ipc

func Authenticate ¶

func Authenticate(ctx context.Context, conn net.Conn, expectedToken string) (string, error)

Authenticate reads the first RPC from conn and validates the auth token. Returns the plugin name on success. The context deadline controls the auth timeout -- unauthenticated connections are closed when ctx expires. On failure, the connection is closed and an error is returned.

Uses byte-by-byte reading to avoid buffering ahead into the connection. This ensures the underlying net.Conn is clean for the caller to wrap in rpc.Conn + MuxConn without data loss from scanner buffering.

func AuthenticateWithLookup ¶

func AuthenticateWithLookup(ctx context.Context, conn net.Conn, sharedSecret string, lookup func(name string) (string, bool)) (string, error)

AuthenticateWithLookup reads the first RPC from conn and validates the auth token using a per-name secret lookup. The lookup function returns the expected secret for the given name, or false if the name is unknown. This supports per-client secrets where each managed client has its own token.

Falls back to sharedSecret if lookup returns false (plugin connections use shared secret).

func AuthenticateWithName ¶

func AuthenticateWithName(ctx context.Context, conn net.Conn, expectedToken, expectedName string) (string, error)

AuthenticateWithName reads the first RPC from conn and validates that both the auth token and the plugin name match the expected values. This enforces name binding: a plugin cannot use its token to impersonate another plugin. On failure, the connection is closed and an error is returned.

func CertFingerprint ¶

func CertFingerprint(cert tls.Certificate) string

CertFingerprint returns the hex-encoded SHA-256 fingerprint of a TLS certificate's DER-encoded bytes. Used to pass the server cert identity to plugins for pinning.

func GenerateSelfSignedCert ¶

func GenerateSelfSignedCert() (tls.Certificate, error)

GenerateSelfSignedCert creates an ephemeral self-signed TLS certificate. Used when no user-provided certificate is configured.

func ReadLineRaw ¶

func ReadLineRaw(conn net.Conn, maxSize int) ([]byte, error)

ReadLineRaw reads bytes one at a time until newline or maxSize. Avoids bufio.Scanner to prevent buffering ahead into the connection.

func SendAuth ¶

func SendAuth(_ context.Context, conn net.Conn, token, name string) error

SendAuth sends the auth RPC to the engine as #0 auth {"token":"...","name":"..."}. Writes directly to conn without creating rpc.Conn (avoids reader goroutine leak).

func StartListeners ¶

func StartListeners(addrs []string, cert tls.Certificate) ([]net.Listener, error)

StartListeners creates TLS listeners on each of the given addresses. Returns all listeners on success, or an error if any address fails to bind. Returns an error if addrs is empty. On error, all successfully created listeners are closed before returning.

func TLSConfigWithFingerprint ¶

func TLSConfigWithFingerprint(fingerprint string) *tls.Config

TLSConfigWithFingerprint returns a TLS client config that verifies the server certificate matches the given SHA-256 fingerprint. If fingerprint is empty, uses InsecureSkipVerify (useful during development or when fingerprint is unavailable).