-
Notifications
You must be signed in to change notification settings - Fork 19
/
utils.go
108 lines (95 loc) · 2.98 KB
/
utils.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
// Copyright (C) 2020-2021, IrineSistiana
//
// This file is part of simple-tls.
//
// simple-tls is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// simple-tls is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program. If not, see <https://www.gnu.org/licenses/>.
package core
import (
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand"
"crypto/tls"
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"fmt"
"math/big"
mathRand "math/rand"
"time"
)
func tls13HandshakeWithTimeout(c *tls.Conn, timeout time.Duration) error {
c.SetDeadline(time.Now().Add(timeout))
if err := c.Handshake(); err != nil {
return err
}
c.SetDeadline(time.Time{})
if cVar := c.ConnectionState().Version; cVar != tls.VersionTLS13 {
return fmt.Errorf("unexpected tls version: %x", cVar)
}
return nil
}
func GenerateCertificate(serverName string) (dnsName string, keyPEM, certPEM []byte, err error) {
//priv key
key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
if err != nil {
return
}
//serial number
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
if err != nil {
err = fmt.Errorf("generate serial number: %v", err)
return
}
// set DNSNames
if len(serverName) == 0 {
dnsName = randServerName()
} else {
dnsName = serverName
}
template := x509.Certificate{
SerialNumber: serialNumber,
Subject: pkix.Name{CommonName: dnsName},
DNSNames: []string{dnsName},
NotBefore: time.Now(),
NotAfter: time.Now().AddDate(10, 0, 0),
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
BasicConstraintsValid: true,
}
certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
if err != nil {
return
}
b, err := x509.MarshalPKCS8PrivateKey(key)
if err != nil {
return
}
keyPEM = pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: b})
certPEM = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
return dnsName, keyPEM, certPEM, nil
}
func randServerName() string {
r := mathRand.New(mathRand.NewSource(time.Now().UnixNano()))
return fmt.Sprintf("%s.%s", randStr(r.Intn(5)+3), randStr(r.Intn(3)+1))
}
func randStr(length int) string {
r := mathRand.New(mathRand.NewSource(time.Now().UnixNano()))
set := "abcdefghijklmnopqrstuvwxyz"
b := make([]byte, length)
for i := range b {
b[i] = set[r.Intn(len(set))]
}
return string(b)
}