-
Notifications
You must be signed in to change notification settings - Fork 79
/
tlsconfig.go
185 lines (160 loc) · 5.88 KB
/
tlsconfig.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
//go:build !no_tls_config
// +build !no_tls_config
package netceptor
import (
"crypto/tls"
"crypto/x509"
"encoding/hex"
"fmt"
"io/ioutil"
"strings"
"github.com/ghjm/cmdline"
)
// **************************************************************************
// Command line
// **************************************************************************
var configSection = &cmdline.ConfigSection{
Description: "Commands that configure resources used by other commands:",
Order: 5,
}
func decodeFingerprints(fingerprints []string) ([][]byte, error) {
fingerprintBytes := make([][]byte, 0, len(fingerprints))
for _, fingStr := range fingerprints {
fingBytes, err := hex.DecodeString(strings.ReplaceAll(fingStr, ":", ""))
if err != nil {
return nil, fmt.Errorf("error decoding fingerprint")
}
if len(fingBytes) != 32 && len(fingBytes) != 64 {
return nil, fmt.Errorf("fingerprints must be 32 or 64 bytes for sha256 or sha512")
}
fingerprintBytes = append(fingerprintBytes, fingBytes)
}
return fingerprintBytes, nil
}
func baseTLS(minTLS13 bool) *tls.Config {
var tlscfg *tls.Config
if minTLS13 {
tlscfg = &tls.Config{
PreferServerCipherSuites: true,
MinVersion: tls.VersionTLS13,
}
} else {
tlscfg = &tls.Config{
MinVersion: tls.VersionTLS12,
CurvePreferences: []tls.CurveID{tls.CurveP521, tls.CurveP384, tls.CurveP256},
PreferServerCipherSuites: true,
CipherSuites: []uint16{
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
},
}
}
return tlscfg
}
// tlsServerCfg stores the configuration options for a TLS server.
type tlsServerCfg struct {
Name string `required:"true" description:"Name of this TLS server configuration"`
Cert string `required:"true" description:"Server certificate filename"`
Key string `required:"true" description:"Server private key filename"`
RequireClientCert bool `description:"Require client certificates" default:"false"`
ClientCAs string `description:"Filename of CA bundle to verify client certs with"`
PinnedClientCert []string `description:"Pinned fingerprint of required client certificate"`
MinTLS13 bool `required:"false" description:"Set minimum TLS version to 1.3. Otherwise the minimum is 1.2" default:"false"`
}
// Prepare creates the tls.config and stores it in the global map.
func (cfg tlsServerCfg) Prepare() error {
tlscfg := baseTLS(cfg.MinTLS13)
certbytes, err := ioutil.ReadFile(cfg.Cert)
if err != nil {
return err
}
keybytes, err := ioutil.ReadFile(cfg.Key)
if err != nil {
return err
}
cert, err := tls.X509KeyPair(certbytes, keybytes)
if err != nil {
return err
}
tlscfg.Certificates = []tls.Certificate{cert}
if cfg.ClientCAs != "" {
caBytes, err := ioutil.ReadFile(cfg.ClientCAs)
if err != nil {
return fmt.Errorf("error reading client CAs file: %s", err)
}
clientCAs := x509.NewCertPool()
clientCAs.AppendCertsFromPEM(caBytes)
tlscfg.ClientCAs = clientCAs
}
switch {
case cfg.RequireClientCert:
tlscfg.ClientAuth = tls.RequireAndVerifyClientCert
case cfg.ClientCAs != "":
tlscfg.ClientAuth = tls.VerifyClientCertIfGiven
default:
tlscfg.ClientAuth = tls.NoClientCert
}
var pinnedFingerprints [][]byte
pinnedFingerprints, err = decodeFingerprints(cfg.PinnedClientCert)
if err != nil {
return fmt.Errorf("error decoding fingerprints: %s", err)
}
if tlscfg.ClientAuth != tls.NoClientCert {
tlscfg.VerifyPeerCertificate = ReceptorVerifyFunc(tlscfg, pinnedFingerprints,
"", ExpectedHostnameTypeDNS, VerifyClient)
}
return MainInstance.SetServerTLSConfig(cfg.Name, tlscfg)
}
// tlsClientConfig stores the configuration options for a TLS client.
type tlsClientConfig struct {
Name string `required:"true" description:"Name of this TLS client configuration"`
Cert string `required:"false" description:"Client certificate filename"`
Key string `required:"false" description:"Client private key filename"`
RootCAs string `required:"false" description:"Root CA bundle to use instead of system trust"`
InsecureSkipVerify bool `required:"false" description:"Accept any server cert" default:"false"`
PinnedServerCert []string `required:"false" description:"Pinned fingerprint of required server certificate"`
MinTLS13 bool `required:"false" description:"Set minimum TLS version to 1.3. Otherwise the minimum is 1.2" default:"false"`
}
// Prepare creates the tls.config and stores it in the global map.
func (cfg tlsClientConfig) Prepare() error {
tlscfg := baseTLS(cfg.MinTLS13)
if cfg.Cert != "" || cfg.Key != "" {
if cfg.Cert == "" || cfg.Key == "" {
return fmt.Errorf("cert and key must both be supplied or neither")
}
certBytes, err := ioutil.ReadFile(cfg.Cert)
if err != nil {
return err
}
keyBytes, err := ioutil.ReadFile(cfg.Key)
if err != nil {
return err
}
cert, err := tls.X509KeyPair(certBytes, keyBytes)
if err != nil {
return err
}
tlscfg.Certificates = []tls.Certificate{cert}
}
if cfg.RootCAs != "" {
caBytes, err := ioutil.ReadFile(cfg.RootCAs)
if err != nil {
return fmt.Errorf("error reading root CAs file: %s", err)
}
rootCAs := x509.NewCertPool()
rootCAs.AppendCertsFromPEM(caBytes)
tlscfg.RootCAs = rootCAs
}
pinnedFingerprints, err := decodeFingerprints(cfg.PinnedServerCert)
if err != nil {
return fmt.Errorf("error decoding fingerprints: %s", err)
}
tlscfg.InsecureSkipVerify = cfg.InsecureSkipVerify
return MainInstance.SetClientTLSConfig(cfg.Name, tlscfg, pinnedFingerprints)
}
func init() {
cmdline.RegisterConfigTypeForApp("receptor-tls",
"tls-server", "Define a TLS server configuration", tlsServerCfg{}, cmdline.Section(configSection))
cmdline.RegisterConfigTypeForApp("receptor-tls",
"tls-client", "Define a TLS client configuration", tlsClientConfig{}, cmdline.Section(configSection))
}