Merge pull request #27 from smallstep/mariano/renew-pool
SDK should update certificate pools safelyseb/ct-local
commit
262a9d0978
@ -0,0 +1,109 @@
|
||||
package ca
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"sync"
|
||||
|
||||
"github.com/smallstep/certificates/api"
|
||||
)
|
||||
|
||||
// mutableTLSConfig allows to use a tls.Config with mutable cert pools.
|
||||
type mutableTLSConfig struct {
|
||||
sync.RWMutex
|
||||
config *tls.Config
|
||||
clientCerts []*x509.Certificate
|
||||
rootCerts []*x509.Certificate
|
||||
mutClientCerts []*x509.Certificate
|
||||
mutRootCerts []*x509.Certificate
|
||||
}
|
||||
|
||||
// newMutableTLSConfig creates a new mutableTLSConfig that will be later
|
||||
// initialized with a tls.Config.
|
||||
func newMutableTLSConfig() *mutableTLSConfig {
|
||||
return &mutableTLSConfig{
|
||||
clientCerts: []*x509.Certificate{},
|
||||
rootCerts: []*x509.Certificate{},
|
||||
mutClientCerts: []*x509.Certificate{},
|
||||
mutRootCerts: []*x509.Certificate{},
|
||||
}
|
||||
}
|
||||
|
||||
// Init initializes the mutable tls.Config with the given tls.Config.
|
||||
func (c *mutableTLSConfig) Init(base *tls.Config) {
|
||||
c.Lock()
|
||||
c.config = base.Clone()
|
||||
c.Unlock()
|
||||
}
|
||||
|
||||
// TLSConfig returns the updated tls.Config it it has changed. It's used in the
|
||||
// tls.Config GetConfigForClient.
|
||||
func (c *mutableTLSConfig) TLSConfig() (config *tls.Config) {
|
||||
c.RLock()
|
||||
config = c.config
|
||||
c.RUnlock()
|
||||
return
|
||||
}
|
||||
|
||||
// Reload reloads the tls.Config with the new CAs.
|
||||
func (c *mutableTLSConfig) Reload() {
|
||||
// Prepare new pools
|
||||
c.RLock()
|
||||
rootCAs := x509.NewCertPool()
|
||||
clientCAs := x509.NewCertPool()
|
||||
// Fixed certs
|
||||
for _, cert := range c.rootCerts {
|
||||
rootCAs.AddCert(cert)
|
||||
}
|
||||
for _, cert := range c.clientCerts {
|
||||
clientCAs.AddCert(cert)
|
||||
}
|
||||
// Mutable certs
|
||||
for _, cert := range c.mutRootCerts {
|
||||
rootCAs.AddCert(cert)
|
||||
}
|
||||
for _, cert := range c.mutClientCerts {
|
||||
clientCAs.AddCert(cert)
|
||||
}
|
||||
c.RUnlock()
|
||||
|
||||
// Set new pool
|
||||
c.Lock()
|
||||
c.config.RootCAs = rootCAs
|
||||
c.config.ClientCAs = clientCAs
|
||||
c.mutRootCerts = []*x509.Certificate{}
|
||||
c.mutClientCerts = []*x509.Certificate{}
|
||||
c.Unlock()
|
||||
}
|
||||
|
||||
// AddImmutableClientCACert add an immutable cert to ClientCAs.
|
||||
func (c *mutableTLSConfig) AddImmutableClientCACert(cert *x509.Certificate) {
|
||||
c.Lock()
|
||||
c.clientCerts = append(c.clientCerts, cert)
|
||||
c.Unlock()
|
||||
}
|
||||
|
||||
// AddImmutableRootCACert add an immutable cert to RootCas.
|
||||
func (c *mutableTLSConfig) AddImmutableRootCACert(cert *x509.Certificate) {
|
||||
c.Lock()
|
||||
c.rootCerts = append(c.rootCerts, cert)
|
||||
c.Unlock()
|
||||
}
|
||||
|
||||
// AddClientCAs add mutable certs to ClientCAs.
|
||||
func (c *mutableTLSConfig) AddClientCAs(certs []api.Certificate) {
|
||||
c.Lock()
|
||||
for _, cert := range certs {
|
||||
c.mutClientCerts = append(c.mutClientCerts, cert.Certificate)
|
||||
}
|
||||
c.Unlock()
|
||||
}
|
||||
|
||||
// AddRootCAs add mutable certs to RootCAs.
|
||||
func (c *mutableTLSConfig) AddRootCAs(certs []api.Certificate) {
|
||||
c.Lock()
|
||||
for _, cert := range certs {
|
||||
c.mutRootCerts = append(c.mutRootCerts, cert.Certificate)
|
||||
}
|
||||
c.Unlock()
|
||||
}
|
Loading…
Reference in New Issue