2018-11-21 21:29:18 +00:00
|
|
|
package ca
|
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto/tls"
|
|
|
|
"crypto/x509"
|
|
|
|
)
|
|
|
|
|
|
|
|
// TLSOption defines the type of a function that modifies a tls.Config.
|
2019-01-09 21:20:28 +00:00
|
|
|
type TLSOption func(ctx *TLSOptionCtx) error
|
2018-11-21 21:29:18 +00:00
|
|
|
|
2019-01-09 21:20:28 +00:00
|
|
|
// TLSOptionCtx is the context modified on TLSOption methods.
|
|
|
|
type TLSOptionCtx struct {
|
|
|
|
Client *Client
|
|
|
|
Config *tls.Config
|
|
|
|
OnRenewFunc []TLSOption
|
|
|
|
}
|
|
|
|
|
|
|
|
// newTLSOptionCtx creates the TLSOption context.
|
2019-01-12 03:08:08 +00:00
|
|
|
func newTLSOptionCtx(c *Client, config *tls.Config) *TLSOptionCtx {
|
2019-01-09 21:20:28 +00:00
|
|
|
return &TLSOptionCtx{
|
2019-01-12 03:08:08 +00:00
|
|
|
Client: c,
|
|
|
|
Config: config,
|
|
|
|
}
|
2019-01-09 21:20:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (ctx *TLSOptionCtx) apply(options []TLSOption) error {
|
|
|
|
for _, fn := range options {
|
|
|
|
if err := fn(ctx); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2019-01-08 01:48:56 +00:00
|
|
|
}
|
2019-01-09 21:20:28 +00:00
|
|
|
return nil
|
|
|
|
}
|
2019-01-08 01:48:56 +00:00
|
|
|
|
2019-01-12 03:08:08 +00:00
|
|
|
func (ctx *TLSOptionCtx) applyRenew() error {
|
2019-01-09 21:20:28 +00:00
|
|
|
for _, fn := range ctx.OnRenewFunc {
|
|
|
|
if err := fn(ctx); err != nil {
|
2018-11-21 21:29:18 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// RequireAndVerifyClientCert is a tls.Config option used on servers to enforce
|
|
|
|
// a valid TLS client certificate. This is the default option for mTLS servers.
|
|
|
|
func RequireAndVerifyClientCert() TLSOption {
|
2019-01-09 21:20:28 +00:00
|
|
|
return func(ctx *TLSOptionCtx) error {
|
|
|
|
ctx.Config.ClientAuth = tls.RequireAndVerifyClientCert
|
2018-11-21 21:29:18 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// VerifyClientCertIfGiven is a tls.Config option used on on servers to validate
|
|
|
|
// a TLS client certificate if it is provided. It does not requires a certificate.
|
|
|
|
func VerifyClientCertIfGiven() TLSOption {
|
2019-01-09 21:20:28 +00:00
|
|
|
return func(ctx *TLSOptionCtx) error {
|
|
|
|
ctx.Config.ClientAuth = tls.VerifyClientCertIfGiven
|
2018-11-21 21:29:18 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// AddRootCA adds to the tls.Config RootCAs the given certificate. RootCAs
|
|
|
|
// defines the set of root certificate authorities that clients use when
|
|
|
|
// verifying server certificates.
|
|
|
|
func AddRootCA(cert *x509.Certificate) TLSOption {
|
2019-01-09 21:20:28 +00:00
|
|
|
return func(ctx *TLSOptionCtx) error {
|
|
|
|
if ctx.Config.RootCAs == nil {
|
|
|
|
ctx.Config.RootCAs = x509.NewCertPool()
|
2018-11-21 21:29:18 +00:00
|
|
|
}
|
2019-01-09 21:20:28 +00:00
|
|
|
ctx.Config.RootCAs.AddCert(cert)
|
2018-11-21 21:29:18 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// AddClientCA adds to the tls.Config ClientCAs the given certificate. ClientCAs
|
|
|
|
// defines the set of root certificate authorities that servers use if required
|
|
|
|
// to verify a client certificate by the policy in ClientAuth.
|
|
|
|
func AddClientCA(cert *x509.Certificate) TLSOption {
|
2019-01-09 21:20:28 +00:00
|
|
|
return func(ctx *TLSOptionCtx) error {
|
|
|
|
if ctx.Config.ClientCAs == nil {
|
|
|
|
ctx.Config.ClientCAs = x509.NewCertPool()
|
2019-01-05 01:51:32 +00:00
|
|
|
}
|
2019-01-09 21:20:28 +00:00
|
|
|
ctx.Config.ClientCAs.AddCert(cert)
|
2019-01-05 01:51:32 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-01-08 01:48:56 +00:00
|
|
|
// AddRootsToRootCAs does a roots request and adds to the tls.Config RootCAs all
|
|
|
|
// the certificates in the response. RootCAs defines the set of root certificate
|
|
|
|
// authorities that clients use when verifying server certificates.
|
2019-01-08 02:55:40 +00:00
|
|
|
//
|
|
|
|
// BootstrapServer and BootstrapClient methods include this option by default.
|
2019-01-08 01:48:56 +00:00
|
|
|
func AddRootsToRootCAs() TLSOption {
|
2019-01-09 21:20:28 +00:00
|
|
|
fn := func(ctx *TLSOptionCtx) error {
|
2019-01-12 03:08:08 +00:00
|
|
|
certs, err := ctx.Client.Roots()
|
2019-01-08 01:48:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2019-01-09 21:20:28 +00:00
|
|
|
if ctx.Config.RootCAs == nil {
|
|
|
|
ctx.Config.RootCAs = x509.NewCertPool()
|
2019-01-05 01:51:32 +00:00
|
|
|
}
|
2019-01-08 01:48:56 +00:00
|
|
|
for _, cert := range certs.Certificates {
|
2019-01-09 21:20:28 +00:00
|
|
|
ctx.Config.RootCAs.AddCert(cert.Certificate)
|
2019-01-08 01:48:56 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2019-01-09 21:20:28 +00:00
|
|
|
return func(ctx *TLSOptionCtx) error {
|
|
|
|
ctx.OnRenewFunc = append(ctx.OnRenewFunc, fn)
|
|
|
|
return fn(ctx)
|
|
|
|
}
|
2019-01-08 01:48:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// AddRootsToClientCAs does a roots request and adds to the tls.Config ClientCAs
|
|
|
|
// all the certificates in the response. ClientCAs defines the set of root
|
|
|
|
// certificate authorities that servers use if required to verify a client
|
|
|
|
// certificate by the policy in ClientAuth.
|
2019-01-08 02:55:40 +00:00
|
|
|
//
|
|
|
|
// BootstrapServer method includes this option by default.
|
2019-01-08 01:48:56 +00:00
|
|
|
func AddRootsToClientCAs() TLSOption {
|
2019-01-09 21:20:28 +00:00
|
|
|
fn := func(ctx *TLSOptionCtx) error {
|
2019-01-12 03:08:08 +00:00
|
|
|
certs, err := ctx.Client.Roots()
|
2019-01-08 01:48:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2019-01-09 21:20:28 +00:00
|
|
|
if ctx.Config.ClientCAs == nil {
|
|
|
|
ctx.Config.ClientCAs = x509.NewCertPool()
|
2019-01-08 01:48:56 +00:00
|
|
|
}
|
|
|
|
for _, cert := range certs.Certificates {
|
2019-01-09 21:20:28 +00:00
|
|
|
ctx.Config.ClientCAs.AddCert(cert.Certificate)
|
2019-01-08 01:48:56 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2019-01-09 21:20:28 +00:00
|
|
|
return func(ctx *TLSOptionCtx) error {
|
|
|
|
ctx.OnRenewFunc = append(ctx.OnRenewFunc, fn)
|
|
|
|
return fn(ctx)
|
|
|
|
}
|
2019-01-08 01:48:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// AddFederationToRootCAs does a federation request and adds to the tls.Config
|
|
|
|
// RootCAs all the certificates in the response. RootCAs defines the set of root
|
|
|
|
// certificate authorities that clients use when verifying server certificates.
|
|
|
|
func AddFederationToRootCAs() TLSOption {
|
2019-01-09 21:20:28 +00:00
|
|
|
fn := func(ctx *TLSOptionCtx) error {
|
2019-01-12 03:08:08 +00:00
|
|
|
certs, err := ctx.Client.Federation()
|
2019-01-05 01:51:32 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2019-01-09 21:20:28 +00:00
|
|
|
if ctx.Config.RootCAs == nil {
|
|
|
|
ctx.Config.RootCAs = x509.NewCertPool()
|
2019-01-08 01:48:56 +00:00
|
|
|
}
|
2019-01-05 01:51:32 +00:00
|
|
|
for _, cert := range certs.Certificates {
|
2019-01-09 21:20:28 +00:00
|
|
|
ctx.Config.RootCAs.AddCert(cert.Certificate)
|
2019-01-05 01:51:32 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2019-01-09 21:20:28 +00:00
|
|
|
return func(ctx *TLSOptionCtx) error {
|
|
|
|
ctx.OnRenewFunc = append(ctx.OnRenewFunc, fn)
|
|
|
|
return fn(ctx)
|
|
|
|
}
|
2019-01-05 01:51:32 +00:00
|
|
|
}
|
|
|
|
|
2019-01-08 01:48:56 +00:00
|
|
|
// AddFederationToClientCAs does a federation request and adds to the tls.Config
|
2019-01-05 01:51:32 +00:00
|
|
|
// ClientCAs all the certificates in the response. ClientCAs defines the set of
|
|
|
|
// root certificate authorities that servers use if required to verify a client
|
|
|
|
// certificate by the policy in ClientAuth.
|
2019-01-08 01:48:56 +00:00
|
|
|
func AddFederationToClientCAs() TLSOption {
|
2019-01-09 21:20:28 +00:00
|
|
|
fn := func(ctx *TLSOptionCtx) error {
|
2019-01-12 03:08:08 +00:00
|
|
|
certs, err := ctx.Client.Federation()
|
2019-01-09 21:20:28 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if ctx.Config.ClientCAs == nil {
|
|
|
|
ctx.Config.ClientCAs = x509.NewCertPool()
|
|
|
|
}
|
|
|
|
for _, cert := range certs.Certificates {
|
|
|
|
ctx.Config.ClientCAs.AddCert(cert.Certificate)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
return func(ctx *TLSOptionCtx) error {
|
|
|
|
ctx.OnRenewFunc = append(ctx.OnRenewFunc, fn)
|
|
|
|
return fn(ctx)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// AddRootsToCAs does a roots request and adds the resulting certs to the
|
|
|
|
// tls.Config RootCAs and ClientCAs. Combines the functionality of
|
|
|
|
// AddRootsToRootCAs and AddRootsToClientCAs.
|
|
|
|
func AddRootsToCAs() TLSOption {
|
|
|
|
fn := func(ctx *TLSOptionCtx) error {
|
2019-01-12 03:08:08 +00:00
|
|
|
certs, err := ctx.Client.Roots()
|
2019-01-05 01:51:32 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2019-01-09 21:20:28 +00:00
|
|
|
if ctx.Config.ClientCAs == nil {
|
|
|
|
ctx.Config.ClientCAs = x509.NewCertPool()
|
|
|
|
}
|
|
|
|
if ctx.Config.RootCAs == nil {
|
|
|
|
ctx.Config.RootCAs = x509.NewCertPool()
|
2019-01-08 01:48:56 +00:00
|
|
|
}
|
2019-01-05 01:51:32 +00:00
|
|
|
for _, cert := range certs.Certificates {
|
2019-01-09 21:20:28 +00:00
|
|
|
ctx.Config.ClientCAs.AddCert(cert.Certificate)
|
|
|
|
ctx.Config.RootCAs.AddCert(cert.Certificate)
|
2018-11-21 21:29:18 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2019-01-09 21:20:28 +00:00
|
|
|
return func(ctx *TLSOptionCtx) error {
|
|
|
|
ctx.OnRenewFunc = append(ctx.OnRenewFunc, fn)
|
|
|
|
return fn(ctx)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// AddFederationToCAs does a federation request and adds the resulting certs to the
|
|
|
|
// tls.Config RootCAs and ClientCAs. Combines the functionality of
|
|
|
|
// AddFederationToRootCAs and AddFederationToClientCAs.
|
|
|
|
func AddFederationToCAs() TLSOption {
|
|
|
|
fn := func(ctx *TLSOptionCtx) error {
|
2019-01-12 03:08:08 +00:00
|
|
|
certs, err := ctx.Client.Federation()
|
2019-01-09 21:20:28 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if ctx.Config.ClientCAs == nil {
|
|
|
|
ctx.Config.ClientCAs = x509.NewCertPool()
|
|
|
|
}
|
|
|
|
if ctx.Config.RootCAs == nil {
|
|
|
|
ctx.Config.RootCAs = x509.NewCertPool()
|
|
|
|
}
|
|
|
|
for _, cert := range certs.Certificates {
|
|
|
|
ctx.Config.ClientCAs.AddCert(cert.Certificate)
|
|
|
|
ctx.Config.RootCAs.AddCert(cert.Certificate)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
return func(ctx *TLSOptionCtx) error {
|
|
|
|
ctx.OnRenewFunc = append(ctx.OnRenewFunc, fn)
|
|
|
|
return fn(ctx)
|
|
|
|
}
|
2018-11-21 21:29:18 +00:00
|
|
|
}
|