d4983e717b
Because ttrpc can be used with abstract sockets, it is critical to ensure that only certain users can connect to the unix socket. This is of particular interest in the primary use case of containerd, where a shim may run as root and any user can connection. With this, we get a few nice features. The first is the concept of a `Handshaker` that allows one to intercept each connection and replace it with one of their own. The enables credential checks and other measures, such as tls. The second is that servers now support configuration. This allows one to inject a handshaker for each connection. Other options will be added in the future. Signed-off-by: Stephen J Day <stephen.day@docker.com>
24 lines
557 B
Go
24 lines
557 B
Go
package ttrpc
|
|
|
|
import "github.com/pkg/errors"
|
|
|
|
type serverConfig struct {
|
|
handshaker Handshaker
|
|
}
|
|
|
|
type ServerOpt func(*serverConfig) error
|
|
|
|
// WithServerHandshaker can be passed to NewServer to ensure that the
|
|
// handshaker is called before every connection attempt.
|
|
//
|
|
// Only one handshaker is allowed per server.
|
|
func WithServerHandshaker(handshaker Handshaker) ServerOpt {
|
|
return func(c *serverConfig) error {
|
|
if c.handshaker != nil {
|
|
return errors.New("only one handshaker allowed per server")
|
|
}
|
|
c.handshaker = handshaker
|
|
return nil
|
|
}
|
|
}
|