2015-01-25 06:19:16 +03:00
|
|
|
// Copyright 2015 CoreOS, Inc.
|
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
2014-10-18 02:41:22 +04:00
|
|
|
|
2014-09-23 03:35:00 +04:00
|
|
|
package transport
|
|
|
|
|
|
|
|
import (
|
2014-09-23 03:48:12 +04:00
|
|
|
"crypto/tls"
|
|
|
|
"crypto/x509"
|
|
|
|
"encoding/pem"
|
|
|
|
"fmt"
|
|
|
|
"io/ioutil"
|
2014-09-23 03:35:00 +04:00
|
|
|
"net"
|
2014-09-23 19:43:20 +04:00
|
|
|
"net/http"
|
|
|
|
"time"
|
2014-09-23 03:35:00 +04:00
|
|
|
)
|
|
|
|
|
2014-11-11 22:51:57 +03:00
|
|
|
func NewListener(addr string, scheme string, info TLSInfo) (net.Listener, error) {
|
2014-09-23 03:48:12 +04:00
|
|
|
l, err := net.Listen("tcp", addr)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2014-11-11 22:51:57 +03:00
|
|
|
if !info.Empty() && scheme == "https" {
|
2014-09-23 03:48:12 +04:00
|
|
|
cfg, err := info.ServerConfig()
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
l = tls.NewListener(l, cfg)
|
|
|
|
}
|
|
|
|
|
|
|
|
return l, nil
|
|
|
|
}
|
|
|
|
|
2014-09-23 19:58:21 +04:00
|
|
|
func NewTransport(info TLSInfo) (*http.Transport, error) {
|
2014-11-06 23:10:04 +03:00
|
|
|
cfg, err := info.ClientConfig()
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2014-09-23 19:43:20 +04:00
|
|
|
t := &http.Transport{
|
|
|
|
// timeouts taken from http.DefaultTransport
|
|
|
|
Dial: (&net.Dialer{
|
|
|
|
Timeout: 30 * time.Second,
|
|
|
|
KeepAlive: 30 * time.Second,
|
|
|
|
}).Dial,
|
|
|
|
TLSHandshakeTimeout: 10 * time.Second,
|
2014-11-06 23:10:04 +03:00
|
|
|
TLSClientConfig: cfg,
|
2014-09-23 19:58:21 +04:00
|
|
|
}
|
|
|
|
|
2014-09-23 19:43:20 +04:00
|
|
|
return t, nil
|
|
|
|
}
|
|
|
|
|
2014-09-23 03:48:12 +04:00
|
|
|
type TLSInfo struct {
|
|
|
|
CertFile string
|
|
|
|
KeyFile string
|
|
|
|
CAFile string
|
2014-09-24 00:38:57 +04:00
|
|
|
|
|
|
|
// parseFunc exists to simplify testing. Typically, parseFunc
|
|
|
|
// should be left nil. In that case, tls.X509KeyPair will be used.
|
|
|
|
parseFunc func([]byte, []byte) (tls.Certificate, error)
|
2014-09-23 03:48:12 +04:00
|
|
|
}
|
|
|
|
|
2014-11-13 07:11:04 +03:00
|
|
|
func (info TLSInfo) String() string {
|
|
|
|
return fmt.Sprintf("cert = %s, key = %s, ca = %s", info.CertFile, info.KeyFile, info.CAFile)
|
|
|
|
}
|
|
|
|
|
2014-09-23 03:48:12 +04:00
|
|
|
func (info TLSInfo) Empty() bool {
|
|
|
|
return info.CertFile == "" && info.KeyFile == ""
|
|
|
|
}
|
|
|
|
|
2014-09-23 19:54:24 +04:00
|
|
|
func (info TLSInfo) baseConfig() (*tls.Config, error) {
|
2014-09-23 03:48:12 +04:00
|
|
|
if info.KeyFile == "" || info.CertFile == "" {
|
|
|
|
return nil, fmt.Errorf("KeyFile and CertFile must both be present[key: %v, cert: %v]", info.KeyFile, info.CertFile)
|
|
|
|
}
|
|
|
|
|
2014-09-24 00:38:57 +04:00
|
|
|
cert, err := ioutil.ReadFile(info.CertFile)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
key, err := ioutil.ReadFile(info.KeyFile)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
parseFunc := info.parseFunc
|
|
|
|
if parseFunc == nil {
|
|
|
|
parseFunc = tls.X509KeyPair
|
|
|
|
}
|
|
|
|
|
|
|
|
tlsCert, err := parseFunc(cert, key)
|
2014-09-23 03:48:12 +04:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2014-10-15 23:08:59 +04:00
|
|
|
cfg := &tls.Config{
|
|
|
|
Certificates: []tls.Certificate{tlsCert},
|
|
|
|
MinVersion: tls.VersionTLS10,
|
|
|
|
}
|
|
|
|
return cfg, nil
|
2014-09-23 19:54:24 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
// ServerConfig generates a tls.Config object for use by an HTTP server
|
|
|
|
func (info TLSInfo) ServerConfig() (*tls.Config, error) {
|
|
|
|
cfg, err := info.baseConfig()
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2014-09-23 03:48:12 +04:00
|
|
|
|
|
|
|
if info.CAFile != "" {
|
|
|
|
cfg.ClientAuth = tls.RequireAndVerifyClientCert
|
|
|
|
cp, err := newCertPool(info.CAFile)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
cfg.ClientCAs = cp
|
|
|
|
} else {
|
|
|
|
cfg.ClientAuth = tls.NoClientCert
|
|
|
|
}
|
|
|
|
|
2014-09-23 19:54:24 +04:00
|
|
|
return cfg, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// ClientConfig generates a tls.Config object for use by an HTTP client
|
2014-11-06 23:10:04 +03:00
|
|
|
func (info TLSInfo) ClientConfig() (cfg *tls.Config, err error) {
|
|
|
|
if !info.Empty() {
|
|
|
|
cfg, err = info.baseConfig()
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
cfg = &tls.Config{}
|
2014-09-23 19:54:24 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
if info.CAFile != "" {
|
2014-11-06 23:10:04 +03:00
|
|
|
cfg.RootCAs, err = newCertPool(info.CAFile)
|
2014-09-23 19:54:24 +04:00
|
|
|
if err != nil {
|
2014-11-06 23:10:04 +03:00
|
|
|
return
|
2014-09-23 19:54:24 +04:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-11-06 23:10:04 +03:00
|
|
|
return
|
2014-09-23 03:48:12 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
// newCertPool creates x509 certPool with provided CA file
|
|
|
|
func newCertPool(CAFile string) (*x509.CertPool, error) {
|
|
|
|
certPool := x509.NewCertPool()
|
|
|
|
pemByte, err := ioutil.ReadFile(CAFile)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
for {
|
|
|
|
var block *pem.Block
|
|
|
|
block, pemByte = pem.Decode(pemByte)
|
|
|
|
if block == nil {
|
|
|
|
return certPool, nil
|
|
|
|
}
|
|
|
|
cert, err := x509.ParseCertificate(block.Bytes)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
certPool.AddCert(cert)
|
|
|
|
}
|
2014-09-23 03:35:00 +04:00
|
|
|
}
|