Skip to content

Make use of SocketCAFile config #457

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 29, 2021
Merged

Make use of SocketCAFile config #457

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e6a3695
Make use of SocketCAFile config
hyde-zhang Aug 24, 2021
ee4e0e5
Update tls.go load with CA only behaviour
hyde-zhang Sep 8, 2021
bd4a36c
Require client certs verification when SocketUseSSL N
hyde-zhang Sep 8, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 26 additions & 20 deletions tls.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,33 +35,40 @@ func loadTLSConfig(settings *SessionSettings) (tlsConfig *tls.Config, err error)
}

if !settings.HasSetting(config.SocketPrivateKeyFile) && !settings.HasSetting(config.SocketCertificateFile) {
if allowSkipClientCerts {
tlsConfig = defaultTLSConfig()
tlsConfig.ServerName = serverName
tlsConfig.InsecureSkipVerify = insecureSkipVerify
setMinVersionExplicit(settings, tlsConfig)
if !allowSkipClientCerts {
return
}
return
}

privateKeyFile, err := settings.Setting(config.SocketPrivateKeyFile)
if err != nil {
return
}

certificateFile, err := settings.Setting(config.SocketCertificateFile)
if err != nil {
return
}

tlsConfig = defaultTLSConfig()
tlsConfig.Certificates = make([]tls.Certificate, 1)
tlsConfig.ServerName = serverName
tlsConfig.InsecureSkipVerify = insecureSkipVerify
setMinVersionExplicit(settings, tlsConfig)

if tlsConfig.Certificates[0], err = tls.LoadX509KeyPair(certificateFile, privateKeyFile); err != nil {
return
if settings.HasSetting(config.SocketPrivateKeyFile) || settings.HasSetting(config.SocketCertificateFile) {

var privateKeyFile string
var certificateFile string

privateKeyFile, err = settings.Setting(config.SocketPrivateKeyFile)
if err != nil {
return
}

certificateFile, err = settings.Setting(config.SocketCertificateFile)
if err != nil {
return
}

tlsConfig.Certificates = make([]tls.Certificate, 1)

if tlsConfig.Certificates[0], err = tls.LoadX509KeyPair(certificateFile, privateKeyFile); err != nil {
return
}
}

if !allowSkipClientCerts {
tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
}

if !settings.HasSetting(config.SocketCAFile) {
Expand All @@ -86,7 +93,6 @@ func loadTLSConfig(settings *SessionSettings) (tlsConfig *tls.Config, err error)

tlsConfig.RootCAs = certPool
tlsConfig.ClientCAs = certPool
tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert

return
}
Expand Down
32 changes: 31 additions & 1 deletion tls_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ func (s *TLSTestSuite) TestLoadTLSNoCA() {
s.Len(tlsConfig.Certificates, 1)
s.Nil(tlsConfig.RootCAs)
s.Nil(tlsConfig.ClientCAs)
s.Equal(tls.NoClientCert, tlsConfig.ClientAuth)
s.Equal(tls.RequireAndVerifyClientCert, tlsConfig.ClientAuth)
Copy link
Contributor Author

@hyde-zhang hyde-zhang Sep 8, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still need to verify the incoming message using host's root CA set i.e. only skip when SocketUseSSL = Y - when initiator is allowed to not providing key pairs for its own identify

}

func (s *TLSTestSuite) TestLoadTLSWithBadCA() {
Expand All @@ -87,6 +87,36 @@ func (s *TLSTestSuite) TestLoadTLSWithCA() {
s.Equal(tls.RequireAndVerifyClientCert, tlsConfig.ClientAuth)
}

func (s *TLSTestSuite) TestLoadTLSWithOnlyCA() {
s.settings.GlobalSettings().Set(config.SocketUseSSL, "Y")
s.settings.GlobalSettings().Set(config.SocketCAFile, s.CAFile)

tlsConfig, err := loadTLSConfig(s.settings.GlobalSettings())
s.Nil(err)
s.NotNil(tlsConfig)

s.NotNil(tlsConfig.RootCAs)
s.NotNil(tlsConfig.ClientCAs)
}

func (s *TLSTestSuite) TestLoadTLSWithoutSSLWithOnlyCA() {
s.settings.GlobalSettings().Set(config.SocketCAFile, s.CAFile)

tlsConfig, err := loadTLSConfig(s.settings.GlobalSettings())
s.Nil(err)
s.Nil(tlsConfig)
}

func (s *TLSTestSuite) TestLoadTLSAllowSkipClientCerts() {
s.settings.GlobalSettings().Set(config.SocketUseSSL, "Y")

tlsConfig, err := loadTLSConfig(s.settings.GlobalSettings())
s.Nil(err)
s.NotNil(tlsConfig)

s.Equal(tls.NoClientCert, tlsConfig.ClientAuth)
}

func (s *TLSTestSuite) TestServerNameUseSSL() {
s.settings.GlobalSettings().Set(config.SocketUseSSL, "Y")
s.settings.GlobalSettings().Set(config.SocketServerName, "DummyServerNameUseSSL")
Expand Down