1
0
mirror of https://github.com/zrepl/zrepl.git synced 2024-12-30 19:08:50 +01:00
zrepl/tlsconf/tlsconf.go

139 lines
3.5 KiB
Go
Raw Permalink Normal View History

2018-08-25 12:58:17 +02:00
package tlsconf
import (
"crypto/tls"
"crypto/x509"
"errors"
"fmt"
"io"
2018-08-25 12:58:17 +02:00
"io/ioutil"
"net"
"os"
2018-08-25 12:58:17 +02:00
"time"
)
func ParseCAFile(certfile string) (*x509.CertPool, error) {
pool := x509.NewCertPool()
pem, err := ioutil.ReadFile(certfile)
if err != nil {
return nil, err
}
if !pool.AppendCertsFromPEM(pem) {
return nil, errors.New("PEM parsing error")
}
return pool, nil
}
type ClientAuthListener struct {
l *net.TCPListener
c *tls.Config
2018-08-25 12:58:17 +02:00
handshakeTimeout time.Duration
}
func NewClientAuthListener(
l *net.TCPListener, ca *x509.CertPool, serverCert tls.Certificate,
handshakeTimeout time.Duration) *ClientAuthListener {
2018-08-25 12:58:17 +02:00
if ca == nil {
panic(ca)
}
if serverCert.Certificate == nil || serverCert.PrivateKey == nil {
panic(serverCert)
}
tlsConf := &tls.Config{
2018-08-25 21:30:25 +02:00
Certificates: []tls.Certificate{serverCert},
2018-08-25 12:58:17 +02:00
ClientCAs: ca,
ClientAuth: tls.RequireAndVerifyClientCert,
PreferServerCipherSuites: true,
KeyLogWriter: keylogFromEnv(),
2018-08-25 12:58:17 +02:00
}
return &ClientAuthListener{
l,
tlsConf,
2018-08-25 12:58:17 +02:00
handshakeTimeout,
}
}
// Accept() accepts a connection from the *net.TCPListener passed to the constructor
// and sets up the TLS connection, including handshake and peer CommonName validation
// within the specified handshakeTimeout.
//
// It returns both the raw TCP connection (tcpConn) and the TLS connection (tlsConn) on top of it.
// Access to the raw tcpConn might be necessary if CloseWrite semantics are desired:
// tlsConn.CloseWrite does NOT call tcpConn.CloseWrite, hence we provide access to tcpConn to
// allow the caller to do this by themselves.
func (l *ClientAuthListener) Accept() (tcpConn *net.TCPConn, tlsConn *tls.Conn, clientCN string, err error) {
tcpConn, err = l.l.AcceptTCP()
2018-08-25 12:58:17 +02:00
if err != nil {
return nil, nil, "", err
2018-08-25 12:58:17 +02:00
}
tlsConn = tls.Server(tcpConn, l.c)
2018-08-25 12:58:17 +02:00
var (
cn string
peerCerts []*x509.Certificate
)
if err = tlsConn.SetDeadline(time.Now().Add(l.handshakeTimeout)); err != nil {
goto CloseAndErr
}
if err = tlsConn.Handshake(); err != nil {
goto CloseAndErr
}
if err = tlsConn.SetDeadline(time.Time{}); err != nil {
goto CloseAndErr
}
2018-08-25 12:58:17 +02:00
peerCerts = tlsConn.ConnectionState().PeerCertificates
if len(peerCerts) < 1 {
err = errors.New("client must present full RFC5246:7.4.2 TLS client certificate chain")
2018-08-25 12:58:17 +02:00
goto CloseAndErr
}
cn = peerCerts[0].Subject.CommonName
return tcpConn, tlsConn, cn, nil
2018-08-25 12:58:17 +02:00
CloseAndErr:
// unlike CloseWrite, Close on *tls.Conn actually closes the underlying connection
tlsConn.Close() // TODO log error
return nil, nil, "", err
2018-08-25 12:58:17 +02:00
}
func (l *ClientAuthListener) Addr() net.Addr {
return l.l.Addr()
}
func (l *ClientAuthListener) Close() error {
return l.l.Close()
}
func ClientAuthClient(serverName string, rootCA *x509.CertPool, clientCert tls.Certificate) (*tls.Config, error) {
if serverName == "" {
panic(serverName)
}
if rootCA == nil {
panic(rootCA)
}
if clientCert.Certificate == nil || clientCert.PrivateKey == nil {
panic(clientCert)
}
tlsConfig := &tls.Config{
Certificates: []tls.Certificate{clientCert},
RootCAs: rootCA,
2018-08-25 21:30:25 +02:00
ServerName: serverName,
KeyLogWriter: keylogFromEnv(),
2018-08-25 12:58:17 +02:00
}
return tlsConfig, nil
2018-08-25 21:30:25 +02:00
}
func keylogFromEnv() io.Writer {
var keyLog io.Writer = nil
if outfile := os.Getenv("ZREPL_KEYLOG_FILE"); outfile != "" {
fmt.Fprintf(os.Stderr, "writing to key log %s\n", outfile)
var err error
keyLog, err = os.OpenFile(outfile, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0600)
if err != nil {
panic(err)
}
}
return keyLog
}