeyWrapper returns a new key wrapping interface using jwe
|
||||
func NewKeyWrapper() keywrap.KeyWrapper {
|
||||
return &jweKeyWrapper{}
|
||||
}
|
||||
|
||||
// WrapKeys wraps the session key for recpients and encrypts the optsData, which
|
||||
// describe the symmetric key used for encrypting the layer
|
||||
func (kw *jweKeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
|
||||
var joseRecipients []jose.Recipient
|
||||
|
||||
err := addPubKeys(&joseRecipients, ec.Parameters["pubkeys"])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// no recipients is not an error...
|
||||
if len(joseRecipients) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
encrypter, err := jose.NewMultiEncrypter(jose.A256GCM, joseRecipients, nil)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "jose.NewMultiEncrypter failed")
|
||||
}
|
||||
jwe, err := encrypter.Encrypt(optsData)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "JWE Encrypt failed")
|
||||
}
|
||||
return []byte(jwe.FullSerialize()), nil
|
||||
}
|
||||
|
||||
func (kw *jweKeyWrapper) UnwrapKey(dc *config.DecryptConfig, jweString []byte) ([]byte, error) {
|
||||
jwe, err := jose.ParseEncrypted(string(jweString))
|
||||
if err != nil {
|
||||
return nil, errors.New("jose.ParseEncrypted failed")
|
||||
}
|
||||
|
||||
privKeys := kw.GetPrivateKeys(dc.Parameters)
|
||||
if len(privKeys) == 0 {
|
||||
return nil, errors.New("No private keys found for JWE decryption")
|
||||
}
|
||||
privKeysPasswords := kw.getPrivateKeysPasswords(dc.Parameters)
|
||||
if len(privKeysPasswords) != len(privKeys) {
|
||||
return nil, errors.New("Private key password array length must be same as that of private keys")
|
||||
}
|
||||
|
||||
for idx, privKey := range privKeys {
|
||||
key, err := utils.ParsePrivateKey(privKey, privKeysPasswords[idx], "JWE")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
_, _, plain, err := jwe.DecryptMulti(key)
|
||||
if err == nil {
|
||||
return plain, nil
|
||||
}
|
||||
}
|
||||
return nil, errors.New("JWE: No suitable private key found for decryption")
|
||||
}
|
||||
|
||||
func (kw *jweKeyWrapper) NoPossibleKeys(dcparameters map[string][][]byte) bool {
|
||||
return len(kw.GetPrivateKeys(dcparameters)) == 0
|
||||
}
|
||||
|
||||
func (kw *jweKeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
|
||||
return dcparameters["privkeys"]
|
||||
}
|
||||
|
||||
func (kw *jweKeyWrapper) getPrivateKeysPasswords(dcparameters map[string][][]byte) [][]byte {
|
||||
return dcparameters["privkeys-passwords"]
|
||||
}
|
||||
|
||||
func (kw *jweKeyWrapper) GetKeyIdsFromPacket(b64jwes string) ([]uint64, error) {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
func (kw *jweKeyWrapper) GetRecipients(b64jwes string) ([]string, error) {
|
||||
return []string{"[jwe]"}, nil
|
||||
}
|
||||
|
||||
func addPubKeys(joseRecipients *[]jose.Recipient, pubKeys [][]byte) error {
|
||||
if len(pubKeys) == 0 {
|
||||
return nil
|
||||
}
|
||||
for _, pubKey := range pubKeys {
|
||||
key, err := utils.ParsePublicKey(pubKey, "JWE")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
alg := jose.RSA_OAEP
|
||||
switch key.(type) {
|
||||
case *ecdsa.PublicKey:
|
||||
alg = jose.ECDH_ES_A256KW
|
||||
}
|
||||
|
||||
*joseRecipients = append(*joseRecipients, jose.Recipient{
|
||||
Algorithm: alg,
|
||||
Key: key,
|
||||
})
|
||||
}
|
||||
return nil
|
||||
}
|
||||
242
vendor/github.com/containers/ocicrypt/keywrap/keyprovider/keyprovider.go
generated
vendored
242
vendor/github.com/containers/ocicrypt/keywrap/keyprovider/keyprovider.go
generated
vendored
@ -1,242 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package keyprovider
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"github.com/containers/ocicrypt/config"
|
||||
keyproviderconfig "github.com/containers/ocicrypt/config/keyprovider-config"
|
||||
"github.com/containers/ocicrypt/keywrap"
|
||||
"github.com/containers/ocicrypt/utils"
|
||||
keyproviderpb "github.com/containers/ocicrypt/utils/keyprovider"
|
||||
"github.com/pkg/errors"
|
||||
log "github.com/sirupsen/logrus"
|
||||
"google.golang.org/grpc"
|
||||
)
|
||||
|
||||
type keyProviderKeyWrapper struct {
|
||||
provider string
|
||||
attrs keyproviderconfig.KeyProviderAttrs
|
||||
}
|
||||
|
||||
func (kw *keyProviderKeyWrapper) GetAnnotationID() string {
|
||||
return "org.opencontainers.image.enc.keys.provider." + kw.provider
|
||||
}
|
||||
|
||||
// NewKeyWrapper returns a new key wrapping interface using keyprovider
|
||||
func NewKeyWrapper(p string, a keyproviderconfig.KeyProviderAttrs) keywrap.KeyWrapper {
|
||||
return &keyProviderKeyWrapper{provider: p, attrs: a}
|
||||
}
|
||||
|
||||
type KeyProviderKeyWrapProtocolOperation string
|
||||
|
||||
var (
|
||||
OpKeyWrap KeyProviderKeyWrapProtocolOperation = "keywrap"
|
||||
OpKeyUnwrap KeyProviderKeyWrapProtocolOperation = "keyunwrap"
|
||||
)
|
||||
|
||||
// KeyProviderKeyWrapProtocolInput defines the input to the key provider binary or grpc method.
|
||||
type KeyProviderKeyWrapProtocolInput struct {
|
||||
// Operation is either "keywrap" or "keyunwrap"
|
||||
Operation KeyProviderKeyWrapProtocolOperation `json:"op"`
|
||||
// KeyWrapParams encodes the arguments to key wrap if operation is set to wrap
|
||||
KeyWrapParams KeyWrapParams `json:"keywrapparams,omitempty"`
|
||||
// KeyUnwrapParams encodes the arguments to key unwrap if operation is set to unwrap
|
||||
KeyUnwrapParams KeyUnwrapParams `json:"keyunwrapparams,omitempty"`
|
||||
}
|
||||
|
||||
// KeyProviderKeyWrapProtocolOutput defines the output of the key provider binary or grpc method.
|
||||
type KeyProviderKeyWrapProtocolOutput struct {
|
||||
// KeyWrapResult encodes the results to key wrap if operation is to wrap
|
||||
KeyWrapResults KeyWrapResults `json:"keywrapresults,omitempty"`
|
||||
// KeyUnwrapResult encodes the result to key unwrap if operation is to unwrap
|
||||
KeyUnwrapResults KeyUnwrapResults `json:"keyunwrapresults,omitempty"`
|
||||
}
|
||||
|
||||
type KeyWrapParams struct {
|
||||
Ec *config.EncryptConfig `json:"ec"`
|
||||
OptsData []byte `json:"optsdata"`
|
||||
}
|
||||
|
||||
type KeyUnwrapParams struct {
|
||||
Dc *config.DecryptConfig `json:"dc"`
|
||||
Annotation []byte `json:"annotation"`
|
||||
}
|
||||
|
||||
type KeyUnwrapResults struct {
|
||||
OptsData []byte `json:"optsdata"`
|
||||
}
|
||||
|
||||
type KeyWrapResults struct {
|
||||
Annotation []byte `json:"annotation"`
|
||||
}
|
||||
|
||||
var runner utils.CommandExecuter
|
||||
|
||||
func init() {
|
||||
runner = utils.Runner{}
|
||||
}
|
||||
|
||||
// WrapKeys calls appropriate binary executable/grpc server for wrapping the session key for recipients and gets encrypted optsData, which
|
||||
// describe the symmetric key used for encrypting the layer
|
||||
func (kw *keyProviderKeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
|
||||
|
||||
input, err := json.Marshal(KeyProviderKeyWrapProtocolInput{
|
||||
Operation: OpKeyWrap,
|
||||
KeyWrapParams: KeyWrapParams{
|
||||
Ec: ec,
|
||||
OptsData: optsData,
|
||||
},
|
||||
})
|
||||
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if _, ok := ec.Parameters[kw.provider]; ok {
|
||||
if kw.attrs.Command != nil {
|
||||
protocolOuput, err := getProviderCommandOutput(input, kw.attrs.Command)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "error while retrieving keyprovider protocol command output")
|
||||
}
|
||||
return protocolOuput.KeyWrapResults.Annotation, nil
|
||||
} else if kw.attrs.Grpc != "" {
|
||||
protocolOuput, err := getProviderGRPCOutput(input, kw.attrs.Grpc, OpKeyWrap)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "error while retrieving keyprovider protocol grpc output")
|
||||
}
|
||||
|
||||
return protocolOuput.KeyWrapResults.Annotation, nil
|
||||
} else {
|
||||
return nil, errors.New("Unsupported keyprovider invocation. Supported invocation methods are grpc and cmd")
|
||||
}
|
||||
}
|
||||
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
// UnwrapKey calls appropriate binary executable/grpc server for unwrapping the session key based on the protocol given in annotation for recipients and gets decrypted optsData,
|
||||
// which describe the symmetric key used for decrypting the layer
|
||||
func (kw *keyProviderKeyWrapper) UnwrapKey(dc *config.DecryptConfig, jsonString []byte) ([]byte, error) {
|
||||
input, err := json.Marshal(KeyProviderKeyWrapProtocolInput{
|
||||
Operation: OpKeyUnwrap,
|
||||
KeyUnwrapParams: KeyUnwrapParams{
|
||||
Dc: dc,
|
||||
Annotation: jsonString,
|
||||
},
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if kw.attrs.Command != nil {
|
||||
protocolOuput, err := getProviderCommandOutput(input, kw.attrs.Command)
|
||||
if err != nil {
|
||||
// If err is not nil, then ignore it and continue with rest of the given keyproviders
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return protocolOuput.KeyUnwrapResults.OptsData, nil
|
||||
} else if kw.attrs.Grpc != "" {
|
||||
protocolOuput, err := getProviderGRPCOutput(input, kw.attrs.Grpc, OpKeyUnwrap)
|
||||
if err != nil {
|
||||
// If err is not nil, then ignore it and continue with rest of the given keyproviders
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return protocolOuput.KeyUnwrapResults.OptsData, nil
|
||||
} else {
|
||||
return nil, errors.New("Unsupported keyprovider invocation. Supported invocation methods are grpc and cmd")
|
||||
}
|
||||
}
|
||||
|
||||
func getProviderGRPCOutput(input []byte, connString string, operation KeyProviderKeyWrapProtocolOperation) (*KeyProviderKeyWrapProtocolOutput, error) {
|
||||
var protocolOuput KeyProviderKeyWrapProtocolOutput
|
||||
var grpcOutput *keyproviderpb.KeyProviderKeyWrapProtocolOutput
|
||||
cc, err := grpc.Dial(connString, grpc.WithInsecure())
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "error while dialing rpc server")
|
||||
}
|
||||
defer func() {
|
||||
derr := cc.Close()
|
||||
if derr != nil {
|
||||
log.WithError(derr).Error("Error closing grpc socket")
|
||||
}
|
||||
}()
|
||||
|
||||
client := keyproviderpb.NewKeyProviderServiceClient(cc)
|
||||
req := &keyproviderpb.KeyProviderKeyWrapProtocolInput{
|
||||
KeyProviderKeyWrapProtocolInput: input,
|
||||
}
|
||||
|
||||
if operation == OpKeyWrap {
|
||||
grpcOutput, err = client.WrapKey(context.Background(), req)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "Error from grpc method")
|
||||
}
|
||||
} else if operation == OpKeyUnwrap {
|
||||
grpcOutput, err = client.UnWrapKey(context.Background(), req)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "Error from grpc method")
|
||||
}
|
||||
} else {
|
||||
return nil, errors.New("Unsupported operation")
|
||||
}
|
||||
|
||||
respBytes := grpcOutput.GetKeyProviderKeyWrapProtocolOutput()
|
||||
err = json.Unmarshal(respBytes, &protocolOuput)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "Error while unmarshalling grpc method output")
|
||||
}
|
||||
|
||||
return &protocolOuput, nil
|
||||
}
|
||||
|
||||
func getProviderCommandOutput(input []byte, command *keyproviderconfig.Command) (*KeyProviderKeyWrapProtocolOutput, error) {
|
||||
var protocolOuput KeyProviderKeyWrapProtocolOutput
|
||||
// Convert interface to command structure
|
||||
respBytes, err := runner.Exec(command.Path, command.Args, input)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
err = json.Unmarshal(respBytes, &protocolOuput)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "Error while unmarshalling binary executable command output")
|
||||
}
|
||||
return &protocolOuput, nil
|
||||
}
|
||||
|
||||
// Return false as it is not applicable to keyprovider protocol
|
||||
func (kw *keyProviderKeyWrapper) NoPossibleKeys(dcparameters map[string][][]byte) bool {
|
||||
return false
|
||||
}
|
||||
|
||||
// Return nil as it is not applicable to keyprovider protocol
|
||||
func (kw *keyProviderKeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Return nil as it is not applicable to keyprovider protocol
|
||||
func (kw *keyProviderKeyWrapper) GetKeyIdsFromPacket(_ string) ([]uint64, error) {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
// Return nil as it is not applicable to keyprovider protocol
|
||||
func (kw *keyProviderKeyWrapper) GetRecipients(_ string) ([]string, error) {
|
||||
return nil, nil
|
||||
}
|
||||
48
vendor/github.com/containers/ocicrypt/keywrap/keywrap.go
generated
vendored
48
vendor/github.com/containers/ocicrypt/keywrap/keywrap.go
generated
vendored
@ -1,48 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package keywrap
|
||||
|
||||
import (
|
||||
"github.com/containers/ocicrypt/config"
|
||||
)
|
||||
|
||||
// KeyWrapper is the interface used for wrapping keys using
|
||||
// a specific encryption technology (pgp, jwe)
|
||||
type KeyWrapper interface {
|
||||
WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error)
|
||||
UnwrapKey(dc *config.DecryptConfig, annotation []byte) ([]byte, error)
|
||||
GetAnnotationID() string
|
||||
|
||||
// NoPossibleKeys returns true if there is no possibility of performing
|
||||
// decryption for parameters provided.
|
||||
NoPossibleKeys(dcparameters map[string][][]byte) bool
|
||||
|
||||
// GetPrivateKeys (optional) gets the array of private keys. It is an optional implementation
|
||||
// as in some key services, a private key may not be exportable (i.e. HSM)
|
||||
// If not implemented, return nil
|
||||
GetPrivateKeys(dcparameters map[string][][]byte) [][]byte
|
||||
|
||||
// GetKeyIdsFromPacket (optional) gets a list of key IDs. This is optional as some encryption
|
||||
// schemes may not have a notion of key IDs
|
||||
// If not implemented, return the nil slice
|
||||
GetKeyIdsFromPacket(packet string) ([]uint64, error)
|
||||
|
||||
// GetRecipients (optional) gets a list of recipients. It is optional due to the validity of
|
||||
// recipients in a particular encryptiong scheme
|
||||
// If not implemented, return the nil slice
|
||||
GetRecipients(packet string) ([]string, error)
|
||||
}
|
||||
273
vendor/github.com/containers/ocicrypt/keywrap/pgp/keywrapper_gpg.go
generated
vendored
273
vendor/github.com/containers/ocicrypt/keywrap/pgp/keywrapper_gpg.go
generated
vendored
@ -1,273 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package pgp
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto"
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
"io"
|
||||
"io/ioutil"
|
||||
"net/mail"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/containers/ocicrypt/config"
|
||||
"github.com/containers/ocicrypt/keywrap"
|
||||
"github.com/pkg/errors"
|
||||
"golang.org/x/crypto/openpgp"
|
||||
"golang.org/x/crypto/openpgp/packet"
|
||||
)
|
||||
|
||||
type gpgKeyWrapper struct {
|
||||
}
|
||||
|
||||
// NewKeyWrapper returns a new key wrapping interface for pgp
|
||||
func NewKeyWrapper() keywrap.KeyWrapper {
|
||||
return &gpgKeyWrapper{}
|
||||
}
|
||||
|
||||
var (
|
||||
// GPGDefaultEncryptConfig is the default configuration for layer encryption/decryption
|
||||
GPGDefaultEncryptConfig = &packet.Config{
|
||||
Rand: rand.Reader,
|
||||
DefaultHash: crypto.SHA256,
|
||||
DefaultCipher: packet.CipherAES256,
|
||||
CompressionConfig: &packet.CompressionConfig{Level: 0}, // No compression
|
||||
RSABits: 2048,
|
||||
}
|
||||
)
|
||||
|
||||
func (kw *gpgKeyWrapper) GetAnnotationID() string {
|
||||
return "org.opencontainers.image.enc.keys.pgp"
|
||||
}
|
||||
|
||||
// WrapKeys wraps the session key for recpients and encrypts the optsData, which
|
||||
// describe the symmetric key used for encrypting the layer
|
||||
func (kw *gpgKeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
|
||||
ciphertext := new(bytes.Buffer)
|
||||
el, err := kw.createEntityList(ec)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "unable to create entity list")
|
||||
}
|
||||
if len(el) == 0 {
|
||||
// nothing to do -- not an error
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
plaintextWriter, err := openpgp.Encrypt(ciphertext,
|
||||
el, /*EntityList*/
|
||||
nil, /* Sign*/
|
||||
nil, /* FileHint */
|
||||
GPGDefaultEncryptConfig)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if _, err = plaintextWriter.Write(optsData); err != nil {
|
||||
return nil, err
|
||||
} else if err = plaintextWriter.Close(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return ciphertext.Bytes(), err
|
||||
}
|
||||
|
||||
// UnwrapKey unwraps the symmetric key with which the layer is encrypted
|
||||
// This symmetric key is encrypted in the PGP payload.
|
||||
func (kw *gpgKeyWrapper) UnwrapKey(dc *config.DecryptConfig, pgpPacket []byte) ([]byte, error) {
|
||||
pgpPrivateKeys, pgpPrivateKeysPwd, err := kw.getKeyParameters(dc.Parameters)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
for idx, pgpPrivateKey := range pgpPrivateKeys {
|
||||
r := bytes.NewBuffer(pgpPrivateKey)
|
||||
entityList, err := openpgp.ReadKeyRing(r)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "unable to parse private keys")
|
||||
}
|
||||
|
||||
var prompt openpgp.PromptFunction
|
||||
if len(pgpPrivateKeysPwd) > idx {
|
||||
responded := false
|
||||
prompt = func(keys []openpgp.Key, symmetric bool) ([]byte, error) {
|
||||
if responded {
|
||||
return nil, fmt.Errorf("don't seem to have the right password")
|
||||
}
|
||||
responded = true
|
||||
for _, key := range keys {
|
||||
if key.PrivateKey != nil {
|
||||
_ = key.PrivateKey.Decrypt(pgpPrivateKeysPwd[idx])
|
||||
}
|
||||
}
|
||||
return pgpPrivateKeysPwd[idx], nil
|
||||
}
|
||||
}
|
||||
|
||||
r = bytes.NewBuffer(pgpPacket)
|
||||
md, err := openpgp.ReadMessage(r, entityList, prompt, GPGDefaultEncryptConfig)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
// we get the plain key options back
|
||||
optsData, err := ioutil.ReadAll(md.UnverifiedBody)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
return optsData, nil
|
||||
}
|
||||
return nil, errors.New("PGP: No suitable key found to unwrap key")
|
||||
}
|
||||
|
||||
// GetKeyIdsFromWrappedKeys converts the base64 encoded PGPPacket to uint64 keyIds
|
||||
func (kw *gpgKeyWrapper) GetKeyIdsFromPacket(b64pgpPackets string) ([]uint64, error) {
|
||||
|
||||
var keyids []uint64
|
||||
for _, b64pgpPacket := range strings.Split(b64pgpPackets, ",") {
|
||||
pgpPacket, err := base64.StdEncoding.DecodeString(b64pgpPacket)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "could not decode base64 encoded PGP packet")
|
||||
}
|
||||
newids, err := kw.getKeyIDs(pgpPacket)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
keyids = append(keyids, newids...)
|
||||
}
|
||||
return keyids, nil
|
||||
}
|
||||
|
||||
// getKeyIDs parses a PGPPacket and gets the list of recipients' key IDs
|
||||
func (kw *gpgKeyWrapper) getKeyIDs(pgpPacket []byte) ([]uint64, error) {
|
||||
var keyids []uint64
|
||||
|
||||
kbuf := bytes.NewBuffer(pgpPacket)
|
||||
packets := packet.NewReader(kbuf)
|
||||
ParsePackets:
|
||||
for {
|
||||
p, err := packets.Next()
|
||||
if err == io.EOF {
|
||||
break ParsePackets
|
||||
}
|
||||
if err != nil {
|
||||
return []uint64{}, errors.Wrapf(err, "packets.Next() failed")
|
||||
}
|
||||
switch p := p.(type) {
|
||||
case *packet.EncryptedKey:
|
||||
keyids = append(keyids, p.KeyId)
|
||||
case *packet.SymmetricallyEncrypted:
|
||||
break ParsePackets
|
||||
}
|
||||
}
|
||||
return keyids, nil
|
||||
}
|
||||
|
||||
// GetRecipients converts the wrappedKeys to an array of recipients
|
||||
func (kw *gpgKeyWrapper) GetRecipients(b64pgpPackets string) ([]string, error) {
|
||||
keyIds, err := kw.GetKeyIdsFromPacket(b64pgpPackets)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var array []string
|
||||
for _, keyid := range keyIds {
|
||||
array = append(array, "0x"+strconv.FormatUint(keyid, 16))
|
||||
}
|
||||
return array, nil
|
||||
}
|
||||
|
||||
func (kw *gpgKeyWrapper) NoPossibleKeys(dcparameters map[string][][]byte) bool {
|
||||
return len(kw.GetPrivateKeys(dcparameters)) == 0
|
||||
}
|
||||
|
||||
func (kw *gpgKeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
|
||||
return dcparameters["gpg-privatekeys"]
|
||||
}
|
||||
|
||||
func (kw *gpgKeyWrapper) getKeyParameters(dcparameters map[string][][]byte) ([][]byte, [][]byte, error) {
|
||||
|
||||
privKeys := kw.GetPrivateKeys(dcparameters)
|
||||
if len(privKeys) == 0 {
|
||||
return nil, nil, errors.New("GPG: Missing private key parameter")
|
||||
}
|
||||
|
||||
return privKeys, dcparameters["gpg-privatekeys-passwords"], nil
|
||||
}
|
||||
|
||||
// createEntityList creates the opengpg EntityList by reading the KeyRing
|
||||
// first and then filtering out recipients' keys
|
||||
func (kw *gpgKeyWrapper) createEntityList(ec *config.EncryptConfig) (openpgp.EntityList, error) {
|
||||
pgpPubringFile := ec.Parameters["gpg-pubkeyringfile"]
|
||||
if len(pgpPubringFile) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
r := bytes.NewReader(pgpPubringFile[0])
|
||||
|
||||
entityList, err := openpgp.ReadKeyRing(r)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
gpgRecipients := ec.Parameters["gpg-recipients"]
|
||||
if len(gpgRecipients) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
rSet := make(map[string]int)
|
||||
for _, r := range gpgRecipients {
|
||||
rSet[string(r)] = 0
|
||||
}
|
||||
|
||||
var filteredList openpgp.EntityList
|
||||
for _, entity := range entityList {
|
||||
for k := range entity.Identities {
|
||||
addr, err := mail.ParseAddress(k)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for _, r := range gpgRecipients {
|
||||
recp := string(r)
|
||||
if strings.Compare(addr.Name, recp) == 0 || strings.Compare(addr.Address, recp) == 0 {
|
||||
filteredList = append(filteredList, entity)
|
||||
rSet[recp] = rSet[recp] + 1
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// make sure we found keys for all the Recipients...
|
||||
var buffer bytes.Buffer
|
||||
notFound := false
|
||||
buffer.WriteString("PGP: No key found for the following recipients: ")
|
||||
|
||||
for k, v := range rSet {
|
||||
if v == 0 {
|
||||
if notFound {
|
||||
buffer.WriteString(", ")
|
||||
}
|
||||
buffer.WriteString(k)
|
||||
notFound = true
|
||||
}
|
||||
}
|
||||
|
||||
if notFound {
|
||||
return nil, errors.New(buffer.String())
|
||||
}
|
||||
|
||||
return filteredList, nil
|
||||
}
|
||||
147
vendor/github.com/containers/ocicrypt/keywrap/pkcs11/keywrapper_pkcs11.go
generated
vendored
147
vendor/github.com/containers/ocicrypt/keywrap/pkcs11/keywrapper_pkcs11.go
generated
vendored
@ -1,147 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package pkcs11
|
||||
|
||||
import (
|
||||
"github.com/containers/ocicrypt/config"
|
||||
"github.com/containers/ocicrypt/crypto/pkcs11"
|
||||
"github.com/containers/ocicrypt/keywrap"
|
||||
"github.com/containers/ocicrypt/utils"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
type pkcs11KeyWrapper struct {
|
||||
}
|
||||
|
||||
func (kw *pkcs11KeyWrapper) GetAnnotationID() string {
|
||||
return "org.opencontainers.image.enc.keys.pkcs11"
|
||||
}
|
||||
|
||||
// NewKeyWrapper returns a new key wrapping interface using pkcs11
|
||||
func NewKeyWrapper() keywrap.KeyWrapper {
|
||||
return &pkcs11KeyWrapper{}
|
||||
}
|
||||
|
||||
// WrapKeys wraps the session key for recpients and encrypts the optsData, which
|
||||
// describe the symmetric key used for encrypting the layer
|
||||
func (kw *pkcs11KeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
|
||||
pkcs11Recipients, err := addPubKeys(&ec.DecryptConfig, append(ec.Parameters["pkcs11-pubkeys"], ec.Parameters["pkcs11-yamls"]...))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// no recipients is not an error...
|
||||
if len(pkcs11Recipients) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
jsonString, err := pkcs11.EncryptMultiple(pkcs11Recipients, optsData)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "PKCS11 EncryptMulitple failed")
|
||||
}
|
||||
return jsonString, nil
|
||||
}
|
||||
|
||||
func (kw *pkcs11KeyWrapper) UnwrapKey(dc *config.DecryptConfig, jsonString []byte) ([]byte, error) {
|
||||
var pkcs11PrivKeys []*pkcs11.Pkcs11KeyFileObject
|
||||
|
||||
privKeys := kw.GetPrivateKeys(dc.Parameters)
|
||||
if len(privKeys) == 0 {
|
||||
return nil, errors.New("No private keys found for PKCS11 decryption")
|
||||
}
|
||||
|
||||
p11conf, err := p11confFromParameters(dc.Parameters)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
for _, privKey := range privKeys {
|
||||
key, err := utils.ParsePrivateKey(privKey, nil, "PKCS11")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
switch pkcs11PrivKey := key.(type) {
|
||||
case *pkcs11.Pkcs11KeyFileObject:
|
||||
if p11conf != nil {
|
||||
pkcs11PrivKey.Uri.SetModuleDirectories(p11conf.ModuleDirectories)
|
||||
pkcs11PrivKey.Uri.SetAllowedModulePaths(p11conf.AllowedModulePaths)
|
||||
}
|
||||
pkcs11PrivKeys = append(pkcs11PrivKeys, pkcs11PrivKey)
|
||||
default:
|
||||
continue
|
||||
}
|
||||
}
|
||||
|
||||
plaintext, err := pkcs11.Decrypt(pkcs11PrivKeys, jsonString)
|
||||
if err == nil {
|
||||
return plaintext, nil
|
||||
}
|
||||
|
||||
return nil, errors.Wrapf(err, "PKCS11: No suitable private key found for decryption")
|
||||
}
|
||||
|
||||
func (kw *pkcs11KeyWrapper) NoPossibleKeys(dcparameters map[string][][]byte) bool {
|
||||
return len(kw.GetPrivateKeys(dcparameters)) == 0
|
||||
}
|
||||
|
||||
func (kw *pkcs11KeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
|
||||
return dcparameters["pkcs11-yamls"]
|
||||
}
|
||||
|
||||
func (kw *pkcs11KeyWrapper) GetKeyIdsFromPacket(_ string) ([]uint64, error) {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
func (kw *pkcs11KeyWrapper) GetRecipients(_ string) ([]string, error) {
|
||||
return []string{"[pkcs11]"}, nil
|
||||
}
|
||||
|
||||
func addPubKeys(dc *config.DecryptConfig, pubKeys [][]byte) ([]interface{}, error) {
|
||||
var pkcs11Keys []interface{}
|
||||
|
||||
if len(pubKeys) == 0 {
|
||||
return pkcs11Keys, nil
|
||||
}
|
||||
|
||||
p11conf, err := p11confFromParameters(dc.Parameters)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
for _, pubKey := range pubKeys {
|
||||
key, err := utils.ParsePublicKey(pubKey, "PKCS11")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
switch pkcs11PubKey := key.(type) {
|
||||
case *pkcs11.Pkcs11KeyFileObject:
|
||||
if p11conf != nil {
|
||||
pkcs11PubKey.Uri.SetModuleDirectories(p11conf.ModuleDirectories)
|
||||
pkcs11PubKey.Uri.SetAllowedModulePaths(p11conf.AllowedModulePaths)
|
||||
}
|
||||
}
|
||||
pkcs11Keys = append(pkcs11Keys, key)
|
||||
}
|
||||
return pkcs11Keys, nil
|
||||
}
|
||||
|
||||
func p11confFromParameters(dcparameters map[string][][]byte) (*pkcs11.Pkcs11Config, error) {
|
||||
if _, ok := dcparameters["pkcs11-config"]; ok {
|
||||
return pkcs11.ParsePkcs11ConfigFile(dcparameters["pkcs11-config"][0])
|
||||
}
|
||||
return nil, nil
|
||||
}
|
||||
136
vendor/github.com/containers/ocicrypt/keywrap/pkcs7/keywrapper_pkcs7.go
generated
vendored
136
vendor/github.com/containers/ocicrypt/keywrap/pkcs7/keywrapper_pkcs7.go
generated
vendored
@ -1,136 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package pkcs7
|
||||
|
||||
import (
|
||||
"crypto"
|
||||
"crypto/x509"
|
||||
|
||||
"github.com/containers/ocicrypt/config"
|
||||
"github.com/containers/ocicrypt/keywrap"
|
||||
"github.com/containers/ocicrypt/utils"
|
||||
"github.com/pkg/errors"
|
||||
"go.mozilla.org/pkcs7"
|
||||
)
|
||||
|
||||
type pkcs7KeyWrapper struct {
|
||||
}
|
||||
|
||||
// NewKeyWrapper returns a new key wrapping interface using jwe
|
||||
func NewKeyWrapper() keywrap.KeyWrapper {
|
||||
return &pkcs7KeyWrapper{}
|
||||
}
|
||||
|
||||
func (kw *pkcs7KeyWrapper) GetAnnotationID() string {
|
||||
return "org.opencontainers.image.enc.keys.pkcs7"
|
||||
}
|
||||
|
||||
// WrapKeys wraps the session key for recpients and encrypts the optsData, which
|
||||
// describe the symmetric key used for encrypting the layer
|
||||
func (kw *pkcs7KeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
|
||||
x509Certs, err := collectX509s(ec.Parameters["x509s"])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// no recipients is not an error...
|
||||
if len(x509Certs) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
pkcs7.ContentEncryptionAlgorithm = pkcs7.EncryptionAlgorithmAES128GCM
|
||||
return pkcs7.Encrypt(optsData, x509Certs)
|
||||
}
|
||||
|
||||
func collectX509s(x509s [][]byte) ([]*x509.Certificate, error) {
|
||||
if len(x509s) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
var x509Certs []*x509.Certificate
|
||||
for _, x509 := range x509s {
|
||||
x509Cert, err := utils.ParseCertificate(x509, "PKCS7")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
x509Certs = append(x509Certs, x509Cert)
|
||||
}
|
||||
return x509Certs, nil
|
||||
}
|
||||
|
||||
func (kw *pkcs7KeyWrapper) NoPossibleKeys(dcparameters map[string][][]byte) bool {
|
||||
return len(kw.GetPrivateKeys(dcparameters)) == 0
|
||||
}
|
||||
|
||||
func (kw *pkcs7KeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
|
||||
return dcparameters["privkeys"]
|
||||
}
|
||||
|
||||
func (kw *pkcs7KeyWrapper) getPrivateKeysPasswords(dcparameters map[string][][]byte) [][]byte {
|
||||
return dcparameters["privkeys-passwords"]
|
||||
}
|
||||
|
||||
// UnwrapKey unwraps the symmetric key with which the layer is encrypted
|
||||
// This symmetric key is encrypted in the PKCS7 payload.
|
||||
func (kw *pkcs7KeyWrapper) UnwrapKey(dc *config.DecryptConfig, pkcs7Packet []byte) ([]byte, error) {
|
||||
privKeys := kw.GetPrivateKeys(dc.Parameters)
|
||||
if len(privKeys) == 0 {
|
||||
return nil, errors.New("no private keys found for PKCS7 decryption")
|
||||
}
|
||||
privKeysPasswords := kw.getPrivateKeysPasswords(dc.Parameters)
|
||||
if len(privKeysPasswords) != len(privKeys) {
|
||||
return nil, errors.New("private key password array length must be same as that of private keys")
|
||||
}
|
||||
|
||||
x509Certs, err := collectX509s(dc.Parameters["x509s"])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if len(x509Certs) == 0 {
|
||||
return nil, errors.New("no x509 certificates found needed for PKCS7 decryption")
|
||||
}
|
||||
|
||||
p7, err := pkcs7.Parse(pkcs7Packet)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "could not parse PKCS7 packet")
|
||||
}
|
||||
|
||||
for idx, privKey := range privKeys {
|
||||
key, err := utils.ParsePrivateKey(privKey, privKeysPasswords[idx], "PKCS7")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for _, x509Cert := range x509Certs {
|
||||
optsData, err := p7.Decrypt(x509Cert, crypto.PrivateKey(key))
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
return optsData, nil
|
||||
}
|
||||
}
|
||||
return nil, errors.New("PKCS7: No suitable private key found for decryption")
|
||||
}
|
||||
|
||||
// GetKeyIdsFromWrappedKeys converts the base64 encoded Packet to uint64 keyIds;
|
||||
// We cannot do this with pkcs7
|
||||
func (kw *pkcs7KeyWrapper) GetKeyIdsFromPacket(b64pkcs7Packets string) ([]uint64, error) {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
// GetRecipients converts the wrappedKeys to an array of recipients
|
||||
// We cannot do this with pkcs7
|
||||
func (kw *pkcs7KeyWrapper) GetRecipients(b64pkcs7Packets string) ([]string, error) {
|
||||
return []string{"[pkcs7]"}, nil
|
||||
}
|
||||
40
vendor/github.com/containers/ocicrypt/reader.go
generated
vendored
40
vendor/github.com/containers/ocicrypt/reader.go
generated
vendored
@ -1,40 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package ocicrypt
|
||||
|
||||
import (
|
||||
"io"
|
||||
)
|
||||
|
||||
type readerAtReader struct {
|
||||
r io.ReaderAt
|
||||
off int64
|
||||
}
|
||||
|
||||
// ReaderFromReaderAt takes an io.ReaderAt and returns an io.Reader
|
||||
func ReaderFromReaderAt(r io.ReaderAt) io.Reader {
|
||||
return &readerAtReader{
|
||||
r: r,
|
||||
off: 0,
|
||||
}
|
||||
}
|
||||
|
||||
func (rar *readerAtReader) Read(p []byte) (n int, err error) {
|
||||
n, err = rar.r.ReadAt(p, rar.off)
|
||||
rar.off += int64(n)
|
||||
return n, err
|
||||
}
|
||||
16
vendor/github.com/containers/ocicrypt/spec/spec.go
generated
vendored
16
vendor/github.com/containers/ocicrypt/spec/spec.go
generated
vendored
@ -1,16 +0,0 @@
|
||||
package spec
|
||||
|
||||
const (
|
||||
// MediaTypeLayerEnc is MIME type used for encrypted layers.
|
||||
MediaTypeLayerEnc = "application/vnd.oci.image.layer.v1.tar+encrypted"
|
||||
// MediaTypeLayerGzipEnc is MIME type used for encrypted gzip-compressed layers.
|
||||
MediaTypeLayerGzipEnc = "application/vnd.oci.image.layer.v1.tar+gzip+encrypted"
|
||||
// MediaTypeLayerZstdEnc is MIME type used for encrypted zstd-compressed layers.
|
||||
MediaTypeLayerZstdEnc = "application/vnd.oci.image.layer.v1.tar+zstd+encrypted"
|
||||
// MediaTypeLayerNonDistributableEnc is MIME type used for non distributable encrypted layers.
|
||||
MediaTypeLayerNonDistributableEnc = "application/vnd.oci.image.layer.nondistributable.v1.tar+encrypted"
|
||||
// MediaTypeLayerGzipEnc is MIME type used for non distributable encrypted gzip-compressed layers.
|
||||
MediaTypeLayerNonDistributableGzipEnc = "application/vnd.oci.image.layer.nondistributable.v1.tar+gzip+encrypted"
|
||||
// MediaTypeLayerZstdEnc is MIME type used for non distributable encrypted zstd-compressed layers.
|
||||
MediaTypeLayerNonDistributableZsdtEnc = "application/vnd.oci.image.layer.nondistributable.v1.tar+zstd+encrypted"
|
||||
)
|
||||
109
vendor/github.com/containers/ocicrypt/utils/delayedreader.go
generated
vendored
109
vendor/github.com/containers/ocicrypt/utils/delayedreader.go
generated
vendored
@ -1,109 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package utils
|
||||
|
||||
import (
|
||||
"io"
|
||||
)
|
||||
|
||||
func min(a, b int) int {
|
||||
if a < b {
|
||||
return a
|
||||
}
|
||||
return b
|
||||
}
|
||||
|
||||
// DelayedReader wraps a io.Reader and allows a client to use the Reader
|
||||
// interface. The DelayedReader holds back some buffer to the client
|
||||
// so that it can report any error that occurred on the Reader it wraps
|
||||
// early to the client while it may still have held some data back.
|
||||
type DelayedReader struct {
|
||||
reader io.Reader // Reader to Read() bytes from and delay them
|
||||
err error // error that occurred on the reader
|
||||
buffer []byte // delay buffer
|
||||
bufbytes int // number of bytes in the delay buffer to give to Read(); on '0' we return 'EOF' to caller
|
||||
bufoff int // offset in the delay buffer to give to Read()
|
||||
}
|
||||
|
||||
// NewDelayedReader wraps a io.Reader and allocates a delay buffer of bufsize bytes
|
||||
func NewDelayedReader(reader io.Reader, bufsize uint) io.Reader {
|
||||
return &DelayedReader{
|
||||
reader: reader,
|
||||
buffer: make([]byte, bufsize),
|
||||
}
|
||||
}
|
||||
|
||||
// Read implements the io.Reader interface
|
||||
func (dr *DelayedReader) Read(p []byte) (int, error) {
|
||||
if dr.err != nil && dr.err != io.EOF {
|
||||
return 0, dr.err
|
||||
}
|
||||
|
||||
// if we are completely drained, return io.EOF
|
||||
if dr.err == io.EOF && dr.bufbytes == 0 {
|
||||
return 0, io.EOF
|
||||
}
|
||||
|
||||
// only at the beginning we fill our delay buffer in an extra step
|
||||
if dr.bufbytes < len(dr.buffer) && dr.err == nil {
|
||||
dr.bufbytes, dr.err = FillBuffer(dr.reader, dr.buffer)
|
||||
if dr.err != nil && dr.err != io.EOF {
|
||||
return 0, dr.err
|
||||
}
|
||||
}
|
||||
// dr.err != nil means we have EOF and can drain the delay buffer
|
||||
// otherwise we need to still read from the reader
|
||||
|
||||
var tmpbuf []byte
|
||||
tmpbufbytes := 0
|
||||
if dr.err == nil {
|
||||
tmpbuf = make([]byte, len(p))
|
||||
tmpbufbytes, dr.err = FillBuffer(dr.reader, tmpbuf)
|
||||
if dr.err != nil && dr.err != io.EOF {
|
||||
return 0, dr.err
|
||||
}
|
||||
}
|
||||
|
||||
// copy out of the delay buffer into 'p'
|
||||
tocopy1 := min(len(p), dr.bufbytes)
|
||||
c1 := copy(p[:tocopy1], dr.buffer[dr.bufoff:])
|
||||
dr.bufoff += c1
|
||||
dr.bufbytes -= c1
|
||||
|
||||
c2 := 0
|
||||
// can p still hold more data?
|
||||
if c1 < len(p) {
|
||||
// copy out of the tmpbuf into 'p'
|
||||
c2 = copy(p[tocopy1:], tmpbuf[:tmpbufbytes])
|
||||
}
|
||||
|
||||
// if tmpbuf holds data we need to hold onto, copy them
|
||||
// into the delay buffer
|
||||
if tmpbufbytes-c2 > 0 {
|
||||
// left-shift the delay buffer and append the tmpbuf's remaining data
|
||||
dr.buffer = dr.buffer[dr.bufoff : dr.bufoff+dr.bufbytes]
|
||||
dr.buffer = append(dr.buffer, tmpbuf[c2:tmpbufbytes]...)
|
||||
dr.bufoff = 0
|
||||
dr.bufbytes = len(dr.buffer)
|
||||
}
|
||||
|
||||
var err error
|
||||
if dr.bufbytes == 0 {
|
||||
err = io.EOF
|
||||
}
|
||||
return c1 + c2, err
|
||||
}
|
||||
56
vendor/github.com/containers/ocicrypt/utils/ioutils.go
generated
vendored
56
vendor/github.com/containers/ocicrypt/utils/ioutils.go
generated
vendored
@ -1,56 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package utils
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"github.com/pkg/errors"
|
||||
"io"
|
||||
"os/exec"
|
||||
)
|
||||
|
||||
// FillBuffer fills the given buffer with as many bytes from the reader as possible. It returns
|
||||
// EOF if an EOF was encountered or any other error.
|
||||
func FillBuffer(reader io.Reader, buffer []byte) (int, error) {
|
||||
n, err := io.ReadFull(reader, buffer)
|
||||
if err == io.ErrUnexpectedEOF {
|
||||
return n, io.EOF
|
||||
}
|
||||
return n, err
|
||||
}
|
||||
|
||||
// first argument is the command, like cat or echo,
|
||||
// the second is the list of args to pass to it
|
||||
type CommandExecuter interface {
|
||||
Exec(string, []string, []byte) ([]byte, error)
|
||||
}
|
||||
|
||||
type Runner struct{}
|
||||
|
||||
// ExecuteCommand is used to execute a linux command line command and return the output of the command with an error if it exists.
|
||||
func (r Runner) Exec(cmdName string, args []string, input []byte) ([]byte, error) {
|
||||
var out bytes.Buffer
|
||||
stdInputBuffer := bytes.NewBuffer(input)
|
||||
cmd := exec.Command(cmdName, args...)
|
||||
cmd.Stdin = stdInputBuffer
|
||||
cmd.Stdout = &out
|
||||
err := cmd.Run()
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "Error while running command: %s", cmdName)
|
||||
}
|
||||
return out.Bytes(), nil
|
||||
}
|
||||
243
vendor/github.com/containers/ocicrypt/utils/keyprovider/keyprovider.pb.go
generated
vendored
243
vendor/github.com/containers/ocicrypt/utils/keyprovider/keyprovider.pb.go
generated
vendored
@ -1,243 +0,0 @@
|
||||
// Code generated by protoc-gen-go. DO NOT EDIT.
|
||||
// source: keyprovider.proto
|
||||
|
||||
package keyprovider
|
||||
|
||||
import (
|
||||
context "context"
|
||||
fmt "fmt"
|
||||
proto "github.com/golang/protobuf/proto"
|
||||
grpc "google.golang.org/grpc"
|
||||
codes "google.golang.org/grpc/codes"
|
||||
status "google.golang.org/grpc/status"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// This is a compile-time assertion to ensure that this generated file
|
||||
// is compatible with the proto package it is being compiled against.
|
||||
// A compilation error at this line likely means your copy of the
|
||||
// proto package needs to be updated.
|
||||
const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
|
||||
|
||||
type KeyProviderKeyWrapProtocolInput struct {
|
||||
KeyProviderKeyWrapProtocolInput []byte `protobuf:"bytes,1,opt,name=KeyProviderKeyWrapProtocolInput,proto3" json:"KeyProviderKeyWrapProtocolInput,omitempty"`
|
||||
XXX_NoUnkeyedLiteral struct{} `json:"-"`
|
||||
XXX_unrecognized []byte `json:"-"`
|
||||
XXX_sizecache int32 `json:"-"`
|
||||
}
|
||||
|
||||
func (m *KeyProviderKeyWrapProtocolInput) Reset() { *m = KeyProviderKeyWrapProtocolInput{} }
|
||||
func (m *KeyProviderKeyWrapProtocolInput) String() string { return proto.CompactTextString(m) }
|
||||
func (*KeyProviderKeyWrapProtocolInput) ProtoMessage() {}
|
||||
func (*KeyProviderKeyWrapProtocolInput) Descriptor() ([]byte, []int) {
|
||||
return fileDescriptor_da74c8e785ad390c, []int{0}
|
||||
}
|
||||
|
||||
func (m *KeyProviderKeyWrapProtocolInput) XXX_Unmarshal(b []byte) error {
|
||||
return xxx_messageInfo_KeyProviderKeyWrapProtocolInput.Unmarshal(m, b)
|
||||
}
|
||||
func (m *KeyProviderKeyWrapProtocolInput) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
|
||||
return xxx_messageInfo_KeyProviderKeyWrapProtocolInput.Marshal(b, m, deterministic)
|
||||
}
|
||||
func (m *KeyProviderKeyWrapProtocolInput) XXX_Merge(src proto.Message) {
|
||||
xxx_messageInfo_KeyProviderKeyWrapProtocolInput.Merge(m, src)
|
||||
}
|
||||
func (m *KeyProviderKeyWrapProtocolInput) XXX_Size() int {
|
||||
return xxx_messageInfo_KeyProviderKeyWrapProtocolInput.Size(m)
|
||||
}
|
||||
func (m *KeyProviderKeyWrapProtocolInput) XXX_DiscardUnknown() {
|
||||
xxx_messageInfo_KeyProviderKeyWrapProtocolInput.DiscardUnknown(m)
|
||||
}
|
||||
|
||||
var xxx_messageInfo_KeyProviderKeyWrapProtocolInput proto.InternalMessageInfo
|
||||
|
||||
func (m *KeyProviderKeyWrapProtocolInput) GetKeyProviderKeyWrapProtocolInput() []byte {
|
||||
if m != nil {
|
||||
return m.KeyProviderKeyWrapProtocolInput
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
type KeyProviderKeyWrapProtocolOutput struct {
|
||||
KeyProviderKeyWrapProtocolOutput []byte `protobuf:"bytes,1,opt,name=KeyProviderKeyWrapProtocolOutput,proto3" json:"KeyProviderKeyWrapProtocolOutput,omitempty"`
|
||||
XXX_NoUnkeyedLiteral struct{} `json:"-"`
|
||||
XXX_unrecognized []byte `json:"-"`
|
||||
XXX_sizecache int32 `json:"-"`
|
||||
}
|
||||
|
||||
func (m *KeyProviderKeyWrapProtocolOutput) Reset() { *m = KeyProviderKeyWrapProtocolOutput{} }
|
||||
func (m *KeyProviderKeyWrapProtocolOutput) String() string { return proto.CompactTextString(m) }
|
||||
func (*KeyProviderKeyWrapProtocolOutput) ProtoMessage() {}
|
||||
func (*KeyProviderKeyWrapProtocolOutput) Descriptor() ([]byte, []int) {
|
||||
return fileDescriptor_da74c8e785ad390c, []int{1}
|
||||
}
|
||||
|
||||
func (m *KeyProviderKeyWrapProtocolOutput) XXX_Unmarshal(b []byte) error {
|
||||
return xxx_messageInfo_KeyProviderKeyWrapProtocolOutput.Unmarshal(m, b)
|
||||
}
|
||||
func (m *KeyProviderKeyWrapProtocolOutput) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
|
||||
return xxx_messageInfo_KeyProviderKeyWrapProtocolOutput.Marshal(b, m, deterministic)
|
||||
}
|
||||
func (m *KeyProviderKeyWrapProtocolOutput) XXX_Merge(src proto.Message) {
|
||||
xxx_messageInfo_KeyProviderKeyWrapProtocolOutput.Merge(m, src)
|
||||
}
|
||||
func (m *KeyProviderKeyWrapProtocolOutput) XXX_Size() int {
|
||||
return xxx_messageInfo_KeyProviderKeyWrapProtocolOutput.Size(m)
|
||||
}
|
||||
func (m *KeyProviderKeyWrapProtocolOutput) XXX_DiscardUnknown() {
|
||||
xxx_messageInfo_KeyProviderKeyWrapProtocolOutput.DiscardUnknown(m)
|
||||
}
|
||||
|
||||
var xxx_messageInfo_KeyProviderKeyWrapProtocolOutput proto.InternalMessageInfo
|
||||
|
||||
func (m *KeyProviderKeyWrapProtocolOutput) GetKeyProviderKeyWrapProtocolOutput() []byte {
|
||||
if m != nil {
|
||||
return m.KeyProviderKeyWrapProtocolOutput
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func init() {
|
||||
proto.RegisterType((*KeyProviderKeyWrapProtocolInput)(nil), "keyprovider.keyProviderKeyWrapProtocolInput")
|
||||
proto.RegisterType((*KeyProviderKeyWrapProtocolOutput)(nil), "keyprovider.keyProviderKeyWrapProtocolOutput")
|
||||
}
|
||||
|
||||
func init() {
|
||||
proto.RegisterFile("keyprovider.proto", fileDescriptor_da74c8e785ad390c)
|
||||
}
|
||||
|
||||
var fileDescriptor_da74c8e785ad390c = []byte{
|
||||
// 169 bytes of a gzipped FileDescriptorProto
|
||||
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0x12, 0xcc, 0x4e, 0xad, 0x2c,
|
||||
0x28, 0xca, 0x2f, 0xcb, 0x4c, 0x49, 0x2d, 0xd2, 0x03, 0x32, 0x4a, 0xf2, 0x85, 0xb8, 0x91, 0x84,
|
||||
0x94, 0xb2, 0xb9, 0xe4, 0x81, 0xdc, 0x00, 0x28, 0xd7, 0x3b, 0xb5, 0x32, 0xbc, 0x28, 0xb1, 0x20,
|
||||
0x00, 0xa4, 0x2e, 0x39, 0x3f, 0xc7, 0x33, 0xaf, 0xa0, 0xb4, 0x44, 0xc8, 0x83, 0x4b, 0xde, 0x1b,
|
||||
0xbf, 0x12, 0x09, 0x46, 0x05, 0x46, 0x0d, 0x9e, 0x20, 0x42, 0xca, 0x94, 0xf2, 0xb8, 0x14, 0x70,
|
||||
0x5b, 0xe6, 0x5f, 0x5a, 0x02, 0xb2, 0xcd, 0x8b, 0x4b, 0xc1, 0x9b, 0x80, 0x1a, 0xa8, 0x75, 0x04,
|
||||
0xd5, 0x19, 0xbd, 0x62, 0xe4, 0x12, 0x42, 0x52, 0x14, 0x9c, 0x5a, 0x54, 0x96, 0x99, 0x9c, 0x2a,
|
||||
0x94, 0xc1, 0xc5, 0x0e, 0x52, 0x0c, 0x94, 0x11, 0xd2, 0xd1, 0x43, 0x0e, 0x1f, 0x02, 0x21, 0x21,
|
||||
0xa5, 0x4b, 0xa4, 0x6a, 0x88, 0xf5, 0x4a, 0x0c, 0x42, 0x59, 0x5c, 0x9c, 0xa1, 0x79, 0xf4, 0xb1,
|
||||
0xcb, 0x89, 0x37, 0x0a, 0x39, 0x62, 0x93, 0xd8, 0xc0, 0x91, 0x6d, 0x0c, 0x08, 0x00, 0x00, 0xff,
|
||||
0xff, 0x9a, 0x10, 0xcb, 0xf9, 0x01, 0x02, 0x00, 0x00,
|
||||
}
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ context.Context
|
||||
var _ grpc.ClientConnInterface
|
||||
|
||||
// This is a compile-time assertion to ensure that this generated file
|
||||
// is compatible with the grpc package it is being compiled against.
|
||||
const _ = grpc.SupportPackageIsVersion6
|
||||
|
||||
// KeyProviderServiceClient is the client API for KeyProviderService service.
|
||||
//
|
||||
// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
|
||||
type KeyProviderServiceClient interface {
|
||||
WrapKey(ctx context.Context, in *KeyProviderKeyWrapProtocolInput, opts ...grpc.CallOption) (*KeyProviderKeyWrapProtocolOutput, error)
|
||||
UnWrapKey(ctx context.Context, in *KeyProviderKeyWrapProtocolInput, opts ...grpc.CallOption) (*KeyProviderKeyWrapProtocolOutput, error)
|
||||
}
|
||||
|
||||
type keyProviderServiceClient struct {
|
||||
cc grpc.ClientConnInterface
|
||||
}
|
||||
|
||||
func NewKeyProviderServiceClient(cc grpc.ClientConnInterface) KeyProviderServiceClient {
|
||||
return &keyProviderServiceClient{cc}
|
||||
}
|
||||
|
||||
func (c *keyProviderServiceClient) WrapKey(ctx context.Context, in *KeyProviderKeyWrapProtocolInput, opts ...grpc.CallOption) (*KeyProviderKeyWrapProtocolOutput, error) {
|
||||
out := new(KeyProviderKeyWrapProtocolOutput)
|
||||
err := c.cc.Invoke(ctx, "/keyprovider.KeyProviderService/WrapKey", in, out, opts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
func (c *keyProviderServiceClient) UnWrapKey(ctx context.Context, in *KeyProviderKeyWrapProtocolInput, opts ...grpc.CallOption) (*KeyProviderKeyWrapProtocolOutput, error) {
|
||||
out := new(KeyProviderKeyWrapProtocolOutput)
|
||||
err := c.cc.Invoke(ctx, "/keyprovider.KeyProviderService/UnWrapKey", in, out, opts...)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// KeyProviderServiceServer is the server API for KeyProviderService service.
|
||||
type KeyProviderServiceServer interface {
|
||||
WrapKey(context.Context, *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error)
|
||||
UnWrapKey(context.Context, *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error)
|
||||
}
|
||||
|
||||
// UnimplementedKeyProviderServiceServer can be embedded to have forward compatible implementations.
|
||||
type UnimplementedKeyProviderServiceServer struct {
|
||||
}
|
||||
|
||||
func (*UnimplementedKeyProviderServiceServer) WrapKey(ctx context.Context, req *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error) {
|
||||
return nil, status.Errorf(codes.Unimplemented, "method WrapKey not implemented")
|
||||
}
|
||||
func (*UnimplementedKeyProviderServiceServer) UnWrapKey(ctx context.Context, req *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error) {
|
||||
return nil, status.Errorf(codes.Unimplemented, "method UnWrapKey not implemented")
|
||||
}
|
||||
|
||||
func RegisterKeyProviderServiceServer(s *grpc.Server, srv KeyProviderServiceServer) {
|
||||
s.RegisterService(&_KeyProviderService_serviceDesc, srv)
|
||||
}
|
||||
|
||||
func _KeyProviderService_WrapKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
|
||||
in := new(KeyProviderKeyWrapProtocolInput)
|
||||
if err := dec(in); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if interceptor == nil {
|
||||
return srv.(KeyProviderServiceServer).WrapKey(ctx, in)
|
||||
}
|
||||
info := &grpc.UnaryServerInfo{
|
||||
Server: srv,
|
||||
FullMethod: "/keyprovider.KeyProviderService/WrapKey",
|
||||
}
|
||||
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
|
||||
return srv.(KeyProviderServiceServer).WrapKey(ctx, req.(*KeyProviderKeyWrapProtocolInput))
|
||||
}
|
||||
return interceptor(ctx, in, info, handler)
|
||||
}
|
||||
|
||||
func _KeyProviderService_UnWrapKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
|
||||
in := new(KeyProviderKeyWrapProtocolInput)
|
||||
if err := dec(in); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if interceptor == nil {
|
||||
return srv.(KeyProviderServiceServer).UnWrapKey(ctx, in)
|
||||
}
|
||||
info := &grpc.UnaryServerInfo{
|
||||
Server: srv,
|
||||
FullMethod: "/keyprovider.KeyProviderService/UnWrapKey",
|
||||
}
|
||||
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
|
||||
return srv.(KeyProviderServiceServer).UnWrapKey(ctx, req.(*KeyProviderKeyWrapProtocolInput))
|
||||
}
|
||||
return interceptor(ctx, in, info, handler)
|
||||
}
|
||||
|
||||
var _KeyProviderService_serviceDesc = grpc.ServiceDesc{
|
||||
ServiceName: "keyprovider.KeyProviderService",
|
||||
HandlerType: (*KeyProviderServiceServer)(nil),
|
||||
Methods: []grpc.MethodDesc{
|
||||
{
|
||||
MethodName: "WrapKey",
|
||||
Handler: _KeyProviderService_WrapKey_Handler,
|
||||
},
|
||||
{
|
||||
MethodName: "UnWrapKey",
|
||||
Handler: _KeyProviderService_UnWrapKey_Handler,
|
||||
},
|
||||
},
|
||||
Streams: []grpc.StreamDesc{},
|
||||
Metadata: "keyprovider.proto",
|
||||
}
|
||||
17
vendor/github.com/containers/ocicrypt/utils/keyprovider/keyprovider.proto
generated
vendored
17
vendor/github.com/containers/ocicrypt/utils/keyprovider/keyprovider.proto
generated
vendored
@ -1,17 +0,0 @@
|
||||
syntax = "proto3";
|
||||
|
||||
package keyprovider;
|
||||
option go_package = "keyprovider";
|
||||
|
||||
message keyProviderKeyWrapProtocolInput {
|
||||
bytes KeyProviderKeyWrapProtocolInput = 1;
|
||||
}
|
||||
|
||||
message keyProviderKeyWrapProtocolOutput {
|
||||
bytes KeyProviderKeyWrapProtocolOutput = 1;
|
||||
}
|
||||
|
||||
service KeyProviderService {
|
||||
rpc WrapKey(keyProviderKeyWrapProtocolInput) returns (keyProviderKeyWrapProtocolOutput) {};
|
||||
rpc UnWrapKey(keyProviderKeyWrapProtocolInput) returns (keyProviderKeyWrapProtocolOutput) {};
|
||||
}
|
||||
166
vendor/github.com/containers/ocicrypt/utils/testing.go
generated
vendored
166
vendor/github.com/containers/ocicrypt/utils/testing.go
generated
vendored
@ -1,166 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package utils
|
||||
|
||||
import (
|
||||
"crypto/ecdsa"
|
||||
"crypto/elliptic"
|
||||
"crypto/rand"
|
||||
"crypto/rsa"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/pem"
|
||||
"math/big"
|
||||
"time"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
// CreateRSAKey creates an RSA key
|
||||
func CreateRSAKey(bits int) (*rsa.PrivateKey, error) {
|
||||
key, err := rsa.GenerateKey(rand.Reader, bits)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "rsa.GenerateKey failed")
|
||||
}
|
||||
return key, nil
|
||||
}
|
||||
|
||||
// CreateRSATestKey creates an RSA key of the given size and returns
|
||||
// the public and private key in PEM or DER format
|
||||
func CreateRSATestKey(bits int, password []byte, pemencode bool) ([]byte, []byte, error) {
|
||||
key, err := CreateRSAKey(bits)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
pubData, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
|
||||
if err != nil {
|
||||
return nil, nil, errors.Wrap(err, "x509.MarshalPKIXPublicKey failed")
|
||||
}
|
||||
privData := x509.MarshalPKCS1PrivateKey(key)
|
||||
|
||||
// no more encoding needed for DER
|
||||
if !pemencode {
|
||||
return pubData, privData, nil
|
||||
}
|
||||
|
||||
publicKey := pem.EncodeToMemory(&pem.Block{
|
||||
Type: "PUBLIC KEY",
|
||||
Bytes: pubData,
|
||||
})
|
||||
|
||||
var block *pem.Block
|
||||
|
||||
typ := "RSA PRIVATE KEY"
|
||||
if len(password) > 0 {
|
||||
block, err = x509.EncryptPEMBlock(rand.Reader, typ, privData, password, x509.PEMCipherAES256) //nolint:staticcheck // ignore SA1019, which is kept for backward compatibility
|
||||
if err != nil {
|
||||
return nil, nil, errors.Wrap(err, "x509.EncryptPEMBlock failed")
|
||||
}
|
||||
} else {
|
||||
block = &pem.Block{
|
||||
Type: typ,
|
||||
Bytes: privData,
|
||||
}
|
||||
}
|
||||
|
||||
privateKey := pem.EncodeToMemory(block)
|
||||
|
||||
return publicKey, privateKey, nil
|
||||
}
|
||||
|
||||
// CreateECDSATestKey creates and elliptic curve key for the given curve and returns
|
||||
// the public and private key in DER format
|
||||
func CreateECDSATestKey(curve elliptic.Curve) ([]byte, []byte, error) {
|
||||
key, err := ecdsa.GenerateKey(curve, rand.Reader)
|
||||
if err != nil {
|
||||
return nil, nil, errors.Wrapf(err, "ecdsa.GenerateKey failed")
|
||||
}
|
||||
|
||||
pubData, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
|
||||
if err != nil {
|
||||
return nil, nil, errors.Wrapf(err, "x509.MarshalPKIXPublicKey failed")
|
||||
}
|
||||
|
||||
privData, err := x509.MarshalECPrivateKey(key)
|
||||
if err != nil {
|
||||
return nil, nil, errors.Wrapf(err, "x509.MarshalECPrivateKey failed")
|
||||
}
|
||||
|
||||
return pubData, privData, nil
|
||||
}
|
||||
|
||||
// CreateTestCA creates a root CA for testing
|
||||
func CreateTestCA() (*rsa.PrivateKey, *x509.Certificate, error) {
|
||||
key, err := rsa.GenerateKey(rand.Reader, 2048)
|
||||
if err != nil {
|
||||
return nil, nil, errors.Wrap(err, "rsa.GenerateKey failed")
|
||||
}
|
||||
|
||||
ca := &x509.Certificate{
|
||||
SerialNumber: big.NewInt(1),
|
||||
Subject: pkix.Name{
|
||||
CommonName: "test-ca",
|
||||
},
|
||||
NotBefore: time.Now(),
|
||||
NotAfter: time.Now().AddDate(1, 0, 0),
|
||||
IsCA: true,
|
||||
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
|
||||
BasicConstraintsValid: true,
|
||||
}
|
||||
caCert, err := certifyKey(&key.PublicKey, ca, key, ca)
|
||||
|
||||
return key, caCert, err
|
||||
}
|
||||
|
||||
// CertifyKey certifies a public key using the given CA's private key and cert;
|
||||
// The certificate template for the public key is optional
|
||||
func CertifyKey(pubbytes []byte, template *x509.Certificate, caKey *rsa.PrivateKey, caCert *x509.Certificate) (*x509.Certificate, error) {
|
||||
pubKey, err := ParsePublicKey(pubbytes, "CertifyKey")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return certifyKey(pubKey, template, caKey, caCert)
|
||||
}
|
||||
|
||||
func certifyKey(pub interface{}, template *x509.Certificate, caKey *rsa.PrivateKey, caCert *x509.Certificate) (*x509.Certificate, error) {
|
||||
if template == nil {
|
||||
template = &x509.Certificate{
|
||||
SerialNumber: big.NewInt(1),
|
||||
Subject: pkix.Name{
|
||||
CommonName: "testkey",
|
||||
},
|
||||
NotBefore: time.Now(),
|
||||
NotAfter: time.Now().Add(time.Hour),
|
||||
IsCA: false,
|
||||
KeyUsage: x509.KeyUsageDigitalSignature,
|
||||
BasicConstraintsValid: true,
|
||||
}
|
||||
}
|
||||
|
||||
certDER, err := x509.CreateCertificate(rand.Reader, template, caCert, pub, caKey)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "x509.CreateCertificate failed")
|
||||
}
|
||||
|
||||
cert, err := x509.ParseCertificate(certDER)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "x509.ParseCertificate failed")
|
||||
}
|
||||
|
||||
return cert, nil
|
||||
}
|
||||
250
vendor/github.com/containers/ocicrypt/utils/utils.go
generated
vendored
250
vendor/github.com/containers/ocicrypt/utils/utils.go
generated
vendored
@ -1,250 +0,0 @@
|
||||
/*
|
||||
Copyright The ocicrypt Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package utils
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/x509"
|
||||
"encoding/base64"
|
||||
"encoding/pem"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/containers/ocicrypt/crypto/pkcs11"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
"golang.org/x/crypto/openpgp"
|
||||
json "gopkg.in/square/go-jose.v2"
|
||||
)
|
||||
|
||||
// parseJWKPrivateKey parses the input byte array as a JWK and makes sure it's a private key
|
||||
func parseJWKPrivateKey(privKey []byte, prefix string) (interface{}, error) {
|
||||
jwk := json.JSONWebKey{}
|
||||
err := jwk.UnmarshalJSON(privKey)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "%s: Could not parse input as JWK", prefix)
|
||||
}
|
||||
if jwk.IsPublic() {
|
||||
return nil, fmt.Errorf("%s: JWK is not a private key", prefix)
|
||||
}
|
||||
return &jwk, nil
|
||||
}
|
||||
|
||||
// parseJWKPublicKey parses the input byte array as a JWK
|
||||
func parseJWKPublicKey(privKey []byte, prefix string) (interface{}, error) {
|
||||
jwk := json.JSONWebKey{}
|
||||
err := jwk.UnmarshalJSON(privKey)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "%s: Could not parse input as JWK", prefix)
|
||||
}
|
||||
if !jwk.IsPublic() {
|
||||
return nil, fmt.Errorf("%s: JWK is not a public key", prefix)
|
||||
}
|
||||
return &jwk, nil
|
||||
}
|
||||
|
||||
// parsePkcs11PrivateKeyYaml parses the input byte array as pkcs11 key file yaml format)
|
||||
func parsePkcs11PrivateKeyYaml(yaml []byte, prefix string) (*pkcs11.Pkcs11KeyFileObject, error) {
|
||||
// if the URI does not have enough attributes, we will throw an error when decrypting
|
||||
return pkcs11.ParsePkcs11KeyFile(yaml)
|
||||
}
|
||||
|
||||
// parsePkcs11URIPublicKey parses the input byte array as a pkcs11 key file yaml
|
||||
func parsePkcs11PublicKeyYaml(yaml []byte, prefix string) (*pkcs11.Pkcs11KeyFileObject, error) {
|
||||
// if the URI does not have enough attributes, we will throw an error when decrypting
|
||||
return pkcs11.ParsePkcs11KeyFile(yaml)
|
||||
}
|
||||
|
||||
// IsPasswordError checks whether an error is related to a missing or wrong
|
||||
// password
|
||||
func IsPasswordError(err error) bool {
|
||||
if err == nil {
|
||||
return false
|
||||
}
|
||||
msg := strings.ToLower(err.Error())
|
||||
|
||||
return strings.Contains(msg, "password") &&
|
||||
(strings.Contains(msg, "missing") || strings.Contains(msg, "wrong"))
|
||||
}
|
||||
|
||||
// ParsePrivateKey tries to parse a private key in DER format first and
|
||||
// PEM format after, returning an error if the parsing failed
|
||||
func ParsePrivateKey(privKey, privKeyPassword []byte, prefix string) (interface{}, error) {
|
||||
key, err := x509.ParsePKCS8PrivateKey(privKey)
|
||||
if err != nil {
|
||||
key, err = x509.ParsePKCS1PrivateKey(privKey)
|
||||
if err != nil {
|
||||
key, err = x509.ParseECPrivateKey(privKey)
|
||||
}
|
||||
}
|
||||
if err != nil {
|
||||
block, _ := pem.Decode(privKey)
|
||||
if block != nil {
|
||||
var der []byte
|
||||
if x509.IsEncryptedPEMBlock(block) { //nolint:staticcheck // ignore SA1019, which is kept for backward compatibility
|
||||
if privKeyPassword == nil {
|
||||
return nil, errors.Errorf("%s: Missing password for encrypted private key", prefix)
|
||||
}
|
||||
der, err = x509.DecryptPEMBlock(block, privKeyPassword) //nolint:staticcheck // ignore SA1019, which is kept for backward compatibility
|
||||
if err != nil {
|
||||
return nil, errors.Errorf("%s: Wrong password: could not decrypt private key", prefix)
|
||||
}
|
||||
} else {
|
||||
der = block.Bytes
|
||||
}
|
||||
|
||||
key, err = x509.ParsePKCS8PrivateKey(der)
|
||||
if err != nil {
|
||||
key, err = x509.ParsePKCS1PrivateKey(der)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "%s: Could not parse private key", prefix)
|
||||
}
|
||||
}
|
||||
} else {
|
||||
key, err = parseJWKPrivateKey(privKey, prefix)
|
||||
if err != nil {
|
||||
key, err = parsePkcs11PrivateKeyYaml(privKey, prefix)
|
||||
}
|
||||
}
|
||||
}
|
||||
return key, err
|
||||
}
|
||||
|
||||
// IsPrivateKey returns true in case the given byte array represents a private key
|
||||
// It returns an error if for example the password is wrong
|
||||
func IsPrivateKey(data []byte, password []byte) (bool, error) {
|
||||
_, err := ParsePrivateKey(data, password, "")
|
||||
return err == nil, err
|
||||
}
|
||||
|
||||
// IsPkcs11PrivateKey returns true in case the given byte array represents a pkcs11 private key
|
||||
func IsPkcs11PrivateKey(data []byte) bool {
|
||||
return pkcs11.IsPkcs11PrivateKey(data)
|
||||
}
|
||||
|
||||
// ParsePublicKey tries to parse a public key in DER format first and
|
||||
// PEM format after, returning an error if the parsing failed
|
||||
func ParsePublicKey(pubKey []byte, prefix string) (interface{}, error) {
|
||||
key, err := x509.ParsePKIXPublicKey(pubKey)
|
||||
if err != nil {
|
||||
block, _ := pem.Decode(pubKey)
|
||||
if block != nil {
|
||||
key, err = x509.ParsePKIXPublicKey(block.Bytes)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "%s: Could not parse public key", prefix)
|
||||
}
|
||||
} else {
|
||||
key, err = parseJWKPublicKey(pubKey, prefix)
|
||||
if err != nil {
|
||||
key, err = parsePkcs11PublicKeyYaml(pubKey, prefix)
|
||||
}
|
||||
}
|
||||
}
|
||||
return key, err
|
||||
}
|
||||
|
||||
// IsPublicKey returns true in case the given byte array represents a public key
|
||||
func IsPublicKey(data []byte) bool {
|
||||
_, err := ParsePublicKey(data, "")
|
||||
return err == nil
|
||||
}
|
||||
|
||||
// IsPkcs11PublicKey returns true in case the given byte array represents a pkcs11 public key
|
||||
func IsPkcs11PublicKey(data []byte) bool {
|
||||
return pkcs11.IsPkcs11PublicKey(data)
|
||||
}
|
||||
|
||||
// ParseCertificate tries to parse a public key in DER format first and
|
||||
// PEM format after, returning an error if the parsing failed
|
||||
func ParseCertificate(certBytes []byte, prefix string) (*x509.Certificate, error) {
|
||||
x509Cert, err := x509.ParseCertificate(certBytes)
|
||||
if err != nil {
|
||||
block, _ := pem.Decode(certBytes)
|
||||
if block == nil {
|
||||
return nil, fmt.Errorf("%s: Could not PEM decode x509 certificate", prefix)
|
||||
}
|
||||
x509Cert, err = x509.ParseCertificate(block.Bytes)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "%s: Could not parse x509 certificate", prefix)
|
||||
}
|
||||
}
|
||||
return x509Cert, err
|
||||
}
|
||||
|
||||
// IsCertificate returns true in case the given byte array represents an x.509 certificate
|
||||
func IsCertificate(data []byte) bool {
|
||||
_, err := ParseCertificate(data, "")
|
||||
return err == nil
|
||||
}
|
||||
|
||||
// IsGPGPrivateKeyRing returns true in case the given byte array represents a GPG private key ring file
|
||||
func IsGPGPrivateKeyRing(data []byte) bool {
|
||||
r := bytes.NewBuffer(data)
|
||||
_, err := openpgp.ReadKeyRing(r)
|
||||
return err == nil
|
||||
}
|
||||
|
||||
// SortDecryptionKeys parses a list of comma separated base64 entries and sorts the data into
|
||||
// a map. Each entry in the list may be either a GPG private key ring, private key, or x.509
|
||||
// certificate
|
||||
func SortDecryptionKeys(b64ItemList string) (map[string][][]byte, error) {
|
||||
dcparameters := make(map[string][][]byte)
|
||||
|
||||
for _, b64Item := range strings.Split(b64ItemList, ",") {
|
||||
var password []byte
|
||||
b64Data := strings.Split(b64Item, ":")
|
||||
keyData, err := base64.StdEncoding.DecodeString(b64Data[0])
|
||||
if err != nil {
|
||||
return nil, errors.New("Could not base64 decode a passed decryption key")
|
||||
}
|
||||
if len(b64Data) == 2 {
|
||||
password, err = base64.StdEncoding.DecodeString(b64Data[1])
|
||||
if err != nil {
|
||||
return nil, errors.New("Could not base64 decode a passed decryption key password")
|
||||
}
|
||||
}
|
||||
var key string
|
||||
isPrivKey, err := IsPrivateKey(keyData, password)
|
||||
if IsPasswordError(err) {
|
||||
return nil, err
|
||||
}
|
||||
if isPrivKey {
|
||||
key = "privkeys"
|
||||
if _, ok := dcparameters["privkeys-passwords"]; !ok {
|
||||
dcparameters["privkeys-passwords"] = [][]byte{password}
|
||||
} else {
|
||||
dcparameters["privkeys-passwords"] = append(dcparameters["privkeys-passwords"], password)
|
||||
}
|
||||
} else if IsCertificate(keyData) {
|
||||
key = "x509s"
|
||||
} else if IsGPGPrivateKeyRing(keyData) {
|
||||
key = "gpg-privatekeys"
|
||||
}
|
||||
if key != "" {
|
||||
values := dcparameters[key]
|
||||
if values == nil {
|
||||
dcparameters[key] = [][]byte{keyData}
|
||||
} else {
|
||||
dcparameters[key] = append(dcparameters[key], keyData)
|
||||
}
|
||||
} else {
|
||||
return nil, errors.New("Unknown decryption key type")
|
||||
}
|
||||
}
|
||||
|
||||
return dcparameters, nil
|
||||
}
|
||||
140
vendor/github.com/gogo/protobuf/types/any.go
generated
vendored
140
vendor/github.com/gogo/protobuf/types/any.go
generated
vendored
@ -1,140 +0,0 @@
|
||||
// Go support for Protocol Buffers - Google's data interchange format
|
||||
//
|
||||
// Copyright 2016 The Go Authors. All rights reserved.
|
||||
// https://github.com/golang/protobuf
|
||||
//
|
||||
// Redistribution and use in source and binary forms, with or without
|
||||
// modification, are permitted provided that the following conditions are
|
||||
// met:
|
||||
//
|
||||
// * Redistributions of source code must retain the above copyright
|
||||
// notice, this list of conditions and the following disclaimer.
|
||||
// * Redistributions in binary form must reproduce the above
|
||||
// copyright notice, this list of conditions and the following disclaimer
|
||||
// in the documentation and/or other materials provided with the
|
||||
// distribution.
|
||||
// * Neither the name of Google Inc. nor the names of its
|
||||
// contributors may be used to endorse or promote products derived from
|
||||
// this software without specific prior written permission.
|
||||
//
|
||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
package types
|
||||
|
||||
// This file implements functions to marshal proto.Message to/from
|
||||
// google.protobuf.Any message.
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"reflect"
|
||||
"strings"
|
||||
|
||||
"github.com/gogo/protobuf/proto"
|
||||
)
|
||||
|
||||
const googleApis = "type.googleapis.com/"
|
||||
|
||||
// AnyMessageName returns the name of the message contained in a google.protobuf.Any message.
|
||||
//
|
||||
// Note that regular type assertions should be done using the Is
|
||||
// function. AnyMessageName is provided for less common use cases like filtering a
|
||||
// sequence of Any messages based on a set of allowed message type names.
|
||||
func AnyMessageName(any *Any) (string, error) {
|
||||
if any == nil {
|
||||
return "", fmt.Errorf("message is nil")
|
||||
}
|
||||
slash := strings.LastIndex(any.TypeUrl, "/")
|
||||
if slash < 0 {
|
||||
return "", fmt.Errorf("message type url %q is invalid", any.TypeUrl)
|
||||
}
|
||||
return any.TypeUrl[slash+1:], nil
|
||||
}
|
||||
|
||||
// MarshalAny takes the protocol buffer and encodes it into google.protobuf.Any.
|
||||
func MarshalAny(pb proto.Message) (*Any, error) {
|
||||
value, err := proto.Marshal(pb)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &Any{TypeUrl: googleApis + proto.MessageName(pb), Value: value}, nil
|
||||
}
|
||||
|
||||
// DynamicAny is a value that can be passed to UnmarshalAny to automatically
|
||||
// allocate a proto.Message for the type specified in a google.protobuf.Any
|
||||
// message. The allocated message is stored in the embedded proto.Message.
|
||||
//
|
||||
// Example:
|
||||
//
|
||||
// var x ptypes.DynamicAny
|
||||
// if err := ptypes.UnmarshalAny(a, &x); err != nil { ... }
|
||||
// fmt.Printf("unmarshaled message: %v", x.Message)
|
||||
type DynamicAny struct {
|
||||
proto.Message
|
||||
}
|
||||
|
||||
// Empty returns a new proto.Message of the type specified in a
|
||||
// google.protobuf.Any message. It returns an error if corresponding message
|
||||
// type isn't linked in.
|
||||
func EmptyAny(any *Any) (proto.Message, error) {
|
||||
aname, err := AnyMessageName(any)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
t := proto.MessageType(aname)
|
||||
if t == nil {
|
||||
return nil, fmt.Errorf("any: message type %q isn't linked in", aname)
|
||||
}
|
||||
return reflect.New(t.Elem()).Interface().(proto.Message), nil
|
||||
}
|
||||
|
||||
// UnmarshalAny parses the protocol buffer representation in a google.protobuf.Any
|
||||
// message and places the decoded result in pb. It returns an error if type of
|
||||
// contents of Any message does not match type of pb message.
|
||||
//
|
||||
// pb can be a proto.Message, or a *DynamicAny.
|
||||
func UnmarshalAny(any *Any, pb proto.Message) error {
|
||||
if d, ok := pb.(*DynamicAny); ok {
|
||||
if d.Message == nil {
|
||||
var err error
|
||||
d.Message, err = EmptyAny(any)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return UnmarshalAny(any, d.Message)
|
||||
}
|
||||
|
||||
aname, err := AnyMessageName(any)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
mname := proto.MessageName(pb)
|
||||
if aname != mname {
|
||||
return fmt.Errorf("mismatched message type: got %q want %q", aname, mname)
|
||||
}
|
||||
return proto.Unmarshal(any.Value, pb)
|
||||
}
|
||||
|
||||
// Is returns true if any value contains a given message type.
|
||||
func Is(any *Any, pb proto.Message) bool {
|
||||
// The following is equivalent to AnyMessageName(any) == proto.MessageName(pb),
|
||||
// but it avoids scanning TypeUrl for the slash.
|
||||
if any == nil {
|
||||
return false
|
||||
}
|
||||
name := proto.MessageName(pb)
|
||||
prefix := len(any.TypeUrl) - len(name)
|
||||
return prefix >= 1 && any.TypeUrl[prefix-1] == '/' && any.TypeUrl[prefix:] == name
|
||||
}
|
||||
694
vendor/github.com/gogo/protobuf/types/any.pb.go
generated
vendored
694
vendor/github.com/gogo/protobuf/types/any.pb.go
generated
vendored
@ -1,694 +0,0 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: google/protobuf/any.proto
|
||||
|
||||
package types
|
||||
|
||||
import (
|
||||
bytes "bytes"
|
||||
fmt "fmt"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
io "io"
|
||||
math "math"
|
||||
math_bits "math/bits"
|
||||
reflect "reflect"
|
||||
strings "strings"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// This is a compile-time assertion to ensure that this generated file
|
||||
// is compatible with the proto package it is being compiled against.
|
||||
// A compilation error at this line likely means your copy of the
|
||||
// proto package needs to be updated.
|
||||
const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
|
||||
|
||||
// `Any` contains an arbitrary serialized protocol buffer message along with a
|
||||
// URL that describes the type of the serialized message.
|
||||
//
|
||||
// Protobuf library provides support to pack/unpack Any values in the form
|
||||
// of utility functions or additional generated methods of the Any type.
|
||||
//
|
||||
// Example 1: Pack and unpack a message in C++.
|
||||
//
|
||||
// Foo foo = ...;
|
||||
// Any any;
|
||||
// any.PackFrom(foo);
|
||||
// ...
|
||||
// if (any.UnpackTo(&foo)) {
|
||||
// ...
|
||||
// }
|
||||
//
|
||||
// Example 2: Pack and unpack a message in Java.
|
||||
//
|
||||
// Foo foo = ...;
|
||||
// Any any = Any.pack(foo);
|
||||
// ...
|
||||
// if (any.is(Foo.class)) {
|
||||
// foo = any.unpack(Foo.class);
|
||||
// }
|
||||
//
|
||||
// Example 3: Pack and unpack a message in Python.
|
||||
//
|
||||
// foo = Foo(...)
|
||||
// any = Any()
|
||||
// any.Pack(foo)
|
||||
// ...
|
||||
// if any.Is(Foo.DESCRIPTOR):
|
||||
// any.Unpack(foo)
|
||||
// ...
|
||||
//
|
||||
// Example 4: Pack and unpack a message in Go
|
||||
//
|
||||
// foo := &pb.Foo{...}
|
||||
// any, err := ptypes.MarshalAny(foo)
|
||||
// ...
|
||||
// foo := &pb.Foo{}
|
||||
// if err := ptypes.UnmarshalAny(any, foo); err != nil {
|
||||
// ...
|
||||
// }
|
||||
//
|
||||
// The pack methods provided by protobuf library will by default use
|
||||
// 'type.googleapis.com/full.type.name' as the type URL and the unpack
|
||||
// methods only use the fully qualified type name after the last '/'
|
||||
// in the type URL, for example "foo.bar.com/x/y.z" will yield type
|
||||
// name "y.z".
|
||||
//
|
||||
//
|
||||
// JSON
|
||||
// ====
|
||||
// The JSON representation of an `Any` value uses the regular
|
||||
// representation of the deserialized, embedded message, with an
|
||||
// additional field `@type` which contains the type URL. Example:
|
||||
//
|
||||
// package google.profile;
|
||||
// message Person {
|
||||
// string first_name = 1;
|
||||
// string last_name = 2;
|
||||
// }
|
||||
//
|
||||
// {
|
||||
// "@type": "type.googleapis.com/google.profile.Person",
|
||||
// "firstName": <string>,
|
||||
// "lastName": <string>
|
||||
// }
|
||||
//
|
||||
// If the embedded message type is well-known and has a custom JSON
|
||||
// representation, that representation will be embedded adding a field
|
||||
// `value` which holds the custom JSON in addition to the `@type`
|
||||
// field. Example (for message [google.protobuf.Duration][]):
|
||||
//
|
||||
// {
|
||||
// "@type": "type.googleapis.com/google.protobuf.Duration",
|
||||
// "value": "1.212s"
|
||||
// }
|
||||
//
|
||||
type Any struct {
|
||||
// A URL/resource name that uniquely identifies the type of the serialized
|
||||
// protocol buffer message. This string must contain at least
|
||||
// one "/" character. The last segment of the URL's path must represent
|
||||
// the fully qualified name of the type (as in
|
||||
// `path/google.protobuf.Duration`). The name should be in a canonical form
|
||||
// (e.g., leading "." is not accepted).
|
||||
//
|
||||
// In practice, teams usually precompile into the binary all types that they
|
||||
// expect it to use in the context of Any. However, for URLs which use the
|
||||
// scheme `http`, `https`, or no scheme, one can optionally set up a type
|
||||
// server that maps type URLs to message definitions as follows:
|
||||
//
|
||||
// * If no scheme is provided, `https` is assumed.
|
||||
// * An HTTP GET on the URL must yield a [google.protobuf.Type][]
|
||||
// value in binary format, or produce an error.
|
||||
// * Applications are allowed to cache lookup results based on the
|
||||
// URL, or have them precompiled into a binary to avoid any
|
||||
// lookup. Therefore, binary compatibility needs to be preserved
|
||||
// on changes to types. (Use versioned type names to manage
|
||||
// breaking changes.)
|
||||
//
|
||||
// Note: this functionality is not currently available in the official
|
||||
// protobuf release, and it is not used for type URLs beginning with
|
||||
// type.googleapis.com.
|
||||
//
|
||||
// Schemes other than `http`, `https` (or the empty scheme) might be
|
||||
// used with implementation specific semantics.
|
||||
//
|
||||
TypeUrl string `protobuf:"bytes,1,opt,name=type_url,json=typeUrl,proto3" json:"type_url,omitempty"`
|
||||
// Must be a valid serialized protocol buffer of the above specified type.
|
||||
Value []byte `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
|
||||
XXX_NoUnkeyedLiteral struct{} `json:"-"`
|
||||
XXX_unrecognized []byte `json:"-"`
|
||||
XXX_sizecache int32 `json:"-"`
|
||||
}
|
||||
|
||||
func (m *Any) Reset() { *m = Any{} }
|
||||
func (*Any) ProtoMessage() {}
|
||||
func (*Any) Descriptor() ([]byte, []int) {
|
||||
return fileDescriptor_b53526c13ae22eb4, []int{0}
|
||||
}
|
||||
func (*Any) XXX_WellKnownType() string { return "Any" }
|
||||
func (m *Any) XXX_Unmarshal(b []byte) error {
|
||||
return m.Unmarshal(b)
|
||||
}
|
||||
func (m *Any) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
|
||||
if deterministic {
|
||||
return xxx_messageInfo_Any.Marshal(b, m, deterministic)
|
||||
} else {
|
||||
b = b[:cap(b)]
|
||||
n, err := m.MarshalToSizedBuffer(b)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return b[:n], nil
|
||||
}
|
||||
}
|
||||
func (m *Any) XXX_Merge(src proto.Message) {
|
||||
xxx_messageInfo_Any.Merge(m, src)
|
||||
}
|
||||
func (m *Any) XXX_Size() int {
|
||||
return m.Size()
|
||||
}
|
||||
func (m *Any) XXX_DiscardUnknown() {
|
||||
xxx_messageInfo_Any.DiscardUnknown(m)
|
||||
}
|
||||
|
||||
var xxx_messageInfo_Any proto.InternalMessageInfo
|
||||
|
||||
func (m *Any) GetTypeUrl() string {
|
||||
if m != nil {
|
||||
return m.TypeUrl
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func (m *Any) GetValue() []byte {
|
||||
if m != nil {
|
||||
return m.Value
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (*Any) XXX_MessageName() string {
|
||||
return "google.protobuf.Any"
|
||||
}
|
||||
func init() {
|
||||
proto.RegisterType((*Any)(nil), "google.protobuf.Any")
|
||||
}
|
||||
|
||||
func init() { proto.RegisterFile("google/protobuf/any.proto", fileDescriptor_b53526c13ae22eb4) }
|
||||
|
||||
var fileDescriptor_b53526c13ae22eb4 = []byte{
|
||||
// 211 bytes of a gzipped FileDescriptorProto
|
||||
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x92, 0x4c, 0xcf, 0xcf, 0x4f,
|
||||
0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x4f, 0xcc, 0xab, 0xd4,
|
||||
0x03, 0x73, 0x84, 0xf8, 0x21, 0x52, 0x7a, 0x30, 0x29, 0x25, 0x33, 0x2e, 0x66, 0xc7, 0xbc, 0x4a,
|
||||
0x21, 0x49, 0x2e, 0x8e, 0x92, 0xca, 0x82, 0xd4, 0xf8, 0xd2, 0xa2, 0x1c, 0x09, 0x46, 0x05, 0x46,
|
||||
0x0d, 0xce, 0x20, 0x76, 0x10, 0x3f, 0xb4, 0x28, 0x47, 0x48, 0x84, 0x8b, 0xb5, 0x2c, 0x31, 0xa7,
|
||||
0x34, 0x55, 0x82, 0x49, 0x81, 0x51, 0x83, 0x27, 0x08, 0xc2, 0x71, 0xaa, 0xbf, 0xf1, 0x50, 0x8e,
|
||||
0xe1, 0xc3, 0x43, 0x39, 0xc6, 0x1f, 0x0f, 0xe5, 0x18, 0x1b, 0x1e, 0xc9, 0x31, 0xae, 0x78, 0x24,
|
||||
0xc7, 0x78, 0xe2, 0x91, 0x1c, 0xe3, 0x85, 0x47, 0x72, 0x8c, 0x0f, 0x1e, 0xc9, 0x31, 0xbe, 0x78,
|
||||
0x24, 0xc7, 0xf0, 0x01, 0x24, 0xfe, 0x58, 0x8e, 0xf1, 0xc4, 0x63, 0x39, 0x46, 0x2e, 0xe1, 0xe4,
|
||||
0xfc, 0x5c, 0x3d, 0x34, 0xeb, 0x9d, 0x38, 0x1c, 0xf3, 0x2a, 0x03, 0x40, 0x9c, 0x00, 0xc6, 0x28,
|
||||
0x56, 0x90, 0x8d, 0xc5, 0x8b, 0x98, 0x98, 0xdd, 0x03, 0x9c, 0x56, 0x31, 0xc9, 0xb9, 0x43, 0x94,
|
||||
0x06, 0x40, 0x95, 0xea, 0x85, 0xa7, 0xe6, 0xe4, 0x78, 0xe7, 0xe5, 0x97, 0xe7, 0x85, 0x80, 0x94,
|
||||
0x25, 0xb1, 0x81, 0xcd, 0x30, 0x06, 0x04, 0x00, 0x00, 0xff, 0xff, 0xb7, 0x81, 0x82, 0xd3, 0xed,
|
||||
0x00, 0x00, 0x00,
|
||||
}
|
||||
|
||||
func (this *Any) Compare(that interface{}) int {
|
||||
if that == nil {
|
||||
if this == nil {
|
||||
return 0
|
||||
}
|
||||
return 1
|
||||
}
|
||||
|
||||
that1, ok := that.(*Any)
|
||||
if !ok {
|
||||
that2, ok := that.(Any)
|
||||
if ok {
|
||||
that1 = &that2
|
||||
} else {
|
||||
return 1
|
||||
}
|
||||
}
|
||||
if that1 == nil {
|
||||
if this == nil {
|
||||
return 0
|
||||
}
|
||||
return 1
|
||||
} else if this == nil {
|
||||
return -1
|
||||
}
|
||||
if this.TypeUrl != that1.TypeUrl {
|
||||
if this.TypeUrl < that1.TypeUrl {
|
||||
return -1
|
||||
}
|
||||
return 1
|
||||
}
|
||||
if c := bytes.Compare(this.Value, that1.Value); c != 0 {
|
||||
return c
|
||||
}
|
||||
if c := bytes.Compare(this.XXX_unrecognized, that1.XXX_unrecognized); c != 0 {
|
||||
return c
|
||||
}
|
||||
return 0
|
||||
}
|
||||
func (this *Any) Equal(that interface{}) bool {
|
||||
if that == nil {
|
||||
return this == nil
|
||||
}
|
||||
|
||||
that1, ok := that.(*Any)
|
||||
if !ok {
|
||||
that2, ok := that.(Any)
|
||||
if ok {
|
||||
that1 = &that2
|
||||
} else {
|
||||
return false
|
||||
}
|
||||
}
|
||||
if that1 == nil {
|
||||
return this == nil
|
||||
} else if this == nil {
|
||||
return false
|
||||
}
|
||||
if this.TypeUrl != that1.TypeUrl {
|
||||
return false
|
||||
}
|
||||
if !bytes.Equal(this.Value, that1.Value) {
|
||||
return false
|
||||
}
|
||||
if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
func (this *Any) GoString() string {
|
||||
if this == nil {
|
||||
return "nil"
|
||||
}
|
||||
s := make([]string, 0, 6)
|
||||
s = append(s, "&types.Any{")
|
||||
s = append(s, "TypeUrl: "+fmt.Sprintf("%#v", this.TypeUrl)+",\n")
|
||||
s = append(s, "Value: "+fmt.Sprintf("%#v", this.Value)+",\n")
|
||||
if this.XXX_unrecognized != nil {
|
||||
s = append(s, "XXX_unrecognized:"+fmt.Sprintf("%#v", this.XXX_unrecognized)+",\n")
|
||||
}
|
||||
s = append(s, "}")
|
||||
return strings.Join(s, "")
|
||||
}
|
||||
func valueToGoStringAny(v interface{}, typ string) string {
|
||||
rv := reflect.ValueOf(v)
|
||||
if rv.IsNil() {
|
||||
return "nil"
|
||||
}
|
||||
pv := reflect.Indirect(rv).Interface()
|
||||
return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
|
||||
}
|
||||
func (m *Any) Marshal() (dAtA []byte, err error) {
|
||||
size := m.Size()
|
||||
dAtA = make([]byte, size)
|
||||
n, err := m.MarshalToSizedBuffer(dAtA[:size])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return dAtA[:n], nil
|
||||
}
|
||||
|
||||
func (m *Any) MarshalTo(dAtA []byte) (int, error) {
|
||||
size := m.Size()
|
||||
return m.MarshalToSizedBuffer(dAtA[:size])
|
||||
}
|
||||
|
||||
func (m *Any) MarshalToSizedBuffer(dAtA []byte) (int, error) {
|
||||
i := len(dAtA)
|
||||
_ = i
|
||||
var l int
|
||||
_ = l
|
||||
if m.XXX_unrecognized != nil {
|
||||
i -= len(m.XXX_unrecognized)
|
||||
copy(dAtA[i:], m.XXX_unrecognized)
|
||||
}
|
||||
if len(m.Value) > 0 {
|
||||
i -= len(m.Value)
|
||||
copy(dAtA[i:], m.Value)
|
||||
i = encodeVarintAny(dAtA, i, uint64(len(m.Value)))
|
||||
i--
|
||||
dAtA[i] = 0x12
|
||||
}
|
||||
if len(m.TypeUrl) > 0 {
|
||||
i -= len(m.TypeUrl)
|
||||
copy(dAtA[i:], m.TypeUrl)
|
||||
i = encodeVarintAny(dAtA, i, uint64(len(m.TypeUrl)))
|
||||
i--
|
||||
dAtA[i] = 0xa
|
||||
}
|
||||
return len(dAtA) - i, nil
|
||||
}
|
||||
|
||||
func encodeVarintAny(dAtA []byte, offset int, v uint64) int {
|
||||
offset -= sovAny(v)
|
||||
base := offset
|
||||
for v >= 1<<7 {
|
||||
dAtA[offset] = uint8(v&0x7f | 0x80)
|
||||
v >>= 7
|
||||
offset++
|
||||
}
|
||||
dAtA[offset] = uint8(v)
|
||||
return base
|
||||
}
|
||||
func NewPopulatedAny(r randyAny, easy bool) *Any {
|
||||
this := &Any{}
|
||||
this.TypeUrl = string(randStringAny(r))
|
||||
v1 := r.Intn(100)
|
||||
this.Value = make([]byte, v1)
|
||||
for i := 0; i < v1; i++ {
|
||||
this.Value[i] = byte(r.Intn(256))
|
||||
}
|
||||
if !easy && r.Intn(10) != 0 {
|
||||
this.XXX_unrecognized = randUnrecognizedAny(r, 3)
|
||||
}
|
||||
return this
|
||||
}
|
||||
|
||||
type randyAny interface {
|
||||
Float32() float32
|
||||
Float64() float64
|
||||
Int63() int64
|
||||
Int31() int32
|
||||
Uint32() uint32
|
||||
Intn(n int) int
|
||||
}
|
||||
|
||||
func randUTF8RuneAny(r randyAny) rune {
|
||||
ru := r.Intn(62)
|
||||
if ru < 10 {
|
||||
return rune(ru + 48)
|
||||
} else if ru < 36 {
|
||||
return rune(ru + 55)
|
||||
}
|
||||
return rune(ru + 61)
|
||||
}
|
||||
func randStringAny(r randyAny) string {
|
||||
v2 := r.Intn(100)
|
||||
tmps := make([]rune, v2)
|
||||
for i := 0; i < v2; i++ {
|
||||
tmps[i] = randUTF8RuneAny(r)
|
||||
}
|
||||
return string(tmps)
|
||||
}
|
||||
func randUnrecognizedAny(r randyAny, maxFieldNumber int) (dAtA []byte) {
|
||||
l := r.Intn(5)
|
||||
for i := 0; i < l; i++ {
|
||||
wire := r.Intn(4)
|
||||
if wire == 3 {
|
||||
wire = 5
|
||||
}
|
||||
fieldNumber := maxFieldNumber + r.Intn(100)
|
||||
dAtA = randFieldAny(dAtA, r, fieldNumber, wire)
|
||||
}
|
||||
return dAtA
|
||||
}
|
||||
func randFieldAny(dAtA []byte, r randyAny, fieldNumber int, wire int) []byte {
|
||||
key := uint32(fieldNumber)<<3 | uint32(wire)
|
||||
switch wire {
|
||||
case 0:
|
||||
dAtA = encodeVarintPopulateAny(dAtA, uint64(key))
|
||||
v3 := r.Int63()
|
||||
if r.Intn(2) == 0 {
|
||||
v3 *= -1
|
||||
}
|
||||
dAtA = encodeVarintPopulateAny(dAtA, uint64(v3))
|
||||
case 1:
|
||||
dAtA = encodeVarintPopulateAny(dAtA, uint64(key))
|
||||
dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
|
||||
case 2:
|
||||
dAtA = encodeVarintPopulateAny(dAtA, uint64(key))
|
||||
ll := r.Intn(100)
|
||||
dAtA = encodeVarintPopulateAny(dAtA, uint64(ll))
|
||||
for j := 0; j < ll; j++ {
|
||||
dAtA = append(dAtA, byte(r.Intn(256)))
|
||||
}
|
||||
default:
|
||||
dAtA = encodeVarintPopulateAny(dAtA, uint64(key))
|
||||
dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
|
||||
}
|
||||
return dAtA
|
||||
}
|
||||
func encodeVarintPopulateAny(dAtA []byte, v uint64) []byte {
|
||||
for v >= 1<<7 {
|
||||
dAtA = append(dAtA, uint8(uint64(v)&0x7f|0x80))
|
||||
v >>= 7
|
||||
}
|
||||
dAtA = append(dAtA, uint8(v))
|
||||
return dAtA
|
||||
}
|
||||
func (m *Any) Size() (n int) {
|
||||
if m == nil {
|
||||
return 0
|
||||
}
|
||||
var l int
|
||||
_ = l
|
||||
l = len(m.TypeUrl)
|
||||
if l > 0 {
|
||||
n += 1 + l + sovAny(uint64(l))
|
||||
}
|
||||
l = len(m.Value)
|
||||
if l > 0 {
|
||||
n += 1 + l + sovAny(uint64(l))
|
||||
}
|
||||
if m.XXX_unrecognized != nil {
|
||||
n += len(m.XXX_unrecognized)
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
func sovAny(x uint64) (n int) {
|
||||
return (math_bits.Len64(x|1) + 6) / 7
|
||||
}
|
||||
func sozAny(x uint64) (n int) {
|
||||
return sovAny(uint64((x << 1) ^ uint64((int64(x) >> 63))))
|
||||
}
|
||||
func (this *Any) String() string {
|
||||
if this == nil {
|
||||
return "nil"
|
||||
}
|
||||
s := strings.Join([]string{`&Any{`,
|
||||
`TypeUrl:` + fmt.Sprintf("%v", this.TypeUrl) + `,`,
|
||||
`Value:` + fmt.Sprintf("%v", this.Value) + `,`,
|
||||
`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,
|
||||
`}`,
|
||||
}, "")
|
||||
return s
|
||||
}
|
||||
func valueToStringAny(v interface{}) string {
|
||||
rv := reflect.ValueOf(v)
|
||||
if rv.IsNil() {
|
||||
return "nil"
|
||||
}
|
||||
pv := reflect.Indirect(rv).Interface()
|
||||
return fmt.Sprintf("*%v", pv)
|
||||
}
|
||||
func (m *Any) Unmarshal(dAtA []byte) error {
|
||||
l := len(dAtA)
|
||||
iNdEx := 0
|
||||
for iNdEx < l {
|
||||
preIndex := iNdEx
|
||||
var wire uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowAny
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
wire |= uint64(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
fieldNum := int32(wire >> 3)
|
||||
wireType := int(wire & 0x7)
|
||||
if wireType == 4 {
|
||||
return fmt.Errorf("proto: Any: wiretype end group for non-group")
|
||||
}
|
||||
if fieldNum <= 0 {
|
||||
return fmt.Errorf("proto: Any: illegal tag %d (wire type %d)", fieldNum, wire)
|
||||
}
|
||||
switch fieldNum {
|
||||
case 1:
|
||||
if wireType != 2 {
|
||||
return fmt.Errorf("proto: wrong wireType = %d for field TypeUrl", wireType)
|
||||
}
|
||||
var stringLen uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowAny
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
stringLen |= uint64(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
intStringLen := int(stringLen)
|
||||
if intStringLen < 0 {
|
||||
return ErrInvalidLengthAny
|
||||
}
|
||||
postIndex := iNdEx + intStringLen
|
||||
if postIndex < 0 {
|
||||
return ErrInvalidLengthAny
|
||||
}
|
||||
if postIndex > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
m.TypeUrl = string(dAtA[iNdEx:postIndex])
|
||||
iNdEx = postIndex
|
||||
case 2:
|
||||
if wireType != 2 {
|
||||
return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
|
||||
}
|
||||
var byteLen int
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowAny
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
byteLen |= int(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
if byteLen < 0 {
|
||||
return ErrInvalidLengthAny
|
||||
}
|
||||
postIndex := iNdEx + byteLen
|
||||
if postIndex < 0 {
|
||||
return ErrInvalidLengthAny
|
||||
}
|
||||
if postIndex > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
m.Value = append(m.Value[:0], dAtA[iNdEx:postIndex]...)
|
||||
if m.Value == nil {
|
||||
m.Value = []byte{}
|
||||
}
|
||||
iNdEx = postIndex
|
||||
default:
|
||||
iNdEx = preIndex
|
||||
skippy, err := skipAny(dAtA[iNdEx:])
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if (skippy < 0) || (iNdEx+skippy) < 0 {
|
||||
return ErrInvalidLengthAny
|
||||
}
|
||||
if (iNdEx + skippy) > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
|
||||
iNdEx += skippy
|
||||
}
|
||||
}
|
||||
|
||||
if iNdEx > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func skipAny(dAtA []byte) (n int, err error) {
|
||||
l := len(dAtA)
|
||||
iNdEx := 0
|
||||
depth := 0
|
||||
for iNdEx < l {
|
||||
var wire uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowAny
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
wire |= (uint64(b) & 0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
wireType := int(wire & 0x7)
|
||||
switch wireType {
|
||||
case 0:
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowAny
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
iNdEx++
|
||||
if dAtA[iNdEx-1] < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
case 1:
|
||||
iNdEx += 8
|
||||
case 2:
|
||||
var length int
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowAny
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
length |= (int(b) & 0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
if length < 0 {
|
||||
return 0, ErrInvalidLengthAny
|
||||
}
|
||||
iNdEx += length
|
||||
case 3:
|
||||
depth++
|
||||
case 4:
|
||||
if depth == 0 {
|
||||
return 0, ErrUnexpectedEndOfGroupAny
|
||||
}
|
||||
depth--
|
||||
case 5:
|
||||
iNdEx += 4
|
||||
default:
|
||||
return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
|
||||
}
|
||||
if iNdEx < 0 {
|
||||
return 0, ErrInvalidLengthAny
|
||||
}
|
||||
if depth == 0 {
|
||||
return iNdEx, nil
|
||||
}
|
||||
}
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
|
||||
var (
|
||||
ErrInvalidLengthAny = fmt.Errorf("proto: negative length found during unmarshaling")
|
||||
ErrIntOverflowAny = fmt.Errorf("proto: integer overflow")
|
||||
ErrUnexpectedEndOfGroupAny = fmt.Errorf("proto: unexpected end of group")
|
||||
)
|
||||
2134
vendor/github.com/gogo/protobuf/types/api.pb.go
generated
vendored
2134
vendor/github.com/gogo/protobuf/types/api.pb.go
generated
vendored
File diff suppressed because it is too large
Load Diff
35
vendor/github.com/gogo/protobuf/types/doc.go
generated
vendored
35
vendor/github.com/gogo/protobuf/types/doc.go
generated
vendored
@ -1,35 +0,0 @@
|
||||
// Go support for Protocol Buffers - Google's data interchange format
|
||||
//
|
||||
// Copyright 2016 The Go Authors. All rights reserved.
|
||||
// https://github.com/golang/protobuf
|
||||
//
|
||||
// Redistribution and use in source and binary forms, with or without
|
||||
// modification, are permitted provided that the following conditions are
|
||||
// met:
|
||||
//
|
||||
// * Redistributions of source code must retain the above copyright
|
||||
// notice, this list of conditions and the following disclaimer.
|
||||
// * Redistributions in binary form must reproduce the above
|
||||
// copyright notice, this list of conditions and the following disclaimer
|
||||
// in the documentation and/or other materials provided with the
|
||||
// distribution.
|
||||
// * Neither the name of Google Inc. nor the names of its
|
||||
// contributors may be used to endorse or promote products derived from
|
||||
// this software without specific prior written permission.
|
||||
//
|
||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
/*
|
||||
Package types contains code for interacting with well-known types.
|
||||
*/
|
||||
package types
|
||||
100
vendor/github.com/gogo/protobuf/types/duration.go
generated
vendored
100
vendor/github.com/gogo/protobuf/types/duration.go
generated
vendored
@ -1,100 +0,0 @@
|
||||
// Go support for Protocol Buffers - Google's data interchange format
|
||||
//
|
||||
// Copyright 2016 The Go Authors. All rights reserved.
|
||||
// https://github.com/golang/protobuf
|
||||
//
|
||||
// Redistribution and use in source and binary forms, with or without
|
||||
// modification, are permitted provided that the following conditions are
|
||||
// met:
|
||||
//
|
||||
// * Redistributions of source code must retain the above copyright
|
||||
// notice, this list of conditions and the following disclaimer.
|
||||
// * Redistributions in binary form must reproduce the above
|
||||
// copyright notice, this list of conditions and the following disclaimer
|
||||
// in the documentation and/or other materials provided with the
|
||||
// distribution.
|
||||
// * Neither the name of Google Inc. nor the names of its
|
||||
// contributors may be used to endorse or promote products derived from
|
||||
// this software without specific prior written permission.
|
||||
//
|
||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
package types
|
||||
|
||||
// This file implements conversions between google.protobuf.Duration
|
||||
// and time.Duration.
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"time"
|
||||
)
|
||||
|
||||
const (
|
||||
// Range of a Duration in seconds, as specified in
|
||||
// google/protobuf/duration.proto. This is about 10,000 years in seconds.
|
||||
maxSeconds = int64(10000 * 365.25 * 24 * 60 * 60)
|
||||
minSeconds = -maxSeconds
|
||||
)
|
||||
|
||||
// validateDuration determines whether the Duration is valid according to the
|
||||
// definition in google/protobuf/duration.proto. A valid Duration
|
||||
// may still be too large to fit into a time.Duration (the range of Duration
|
||||
// is about 10,000 years, and the range of time.Duration is about 290).
|
||||
func validateDuration(d *Duration) error {
|
||||
if d == nil {
|
||||
return errors.New("duration: nil Duration")
|
||||
}
|
||||
if d.Seconds < minSeconds || d.Seconds > maxSeconds {
|
||||
return fmt.Errorf("duration: %#v: seconds out of range", d)
|
||||
}
|
||||
if d.Nanos <= -1e9 || d.Nanos >= 1e9 {
|
||||
return fmt.Errorf("duration: %#v: nanos out of range", d)
|
||||
}
|
||||
// Seconds and Nanos must have the same sign, unless d.Nanos is zero.
|
||||
if (d.Seconds < 0 && d.Nanos > 0) || (d.Seconds > 0 && d.Nanos < 0) {
|
||||
return fmt.Errorf("duration: %#v: seconds and nanos have different signs", d)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DurationFromProto converts a Duration to a time.Duration. DurationFromProto
|
||||
// returns an error if the Duration is invalid or is too large to be
|
||||
// represented in a time.Duration.
|
||||
func DurationFromProto(p *Duration) (time.Duration, error) {
|
||||
if err := validateDuration(p); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
d := time.Duration(p.Seconds) * time.Second
|
||||
if int64(d/time.Second) != p.Seconds {
|
||||
return 0, fmt.Errorf("duration: %#v is out of range for time.Duration", p)
|
||||
}
|
||||
if p.Nanos != 0 {
|
||||
d += time.Duration(p.Nanos) * time.Nanosecond
|
||||
if (d < 0) != (p.Nanos < 0) {
|
||||
return 0, fmt.Errorf("duration: %#v is out of range for time.Duration", p)
|
||||
}
|
||||
}
|
||||
return d, nil
|
||||
}
|
||||
|
||||
// DurationProto converts a time.Duration to a Duration.
|
||||
func DurationProto(d time.Duration) *Duration {
|
||||
nanos := d.Nanoseconds()
|
||||
secs := nanos / 1e9
|
||||
nanos -= secs * 1e9
|
||||
return &Duration{
|
||||
Seconds: secs,
|
||||
Nanos: int32(nanos),
|
||||
}
|
||||
}
|
||||
517
vendor/github.com/gogo/protobuf/types/duration.pb.go
generated
vendored
517
vendor/github.com/gogo/protobuf/types/duration.pb.go
generated
vendored
@ -1,517 +0,0 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: google/protobuf/duration.proto
|
||||
|
||||
package types
|
||||
|
||||
import (
|
||||
bytes "bytes"
|
||||
fmt "fmt"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
io "io"
|
||||
math "math"
|
||||
math_bits "math/bits"
|
||||
reflect "reflect"
|
||||
strings "strings"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// This is a compile-time assertion to ensure that this generated file
|
||||
// is compatible with the proto package it is being compiled against.
|
||||
// A compilation error at this line likely means your copy of the
|
||||
// proto package needs to be updated.
|
||||
const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
|
||||
|
||||
// A Duration represents a signed, fixed-length span of time represented
|
||||
// as a count of seconds and fractions of seconds at nanosecond
|
||||
// resolution. It is independent of any calendar and concepts like "day"
|
||||
// or "month". It is related to Timestamp in that the difference between
|
||||
// two Timestamp values is a Duration and it can be added or subtracted
|
||||
// from a Timestamp. Range is approximately +-10,000 years.
|
||||
//
|
||||
// # Examples
|
||||
//
|
||||
// Example 1: Compute Duration from two Timestamps in pseudo code.
|
||||
//
|
||||
// Timestamp start = ...;
|
||||
// Timestamp end = ...;
|
||||
// Duration duration = ...;
|
||||
//
|
||||
// duration.seconds = end.seconds - start.seconds;
|
||||
// duration.nanos = end.nanos - start.nanos;
|
||||
//
|
||||
// if (duration.seconds < 0 && duration.nanos > 0) {
|
||||
// duration.seconds += 1;
|
||||
// duration.nanos -= 1000000000;
|
||||
// } else if (durations.seconds > 0 && duration.nanos < 0) {
|
||||
// duration.seconds -= 1;
|
||||
// duration.nanos += 1000000000;
|
||||
// }
|
||||
//
|
||||
// Example 2: Compute Timestamp from Timestamp + Duration in pseudo code.
|
||||
//
|
||||
// Timestamp start = ...;
|
||||
// Duration duration = ...;
|
||||
// Timestamp end = ...;
|
||||
//
|
||||
// end.seconds = start.seconds + duration.seconds;
|
||||
// end.nanos = start.nanos + duration.nanos;
|
||||
//
|
||||
// if (end.nanos < 0) {
|
||||
// end.seconds -= 1;
|
||||
// end.nanos += 1000000000;
|
||||
// } else if (end.nanos >= 1000000000) {
|
||||
// end.seconds += 1;
|
||||
// end.nanos -= 1000000000;
|
||||
// }
|
||||
//
|
||||
// Example 3: Compute Duration from datetime.timedelta in Python.
|
||||
//
|
||||
// td = datetime.timedelta(days=3, minutes=10)
|
||||
// duration = Duration()
|
||||
// duration.FromTimedelta(td)
|
||||
//
|
||||
// # JSON Mapping
|
||||
//
|
||||
// In JSON format, the Duration type is encoded as a string rather than an
|
||||
// object, where the string ends in the suffix "s" (indicating seconds) and
|
||||
// is preceded by the number of seconds, with nanoseconds expressed as
|
||||
// fractional seconds. For example, 3 seconds with 0 nanoseconds should be
|
||||
// encoded in JSON format as "3s", while 3 seconds and 1 nanosecond should
|
||||
// be expressed in JSON format as "3.000000001s", and 3 seconds and 1
|
||||
// microsecond should be expressed in JSON format as "3.000001s".
|
||||
//
|
||||
//
|
||||
type Duration struct {
|
||||
// Signed seconds of the span of time. Must be from -315,576,000,000
|
||||
// to +315,576,000,000 inclusive. Note: these bounds are computed from:
|
||||
// 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
|
||||
Seconds int64 `protobuf:"varint,1,opt,name=seconds,proto3" json:"seconds,omitempty"`
|
||||
// Signed fractions of a second at nanosecond resolution of the span
|
||||
// of time. Durations less than one second are represented with a 0
|
||||
// `seconds` field and a positive or negative `nanos` field. For durations
|
||||
// of one second or more, a non-zero value for the `nanos` field must be
|
||||
// of the same sign as the `seconds` field. Must be from -999,999,999
|
||||
// to +999,999,999 inclusive.
|
||||
Nanos int32 `protobuf:"varint,2,opt,name=nanos,proto3" json:"nanos,omitempty"`
|
||||
XXX_NoUnkeyedLiteral struct{} `json:"-"`
|
||||
XXX_unrecognized []byte `json:"-"`
|
||||
XXX_sizecache int32 `json:"-"`
|
||||
}
|
||||
|
||||
func (m *Duration) Reset() { *m = Duration{} }
|
||||
func (*Duration) ProtoMessage() {}
|
||||
func (*Duration) Descriptor() ([]byte, []int) {
|
||||
return fileDescriptor_23597b2ebd7ac6c5, []int{0}
|
||||
}
|
||||
func (*Duration) XXX_WellKnownType() string { return "Duration" }
|
||||
func (m *Duration) XXX_Unmarshal(b []byte) error {
|
||||
return m.Unmarshal(b)
|
||||
}
|
||||
func (m *Duration) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
|
||||
if deterministic {
|
||||
return xxx_messageInfo_Duration.Marshal(b, m, deterministic)
|
||||
} else {
|
||||
b = b[:cap(b)]
|
||||
n, err := m.MarshalToSizedBuffer(b)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return b[:n], nil
|
||||
}
|
||||
}
|
||||
func (m *Duration) XXX_Merge(src proto.Message) {
|
||||
xxx_messageInfo_Duration.Merge(m, src)
|
||||
}
|
||||
func (m *Duration) XXX_Size() int {
|
||||
return m.Size()
|
||||
}
|
||||
func (m *Duration) XXX_DiscardUnknown() {
|
||||
xxx_messageInfo_Duration.DiscardUnknown(m)
|
||||
}
|
||||
|
||||
var xxx_messageInfo_Duration proto.InternalMessageInfo
|
||||
|
||||
func (m *Duration) GetSeconds() int64 {
|
||||
if m != nil {
|
||||
return m.Seconds
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
func (m *Duration) GetNanos() int32 {
|
||||
if m != nil {
|
||||
return m.Nanos
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
func (*Duration) XXX_MessageName() string {
|
||||
return "google.protobuf.Duration"
|
||||
}
|
||||
func init() {
|
||||
proto.RegisterType((*Duration)(nil), "google.protobuf.Duration")
|
||||
}
|
||||
|
||||
func init() { proto.RegisterFile("google/protobuf/duration.proto", fileDescriptor_23597b2ebd7ac6c5) }
|
||||
|
||||
var fileDescriptor_23597b2ebd7ac6c5 = []byte{
|
||||
// 209 bytes of a gzipped FileDescriptorProto
|
||||
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x92, 0x4b, 0xcf, 0xcf, 0x4f,
|
||||
0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x4f, 0x29, 0x2d, 0x4a,
|
||||
0x2c, 0xc9, 0xcc, 0xcf, 0xd3, 0x03, 0x8b, 0x08, 0xf1, 0x43, 0xe4, 0xf5, 0x60, 0xf2, 0x4a, 0x56,
|
||||
0x5c, 0x1c, 0x2e, 0x50, 0x25, 0x42, 0x12, 0x5c, 0xec, 0xc5, 0xa9, 0xc9, 0xf9, 0x79, 0x29, 0xc5,
|
||||
0x12, 0x8c, 0x0a, 0x8c, 0x1a, 0xcc, 0x41, 0x30, 0xae, 0x90, 0x08, 0x17, 0x6b, 0x5e, 0x62, 0x5e,
|
||||
0x7e, 0xb1, 0x04, 0x93, 0x02, 0xa3, 0x06, 0x6b, 0x10, 0x84, 0xe3, 0x54, 0x7f, 0xe3, 0xa1, 0x1c,
|
||||
0xc3, 0x87, 0x87, 0x72, 0x8c, 0x2b, 0x1e, 0xc9, 0x31, 0x9e, 0x78, 0x24, 0xc7, 0x78, 0xe1, 0x91,
|
||||
0x1c, 0xe3, 0x83, 0x47, 0x72, 0x8c, 0x2f, 0x1e, 0xc9, 0x31, 0x7c, 0x78, 0x24, 0xc7, 0xb8, 0xe2,
|
||||
0xb1, 0x1c, 0xe3, 0x89, 0xc7, 0x72, 0x8c, 0x5c, 0xc2, 0xc9, 0xf9, 0xb9, 0x7a, 0x68, 0x56, 0x3b,
|
||||
0xf1, 0xc2, 0x2c, 0x0e, 0x00, 0x89, 0x04, 0x30, 0x46, 0xb1, 0x96, 0x54, 0x16, 0xa4, 0x16, 0xff,
|
||||
0x60, 0x64, 0x5c, 0xc4, 0xc4, 0xec, 0x1e, 0xe0, 0xb4, 0x8a, 0x49, 0xce, 0x1d, 0xa2, 0x25, 0x00,
|
||||
0xaa, 0x45, 0x2f, 0x3c, 0x35, 0x27, 0xc7, 0x3b, 0x2f, 0xbf, 0x3c, 0x2f, 0x04, 0xa4, 0x32, 0x89,
|
||||
0x0d, 0x6c, 0x96, 0x31, 0x20, 0x00, 0x00, 0xff, 0xff, 0x8a, 0x1c, 0x64, 0x4e, 0xf6, 0x00, 0x00,
|
||||
0x00,
|
||||
}
|
||||
|
||||
func (this *Duration) Compare(that interface{}) int {
|
||||
if that == nil {
|
||||
if this == nil {
|
||||
return 0
|
||||
}
|
||||
return 1
|
||||
}
|
||||
|
||||
that1, ok := that.(*Duration)
|
||||
if !ok {
|
||||
that2, ok := that.(Duration)
|
||||
if ok {
|
||||
that1 = &that2
|
||||
} else {
|
||||
return 1
|
||||
}
|
||||
}
|
||||
if that1 == nil {
|
||||
if this == nil {
|
||||
return 0
|
||||
}
|
||||
return 1
|
||||
} else if this == nil {
|
||||
return -1
|
||||
}
|
||||
if this.Seconds != that1.Seconds {
|
||||
if this.Seconds < that1.Seconds {
|
||||
return -1
|
||||
}
|
||||
return 1
|
||||
}
|
||||
if this.Nanos != that1.Nanos {
|
||||
if this.Nanos < that1.Nanos {
|
||||
return -1
|
||||
}
|
||||
return 1
|
||||
}
|
||||
if c := bytes.Compare(this.XXX_unrecognized, that1.XXX_unrecognized); c != 0 {
|
||||
return c
|
||||
}
|
||||
return 0
|
||||
}
|
||||
func (this *Duration) Equal(that interface{}) bool {
|
||||
if that == nil {
|
||||
return this == nil
|
||||
}
|
||||
|
||||
that1, ok := that.(*Duration)
|
||||
if !ok {
|
||||
that2, ok := that.(Duration)
|
||||
if ok {
|
||||
that1 = &that2
|
||||
} else {
|
||||
return false
|
||||
}
|
||||
}
|
||||
if that1 == nil {
|
||||
return this == nil
|
||||
} else if this == nil {
|
||||
return false
|
||||
}
|
||||
if this.Seconds != that1.Seconds {
|
||||
return false
|
||||
}
|
||||
if this.Nanos != that1.Nanos {
|
||||
return false
|
||||
}
|
||||
if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
func (this *Duration) GoString() string {
|
||||
if this == nil {
|
||||
return "nil"
|
||||
}
|
||||
s := make([]string, 0, 6)
|
||||
s = append(s, "&types.Duration{")
|
||||
s = append(s, "Seconds: "+fmt.Sprintf("%#v", this.Seconds)+",\n")
|
||||
s = append(s, "Nanos: "+fmt.Sprintf("%#v", this.Nanos)+",\n")
|
||||
if this.XXX_unrecognized != nil {
|
||||
s = append(s, "XXX_unrecognized:"+fmt.Sprintf("%#v", this.XXX_unrecognized)+",\n")
|
||||
}
|
||||
s = append(s, "}")
|
||||
return strings.Join(s, "")
|
||||
}
|
||||
func valueToGoStringDuration(v interface{}, typ string) string {
|
||||
rv := reflect.ValueOf(v)
|
||||
if rv.IsNil() {
|
||||
return "nil"
|
||||
}
|
||||
pv := reflect.Indirect(rv).Interface()
|
||||
return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
|
||||
}
|
||||
func (m *Duration) Marshal() (dAtA []byte, err error) {
|
||||
size := m.Size()
|
||||
dAtA = make([]byte, size)
|
||||
n, err := m.MarshalToSizedBuffer(dAtA[:size])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return dAtA[:n], nil
|
||||
}
|
||||
|
||||
func (m *Duration) MarshalTo(dAtA []byte) (int, error) {
|
||||
size := m.Size()
|
||||
return m.MarshalToSizedBuffer(dAtA[:size])
|
||||
}
|
||||
|
||||
func (m *Duration) MarshalToSizedBuffer(dAtA []byte) (int, error) {
|
||||
i := len(dAtA)
|
||||
_ = i
|
||||
var l int
|
||||
_ = l
|
||||
if m.XXX_unrecognized != nil {
|
||||
i -= len(m.XXX_unrecognized)
|
||||
copy(dAtA[i:], m.XXX_unrecognized)
|
||||
}
|
||||
if m.Nanos != 0 {
|
||||
i = encodeVarintDuration(dAtA, i, uint64(m.Nanos))
|
||||
i--
|
||||
dAtA[i] = 0x10
|
||||
}
|
||||
if m.Seconds != 0 {
|
||||
i = encodeVarintDuration(dAtA, i, uint64(m.Seconds))
|
||||
i--
|
||||
dAtA[i] = 0x8
|
||||
}
|
||||
return len(dAtA) - i, nil
|
||||
}
|
||||
|
||||
func encodeVarintDuration(dAtA []byte, offset int, v uint64) int {
|
||||
offset -= sovDuration(v)
|
||||
base := offset
|
||||
for v >= 1<<7 {
|
||||
dAtA[offset] = uint8(v&0x7f | 0x80)
|
||||
v >>= 7
|
||||
offset++
|
||||
}
|
||||
dAtA[offset] = uint8(v)
|
||||
return base
|
||||
}
|
||||
func (m *Duration) Size() (n int) {
|
||||
if m == nil {
|
||||
return 0
|
||||
}
|
||||
var l int
|
||||
_ = l
|
||||
if m.Seconds != 0 {
|
||||
n += 1 + sovDuration(uint64(m.Seconds))
|
||||
}
|
||||
if m.Nanos != 0 {
|
||||
n += 1 + sovDuration(uint64(m.Nanos))
|
||||
}
|
||||
if m.XXX_unrecognized != nil {
|
||||
n += len(m.XXX_unrecognized)
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
func sovDuration(x uint64) (n int) {
|
||||
return (math_bits.Len64(x|1) + 6) / 7
|
||||
}
|
||||
func sozDuration(x uint64) (n int) {
|
||||
return sovDuration(uint64((x << 1) ^ uint64((int64(x) >> 63))))
|
||||
}
|
||||
func (m *Duration) Unmarshal(dAtA []byte) error {
|
||||
l := len(dAtA)
|
||||
iNdEx := 0
|
||||
for iNdEx < l {
|
||||
preIndex := iNdEx
|
||||
var wire uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowDuration
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
wire |= uint64(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
fieldNum := int32(wire >> 3)
|
||||
wireType := int(wire & 0x7)
|
||||
if wireType == 4 {
|
||||
return fmt.Errorf("proto: Duration: wiretype end group for non-group")
|
||||
}
|
||||
if fieldNum <= 0 {
|
||||
return fmt.Errorf("proto: Duration: illegal tag %d (wire type %d)", fieldNum, wire)
|
||||
}
|
||||
switch fieldNum {
|
||||
case 1:
|
||||
if wireType != 0 {
|
||||
return fmt.Errorf("proto: wrong wireType = %d for field Seconds", wireType)
|
||||
}
|
||||
m.Seconds = 0
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowDuration
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
m.Seconds |= int64(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
case 2:
|
||||
if wireType != 0 {
|
||||
return fmt.Errorf("proto: wrong wireType = %d for field Nanos", wireType)
|
||||
}
|
||||
m.Nanos = 0
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowDuration
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
m.Nanos |= int32(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
default:
|
||||
iNdEx = preIndex
|
||||
skippy, err := skipDuration(dAtA[iNdEx:])
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if (skippy < 0) || (iNdEx+skippy) < 0 {
|
||||
return ErrInvalidLengthDuration
|
||||
}
|
||||
if (iNdEx + skippy) > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
|
||||
iNdEx += skippy
|
||||
}
|
||||
}
|
||||
|
||||
if iNdEx > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func skipDuration(dAtA []byte) (n int, err error) {
|
||||
l := len(dAtA)
|
||||
iNdEx := 0
|
||||
depth := 0
|
||||
for iNdEx < l {
|
||||
var wire uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowDuration
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
wire |= (uint64(b) & 0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
wireType := int(wire & 0x7)
|
||||
switch wireType {
|
||||
case 0:
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowDuration
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
iNdEx++
|
||||
if dAtA[iNdEx-1] < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
case 1:
|
||||
iNdEx += 8
|
||||
case 2:
|
||||
var length int
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowDuration
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
length |= (int(b) & 0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
if length < 0 {
|
||||
return 0, ErrInvalidLengthDuration
|
||||
}
|
||||
iNdEx += length
|
||||
case 3:
|
||||
depth++
|
||||
case 4:
|
||||
if depth == 0 {
|
||||
return 0, ErrUnexpectedEndOfGroupDuration
|
||||
}
|
||||
depth--
|
||||
case 5:
|
||||
iNdEx += 4
|
||||
default:
|
||||
return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
|
||||
}
|
||||
if iNdEx < 0 {
|
||||
return 0, ErrInvalidLengthDuration
|
||||
}
|
||||
if depth == 0 {
|
||||
return iNdEx, nil
|
||||
}
|
||||
}
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
|
||||
var (
|
||||
ErrInvalidLengthDuration = fmt.Errorf("proto: negative length found during unmarshaling")
|
||||
ErrIntOverflowDuration = fmt.Errorf("proto: integer overflow")
|
||||
ErrUnexpectedEndOfGroupDuration = fmt.Errorf("proto: unexpected end of group")
|
||||
)
|
||||
100
vendor/github.com/gogo/protobuf/types/duration_gogo.go
generated
vendored
100
vendor/github.com/gogo/protobuf/types/duration_gogo.go
generated
vendored
@ -1,100 +0,0 @@
|
||||
// Protocol Buffers for Go with Gadgets
|
||||
//
|
||||
// Copyright (c) 2016, The GoGo Authors. All rights reserved.
|
||||
// http://github.com/gogo/protobuf
|
||||
//
|
||||
// Redistribution and use in source and binary forms, with or without
|
||||
// modification, are permitted provided that the following conditions are
|
||||
// met:
|
||||
//
|
||||
// * Redistributions of source code must retain the above copyright
|
||||
// notice, this list of conditions and the following disclaimer.
|
||||
// * Redistributions in binary form must reproduce the above
|
||||
// copyright notice, this list of conditions and the following disclaimer
|
||||
// in the documentation and/or other materials provided with the
|
||||
// distribution.
|
||||
//
|
||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
package types
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"time"
|
||||
)
|
||||
|
||||
func NewPopulatedDuration(r interface {
|
||||
Int63() int64
|
||||
}, easy bool) *Duration {
|
||||
this := &Duration{}
|
||||
maxSecs := time.Hour.Nanoseconds() / 1e9
|
||||
max := 2 * maxSecs
|
||||
s := int64(r.Int63()) % max
|
||||
s -= maxSecs
|
||||
neg := int64(1)
|
||||
if s < 0 {
|
||||
neg = -1
|
||||
}
|
||||
this.Seconds = s
|
||||
this.Nanos = int32(neg * (r.Int63() % 1e9))
|
||||
return this
|
||||
}
|
||||
|
||||
func (d *Duration) String() string {
|
||||
td, err := DurationFromProto(d)
|
||||
if err != nil {
|
||||
return fmt.Sprintf("(%v)", err)
|
||||
}
|
||||
return td.String()
|
||||
}
|
||||
|
||||
func NewPopulatedStdDuration(r interface {
|
||||
Int63() int64
|
||||
}, easy bool) *time.Duration {
|
||||
dur := NewPopulatedDuration(r, easy)
|
||||
d, err := DurationFromProto(dur)
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
return &d
|
||||
}
|
||||
|
||||
func SizeOfStdDuration(d time.Duration) int {
|
||||
dur := DurationProto(d)
|
||||
return dur.Size()
|
||||
}
|
||||
|
||||
func StdDurationMarshal(d time.Duration) ([]byte, error) {
|
||||
size := SizeOfStdDuration(d)
|
||||
buf := make([]byte, size)
|
||||
_, err := StdDurationMarshalTo(d, buf)
|
||||
return buf, err
|
||||
}
|
||||
|
||||
func StdDurationMarshalTo(d time.Duration, data []byte) (int, error) {
|
||||
dur := DurationProto(d)
|
||||
return dur.MarshalTo(data)
|
||||
}
|
||||
|
||||
func StdDurationUnmarshal(d *time.Duration, data []byte) error {
|
||||
dur := &Duration{}
|
||||
if err := dur.Unmarshal(data); err != nil {
|
||||
return err
|
||||
}
|
||||
dd, err := DurationFromProto(dur)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
*d = dd
|
||||
return nil
|
||||
}
|
||||
462
vendor/github.com/gogo/protobuf/types/empty.pb.go
generated
vendored
462
vendor/github.com/gogo/protobuf/types/empty.pb.go
generated
vendored
@ -1,462 +0,0 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: google/protobuf/empty.proto
|
||||
|
||||
package types
|
||||
|
||||
import (
|
||||
bytes "bytes"
|
||||
fmt "fmt"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
io "io"
|
||||
math "math"
|
||||
math_bits "math/bits"
|
||||
reflect "reflect"
|
||||
strings "strings"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// This is a compile-time assertion to ensure that this generated file
|
||||
// is compatible with the proto package it is being compiled against.
|
||||
// A compilation error at this line likely means your copy of the
|
||||
// proto package needs to be updated.
|
||||
const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
|
||||
|
||||
// A generic empty message that you can re-use to avoid defining duplicated
|
||||
// empty messages in your APIs. A typical example is to use it as the request
|
||||
// or the response type of an API method. For instance:
|
||||
//
|
||||
// service Foo {
|
||||
// rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
|
||||
// }
|
||||
//
|
||||
// The JSON representation for `Empty` is empty JSON object `{}`.
|
||||
type Empty struct {
|
||||
XXX_NoUnkeyedLiteral struct{} `json:"-"`
|
||||
XXX_unrecognized []byte `json:"-"`
|
||||
XXX_sizecache int32 `json:"-"`
|
||||
}
|
||||
|
||||
func (m *Empty) Reset() { *m = Empty{} }
|
||||
func (*Empty) ProtoMessage() {}
|
||||
func (*Empty) Descriptor() ([]byte, []int) {
|
||||
return fileDescriptor_900544acb223d5b8, []int{0}
|
||||
}
|
||||
func (*Empty) XXX_WellKnownType() string { return "Empty" }
|
||||
func (m *Empty) XXX_Unmarshal(b []byte) error {
|
||||
return m.Unmarshal(b)
|
||||
}
|
||||
func (m *Empty) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
|
||||
if deterministic {
|
||||
return xxx_messageInfo_Empty.Marshal(b, m, deterministic)
|
||||
} else {
|
||||
b = b[:cap(b)]
|
||||
n, err := m.MarshalToSizedBuffer(b)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return b[:n], nil
|
||||
}
|
||||
}
|
||||
func (m *Empty) XXX_Merge(src proto.Message) {
|
||||
xxx_messageInfo_Empty.Merge(m, src)
|
||||
}
|
||||
func (m *Empty) XXX_Size() int {
|
||||
return m.Size()
|
||||
}
|
||||
func (m *Empty) XXX_DiscardUnknown() {
|
||||
xxx_messageInfo_Empty.DiscardUnknown(m)
|
||||
}
|
||||
|
||||
var xxx_messageInfo_Empty proto.InternalMessageInfo
|
||||
|
||||
func (*Empty) XXX_MessageName() string {
|
||||
return "google.protobuf.Empty"
|
||||
}
|
||||
func init() {
|
||||
proto.RegisterType((*Empty)(nil), "google.protobuf.Empty")
|
||||
}
|
||||
|
||||
func init() { proto.RegisterFile("google/protobuf/empty.proto", fileDescriptor_900544acb223d5b8) }
|
||||
|
||||
var fileDescriptor_900544acb223d5b8 = []byte{
|
||||
// 176 bytes of a gzipped FileDescriptorProto
|
||||
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x92, 0x4e, 0xcf, 0xcf, 0x4f,
|
||||
0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x4f, 0xcd, 0x2d, 0x28,
|
||||
0xa9, 0xd4, 0x03, 0x73, 0x85, 0xf8, 0x21, 0x92, 0x7a, 0x30, 0x49, 0x25, 0x76, 0x2e, 0x56, 0x57,
|
||||
0x90, 0xbc, 0x53, 0x0b, 0xe3, 0x8d, 0x87, 0x72, 0x0c, 0x1f, 0x1e, 0xca, 0x31, 0xfe, 0x78, 0x28,
|
||||
0xc7, 0xd8, 0xf0, 0x48, 0x8e, 0x71, 0xc5, 0x23, 0x39, 0xc6, 0x13, 0x8f, 0xe4, 0x18, 0x2f, 0x3c,
|
||||
0x92, 0x63, 0x7c, 0xf0, 0x48, 0x8e, 0xf1, 0xc5, 0x23, 0x39, 0x86, 0x0f, 0x20, 0xf1, 0xc7, 0x72,
|
||||
0x8c, 0x27, 0x1e, 0xcb, 0x31, 0x72, 0x09, 0x27, 0xe7, 0xe7, 0xea, 0xa1, 0x19, 0xe8, 0xc4, 0x05,
|
||||
0x36, 0x2e, 0x00, 0xc4, 0x0d, 0x60, 0x8c, 0x62, 0x2d, 0xa9, 0x2c, 0x48, 0x2d, 0xfe, 0xc1, 0xc8,
|
||||
0xb8, 0x88, 0x89, 0xd9, 0x3d, 0xc0, 0x69, 0x15, 0x93, 0x9c, 0x3b, 0x44, 0x7d, 0x00, 0x54, 0xbd,
|
||||
0x5e, 0x78, 0x6a, 0x4e, 0x8e, 0x77, 0x5e, 0x7e, 0x79, 0x5e, 0x08, 0x48, 0x65, 0x12, 0x1b, 0xd8,
|
||||
0x20, 0x63, 0x40, 0x00, 0x00, 0x00, 0xff, 0xff, 0x21, 0xbe, 0xb6, 0x31, 0xc6, 0x00, 0x00, 0x00,
|
||||
}
|
||||
|
||||
func (this *Empty) Compare(that interface{}) int {
|
||||
if that == nil {
|
||||
if this == nil {
|
||||
return 0
|
||||
}
|
||||
return 1
|
||||
}
|
||||
|
||||
that1, ok := that.(*Empty)
|
||||
if !ok {
|
||||
that2, ok := that.(Empty)
|
||||
if ok {
|
||||
that1 = &that2
|
||||
} else {
|
||||
return 1
|
||||
}
|
||||
}
|
||||
if that1 == nil {
|
||||
if this == nil {
|
||||
return 0
|
||||
}
|
||||
return 1
|
||||
} else if this == nil {
|
||||
return -1
|
||||
}
|
||||
if c := bytes.Compare(this.XXX_unrecognized, that1.XXX_unrecognized); c != 0 {
|
||||
return c
|
||||
}
|
||||
return 0
|
||||
}
|
||||
func (this *Empty) Equal(that interface{}) bool {
|
||||
if that == nil {
|
||||
return this == nil
|
||||
}
|
||||
|
||||
that1, ok := that.(*Empty)
|
||||
if !ok {
|
||||
that2, ok := that.(Empty)
|
||||
if ok {
|
||||
that1 = &that2
|
||||
} else {
|
||||
return false
|
||||
}
|
||||
}
|
||||
if that1 == nil {
|
||||
return this == nil
|
||||
} else if this == nil {
|
||||
return false
|
||||
}
|
||||
if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
func (this *Empty) GoString() string {
|
||||
if this == nil {
|
||||
return "nil"
|
||||
}
|
||||
s := make([]string, 0, 4)
|
||||
s = append(s, "&types.Empty{")
|
||||
if this.XXX_unrecognized != nil {
|
||||
s = append(s, "XXX_unrecognized:"+fmt.Sprintf("%#v", this.XXX_unrecognized)+",\n")
|
||||
}
|
||||
s = append(s, "}")
|
||||
return strings.Join(s, "")
|
||||
}
|
||||
func valueToGoStringEmpty(v interface{}, typ string) string {
|
||||
rv := reflect.ValueOf(v)
|
||||
if rv.IsNil() {
|
||||
return "nil"
|
||||
}
|
||||
pv := reflect.Indirect(rv).Interface()
|
||||
return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
|
||||
}
|
||||
func (m *Empty) Marshal() (dAtA []byte, err error) {
|
||||
size := m.Size()
|
||||
dAtA = make([]byte, size)
|
||||
n, err := m.MarshalToSizedBuffer(dAtA[:size])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return dAtA[:n], nil
|
||||
}
|
||||
|
||||
func (m *Empty) MarshalTo(dAtA []byte) (int, error) {
|
||||
size := m.Size()
|
||||
return m.MarshalToSizedBuffer(dAtA[:size])
|
||||
}
|
||||
|
||||
func (m *Empty) MarshalToSizedBuffer(dAtA []byte) (int, error) {
|
||||
i := len(dAtA)
|
||||
_ = i
|
||||
var l int
|
||||
_ = l
|
||||
if m.XXX_unrecognized != nil {
|
||||
i -= len(m.XXX_unrecognized)
|
||||
copy(dAtA[i:], m.XXX_unrecognized)
|
||||
}
|
||||
return len(dAtA) - i, nil
|
||||
}
|
||||
|
||||
func encodeVarintEmpty(dAtA []byte, offset int, v uint64) int {
|
||||
offset -= sovEmpty(v)
|
||||
base := offset
|
||||
for v >= 1<<7 {
|
||||
dAtA[offset] = uint8(v&0x7f | 0x80)
|
||||
v >>= 7
|
||||
offset++
|
||||
}
|
||||
dAtA[offset] = uint8(v)
|
||||
return base
|
||||
}
|
||||
func NewPopulatedEmpty(r randyEmpty, easy bool) *Empty {
|
||||
this := &Empty{}
|
||||
if !easy && r.Intn(10) != 0 {
|
||||
this.XXX_unrecognized = randUnrecognizedEmpty(r, 1)
|
||||
}
|
||||
return this
|
||||
}
|
||||
|
||||
type randyEmpty interface {
|
||||
Float32() float32
|
||||
Float64() float64
|
||||
Int63() int64
|
||||
Int31() int32
|
||||
Uint32() uint32
|
||||
Intn(n int) int
|
||||
}
|
||||
|
||||
func randUTF8RuneEmpty(r randyEmpty) rune {
|
||||
ru := r.Intn(62)
|
||||
if ru < 10 {
|
||||
return rune(ru + 48)
|
||||
} else if ru < 36 {
|
||||
return rune(ru + 55)
|
||||
}
|
||||
return rune(ru + 61)
|
||||
}
|
||||
func randStringEmpty(r randyEmpty) string {
|
||||
v1 := r.Intn(100)
|
||||
tmps := make([]rune, v1)
|
||||
for i := 0; i < v1; i++ {
|
||||
tmps[i] = randUTF8RuneEmpty(r)
|
||||
}
|
||||
return string(tmps)
|
||||
}
|
||||
func randUnrecognizedEmpty(r randyEmpty, maxFieldNumber int) (dAtA []byte) {
|
||||
l := r.Intn(5)
|
||||
for i := 0; i < l; i++ {
|
||||
wire := r.Intn(4)
|
||||
if wire == 3 {
|
||||
wire = 5
|
||||
}
|
||||
fieldNumber := maxFieldNumber + r.Intn(100)
|
||||
dAtA = randFieldEmpty(dAtA, r, fieldNumber, wire)
|
||||
}
|
||||
return dAtA
|
||||
}
|
||||
func randFieldEmpty(dAtA []byte, r randyEmpty, fieldNumber int, wire int) []byte {
|
||||
key := uint32(fieldNumber)<<3 | uint32(wire)
|
||||
switch wire {
|
||||
case 0:
|
||||
dAtA = encodeVarintPopulateEmpty(dAtA, uint64(key))
|
||||
v2 := r.Int63()
|
||||
if r.Intn(2) == 0 {
|
||||
v2 *= -1
|
||||
}
|
||||
dAtA = encodeVarintPopulateEmpty(dAtA, uint64(v2))
|
||||
case 1:
|
||||
dAtA = encodeVarintPopulateEmpty(dAtA, uint64(key))
|
||||
dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
|
||||
case 2:
|
||||
dAtA = encodeVarintPopulateEmpty(dAtA, uint64(key))
|
||||
ll := r.Intn(100)
|
||||
dAtA = encodeVarintPopulateEmpty(dAtA, uint64(ll))
|
||||
for j := 0; j < ll; j++ {
|
||||
dAtA = append(dAtA, byte(r.Intn(256)))
|
||||
}
|
||||
default:
|
||||
dAtA = encodeVarintPopulateEmpty(dAtA, uint64(key))
|
||||
dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
|
||||
}
|
||||
return dAtA
|
||||
}
|
||||
func encodeVarintPopulateEmpty(dAtA []byte, v uint64) []byte {
|
||||
for v >= 1<<7 {
|
||||
dAtA = append(dAtA, uint8(uint64(v)&0x7f|0x80))
|
||||
v >>= 7
|
||||
}
|
||||
dAtA = append(dAtA, uint8(v))
|
||||
return dAtA
|
||||
}
|
||||
func (m *Empty) Size() (n int) {
|
||||
if m == nil {
|
||||
return 0
|
||||
}
|
||||
var l int
|
||||
_ = l
|
||||
if m.XXX_unrecognized != nil {
|
||||
n += len(m.XXX_unrecognized)
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
func sovEmpty(x uint64) (n int) {
|
||||
return (math_bits.Len64(x|1) + 6) / 7
|
||||
}
|
||||
func sozEmpty(x uint64) (n int) {
|
||||
return sovEmpty(uint64((x << 1) ^ uint64((int64(x) >> 63))))
|
||||
}
|
||||
func (this *Empty) String() string {
|
||||
if this == nil {
|
||||
return "nil"
|
||||
}
|
||||
s := strings.Join([]string{`&Empty{`,
|
||||
`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,
|
||||
`}`,
|
||||
}, "")
|
||||
return s
|
||||
}
|
||||
func valueToStringEmpty(v interface{}) string {
|
||||
rv := reflect.ValueOf(v)
|
||||
if rv.IsNil() {
|
||||
return "nil"
|
||||
}
|
||||
pv := reflect.Indirect(rv).Interface()
|
||||
return fmt.Sprintf("*%v", pv)
|
||||
}
|
||||
func (m *Empty) Unmarshal(dAtA []byte) error {
|
||||
l := len(dAtA)
|
||||
iNdEx := 0
|
||||
for iNdEx < l {
|
||||
preIndex := iNdEx
|
||||
var wire uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowEmpty
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
wire |= uint64(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
fieldNum := int32(wire >> 3)
|
||||
wireType := int(wire & 0x7)
|
||||
if wireType == 4 {
|
||||
return fmt.Errorf("proto: Empty: wiretype end group for non-group")
|
||||
}
|
||||
if fieldNum <= 0 {
|
||||
return fmt.Errorf("proto: Empty: illegal tag %d (wire type %d)", fieldNum, wire)
|
||||
}
|
||||
switch fieldNum {
|
||||
default:
|
||||
iNdEx = preIndex
|
||||
skippy, err := skipEmpty(dAtA[iNdEx:])
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if (skippy < 0) || (iNdEx+skippy) < 0 {
|
||||
return ErrInvalidLengthEmpty
|
||||
}
|
||||
if (iNdEx + skippy) > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
|
||||
iNdEx += skippy
|
||||
}
|
||||
}
|
||||
|
||||
if iNdEx > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func skipEmpty(dAtA []byte) (n int, err error) {
|
||||
l := len(dAtA)
|
||||
iNdEx := 0
|
||||
depth := 0
|
||||
for iNdEx < l {
|
||||
var wire uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowEmpty
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
wire |= (uint64(b) & 0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
wireType := int(wire & 0x7)
|
||||
switch wireType {
|
||||
case 0:
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowEmpty
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
iNdEx++
|
||||
if dAtA[iNdEx-1] < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
case 1:
|
||||
iNdEx += 8
|
||||
case 2:
|
||||
var length int
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowEmpty
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
length |= (int(b) & 0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
if length < 0 {
|
||||
return 0, ErrInvalidLengthEmpty
|
||||
}
|
||||
iNdEx += length
|
||||
case 3:
|
||||
depth++
|
||||
case 4:
|
||||
if depth == 0 {
|
||||
return 0, ErrUnexpectedEndOfGroupEmpty
|
||||
}
|
||||
depth--
|
||||
case 5:
|
||||
iNdEx += 4
|
||||
default:
|
||||
return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
|
||||
}
|
||||
if iNdEx < 0 {
|
||||
return 0, ErrInvalidLengthEmpty
|
||||
}
|
||||
if depth == 0 {
|
||||
return iNdEx, nil
|
||||
}
|
||||
}
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
|
||||
var (
|
||||
ErrInvalidLengthEmpty = fmt.Errorf("proto: negative length found during unmarshaling")
|
||||
ErrIntOverflowEmpty = fmt.Errorf("proto: integer overflow")
|
||||
ErrUnexpectedEndOfGroupEmpty = fmt.Errorf("proto: unexpected end of group")
|
||||
)
|
||||
738
vendor/github.com/gogo/protobuf/types/field_mask.pb.go
generated
vendored
738
vendor/github.com/gogo/protobuf/types/field_mask.pb.go
generated
vendored
@ -1,738 +0,0 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: google/protobuf/field_mask.proto
|
||||
|
||||
package types
|
||||
|
||||
import (
|
||||
bytes "bytes"
|
||||
fmt "fmt"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
io "io"
|
||||
math "math"
|
||||
math_bits "math/bits"
|
||||
reflect "reflect"
|
||||
strings "strings"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// This is a compile-time assertion to ensure that this generated file
|
||||
// is compatible with the proto package it is being compiled against.
|
||||
// A compilation error at this line likely means your copy of the
|
||||
// proto package needs to be updated.
|
||||
const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
|
||||
|
||||
// `FieldMask` represents a set of symbolic field paths, for example:
|
||||
//
|
||||
// paths: "f.a"
|
||||
// paths: "f.b.d"
|
||||
//
|
||||
// Here `f` represents a field in some root message, `a` and `b`
|
||||
// fields in the message found in `f`, and `d` a field found in the
|
||||
// message in `f.b`.
|
||||
//
|
||||
// Field masks are used to specify a subset of fields that should be
|
||||
// returned by a get operation or modified by an update operation.
|
||||
// Field masks also have a custom JSON encoding (see below).
|
||||
//
|
||||
// # Field Masks in Projections
|
||||
//
|
||||
// When used in the context of a projection, a response message or
|
||||
// sub-message is filtered by the API to only contain those fields as
|
||||
// specified in the mask. For example, if the mask in the previous
|
||||
// example is applied to a response message as follows:
|
||||
//
|
||||
// f {
|
||||
// a : 22
|
||||
// b {
|
||||
// d : 1
|
||||
// x : 2
|
||||
// }
|
||||
// y : 13
|
||||
// }
|
||||
// z: 8
|
||||
//
|
||||
// The result will not contain specific values for fields x,y and z
|
||||
// (their value will be set to the default, and omitted in proto text
|
||||
// output):
|
||||
//
|
||||
//
|
||||
// f {
|
||||
// a : 22
|
||||
// b {
|
||||
// d : 1
|
||||
// }
|
||||
// }
|
||||
//
|
||||
// A repeated field is not allowed except at the last position of a
|
||||
// paths string.
|
||||
//
|
||||
// If a FieldMask object is not present in a get operation, the
|
||||
// operation applies to all fields (as if a FieldMask of all fields
|
||||
// had been specified).
|
||||
//
|
||||
// Note that a field mask does not necessarily apply to the
|
||||
// top-level response message. In case of a REST get operation, the
|
||||
// field mask applies directly to the response, but in case of a REST
|
||||
// list operation, the mask instead applies to each individual message
|
||||
// in the returned resource list. In case of a REST custom method,
|
||||
// other definitions may be used. Where the mask applies will be
|
||||
// clearly documented together with its declaration in the API. In
|
||||
// any case, the effect on the returned resource/resources is required
|
||||
// behavior for APIs.
|
||||
//
|
||||
// # Field Masks in Update Operations
|
||||
//
|
||||
// A field mask in update operations specifies which fields of the
|
||||
// targeted resource are going to be updated. The API is required
|
||||
// to only change the values of the fields as specified in the mask
|
||||
// and leave the others untouched. If a resource is passed in to
|
||||
// describe the updated values, the API ignores the values of all
|
||||
// fields not covered by the mask.
|
||||
//
|
||||
// If a repeated field is specified for an update operation, new values will
|
||||
// be appended to the existing repeated field in the target resource. Note that
|
||||
// a repeated field is only allowed in the last position of a `paths` string.
|
||||
//
|
||||
// If a sub-message is specified in the last position of the field mask for an
|
||||
// update operation, then new value will be merged into the existing sub-message
|
||||
// in the target resource.
|
||||
//
|
||||
// For example, given the target message:
|
||||
//
|
||||
// f {
|
||||
// b {
|
||||
// d: 1
|
||||
// x: 2
|
||||
// }
|
||||
// c: [1]
|
||||
// }
|
||||
//
|
||||
// And an update message:
|
||||
//
|
||||
// f {
|
||||
// b {
|
||||
// d: 10
|
||||
// }
|
||||
// c: [2]
|
||||
// }
|
||||
//
|
||||
// then if the field mask is:
|
||||
//
|
||||
// paths: ["f.b", "f.c"]
|
||||
//
|
||||
// then the result will be:
|
||||
//
|
||||
// f {
|
||||
// b {
|
||||
// d: 10
|
||||
// x: 2
|
||||
// }
|
||||
// c: [1, 2]
|
||||
// }
|
||||
//
|
||||
// An implementation may provide options to override this default behavior for
|
||||
// repeated and message fields.
|
||||
//
|
||||
// In order to reset a field's value to the default, the field must
|
||||
// be in the mask and set to the default value in the provided resource.
|
||||
// Hence, in order to reset all fields of a resource, provide a default
|
||||
// instance of the resource and set all fields in the mask, or do
|
||||
// not provide a mask as described below.
|
||||
//
|
||||
// If a field mask is not present on update, the operation applies to
|
||||
// all fields (as if a field mask of all fields has been specified).
|
||||
// Note that in the presence of schema evolution, this may mean that
|
||||
// fields the client does not know and has therefore not filled into
|
||||
// the request will be reset to their default. If this is unwanted
|
||||
// behavior, a specific service may require a client to always specify
|
||||
// a field mask, producing an error if not.
|
||||
//
|
||||
// As with get operations, the location of the resource which
|
||||
// describes the updated values in the request message depends on the
|
||||
// operation kind. In any case, the effect of the field mask is
|
||||
// required to be honored by the API.
|
||||
//
|
||||
// ## Considerations for HTTP REST
|
||||
//
|
||||
// The HTTP kind of an update operation which uses a field mask must
|
||||
// be set to PATCH instead of PUT in order to satisfy HTTP semantics
|
||||
// (PUT must only be used for full updates).
|
||||
//
|
||||
// # JSON Encoding of Field Masks
|
||||
//
|
||||
// In JSON, a field mask is encoded as a single string where paths are
|
||||
// separated by a comma. Fields name in each path are converted
|
||||
// to/from lower-camel naming conventions.
|
||||
//
|
||||
// As an example, consider the following message declarations:
|
||||
//
|
||||
// message Profile {
|
||||
// User user = 1;
|
||||
// Photo photo = 2;
|
||||
// }
|
||||
// message User {
|
||||
// string display_name = 1;
|
||||
// string address = 2;
|
||||
// }
|
||||
//
|
||||
// In proto a field mask for `Profile` may look as such:
|
||||
//
|
||||
// mask {
|
||||
// paths: "user.display_name"
|
||||
// paths: "photo"
|
||||
// }
|
||||
//
|
||||
// In JSON, the same mask is represented as below:
|
||||
//
|
||||
// {
|
||||
// mask: "user.displayName,photo"
|
||||
// }
|
||||
//
|
||||
// # Field Masks and Oneof Fields
|
||||
//
|
||||
// Field masks treat fields in oneofs just as regular fields. Consider the
|
||||
// following message:
|
||||
//
|
||||
// message SampleMessage {
|
||||
// oneof test_oneof {
|
||||
// string name = 4;
|
||||
// SubMessage sub_message = 9;
|
||||
// }
|
||||
// }
|
||||
//
|
||||
// The field mask can be:
|
||||
//
|
||||
// mask {
|
||||
// paths: "name"
|
||||
// }
|
||||
//
|
||||
// Or:
|
||||
//
|
||||
// mask {
|
||||
// paths: "sub_message"
|
||||
// }
|
||||
//
|
||||
// Note that oneof type names ("test_oneof" in this case) cannot be used in
|
||||
// paths.
|
||||
//
|
||||
// ## Field Mask Verification
|
||||
//
|
||||
// The implementation of any API method which has a FieldMask type field in the
|
||||
// request should verify the included field paths, and return an
|
||||
// `INVALID_ARGUMENT` error if any path is duplicated or unmappable.
|
||||
type FieldMask struct {
|
||||
// The set of field mask paths.
|
||||
Paths []string `protobuf:"bytes,1,rep,name=paths,proto3" json:"paths,omitempty"`
|
||||
XXX_NoUnkeyedLiteral struct{} `json:"-"`
|
||||
XXX_unrecognized []byte `json:"-"`
|
||||
XXX_sizecache int32 `json:"-"`
|
||||
}
|
||||
|
||||
func (m *FieldMask) Reset() { *m = FieldMask{} }
|
||||
func (*FieldMask) ProtoMessage() {}
|
||||
func (*FieldMask) Descriptor() ([]byte, []int) {
|
||||
return fileDescriptor_5158202634f0da48, []int{0}
|
||||
}
|
||||
func (m *FieldMask) XXX_Unmarshal(b []byte) error {
|
||||
return m.Unmarshal(b)
|
||||
}
|
||||
func (m *FieldMask) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
|
||||
if deterministic {
|
||||
return xxx_messageInfo_FieldMask.Marshal(b, m, deterministic)
|
||||
} else {
|
||||
b = b[:cap(b)]
|
||||
n, err := m.MarshalToSizedBuffer(b)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return b[:n], nil
|
||||
}
|
||||
}
|
||||
func (m *FieldMask) XXX_Merge(src proto.Message) {
|
||||
xxx_messageInfo_FieldMask.Merge(m, src)
|
||||
}
|
||||
func (m *FieldMask) XXX_Size() int {
|
||||
return m.Size()
|
||||
}
|
||||
func (m *FieldMask) XXX_DiscardUnknown() {
|
||||
xxx_messageInfo_FieldMask.DiscardUnknown(m)
|
||||
}
|
||||
|
||||
var xxx_messageInfo_FieldMask proto.InternalMessageInfo
|
||||
|
||||
func (m *FieldMask) GetPaths() []string {
|
||||
if m != nil {
|
||||
return m.Paths
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (*FieldMask) XXX_MessageName() string {
|
||||
return "google.protobuf.FieldMask"
|
||||
}
|
||||
func init() {
|
||||
proto.RegisterType((*FieldMask)(nil), "google.protobuf.FieldMask")
|
||||
}
|
||||
|
||||
func init() { proto.RegisterFile("google/protobuf/field_mask.proto", fileDescriptor_5158202634f0da48) }
|
||||
|
||||
var fileDescriptor_5158202634f0da48 = []byte{
|
||||
// 203 bytes of a gzipped FileDescriptorProto
|
||||
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x52, 0x48, 0xcf, 0xcf, 0x4f,
|
||||
0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x4f, 0xcb, 0x4c, 0xcd,
|
||||
0x49, 0x89, 0xcf, 0x4d, 0x2c, 0xce, 0xd6, 0x03, 0x8b, 0x09, 0xf1, 0x43, 0x54, 0xe8, 0xc1, 0x54,
|
||||
0x28, 0x29, 0x72, 0x71, 0xba, 0x81, 0x14, 0xf9, 0x26, 0x16, 0x67, 0x0b, 0x89, 0x70, 0xb1, 0x16,
|
||||
0x24, 0x96, 0x64, 0x14, 0x4b, 0x30, 0x2a, 0x30, 0x6b, 0x70, 0x06, 0x41, 0x38, 0x4e, 0x1d, 0x8c,
|
||||
0x37, 0x1e, 0xca, 0x31, 0x7c, 0x78, 0x28, 0xc7, 0xf8, 0xe3, 0xa1, 0x1c, 0x63, 0xc3, 0x23, 0x39,
|
||||
0xc6, 0x15, 0x8f, 0xe4, 0x18, 0x4f, 0x3c, 0x92, 0x63, 0xbc, 0xf0, 0x48, 0x8e, 0xf1, 0xc1, 0x23,
|
||||
0x39, 0xc6, 0x17, 0x8f, 0xe4, 0x18, 0x3e, 0x80, 0xc4, 0x1f, 0xcb, 0x31, 0x9e, 0x78, 0x2c, 0xc7,
|
||||
0xc8, 0x25, 0x9c, 0x9c, 0x9f, 0xab, 0x87, 0x66, 0x95, 0x13, 0x1f, 0xdc, 0xa2, 0x00, 0x90, 0x50,
|
||||
0x00, 0x63, 0x14, 0x6b, 0x49, 0x65, 0x41, 0x6a, 0xf1, 0x0f, 0x46, 0xc6, 0x45, 0x4c, 0xcc, 0xee,
|
||||
0x01, 0x4e, 0xab, 0x98, 0xe4, 0xdc, 0x21, 0x7a, 0x02, 0xa0, 0x7a, 0xf4, 0xc2, 0x53, 0x73, 0x72,
|
||||
0xbc, 0xf3, 0xf2, 0xcb, 0xf3, 0x42, 0x40, 0x2a, 0x93, 0xd8, 0xc0, 0x86, 0x19, 0x03, 0x02, 0x00,
|
||||
0x00, 0xff, 0xff, 0x43, 0xa0, 0x83, 0xd0, 0xe9, 0x00, 0x00, 0x00,
|
||||
}
|
||||
|
||||
func (this *FieldMask) Compare(that interface{}) int {
|
||||
if that == nil {
|
||||
if this == nil {
|
||||
return 0
|
||||
}
|
||||
return 1
|
||||
}
|
||||
|
||||
that1, ok := that.(*FieldMask)
|
||||
if !ok {
|
||||
that2, ok := that.(FieldMask)
|
||||
if ok {
|
||||
that1 = &that2
|
||||
} else {
|
||||
return 1
|
||||
}
|
||||
}
|
||||
if that1 == nil {
|
||||
if this == nil {
|
||||
return 0
|
||||
}
|
||||
return 1
|
||||
} else if this == nil {
|
||||
return -1
|
||||
}
|
||||
if len(this.Paths) != len(that1.Paths) {
|
||||
if len(this.Paths) < len(that1.Paths) {
|
||||
return -1
|
||||
}
|
||||
return 1
|
||||
}
|
||||
for i := range this.Paths {
|
||||
if this.Paths[i] != that1.Paths[i] {
|
||||
if this.Paths[i] < that1.Paths[i] {
|
||||
return -1
|
||||
}
|
||||
return 1
|
||||
}
|
||||
}
|
||||
if c := bytes.Compare(this.XXX_unrecognized, that1.XXX_unrecognized); c != 0 {
|
||||
return c
|
||||
}
|
||||
return 0
|
||||
}
|
||||
func (this *FieldMask) Equal(that interface{}) bool {
|
||||
if that == nil {
|
||||
return this == nil
|
||||
}
|
||||
|
||||
that1, ok := that.(*FieldMask)
|
||||
if !ok {
|
||||
that2, ok := that.(FieldMask)
|
||||
if ok {
|
||||
that1 = &that2
|
||||
} else {
|
||||
return false
|
||||
}
|
||||
}
|
||||
if that1 == nil {
|
||||
return this == nil
|
||||
} else if this == nil {
|
||||
return false
|
||||
}
|
||||
if len(this.Paths) != len(that1.Paths) {
|
||||
return false
|
||||
}
|
||||
for i := range this.Paths {
|
||||
if this.Paths[i] != that1.Paths[i] {
|
||||
return false
|
||||
}
|
||||
}
|
||||
if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
func (this *FieldMask) GoString() string {
|
||||
if this == nil {
|
||||
return "nil"
|
||||
}
|
||||
s := make([]string, 0, 5)
|
||||
s = append(s, "&types.FieldMask{")
|
||||
s = append(s, "Paths: "+fmt.Sprintf("%#v", this.Paths)+",\n")
|
||||
if this.XXX_unrecognized != nil {
|
||||
s = append(s, "XXX_unrecognized:"+fmt.Sprintf("%#v", this.XXX_unrecognized)+",\n")
|
||||
}
|
||||
s = append(s, "}")
|
||||
return strings.Join(s, "")
|
||||
}
|
||||
func valueToGoStringFieldMask(v interface{}, typ string) string {
|
||||
rv := reflect.ValueOf(v)
|
||||
if rv.IsNil() {
|
||||
return "nil"
|
||||
}
|
||||
pv := reflect.Indirect(rv).Interface()
|
||||
return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
|
||||
}
|
||||
func (m *FieldMask) Marshal() (dAtA []byte, err error) {
|
||||
size := m.Size()
|
||||
dAtA = make([]byte, size)
|
||||
n, err := m.MarshalToSizedBuffer(dAtA[:size])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return dAtA[:n], nil
|
||||
}
|
||||
|
||||
func (m *FieldMask) MarshalTo(dAtA []byte) (int, error) {
|
||||
size := m.Size()
|
||||
return m.MarshalToSizedBuffer(dAtA[:size])
|
||||
}
|
||||
|
||||
func (m *FieldMask) MarshalToSizedBuffer(dAtA []byte) (int, error) {
|
||||
i := len(dAtA)
|
||||
_ = i
|
||||
var l int
|
||||
_ = l
|
||||
if m.XXX_unrecognized != nil {
|
||||
i -= len(m.XXX_unrecognized)
|
||||
copy(dAtA[i:], m.XXX_unrecognized)
|
||||
}
|
||||
if len(m.Paths) > 0 {
|
||||
for iNdEx := len(m.Paths) - 1; iNdEx >= 0; iNdEx-- {
|
||||
i -= len(m.Paths[iNdEx])
|
||||
copy(dAtA[i:], m.Paths[iNdEx])
|
||||
i = encodeVarintFieldMask(dAtA, i, uint64(len(m.Paths[iNdEx])))
|
||||
i--
|
||||
dAtA[i] = 0xa
|
||||
}
|
||||
}
|
||||
return len(dAtA) - i, nil
|
||||
}
|
||||
|
||||
func encodeVarintFieldMask(dAtA []byte, offset int, v uint64) int {
|
||||
offset -= sovFieldMask(v)
|
||||
base := offset
|
||||
for v >= 1<<7 {
|
||||
dAtA[offset] = uint8(v&0x7f | 0x80)
|
||||
v >>= 7
|
||||
offset++
|
||||
}
|
||||
dAtA[offset] = uint8(v)
|
||||
return base
|
||||
}
|
||||
func NewPopulatedFieldMask(r randyFieldMask, easy bool) *FieldMask {
|
||||
this := &FieldMask{}
|
||||
v1 := r.Intn(10)
|
||||
this.Paths = make([]string, v1)
|
||||
for i := 0; i < v1; i++ {
|
||||
this.Paths[i] = string(randStringFieldMask(r))
|
||||
}
|
||||
if !easy && r.Intn(10) != 0 {
|
||||
this.XXX_unrecognized = randUnrecognizedFieldMask(r, 2)
|
||||
}
|
||||
return this
|
||||
}
|
||||
|
||||
type randyFieldMask interface {
|
||||
Float32() float32
|
||||
Float64() float64
|
||||
Int63() int64
|
||||
Int31() int32
|
||||
Uint32() uint32
|
||||
Intn(n int) int
|
||||
}
|
||||
|
||||
func randUTF8RuneFieldMask(r randyFieldMask) rune {
|
||||
ru := r.Intn(62)
|
||||
if ru < 10 {
|
||||
return rune(ru + 48)
|
||||
} else if ru < 36 {
|
||||
return rune(ru + 55)
|
||||
}
|
||||
return rune(ru + 61)
|
||||
}
|
||||
func randStringFieldMask(r randyFieldMask) string {
|
||||
v2 := r.Intn(100)
|
||||
tmps := make([]rune, v2)
|
||||
for i := 0; i < v2; i++ {
|
||||
tmps[i] = randUTF8RuneFieldMask(r)
|
||||
}
|
||||
return string(tmps)
|
||||
}
|
||||
func randUnrecognizedFieldMask(r randyFieldMask, maxFieldNumber int) (dAtA []byte) {
|
||||
l := r.Intn(5)
|
||||
for i := 0; i < l; i++ {
|
||||
wire := r.Intn(4)
|
||||
if wire == 3 {
|
||||
wire = 5
|
||||
}
|
||||
fieldNumber := maxFieldNumber + r.Intn(100)
|
||||
dAtA = randFieldFieldMask(dAtA, r, fieldNumber, wire)
|
||||
}
|
||||
return dAtA
|
||||
}
|
||||
func randFieldFieldMask(dAtA []byte, r randyFieldMask, fieldNumber int, wire int) []byte {
|
||||
key := uint32(fieldNumber)<<3 | uint32(wire)
|
||||
switch wire {
|
||||
case 0:
|
||||
dAtA = encodeVarintPopulateFieldMask(dAtA, uint64(key))
|
||||
v3 := r.Int63()
|
||||
if r.Intn(2) == 0 {
|
||||
v3 *= -1
|
||||
}
|
||||
dAtA = encodeVarintPopulateFieldMask(dAtA, uint64(v3))
|
||||
case 1:
|
||||
dAtA = encodeVarintPopulateFieldMask(dAtA, uint64(key))
|
||||
dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
|
||||
case 2:
|
||||
dAtA = encodeVarintPopulateFieldMask(dAtA, uint64(key))
|
||||
ll := r.Intn(100)
|
||||
dAtA = encodeVarintPopulateFieldMask(dAtA, uint64(ll))
|
||||
for j := 0; j < ll; j++ {
|
||||
dAtA = append(dAtA, byte(r.Intn(256)))
|
||||
}
|
||||
default:
|
||||
dAtA = encodeVarintPopulateFieldMask(dAtA, uint64(key))
|
||||
dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
|
||||
}
|
||||
return dAtA
|
||||
}
|
||||
func encodeVarintPopulateFieldMask(dAtA []byte, v uint64) []byte {
|
||||
for v >= 1<<7 {
|
||||
dAtA = append(dAtA, uint8(uint64(v)&0x7f|0x80))
|
||||
v >>= 7
|
||||
}
|
||||
dAtA = append(dAtA, uint8(v))
|
||||
return dAtA
|
||||
}
|
||||
func (m *FieldMask) Size() (n int) {
|
||||
if m == nil {
|
||||
return 0
|
||||
}
|
||||
var l int
|
||||
_ = l
|
||||
if len(m.Paths) > 0 {
|
||||
for _, s := range m.Paths {
|
||||
l = len(s)
|
||||
n += 1 + l + sovFieldMask(uint64(l))
|
||||
}
|
||||
}
|
||||
if m.XXX_unrecognized != nil {
|
||||
n += len(m.XXX_unrecognized)
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
func sovFieldMask(x uint64) (n int) {
|
||||
return (math_bits.Len64(x|1) + 6) / 7
|
||||
}
|
||||
func sozFieldMask(x uint64) (n int) {
|
||||
return sovFieldMask(uint64((x << 1) ^ uint64((int64(x) >> 63))))
|
||||
}
|
||||
func (this *FieldMask) String() string {
|
||||
if this == nil {
|
||||
return "nil"
|
||||
}
|
||||
s := strings.Join([]string{`&FieldMask{`,
|
||||
`Paths:` + fmt.Sprintf("%v", this.Paths) + `,`,
|
||||
`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,
|
||||
`}`,
|
||||
}, "")
|
||||
return s
|
||||
}
|
||||
func valueToStringFieldMask(v interface{}) string {
|
||||
rv := reflect.ValueOf(v)
|
||||
if rv.IsNil() {
|
||||
return "nil"
|
||||
}
|
||||
pv := reflect.Indirect(rv).Interface()
|
||||
return fmt.Sprintf("*%v", pv)
|
||||
}
|
||||
func (m *FieldMask) Unmarshal(dAtA []byte) error {
|
||||
l := len(dAtA)
|
||||
iNdEx := 0
|
||||
for iNdEx < l {
|
||||
preIndex := iNdEx
|
||||
var wire uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowFieldMask
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
wire |= uint64(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
fieldNum := int32(wire >> 3)
|
||||
wireType := int(wire & 0x7)
|
||||
if wireType == 4 {
|
||||
return fmt.Errorf("proto: FieldMask: wiretype end group for non-group")
|
||||
}
|
||||
if fieldNum <= 0 {
|
||||
return fmt.Errorf("proto: FieldMask: illegal tag %d (wire type %d)", fieldNum, wire)
|
||||
}
|
||||
switch fieldNum {
|
||||
case 1:
|
||||
if wireType != 2 {
|
||||
return fmt.Errorf("proto: wrong wireType = %d for field Paths", wireType)
|
||||
}
|
||||
var stringLen uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowFieldMask
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
stringLen |= uint64(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
intStringLen := int(stringLen)
|
||||
if intStringLen < 0 {
|
||||
return ErrInvalidLengthFieldMask
|
||||
}
|
||||
postIndex := iNdEx + intStringLen
|
||||
if postIndex < 0 {
|
||||
return ErrInvalidLengthFieldMask
|
||||
}
|
||||
if postIndex > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
m.Paths = append(m.Paths, string(dAtA[iNdEx:postIndex]))
|
||||
iNdEx = postIndex
|
||||
default:
|
||||
iNdEx = preIndex
|
||||
skippy, err := skipFieldMask(dAtA[iNdEx:])
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if (skippy < 0) || (iNdEx+skippy) < 0 {
|
||||
return ErrInvalidLengthFieldMask
|
||||
}
|
||||
if (iNdEx + skippy) > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
|
||||
iNdEx += skippy
|
||||
}
|
||||
}
|
||||
|
||||
if iNdEx > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func skipFieldMask(dAtA []byte) (n int, err error) {
|
||||
l := len(dAtA)
|
||||
iNdEx := 0
|
||||
depth := 0
|
||||
for iNdEx < l {
|
||||
var wire uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowFieldMask
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
wire |= (uint64(b) & 0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
wireType := int(wire & 0x7)
|
||||
switch wireType {
|
||||
case 0:
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowFieldMask
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
iNdEx++
|
||||
if dAtA[iNdEx-1] < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
case 1:
|
||||
iNdEx += 8
|
||||
case 2:
|
||||
var length int
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowFieldMask
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
length |= (int(b) & 0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
if length < 0 {
|
||||
return 0, ErrInvalidLengthFieldMask
|
||||
}
|
||||
iNdEx += length
|
||||
case 3:
|
||||
depth++
|
||||
case 4:
|
||||
if depth == 0 {
|
||||
return 0, ErrUnexpectedEndOfGroupFieldMask
|
||||
}
|
||||
depth--
|
||||
case 5:
|
||||
iNdEx += 4
|
||||
default:
|
||||
return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
|
||||
}
|
||||
if iNdEx < 0 {
|
||||
return 0, ErrInvalidLengthFieldMask
|
||||
}
|
||||
if depth == 0 {
|
||||
return iNdEx, nil
|
||||
}
|
||||
}
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
|
||||
var (
|
||||
ErrInvalidLengthFieldMask = fmt.Errorf("proto: negative length found during unmarshaling")
|
||||
ErrIntOverflowFieldMask = fmt.Errorf("proto: integer overflow")
|
||||
ErrUnexpectedEndOfGroupFieldMask = fmt.Errorf("proto: unexpected end of group")
|
||||
)
|
||||
34
vendor/github.com/gogo/protobuf/types/protosize.go
generated
vendored
34
vendor/github.com/gogo/protobuf/types/protosize.go
generated
vendored
@ -1,34 +0,0 @@
|
||||
package types
|
||||
|
||||
func (m *Any) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Api) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Method) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Mixin) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Duration) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Empty) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *FieldMask) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *SourceContext) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Struct) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Value) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Value_NullValue) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Value_NumberValue) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Value_StringValue) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Value_BoolValue) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Value_StructValue) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Value_ListValue) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *ListValue) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Timestamp) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Type) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Field) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Enum) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *EnumValue) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Option) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *DoubleValue) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *FloatValue) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Int64Value) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *UInt64Value) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *Int32Value) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *UInt32Value) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *BoolValue) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *StringValue) ProtoSize() (n int) { return m.Size() }
|
||||
func (m *BytesValue) ProtoSize() (n int) { return m.Size() }
|
||||
524
vendor/github.com/gogo/protobuf/types/source_context.pb.go
generated
vendored
524
vendor/github.com/gogo/protobuf/types/source_context.pb.go
generated
vendored
@ -1,524 +0,0 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: google/protobuf/source_context.proto
|
||||
|
||||
package types
|
||||
|
||||
import (
|
||||
bytes "bytes"
|
||||
fmt "fmt"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
io "io"
|
||||
math "math"
|
||||
math_bits "math/bits"
|
||||
reflect "reflect"
|
||||
strings "strings"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// This is a compile-time assertion to ensure that this generated file
|
||||
// is compatible with the proto package it is being compiled against.
|
||||
// A compilation error at this line likely means your copy of the
|
||||
// proto package needs to be updated.
|
||||
const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
|
||||
|
||||
// `SourceContext` represents information about the source of a
|
||||
// protobuf element, like the file in which it is defined.
|
||||
type SourceContext struct {
|
||||
// The path-qualified name of the .proto file that contained the associated
|
||||
// protobuf element. For example: `"google/protobuf/source_context.proto"`.
|
||||
FileName string `protobuf:"bytes,1,opt,name=file_name,json=fileName,proto3" json:"file_name,omitempty"`
|
||||
XXX_NoUnkeyedLiteral struct{} `json:"-"`
|
||||
XXX_unrecognized []byte `json:"-"`
|
||||
XXX_sizecache int32 `json:"-"`
|
||||
}
|
||||
|
||||
func (m *SourceContext) Reset() { *m = SourceContext{} }
|
||||
func (*SourceContext) ProtoMessage() {}
|
||||
func (*SourceContext) Descriptor() ([]byte, []int) {
|
||||
return fileDescriptor_b686cdb126d509db, []int{0}
|
||||
}
|
||||
func (m *SourceContext) XXX_Unmarshal(b []byte) error {
|
||||
return m.Unmarshal(b)
|
||||
}
|
||||
func (m *SourceContext) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
|
||||
if deterministic {
|
||||
return xxx_messageInfo_SourceContext.Marshal(b, m, deterministic)
|
||||
} else {
|
||||
b = b[:cap(b)]
|
||||
n, err := m.MarshalToSizedBuffer(b)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return b[:n], nil
|
||||
}
|
||||
}
|
||||
func (m *SourceContext) XXX_Merge(src proto.Message) {
|
||||
xxx_messageInfo_SourceContext.Merge(m, src)
|
||||
}
|
||||
func (m *SourceContext) XXX_Size() int {
|
||||
return m.Size()
|
||||
}
|
||||
func (m *SourceContext) XXX_DiscardUnknown() {
|
||||
xxx_messageInfo_SourceContext.DiscardUnknown(m)
|
||||
}
|
||||
|
||||
var xxx_messageInfo_SourceContext proto.InternalMessageInfo
|
||||
|
||||
func (m *SourceContext) GetFileName() string {
|
||||
if m != nil {
|
||||
return m.FileName
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func (*SourceContext) XXX_MessageName() string {
|
||||
return "google.protobuf.SourceContext"
|
||||
}
|
||||
func init() {
|
||||
proto.RegisterType((*SourceContext)(nil), "google.protobuf.SourceContext")
|
||||
}
|
||||
|
||||
func init() {
|
||||
proto.RegisterFile("google/protobuf/source_context.proto", fileDescriptor_b686cdb126d509db)
|
||||
}
|
||||
|
||||
var fileDescriptor_b686cdb126d509db = []byte{
|
||||
// 212 bytes of a gzipped FileDescriptorProto
|
||||
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x52, 0x49, 0xcf, 0xcf, 0x4f,
|
||||
0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x2f, 0xce, 0x2f, 0x2d,
|
||||
0x4a, 0x4e, 0x8d, 0x4f, 0xce, 0xcf, 0x2b, 0x49, 0xad, 0x28, 0xd1, 0x03, 0x8b, 0x0b, 0xf1, 0x43,
|
||||
0x54, 0xe9, 0xc1, 0x54, 0x29, 0xe9, 0x70, 0xf1, 0x06, 0x83, 0x15, 0x3a, 0x43, 0xd4, 0x09, 0x49,
|
||||
0x73, 0x71, 0xa6, 0x65, 0xe6, 0xa4, 0xc6, 0xe7, 0x25, 0xe6, 0xa6, 0x4a, 0x30, 0x2a, 0x30, 0x6a,
|
||||
0x70, 0x06, 0x71, 0x80, 0x04, 0xfc, 0x12, 0x73, 0x53, 0x9d, 0x3a, 0x19, 0x6f, 0x3c, 0x94, 0x63,
|
||||
0xf8, 0xf0, 0x50, 0x8e, 0xf1, 0xc7, 0x43, 0x39, 0xc6, 0x86, 0x47, 0x72, 0x8c, 0x2b, 0x1e, 0xc9,
|
||||
0x31, 0x9e, 0x78, 0x24, 0xc7, 0x78, 0xe1, 0x91, 0x1c, 0xe3, 0x83, 0x47, 0x72, 0x8c, 0x2f, 0x1e,
|
||||
0xc9, 0x31, 0x7c, 0x00, 0x89, 0x3f, 0x96, 0x63, 0x3c, 0xf1, 0x58, 0x8e, 0x91, 0x4b, 0x38, 0x39,
|
||||
0x3f, 0x57, 0x0f, 0xcd, 0x56, 0x27, 0x21, 0x14, 0x3b, 0x03, 0x40, 0xc2, 0x01, 0x8c, 0x51, 0xac,
|
||||
0x25, 0x95, 0x05, 0xa9, 0xc5, 0x8b, 0x98, 0x98, 0xdd, 0x03, 0x9c, 0x56, 0x31, 0xc9, 0xb9, 0x43,
|
||||
0x34, 0x05, 0x40, 0x35, 0xe9, 0x85, 0xa7, 0xe6, 0xe4, 0x78, 0xe7, 0xe5, 0x97, 0xe7, 0x85, 0x80,
|
||||
0x94, 0x25, 0xb1, 0x81, 0x4d, 0x33, 0x06, 0x04, 0x00, 0x00, 0xff, 0xff, 0xb8, 0x37, 0x2a, 0xa1,
|
||||
0xf9, 0x00, 0x00, 0x00,
|
||||
}
|
||||
|
||||
func (this *SourceContext) Compare(that interface{}) int {
|
||||
if that == nil {
|
||||
if this == nil {
|
||||
return 0
|
||||
}
|
||||
return 1
|
||||
}
|
||||
|
||||
that1, ok := that.(*SourceContext)
|
||||
if !ok {
|
||||
that2, ok := that.(SourceContext)
|
||||
if ok {
|
||||
that1 = &that2
|
||||
} else {
|
||||
return 1
|
||||
}
|
||||
}
|
||||
if that1 == nil {
|
||||
if this == nil {
|
||||
return 0
|
||||
}
|
||||
return 1
|
||||
} else if this == nil {
|
||||
return -1
|
||||
}
|
||||
if this.FileName != that1.FileName {
|
||||
if this.FileName < that1.FileName {
|
||||
return -1
|
||||
}
|
||||
return 1
|
||||
}
|
||||
if c := bytes.Compare(this.XXX_unrecognized, that1.XXX_unrecognized); c != 0 {
|
||||
return c
|
||||
}
|
||||
return 0
|
||||
}
|
||||
func (this *SourceContext) Equal(that interface{}) bool {
|
||||
if that == nil {
|
||||
return this == nil
|
||||
}
|
||||
|
||||
that1, ok := that.(*SourceContext)
|
||||
if !ok {
|
||||
that2, ok := that.(SourceContext)
|
||||
if ok {
|
||||
that1 = &that2
|
||||
} else {
|
||||
return false
|
||||
}
|
||||
}
|
||||
if that1 == nil {
|
||||
return this == nil
|
||||
} else if this == nil {
|
||||
return false
|
||||
}
|
||||
if this.FileName != that1.FileName {
|
||||
return false
|
||||
}
|
||||
if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
func (this *SourceContext) GoString() string {
|
||||
if this == nil {
|
||||
return "nil"
|
||||
}
|
||||
s := make([]string, 0, 5)
|
||||
s = append(s, "&types.SourceContext{")
|
||||
s = append(s, "FileName: "+fmt.Sprintf("%#v", this.FileName)+",\n")
|
||||
if this.XXX_unrecognized != nil {
|
||||
s = append(s, "XXX_unrecognized:"+fmt.Sprintf("%#v", this.XXX_unrecognized)+",\n")
|
||||
}
|
||||
s = append(s, "}")
|
||||
return strings.Join(s, "")
|
||||
}
|
||||
func valueToGoStringSourceContext(v interface{}, typ string) string {
|
||||
rv := reflect.ValueOf(v)
|
||||
if rv.IsNil() {
|
||||
return "nil"
|
||||
}
|
||||
pv := reflect.Indirect(rv).Interface()
|
||||
return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
|
||||
}
|
||||
func (m *SourceContext) Marshal() (dAtA []byte, err error) {
|
||||
size := m.Size()
|
||||
dAtA = make([]byte, size)
|
||||
n, err := m.MarshalToSizedBuffer(dAtA[:size])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return dAtA[:n], nil
|
||||
}
|
||||
|
||||
func (m *SourceContext) MarshalTo(dAtA []byte) (int, error) {
|
||||
size := m.Size()
|
||||
return m.MarshalToSizedBuffer(dAtA[:size])
|
||||
}
|
||||
|
||||
func (m *SourceContext) MarshalToSizedBuffer(dAtA []byte) (int, error) {
|
||||
i := len(dAtA)
|
||||
_ = i
|
||||
var l int
|
||||
_ = l
|
||||
if m.XXX_unrecognized != nil {
|
||||
i -= len(m.XXX_unrecognized)
|
||||
copy(dAtA[i:], m.XXX_unrecognized)
|
||||
}
|
||||
if len(m.FileName) > 0 {
|
||||
i -= len(m.FileName)
|
||||
copy(dAtA[i:], m.FileName)
|
||||
i = encodeVarintSourceContext(dAtA, i, uint64(len(m.FileName)))
|
||||
i--
|
||||
dAtA[i] = 0xa
|
||||
}
|
||||
return len(dAtA) - i, nil
|
||||
}
|
||||
|
||||
func encodeVarintSourceContext(dAtA []byte, offset int, v uint64) int {
|
||||
offset -= sovSourceContext(v)
|
||||
base := offset
|
||||
for v >= 1<<7 {
|
||||
dAtA[offset] = uint8(v&0x7f | 0x80)
|
||||
v >>= 7
|
||||
offset++
|
||||
}
|
||||
dAtA[offset] = uint8(v)
|
||||
return base
|
||||
}
|
||||
func NewPopulatedSourceContext(r randySourceContext, easy bool) *SourceContext {
|
||||
this := &SourceContext{}
|
||||
this.FileName = string(randStringSourceContext(r))
|
||||
if !easy && r.Intn(10) != 0 {
|
||||
this.XXX_unrecognized = randUnrecognizedSourceContext(r, 2)
|
||||
}
|
||||
return this
|
||||
}
|
||||
|
||||
type randySourceContext interface {
|
||||
Float32() float32
|
||||
Float64() float64
|
||||
Int63() int64
|
||||
Int31() int32
|
||||
Uint32() uint32
|
||||
Intn(n int) int
|
||||
}
|
||||
|
||||
func randUTF8RuneSourceContext(r randySourceContext) rune {
|
||||
ru := r.Intn(62)
|
||||
if ru < 10 {
|
||||
return rune(ru + 48)
|
||||
} else if ru < 36 {
|
||||
return rune(ru + 55)
|
||||
}
|
||||
return rune(ru + 61)
|
||||
}
|
||||
func randStringSourceContext(r randySourceContext) string {
|
||||
v1 := r.Intn(100)
|
||||
tmps := make([]rune, v1)
|
||||
for i := 0; i < v1; i++ {
|
||||
tmps[i] = randUTF8RuneSourceContext(r)
|
||||
}
|
||||
return string(tmps)
|
||||
}
|
||||
func randUnrecognizedSourceContext(r randySourceContext, maxFieldNumber int) (dAtA []byte) {
|
||||
l := r.Intn(5)
|
||||
for i := 0; i < l; i++ {
|
||||
wire := r.Intn(4)
|
||||
if wire == 3 {
|
||||
wire = 5
|
||||
}
|
||||
fieldNumber := maxFieldNumber + r.Intn(100)
|
||||
dAtA = randFieldSourceContext(dAtA, r, fieldNumber, wire)
|
||||
}
|
||||
return dAtA
|
||||
}
|
||||
func randFieldSourceContext(dAtA []byte, r randySourceContext, fieldNumber int, wire int) []byte {
|
||||
key := uint32(fieldNumber)<<3 | uint32(wire)
|
||||
switch wire {
|
||||
case 0:
|
||||
dAtA = encodeVarintPopulateSourceContext(dAtA, uint64(key))
|
||||
v2 := r.Int63()
|
||||
if r.Intn(2) == 0 {
|
||||
v2 *= -1
|
||||
}
|
||||
dAtA = encodeVarintPopulateSourceContext(dAtA, uint64(v2))
|
||||
case 1:
|
||||
dAtA = encodeVarintPopulateSourceContext(dAtA, uint64(key))
|
||||
dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
|
||||
case 2:
|
||||
dAtA = encodeVarintPopulateSourceContext(dAtA, uint64(key))
|
||||
ll := r.Intn(100)
|
||||
dAtA = encodeVarintPopulateSourceContext(dAtA, uint64(ll))
|
||||
for j := 0; j < ll; j++ {
|
||||
dAtA = append(dAtA, byte(r.Intn(256)))
|
||||
}
|
||||
default:
|
||||
dAtA = encodeVarintPopulateSourceContext(dAtA, uint64(key))
|
||||
dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
|
||||
}
|
||||
return dAtA
|
||||
}
|
||||
func encodeVarintPopulateSourceContext(dAtA []byte, v uint64) []byte {
|
||||
for v >= 1<<7 {
|
||||
dAtA = append(dAtA, uint8(uint64(v)&0x7f|0x80))
|
||||
v >>= 7
|
||||
}
|
||||
dAtA = append(dAtA, uint8(v))
|
||||
return dAtA
|
||||
}
|
||||
func (m *SourceContext) Size() (n int) {
|
||||
if m == nil {
|
||||
return 0
|
||||
}
|
||||
var l int
|
||||
_ = l
|
||||
l = len(m.FileName)
|
||||
if l > 0 {
|
||||
n += 1 + l + sovSourceContext(uint64(l))
|
||||
}
|
||||
if m.XXX_unrecognized != nil {
|
||||
n += len(m.XXX_unrecognized)
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
func sovSourceContext(x uint64) (n int) {
|
||||
return (math_bits.Len64(x|1) + 6) / 7
|
||||
}
|
||||
func sozSourceContext(x uint64) (n int) {
|
||||
return sovSourceContext(uint64((x << 1) ^ uint64((int64(x) >> 63))))
|
||||
}
|
||||
func (this *SourceContext) String() string {
|
||||
if this == nil {
|
||||
return "nil"
|
||||
}
|
||||
s := strings.Join([]string{`&SourceContext{`,
|
||||
`FileName:` + fmt.Sprintf("%v", this.FileName) + `,`,
|
||||
`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,
|
||||
`}`,
|
||||
}, "")
|
||||
return s
|
||||
}
|
||||
func valueToStringSourceContext(v interface{}) string {
|
||||
rv := reflect.ValueOf(v)
|
||||
if rv.IsNil() {
|
||||
return "nil"
|
||||
}
|
||||
pv := reflect.Indirect(rv).Interface()
|
||||
return fmt.Sprintf("*%v", pv)
|
||||
}
|
||||
func (m *SourceContext) Unmarshal(dAtA []byte) error {
|
||||
l := len(dAtA)
|
||||
iNdEx := 0
|
||||
for iNdEx < l {
|
||||
preIndex := iNdEx
|
||||
var wire uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowSourceContext
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
wire |= uint64(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
fieldNum := int32(wire >> 3)
|
||||
wireType := int(wire & 0x7)
|
||||
if wireType == 4 {
|
||||
return fmt.Errorf("proto: SourceContext: wiretype end group for non-group")
|
||||
}
|
||||
if fieldNum <= 0 {
|
||||
return fmt.Errorf("proto: SourceContext: illegal tag %d (wire type %d)", fieldNum, wire)
|
||||
}
|
||||
switch fieldNum {
|
||||
case 1:
|
||||
if wireType != 2 {
|
||||
return fmt.Errorf("proto: wrong wireType = %d for field FileName", wireType)
|
||||
}
|
||||
var stringLen uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowSourceContext
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
stringLen |= uint64(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
intStringLen := int(stringLen)
|
||||
if intStringLen < 0 {
|
||||
return ErrInvalidLengthSourceContext
|
||||
}
|
||||
postIndex := iNdEx + intStringLen
|
||||
if postIndex < 0 {
|
||||
return ErrInvalidLengthSourceContext
|
||||
}
|
||||
if postIndex > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
m.FileName = string(dAtA[iNdEx:postIndex])
|
||||
iNdEx = postIndex
|
||||
default:
|
||||
iNdEx = preIndex
|
||||
skippy, err := skipSourceContext(dAtA[iNdEx:])
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if (skippy < 0) || (iNdEx+skippy) < 0 {
|
||||
return ErrInvalidLengthSourceContext
|
||||
}
|
||||
if (iNdEx + skippy) > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
|
||||
iNdEx += skippy
|
||||
}
|
||||
}
|
||||
|
||||
if iNdEx > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func skipSourceContext(dAtA []byte) (n int, err error) {
|
||||
l := len(dAtA)
|
||||
iNdEx := 0
|
||||
depth := 0
|
||||
for iNdEx < l {
|
||||
var wire uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowSourceContext
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
wire |= (uint64(b) & 0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
wireType := int(wire & 0x7)
|
||||
switch wireType {
|
||||
case 0:
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowSourceContext
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
iNdEx++
|
||||
if dAtA[iNdEx-1] < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
case 1:
|
||||
iNdEx += 8
|
||||
case 2:
|
||||
var length int
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowSourceContext
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
length |= (int(b) & 0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
if length < 0 {
|
||||
return 0, ErrInvalidLengthSourceContext
|
||||
}
|
||||
iNdEx += length
|
||||
case 3:
|
||||
depth++
|
||||
case 4:
|
||||
if depth == 0 {
|
||||
return 0, ErrUnexpectedEndOfGroupSourceContext
|
||||
}
|
||||
depth--
|
||||
case 5:
|
||||
iNdEx += 4
|
||||
default:
|
||||
return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
|
||||
}
|
||||
if iNdEx < 0 {
|
||||
return 0, ErrInvalidLengthSourceContext
|
||||
}
|
||||
if depth == 0 {
|
||||
return iNdEx, nil
|
||||
}
|
||||
}
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
|
||||
var (
|
||||
ErrInvalidLengthSourceContext = fmt.Errorf("proto: negative length found during unmarshaling")
|
||||
ErrIntOverflowSourceContext = fmt.Errorf("proto: integer overflow")
|
||||
ErrUnexpectedEndOfGroupSourceContext = fmt.Errorf("proto: unexpected end of group")
|
||||
)
|
||||
2271
vendor/github.com/gogo/protobuf/types/struct.pb.go
generated
vendored
2271
vendor/github.com/gogo/protobuf/types/struct.pb.go
generated
vendored
File diff suppressed because it is too large
Load Diff
130
vendor/github.com/gogo/protobuf/types/timestamp.go
generated
vendored
130
vendor/github.com/gogo/protobuf/types/timestamp.go
generated
vendored
@ -1,130 +0,0 @@
|
||||
// Go support for Protocol Buffers - Google's data interchange format
|
||||
//
|
||||
// Copyright 2016 The Go Authors. All rights reserved.
|
||||
// https://github.com/golang/protobuf
|
||||
//
|
||||
// Redistribution and use in source and binary forms, with or without
|
||||
// modification, are permitted provided that the following conditions are
|
||||
// met:
|
||||
//
|
||||
// * Redistributions of source code must retain the above copyright
|
||||
// notice, this list of conditions and the following disclaimer.
|
||||
// * Redistributions in binary form must reproduce the above
|
||||
// copyright notice, this list of conditions and the following disclaimer
|
||||
// in the documentation and/or other materials provided with the
|
||||
// distribution.
|
||||
// * Neither the name of Google Inc. nor the names of its
|
||||
// contributors may be used to endorse or promote products derived from
|
||||
// this software without specific prior written permission.
|
||||
//
|
||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
package types
|
||||
|
||||
// This file implements operations on google.protobuf.Timestamp.
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"time"
|
||||
)
|
||||
|
||||
const (
|
||||
// Seconds field of the earliest valid Timestamp.
|
||||
// This is time.Date(1, 1, 1, 0, 0, 0, 0, time.UTC).Unix().
|
||||
minValidSeconds = -62135596800
|
||||
// Seconds field just after the latest valid Timestamp.
|
||||
// This is time.Date(10000, 1, 1, 0, 0, 0, 0, time.UTC).Unix().
|
||||
maxValidSeconds = 253402300800
|
||||
)
|
||||
|
||||
// validateTimestamp determines whether a Timestamp is valid.
|
||||
// A valid timestamp represents a time in the range
|
||||
// [0001-01-01, 10000-01-01) and has a Nanos field
|
||||
// in the range [0, 1e9).
|
||||
//
|
||||
// If the Timestamp is valid, validateTimestamp returns nil.
|
||||
// Otherwise, it returns an error that describes
|
||||
// the problem.
|
||||
//
|
||||
// Every valid Timestamp can be represented by a time.Time, but the converse is not true.
|
||||
func validateTimestamp(ts *Timestamp) error {
|
||||
if ts == nil {
|
||||
return errors.New("timestamp: nil Timestamp")
|
||||
}
|
||||
if ts.Seconds < minValidSeconds {
|
||||
return fmt.Errorf("timestamp: %#v before 0001-01-01", ts)
|
||||
}
|
||||
if ts.Seconds >= maxValidSeconds {
|
||||
return fmt.Errorf("timestamp: %#v after 10000-01-01", ts)
|
||||
}
|
||||
if ts.Nanos < 0 || ts.Nanos >= 1e9 {
|
||||
return fmt.Errorf("timestamp: %#v: nanos not in range [0, 1e9)", ts)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// TimestampFromProto converts a google.protobuf.Timestamp proto to a time.Time.
|
||||
// It returns an error if the argument is invalid.
|
||||
//
|
||||
// Unlike most Go functions, if Timestamp returns an error, the first return value
|
||||
// is not the zero time.Time. Instead, it is the value obtained from the
|
||||
// time.Unix function when passed the contents of the Timestamp, in the UTC
|
||||
// locale. This may or may not be a meaningful time; many invalid Timestamps
|
||||
// do map to valid time.Times.
|
||||
//
|
||||
// A nil Timestamp returns an error. The first return value in that case is
|
||||
// undefined.
|
||||
func TimestampFromProto(ts *Timestamp) (time.Time, error) {
|
||||
// Don't return the zero value on error, because corresponds to a valid
|
||||
// timestamp. Instead return whatever time.Unix gives us.
|
||||
var t time.Time
|
||||
if ts == nil {
|
||||
t = time.Unix(0, 0).UTC() // treat nil like the empty Timestamp
|
||||
} else {
|
||||
t = time.Unix(ts.Seconds, int64(ts.Nanos)).UTC()
|
||||
}
|
||||
return t, validateTimestamp(ts)
|
||||
}
|
||||
|
||||
// TimestampNow returns a google.protobuf.Timestamp for the current time.
|
||||
func TimestampNow() *Timestamp {
|
||||
ts, err := TimestampProto(time.Now())
|
||||
if err != nil {
|
||||
panic("ptypes: time.Now() out of Timestamp range")
|
||||
}
|
||||
return ts
|
||||
}
|
||||
|
||||
// TimestampProto converts the time.Time to a google.protobuf.Timestamp proto.
|
||||
// It returns an error if the resulting Timestamp is invalid.
|
||||
func TimestampProto(t time.Time) (*Timestamp, error) {
|
||||
ts := &Timestamp{
|
||||
Seconds: t.Unix(),
|
||||
Nanos: int32(t.Nanosecond()),
|
||||
}
|
||||
if err := validateTimestamp(ts); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return ts, nil
|
||||
}
|
||||
|
||||
// TimestampString returns the RFC 3339 string for valid Timestamps. For invalid
|
||||
// Timestamps, it returns an error message in parentheses.
|
||||
func TimestampString(ts *Timestamp) string {
|
||||
t, err := TimestampFromProto(ts)
|
||||
if err != nil {
|
||||
return fmt.Sprintf("(%v)", err)
|
||||
}
|
||||
return t.Format(time.RFC3339Nano)
|
||||
}
|
||||
539
vendor/github.com/gogo/protobuf/types/timestamp.pb.go
generated
vendored
539
vendor/github.com/gogo/protobuf/types/timestamp.pb.go
generated
vendored
@ -1,539 +0,0 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: google/protobuf/timestamp.proto
|
||||
|
||||
package types
|
||||
|
||||
import (
|
||||
bytes "bytes"
|
||||
fmt "fmt"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
io "io"
|
||||
math "math"
|
||||
math_bits "math/bits"
|
||||
reflect "reflect"
|
||||
strings "strings"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// This is a compile-time assertion to ensure that this generated file
|
||||
// is compatible with the proto package it is being compiled against.
|
||||
// A compilation error at this line likely means your copy of the
|
||||
// proto package needs to be updated.
|
||||
const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
|
||||
|
||||
// A Timestamp represents a point in time independent of any time zone or local
|
||||
// calendar, encoded as a count of seconds and fractions of seconds at
|
||||
// nanosecond resolution. The count is relative to an epoch at UTC midnight on
|
||||
// January 1, 1970, in the proleptic Gregorian calendar which extends the
|
||||
// Gregorian calendar backwards to year one.
|
||||
//
|
||||
// All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap
|
||||
// second table is needed for interpretation, using a [24-hour linear
|
||||
// smear](https://developers.google.com/time/smear).
|
||||
//
|
||||
// The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By
|
||||
// restricting to that range, we ensure that we can convert to and from [RFC
|
||||
// 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.
|
||||
//
|
||||
// # Examples
|
||||
//
|
||||
// Example 1: Compute Timestamp from POSIX `time()`.
|
||||
//
|
||||
// Timestamp timestamp;
|
||||
// timestamp.set_seconds(time(NULL));
|
||||
// timestamp.set_nanos(0);
|
||||
//
|
||||
// Example 2: Compute Timestamp from POSIX `gettimeofday()`.
|
||||
//
|
||||
// struct timeval tv;
|
||||
// gettimeofday(&tv, NULL);
|
||||
//
|
||||
// Timestamp timestamp;
|
||||
// timestamp.set_seconds(tv.tv_sec);
|
||||
// timestamp.set_nanos(tv.tv_usec * 1000);
|
||||
//
|
||||
// Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.
|
||||
//
|
||||
// FILETIME ft;
|
||||
// GetSystemTimeAsFileTime(&ft);
|
||||
// UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
|
||||
//
|
||||
// // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
|
||||
// // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
|
||||
// Timestamp timestamp;
|
||||
// timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
|
||||
// timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
|
||||
//
|
||||
// Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.
|
||||
//
|
||||
// long millis = System.currentTimeMillis();
|
||||
//
|
||||
// Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
|
||||
// .setNanos((int) ((millis % 1000) * 1000000)).build();
|
||||
//
|
||||
//
|
||||
// Example 5: Compute Timestamp from current time in Python.
|
||||
//
|
||||
// timestamp = Timestamp()
|
||||
// timestamp.GetCurrentTime()
|
||||
//
|
||||
// # JSON Mapping
|
||||
//
|
||||
// In JSON format, the Timestamp type is encoded as a string in the
|
||||
// [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the
|
||||
// format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z"
|
||||
// where {year} is always expressed using four digits while {month}, {day},
|
||||
// {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
|
||||
// seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
|
||||
// are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
|
||||
// is required. A proto3 JSON serializer should always use UTC (as indicated by
|
||||
// "Z") when printing the Timestamp type and a proto3 JSON parser should be
|
||||
// able to accept both UTC and other timezones (as indicated by an offset).
|
||||
//
|
||||
// For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
|
||||
// 01:30 UTC on January 15, 2017.
|
||||
//
|
||||
// In JavaScript, one can convert a Date object to this format using the
|
||||
// standard
|
||||
// [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)
|
||||
// method. In Python, a standard `datetime.datetime` object can be converted
|
||||
// to this format using
|
||||
// [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with
|
||||
// the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use
|
||||
// the Joda Time's [`ISODateTimeFormat.dateTime()`](
|
||||
// http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime%2D%2D
|
||||
// ) to obtain a formatter capable of generating timestamps in this format.
|
||||
//
|
||||
//
|
||||
type Timestamp struct {
|
||||
// Represents seconds of UTC time since Unix epoch
|
||||
// 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
||||
// 9999-12-31T23:59:59Z inclusive.
|
||||
Seconds int64 `protobuf:"varint,1,opt,name=seconds,proto3" json:"seconds,omitempty"`
|
||||
// Non-negative fractions of a second at nanosecond resolution. Negative
|
||||
// second values with fractions must still have non-negative nanos values
|
||||
// that count forward in time. Must be from 0 to 999,999,999
|
||||
// inclusive.
|
||||
Nanos int32 `protobuf:"varint,2,opt,name=nanos,proto3" json:"nanos,omitempty"`
|
||||
XXX_NoUnkeyedLiteral struct{} `json:"-"`
|
||||
XXX_unrecognized []byte `json:"-"`
|
||||
XXX_sizecache int32 `json:"-"`
|
||||
}
|
||||
|
||||
func (m *Timestamp) Reset() { *m = Timestamp{} }
|
||||
func (*Timestamp) ProtoMessage() {}
|
||||
func (*Timestamp) Descriptor() ([]byte, []int) {
|
||||
return fileDescriptor_292007bbfe81227e, []int{0}
|
||||
}
|
||||
func (*Timestamp) XXX_WellKnownType() string { return "Timestamp" }
|
||||
func (m *Timestamp) XXX_Unmarshal(b []byte) error {
|
||||
return m.Unmarshal(b)
|
||||
}
|
||||
func (m *Timestamp) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
|
||||
if deterministic {
|
||||
return xxx_messageInfo_Timestamp.Marshal(b, m, deterministic)
|
||||
} else {
|
||||
b = b[:cap(b)]
|
||||
n, err := m.MarshalToSizedBuffer(b)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return b[:n], nil
|
||||
}
|
||||
}
|
||||
func (m *Timestamp) XXX_Merge(src proto.Message) {
|
||||
xxx_messageInfo_Timestamp.Merge(m, src)
|
||||
}
|
||||
func (m *Timestamp) XXX_Size() int {
|
||||
return m.Size()
|
||||
}
|
||||
func (m *Timestamp) XXX_DiscardUnknown() {
|
||||
xxx_messageInfo_Timestamp.DiscardUnknown(m)
|
||||
}
|
||||
|
||||
var xxx_messageInfo_Timestamp proto.InternalMessageInfo
|
||||
|
||||
func (m *Timestamp) GetSeconds() int64 {
|
||||
if m != nil {
|
||||
return m.Seconds
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
func (m *Timestamp) GetNanos() int32 {
|
||||
if m != nil {
|
||||
return m.Nanos
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
func (*Timestamp) XXX_MessageName() string {
|
||||
return "google.protobuf.Timestamp"
|
||||
}
|
||||
func init() {
|
||||
proto.RegisterType((*Timestamp)(nil), "google.protobuf.Timestamp")
|
||||
}
|
||||
|
||||
func init() { proto.RegisterFile("google/protobuf/timestamp.proto", fileDescriptor_292007bbfe81227e) }
|
||||
|
||||
var fileDescriptor_292007bbfe81227e = []byte{
|
||||
// 212 bytes of a gzipped FileDescriptorProto
|
||||
0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x92, 0x4f, 0xcf, 0xcf, 0x4f,
|
||||
0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x2f, 0xc9, 0xcc, 0x4d,
|
||||
0x2d, 0x2e, 0x49, 0xcc, 0x2d, 0xd0, 0x03, 0x0b, 0x09, 0xf1, 0x43, 0x14, 0xe8, 0xc1, 0x14, 0x28,
|
||||
0x59, 0x73, 0x71, 0x86, 0xc0, 0xd4, 0x08, 0x49, 0x70, 0xb1, 0x17, 0xa7, 0x26, 0xe7, 0xe7, 0xa5,
|
||||
0x14, 0x4b, 0x30, 0x2a, 0x30, 0x6a, 0x30, 0x07, 0xc1, 0xb8, 0x42, 0x22, 0x5c, 0xac, 0x79, 0x89,
|
||||
0x79, 0xf9, 0xc5, 0x12, 0x4c, 0x0a, 0x8c, 0x1a, 0xac, 0x41, 0x10, 0x8e, 0x53, 0x03, 0xe3, 0x8d,
|
||||
0x87, 0x72, 0x0c, 0x1f, 0x1e, 0xca, 0x31, 0xae, 0x78, 0x24, 0xc7, 0x78, 0xe2, 0x91, 0x1c, 0xe3,
|
||||
0x85, 0x47, 0x72, 0x8c, 0x0f, 0x1e, 0xc9, 0x31, 0xbe, 0x78, 0x24, 0xc7, 0xf0, 0xe1, 0x91, 0x1c,
|
||||
0xe3, 0x8a, 0xc7, 0x72, 0x8c, 0x27, 0x1e, 0xcb, 0x31, 0x72, 0x09, 0x27, 0xe7, 0xe7, 0xea, 0xa1,
|
||||
0x59, 0xee, 0xc4, 0x07, 0xb7, 0x3a, 0x00, 0x24, 0x14, 0xc0, 0x18, 0xc5, 0x5a, 0x52, 0x59, 0x90,
|
||||
0x5a, 0xfc, 0x83, 0x91, 0x71, 0x11, 0x13, 0xb3, 0x7b, 0x80, 0xd3, 0x2a, 0x26, 0x39, 0x77, 0x88,
|
||||
0x9e, 0x00, 0xa8, 0x1e, 0xbd, 0xf0, 0xd4, 0x9c, 0x1c, 0xef, 0xbc, 0xfc, 0xf2, 0xbc, 0x10, 0x90,
|
||||
0xca, 0x24, 0x36, 0xb0, 0x61, 0xc6, 0x80, 0x00, 0x00, 0x00, 0xff, 0xff, 0x0b, 0x23, 0x83, 0xdd,
|
||||
0xfa, 0x00, 0x00, 0x00,
|
||||
}
|
||||
|
||||
func (this *Timestamp) Compare(that interface{}) int {
|
||||
if that == nil {
|
||||
if this == nil {
|
||||
return 0
|
||||
}
|
||||
return 1
|
||||
}
|
||||
|
||||
that1, ok := that.(*Timestamp)
|
||||
if !ok {
|
||||
that2, ok := that.(Timestamp)
|
||||
if ok {
|
||||
that1 = &that2
|
||||
} else {
|
||||
return 1
|
||||
}
|
||||
}
|
||||
if that1 == nil {
|
||||
if this == nil {
|
||||
return 0
|
||||
}
|
||||
return 1
|
||||
} else if this == nil {
|
||||
return -1
|
||||
}
|
||||
if this.Seconds != that1.Seconds {
|
||||
if this.Seconds < that1.Seconds {
|
||||
return -1
|
||||
}
|
||||
return 1
|
||||
}
|
||||
if this.Nanos != that1.Nanos {
|
||||
if this.Nanos < that1.Nanos {
|
||||
return -1
|
||||
}
|
||||
return 1
|
||||
}
|
||||
if c := bytes.Compare(this.XXX_unrecognized, that1.XXX_unrecognized); c != 0 {
|
||||
return c
|
||||
}
|
||||
return 0
|
||||
}
|
||||
func (this *Timestamp) Equal(that interface{}) bool {
|
||||
if that == nil {
|
||||
return this == nil
|
||||
}
|
||||
|
||||
that1, ok := that.(*Timestamp)
|
||||
if !ok {
|
||||
that2, ok := that.(Timestamp)
|
||||
if ok {
|
||||
that1 = &that2
|
||||
} else {
|
||||
return false
|
||||
}
|
||||
}
|
||||
if that1 == nil {
|
||||
return this == nil
|
||||
} else if this == nil {
|
||||
return false
|
||||
}
|
||||
if this.Seconds != that1.Seconds {
|
||||
return false
|
||||
}
|
||||
if this.Nanos != that1.Nanos {
|
||||
return false
|
||||
}
|
||||
if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
func (this *Timestamp) GoString() string {
|
||||
if this == nil {
|
||||
return "nil"
|
||||
}
|
||||
s := make([]string, 0, 6)
|
||||
s = append(s, "&types.Timestamp{")
|
||||
s = append(s, "Seconds: "+fmt.Sprintf("%#v", this.Seconds)+",\n")
|
||||
s = append(s, "Nanos: "+fmt.Sprintf("%#v", this.Nanos)+",\n")
|
||||
if this.XXX_unrecognized != nil {
|
||||
s = append(s, "XXX_unrecognized:"+fmt.Sprintf("%#v", this.XXX_unrecognized)+",\n")
|
||||
}
|
||||
s = append(s, "}")
|
||||
return strings.Join(s, "")
|
||||
}
|
||||
func valueToGoStringTimestamp(v interface{}, typ string) string {
|
||||
rv := reflect.ValueOf(v)
|
||||
if rv.IsNil() {
|
||||
return "nil"
|
||||
}
|
||||
pv := reflect.Indirect(rv).Interface()
|
||||
return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
|
||||
}
|
||||
func (m *Timestamp) Marshal() (dAtA []byte, err error) {
|
||||
size := m.Size()
|
||||
dAtA = make([]byte, size)
|
||||
n, err := m.MarshalToSizedBuffer(dAtA[:size])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return dAtA[:n], nil
|
||||
}
|
||||
|
||||
func (m *Timestamp) MarshalTo(dAtA []byte) (int, error) {
|
||||
size := m.Size()
|
||||
return m.MarshalToSizedBuffer(dAtA[:size])
|
||||
}
|
||||
|
||||
func (m *Timestamp) MarshalToSizedBuffer(dAtA []byte) (int, error) {
|
||||
i := len(dAtA)
|
||||
_ = i
|
||||
var l int
|
||||
_ = l
|
||||
if m.XXX_unrecognized != nil {
|
||||
i -= len(m.XXX_unrecognized)
|
||||
copy(dAtA[i:], m.XXX_unrecognized)
|
||||
}
|
||||
if m.Nanos != 0 {
|
||||
i = encodeVarintTimestamp(dAtA, i, uint64(m.Nanos))
|
||||
i--
|
||||
dAtA[i] = 0x10
|
||||
}
|
||||
if m.Seconds != 0 {
|
||||
i = encodeVarintTimestamp(dAtA, i, uint64(m.Seconds))
|
||||
i--
|
||||
dAtA[i] = 0x8
|
||||
}
|
||||
return len(dAtA) - i, nil
|
||||
}
|
||||
|
||||
func encodeVarintTimestamp(dAtA []byte, offset int, v uint64) int {
|
||||
offset -= sovTimestamp(v)
|
||||
base := offset
|
||||
for v >= 1<<7 {
|
||||
dAtA[offset] = uint8(v&0x7f | 0x80)
|
||||
v >>= 7
|
||||
offset++
|
||||
}
|
||||
dAtA[offset] = uint8(v)
|
||||
return base
|
||||
}
|
||||
func (m *Timestamp) Size() (n int) {
|
||||
if m == nil {
|
||||
return 0
|
||||
}
|
||||
var l int
|
||||
_ = l
|
||||
if m.Seconds != 0 {
|
||||
n += 1 + sovTimestamp(uint64(m.Seconds))
|
||||
}
|
||||
if m.Nanos != 0 {
|
||||
n += 1 + sovTimestamp(uint64(m.Nanos))
|
||||
}
|
||||
if m.XXX_unrecognized != nil {
|
||||
n += len(m.XXX_unrecognized)
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
func sovTimestamp(x uint64) (n int) {
|
||||
return (math_bits.Len64(x|1) + 6) / 7
|
||||
}
|
||||
func sozTimestamp(x uint64) (n int) {
|
||||
return sovTimestamp(uint64((x << 1) ^ uint64((int64(x) >> 63))))
|
||||
}
|
||||
func (m *Timestamp) Unmarshal(dAtA []byte) error {
|
||||
l := len(dAtA)
|
||||
iNdEx := 0
|
||||
for iNdEx < l {
|
||||
preIndex := iNdEx
|
||||
var wire uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowTimestamp
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
wire |= uint64(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
fieldNum := int32(wire >> 3)
|
||||
wireType := int(wire & 0x7)
|
||||
if wireType == 4 {
|
||||
return fmt.Errorf("proto: Timestamp: wiretype end group for non-group")
|
||||
}
|
||||
if fieldNum <= 0 {
|
||||
return fmt.Errorf("proto: Timestamp: illegal tag %d (wire type %d)", fieldNum, wire)
|
||||
}
|
||||
switch fieldNum {
|
||||
case 1:
|
||||
if wireType != 0 {
|
||||
return fmt.Errorf("proto: wrong wireType = %d for field Seconds", wireType)
|
||||
}
|
||||
m.Seconds = 0
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowTimestamp
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
m.Seconds |= int64(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
case 2:
|
||||
if wireType != 0 {
|
||||
return fmt.Errorf("proto: wrong wireType = %d for field Nanos", wireType)
|
||||
}
|
||||
m.Nanos = 0
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return ErrIntOverflowTimestamp
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
m.Nanos |= int32(b&0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
default:
|
||||
iNdEx = preIndex
|
||||
skippy, err := skipTimestamp(dAtA[iNdEx:])
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if (skippy < 0) || (iNdEx+skippy) < 0 {
|
||||
return ErrInvalidLengthTimestamp
|
||||
}
|
||||
if (iNdEx + skippy) > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
|
||||
iNdEx += skippy
|
||||
}
|
||||
}
|
||||
|
||||
if iNdEx > l {
|
||||
return io.ErrUnexpectedEOF
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func skipTimestamp(dAtA []byte) (n int, err error) {
|
||||
l := len(dAtA)
|
||||
iNdEx := 0
|
||||
depth := 0
|
||||
for iNdEx < l {
|
||||
var wire uint64
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowTimestamp
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
wire |= (uint64(b) & 0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
wireType := int(wire & 0x7)
|
||||
switch wireType {
|
||||
case 0:
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowTimestamp
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
iNdEx++
|
||||
if dAtA[iNdEx-1] < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
case 1:
|
||||
iNdEx += 8
|
||||
case 2:
|
||||
var length int
|
||||
for shift := uint(0); ; shift += 7 {
|
||||
if shift >= 64 {
|
||||
return 0, ErrIntOverflowTimestamp
|
||||
}
|
||||
if iNdEx >= l {
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
b := dAtA[iNdEx]
|
||||
iNdEx++
|
||||
length |= (int(b) & 0x7F) << shift
|
||||
if b < 0x80 {
|
||||
break
|
||||
}
|
||||
}
|
||||
if length < 0 {
|
||||
return 0, ErrInvalidLengthTimestamp
|
||||
}
|
||||
iNdEx += length
|
||||
case 3:
|
||||
depth++
|
||||
case 4:
|
||||
if depth == 0 {
|
||||
return 0, ErrUnexpectedEndOfGroupTimestamp
|
||||
}
|
||||
depth--
|
||||
case 5:
|
||||
iNdEx += 4
|
||||
default:
|
||||
return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
|
||||
}
|
||||
if iNdEx < 0 {
|
||||
return 0, ErrInvalidLengthTimestamp
|
||||
}
|
||||
if depth == 0 {
|
||||
return iNdEx, nil
|
||||
}
|
||||
}
|
||||
return 0, io.ErrUnexpectedEOF
|
||||
}
|
||||
|
||||
var (
|
||||
ErrInvalidLengthTimestamp = fmt.Errorf("proto: negative length found during unmarshaling")
|
||||
ErrIntOverflowTimestamp = fmt.Errorf("proto: integer overflow")
|
||||
ErrUnexpectedEndOfGroupTimestamp = fmt.Errorf("proto: unexpected end of group")
|
||||
)
|
||||
94
vendor/github.com/gogo/protobuf/types/timestamp_gogo.go
generated
vendored
94
vendor/github.com/gogo/protobuf/types/timestamp_gogo.go
generated
vendored
@ -1,94 +0,0 @@
|
||||
// Protocol Buffers for Go with Gadgets
|
||||
//
|
||||
// Copyright (c) 2016, The GoGo Authors. All rights reserved.
|
||||
// http://github.com/gogo/protobuf
|
||||
//
|
||||
// Redistribution and use in source and binary forms, with or without
|
||||
// modification, are permitted provided that the following conditions are
|
||||
// met:
|
||||
//
|
||||
// * Redistributions of source code must retain the above copyright
|
||||
// notice, this list of conditions and the following disclaimer.
|
||||
// * Redistributions in binary form must reproduce the above
|
||||
// copyright notice, this list of conditions and the following disclaimer
|
||||
// in the documentation and/or other materials provided with the
|
||||
// distribution.
|
||||
//
|
||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
package types
|
||||
|
||||
import (
|
||||
"time"
|
||||
)
|
||||
|
||||
func NewPopulatedTimestamp(r interface {
|
||||
Int63() int64
|
||||
}, easy bool) *Timestamp {
|
||||
this := &Timestamp{}
|
||||
ns := int64(r.Int63())
|
||||
this.Seconds = ns / 1e9
|
||||
this.Nanos = int32(ns % 1e9)
|
||||
return this
|
||||
}
|
||||
|
||||
func (ts *Timestamp) String() string {
|
||||
return TimestampString(ts)
|
||||
}
|
||||
|
||||
func NewPopulatedStdTime(r interface {
|
||||
Int63() int64
|
||||
}, easy bool) *time.Time {
|
||||
timestamp := NewPopulatedTimestamp(r, easy)
|
||||
t, err := TimestampFromProto(timestamp)
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
return &t
|
||||
}
|
||||
|
||||
func SizeOfStdTime(t time.Time) int {
|
||||
ts, err := TimestampProto(t)
|
||||
if err != nil {
|
||||
return 0
|
||||
}
|
||||
return ts.Size()
|
||||
}
|
||||
|
||||
func StdTimeMarshal(t time.Time) ([]byte, error) {
|
||||
size := SizeOfStdTime(t)
|
||||
buf := make([]byte, size)
|
||||
_, err := StdTimeMarshalTo(t, buf)
|
||||
return buf, err
|
||||
}
|
||||
|
||||
func StdTimeMarshalTo(t time.Time, data []byte) (int, error) {
|
||||
ts, err := TimestampProto(t)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return ts.MarshalTo(data)
|
||||
}
|
||||
|
||||
func StdTimeUnmarshal(t *time.Time, data []byte) error {
|
||||
ts := &Timestamp{}
|
||||
if err := ts.Unmarshal(data); err != nil {
|
||||
return err
|
||||
}
|
||||
tt, err := TimestampFromProto(ts)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
*t = tt
|
||||
return nil
|
||||
}
|
||||
3355
vendor/github.com/gogo/protobuf/types/type.pb.go
generated
vendored
3355
vendor/github.com/gogo/protobuf/types/type.pb.go
generated
vendored
File diff suppressed because it is too large
Load Diff
2703
vendor/github.com/gogo/protobuf/types/wrappers.pb.go
generated
vendored
2703
vendor/github.com/gogo/protobuf/types/wrappers.pb.go
generated
vendored
File diff suppressed because it is too large
Load Diff
300
vendor/github.com/gogo/protobuf/types/wrappers_gogo.go
generated
vendored
300
vendor/github.com/gogo/protobuf/types/wrappers_gogo.go
generated
vendored
@ -1,300 +0,0 @@
|
||||
// Protocol Buffers for Go with Gadgets
|
||||
//
|
||||
// Copyright (c) 2018, The GoGo Authors. All rights reserved.
|
||||
// http://github.com/gogo/protobuf
|
||||
//
|
||||
// Redistribution and use in source and binary forms, with or without
|
||||
// modification, are permitted provided that the following conditions are
|
||||
// met:
|
||||
//
|
||||
// * Redistributions of source code must retain the above copyright
|
||||
// notice, this list of conditions and the following disclaimer.
|
||||
// * Redistributions in binary form must reproduce the above
|
||||
// copyright notice, this list of conditions and the following disclaimer
|
||||
// in the documentation and/or other materials provided with the
|
||||
// distribution.
|
||||
//
|
||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
package types
|
||||
|
||||
func NewPopulatedStdDouble(r randyWrappers, easy bool) *float64 {
|
||||
v := NewPopulatedDoubleValue(r, easy)
|
||||
return &v.Value
|
||||
}
|
||||
|
||||
func SizeOfStdDouble(v float64) int {
|
||||
pv := &DoubleValue{Value: v}
|
||||
return pv.Size()
|
||||
}
|
||||
|
||||
func StdDoubleMarshal(v float64) ([]byte, error) {
|
||||
size := SizeOfStdDouble(v)
|
||||
buf := make([]byte, size)
|
||||
_, err := StdDoubleMarshalTo(v, buf)
|
||||
return buf, err
|
||||
}
|
||||
|
||||
func StdDoubleMarshalTo(v float64, data []byte) (int, error) {
|
||||
pv := &DoubleValue{Value: v}
|
||||
return pv.MarshalTo(data)
|
||||
}
|
||||
|
||||
func StdDoubleUnmarshal(v *float64, data []byte) error {
|
||||
pv := &DoubleValue{}
|
||||
if err := pv.Unmarshal(data); err != nil {
|
||||
return err
|
||||
}
|
||||
*v = pv.Value
|
||||
return nil
|
||||
}
|
||||
func NewPopulatedStdFloat(r randyWrappers, easy bool) *float32 {
|
||||
v := NewPopulatedFloatValue(r, easy)
|
||||
return &v.Value
|
||||
}
|
||||
|
||||
func SizeOfStdFloat(v float32) int {
|
||||
pv := &FloatValue{Value: v}
|
||||
return pv.Size()
|
||||
}
|
||||
|
||||
func StdFloatMarshal(v float32) ([]byte, error) {
|
||||
size := SizeOfStdFloat(v)
|
||||
buf := make([]byte, size)
|
||||
_, err := StdFloatMarshalTo(v, buf)
|
||||
return buf, err
|
||||
}
|
||||
|
||||
func StdFloatMarshalTo(v float32, data []byte) (int, error) {
|
||||
pv := &FloatValue{Value: v}
|
||||
return pv.MarshalTo(data)
|
||||
}
|
||||
|
||||
func StdFloatUnmarshal(v *float32, data []byte) error {
|
||||
pv := &FloatValue{}
|
||||
if err := pv.Unmarshal(data); err != nil {
|
||||
return err
|
||||
}
|
||||
*v = pv.Value
|
||||
return nil
|
||||
}
|
||||
func NewPopulatedStdInt64(r randyWrappers, easy bool) *int64 {
|
||||
v := NewPopulatedInt64Value(r, easy)
|
||||
return &v.Value
|
||||
}
|
||||
|
||||
func SizeOfStdInt64(v int64) int {
|
||||
pv := &Int64Value{Value: v}
|
||||
return pv.Size()
|
||||
}
|
||||
|
||||
func StdInt64Marshal(v int64) ([]byte, error) {
|
||||
size := SizeOfStdInt64(v)
|
||||
buf := make([]byte, size)
|
||||
_, err := StdInt64MarshalTo(v, buf)
|
||||
return buf, err
|
||||
}
|
||||
|
||||
func StdInt64MarshalTo(v int64, data []byte) (int, error) {
|
||||
pv := &Int64Value{Value: v}
|
||||
return pv.MarshalTo(data)
|
||||
}
|
||||
|
||||
func StdInt64Unmarshal(v *int64, data []byte) error {
|
||||
pv := &Int64Value{}
|
||||
if err := pv.Unmarshal(data); err != nil {
|
||||
return err
|
||||
}
|
||||
*v = pv.Value
|
||||
return nil
|
||||
}
|
||||
func NewPopulatedStdUInt64(r randyWrappers, easy bool) *uint64 {
|
||||
v := NewPopulatedUInt64Value(r, easy)
|
||||
return &v.Value
|
||||
}
|
||||
|
||||
func SizeOfStdUInt64(v uint64) int {
|
||||
pv := &UInt64Value{Value: v}
|
||||
return pv.Size()
|
||||
}
|
||||
|
||||
func StdUInt64Marshal(v uint64) ([]byte, error) {
|
||||
size := SizeOfStdUInt64(v)
|
||||
buf := make([]byte, size)
|
||||
_, err := StdUInt64MarshalTo(v, buf)
|
||||
return buf, err
|
||||
}
|
||||
|
||||
func StdUInt64MarshalTo(v uint64, data []byte) (int, error) {
|
||||
pv := &UInt64Value{Value: v}
|
||||
return pv.MarshalTo(data)
|
||||
}
|
||||
|
||||
func StdUInt64Unmarshal(v *uint64, data []byte) error {
|
||||
pv := &UInt64Value{}
|
||||
if err := pv.Unmarshal(data); err != nil {
|
||||
return err
|
||||
}
|
||||
*v = pv.Value
|
||||
return nil
|
||||
}
|
||||
func NewPopulatedStdInt32(r randyWrappers, easy bool) *int32 {
|
||||
v := NewPopulatedInt32Value(r, easy)
|
||||
return &v.Value
|
||||
}
|
||||
|
||||
func SizeOfStdInt32(v int32) int {
|
||||
pv := &Int32Value{Value: v}
|
||||
return pv.Size()
|
||||
}
|
||||
|
||||
func StdInt32Marshal(v int32) ([]byte, error) {
|
||||
size := SizeOfStdInt32(v)
|
||||
buf := make([]byte, size)
|
||||
_, err := StdInt32MarshalTo(v, buf)
|
||||
return buf, err
|
||||
}
|
||||
|
||||
func StdInt32MarshalTo(v int32, data []byte) (int, error) {
|
||||
pv := &Int32Value{Value: v}
|
||||
return pv.MarshalTo(data)
|
||||
}
|
||||
|
||||
func StdInt32Unmarshal(v *int32, data []byte) error {
|
||||
pv := &Int32Value{}
|
||||
if err := pv.Unmarshal(data); err != nil {
|
||||
return err
|
||||
}
|
||||
*v = pv.Value
|
||||
return nil
|
||||
}
|
||||
func NewPopulatedStdUInt32(r randyWrappers, easy bool) *uint32 {
|
||||
v := NewPopulatedUInt32Value(r, easy)
|
||||
return &v.Value
|
||||
}
|
||||
|
||||
func SizeOfStdUInt32(v uint32) int {
|
||||
pv := &UInt32Value{Value: v}
|
||||
return pv.Size()
|
||||
}
|
||||
|
||||
func StdUInt32Marshal(v uint32) ([]byte, error) {
|
||||
size := SizeOfStdUInt32(v)
|
||||
buf := make([]byte, size)
|
||||
_, err := StdUInt32MarshalTo(v, buf)
|
||||
return buf, err
|
||||
}
|
||||
|
||||
func StdUInt32MarshalTo(v uint32, data []byte) (int, error) {
|
||||
pv := &UInt32Value{Value: v}
|
||||
return pv.MarshalTo(data)
|
||||
}
|
||||
|
||||
func StdUInt32Unmarshal(v *uint32, data []byte) error {
|
||||
pv := &UInt32Value{}
|
||||
if err := pv.Unmarshal(data); err != nil {
|
||||
return err
|
||||
}
|
||||
*v = pv.Value
|
||||
return nil
|
||||
}
|
||||
func NewPopulatedStdBool(r randyWrappers, easy bool) *bool {
|
||||
v := NewPopulatedBoolValue(r, easy)
|
||||
return &v.Value
|
||||
}
|
||||
|
||||
func SizeOfStdBool(v bool) int {
|
||||
pv := &BoolValue{Value: v}
|
||||
return pv.Size()
|
||||
}
|
||||
|
||||
func StdBoolMarshal(v bool) ([]byte, error) {
|
||||
size := SizeOfStdBool(v)
|
||||
buf := make([]byte, size)
|
||||
_, err := StdBoolMarshalTo(v, buf)
|
||||
return buf, err
|
||||
}
|
||||
|
||||
func StdBoolMarshalTo(v bool, data []byte) (int, error) {
|
||||
pv := &BoolValue{Value: v}
|
||||
return pv.MarshalTo(data)
|
||||
}
|
||||
|
||||
func StdBoolUnmarshal(v *bool, data []byte) error {
|
||||
pv := &BoolValue{}
|
||||
if err := pv.Unmarshal(data); err != nil {
|
||||
return err
|
||||
}
|
||||
*v = pv.Value
|
||||
return nil
|
||||
}
|
||||
func NewPopulatedStdString(r randyWrappers, easy bool) *string {
|
||||
v := NewPopulatedStringValue(r, easy)
|
||||
return &v.Value
|
||||
}
|
||||
|
||||
func SizeOfStdString(v string) int {
|
||||
pv := &StringValue{Value: v}
|
||||
return pv.Size()
|
||||
}
|
||||
|
||||
func StdStringMarshal(v string) ([]byte, error) {
|
||||
size := SizeOfStdString(v)
|
||||
buf := make([]byte, size)
|
||||
_, err := StdStringMarshalTo(v, buf)
|
||||
return buf, err
|
||||
}
|
||||
|
||||
func StdStringMarshalTo(v string, data []byte) (int, error) {
|
||||
pv := &StringValue{Value: v}
|
||||
return pv.MarshalTo(data)
|
||||
}
|
||||
|
||||
func StdStringUnmarshal(v *string, data []byte) error {
|
||||
pv := &StringValue{}
|
||||
if err := pv.Unmarshal(data); err != nil {
|
||||
return err
|
||||
}
|
||||
*v = pv.Value
|
||||
return nil
|
||||
}
|
||||
func NewPopulatedStdBytes(r randyWrappers, easy bool) *[]byte {
|
||||
v := NewPopulatedBytesValue(r, easy)
|
||||
return &v.Value
|
||||
}
|
||||
|
||||
func SizeOfStdBytes(v []byte) int {
|
||||
pv := &BytesValue{Value: v}
|
||||
return pv.Size()
|
||||
}
|
||||
|
||||
func StdBytesMarshal(v []byte) ([]byte, error) {
|
||||
size := SizeOfStdBytes(v)
|
||||
buf := make([]byte, size)
|
||||
_, err := StdBytesMarshalTo(v, buf)
|
||||
return buf, err
|
||||
}
|
||||
|
||||
func StdBytesMarshalTo(v []byte, data []byte) (int, error) {
|
||||
pv := &BytesValue{Value: v}
|
||||
return pv.MarshalTo(data)
|
||||
}
|
||||
|
||||
func StdBytesUnmarshal(v *[]byte, data []byte) error {
|
||||
pv := &BytesValue{}
|
||||
if err := pv.Unmarshal(data); err != nil {
|
||||
return err
|
||||
}
|
||||
*v = pv.Value
|
||||
return nil
|
||||
}
|
||||
3
vendor/github.com/miekg/pkcs11/.gitignore
generated
vendored
3
vendor/github.com/miekg/pkcs11/.gitignore
generated
vendored
@ -1,3 +0,0 @@
|
||||
tags
|
||||
test_db/*/generation
|
||||
test_db/*/*.lock
|
||||
27
vendor/github.com/miekg/pkcs11/LICENSE
generated
vendored
27
vendor/github.com/miekg/pkcs11/LICENSE
generated
vendored
@ -1,27 +0,0 @@
|
||||
Copyright (c) 2013 Miek Gieben. All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions are
|
||||
met:
|
||||
|
||||
* Redistributions of source code must retain the above copyright
|
||||
notice, this list of conditions and the following disclaimer.
|
||||
* Redistributions in binary form must reproduce the above
|
||||
copyright notice, this list of conditions and the following disclaimer
|
||||
in the documentation and/or other materials provided with the
|
||||
distribution.
|
||||
* Neither the name of Miek Gieben nor the names of its
|
||||
contributors may be used to endorse or promote products derived from
|
||||
this software without specific prior written permission.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
||||
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
57
vendor/github.com/miekg/pkcs11/Makefile.release
generated
vendored
57
vendor/github.com/miekg/pkcs11/Makefile.release
generated
vendored
@ -1,57 +0,0 @@
|
||||
# Makefile for releasing.
|
||||
#
|
||||
# The release is controlled from version.go. The version found there is
|
||||
# used to tag the git repo, we're not building any artifects so there is nothing
|
||||
# to upload to github.
|
||||
#
|
||||
# * Up the version in version.go
|
||||
# * Run: make -f Makefile.release release
|
||||
# * will *commit* your change with 'Release $VERSION'
|
||||
# * push to github
|
||||
#
|
||||
|
||||
define GO
|
||||
//+build ignore
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/miekg/pkcs11"
|
||||
)
|
||||
|
||||
func main() {
|
||||
fmt.Println(pkcs11.Release.String())
|
||||
}
|
||||
endef
|
||||
|
||||
$(file > version_release.go,$(GO))
|
||||
VERSION:=$(shell go run -tags release version_release.go)
|
||||
TAG="v$(VERSION)"
|
||||
|
||||
all:
|
||||
rm -f version_release.go
|
||||
@echo Use the \'release\' target to start a release $(VERSION)
|
||||
|
||||
.PHONY: run
|
||||
run:
|
||||
rm -f version_release.go
|
||||
@echo $(VERSION)
|
||||
|
||||
.PHONY: release
|
||||
release: commit push
|
||||
@echo Released $(VERSION)
|
||||
|
||||
.PHONY: commit
|
||||
commit:
|
||||
rm -f version_release.go
|
||||
@echo Committing release $(VERSION)
|
||||
git commit -am"Release $(VERSION)"
|
||||
git tag $(TAG)
|
||||
|
||||
.PHONY: push
|
||||
push:
|
||||
@echo Pushing release $(VERSION) to master
|
||||
git push --tags
|
||||
git push
|
||||
68
vendor/github.com/miekg/pkcs11/README.md
generated
vendored
68
vendor/github.com/miekg/pkcs11/README.md
generated
vendored
@ -1,68 +0,0 @@
|
||||
# PKCS#11
|
||||
|
||||
This is a Go implementation of the PKCS#11 API. It wraps the library closely, but uses Go idiom where
|
||||
it makes sense. It has been tested with SoftHSM.
|
||||
|
||||
## SoftHSM
|
||||
|
||||
* Make it use a custom configuration file `export SOFTHSM_CONF=$PWD/softhsm.conf`
|
||||
|
||||
* Then use `softhsm` to init it
|
||||
|
||||
~~~
|
||||
softhsm --init-token --slot 0 --label test --pin 1234
|
||||
~~~
|
||||
|
||||
* Then use `libsofthsm2.so` as the pkcs11 module:
|
||||
|
||||
~~~ go
|
||||
p := pkcs11.New("/usr/lib/softhsm/libsofthsm2.so")
|
||||
~~~
|
||||
|
||||
## Examples
|
||||
|
||||
A skeleton program would look somewhat like this (yes, pkcs#11 is verbose):
|
||||
|
||||
~~~ go
|
||||
p := pkcs11.New("/usr/lib/softhsm/libsofthsm2.so")
|
||||
err := p.Initialize()
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
defer p.Destroy()
|
||||
defer p.Finalize()
|
||||
|
||||
slots, err := p.GetSlotList(true)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
session, err := p.OpenSession(slots[0], pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
defer p.CloseSession(session)
|
||||
|
||||
err = p.Login(session, pkcs11.CKU_USER, "1234")
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
defer p.Logout(session)
|
||||
|
||||
p.DigestInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_SHA_1, nil)})
|
||||
hash, err := p.Digest(session, []byte("this is a string"))
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
for _, d := range hash {
|
||||
fmt.Printf("%x", d)
|
||||
}
|
||||
fmt.Println()
|
||||
~~~
|
||||
|
||||
Further examples are included in the tests.
|
||||
|
||||
To expose PKCS#11 keys using the [crypto.Signer interface](https://golang.org/pkg/crypto/#Signer),
|
||||
please see [github.com/thalesignite/crypto11](https://github.com/thalesignite/crypto11).
|
||||
98
vendor/github.com/miekg/pkcs11/error.go
generated
vendored
98
vendor/github.com/miekg/pkcs11/error.go
generated
vendored
@ -1,98 +0,0 @@
|
||||
// Copyright 2013 Miek Gieben. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package pkcs11
|
||||
|
||||
// awk '/#define CKR_/{ print $3":\""$2"\"," }' pkcs11t.h
|
||||
|
||||
var strerror = map[uint]string{
|
||||
0x00000000: "CKR_OK",
|
||||
0x00000001: "CKR_CANCEL",
|
||||
0x00000002: "CKR_HOST_MEMORY",
|
||||
0x00000003: "CKR_SLOT_ID_INVALID",
|
||||
0x00000005: "CKR_GENERAL_ERROR",
|
||||
0x00000006: "CKR_FUNCTION_FAILED",
|
||||
0x00000007: "CKR_ARGUMENTS_BAD",
|
||||
0x00000008: "CKR_NO_EVENT",
|
||||
0x00000009: "CKR_NEED_TO_CREATE_THREADS",
|
||||
0x0000000A: "CKR_CANT_LOCK",
|
||||
0x00000010: "CKR_ATTRIBUTE_READ_ONLY",
|
||||
0x00000011: "CKR_ATTRIBUTE_SENSITIVE",
|
||||
0x00000012: "CKR_ATTRIBUTE_TYPE_INVALID",
|
||||
0x00000013: "CKR_ATTRIBUTE_VALUE_INVALID",
|
||||
0x00000020: "CKR_DATA_INVALID",
|
||||
0x00000021: "CKR_DATA_LEN_RANGE",
|
||||
0x00000030: "CKR_DEVICE_ERROR",
|
||||
0x00000031: "CKR_DEVICE_MEMORY",
|
||||
0x00000032: "CKR_DEVICE_REMOVED",
|
||||
0x00000040: "CKR_ENCRYPTED_DATA_INVALID",
|
||||
0x00000041: "CKR_ENCRYPTED_DATA_LEN_RANGE",
|
||||
0x00000050: "CKR_FUNCTION_CANCELED",
|
||||
0x00000051: "CKR_FUNCTION_NOT_PARALLEL",
|
||||
0x00000054: "CKR_FUNCTION_NOT_SUPPORTED",
|
||||
0x00000060: "CKR_KEY_HANDLE_INVALID",
|
||||
0x00000062: "CKR_KEY_SIZE_RANGE",
|
||||
0x00000063: "CKR_KEY_TYPE_INCONSISTENT",
|
||||
0x00000064: "CKR_KEY_NOT_NEEDED",
|
||||
0x00000065: "CKR_KEY_CHANGED",
|
||||
0x00000066: "CKR_KEY_NEEDED",
|
||||
0x00000067: "CKR_KEY_INDIGESTIBLE",
|
||||
0x00000068: "CKR_KEY_FUNCTION_NOT_PERMITTED",
|
||||
0x00000069: "CKR_KEY_NOT_WRAPPABLE",
|
||||
0x0000006A: "CKR_KEY_UNEXTRACTABLE",
|
||||
0x00000070: "CKR_MECHANISM_INVALID",
|
||||
0x00000071: "CKR_MECHANISM_PARAM_INVALID",
|
||||
0x00000082: "CKR_OBJECT_HANDLE_INVALID",
|
||||
0x00000090: "CKR_OPERATION_ACTIVE",
|
||||
0x00000091: "CKR_OPERATION_NOT_INITIALIZED",
|
||||
0x000000A0: "CKR_PIN_INCORRECT",
|
||||
0x000000A1: "CKR_PIN_INVALID",
|
||||
0x000000A2: "CKR_PIN_LEN_RANGE",
|
||||
0x000000A3: "CKR_PIN_EXPIRED",
|
||||
0x000000A4: "CKR_PIN_LOCKED",
|
||||
0x000000B0: "CKR_SESSION_CLOSED",
|
||||
0x000000B1: "CKR_SESSION_COUNT",
|
||||
0x000000B3: "CKR_SESSION_HANDLE_INVALID",
|
||||
0x000000B4: "CKR_SESSION_PARALLEL_NOT_SUPPORTED",
|
||||
0x000000B5: "CKR_SESSION_READ_ONLY",
|
||||
0x000000B6: "CKR_SESSION_EXISTS",
|
||||
0x000000B7: "CKR_SESSION_READ_ONLY_EXISTS",
|
||||
0x000000B8: "CKR_SESSION_READ_WRITE_SO_EXISTS",
|
||||
0x000000C0: "CKR_SIGNATURE_INVALID",
|
||||
0x000000C1: "CKR_SIGNATURE_LEN_RANGE",
|
||||
0x000000D0: "CKR_TEMPLATE_INCOMPLETE",
|
||||
0x000000D1: "CKR_TEMPLATE_INCONSISTENT",
|
||||
0x000000E0: "CKR_TOKEN_NOT_PRESENT",
|
||||
0x000000E1: "CKR_TOKEN_NOT_RECOGNIZED",
|
||||
0x000000E2: "CKR_TOKEN_WRITE_PROTECTED",
|
||||
0x000000F0: "CKR_UNWRAPPING_KEY_HANDLE_INVALID",
|
||||
0x000000F1: "CKR_UNWRAPPING_KEY_SIZE_RANGE",
|
||||
0x000000F2: "CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT",
|
||||
0x00000100: "CKR_USER_ALREADY_LOGGED_IN",
|
||||
0x00000101: "CKR_USER_NOT_LOGGED_IN",
|
||||
0x00000102: "CKR_USER_PIN_NOT_INITIALIZED",
|
||||
0x00000103: "CKR_USER_TYPE_INVALID",
|
||||
0x00000104: "CKR_USER_ANOTHER_ALREADY_LOGGED_IN",
|
||||
0x00000105: "CKR_USER_TOO_MANY_TYPES",
|
||||
0x00000110: "CKR_WRAPPED_KEY_INVALID",
|
||||
0x00000112: "CKR_WRAPPED_KEY_LEN_RANGE",
|
||||
0x00000113: "CKR_WRAPPING_KEY_HANDLE_INVALID",
|
||||
0x00000114: "CKR_WRAPPING_KEY_SIZE_RANGE",
|
||||
0x00000115: "CKR_WRAPPING_KEY_TYPE_INCONSISTENT",
|
||||
0x00000120: "CKR_RANDOM_SEED_NOT_SUPPORTED",
|
||||
0x00000121: "CKR_RANDOM_NO_RNG",
|
||||
0x00000130: "CKR_DOMAIN_PARAMS_INVALID",
|
||||
0x00000150: "CKR_BUFFER_TOO_SMALL",
|
||||
0x00000160: "CKR_SAVED_STATE_INVALID",
|
||||
0x00000170: "CKR_INFORMATION_SENSITIVE",
|
||||
0x00000180: "CKR_STATE_UNSAVEABLE",
|
||||
0x00000190: "CKR_CRYPTOKI_NOT_INITIALIZED",
|
||||
0x00000191: "CKR_CRYPTOKI_ALREADY_INITIALIZED",
|
||||
0x000001A0: "CKR_MUTEX_BAD",
|
||||
0x000001A1: "CKR_MUTEX_NOT_LOCKED",
|
||||
0x000001B0: "CKR_NEW_PIN_MODE",
|
||||
0x000001B1: "CKR_NEXT_OTP",
|
||||
0x00000200: "CKR_FUNCTION_REJECTED",
|
||||
0x80000000: "CKR_VENDOR_DEFINED",
|
||||
}
|
||||
BIN
vendor/github.com/miekg/pkcs11/hsm.db
generated
vendored
BIN
vendor/github.com/miekg/pkcs11/hsm.db
generated
vendored
Binary file not shown.
190
vendor/github.com/miekg/pkcs11/params.go
generated
vendored
190
vendor/github.com/miekg/pkcs11/params.go
generated
vendored
@ -1,190 +0,0 @@
|
||||
// Copyright 2013 Miek Gieben. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package pkcs11
|
||||
|
||||
/*
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include "pkcs11go.h"
|
||||
|
||||
static inline void putOAEPParams(CK_RSA_PKCS_OAEP_PARAMS_PTR params, CK_VOID_PTR pSourceData, CK_ULONG ulSourceDataLen)
|
||||
{
|
||||
params->pSourceData = pSourceData;
|
||||
params->ulSourceDataLen = ulSourceDataLen;
|
||||
}
|
||||
|
||||
static inline void putECDH1SharedParams(CK_ECDH1_DERIVE_PARAMS_PTR params, CK_VOID_PTR pSharedData, CK_ULONG ulSharedDataLen)
|
||||
{
|
||||
params->pSharedData = pSharedData;
|
||||
params->ulSharedDataLen = ulSharedDataLen;
|
||||
}
|
||||
|
||||
static inline void putECDH1PublicParams(CK_ECDH1_DERIVE_PARAMS_PTR params, CK_VOID_PTR pPublicData, CK_ULONG ulPublicDataLen)
|
||||
{
|
||||
params->pPublicData = pPublicData;
|
||||
params->ulPublicDataLen = ulPublicDataLen;
|
||||
}
|
||||
*/
|
||||
import "C"
|
||||
import "unsafe"
|
||||
|
||||
// GCMParams represents the parameters for the AES-GCM mechanism.
|
||||
type GCMParams struct {
|
||||
arena
|
||||
params *C.CK_GCM_PARAMS
|
||||
iv []byte
|
||||
aad []byte
|
||||
tagSize int
|
||||
}
|
||||
|
||||
// NewGCMParams returns a pointer to AES-GCM parameters that can be used with the CKM_AES_GCM mechanism.
|
||||
// The Free() method must be called after the operation is complete.
|
||||
//
|
||||
// Note that some HSMs, like CloudHSM, will ignore the IV you pass in and write their
|
||||
// own. As a result, to support all libraries, memory is not freed
|
||||
// automatically, so that after the EncryptInit/Encrypt operation the HSM's IV
|
||||
// can be read back out. It is up to the caller to ensure that Free() is called
|
||||
// on the GCMParams object at an appropriate time, which is after
|
||||
//
|
||||
// Encrypt/Decrypt. As an example:
|
||||
//
|
||||
// gcmParams := pkcs11.NewGCMParams(make([]byte, 12), nil, 128)
|
||||
// p.ctx.EncryptInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_AES_GCM, gcmParams)},
|
||||
// aesObjHandle)
|
||||
// ct, _ := p.ctx.Encrypt(session, pt)
|
||||
// iv := gcmParams.IV()
|
||||
// gcmParams.Free()
|
||||
//
|
||||
func NewGCMParams(iv, aad []byte, tagSize int) *GCMParams {
|
||||
return &GCMParams{
|
||||
iv: iv,
|
||||
aad: aad,
|
||||
tagSize: tagSize,
|
||||
}
|
||||
}
|
||||
|
||||
func cGCMParams(p *GCMParams) []byte {
|
||||
params := C.CK_GCM_PARAMS{
|
||||
ulTagBits: C.CK_ULONG(p.tagSize),
|
||||
}
|
||||
var arena arena
|
||||
if len(p.iv) > 0 {
|
||||
iv, ivLen := arena.Allocate(p.iv)
|
||||
params.pIv = C.CK_BYTE_PTR(iv)
|
||||
params.ulIvLen = ivLen
|
||||
params.ulIvBits = ivLen * 8
|
||||
}
|
||||
if len(p.aad) > 0 {
|
||||
aad, aadLen := arena.Allocate(p.aad)
|
||||
params.pAAD = C.CK_BYTE_PTR(aad)
|
||||
params.ulAADLen = aadLen
|
||||
}
|
||||
p.Free()
|
||||
p.arena = arena
|
||||
p.params = ¶ms
|
||||
return C.GoBytes(unsafe.Pointer(¶ms), C.int(unsafe.Sizeof(params)))
|
||||
}
|
||||
|
||||
// IV returns a copy of the actual IV used for the operation.
|
||||
//
|
||||
// Some HSMs may ignore the user-specified IV and write their own at the end of
|
||||
// the encryption operation; this method allows you to retrieve it.
|
||||
func (p *GCMParams) IV() []byte {
|
||||
if p == nil || p.params == nil {
|
||||
return nil
|
||||
}
|
||||
newIv := C.GoBytes(unsafe.Pointer(p.params.pIv), C.int(p.params.ulIvLen))
|
||||
iv := make([]byte, len(newIv))
|
||||
copy(iv, newIv)
|
||||
return iv
|
||||
}
|
||||
|
||||
// Free deallocates the memory reserved for the HSM to write back the actual IV.
|
||||
//
|
||||
// This must be called after the entire operation is complete, i.e. after
|
||||
// Encrypt or EncryptFinal. It is safe to call Free multiple times.
|
||||
func (p *GCMParams) Free() {
|
||||
if p == nil || p.arena == nil {
|
||||
return
|
||||
}
|
||||
p.arena.Free()
|
||||
p.params = nil
|
||||
p.arena = nil
|
||||
}
|
||||
|
||||
// NewPSSParams creates a CK_RSA_PKCS_PSS_PARAMS structure and returns it as a byte array for use with the CKM_RSA_PKCS_PSS mechanism.
|
||||
func NewPSSParams(hashAlg, mgf, saltLength uint) []byte {
|
||||
p := C.CK_RSA_PKCS_PSS_PARAMS{
|
||||
hashAlg: C.CK_MECHANISM_TYPE(hashAlg),
|
||||
mgf: C.CK_RSA_PKCS_MGF_TYPE(mgf),
|
||||
sLen: C.CK_ULONG(saltLength),
|
||||
}
|
||||
return C.GoBytes(unsafe.Pointer(&p), C.int(unsafe.Sizeof(p)))
|
||||
}
|
||||
|
||||
// OAEPParams can be passed to NewMechanism to implement CKM_RSA_PKCS_OAEP.
|
||||
type OAEPParams struct {
|
||||
HashAlg uint
|
||||
MGF uint
|
||||
SourceType uint
|
||||
SourceData []byte
|
||||
}
|
||||
|
||||
// NewOAEPParams creates a CK_RSA_PKCS_OAEP_PARAMS structure suitable for use with the CKM_RSA_PKCS_OAEP mechanism.
|
||||
func NewOAEPParams(hashAlg, mgf, sourceType uint, sourceData []byte) *OAEPParams {
|
||||
return &OAEPParams{
|
||||
HashAlg: hashAlg,
|
||||
MGF: mgf,
|
||||
SourceType: sourceType,
|
||||
SourceData: sourceData,
|
||||
}
|
||||
}
|
||||
|
||||
func cOAEPParams(p *OAEPParams, arena arena) ([]byte, arena) {
|
||||
params := C.CK_RSA_PKCS_OAEP_PARAMS{
|
||||
hashAlg: C.CK_MECHANISM_TYPE(p.HashAlg),
|
||||
mgf: C.CK_RSA_PKCS_MGF_TYPE(p.MGF),
|
||||
source: C.CK_RSA_PKCS_OAEP_SOURCE_TYPE(p.SourceType),
|
||||
}
|
||||
if len(p.SourceData) != 0 {
|
||||
buf, len := arena.Allocate(p.SourceData)
|
||||
// field is unaligned on windows so this has to call into C
|
||||
C.putOAEPParams(¶ms, buf, len)
|
||||
}
|
||||
return C.GoBytes(unsafe.Pointer(¶ms), C.int(unsafe.Sizeof(params))), arena
|
||||
}
|
||||
|
||||
// ECDH1DeriveParams can be passed to NewMechanism to implement CK_ECDH1_DERIVE_PARAMS.
|
||||
type ECDH1DeriveParams struct {
|
||||
KDF uint
|
||||
SharedData []byte
|
||||
PublicKeyData []byte
|
||||
}
|
||||
|
||||
// NewECDH1DeriveParams creates a CK_ECDH1_DERIVE_PARAMS structure suitable for use with the CKM_ECDH1_DERIVE mechanism.
|
||||
func NewECDH1DeriveParams(kdf uint, sharedData []byte, publicKeyData []byte) *ECDH1DeriveParams {
|
||||
return &ECDH1DeriveParams{
|
||||
KDF: kdf,
|
||||
SharedData: sharedData,
|
||||
PublicKeyData: publicKeyData,
|
||||
}
|
||||
}
|
||||
|
||||
func cECDH1DeriveParams(p *ECDH1DeriveParams, arena arena) ([]byte, arena) {
|
||||
params := C.CK_ECDH1_DERIVE_PARAMS{
|
||||
kdf: C.CK_EC_KDF_TYPE(p.KDF),
|
||||
}
|
||||
|
||||
// SharedData MUST be null if key derivation function (KDF) is CKD_NULL
|
||||
if len(p.SharedData) != 0 {
|
||||
sharedData, sharedDataLen := arena.Allocate(p.SharedData)
|
||||
C.putECDH1SharedParams(¶ms, sharedData, sharedDataLen)
|
||||
}
|
||||
|
||||
publicKeyData, publicKeyDataLen := arena.Allocate(p.PublicKeyData)
|
||||
C.putECDH1PublicParams(¶ms, publicKeyData, publicKeyDataLen)
|
||||
|
||||
return C.GoBytes(unsafe.Pointer(¶ms), C.int(unsafe.Sizeof(params))), arena
|
||||
}
|
||||
1609
vendor/github.com/miekg/pkcs11/pkcs11.go
generated
vendored
1609
vendor/github.com/miekg/pkcs11/pkcs11.go
generated
vendored
File diff suppressed because it is too large
Load Diff
265
vendor/github.com/miekg/pkcs11/pkcs11.h
generated
vendored
265
vendor/github.com/miekg/pkcs11/pkcs11.h
generated
vendored
@ -1,265 +0,0 @@
|
||||
/* Copyright (c) OASIS Open 2016. All Rights Reserved./
|
||||
* /Distributed under the terms of the OASIS IPR Policy,
|
||||
* [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
|
||||
* IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
|
||||
* PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
|
||||
*/
|
||||
|
||||
/* Latest version of the specification:
|
||||
* http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
|
||||
*/
|
||||
|
||||
#ifndef _PKCS11_H_
|
||||
#define _PKCS11_H_ 1
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/* Before including this file (pkcs11.h) (or pkcs11t.h by
|
||||
* itself), 5 platform-specific macros must be defined. These
|
||||
* macros are described below, and typical definitions for them
|
||||
* are also given. Be advised that these definitions can depend
|
||||
* on both the platform and the compiler used (and possibly also
|
||||
* on whether a Cryptoki library is linked statically or
|
||||
* dynamically).
|
||||
*
|
||||
* In addition to defining these 5 macros, the packing convention
|
||||
* for Cryptoki structures should be set. The Cryptoki
|
||||
* convention on packing is that structures should be 1-byte
|
||||
* aligned.
|
||||
*
|
||||
* If you're using Microsoft Developer Studio 5.0 to produce
|
||||
* Win32 stuff, this might be done by using the following
|
||||
* preprocessor directive before including pkcs11.h or pkcs11t.h:
|
||||
*
|
||||
* #pragma pack(push, cryptoki, 1)
|
||||
*
|
||||
* and using the following preprocessor directive after including
|
||||
* pkcs11.h or pkcs11t.h:
|
||||
*
|
||||
* #pragma pack(pop, cryptoki)
|
||||
*
|
||||
* If you're using an earlier version of Microsoft Developer
|
||||
* Studio to produce Win16 stuff, this might be done by using
|
||||
* the following preprocessor directive before including
|
||||
* pkcs11.h or pkcs11t.h:
|
||||
*
|
||||
* #pragma pack(1)
|
||||
*
|
||||
* In a UNIX environment, you're on your own for this. You might
|
||||
* not need to do (or be able to do!) anything.
|
||||
*
|
||||
*
|
||||
* Now for the macros:
|
||||
*
|
||||
*
|
||||
* 1. CK_PTR: The indirection string for making a pointer to an
|
||||
* object. It can be used like this:
|
||||
*
|
||||
* typedef CK_BYTE CK_PTR CK_BYTE_PTR;
|
||||
*
|
||||
* If you're using Microsoft Developer Studio 5.0 to produce
|
||||
* Win32 stuff, it might be defined by:
|
||||
*
|
||||
* #define CK_PTR *
|
||||
*
|
||||
* If you're using an earlier version of Microsoft Developer
|
||||
* Studio to produce Win16 stuff, it might be defined by:
|
||||
*
|
||||
* #define CK_PTR far *
|
||||
*
|
||||
* In a typical UNIX environment, it might be defined by:
|
||||
*
|
||||
* #define CK_PTR *
|
||||
*
|
||||
*
|
||||
* 2. CK_DECLARE_FUNCTION(returnType, name): A macro which makes
|
||||
* an importable Cryptoki library function declaration out of a
|
||||
* return type and a function name. It should be used in the
|
||||
* following fashion:
|
||||
*
|
||||
* extern CK_DECLARE_FUNCTION(CK_RV, C_Initialize)(
|
||||
* CK_VOID_PTR pReserved
|
||||
* );
|
||||
*
|
||||
* If you're using Microsoft Developer Studio 5.0 to declare a
|
||||
* function in a Win32 Cryptoki .dll, it might be defined by:
|
||||
*
|
||||
* #define CK_DECLARE_FUNCTION(returnType, name) \
|
||||
* returnType __declspec(dllimport) name
|
||||
*
|
||||
* If you're using an earlier version of Microsoft Developer
|
||||
* Studio to declare a function in a Win16 Cryptoki .dll, it
|
||||
* might be defined by:
|
||||
*
|
||||
* #define CK_DECLARE_FUNCTION(returnType, name) \
|
||||
* returnType __export _far _pascal name
|
||||
*
|
||||
* In a UNIX environment, it might be defined by:
|
||||
*
|
||||
* #define CK_DECLARE_FUNCTION(returnType, name) \
|
||||
* returnType name
|
||||
*
|
||||
*
|
||||
* 3. CK_DECLARE_FUNCTION_POINTER(returnType, name): A macro
|
||||
* which makes a Cryptoki API function pointer declaration or
|
||||
* function pointer type declaration out of a return type and a
|
||||
* function name. It should be used in the following fashion:
|
||||
*
|
||||
* // Define funcPtr to be a pointer to a Cryptoki API function
|
||||
* // taking arguments args and returning CK_RV.
|
||||
* CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtr)(args);
|
||||
*
|
||||
* or
|
||||
*
|
||||
* // Define funcPtrType to be the type of a pointer to a
|
||||
* // Cryptoki API function taking arguments args and returning
|
||||
* // CK_RV, and then define funcPtr to be a variable of type
|
||||
* // funcPtrType.
|
||||
* typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtrType)(args);
|
||||
* funcPtrType funcPtr;
|
||||
*
|
||||
* If you're using Microsoft Developer Studio 5.0 to access
|
||||
* functions in a Win32 Cryptoki .dll, in might be defined by:
|
||||
*
|
||||
* #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
|
||||
* returnType __declspec(dllimport) (* name)
|
||||
*
|
||||
* If you're using an earlier version of Microsoft Developer
|
||||
* Studio to access functions in a Win16 Cryptoki .dll, it might
|
||||
* be defined by:
|
||||
*
|
||||
* #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
|
||||
* returnType __export _far _pascal (* name)
|
||||
*
|
||||
* In a UNIX environment, it might be defined by:
|
||||
*
|
||||
* #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
|
||||
* returnType (* name)
|
||||
*
|
||||
*
|
||||
* 4. CK_CALLBACK_FUNCTION(returnType, name): A macro which makes
|
||||
* a function pointer type for an application callback out of
|
||||
* a return type for the callback and a name for the callback.
|
||||
* It should be used in the following fashion:
|
||||
*
|
||||
* CK_CALLBACK_FUNCTION(CK_RV, myCallback)(args);
|
||||
*
|
||||
* to declare a function pointer, myCallback, to a callback
|
||||
* which takes arguments args and returns a CK_RV. It can also
|
||||
* be used like this:
|
||||
*
|
||||
* typedef CK_CALLBACK_FUNCTION(CK_RV, myCallbackType)(args);
|
||||
* myCallbackType myCallback;
|
||||
*
|
||||
* If you're using Microsoft Developer Studio 5.0 to do Win32
|
||||
* Cryptoki development, it might be defined by:
|
||||
*
|
||||
* #define CK_CALLBACK_FUNCTION(returnType, name) \
|
||||
* returnType (* name)
|
||||
*
|
||||
* If you're using an earlier version of Microsoft Developer
|
||||
* Studio to do Win16 development, it might be defined by:
|
||||
*
|
||||
* #define CK_CALLBACK_FUNCTION(returnType, name) \
|
||||
* returnType _far _pascal (* name)
|
||||
*
|
||||
* In a UNIX environment, it might be defined by:
|
||||
*
|
||||
* #define CK_CALLBACK_FUNCTION(returnType, name) \
|
||||
* returnType (* name)
|
||||
*
|
||||
*
|
||||
* 5. NULL_PTR: This macro is the value of a NULL pointer.
|
||||
*
|
||||
* In any ANSI/ISO C environment (and in many others as well),
|
||||
* this should best be defined by
|
||||
*
|
||||
* #ifndef NULL_PTR
|
||||
* #define NULL_PTR 0
|
||||
* #endif
|
||||
*/
|
||||
|
||||
|
||||
/* All the various Cryptoki types and #define'd values are in the
|
||||
* file pkcs11t.h.
|
||||
*/
|
||||
#include "pkcs11t.h"
|
||||
|
||||
#define __PASTE(x,y) x##y
|
||||
|
||||
|
||||
/* ==============================================================
|
||||
* Define the "extern" form of all the entry points.
|
||||
* ==============================================================
|
||||
*/
|
||||
|
||||
#define CK_NEED_ARG_LIST 1
|
||||
#define CK_PKCS11_FUNCTION_INFO(name) \
|
||||
extern CK_DECLARE_FUNCTION(CK_RV, name)
|
||||
|
||||
/* pkcs11f.h has all the information about the Cryptoki
|
||||
* function prototypes.
|
||||
*/
|
||||
#include "pkcs11f.h"
|
||||
|
||||
#undef CK_NEED_ARG_LIST
|
||||
#undef CK_PKCS11_FUNCTION_INFO
|
||||
|
||||
|
||||
/* ==============================================================
|
||||
* Define the typedef form of all the entry points. That is, for
|
||||
* each Cryptoki function C_XXX, define a type CK_C_XXX which is
|
||||
* a pointer to that kind of function.
|
||||
* ==============================================================
|
||||
*/
|
||||
|
||||
#define CK_NEED_ARG_LIST 1
|
||||
#define CK_PKCS11_FUNCTION_INFO(name) \
|
||||
typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, __PASTE(CK_,name))
|
||||
|
||||
/* pkcs11f.h has all the information about the Cryptoki
|
||||
* function prototypes.
|
||||
*/
|
||||
#include "pkcs11f.h"
|
||||
|
||||
#undef CK_NEED_ARG_LIST
|
||||
#undef CK_PKCS11_FUNCTION_INFO
|
||||
|
||||
|
||||
/* ==============================================================
|
||||
* Define structed vector of entry points. A CK_FUNCTION_LIST
|
||||
* contains a CK_VERSION indicating a library's Cryptoki version
|
||||
* and then a whole slew of function pointers to the routines in
|
||||
* the library. This type was declared, but not defined, in
|
||||
* pkcs11t.h.
|
||||
* ==============================================================
|
||||
*/
|
||||
|
||||
#define CK_PKCS11_FUNCTION_INFO(name) \
|
||||
__PASTE(CK_,name) name;
|
||||
|
||||
struct CK_FUNCTION_LIST {
|
||||
|
||||
CK_VERSION version; /* Cryptoki version */
|
||||
|
||||
/* Pile all the function pointers into the CK_FUNCTION_LIST. */
|
||||
/* pkcs11f.h has all the information about the Cryptoki
|
||||
* function prototypes.
|
||||
*/
|
||||
#include "pkcs11f.h"
|
||||
|
||||
};
|
||||
|
||||
#undef CK_PKCS11_FUNCTION_INFO
|
||||
|
||||
|
||||
#undef __PASTE
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif /* _PKCS11_H_ */
|
||||
|
||||
939
vendor/github.com/miekg/pkcs11/pkcs11f.h
generated
vendored
939
vendor/github.com/miekg/pkcs11/pkcs11f.h
generated
vendored
@ -1,939 +0,0 @@
|
||||
/* Copyright (c) OASIS Open 2016. All Rights Reserved./
|
||||
* /Distributed under the terms of the OASIS IPR Policy,
|
||||
* [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
|
||||
* IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
|
||||
* PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
|
||||
*/
|
||||
|
||||
/* Latest version of the specification:
|
||||
* http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
|
||||
*/
|
||||
|
||||
/* This header file contains pretty much everything about all the
|
||||
* Cryptoki function prototypes. Because this information is
|
||||
* used for more than just declaring function prototypes, the
|
||||
* order of the functions appearing herein is important, and
|
||||
* should not be altered.
|
||||
*/
|
||||
|
||||
/* General-purpose */
|
||||
|
||||
/* C_Initialize initializes the Cryptoki library. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_Initialize)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_VOID_PTR pInitArgs /* if this is not NULL_PTR, it gets
|
||||
* cast to CK_C_INITIALIZE_ARGS_PTR
|
||||
* and dereferenced
|
||||
*/
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_Finalize indicates that an application is done with the
|
||||
* Cryptoki library.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_Finalize)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_VOID_PTR pReserved /* reserved. Should be NULL_PTR */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_GetInfo returns general information about Cryptoki. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_GetInfo)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_INFO_PTR pInfo /* location that receives information */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_GetFunctionList returns the function list. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_GetFunctionList)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_FUNCTION_LIST_PTR_PTR ppFunctionList /* receives pointer to
|
||||
* function list
|
||||
*/
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/* Slot and token management */
|
||||
|
||||
/* C_GetSlotList obtains a list of slots in the system. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_GetSlotList)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_BBOOL tokenPresent, /* only slots with tokens */
|
||||
CK_SLOT_ID_PTR pSlotList, /* receives array of slot IDs */
|
||||
CK_ULONG_PTR pulCount /* receives number of slots */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_GetSlotInfo obtains information about a particular slot in
|
||||
* the system.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_GetSlotInfo)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SLOT_ID slotID, /* the ID of the slot */
|
||||
CK_SLOT_INFO_PTR pInfo /* receives the slot information */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_GetTokenInfo obtains information about a particular token
|
||||
* in the system.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_GetTokenInfo)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SLOT_ID slotID, /* ID of the token's slot */
|
||||
CK_TOKEN_INFO_PTR pInfo /* receives the token information */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_GetMechanismList obtains a list of mechanism types
|
||||
* supported by a token.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_GetMechanismList)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SLOT_ID slotID, /* ID of token's slot */
|
||||
CK_MECHANISM_TYPE_PTR pMechanismList, /* gets mech. array */
|
||||
CK_ULONG_PTR pulCount /* gets # of mechs. */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_GetMechanismInfo obtains information about a particular
|
||||
* mechanism possibly supported by a token.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_GetMechanismInfo)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SLOT_ID slotID, /* ID of the token's slot */
|
||||
CK_MECHANISM_TYPE type, /* type of mechanism */
|
||||
CK_MECHANISM_INFO_PTR pInfo /* receives mechanism info */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_InitToken initializes a token. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_InitToken)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SLOT_ID slotID, /* ID of the token's slot */
|
||||
CK_UTF8CHAR_PTR pPin, /* the SO's initial PIN */
|
||||
CK_ULONG ulPinLen, /* length in bytes of the PIN */
|
||||
CK_UTF8CHAR_PTR pLabel /* 32-byte token label (blank padded) */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_InitPIN initializes the normal user's PIN. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_InitPIN)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_UTF8CHAR_PTR pPin, /* the normal user's PIN */
|
||||
CK_ULONG ulPinLen /* length in bytes of the PIN */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_SetPIN modifies the PIN of the user who is logged in. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_SetPIN)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_UTF8CHAR_PTR pOldPin, /* the old PIN */
|
||||
CK_ULONG ulOldLen, /* length of the old PIN */
|
||||
CK_UTF8CHAR_PTR pNewPin, /* the new PIN */
|
||||
CK_ULONG ulNewLen /* length of the new PIN */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/* Session management */
|
||||
|
||||
/* C_OpenSession opens a session between an application and a
|
||||
* token.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_OpenSession)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SLOT_ID slotID, /* the slot's ID */
|
||||
CK_FLAGS flags, /* from CK_SESSION_INFO */
|
||||
CK_VOID_PTR pApplication, /* passed to callback */
|
||||
CK_NOTIFY Notify, /* callback function */
|
||||
CK_SESSION_HANDLE_PTR phSession /* gets session handle */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_CloseSession closes a session between an application and a
|
||||
* token.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_CloseSession)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession /* the session's handle */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_CloseAllSessions closes all sessions with a token. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_CloseAllSessions)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SLOT_ID slotID /* the token's slot */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_GetSessionInfo obtains information about the session. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_GetSessionInfo)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_SESSION_INFO_PTR pInfo /* receives session info */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_GetOperationState obtains the state of the cryptographic operation
|
||||
* in a session.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_GetOperationState)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_BYTE_PTR pOperationState, /* gets state */
|
||||
CK_ULONG_PTR pulOperationStateLen /* gets state length */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_SetOperationState restores the state of the cryptographic
|
||||
* operation in a session.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_SetOperationState)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_BYTE_PTR pOperationState, /* holds state */
|
||||
CK_ULONG ulOperationStateLen, /* holds state length */
|
||||
CK_OBJECT_HANDLE hEncryptionKey, /* en/decryption key */
|
||||
CK_OBJECT_HANDLE hAuthenticationKey /* sign/verify key */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_Login logs a user into a token. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_Login)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_USER_TYPE userType, /* the user type */
|
||||
CK_UTF8CHAR_PTR pPin, /* the user's PIN */
|
||||
CK_ULONG ulPinLen /* the length of the PIN */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_Logout logs a user out from a token. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_Logout)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession /* the session's handle */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/* Object management */
|
||||
|
||||
/* C_CreateObject creates a new object. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_CreateObject)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_ATTRIBUTE_PTR pTemplate, /* the object's template */
|
||||
CK_ULONG ulCount, /* attributes in template */
|
||||
CK_OBJECT_HANDLE_PTR phObject /* gets new object's handle. */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_CopyObject copies an object, creating a new object for the
|
||||
* copy.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_CopyObject)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_OBJECT_HANDLE hObject, /* the object's handle */
|
||||
CK_ATTRIBUTE_PTR pTemplate, /* template for new object */
|
||||
CK_ULONG ulCount, /* attributes in template */
|
||||
CK_OBJECT_HANDLE_PTR phNewObject /* receives handle of copy */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_DestroyObject destroys an object. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_DestroyObject)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_OBJECT_HANDLE hObject /* the object's handle */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_GetObjectSize gets the size of an object in bytes. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_GetObjectSize)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_OBJECT_HANDLE hObject, /* the object's handle */
|
||||
CK_ULONG_PTR pulSize /* receives size of object */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_GetAttributeValue obtains the value of one or more object
|
||||
* attributes.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_GetAttributeValue)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_OBJECT_HANDLE hObject, /* the object's handle */
|
||||
CK_ATTRIBUTE_PTR pTemplate, /* specifies attrs; gets vals */
|
||||
CK_ULONG ulCount /* attributes in template */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_SetAttributeValue modifies the value of one or more object
|
||||
* attributes.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_SetAttributeValue)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_OBJECT_HANDLE hObject, /* the object's handle */
|
||||
CK_ATTRIBUTE_PTR pTemplate, /* specifies attrs and values */
|
||||
CK_ULONG ulCount /* attributes in template */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_FindObjectsInit initializes a search for token and session
|
||||
* objects that match a template.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_FindObjectsInit)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_ATTRIBUTE_PTR pTemplate, /* attribute values to match */
|
||||
CK_ULONG ulCount /* attrs in search template */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_FindObjects continues a search for token and session
|
||||
* objects that match a template, obtaining additional object
|
||||
* handles.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_FindObjects)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_OBJECT_HANDLE_PTR phObject, /* gets obj. handles */
|
||||
CK_ULONG ulMaxObjectCount, /* max handles to get */
|
||||
CK_ULONG_PTR pulObjectCount /* actual # returned */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_FindObjectsFinal finishes a search for token and session
|
||||
* objects.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_FindObjectsFinal)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession /* the session's handle */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/* Encryption and decryption */
|
||||
|
||||
/* C_EncryptInit initializes an encryption operation. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_EncryptInit)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_MECHANISM_PTR pMechanism, /* the encryption mechanism */
|
||||
CK_OBJECT_HANDLE hKey /* handle of encryption key */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_Encrypt encrypts single-part data. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_Encrypt)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_BYTE_PTR pData, /* the plaintext data */
|
||||
CK_ULONG ulDataLen, /* bytes of plaintext */
|
||||
CK_BYTE_PTR pEncryptedData, /* gets ciphertext */
|
||||
CK_ULONG_PTR pulEncryptedDataLen /* gets c-text size */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_EncryptUpdate continues a multiple-part encryption
|
||||
* operation.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_EncryptUpdate)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_BYTE_PTR pPart, /* the plaintext data */
|
||||
CK_ULONG ulPartLen, /* plaintext data len */
|
||||
CK_BYTE_PTR pEncryptedPart, /* gets ciphertext */
|
||||
CK_ULONG_PTR pulEncryptedPartLen /* gets c-text size */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_EncryptFinal finishes a multiple-part encryption
|
||||
* operation.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_EncryptFinal)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session handle */
|
||||
CK_BYTE_PTR pLastEncryptedPart, /* last c-text */
|
||||
CK_ULONG_PTR pulLastEncryptedPartLen /* gets last size */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_DecryptInit initializes a decryption operation. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_DecryptInit)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_MECHANISM_PTR pMechanism, /* the decryption mechanism */
|
||||
CK_OBJECT_HANDLE hKey /* handle of decryption key */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_Decrypt decrypts encrypted data in a single part. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_Decrypt)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_BYTE_PTR pEncryptedData, /* ciphertext */
|
||||
CK_ULONG ulEncryptedDataLen, /* ciphertext length */
|
||||
CK_BYTE_PTR pData, /* gets plaintext */
|
||||
CK_ULONG_PTR pulDataLen /* gets p-text size */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_DecryptUpdate continues a multiple-part decryption
|
||||
* operation.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_DecryptUpdate)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_BYTE_PTR pEncryptedPart, /* encrypted data */
|
||||
CK_ULONG ulEncryptedPartLen, /* input length */
|
||||
CK_BYTE_PTR pPart, /* gets plaintext */
|
||||
CK_ULONG_PTR pulPartLen /* p-text size */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_DecryptFinal finishes a multiple-part decryption
|
||||
* operation.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_DecryptFinal)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pLastPart, /* gets plaintext */
|
||||
CK_ULONG_PTR pulLastPartLen /* p-text size */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/* Message digesting */
|
||||
|
||||
/* C_DigestInit initializes a message-digesting operation. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_DigestInit)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_MECHANISM_PTR pMechanism /* the digesting mechanism */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_Digest digests data in a single part. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_Digest)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pData, /* data to be digested */
|
||||
CK_ULONG ulDataLen, /* bytes of data to digest */
|
||||
CK_BYTE_PTR pDigest, /* gets the message digest */
|
||||
CK_ULONG_PTR pulDigestLen /* gets digest length */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_DigestUpdate continues a multiple-part message-digesting
|
||||
* operation.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_DigestUpdate)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pPart, /* data to be digested */
|
||||
CK_ULONG ulPartLen /* bytes of data to be digested */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_DigestKey continues a multi-part message-digesting
|
||||
* operation, by digesting the value of a secret key as part of
|
||||
* the data already digested.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_DigestKey)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_OBJECT_HANDLE hKey /* secret key to digest */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_DigestFinal finishes a multiple-part message-digesting
|
||||
* operation.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_DigestFinal)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pDigest, /* gets the message digest */
|
||||
CK_ULONG_PTR pulDigestLen /* gets byte count of digest */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/* Signing and MACing */
|
||||
|
||||
/* C_SignInit initializes a signature (private key encryption)
|
||||
* operation, where the signature is (will be) an appendix to
|
||||
* the data, and plaintext cannot be recovered from the
|
||||
* signature.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_SignInit)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_MECHANISM_PTR pMechanism, /* the signature mechanism */
|
||||
CK_OBJECT_HANDLE hKey /* handle of signature key */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_Sign signs (encrypts with private key) data in a single
|
||||
* part, where the signature is (will be) an appendix to the
|
||||
* data, and plaintext cannot be recovered from the signature.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_Sign)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pData, /* the data to sign */
|
||||
CK_ULONG ulDataLen, /* count of bytes to sign */
|
||||
CK_BYTE_PTR pSignature, /* gets the signature */
|
||||
CK_ULONG_PTR pulSignatureLen /* gets signature length */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_SignUpdate continues a multiple-part signature operation,
|
||||
* where the signature is (will be) an appendix to the data,
|
||||
* and plaintext cannot be recovered from the signature.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_SignUpdate)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pPart, /* the data to sign */
|
||||
CK_ULONG ulPartLen /* count of bytes to sign */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_SignFinal finishes a multiple-part signature operation,
|
||||
* returning the signature.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_SignFinal)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pSignature, /* gets the signature */
|
||||
CK_ULONG_PTR pulSignatureLen /* gets signature length */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_SignRecoverInit initializes a signature operation, where
|
||||
* the data can be recovered from the signature.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_SignRecoverInit)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_MECHANISM_PTR pMechanism, /* the signature mechanism */
|
||||
CK_OBJECT_HANDLE hKey /* handle of the signature key */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_SignRecover signs data in a single operation, where the
|
||||
* data can be recovered from the signature.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_SignRecover)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pData, /* the data to sign */
|
||||
CK_ULONG ulDataLen, /* count of bytes to sign */
|
||||
CK_BYTE_PTR pSignature, /* gets the signature */
|
||||
CK_ULONG_PTR pulSignatureLen /* gets signature length */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/* Verifying signatures and MACs */
|
||||
|
||||
/* C_VerifyInit initializes a verification operation, where the
|
||||
* signature is an appendix to the data, and plaintext cannot
|
||||
* cannot be recovered from the signature (e.g. DSA).
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_VerifyInit)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_MECHANISM_PTR pMechanism, /* the verification mechanism */
|
||||
CK_OBJECT_HANDLE hKey /* verification key */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_Verify verifies a signature in a single-part operation,
|
||||
* where the signature is an appendix to the data, and plaintext
|
||||
* cannot be recovered from the signature.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_Verify)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pData, /* signed data */
|
||||
CK_ULONG ulDataLen, /* length of signed data */
|
||||
CK_BYTE_PTR pSignature, /* signature */
|
||||
CK_ULONG ulSignatureLen /* signature length*/
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_VerifyUpdate continues a multiple-part verification
|
||||
* operation, where the signature is an appendix to the data,
|
||||
* and plaintext cannot be recovered from the signature.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_VerifyUpdate)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pPart, /* signed data */
|
||||
CK_ULONG ulPartLen /* length of signed data */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_VerifyFinal finishes a multiple-part verification
|
||||
* operation, checking the signature.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_VerifyFinal)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pSignature, /* signature to verify */
|
||||
CK_ULONG ulSignatureLen /* signature length */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_VerifyRecoverInit initializes a signature verification
|
||||
* operation, where the data is recovered from the signature.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_VerifyRecoverInit)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_MECHANISM_PTR pMechanism, /* the verification mechanism */
|
||||
CK_OBJECT_HANDLE hKey /* verification key */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_VerifyRecover verifies a signature in a single-part
|
||||
* operation, where the data is recovered from the signature.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_VerifyRecover)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pSignature, /* signature to verify */
|
||||
CK_ULONG ulSignatureLen, /* signature length */
|
||||
CK_BYTE_PTR pData, /* gets signed data */
|
||||
CK_ULONG_PTR pulDataLen /* gets signed data len */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/* Dual-function cryptographic operations */
|
||||
|
||||
/* C_DigestEncryptUpdate continues a multiple-part digesting
|
||||
* and encryption operation.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_DigestEncryptUpdate)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_BYTE_PTR pPart, /* the plaintext data */
|
||||
CK_ULONG ulPartLen, /* plaintext length */
|
||||
CK_BYTE_PTR pEncryptedPart, /* gets ciphertext */
|
||||
CK_ULONG_PTR pulEncryptedPartLen /* gets c-text length */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_DecryptDigestUpdate continues a multiple-part decryption and
|
||||
* digesting operation.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_DecryptDigestUpdate)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_BYTE_PTR pEncryptedPart, /* ciphertext */
|
||||
CK_ULONG ulEncryptedPartLen, /* ciphertext length */
|
||||
CK_BYTE_PTR pPart, /* gets plaintext */
|
||||
CK_ULONG_PTR pulPartLen /* gets plaintext len */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_SignEncryptUpdate continues a multiple-part signing and
|
||||
* encryption operation.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_SignEncryptUpdate)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_BYTE_PTR pPart, /* the plaintext data */
|
||||
CK_ULONG ulPartLen, /* plaintext length */
|
||||
CK_BYTE_PTR pEncryptedPart, /* gets ciphertext */
|
||||
CK_ULONG_PTR pulEncryptedPartLen /* gets c-text length */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_DecryptVerifyUpdate continues a multiple-part decryption and
|
||||
* verify operation.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_DecryptVerifyUpdate)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_BYTE_PTR pEncryptedPart, /* ciphertext */
|
||||
CK_ULONG ulEncryptedPartLen, /* ciphertext length */
|
||||
CK_BYTE_PTR pPart, /* gets plaintext */
|
||||
CK_ULONG_PTR pulPartLen /* gets p-text length */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/* Key management */
|
||||
|
||||
/* C_GenerateKey generates a secret key, creating a new key
|
||||
* object.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_GenerateKey)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_MECHANISM_PTR pMechanism, /* key generation mech. */
|
||||
CK_ATTRIBUTE_PTR pTemplate, /* template for new key */
|
||||
CK_ULONG ulCount, /* # of attrs in template */
|
||||
CK_OBJECT_HANDLE_PTR phKey /* gets handle of new key */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_GenerateKeyPair generates a public-key/private-key pair,
|
||||
* creating new key objects.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_GenerateKeyPair)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session handle */
|
||||
CK_MECHANISM_PTR pMechanism, /* key-gen mech. */
|
||||
CK_ATTRIBUTE_PTR pPublicKeyTemplate, /* template for pub. key */
|
||||
CK_ULONG ulPublicKeyAttributeCount, /* # pub. attrs. */
|
||||
CK_ATTRIBUTE_PTR pPrivateKeyTemplate, /* template for priv. key */
|
||||
CK_ULONG ulPrivateKeyAttributeCount, /* # priv. attrs. */
|
||||
CK_OBJECT_HANDLE_PTR phPublicKey, /* gets pub. key handle */
|
||||
CK_OBJECT_HANDLE_PTR phPrivateKey /* gets priv. key handle */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_WrapKey wraps (i.e., encrypts) a key. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_WrapKey)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_MECHANISM_PTR pMechanism, /* the wrapping mechanism */
|
||||
CK_OBJECT_HANDLE hWrappingKey, /* wrapping key */
|
||||
CK_OBJECT_HANDLE hKey, /* key to be wrapped */
|
||||
CK_BYTE_PTR pWrappedKey, /* gets wrapped key */
|
||||
CK_ULONG_PTR pulWrappedKeyLen /* gets wrapped key size */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_UnwrapKey unwraps (decrypts) a wrapped key, creating a new
|
||||
* key object.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_UnwrapKey)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_MECHANISM_PTR pMechanism, /* unwrapping mech. */
|
||||
CK_OBJECT_HANDLE hUnwrappingKey, /* unwrapping key */
|
||||
CK_BYTE_PTR pWrappedKey, /* the wrapped key */
|
||||
CK_ULONG ulWrappedKeyLen, /* wrapped key len */
|
||||
CK_ATTRIBUTE_PTR pTemplate, /* new key template */
|
||||
CK_ULONG ulAttributeCount, /* template length */
|
||||
CK_OBJECT_HANDLE_PTR phKey /* gets new handle */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_DeriveKey derives a key from a base key, creating a new key
|
||||
* object.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_DeriveKey)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* session's handle */
|
||||
CK_MECHANISM_PTR pMechanism, /* key deriv. mech. */
|
||||
CK_OBJECT_HANDLE hBaseKey, /* base key */
|
||||
CK_ATTRIBUTE_PTR pTemplate, /* new key template */
|
||||
CK_ULONG ulAttributeCount, /* template length */
|
||||
CK_OBJECT_HANDLE_PTR phKey /* gets new handle */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/* Random number generation */
|
||||
|
||||
/* C_SeedRandom mixes additional seed material into the token's
|
||||
* random number generator.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_SeedRandom)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR pSeed, /* the seed material */
|
||||
CK_ULONG ulSeedLen /* length of seed material */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_GenerateRandom generates random data. */
|
||||
CK_PKCS11_FUNCTION_INFO(C_GenerateRandom)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession, /* the session's handle */
|
||||
CK_BYTE_PTR RandomData, /* receives the random data */
|
||||
CK_ULONG ulRandomLen /* # of bytes to generate */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
/* Parallel function management */
|
||||
|
||||
/* C_GetFunctionStatus is a legacy function; it obtains an
|
||||
* updated status of a function running in parallel with an
|
||||
* application.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_GetFunctionStatus)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession /* the session's handle */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_CancelFunction is a legacy function; it cancels a function
|
||||
* running in parallel.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_CancelFunction)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_SESSION_HANDLE hSession /* the session's handle */
|
||||
);
|
||||
#endif
|
||||
|
||||
|
||||
/* C_WaitForSlotEvent waits for a slot event (token insertion,
|
||||
* removal, etc.) to occur.
|
||||
*/
|
||||
CK_PKCS11_FUNCTION_INFO(C_WaitForSlotEvent)
|
||||
#ifdef CK_NEED_ARG_LIST
|
||||
(
|
||||
CK_FLAGS flags, /* blocking/nonblocking flag */
|
||||
CK_SLOT_ID_PTR pSlot, /* location that receives the slot ID */
|
||||
CK_VOID_PTR pRserved /* reserved. Should be NULL_PTR */
|
||||
);
|
||||
#endif
|
||||
|
||||
33
vendor/github.com/miekg/pkcs11/pkcs11go.h
generated
vendored
33
vendor/github.com/miekg/pkcs11/pkcs11go.h
generated
vendored
@ -1,33 +0,0 @@
|
||||
//
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
//
|
||||
|
||||
#define CK_PTR *
|
||||
#ifndef NULL_PTR
|
||||
#define NULL_PTR 0
|
||||
#endif
|
||||
#define CK_DEFINE_FUNCTION(returnType, name) returnType name
|
||||
#define CK_DECLARE_FUNCTION(returnType, name) returnType name
|
||||
#define CK_DECLARE_FUNCTION_POINTER(returnType, name) returnType (* name)
|
||||
#define CK_CALLBACK_FUNCTION(returnType, name) returnType (* name)
|
||||
|
||||
#include <unistd.h>
|
||||
#ifdef PACKED_STRUCTURES
|
||||
# pragma pack(push, 1)
|
||||
# include "pkcs11.h"
|
||||
# pragma pack(pop)
|
||||
#else
|
||||
# include "pkcs11.h"
|
||||
#endif
|
||||
|
||||
// Copy of CK_INFO but with default alignment (not packed). Go hides unaligned
|
||||
// struct fields so copying to an aligned struct is necessary to read CK_INFO
|
||||
// from Go on Windows where packing is required.
|
||||
typedef struct ckInfo {
|
||||
CK_VERSION cryptokiVersion;
|
||||
CK_UTF8CHAR manufacturerID[32];
|
||||
CK_FLAGS flags;
|
||||
CK_UTF8CHAR libraryDescription[32];
|
||||
CK_VERSION libraryVersion;
|
||||
} ckInfo, *ckInfoPtr;
|
||||
2047
vendor/github.com/miekg/pkcs11/pkcs11t.h
generated
vendored
2047
vendor/github.com/miekg/pkcs11/pkcs11t.h
generated
vendored
File diff suppressed because it is too large
Load Diff
18
vendor/github.com/miekg/pkcs11/release.go
generated
vendored
18
vendor/github.com/miekg/pkcs11/release.go
generated
vendored
@ -1,18 +0,0 @@
|
||||
//go:build release
|
||||
// +build release
|
||||
|
||||
package pkcs11
|
||||
|
||||
import "fmt"
|
||||
|
||||
// Release is current version of the pkcs11 library.
|
||||
var Release = R{1, 1, 1}
|
||||
|
||||
// R holds the version of this library.
|
||||
type R struct {
|
||||
Major, Minor, Patch int
|
||||
}
|
||||
|
||||
func (r R) String() string {
|
||||
return fmt.Sprintf("%d.%d.%d", r.Major, r.Minor, r.Patch)
|
||||
}
|
||||
1
vendor/github.com/miekg/pkcs11/softhsm.conf
generated
vendored
1
vendor/github.com/miekg/pkcs11/softhsm.conf
generated
vendored
@ -1 +0,0 @@
|
||||
0:hsm.db
|
||||
4
vendor/github.com/miekg/pkcs11/softhsm2.conf
generated
vendored
4
vendor/github.com/miekg/pkcs11/softhsm2.conf
generated
vendored
@ -1,4 +0,0 @@
|
||||
log.level = INFO
|
||||
objectstore.backend = file
|
||||
directories.tokendir = test_data
|
||||
slots.removable = false
|
||||
315
vendor/github.com/miekg/pkcs11/types.go
generated
vendored
315
vendor/github.com/miekg/pkcs11/types.go
generated
vendored
@ -1,315 +0,0 @@
|
||||
// Copyright 2013 Miek Gieben. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package pkcs11
|
||||
|
||||
/*
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include "pkcs11go.h"
|
||||
|
||||
CK_ULONG Index(CK_ULONG_PTR array, CK_ULONG i)
|
||||
{
|
||||
return array[i];
|
||||
}
|
||||
|
||||
static inline void putAttributePval(CK_ATTRIBUTE_PTR a, CK_VOID_PTR pValue)
|
||||
{
|
||||
a->pValue = pValue;
|
||||
}
|
||||
|
||||
static inline void putMechanismParam(CK_MECHANISM_PTR m, CK_VOID_PTR pParameter)
|
||||
{
|
||||
m->pParameter = pParameter;
|
||||
}
|
||||
*/
|
||||
import "C"
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"time"
|
||||
"unsafe"
|
||||
)
|
||||
|
||||
type arena []unsafe.Pointer
|
||||
|
||||
func (a *arena) Allocate(obj []byte) (C.CK_VOID_PTR, C.CK_ULONG) {
|
||||
cobj := C.calloc(C.size_t(len(obj)), 1)
|
||||
*a = append(*a, cobj)
|
||||
C.memmove(cobj, unsafe.Pointer(&obj[0]), C.size_t(len(obj)))
|
||||
return C.CK_VOID_PTR(cobj), C.CK_ULONG(len(obj))
|
||||
}
|
||||
|
||||
func (a arena) Free() {
|
||||
for _, p := range a {
|
||||
C.free(p)
|
||||
}
|
||||
}
|
||||
|
||||
// toList converts from a C style array to a []uint.
|
||||
func toList(clist C.CK_ULONG_PTR, size C.CK_ULONG) []uint {
|
||||
l := make([]uint, int(size))
|
||||
for i := 0; i < len(l); i++ {
|
||||
l[i] = uint(C.Index(clist, C.CK_ULONG(i)))
|
||||
}
|
||||
defer C.free(unsafe.Pointer(clist))
|
||||
return l
|
||||
}
|
||||
|
||||
// cBBool converts a bool to a CK_BBOOL.
|
||||
func cBBool(x bool) C.CK_BBOOL {
|
||||
if x {
|
||||
return C.CK_BBOOL(C.CK_TRUE)
|
||||
}
|
||||
return C.CK_BBOOL(C.CK_FALSE)
|
||||
}
|
||||
|
||||
func uintToBytes(x uint64) []byte {
|
||||
ul := C.CK_ULONG(x)
|
||||
return C.GoBytes(unsafe.Pointer(&ul), C.int(unsafe.Sizeof(ul)))
|
||||
}
|
||||
|
||||
// Error represents an PKCS#11 error.
|
||||
type Error uint
|
||||
|
||||
func (e Error) Error() string {
|
||||
return fmt.Sprintf("pkcs11: 0x%X: %s", uint(e), strerror[uint(e)])
|
||||
}
|
||||
|
||||
func toError(e C.CK_RV) error {
|
||||
if e == C.CKR_OK {
|
||||
return nil
|
||||
}
|
||||
return Error(e)
|
||||
}
|
||||
|
||||
// SessionHandle is a Cryptoki-assigned value that identifies a session.
|
||||
type SessionHandle uint
|
||||
|
||||
// ObjectHandle is a token-specific identifier for an object.
|
||||
type ObjectHandle uint
|
||||
|
||||
// Version represents any version information from the library.
|
||||
type Version struct {
|
||||
Major byte
|
||||
Minor byte
|
||||
}
|
||||
|
||||
func toVersion(version C.CK_VERSION) Version {
|
||||
return Version{byte(version.major), byte(version.minor)}
|
||||
}
|
||||
|
||||
// SlotEvent holds the SlotID which for which an slot event (token insertion,
|
||||
// removal, etc.) occurred.
|
||||
type SlotEvent struct {
|
||||
SlotID uint
|
||||
}
|
||||
|
||||
// Info provides information about the library and hardware used.
|
||||
type Info struct {
|
||||
CryptokiVersion Version
|
||||
ManufacturerID string
|
||||
Flags uint
|
||||
LibraryDescription string
|
||||
LibraryVersion Version
|
||||
}
|
||||
|
||||
// SlotInfo provides information about a slot.
|
||||
type SlotInfo struct {
|
||||
SlotDescription string // 64 bytes.
|
||||
ManufacturerID string // 32 bytes.
|
||||
Flags uint
|
||||
HardwareVersion Version
|
||||
FirmwareVersion Version
|
||||
}
|
||||
|
||||
// TokenInfo provides information about a token.
|
||||
type TokenInfo struct {
|
||||
Label string
|
||||
ManufacturerID string
|
||||
Model string
|
||||
SerialNumber string
|
||||
Flags uint
|
||||
MaxSessionCount uint
|
||||
SessionCount uint
|
||||
MaxRwSessionCount uint
|
||||
RwSessionCount uint
|
||||
MaxPinLen uint
|
||||
MinPinLen uint
|
||||
TotalPublicMemory uint
|
||||
FreePublicMemory uint
|
||||
TotalPrivateMemory uint
|
||||
FreePrivateMemory uint
|
||||
HardwareVersion Version
|
||||
FirmwareVersion Version
|
||||
UTCTime string
|
||||
}
|
||||
|
||||
// SessionInfo provides information about a session.
|
||||
type SessionInfo struct {
|
||||
SlotID uint
|
||||
State uint
|
||||
Flags uint
|
||||
DeviceError uint
|
||||
}
|
||||
|
||||
// Attribute holds an attribute type/value combination.
|
||||
type Attribute struct {
|
||||
Type uint
|
||||
Value []byte
|
||||
}
|
||||
|
||||
// NewAttribute allocates a Attribute and returns a pointer to it.
|
||||
// Note that this is merely a convenience function, as values returned
|
||||
// from the HSM are not converted back to Go values, those are just raw
|
||||
// byte slices.
|
||||
func NewAttribute(typ uint, x interface{}) *Attribute {
|
||||
// This function nicely transforms *to* an attribute, but there is
|
||||
// no corresponding function that transform back *from* an attribute,
|
||||
// which in PKCS#11 is just an byte array.
|
||||
a := new(Attribute)
|
||||
a.Type = typ
|
||||
if x == nil {
|
||||
return a
|
||||
}
|
||||
switch v := x.(type) {
|
||||
case bool:
|
||||
if v {
|
||||
a.Value = []byte{1}
|
||||
} else {
|
||||
a.Value = []byte{0}
|
||||
}
|
||||
case int:
|
||||
a.Value = uintToBytes(uint64(v))
|
||||
case int16:
|
||||
a.Value = uintToBytes(uint64(v))
|
||||
case int32:
|
||||
a.Value = uintToBytes(uint64(v))
|
||||
case int64:
|
||||
a.Value = uintToBytes(uint64(v))
|
||||
case uint:
|
||||
a.Value = uintToBytes(uint64(v))
|
||||
case uint16:
|
||||
a.Value = uintToBytes(uint64(v))
|
||||
case uint32:
|
||||
a.Value = uintToBytes(uint64(v))
|
||||
case uint64:
|
||||
a.Value = uintToBytes(uint64(v))
|
||||
case string:
|
||||
a.Value = []byte(v)
|
||||
case []byte:
|
||||
a.Value = v
|
||||
case time.Time: // for CKA_DATE
|
||||
a.Value = cDate(v)
|
||||
default:
|
||||
panic("pkcs11: unhandled attribute type")
|
||||
}
|
||||
return a
|
||||
}
|
||||
|
||||
// cAttribute returns the start address and the length of an attribute list.
|
||||
func cAttributeList(a []*Attribute) (arena, C.CK_ATTRIBUTE_PTR, C.CK_ULONG) {
|
||||
var arena arena
|
||||
if len(a) == 0 {
|
||||
return nil, nil, 0
|
||||
}
|
||||
pa := make([]C.CK_ATTRIBUTE, len(a))
|
||||
for i, attr := range a {
|
||||
pa[i]._type = C.CK_ATTRIBUTE_TYPE(attr.Type)
|
||||
if len(attr.Value) != 0 {
|
||||
buf, len := arena.Allocate(attr.Value)
|
||||
// field is unaligned on windows so this has to call into C
|
||||
C.putAttributePval(&pa[i], buf)
|
||||
pa[i].ulValueLen = len
|
||||
}
|
||||
}
|
||||
return arena, &pa[0], C.CK_ULONG(len(a))
|
||||
}
|
||||
|
||||
func cDate(t time.Time) []byte {
|
||||
b := make([]byte, 8)
|
||||
year, month, day := t.Date()
|
||||
y := fmt.Sprintf("%4d", year)
|
||||
m := fmt.Sprintf("%02d", month)
|
||||
d1 := fmt.Sprintf("%02d", day)
|
||||
b[0], b[1], b[2], b[3] = y[0], y[1], y[2], y[3]
|
||||
b[4], b[5] = m[0], m[1]
|
||||
b[6], b[7] = d1[0], d1[1]
|
||||
return b
|
||||
}
|
||||
|
||||
// Mechanism holds an mechanism type/value combination.
|
||||
type Mechanism struct {
|
||||
Mechanism uint
|
||||
Parameter []byte
|
||||
generator interface{}
|
||||
}
|
||||
|
||||
// NewMechanism returns a pointer to an initialized Mechanism.
|
||||
func NewMechanism(mech uint, x interface{}) *Mechanism {
|
||||
m := new(Mechanism)
|
||||
m.Mechanism = mech
|
||||
if x == nil {
|
||||
return m
|
||||
}
|
||||
|
||||
switch p := x.(type) {
|
||||
case *GCMParams, *OAEPParams, *ECDH1DeriveParams:
|
||||
// contains pointers; defer serialization until cMechanism
|
||||
m.generator = p
|
||||
case []byte:
|
||||
m.Parameter = p
|
||||
default:
|
||||
panic("parameter must be one of type: []byte, *GCMParams, *OAEPParams, *ECDH1DeriveParams")
|
||||
}
|
||||
|
||||
return m
|
||||
}
|
||||
|
||||
func cMechanism(mechList []*Mechanism) (arena, *C.CK_MECHANISM) {
|
||||
if len(mechList) != 1 {
|
||||
panic("expected exactly one mechanism")
|
||||
}
|
||||
mech := mechList[0]
|
||||
cmech := &C.CK_MECHANISM{mechanism: C.CK_MECHANISM_TYPE(mech.Mechanism)}
|
||||
// params that contain pointers are allocated here
|
||||
param := mech.Parameter
|
||||
var arena arena
|
||||
switch p := mech.generator.(type) {
|
||||
case *GCMParams:
|
||||
// uses its own arena because it has to outlive this function call (yuck)
|
||||
param = cGCMParams(p)
|
||||
case *OAEPParams:
|
||||
param, arena = cOAEPParams(p, arena)
|
||||
case *ECDH1DeriveParams:
|
||||
param, arena = cECDH1DeriveParams(p, arena)
|
||||
}
|
||||
if len(param) != 0 {
|
||||
buf, len := arena.Allocate(param)
|
||||
// field is unaligned on windows so this has to call into C
|
||||
C.putMechanismParam(cmech, buf)
|
||||
cmech.ulParameterLen = len
|
||||
}
|
||||
return arena, cmech
|
||||
}
|
||||
|
||||
// MechanismInfo provides information about a particular mechanism.
|
||||
type MechanismInfo struct {
|
||||
MinKeySize uint
|
||||
MaxKeySize uint
|
||||
Flags uint
|
||||
}
|
||||
|
||||
// stubData is a persistent nonempty byte array used by cMessage.
|
||||
var stubData = []byte{0}
|
||||
|
||||
// cMessage returns the pointer/length pair corresponding to data.
|
||||
func cMessage(data []byte) (dataPtr C.CK_BYTE_PTR) {
|
||||
l := len(data)
|
||||
if l == 0 {
|
||||
// &data[0] is forbidden in this case, so use a nontrivial array instead.
|
||||
data = stubData
|
||||
}
|
||||
return C.CK_BYTE_PTR(unsafe.Pointer(&data[0]))
|
||||
}
|
||||
127
vendor/github.com/miekg/pkcs11/vendor.go
generated
vendored
127
vendor/github.com/miekg/pkcs11/vendor.go
generated
vendored
@ -1,127 +0,0 @@
|
||||
package pkcs11
|
||||
|
||||
// Vendor specific range for Ncipher network HSM.
|
||||
const (
|
||||
NFCK_VENDOR_NCIPHER = 0xde436972
|
||||
CKA_NCIPHER = NFCK_VENDOR_NCIPHER
|
||||
CKM_NCIPHER = NFCK_VENDOR_NCIPHER
|
||||
CKK_NCIPHER = NFCK_VENDOR_NCIPHER
|
||||
)
|
||||
|
||||
// Vendor specific mechanisms for HMAC on Ncipher HSMs where Ncipher does not allow use of generic_secret keys.
|
||||
const (
|
||||
CKM_NC_SHA_1_HMAC_KEY_GEN = CKM_NCIPHER + 0x3 /* no params */
|
||||
CKM_NC_MD5_HMAC_KEY_GEN = CKM_NCIPHER + 0x6 /* no params */
|
||||
CKM_NC_SHA224_HMAC_KEY_GEN = CKM_NCIPHER + 0x24 /* no params */
|
||||
CKM_NC_SHA256_HMAC_KEY_GEN = CKM_NCIPHER + 0x25 /* no params */
|
||||
CKM_NC_SHA384_HMAC_KEY_GEN = CKM_NCIPHER + 0x26 /* no params */
|
||||
CKM_NC_SHA512_HMAC_KEY_GEN = CKM_NCIPHER + 0x27 /* no params */
|
||||
)
|
||||
|
||||
// Vendor specific range for Mozilla NSS.
|
||||
const (
|
||||
NSSCK_VENDOR_NSS = 0x4E534350
|
||||
CKO_NSS = CKO_VENDOR_DEFINED | NSSCK_VENDOR_NSS
|
||||
CKK_NSS = CKK_VENDOR_DEFINED | NSSCK_VENDOR_NSS
|
||||
CKC_NSS = CKC_VENDOR_DEFINED | NSSCK_VENDOR_NSS
|
||||
CKA_NSS = CKA_VENDOR_DEFINED | NSSCK_VENDOR_NSS
|
||||
CKA_TRUST = CKA_NSS + 0x2000
|
||||
CKM_NSS = CKM_VENDOR_DEFINED | NSSCK_VENDOR_NSS
|
||||
CKR_NSS = CKM_VENDOR_DEFINED | NSSCK_VENDOR_NSS
|
||||
CKT_VENDOR_DEFINED = 0x80000000
|
||||
CKT_NSS = CKT_VENDOR_DEFINED | NSSCK_VENDOR_NSS
|
||||
)
|
||||
|
||||
// Vendor specific values for Mozilla NSS.
|
||||
const (
|
||||
CKO_NSS_CRL = CKO_NSS + 1
|
||||
CKO_NSS_SMIME = CKO_NSS + 2
|
||||
CKO_NSS_TRUST = CKO_NSS + 3
|
||||
CKO_NSS_BUILTIN_ROOT_LIST = CKO_NSS + 4
|
||||
CKO_NSS_NEWSLOT = CKO_NSS + 5
|
||||
CKO_NSS_DELSLOT = CKO_NSS + 6
|
||||
CKK_NSS_PKCS8 = CKK_NSS + 1
|
||||
CKK_NSS_JPAKE_ROUND1 = CKK_NSS + 2
|
||||
CKK_NSS_JPAKE_ROUND2 = CKK_NSS + 3
|
||||
CKK_NSS_CHACHA20 = CKK_NSS + 4
|
||||
CKA_NSS_URL = CKA_NSS + 1
|
||||
CKA_NSS_EMAIL = CKA_NSS + 2
|
||||
CKA_NSS_SMIME_INFO = CKA_NSS + 3
|
||||
CKA_NSS_SMIME_TIMESTAMP = CKA_NSS + 4
|
||||
CKA_NSS_PKCS8_SALT = CKA_NSS + 5
|
||||
CKA_NSS_PASSWORD_CHECK = CKA_NSS + 6
|
||||
CKA_NSS_EXPIRES = CKA_NSS + 7
|
||||
CKA_NSS_KRL = CKA_NSS + 8
|
||||
CKA_NSS_PQG_COUNTER = CKA_NSS + 20
|
||||
CKA_NSS_PQG_SEED = CKA_NSS + 21
|
||||
CKA_NSS_PQG_H = CKA_NSS + 22
|
||||
CKA_NSS_PQG_SEED_BITS = CKA_NSS + 23
|
||||
CKA_NSS_MODULE_SPEC = CKA_NSS + 24
|
||||
CKA_NSS_OVERRIDE_EXTENSIONS = CKA_NSS + 25
|
||||
CKA_NSS_JPAKE_SIGNERID = CKA_NSS + 26
|
||||
CKA_NSS_JPAKE_PEERID = CKA_NSS + 27
|
||||
CKA_NSS_JPAKE_GX1 = CKA_NSS + 28
|
||||
CKA_NSS_JPAKE_GX2 = CKA_NSS + 29
|
||||
CKA_NSS_JPAKE_GX3 = CKA_NSS + 30
|
||||
CKA_NSS_JPAKE_GX4 = CKA_NSS + 31
|
||||
CKA_NSS_JPAKE_X2 = CKA_NSS + 32
|
||||
CKA_NSS_JPAKE_X2S = CKA_NSS + 33
|
||||
CKA_NSS_MOZILLA_CA_POLICY = CKA_NSS + 34
|
||||
CKA_TRUST_DIGITAL_SIGNATURE = CKA_TRUST + 1
|
||||
CKA_TRUST_NON_REPUDIATION = CKA_TRUST + 2
|
||||
CKA_TRUST_KEY_ENCIPHERMENT = CKA_TRUST + 3
|
||||
CKA_TRUST_DATA_ENCIPHERMENT = CKA_TRUST + 4
|
||||
CKA_TRUST_KEY_AGREEMENT = CKA_TRUST + 5
|
||||
CKA_TRUST_KEY_CERT_SIGN = CKA_TRUST + 6
|
||||
CKA_TRUST_CRL_SIGN = CKA_TRUST + 7
|
||||
CKA_TRUST_SERVER_AUTH = CKA_TRUST + 8
|
||||
CKA_TRUST_CLIENT_AUTH = CKA_TRUST + 9
|
||||
CKA_TRUST_CODE_SIGNING = CKA_TRUST + 10
|
||||
CKA_TRUST_EMAIL_PROTECTION = CKA_TRUST + 11
|
||||
CKA_TRUST_IPSEC_END_SYSTEM = CKA_TRUST + 12
|
||||
CKA_TRUST_IPSEC_TUNNEL = CKA_TRUST + 13
|
||||
CKA_TRUST_IPSEC_USER = CKA_TRUST + 14
|
||||
CKA_TRUST_TIME_STAMPING = CKA_TRUST + 15
|
||||
CKA_TRUST_STEP_UP_APPROVED = CKA_TRUST + 16
|
||||
CKA_CERT_SHA1_HASH = CKA_TRUST + 100
|
||||
CKA_CERT_MD5_HASH = CKA_TRUST + 101
|
||||
CKM_NSS_AES_KEY_WRAP = CKM_NSS + 1
|
||||
CKM_NSS_AES_KEY_WRAP_PAD = CKM_NSS + 2
|
||||
CKM_NSS_HKDF_SHA1 = CKM_NSS + 3
|
||||
CKM_NSS_HKDF_SHA256 = CKM_NSS + 4
|
||||
CKM_NSS_HKDF_SHA384 = CKM_NSS + 5
|
||||
CKM_NSS_HKDF_SHA512 = CKM_NSS + 6
|
||||
CKM_NSS_JPAKE_ROUND1_SHA1 = CKM_NSS + 7
|
||||
CKM_NSS_JPAKE_ROUND1_SHA256 = CKM_NSS + 8
|
||||
CKM_NSS_JPAKE_ROUND1_SHA384 = CKM_NSS + 9
|
||||
CKM_NSS_JPAKE_ROUND1_SHA512 = CKM_NSS + 10
|
||||
CKM_NSS_JPAKE_ROUND2_SHA1 = CKM_NSS + 11
|
||||
CKM_NSS_JPAKE_ROUND2_SHA256 = CKM_NSS + 12
|
||||
CKM_NSS_JPAKE_ROUND2_SHA384 = CKM_NSS + 13
|
||||
CKM_NSS_JPAKE_ROUND2_SHA512 = CKM_NSS + 14
|
||||
CKM_NSS_JPAKE_FINAL_SHA1 = CKM_NSS + 15
|
||||
CKM_NSS_JPAKE_FINAL_SHA256 = CKM_NSS + 16
|
||||
CKM_NSS_JPAKE_FINAL_SHA384 = CKM_NSS + 17
|
||||
CKM_NSS_JPAKE_FINAL_SHA512 = CKM_NSS + 18
|
||||
CKM_NSS_HMAC_CONSTANT_TIME = CKM_NSS + 19
|
||||
CKM_NSS_SSL3_MAC_CONSTANT_TIME = CKM_NSS + 20
|
||||
CKM_NSS_TLS_PRF_GENERAL_SHA256 = CKM_NSS + 21
|
||||
CKM_NSS_TLS_MASTER_KEY_DERIVE_SHA256 = CKM_NSS + 22
|
||||
CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256 = CKM_NSS + 23
|
||||
CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256 = CKM_NSS + 24
|
||||
CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE = CKM_NSS + 25
|
||||
CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE_DH = CKM_NSS + 26
|
||||
CKM_NSS_CHACHA20_KEY_GEN = CKM_NSS + 27
|
||||
CKM_NSS_CHACHA20_POLY1305 = CKM_NSS + 28
|
||||
CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN = CKM_NSS + 29
|
||||
CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN = CKM_NSS + 30
|
||||
CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN = CKM_NSS + 31
|
||||
CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN = CKM_NSS + 32
|
||||
CKR_NSS_CERTDB_FAILED = CKR_NSS + 1
|
||||
CKR_NSS_KEYDB_FAILED = CKR_NSS + 2
|
||||
CKT_NSS_TRUSTED = CKT_NSS + 1
|
||||
CKT_NSS_TRUSTED_DELEGATOR = CKT_NSS + 2
|
||||
CKT_NSS_MUST_VERIFY_TRUST = CKT_NSS + 3
|
||||
CKT_NSS_NOT_TRUSTED = CKT_NSS + 10
|
||||
CKT_NSS_TRUST_UNKNOWN = CKT_NSS + 5
|
||||
)
|
||||
766
vendor/github.com/miekg/pkcs11/zconst.go
generated
vendored
766
vendor/github.com/miekg/pkcs11/zconst.go
generated
vendored
@ -1,766 +0,0 @@
|
||||
// Copyright 2013 Miek Gieben. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// Code generated by "go run const_generate.go"; DO NOT EDIT.
|
||||
|
||||
package pkcs11
|
||||
|
||||
const (
|
||||
CK_TRUE = 1
|
||||
CK_FALSE = 0
|
||||
CK_UNAVAILABLE_INFORMATION = ^uint(0)
|
||||
CK_EFFECTIVELY_INFINITE = 0
|
||||
CK_INVALID_HANDLE = 0
|
||||
CKN_SURRENDER = 0
|
||||
CKN_OTP_CHANGED = 1
|
||||
CKF_TOKEN_PRESENT = 0x00000001
|
||||
CKF_REMOVABLE_DEVICE = 0x00000002
|
||||
CKF_HW_SLOT = 0x00000004
|
||||
CKF_RNG = 0x00000001
|
||||
CKF_WRITE_PROTECTED = 0x00000002
|
||||
CKF_LOGIN_REQUIRED = 0x00000004
|
||||
CKF_USER_PIN_INITIALIZED = 0x00000008
|
||||
CKF_RESTORE_KEY_NOT_NEEDED = 0x00000020
|
||||
CKF_CLOCK_ON_TOKEN = 0x00000040
|
||||
CKF_PROTECTED_AUTHENTICATION_PATH = 0x00000100
|
||||
CKF_DUAL_CRYPTO_OPERATIONS = 0x00000200
|
||||
CKF_TOKEN_INITIALIZED = 0x00000400
|
||||
CKF_SECONDARY_AUTHENTICATION = 0x00000800
|
||||
CKF_USER_PIN_COUNT_LOW = 0x00010000
|
||||
CKF_USER_PIN_FINAL_TRY = 0x00020000
|
||||
CKF_USER_PIN_LOCKED = 0x00040000
|
||||
CKF_USER_PIN_TO_BE_CHANGED = 0x00080000
|
||||
CKF_SO_PIN_COUNT_LOW = 0x00100000
|
||||
CKF_SO_PIN_FINAL_TRY = 0x00200000
|
||||
CKF_SO_PIN_LOCKED = 0x00400000
|
||||
CKF_SO_PIN_TO_BE_CHANGED = 0x00800000
|
||||
CKF_ERROR_STATE = 0x01000000
|
||||
CKU_SO = 0
|
||||
CKU_USER = 1
|
||||
CKU_CONTEXT_SPECIFIC = 2
|
||||
CKS_RO_PUBLIC_SESSION = 0
|
||||
CKS_RO_USER_FUNCTIONS = 1
|
||||
CKS_RW_PUBLIC_SESSION = 2
|
||||
CKS_RW_USER_FUNCTIONS = 3
|
||||
CKS_RW_SO_FUNCTIONS = 4
|
||||
CKF_RW_SESSION = 0x00000002
|
||||
CKF_SERIAL_SESSION = 0x00000004
|
||||
CKO_DATA = 0x00000000
|
||||
CKO_CERTIFICATE = 0x00000001
|
||||
CKO_PUBLIC_KEY = 0x00000002
|
||||
CKO_PRIVATE_KEY = 0x00000003
|
||||
CKO_SECRET_KEY = 0x00000004
|
||||
CKO_HW_FEATURE = 0x00000005
|
||||
CKO_DOMAIN_PARAMETERS = 0x00000006
|
||||
CKO_MECHANISM = 0x00000007
|
||||
CKO_OTP_KEY = 0x00000008
|
||||
CKO_VENDOR_DEFINED = 0x80000000
|
||||
CKH_MONOTONIC_COUNTER = 0x00000001
|
||||
CKH_CLOCK = 0x00000002
|
||||
CKH_USER_INTERFACE = 0x00000003
|
||||
CKH_VENDOR_DEFINED = 0x80000000
|
||||
CKK_RSA = 0x00000000
|
||||
CKK_DSA = 0x00000001
|
||||
CKK_DH = 0x00000002
|
||||
CKK_ECDSA = 0x00000003 // Deprecated
|
||||
CKK_EC = 0x00000003
|
||||
CKK_X9_42_DH = 0x00000004
|
||||
CKK_KEA = 0x00000005
|
||||
CKK_GENERIC_SECRET = 0x00000010
|
||||
CKK_RC2 = 0x00000011
|
||||
CKK_RC4 = 0x00000012
|
||||
CKK_DES = 0x00000013
|
||||
CKK_DES2 = 0x00000014
|
||||
CKK_DES3 = 0x00000015
|
||||
CKK_CAST = 0x00000016
|
||||
CKK_CAST3 = 0x00000017
|
||||
CKK_CAST5 = 0x00000018 // Deprecated
|
||||
CKK_CAST128 = 0x00000018
|
||||
CKK_RC5 = 0x00000019
|
||||
CKK_IDEA = 0x0000001A
|
||||
CKK_SKIPJACK = 0x0000001B
|
||||
CKK_BATON = 0x0000001C
|
||||
CKK_JUNIPER = 0x0000001D
|
||||
CKK_CDMF = 0x0000001E
|
||||
CKK_AES = 0x0000001F
|
||||
CKK_BLOWFISH = 0x00000020
|
||||
CKK_TWOFISH = 0x00000021
|
||||
CKK_SECURID = 0x00000022
|
||||
CKK_HOTP = 0x00000023
|
||||
CKK_ACTI = 0x00000024
|
||||
CKK_CAMELLIA = 0x00000025
|
||||
CKK_ARIA = 0x00000026
|
||||
CKK_MD5_HMAC = 0x00000027
|
||||
CKK_SHA_1_HMAC = 0x00000028
|
||||
CKK_RIPEMD128_HMAC = 0x00000029
|
||||
CKK_RIPEMD160_HMAC = 0x0000002A
|
||||
CKK_SHA256_HMAC = 0x0000002B
|
||||
CKK_SHA384_HMAC = 0x0000002C
|
||||
CKK_SHA512_HMAC = 0x0000002D
|
||||
CKK_SHA224_HMAC = 0x0000002E
|
||||
CKK_SEED = 0x0000002F
|
||||
CKK_GOSTR3410 = 0x00000030
|
||||
CKK_GOSTR3411 = 0x00000031
|
||||
CKK_GOST28147 = 0x00000032
|
||||
CKK_SHA3_224_HMAC = 0x00000033
|
||||
CKK_SHA3_256_HMAC = 0x00000034
|
||||
CKK_SHA3_384_HMAC = 0x00000035
|
||||
CKK_SHA3_512_HMAC = 0x00000036
|
||||
CKK_VENDOR_DEFINED = 0x80000000
|
||||
CK_CERTIFICATE_CATEGORY_UNSPECIFIED = 0
|
||||
CK_CERTIFICATE_CATEGORY_TOKEN_USER = 1
|
||||
CK_CERTIFICATE_CATEGORY_AUTHORITY = 2
|
||||
CK_CERTIFICATE_CATEGORY_OTHER_ENTITY = 3
|
||||
CK_SECURITY_DOMAIN_UNSPECIFIED = 0
|
||||
CK_SECURITY_DOMAIN_MANUFACTURER = 1
|
||||
CK_SECURITY_DOMAIN_OPERATOR = 2
|
||||
CK_SECURITY_DOMAIN_THIRD_PARTY = 3
|
||||
CKC_X_509 = 0x00000000
|
||||
CKC_X_509_ATTR_CERT = 0x00000001
|
||||
CKC_WTLS = 0x00000002
|
||||
CKC_VENDOR_DEFINED = 0x80000000
|
||||
CKF_ARRAY_ATTRIBUTE = 0x40000000
|
||||
CK_OTP_FORMAT_DECIMAL = 0
|
||||
CK_OTP_FORMAT_HEXADECIMAL = 1
|
||||
CK_OTP_FORMAT_ALPHANUMERIC = 2
|
||||
CK_OTP_FORMAT_BINARY = 3
|
||||
CK_OTP_PARAM_IGNORED = 0
|
||||
CK_OTP_PARAM_OPTIONAL = 1
|
||||
CK_OTP_PARAM_MANDATORY = 2
|
||||
CKA_CLASS = 0x00000000
|
||||
CKA_TOKEN = 0x00000001
|
||||
CKA_PRIVATE = 0x00000002
|
||||
CKA_LABEL = 0x00000003
|
||||
CKA_APPLICATION = 0x00000010
|
||||
CKA_VALUE = 0x00000011
|
||||
CKA_OBJECT_ID = 0x00000012
|
||||
CKA_CERTIFICATE_TYPE = 0x00000080
|
||||
CKA_ISSUER = 0x00000081
|
||||
CKA_SERIAL_NUMBER = 0x00000082
|
||||
CKA_AC_ISSUER = 0x00000083
|
||||
CKA_OWNER = 0x00000084
|
||||
CKA_ATTR_TYPES = 0x00000085
|
||||
CKA_TRUSTED = 0x00000086
|
||||
CKA_CERTIFICATE_CATEGORY = 0x00000087
|
||||
CKA_JAVA_MIDP_SECURITY_DOMAIN = 0x00000088
|
||||
CKA_URL = 0x00000089
|
||||
CKA_HASH_OF_SUBJECT_PUBLIC_KEY = 0x0000008A
|
||||
CKA_HASH_OF_ISSUER_PUBLIC_KEY = 0x0000008B
|
||||
CKA_NAME_HASH_ALGORITHM = 0x0000008C
|
||||
CKA_CHECK_VALUE = 0x00000090
|
||||
CKA_KEY_TYPE = 0x00000100
|
||||
CKA_SUBJECT = 0x00000101
|
||||
CKA_ID = 0x00000102
|
||||
CKA_SENSITIVE = 0x00000103
|
||||
CKA_ENCRYPT = 0x00000104
|
||||
CKA_DECRYPT = 0x00000105
|
||||
CKA_WRAP = 0x00000106
|
||||
CKA_UNWRAP = 0x00000107
|
||||
CKA_SIGN = 0x00000108
|
||||
CKA_SIGN_RECOVER = 0x00000109
|
||||
CKA_VERIFY = 0x0000010A
|
||||
CKA_VERIFY_RECOVER = 0x0000010B
|
||||
CKA_DERIVE = 0x0000010C
|
||||
CKA_START_DATE = 0x00000110
|
||||
CKA_END_DATE = 0x00000111
|
||||
CKA_MODULUS = 0x00000120
|
||||
CKA_MODULUS_BITS = 0x00000121
|
||||
CKA_PUBLIC_EXPONENT = 0x00000122
|
||||
CKA_PRIVATE_EXPONENT = 0x00000123
|
||||
CKA_PRIME_1 = 0x00000124
|
||||
CKA_PRIME_2 = 0x00000125
|
||||
CKA_EXPONENT_1 = 0x00000126
|
||||
CKA_EXPONENT_2 = 0x00000127
|
||||
CKA_COEFFICIENT = 0x00000128
|
||||
CKA_PUBLIC_KEY_INFO = 0x00000129
|
||||
CKA_PRIME = 0x00000130
|
||||
CKA_SUBPRIME = 0x00000131
|
||||
CKA_BASE = 0x00000132
|
||||
CKA_PRIME_BITS = 0x00000133
|
||||
CKA_SUBPRIME_BITS = 0x00000134
|
||||
CKA_SUB_PRIME_BITS = CKA_SUBPRIME_BITS
|
||||
CKA_VALUE_BITS = 0x00000160
|
||||
CKA_VALUE_LEN = 0x00000161
|
||||
CKA_EXTRACTABLE = 0x00000162
|
||||
CKA_LOCAL = 0x00000163
|
||||
CKA_NEVER_EXTRACTABLE = 0x00000164
|
||||
CKA_ALWAYS_SENSITIVE = 0x00000165
|
||||
CKA_KEY_GEN_MECHANISM = 0x00000166
|
||||
CKA_MODIFIABLE = 0x00000170
|
||||
CKA_COPYABLE = 0x00000171
|
||||
CKA_DESTROYABLE = 0x00000172
|
||||
CKA_ECDSA_PARAMS = 0x00000180 // Deprecated
|
||||
CKA_EC_PARAMS = 0x00000180
|
||||
CKA_EC_POINT = 0x00000181
|
||||
CKA_SECONDARY_AUTH = 0x00000200 // Deprecated
|
||||
CKA_AUTH_PIN_FLAGS = 0x00000201 // Deprecated
|
||||
CKA_ALWAYS_AUTHENTICATE = 0x00000202
|
||||
CKA_WRAP_WITH_TRUSTED = 0x00000210
|
||||
CKA_WRAP_TEMPLATE = (CKF_ARRAY_ATTRIBUTE | 0x00000211)
|
||||
CKA_UNWRAP_TEMPLATE = (CKF_ARRAY_ATTRIBUTE | 0x00000212)
|
||||
CKA_DERIVE_TEMPLATE = (CKF_ARRAY_ATTRIBUTE | 0x00000213)
|
||||
CKA_OTP_FORMAT = 0x00000220
|
||||
CKA_OTP_LENGTH = 0x00000221
|
||||
CKA_OTP_TIME_INTERVAL = 0x00000222
|
||||
CKA_OTP_USER_FRIENDLY_MODE = 0x00000223
|
||||
CKA_OTP_CHALLENGE_REQUIREMENT = 0x00000224
|
||||
CKA_OTP_TIME_REQUIREMENT = 0x00000225
|
||||
CKA_OTP_COUNTER_REQUIREMENT = 0x00000226
|
||||
CKA_OTP_PIN_REQUIREMENT = 0x00000227
|
||||
CKA_OTP_COUNTER = 0x0000022E
|
||||
CKA_OTP_TIME = 0x0000022F
|
||||
CKA_OTP_USER_IDENTIFIER = 0x0000022A
|
||||
CKA_OTP_SERVICE_IDENTIFIER = 0x0000022B
|
||||
CKA_OTP_SERVICE_LOGO = 0x0000022C
|
||||
CKA_OTP_SERVICE_LOGO_TYPE = 0x0000022D
|
||||
CKA_GOSTR3410_PARAMS = 0x00000250
|
||||
CKA_GOSTR3411_PARAMS = 0x00000251
|
||||
CKA_GOST28147_PARAMS = 0x00000252
|
||||
CKA_HW_FEATURE_TYPE = 0x00000300
|
||||
CKA_RESET_ON_INIT = 0x00000301
|
||||
CKA_HAS_RESET = 0x00000302
|
||||
CKA_PIXEL_X = 0x00000400
|
||||
CKA_PIXEL_Y = 0x00000401
|
||||
CKA_RESOLUTION = 0x00000402
|
||||
CKA_CHAR_ROWS = 0x00000403
|
||||
CKA_CHAR_COLUMNS = 0x00000404
|
||||
CKA_COLOR = 0x00000405
|
||||
CKA_BITS_PER_PIXEL = 0x00000406
|
||||
CKA_CHAR_SETS = 0x00000480
|
||||
CKA_ENCODING_METHODS = 0x00000481
|
||||
CKA_MIME_TYPES = 0x00000482
|
||||
CKA_MECHANISM_TYPE = 0x00000500
|
||||
CKA_REQUIRED_CMS_ATTRIBUTES = 0x00000501
|
||||
CKA_DEFAULT_CMS_ATTRIBUTES = 0x00000502
|
||||
CKA_SUPPORTED_CMS_ATTRIBUTES = 0x00000503
|
||||
CKA_ALLOWED_MECHANISMS = (CKF_ARRAY_ATTRIBUTE | 0x00000600)
|
||||
CKA_VENDOR_DEFINED = 0x80000000
|
||||
CKM_RSA_PKCS_KEY_PAIR_GEN = 0x00000000
|
||||
CKM_RSA_PKCS = 0x00000001
|
||||
CKM_RSA_9796 = 0x00000002
|
||||
CKM_RSA_X_509 = 0x00000003
|
||||
CKM_MD2_RSA_PKCS = 0x00000004
|
||||
CKM_MD5_RSA_PKCS = 0x00000005
|
||||
CKM_SHA1_RSA_PKCS = 0x00000006
|
||||
CKM_RIPEMD128_RSA_PKCS = 0x00000007
|
||||
CKM_RIPEMD160_RSA_PKCS = 0x00000008
|
||||
CKM_RSA_PKCS_OAEP = 0x00000009
|
||||
CKM_RSA_X9_31_KEY_PAIR_GEN = 0x0000000A
|
||||
CKM_RSA_X9_31 = 0x0000000B
|
||||
CKM_SHA1_RSA_X9_31 = 0x0000000C
|
||||
CKM_RSA_PKCS_PSS = 0x0000000D
|
||||
CKM_SHA1_RSA_PKCS_PSS = 0x0000000E
|
||||
CKM_DSA_KEY_PAIR_GEN = 0x00000010
|
||||
CKM_DSA = 0x00000011
|
||||
CKM_DSA_SHA1 = 0x00000012
|
||||
CKM_DSA_SHA224 = 0x00000013
|
||||
CKM_DSA_SHA256 = 0x00000014
|
||||
CKM_DSA_SHA384 = 0x00000015
|
||||
CKM_DSA_SHA512 = 0x00000016
|
||||
CKM_DSA_SHA3_224 = 0x00000018
|
||||
CKM_DSA_SHA3_256 = 0x00000019
|
||||
CKM_DSA_SHA3_384 = 0x0000001A
|
||||
CKM_DSA_SHA3_512 = 0x0000001B
|
||||
CKM_DH_PKCS_KEY_PAIR_GEN = 0x00000020
|
||||
CKM_DH_PKCS_DERIVE = 0x00000021
|
||||
CKM_X9_42_DH_KEY_PAIR_GEN = 0x00000030
|
||||
CKM_X9_42_DH_DERIVE = 0x00000031
|
||||
CKM_X9_42_DH_HYBRID_DERIVE = 0x00000032
|
||||
CKM_X9_42_MQV_DERIVE = 0x00000033
|
||||
CKM_SHA256_RSA_PKCS = 0x00000040
|
||||
CKM_SHA384_RSA_PKCS = 0x00000041
|
||||
CKM_SHA512_RSA_PKCS = 0x00000042
|
||||
CKM_SHA256_RSA_PKCS_PSS = 0x00000043
|
||||
CKM_SHA384_RSA_PKCS_PSS = 0x00000044
|
||||
CKM_SHA512_RSA_PKCS_PSS = 0x00000045
|
||||
CKM_SHA224_RSA_PKCS = 0x00000046
|
||||
CKM_SHA224_RSA_PKCS_PSS = 0x00000047
|
||||
CKM_SHA512_224 = 0x00000048
|
||||
CKM_SHA512_224_HMAC = 0x00000049
|
||||
CKM_SHA512_224_HMAC_GENERAL = 0x0000004A
|
||||
CKM_SHA512_224_KEY_DERIVATION = 0x0000004B
|
||||
CKM_SHA512_256 = 0x0000004C
|
||||
CKM_SHA512_256_HMAC = 0x0000004D
|
||||
CKM_SHA512_256_HMAC_GENERAL = 0x0000004E
|
||||
CKM_SHA512_256_KEY_DERIVATION = 0x0000004F
|
||||
CKM_SHA512_T = 0x00000050
|
||||
CKM_SHA512_T_HMAC = 0x00000051
|
||||
CKM_SHA512_T_HMAC_GENERAL = 0x00000052
|
||||
CKM_SHA512_T_KEY_DERIVATION = 0x00000053
|
||||
CKM_SHA3_256_RSA_PKCS = 0x00000060
|
||||
CKM_SHA3_384_RSA_PKCS = 0x00000061
|
||||
CKM_SHA3_512_RSA_PKCS = 0x00000062
|
||||
CKM_SHA3_256_RSA_PKCS_PSS = 0x00000063
|
||||
CKM_SHA3_384_RSA_PKCS_PSS = 0x00000064
|
||||
CKM_SHA3_512_RSA_PKCS_PSS = 0x00000065
|
||||
CKM_SHA3_224_RSA_PKCS = 0x00000066
|
||||
CKM_SHA3_224_RSA_PKCS_PSS = 0x00000067
|
||||
CKM_RC2_KEY_GEN = 0x00000100
|
||||
CKM_RC2_ECB = 0x00000101
|
||||
CKM_RC2_CBC = 0x00000102
|
||||
CKM_RC2_MAC = 0x00000103
|
||||
CKM_RC2_MAC_GENERAL = 0x00000104
|
||||
CKM_RC2_CBC_PAD = 0x00000105
|
||||
CKM_RC4_KEY_GEN = 0x00000110
|
||||
CKM_RC4 = 0x00000111
|
||||
CKM_DES_KEY_GEN = 0x00000120
|
||||
CKM_DES_ECB = 0x00000121
|
||||
CKM_DES_CBC = 0x00000122
|
||||
CKM_DES_MAC = 0x00000123
|
||||
CKM_DES_MAC_GENERAL = 0x00000124
|
||||
CKM_DES_CBC_PAD = 0x00000125
|
||||
CKM_DES2_KEY_GEN = 0x00000130
|
||||
CKM_DES3_KEY_GEN = 0x00000131
|
||||
CKM_DES3_ECB = 0x00000132
|
||||
CKM_DES3_CBC = 0x00000133
|
||||
CKM_DES3_MAC = 0x00000134
|
||||
CKM_DES3_MAC_GENERAL = 0x00000135
|
||||
CKM_DES3_CBC_PAD = 0x00000136
|
||||
CKM_DES3_CMAC_GENERAL = 0x00000137
|
||||
CKM_DES3_CMAC = 0x00000138
|
||||
CKM_CDMF_KEY_GEN = 0x00000140
|
||||
CKM_CDMF_ECB = 0x00000141
|
||||
CKM_CDMF_CBC = 0x00000142
|
||||
CKM_CDMF_MAC = 0x00000143
|
||||
CKM_CDMF_MAC_GENERAL = 0x00000144
|
||||
CKM_CDMF_CBC_PAD = 0x00000145
|
||||
CKM_DES_OFB64 = 0x00000150
|
||||
CKM_DES_OFB8 = 0x00000151
|
||||
CKM_DES_CFB64 = 0x00000152
|
||||
CKM_DES_CFB8 = 0x00000153
|
||||
CKM_MD2 = 0x00000200
|
||||
CKM_MD2_HMAC = 0x00000201
|
||||
CKM_MD2_HMAC_GENERAL = 0x00000202
|
||||
CKM_MD5 = 0x00000210
|
||||
CKM_MD5_HMAC = 0x00000211
|
||||
CKM_MD5_HMAC_GENERAL = 0x00000212
|
||||
CKM_SHA_1 = 0x00000220
|
||||
CKM_SHA_1_HMAC = 0x00000221
|
||||
CKM_SHA_1_HMAC_GENERAL = 0x00000222
|
||||
CKM_RIPEMD128 = 0x00000230
|
||||
CKM_RIPEMD128_HMAC = 0x00000231
|
||||
CKM_RIPEMD128_HMAC_GENERAL = 0x00000232
|
||||
CKM_RIPEMD160 = 0x00000240
|
||||
CKM_RIPEMD160_HMAC = 0x00000241
|
||||
CKM_RIPEMD160_HMAC_GENERAL = 0x00000242
|
||||
CKM_SHA256 = 0x00000250
|
||||
CKM_SHA256_HMAC = 0x00000251
|
||||
CKM_SHA256_HMAC_GENERAL = 0x00000252
|
||||
CKM_SHA224 = 0x00000255
|
||||
CKM_SHA224_HMAC = 0x00000256
|
||||
CKM_SHA224_HMAC_GENERAL = 0x00000257
|
||||
CKM_SHA384 = 0x00000260
|
||||
CKM_SHA384_HMAC = 0x00000261
|
||||
CKM_SHA384_HMAC_GENERAL = 0x00000262
|
||||
CKM_SHA512 = 0x00000270
|
||||
CKM_SHA512_HMAC = 0x00000271
|
||||
CKM_SHA512_HMAC_GENERAL = 0x00000272
|
||||
CKM_SECURID_KEY_GEN = 0x00000280
|
||||
CKM_SECURID = 0x00000282
|
||||
CKM_HOTP_KEY_GEN = 0x00000290
|
||||
CKM_HOTP = 0x00000291
|
||||
CKM_ACTI = 0x000002A0
|
||||
CKM_ACTI_KEY_GEN = 0x000002A1
|
||||
CKM_SHA3_256 = 0x000002B0
|
||||
CKM_SHA3_256_HMAC = 0x000002B1
|
||||
CKM_SHA3_256_HMAC_GENERAL = 0x000002B2
|
||||
CKM_SHA3_256_KEY_GEN = 0x000002B3
|
||||
CKM_SHA3_224 = 0x000002B5
|
||||
CKM_SHA3_224_HMAC = 0x000002B6
|
||||
CKM_SHA3_224_HMAC_GENERAL = 0x000002B7
|
||||
CKM_SHA3_224_KEY_GEN = 0x000002B8
|
||||
CKM_SHA3_384 = 0x000002C0
|
||||
CKM_SHA3_384_HMAC = 0x000002C1
|
||||
CKM_SHA3_384_HMAC_GENERAL = 0x000002C2
|
||||
CKM_SHA3_384_KEY_GEN = 0x000002C3
|
||||
CKM_SHA3_512 = 0x000002D0
|
||||
CKM_SHA3_512_HMAC = 0x000002D1
|
||||
CKM_SHA3_512_HMAC_GENERAL = 0x000002D2
|
||||
CKM_SHA3_512_KEY_GEN = 0x000002D3
|
||||
CKM_CAST_KEY_GEN = 0x00000300
|
||||
CKM_CAST_ECB = 0x00000301
|
||||
CKM_CAST_CBC = 0x00000302
|
||||
CKM_CAST_MAC = 0x00000303
|
||||
CKM_CAST_MAC_GENERAL = 0x00000304
|
||||
CKM_CAST_CBC_PAD = 0x00000305
|
||||
CKM_CAST3_KEY_GEN = 0x00000310
|
||||
CKM_CAST3_ECB = 0x00000311
|
||||
CKM_CAST3_CBC = 0x00000312
|
||||
CKM_CAST3_MAC = 0x00000313
|
||||
CKM_CAST3_MAC_GENERAL = 0x00000314
|
||||
CKM_CAST3_CBC_PAD = 0x00000315
|
||||
CKM_CAST5_KEY_GEN = 0x00000320
|
||||
CKM_CAST128_KEY_GEN = 0x00000320
|
||||
CKM_CAST5_ECB = 0x00000321
|
||||
CKM_CAST128_ECB = 0x00000321
|
||||
CKM_CAST5_CBC = 0x00000322 // Deprecated
|
||||
CKM_CAST128_CBC = 0x00000322
|
||||
CKM_CAST5_MAC = 0x00000323 // Deprecated
|
||||
CKM_CAST128_MAC = 0x00000323
|
||||
CKM_CAST5_MAC_GENERAL = 0x00000324 // Deprecated
|
||||
CKM_CAST128_MAC_GENERAL = 0x00000324
|
||||
CKM_CAST5_CBC_PAD = 0x00000325 // Deprecated
|
||||
CKM_CAST128_CBC_PAD = 0x00000325
|
||||
CKM_RC5_KEY_GEN = 0x00000330
|
||||
CKM_RC5_ECB = 0x00000331
|
||||
CKM_RC5_CBC = 0x00000332
|
||||
CKM_RC5_MAC = 0x00000333
|
||||
CKM_RC5_MAC_GENERAL = 0x00000334
|
||||
CKM_RC5_CBC_PAD = 0x00000335
|
||||
CKM_IDEA_KEY_GEN = 0x00000340
|
||||
CKM_IDEA_ECB = 0x00000341
|
||||
CKM_IDEA_CBC = 0x00000342
|
||||
CKM_IDEA_MAC = 0x00000343
|
||||
CKM_IDEA_MAC_GENERAL = 0x00000344
|
||||
CKM_IDEA_CBC_PAD = 0x00000345
|
||||
CKM_GENERIC_SECRET_KEY_GEN = 0x00000350
|
||||
CKM_CONCATENATE_BASE_AND_KEY = 0x00000360
|
||||
CKM_CONCATENATE_BASE_AND_DATA = 0x00000362
|
||||
CKM_CONCATENATE_DATA_AND_BASE = 0x00000363
|
||||
CKM_XOR_BASE_AND_DATA = 0x00000364
|
||||
CKM_EXTRACT_KEY_FROM_KEY = 0x00000365
|
||||
CKM_SSL3_PRE_MASTER_KEY_GEN = 0x00000370
|
||||
CKM_SSL3_MASTER_KEY_DERIVE = 0x00000371
|
||||
CKM_SSL3_KEY_AND_MAC_DERIVE = 0x00000372
|
||||
CKM_SSL3_MASTER_KEY_DERIVE_DH = 0x00000373
|
||||
CKM_TLS_PRE_MASTER_KEY_GEN = 0x00000374
|
||||
CKM_TLS_MASTER_KEY_DERIVE = 0x00000375
|
||||
CKM_TLS_KEY_AND_MAC_DERIVE = 0x00000376
|
||||
CKM_TLS_MASTER_KEY_DERIVE_DH = 0x00000377
|
||||
CKM_TLS_PRF = 0x00000378
|
||||
CKM_SSL3_MD5_MAC = 0x00000380
|
||||
CKM_SSL3_SHA1_MAC = 0x00000381
|
||||
CKM_MD5_KEY_DERIVATION = 0x00000390
|
||||
CKM_MD2_KEY_DERIVATION = 0x00000391
|
||||
CKM_SHA1_KEY_DERIVATION = 0x00000392
|
||||
CKM_SHA256_KEY_DERIVATION = 0x00000393
|
||||
CKM_SHA384_KEY_DERIVATION = 0x00000394
|
||||
CKM_SHA512_KEY_DERIVATION = 0x00000395
|
||||
CKM_SHA224_KEY_DERIVATION = 0x00000396
|
||||
CKM_SHA3_256_KEY_DERIVE = 0x00000397
|
||||
CKM_SHA3_224_KEY_DERIVE = 0x00000398
|
||||
CKM_SHA3_384_KEY_DERIVE = 0x00000399
|
||||
CKM_SHA3_512_KEY_DERIVE = 0x0000039A
|
||||
CKM_SHAKE_128_KEY_DERIVE = 0x0000039B
|
||||
CKM_SHAKE_256_KEY_DERIVE = 0x0000039C
|
||||
CKM_PBE_MD2_DES_CBC = 0x000003A0
|
||||
CKM_PBE_MD5_DES_CBC = 0x000003A1
|
||||
CKM_PBE_MD5_CAST_CBC = 0x000003A2
|
||||
CKM_PBE_MD5_CAST3_CBC = 0x000003A3
|
||||
CKM_PBE_MD5_CAST5_CBC = 0x000003A4 // Deprecated
|
||||
CKM_PBE_MD5_CAST128_CBC = 0x000003A4
|
||||
CKM_PBE_SHA1_CAST5_CBC = 0x000003A5 // Deprecated
|
||||
CKM_PBE_SHA1_CAST128_CBC = 0x000003A5
|
||||
CKM_PBE_SHA1_RC4_128 = 0x000003A6
|
||||
CKM_PBE_SHA1_RC4_40 = 0x000003A7
|
||||
CKM_PBE_SHA1_DES3_EDE_CBC = 0x000003A8
|
||||
CKM_PBE_SHA1_DES2_EDE_CBC = 0x000003A9
|
||||
CKM_PBE_SHA1_RC2_128_CBC = 0x000003AA
|
||||
CKM_PBE_SHA1_RC2_40_CBC = 0x000003AB
|
||||
CKM_PKCS5_PBKD2 = 0x000003B0
|
||||
CKM_PBA_SHA1_WITH_SHA1_HMAC = 0x000003C0
|
||||
CKM_WTLS_PRE_MASTER_KEY_GEN = 0x000003D0
|
||||
CKM_WTLS_MASTER_KEY_DERIVE = 0x000003D1
|
||||
CKM_WTLS_MASTER_KEY_DERIVE_DH_ECC = 0x000003D2
|
||||
CKM_WTLS_PRF = 0x000003D3
|
||||
CKM_WTLS_SERVER_KEY_AND_MAC_DERIVE = 0x000003D4
|
||||
CKM_WTLS_CLIENT_KEY_AND_MAC_DERIVE = 0x000003D5
|
||||
CKM_TLS10_MAC_SERVER = 0x000003D6
|
||||
CKM_TLS10_MAC_CLIENT = 0x000003D7
|
||||
CKM_TLS12_MAC = 0x000003D8
|
||||
CKM_TLS12_KDF = 0x000003D9
|
||||
CKM_TLS12_MASTER_KEY_DERIVE = 0x000003E0
|
||||
CKM_TLS12_KEY_AND_MAC_DERIVE = 0x000003E1
|
||||
CKM_TLS12_MASTER_KEY_DERIVE_DH = 0x000003E2
|
||||
CKM_TLS12_KEY_SAFE_DERIVE = 0x000003E3
|
||||
CKM_TLS_MAC = 0x000003E4
|
||||
CKM_TLS_KDF = 0x000003E5
|
||||
CKM_KEY_WRAP_LYNKS = 0x00000400
|
||||
CKM_KEY_WRAP_SET_OAEP = 0x00000401
|
||||
CKM_CMS_SIG = 0x00000500
|
||||
CKM_KIP_DERIVE = 0x00000510
|
||||
CKM_KIP_WRAP = 0x00000511
|
||||
CKM_KIP_MAC = 0x00000512
|
||||
CKM_CAMELLIA_KEY_GEN = 0x00000550
|
||||
CKM_CAMELLIA_ECB = 0x00000551
|
||||
CKM_CAMELLIA_CBC = 0x00000552
|
||||
CKM_CAMELLIA_MAC = 0x00000553
|
||||
CKM_CAMELLIA_MAC_GENERAL = 0x00000554
|
||||
CKM_CAMELLIA_CBC_PAD = 0x00000555
|
||||
CKM_CAMELLIA_ECB_ENCRYPT_DATA = 0x00000556
|
||||
CKM_CAMELLIA_CBC_ENCRYPT_DATA = 0x00000557
|
||||
CKM_CAMELLIA_CTR = 0x00000558
|
||||
CKM_ARIA_KEY_GEN = 0x00000560
|
||||
CKM_ARIA_ECB = 0x00000561
|
||||
CKM_ARIA_CBC = 0x00000562
|
||||
CKM_ARIA_MAC = 0x00000563
|
||||
CKM_ARIA_MAC_GENERAL = 0x00000564
|
||||
CKM_ARIA_CBC_PAD = 0x00000565
|
||||
CKM_ARIA_ECB_ENCRYPT_DATA = 0x00000566
|
||||
CKM_ARIA_CBC_ENCRYPT_DATA = 0x00000567
|
||||
CKM_SEED_KEY_GEN = 0x00000650
|
||||
CKM_SEED_ECB = 0x00000651
|
||||
CKM_SEED_CBC = 0x00000652
|
||||
CKM_SEED_MAC = 0x00000653
|
||||
CKM_SEED_MAC_GENERAL = 0x00000654
|
||||
CKM_SEED_CBC_PAD = 0x00000655
|
||||
CKM_SEED_ECB_ENCRYPT_DATA = 0x00000656
|
||||
CKM_SEED_CBC_ENCRYPT_DATA = 0x00000657
|
||||
CKM_SKIPJACK_KEY_GEN = 0x00001000
|
||||
CKM_SKIPJACK_ECB64 = 0x00001001
|
||||
CKM_SKIPJACK_CBC64 = 0x00001002
|
||||
CKM_SKIPJACK_OFB64 = 0x00001003
|
||||
CKM_SKIPJACK_CFB64 = 0x00001004
|
||||
CKM_SKIPJACK_CFB32 = 0x00001005
|
||||
CKM_SKIPJACK_CFB16 = 0x00001006
|
||||
CKM_SKIPJACK_CFB8 = 0x00001007
|
||||
CKM_SKIPJACK_WRAP = 0x00001008
|
||||
CKM_SKIPJACK_PRIVATE_WRAP = 0x00001009
|
||||
CKM_SKIPJACK_RELAYX = 0x0000100a
|
||||
CKM_KEA_KEY_PAIR_GEN = 0x00001010
|
||||
CKM_KEA_KEY_DERIVE = 0x00001011
|
||||
CKM_KEA_DERIVE = 0x00001012
|
||||
CKM_FORTEZZA_TIMESTAMP = 0x00001020
|
||||
CKM_BATON_KEY_GEN = 0x00001030
|
||||
CKM_BATON_ECB128 = 0x00001031
|
||||
CKM_BATON_ECB96 = 0x00001032
|
||||
CKM_BATON_CBC128 = 0x00001033
|
||||
CKM_BATON_COUNTER = 0x00001034
|
||||
CKM_BATON_SHUFFLE = 0x00001035
|
||||
CKM_BATON_WRAP = 0x00001036
|
||||
CKM_ECDSA_KEY_PAIR_GEN = 0x00001040 // Deprecated
|
||||
CKM_EC_KEY_PAIR_GEN = 0x00001040
|
||||
CKM_ECDSA = 0x00001041
|
||||
CKM_ECDSA_SHA1 = 0x00001042
|
||||
CKM_ECDSA_SHA224 = 0x00001043
|
||||
CKM_ECDSA_SHA256 = 0x00001044
|
||||
CKM_ECDSA_SHA384 = 0x00001045
|
||||
CKM_ECDSA_SHA512 = 0x00001046
|
||||
CKM_ECDH1_DERIVE = 0x00001050
|
||||
CKM_ECDH1_COFACTOR_DERIVE = 0x00001051
|
||||
CKM_ECMQV_DERIVE = 0x00001052
|
||||
CKM_ECDH_AES_KEY_WRAP = 0x00001053
|
||||
CKM_RSA_AES_KEY_WRAP = 0x00001054
|
||||
CKM_JUNIPER_KEY_GEN = 0x00001060
|
||||
CKM_JUNIPER_ECB128 = 0x00001061
|
||||
CKM_JUNIPER_CBC128 = 0x00001062
|
||||
CKM_JUNIPER_COUNTER = 0x00001063
|
||||
CKM_JUNIPER_SHUFFLE = 0x00001064
|
||||
CKM_JUNIPER_WRAP = 0x00001065
|
||||
CKM_FASTHASH = 0x00001070
|
||||
CKM_AES_KEY_GEN = 0x00001080
|
||||
CKM_AES_ECB = 0x00001081
|
||||
CKM_AES_CBC = 0x00001082
|
||||
CKM_AES_MAC = 0x00001083
|
||||
CKM_AES_MAC_GENERAL = 0x00001084
|
||||
CKM_AES_CBC_PAD = 0x00001085
|
||||
CKM_AES_CTR = 0x00001086
|
||||
CKM_AES_GCM = 0x00001087
|
||||
CKM_AES_CCM = 0x00001088
|
||||
CKM_AES_CTS = 0x00001089
|
||||
CKM_AES_CMAC = 0x0000108A
|
||||
CKM_AES_CMAC_GENERAL = 0x0000108B
|
||||
CKM_AES_XCBC_MAC = 0x0000108C
|
||||
CKM_AES_XCBC_MAC_96 = 0x0000108D
|
||||
CKM_AES_GMAC = 0x0000108E
|
||||
CKM_BLOWFISH_KEY_GEN = 0x00001090
|
||||
CKM_BLOWFISH_CBC = 0x00001091
|
||||
CKM_TWOFISH_KEY_GEN = 0x00001092
|
||||
CKM_TWOFISH_CBC = 0x00001093
|
||||
CKM_BLOWFISH_CBC_PAD = 0x00001094
|
||||
CKM_TWOFISH_CBC_PAD = 0x00001095
|
||||
CKM_DES_ECB_ENCRYPT_DATA = 0x00001100
|
||||
CKM_DES_CBC_ENCRYPT_DATA = 0x00001101
|
||||
CKM_DES3_ECB_ENCRYPT_DATA = 0x00001102
|
||||
CKM_DES3_CBC_ENCRYPT_DATA = 0x00001103
|
||||
CKM_AES_ECB_ENCRYPT_DATA = 0x00001104
|
||||
CKM_AES_CBC_ENCRYPT_DATA = 0x00001105
|
||||
CKM_GOSTR3410_KEY_PAIR_GEN = 0x00001200
|
||||
CKM_GOSTR3410 = 0x00001201
|
||||
CKM_GOSTR3410_WITH_GOSTR3411 = 0x00001202
|
||||
CKM_GOSTR3410_KEY_WRAP = 0x00001203
|
||||
CKM_GOSTR3410_DERIVE = 0x00001204
|
||||
CKM_GOSTR3411 = 0x00001210
|
||||
CKM_GOSTR3411_HMAC = 0x00001211
|
||||
CKM_GOST28147_KEY_GEN = 0x00001220
|
||||
CKM_GOST28147_ECB = 0x00001221
|
||||
CKM_GOST28147 = 0x00001222
|
||||
CKM_GOST28147_MAC = 0x00001223
|
||||
CKM_GOST28147_KEY_WRAP = 0x00001224
|
||||
CKM_DSA_PARAMETER_GEN = 0x00002000
|
||||
CKM_DH_PKCS_PARAMETER_GEN = 0x00002001
|
||||
CKM_X9_42_DH_PARAMETER_GEN = 0x00002002
|
||||
CKM_DSA_PROBABLISTIC_PARAMETER_GEN = 0x00002003
|
||||
CKM_DSA_SHAWE_TAYLOR_PARAMETER_GEN = 0x00002004
|
||||
CKM_AES_OFB = 0x00002104
|
||||
CKM_AES_CFB64 = 0x00002105
|
||||
CKM_AES_CFB8 = 0x00002106
|
||||
CKM_AES_CFB128 = 0x00002107
|
||||
CKM_AES_CFB1 = 0x00002108
|
||||
CKM_AES_KEY_WRAP = 0x00002109
|
||||
CKM_AES_KEY_WRAP_PAD = 0x0000210A
|
||||
CKM_RSA_PKCS_TPM_1_1 = 0x00004001
|
||||
CKM_RSA_PKCS_OAEP_TPM_1_1 = 0x00004002
|
||||
CKM_VENDOR_DEFINED = 0x80000000
|
||||
CKF_HW = 0x00000001
|
||||
CKF_ENCRYPT = 0x00000100
|
||||
CKF_DECRYPT = 0x00000200
|
||||
CKF_DIGEST = 0x00000400
|
||||
CKF_SIGN = 0x00000800
|
||||
CKF_SIGN_RECOVER = 0x00001000
|
||||
CKF_VERIFY = 0x00002000
|
||||
CKF_VERIFY_RECOVER = 0x00004000
|
||||
CKF_GENERATE = 0x00008000
|
||||
CKF_GENERATE_KEY_PAIR = 0x00010000
|
||||
CKF_WRAP = 0x00020000
|
||||
CKF_UNWRAP = 0x00040000
|
||||
CKF_DERIVE = 0x00080000
|
||||
CKF_EC_F_P = 0x00100000
|
||||
CKF_EC_F_2M = 0x00200000
|
||||
CKF_EC_ECPARAMETERS = 0x00400000
|
||||
CKF_EC_NAMEDCURVE = 0x00800000
|
||||
CKF_EC_UNCOMPRESS = 0x01000000
|
||||
CKF_EC_COMPRESS = 0x02000000
|
||||
CKF_EXTENSION = 0x80000000
|
||||
CKR_OK = 0x00000000
|
||||
CKR_CANCEL = 0x00000001
|
||||
CKR_HOST_MEMORY = 0x00000002
|
||||
CKR_SLOT_ID_INVALID = 0x00000003
|
||||
CKR_GENERAL_ERROR = 0x00000005
|
||||
CKR_FUNCTION_FAILED = 0x00000006
|
||||
CKR_ARGUMENTS_BAD = 0x00000007
|
||||
CKR_NO_EVENT = 0x00000008
|
||||
CKR_NEED_TO_CREATE_THREADS = 0x00000009
|
||||
CKR_CANT_LOCK = 0x0000000A
|
||||
CKR_ATTRIBUTE_READ_ONLY = 0x00000010
|
||||
CKR_ATTRIBUTE_SENSITIVE = 0x00000011
|
||||
CKR_ATTRIBUTE_TYPE_INVALID = 0x00000012
|
||||
CKR_ATTRIBUTE_VALUE_INVALID = 0x00000013
|
||||
CKR_ACTION_PROHIBITED = 0x0000001B
|
||||
CKR_DATA_INVALID = 0x00000020
|
||||
CKR_DATA_LEN_RANGE = 0x00000021
|
||||
CKR_DEVICE_ERROR = 0x00000030
|
||||
CKR_DEVICE_MEMORY = 0x00000031
|
||||
CKR_DEVICE_REMOVED = 0x00000032
|
||||
CKR_ENCRYPTED_DATA_INVALID = 0x00000040
|
||||
CKR_ENCRYPTED_DATA_LEN_RANGE = 0x00000041
|
||||
CKR_FUNCTION_CANCELED = 0x00000050
|
||||
CKR_FUNCTION_NOT_PARALLEL = 0x00000051
|
||||
CKR_FUNCTION_NOT_SUPPORTED = 0x00000054
|
||||
CKR_KEY_HANDLE_INVALID = 0x00000060
|
||||
CKR_KEY_SIZE_RANGE = 0x00000062
|
||||
CKR_KEY_TYPE_INCONSISTENT = 0x00000063
|
||||
CKR_KEY_NOT_NEEDED = 0x00000064
|
||||
CKR_KEY_CHANGED = 0x00000065
|
||||
CKR_KEY_NEEDED = 0x00000066
|
||||
CKR_KEY_INDIGESTIBLE = 0x00000067
|
||||
CKR_KEY_FUNCTION_NOT_PERMITTED = 0x00000068
|
||||
CKR_KEY_NOT_WRAPPABLE = 0x00000069
|
||||
CKR_KEY_UNEXTRACTABLE = 0x0000006A
|
||||
CKR_MECHANISM_INVALID = 0x00000070
|
||||
CKR_MECHANISM_PARAM_INVALID = 0x00000071
|
||||
CKR_OBJECT_HANDLE_INVALID = 0x00000082
|
||||
CKR_OPERATION_ACTIVE = 0x00000090
|
||||
CKR_OPERATION_NOT_INITIALIZED = 0x00000091
|
||||
CKR_PIN_INCORRECT = 0x000000A0
|
||||
CKR_PIN_INVALID = 0x000000A1
|
||||
CKR_PIN_LEN_RANGE = 0x000000A2
|
||||
CKR_PIN_EXPIRED = 0x000000A3
|
||||
CKR_PIN_LOCKED = 0x000000A4
|
||||
CKR_SESSION_CLOSED = 0x000000B0
|
||||
CKR_SESSION_COUNT = 0x000000B1
|
||||
CKR_SESSION_HANDLE_INVALID = 0x000000B3
|
||||
CKR_SESSION_PARALLEL_NOT_SUPPORTED = 0x000000B4
|
||||
CKR_SESSION_READ_ONLY = 0x000000B5
|
||||
CKR_SESSION_EXISTS = 0x000000B6
|
||||
CKR_SESSION_READ_ONLY_EXISTS = 0x000000B7
|
||||
CKR_SESSION_READ_WRITE_SO_EXISTS = 0x000000B8
|
||||
CKR_SIGNATURE_INVALID = 0x000000C0
|
||||
CKR_SIGNATURE_LEN_RANGE = 0x000000C1
|
||||
CKR_TEMPLATE_INCOMPLETE = 0x000000D0
|
||||
CKR_TEMPLATE_INCONSISTENT = 0x000000D1
|
||||
CKR_TOKEN_NOT_PRESENT = 0x000000E0
|
||||
CKR_TOKEN_NOT_RECOGNIZED = 0x000000E1
|
||||
CKR_TOKEN_WRITE_PROTECTED = 0x000000E2
|
||||
CKR_UNWRAPPING_KEY_HANDLE_INVALID = 0x000000F0
|
||||
CKR_UNWRAPPING_KEY_SIZE_RANGE = 0x000000F1
|
||||
CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT = 0x000000F2
|
||||
CKR_USER_ALREADY_LOGGED_IN = 0x00000100
|
||||
CKR_USER_NOT_LOGGED_IN = 0x00000101
|
||||
CKR_USER_PIN_NOT_INITIALIZED = 0x00000102
|
||||
CKR_USER_TYPE_INVALID = 0x00000103
|
||||
CKR_USER_ANOTHER_ALREADY_LOGGED_IN = 0x00000104
|
||||
CKR_USER_TOO_MANY_TYPES = 0x00000105
|
||||
CKR_WRAPPED_KEY_INVALID = 0x00000110
|
||||
CKR_WRAPPED_KEY_LEN_RANGE = 0x00000112
|
||||
CKR_WRAPPING_KEY_HANDLE_INVALID = 0x00000113
|
||||
CKR_WRAPPING_KEY_SIZE_RANGE = 0x00000114
|
||||
CKR_WRAPPING_KEY_TYPE_INCONSISTENT = 0x00000115
|
||||
CKR_RANDOM_SEED_NOT_SUPPORTED = 0x00000120
|
||||
CKR_RANDOM_NO_RNG = 0x00000121
|
||||
CKR_DOMAIN_PARAMS_INVALID = 0x00000130
|
||||
CKR_CURVE_NOT_SUPPORTED = 0x00000140
|
||||
CKR_BUFFER_TOO_SMALL = 0x00000150
|
||||
CKR_SAVED_STATE_INVALID = 0x00000160
|
||||
CKR_INFORMATION_SENSITIVE = 0x00000170
|
||||
CKR_STATE_UNSAVEABLE = 0x00000180
|
||||
CKR_CRYPTOKI_NOT_INITIALIZED = 0x00000190
|
||||
CKR_CRYPTOKI_ALREADY_INITIALIZED = 0x00000191
|
||||
CKR_MUTEX_BAD = 0x000001A0
|
||||
CKR_MUTEX_NOT_LOCKED = 0x000001A1
|
||||
CKR_NEW_PIN_MODE = 0x000001B0
|
||||
CKR_NEXT_OTP = 0x000001B1
|
||||
CKR_EXCEEDED_MAX_ITERATIONS = 0x000001B5
|
||||
CKR_FIPS_SELF_TEST_FAILED = 0x000001B6
|
||||
CKR_LIBRARY_LOAD_FAILED = 0x000001B7
|
||||
CKR_PIN_TOO_WEAK = 0x000001B8
|
||||
CKR_PUBLIC_KEY_INVALID = 0x000001B9
|
||||
CKR_FUNCTION_REJECTED = 0x00000200
|
||||
CKR_VENDOR_DEFINED = 0x80000000
|
||||
CKF_LIBRARY_CANT_CREATE_OS_THREADS = 0x00000001
|
||||
CKF_OS_LOCKING_OK = 0x00000002
|
||||
CKF_DONT_BLOCK = 1
|
||||
CKG_MGF1_SHA1 = 0x00000001
|
||||
CKG_MGF1_SHA256 = 0x00000002
|
||||
CKG_MGF1_SHA384 = 0x00000003
|
||||
CKG_MGF1_SHA512 = 0x00000004
|
||||
CKG_MGF1_SHA224 = 0x00000005
|
||||
CKZ_DATA_SPECIFIED = 0x00000001
|
||||
CKD_NULL = 0x00000001
|
||||
CKD_SHA1_KDF = 0x00000002
|
||||
CKD_SHA1_KDF_ASN1 = 0x00000003
|
||||
CKD_SHA1_KDF_CONCATENATE = 0x00000004
|
||||
CKD_SHA224_KDF = 0x00000005
|
||||
CKD_SHA256_KDF = 0x00000006
|
||||
CKD_SHA384_KDF = 0x00000007
|
||||
CKD_SHA512_KDF = 0x00000008
|
||||
CKD_CPDIVERSIFY_KDF = 0x00000009
|
||||
CKD_SHA3_224_KDF = 0x0000000A
|
||||
CKD_SHA3_256_KDF = 0x0000000B
|
||||
CKD_SHA3_384_KDF = 0x0000000C
|
||||
CKD_SHA3_512_KDF = 0x0000000D
|
||||
CKP_PKCS5_PBKD2_HMAC_SHA1 = 0x00000001
|
||||
CKP_PKCS5_PBKD2_HMAC_GOSTR3411 = 0x00000002
|
||||
CKP_PKCS5_PBKD2_HMAC_SHA224 = 0x00000003
|
||||
CKP_PKCS5_PBKD2_HMAC_SHA256 = 0x00000004
|
||||
CKP_PKCS5_PBKD2_HMAC_SHA384 = 0x00000005
|
||||
CKP_PKCS5_PBKD2_HMAC_SHA512 = 0x00000006
|
||||
CKP_PKCS5_PBKD2_HMAC_SHA512_224 = 0x00000007
|
||||
CKP_PKCS5_PBKD2_HMAC_SHA512_256 = 0x00000008
|
||||
CKZ_SALT_SPECIFIED = 0x00000001
|
||||
CK_OTP_VALUE = 0
|
||||
CK_OTP_PIN = 1
|
||||
CK_OTP_CHALLENGE = 2
|
||||
CK_OTP_TIME = 3
|
||||
CK_OTP_COUNTER = 4
|
||||
CK_OTP_FLAGS = 5
|
||||
CK_OTP_OUTPUT_LENGTH = 6
|
||||
CK_OTP_OUTPUT_FORMAT = 7
|
||||
CKF_NEXT_OTP = 0x00000001
|
||||
CKF_EXCLUDE_TIME = 0x00000002
|
||||
CKF_EXCLUDE_COUNTER = 0x00000004
|
||||
CKF_EXCLUDE_CHALLENGE = 0x00000008
|
||||
CKF_EXCLUDE_PIN = 0x00000010
|
||||
CKF_USER_FRIENDLY_OTP = 0x00000020
|
||||
)
|
||||
2
vendor/github.com/stefanberger/go-pkcs11uri/.gitignore
generated
vendored
2
vendor/github.com/stefanberger/go-pkcs11uri/.gitignore
generated
vendored
@ -1,2 +0,0 @@
|
||||
*~
|
||||
pkcs11uri
|
||||
25
vendor/github.com/stefanberger/go-pkcs11uri/.travis.yml
generated
vendored
25
vendor/github.com/stefanberger/go-pkcs11uri/.travis.yml
generated
vendored
@ -1,25 +0,0 @@
|
||||
dist: bionic
|
||||
language: go
|
||||
|
||||
os:
|
||||
- linux
|
||||
|
||||
go:
|
||||
- "1.13.x"
|
||||
|
||||
matrix:
|
||||
include:
|
||||
- os: linux
|
||||
|
||||
addons:
|
||||
apt:
|
||||
packages:
|
||||
- softhsm2
|
||||
|
||||
install:
|
||||
- curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.30.0
|
||||
|
||||
script:
|
||||
- make
|
||||
- make check
|
||||
- make test
|
||||
177
vendor/github.com/stefanberger/go-pkcs11uri/LICENSE
generated
vendored
177
vendor/github.com/stefanberger/go-pkcs11uri/LICENSE
generated
vendored
@ -1,177 +0,0 @@
|
||||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
https://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
28
vendor/github.com/stefanberger/go-pkcs11uri/Makefile
generated
vendored
28
vendor/github.com/stefanberger/go-pkcs11uri/Makefile
generated
vendored
@ -1,28 +0,0 @@
|
||||
# Copyright IBM Corporation, 2020
|
||||
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
.PHONY: check build test
|
||||
|
||||
all: build
|
||||
|
||||
FORCE:
|
||||
|
||||
check:
|
||||
golangci-lint run
|
||||
|
||||
build:
|
||||
go build ./...
|
||||
|
||||
test:
|
||||
go test ./... -test.v
|
||||
102
vendor/github.com/stefanberger/go-pkcs11uri/README.md
generated
vendored
102
vendor/github.com/stefanberger/go-pkcs11uri/README.md
generated
vendored
@ -1,102 +0,0 @@
|
||||
# go-pkcs11uri
|
||||
|
||||
Welcome to the go-pkcs11uri library. The implementation follows [RFC 7512](https://tools.ietf.org/html/rfc7512) and this [errata](https://www.rfc-editor.org/errata/rfc7512).
|
||||
|
||||
# Exampe usage:
|
||||
|
||||
The following example builds on this library [here](https://github.com/miekg/pkcs11) and are using softhsm2 on Fedora.
|
||||
|
||||
## Example
|
||||
|
||||
This example program extending the one found [here](https://github.com/miekg/pkcs11/blob/master/README.md#examples):
|
||||
|
||||
```
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"strconv"
|
||||
|
||||
"github.com/miekg/pkcs11"
|
||||
pkcs11uri "github.com/stefanberger/go-pkcs11uri"
|
||||
)
|
||||
|
||||
func main() {
|
||||
if len(os.Args) < 2 {
|
||||
panic("Missing pkcs11 URI argument")
|
||||
}
|
||||
uristr := os.Args[1]
|
||||
|
||||
uri, err := pkcs11uri.New()
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
err = uri.Parse(uristr)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
module, err := uri.GetModule()
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
slot, ok := uri.GetPathAttribute("slot-id", false)
|
||||
if !ok {
|
||||
panic("No slot-id in pkcs11 URI")
|
||||
}
|
||||
slotid, err := strconv.Atoi(slot)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
pin, err := uri.GetPIN()
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
p := pkcs11.New(module)
|
||||
err = p.Initialize()
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
defer p.Destroy()
|
||||
defer p.Finalize()
|
||||
|
||||
session, err := p.OpenSession(uint(slotid), pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
defer p.CloseSession(session)
|
||||
|
||||
err = p.Login(session, pkcs11.CKU_USER, pin)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
defer p.Logout(session)
|
||||
|
||||
p.DigestInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_SHA_1, nil)})
|
||||
hash, err := p.Digest(session, []byte("this is a string"))
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
for _, d := range hash {
|
||||
fmt.Printf("%x", d)
|
||||
}
|
||||
fmt.Println()
|
||||
}
|
||||
```
|
||||
|
||||
## Exampe Usage
|
||||
|
||||
```
|
||||
$ sudo softhsm2-util --init-token --slot 1 --label test --pin 1234 --so-pin 1234
|
||||
The token has been initialized and is reassigned to slot 2053753261
|
||||
$ go build ./...
|
||||
$ sudo ./pkcs11-example 'pkcs11:slot-id=2053753261?module-path=/usr/lib64/pkcs11/libsofthsm2.so&pin-value=1234'
|
||||
517592df8fec3ad146a79a9af153db2a4d784ec5
|
||||
```
|
||||
|
||||
453
vendor/github.com/stefanberger/go-pkcs11uri/pkcs11uri.go
generated
vendored
453
vendor/github.com/stefanberger/go-pkcs11uri/pkcs11uri.go
generated
vendored
@ -1,453 +0,0 @@
|
||||
/*
|
||||
(c) Copyright IBM Corporation, 2020
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package pkcs11uri
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// Pkcs11URI holds a pkcs11 URI object
|
||||
type Pkcs11URI struct {
|
||||
// path and query attributes may have custom attributes that either
|
||||
// have to be in the query or in the path part, so we use two maps
|
||||
pathAttributes map[string]string
|
||||
queryAttributes map[string]string
|
||||
// directories to search for pkcs11 modules
|
||||
moduleDirectories []string
|
||||
// file paths of allowed pkcs11 modules
|
||||
allowedModulePaths []string
|
||||
// whether any module is allowed to be loaded
|
||||
allowAnyModule bool
|
||||
// A map of environment variables needed by the pkcs11 module using this URI.
|
||||
// This map is not needed by this implementation but is there for convenience.
|
||||
env map[string]string
|
||||
}
|
||||
|
||||
// upper character hex digits needed for pct-encoding
|
||||
const hex = "0123456789ABCDEF"
|
||||
|
||||
// escapeAll pct-escapes all characters in the string
|
||||
func escapeAll(s string) string {
|
||||
res := make([]byte, len(s)*3)
|
||||
j := 0
|
||||
for i := 0; i < len(s); i++ {
|
||||
c := s[i]
|
||||
res[j] = '%'
|
||||
res[j+1] = hex[c>>4]
|
||||
res[j+2] = hex[c&0xf]
|
||||
j += 3
|
||||
}
|
||||
return string(res)
|
||||
}
|
||||
|
||||
// escape pct-escapes the path and query part of the pkcs11 URI following the different rules of the
|
||||
// path and query part as decribed in RFC 7512 sec. 2.3
|
||||
func escape(s string, isPath bool) string {
|
||||
res := make([]byte, len(s)*3)
|
||||
j := 0
|
||||
for i := 0; i < len(s); i++ {
|
||||
c := s[i]
|
||||
// unreserved per RFC 3986 sec. 2.3
|
||||
if (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') {
|
||||
res[j] = c
|
||||
} else if isPath && c == '&' {
|
||||
res[j] = c
|
||||
} else if !isPath && (c == '/' || c == '?' || c == '|') {
|
||||
res[j] = c
|
||||
} else {
|
||||
switch c {
|
||||
case '-', '.', '_', '~': // unreserved per RFC 3986 sec. 2.3
|
||||
res[j] = c
|
||||
case ':', '[', ']', '@', '!', '$', '\'', '(', ')', '*', '+', ',', '=':
|
||||
res[j] = c
|
||||
default:
|
||||
res[j] = '%'
|
||||
res[j+1] = hex[c>>4]
|
||||
res[j+2] = hex[c&0xf]
|
||||
j += 2
|
||||
}
|
||||
}
|
||||
j++
|
||||
}
|
||||
return string(res[:j])
|
||||
}
|
||||
|
||||
// New creates a new Pkcs11URI object
|
||||
func New() *Pkcs11URI {
|
||||
return &Pkcs11URI{
|
||||
pathAttributes: make(map[string]string),
|
||||
queryAttributes: make(map[string]string),
|
||||
env: make(map[string]string),
|
||||
}
|
||||
}
|
||||
|
||||
func (uri *Pkcs11URI) setAttribute(attrMap map[string]string, name, value string) error {
|
||||
v, err := url.PathUnescape(value)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
attrMap[name] = v
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetPathAttribute returns the value of a path attribute in unescaped form or
|
||||
// pct-encoded form
|
||||
func (uri *Pkcs11URI) GetPathAttribute(name string, pctencode bool) (string, bool) {
|
||||
v, ok := uri.pathAttributes[name]
|
||||
if ok && pctencode {
|
||||
v = escape(v, true)
|
||||
}
|
||||
return v, ok
|
||||
}
|
||||
|
||||
// SetPathAttribute sets the value for a path attribute; this function may return an error
|
||||
// if the given value cannot be pct-unescaped
|
||||
func (uri *Pkcs11URI) SetPathAttribute(name, value string) error {
|
||||
return uri.setAttribute(uri.pathAttributes, name, value)
|
||||
}
|
||||
|
||||
// AddPathAttribute adds a path attribute; it returns an error if an attribute with the same
|
||||
// name already existed or if the given value cannot be pct-unescaped
|
||||
func (uri *Pkcs11URI) AddPathAttribute(name, value string) error {
|
||||
if _, ok := uri.pathAttributes[name]; ok {
|
||||
return errors.New("duplicate path attribute")
|
||||
}
|
||||
return uri.SetPathAttribute(name, value)
|
||||
}
|
||||
|
||||
// RemovePathAttribute removes a path attribute
|
||||
func (uri *Pkcs11URI) RemovePathAttribute(name string) {
|
||||
delete(uri.pathAttributes, name)
|
||||
}
|
||||
|
||||
// AddEnv adds an environment variable for the pkcs11 module
|
||||
func (uri *Pkcs11URI) AddEnv(name, value string) {
|
||||
uri.env[name] = value
|
||||
}
|
||||
|
||||
// SetEnvMap sets the environment variables for the pkcs11 module
|
||||
func (uri *Pkcs11URI) SetEnvMap(env map[string]string) {
|
||||
uri.env = env
|
||||
}
|
||||
|
||||
// GetEnvMap returns the map of environment variables
|
||||
func (uri *Pkcs11URI) GetEnvMap() map[string]string {
|
||||
return uri.env
|
||||
}
|
||||
|
||||
// GetQueryAttribute returns the value of a query attribute in unescaped or
|
||||
// pct-encoded form
|
||||
func (uri *Pkcs11URI) GetQueryAttribute(name string, pctencode bool) (string, bool) {
|
||||
v, ok := uri.queryAttributes[name]
|
||||
if ok && pctencode {
|
||||
v = escape(v, false)
|
||||
}
|
||||
return v, ok
|
||||
}
|
||||
|
||||
// SetQueryAttribute sets the value for a query attribute; this function may return an error
|
||||
// if the given value cannot pct-unescaped
|
||||
func (uri *Pkcs11URI) SetQueryAttribute(name, value string) error {
|
||||
return uri.setAttribute(uri.queryAttributes, name, value)
|
||||
}
|
||||
|
||||
// AddQueryAttribute adds a query attribute; it returns an error if an attribute with the same
|
||||
// name already existed or if the given value cannot be pct-unescaped
|
||||
func (uri *Pkcs11URI) AddQueryAttribute(name, value string) error {
|
||||
if _, ok := uri.queryAttributes[name]; ok {
|
||||
return errors.New("duplicate query attribute")
|
||||
}
|
||||
return uri.SetQueryAttribute(name, value)
|
||||
}
|
||||
|
||||
// RemoveQueryAttribute removes a path attribute
|
||||
func (uri *Pkcs11URI) RemoveQueryAttribute(name string) {
|
||||
delete(uri.queryAttributes, name)
|
||||
}
|
||||
|
||||
// Validate validates a Pkcs11URI object's attributes following RFC 7512 rules and proper formatting of
|
||||
// their values
|
||||
func (uri *Pkcs11URI) Validate() error {
|
||||
/* RFC 7512: 2.3 */
|
||||
/* slot-id should be DIGIT, but we go for number */
|
||||
if v, ok := uri.pathAttributes["slot-id"]; ok {
|
||||
if _, err := strconv.Atoi(v); err != nil {
|
||||
return fmt.Errorf("slot-id must be a number: %s", v)
|
||||
}
|
||||
}
|
||||
|
||||
/* library-version should 1*DIGIT [ "." 1 *DIGIT ]; allow NUMBERS for DIGIT */
|
||||
if v, ok := uri.pathAttributes["library-version"]; ok {
|
||||
m, err := regexp.Match("^[0-9]+(\\.[0-9]+)?$", []byte(v))
|
||||
if err != nil || !m {
|
||||
return fmt.Errorf("Invalid format for library-version '%s'", v)
|
||||
}
|
||||
}
|
||||
|
||||
if v, ok := uri.pathAttributes["type"]; ok {
|
||||
m, err := regexp.Match("^(public|private|cert|secret-key}data)?$", []byte(v))
|
||||
if err != nil || !m {
|
||||
return fmt.Errorf("Invalid type '%s'", v)
|
||||
}
|
||||
}
|
||||
|
||||
/* RFC 7512: 2.4 */
|
||||
_, ok1 := uri.queryAttributes["pin-source"]
|
||||
_, ok2 := uri.queryAttributes["pin-value"]
|
||||
if ok1 && ok2 {
|
||||
return errors.New("URI must not contain pin-source and pin-value")
|
||||
}
|
||||
|
||||
if v, ok := uri.queryAttributes["module-path"]; ok {
|
||||
if !filepath.IsAbs(v) {
|
||||
return fmt.Errorf("path %s of module-name attribute must be absolute", v)
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// HasPIN allows the user to check whether a PIN has been provided either by the pin-value or the pin-source
|
||||
// attributes. It should be called before GetPIN(), which may still fail getting the PIN from a file for example.
|
||||
func (uri *Pkcs11URI) HasPIN() bool {
|
||||
_, ok := uri.queryAttributes["pin-value"]
|
||||
if ok {
|
||||
return true
|
||||
}
|
||||
_, ok = uri.queryAttributes["pin-source"]
|
||||
return ok
|
||||
}
|
||||
|
||||
// GetPIN gets the PIN from either the pin-value or pin-source attribute; a user may want to call HasPIN()
|
||||
// before calling this function to determine whether a PIN has been provided at all so that an error code
|
||||
// returned by this function indicates that the PIN value could not be retrieved.
|
||||
func (uri *Pkcs11URI) GetPIN() (string, error) {
|
||||
if v, ok := uri.queryAttributes["pin-value"]; ok {
|
||||
return v, nil
|
||||
}
|
||||
if v, ok := uri.queryAttributes["pin-source"]; ok {
|
||||
pinuri, err := url.ParseRequestURI(v)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("Could not parse pin-source: %s ", err)
|
||||
}
|
||||
switch pinuri.Scheme {
|
||||
case "", "file":
|
||||
if !filepath.IsAbs(pinuri.Path) {
|
||||
return "", fmt.Errorf("PIN URI path '%s' is not absolute", pinuri.Path)
|
||||
}
|
||||
pin, err := ioutil.ReadFile(pinuri.Path)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("Could not open PIN file: %s", err)
|
||||
}
|
||||
return string(pin), nil
|
||||
default:
|
||||
return "", fmt.Errorf("PIN URI scheme %s is not supported", pinuri.Scheme)
|
||||
}
|
||||
}
|
||||
return "", fmt.Errorf("Neither pin-source nor pin-value are available")
|
||||
}
|
||||
|
||||
// Parse parses a pkcs11: URI string
|
||||
func (uri *Pkcs11URI) Parse(uristring string) error {
|
||||
if !strings.HasPrefix(uristring, "pkcs11:") {
|
||||
return errors.New("Malformed pkcs11 URI: missing pcks11: prefix")
|
||||
}
|
||||
|
||||
parts := strings.SplitN(uristring[7:], "?", 2)
|
||||
|
||||
uri.pathAttributes = make(map[string]string)
|
||||
uri.queryAttributes = make(map[string]string)
|
||||
|
||||
if len(parts[0]) > 0 {
|
||||
/* parse path part */
|
||||
for _, part := range strings.Split(parts[0], ";") {
|
||||
p := strings.SplitN(part, "=", 2)
|
||||
if len(p) != 2 {
|
||||
return errors.New("Malformed pkcs11 URI: malformed path attribute")
|
||||
}
|
||||
if err := uri.AddPathAttribute(p[0], p[1]); err != nil {
|
||||
return fmt.Errorf("Malformed pkcs11 URI: %s", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if len(parts) == 2 {
|
||||
/* parse query part */
|
||||
for _, part := range strings.Split(parts[1], "&") {
|
||||
p := strings.SplitN(part, "=", 2)
|
||||
if len(p) != 2 {
|
||||
return errors.New("Malformed pkcs11 URI: malformed query attribute")
|
||||
}
|
||||
if err := uri.AddQueryAttribute(p[0], p[1]); err != nil {
|
||||
return fmt.Errorf("Malformed pkcs11 URI: %s", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
return uri.Validate()
|
||||
}
|
||||
|
||||
// formatAttribute formats attributes and escapes their values as needed
|
||||
func formatAttributes(attrMap map[string]string, ispath bool) string {
|
||||
res := ""
|
||||
for key, value := range attrMap {
|
||||
switch key {
|
||||
case "id":
|
||||
/* id is always pct-encoded */
|
||||
value = escapeAll(value)
|
||||
default:
|
||||
if ispath {
|
||||
value = escape(value, true)
|
||||
} else {
|
||||
value = escape(value, false)
|
||||
}
|
||||
}
|
||||
if len(res) > 0 {
|
||||
if ispath {
|
||||
res += ";"
|
||||
} else {
|
||||
res += "&"
|
||||
}
|
||||
}
|
||||
res += key + "=" + value
|
||||
}
|
||||
return res
|
||||
}
|
||||
|
||||
// Format formats a Pkcs11URI to it string representaion
|
||||
func (uri *Pkcs11URI) Format() (string, error) {
|
||||
if err := uri.Validate(); err != nil {
|
||||
return "", err
|
||||
}
|
||||
result := "pkcs11:" + formatAttributes(uri.pathAttributes, true)
|
||||
if len(uri.queryAttributes) > 0 {
|
||||
result += "?" + formatAttributes(uri.queryAttributes, false)
|
||||
}
|
||||
return result, nil
|
||||
}
|
||||
|
||||
// SetModuleDirectories sets the search directories for pkcs11 modules
|
||||
func (uri *Pkcs11URI) SetModuleDirectories(moduleDirectories []string) {
|
||||
uri.moduleDirectories = moduleDirectories
|
||||
}
|
||||
|
||||
// GetModuleDirectories gets the search directories for pkcs11 modules
|
||||
func (uri *Pkcs11URI) GetModuleDirectories() []string {
|
||||
return uri.moduleDirectories
|
||||
}
|
||||
|
||||
// SetAllowedModulePaths sets allowed module paths to restrict access to modules.
|
||||
// Directory entries must end with a '/', all other ones are assumed to be file entries.
|
||||
// Allowed modules are filtered by string matching.
|
||||
func (uri *Pkcs11URI) SetAllowedModulePaths(allowedModulePaths []string) {
|
||||
uri.allowedModulePaths = allowedModulePaths
|
||||
}
|
||||
|
||||
// SetAllowAnyModule allows any module to be loaded; by default this is not allowed
|
||||
func (uri *Pkcs11URI) SetAllowAnyModule(allowAnyModule bool) {
|
||||
uri.allowAnyModule = allowAnyModule
|
||||
}
|
||||
|
||||
func (uri *Pkcs11URI) isAllowedPath(path string, allowedPaths []string) bool {
|
||||
if uri.allowAnyModule {
|
||||
return true
|
||||
}
|
||||
for _, allowedPath := range allowedPaths {
|
||||
if allowedPath == path {
|
||||
// exact filename match
|
||||
return true
|
||||
}
|
||||
if allowedPath[len(allowedPath)-1] == '/' && strings.HasPrefix(path, allowedPath) {
|
||||
// allowedPath no subdirectory is allowed
|
||||
idx := strings.IndexRune(path[len(allowedPath):], os.PathSeparator)
|
||||
if idx < 0 {
|
||||
return true
|
||||
}
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// GetModule returns the module to use or an error in case no module could be found.
|
||||
// First the module-path is checked for whether it holds an absolute that can be read
|
||||
// by the current user. If this is the case the module is returned. Otherwise either the module-path
|
||||
// is used or the user-provided module path is used to match a module containing what is set in the
|
||||
// attribute module-name.
|
||||
func (uri *Pkcs11URI) GetModule() (string, error) {
|
||||
var searchdirs []string
|
||||
v, ok := uri.queryAttributes["module-path"]
|
||||
|
||||
if ok {
|
||||
info, err := os.Stat(v)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("module-path '%s' is not accessible", v)
|
||||
}
|
||||
if err == nil && info.Mode().IsRegular() {
|
||||
// it's a file
|
||||
if uri.isAllowedPath(v, uri.allowedModulePaths) {
|
||||
return v, nil
|
||||
}
|
||||
return "", fmt.Errorf("module-path '%s' is not allowed by policy", v)
|
||||
}
|
||||
if !info.IsDir() {
|
||||
return "", fmt.Errorf("module-path '%s' points to an invalid file type", v)
|
||||
}
|
||||
// v is a directory
|
||||
searchdirs = []string{v}
|
||||
} else {
|
||||
searchdirs = uri.GetModuleDirectories()
|
||||
}
|
||||
|
||||
moduleName, ok := uri.queryAttributes["module-name"]
|
||||
if !ok {
|
||||
return "", fmt.Errorf("module-name attribute is not set")
|
||||
}
|
||||
moduleName = strings.ToLower(moduleName)
|
||||
|
||||
for _, dir := range searchdirs {
|
||||
files, err := ioutil.ReadDir(dir)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
for _, file := range files {
|
||||
fileLower := strings.ToLower(file.Name())
|
||||
|
||||
i := strings.Index(fileLower, moduleName)
|
||||
if i < 0 {
|
||||
continue
|
||||
}
|
||||
// we require that the fileLower ends with moduleName or that
|
||||
// a suffix follows so that softhsm will not match libsofthsm2.so but only
|
||||
// libsofthsm.so
|
||||
if len(fileLower) == i+len(moduleName) || fileLower[i+len(moduleName)] == '.' {
|
||||
f := filepath.Join(dir, file.Name())
|
||||
if uri.isAllowedPath(f, uri.allowedModulePaths) {
|
||||
return f, nil
|
||||
}
|
||||
return "", fmt.Errorf("module '%s' is not allowed by policy", f)
|
||||
}
|
||||
}
|
||||
}
|
||||
return "", fmt.Errorf("No module could be found")
|
||||
}
|
||||
24
vendor/go.mozilla.org/pkcs7/.gitignore
generated
vendored
24
vendor/go.mozilla.org/pkcs7/.gitignore
generated
vendored
@ -1,24 +0,0 @@
|
||||
# Compiled Object files, Static and Dynamic libs (Shared Objects)
|
||||
*.o
|
||||
*.a
|
||||
*.so
|
||||
|
||||
# Folders
|
||||
_obj
|
||||
_test
|
||||
|
||||
# Architecture specific extensions/prefixes
|
||||
*.[568vq]
|
||||
[568vq].out
|
||||
|
||||
*.cgo1.go
|
||||
*.cgo2.c
|
||||
_cgo_defun.c
|
||||
_cgo_gotypes.go
|
||||
_cgo_export.*
|
||||
|
||||
_testmain.go
|
||||
|
||||
*.exe
|
||||
*.test
|
||||
*.prof
|
||||
10
vendor/go.mozilla.org/pkcs7/.travis.yml
generated
vendored
10
vendor/go.mozilla.org/pkcs7/.travis.yml
generated
vendored
@ -1,10 +0,0 @@
|
||||
language: go
|
||||
go:
|
||||
- "1.11"
|
||||
- "1.12"
|
||||
- "1.13"
|
||||
- tip
|
||||
before_install:
|
||||
- make gettools
|
||||
script:
|
||||
- make
|
||||
22
vendor/go.mozilla.org/pkcs7/LICENSE
generated
vendored
22
vendor/go.mozilla.org/pkcs7/LICENSE
generated
vendored
@ -1,22 +0,0 @@
|
||||
The MIT License (MIT)
|
||||
|
||||
Copyright (c) 2015 Andrew Smith
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user