forked from contribsys/faktory
-
Notifications
You must be signed in to change notification settings - Fork 0
/
security.go
96 lines (82 loc) · 1.85 KB
/
security.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
package server
import (
"crypto/tls"
"crypto/x509"
"fmt"
"io/ioutil"
"os"
"regexp"
"strings"
"github.com/contribsys/faktory/util"
)
func fetchPassword(configDir string) (string, error) {
val, ok := os.LookupEnv("FAKTORY_PASSWORD")
if ok {
return val, nil
}
pwd := configDir + "/password"
exists, err := util.FileExists(pwd)
if err != nil {
return "", err
}
if exists {
data, err := ioutil.ReadFile(pwd)
if err != nil {
util.Warn("Unable to read file %s: %s", pwd, err.Error())
}
return strings.TrimSpace(string(data)), nil
}
return "", nil
}
func tlsConfig(binding string, forceTLS bool, configDir string) (*tls.Config, error) {
return findTlsConfigIn(binding, forceTLS, []string{configDir + "/tls"})
}
func findTlsConfigIn(binding string, disableTls bool, dirs []string) (*tls.Config, error) {
// TLS is optional when binding to something that matches "localhost:"
optional, err := regexp.Match("\\Alocalhost:", []byte(binding))
if err != nil {
return nil, err
}
if disableTls {
optional = true
}
if optional {
return nil, nil
}
var tlscfg *tls.Config
for _, dir := range dirs {
if dir == "" {
continue
}
exists, err := util.FileExists(dir + "/public.crt")
if err != nil {
return nil, err
}
if !exists {
continue
}
cert, err := tls.LoadX509KeyPair(dir+"/public.crt", dir+"/private.key")
if err != nil {
return nil, err
}
tlscfg = &tls.Config{
RootCAs: nil,
Certificates: []tls.Certificate{cert},
}
exists, err = util.FileExists(dir + "/ca.crt")
if err != nil {
return nil, err
}
if exists {
pemData, err := ioutil.ReadFile(dir + "/ca.crt")
if err != nil {
return nil, err
}
cas := x509.NewCertPool()
cas.AppendCertsFromPEM(pemData)
tlscfg.RootCAs = cas
}
return tlscfg, nil
}
return nil, fmt.Errorf("TLS certificates not found in %v", dirs)
}