107 lines
3.0 KiB
Go
107 lines
3.0 KiB
Go
|
package tlsconfig
|
||
|
|
|
||
|
|
import (
|
||
|
|
"bytes"
|
||
|
|
"crypto/sha256"
|
||
|
|
"crypto/tls"
|
||
|
|
"crypto/x509"
|
||
|
|
"encoding/base64"
|
||
|
|
"errors"
|
||
|
|
"fmt"
|
||
|
|
"os"
|
||
|
|
"strings"
|
||
|
|
"time"
|
||
|
|
)
|
||
|
|
|
||
|
|
type Options struct {
|
||
|
|
InsecureSkipVerify bool
|
||
|
|
CAPath string
|
||
|
|
SPKIPins []string
|
||
|
|
ClientCertPath string
|
||
|
|
ClientKeyPath string
|
||
|
|
}
|
||
|
|
|
||
|
|
func Build(options Options) (*tls.Config, error) {
|
||
|
|
pins, err := decodePins(options.SPKIPins)
|
||
|
|
if err != nil {
|
||
|
|
return nil, err
|
||
|
|
}
|
||
|
|
|
||
|
|
tlsConfig := &tls.Config{
|
||
|
|
MinVersion: tls.VersionTLS12,
|
||
|
|
}
|
||
|
|
|
||
|
|
if strings.TrimSpace(options.CAPath) != "" {
|
||
|
|
caCert, err := os.ReadFile(options.CAPath)
|
||
|
|
if err != nil {
|
||
|
|
return nil, fmt.Errorf("read TLS CA: %w", err)
|
||
|
|
}
|
||
|
|
caCertPool := x509.NewCertPool()
|
||
|
|
if !caCertPool.AppendCertsFromPEM(caCert) {
|
||
|
|
return nil, errors.New("parse TLS CA: no certificates found")
|
||
|
|
}
|
||
|
|
tlsConfig.RootCAs = caCertPool
|
||
|
|
}
|
||
|
|
|
||
|
|
if strings.TrimSpace(options.ClientCertPath) != "" || strings.TrimSpace(options.ClientKeyPath) != "" {
|
||
|
|
if strings.TrimSpace(options.ClientCertPath) == "" || strings.TrimSpace(options.ClientKeyPath) == "" {
|
||
|
|
return nil, errors.New("both TLS client certificate and key are required")
|
||
|
|
}
|
||
|
|
certificate, err := tls.LoadX509KeyPair(options.ClientCertPath, options.ClientKeyPath)
|
||
|
|
if err != nil {
|
||
|
|
return nil, fmt.Errorf("load TLS client certificate: %w", err)
|
||
|
|
}
|
||
|
|
tlsConfig.Certificates = []tls.Certificate{certificate}
|
||
|
|
}
|
||
|
|
|
||
|
|
if len(pins) > 0 {
|
||
|
|
// Verification is performed below against an embedded application pin.
|
||
|
|
// This intentionally supports self-signed certificates without trusting
|
||
|
|
// arbitrary certificates from the network or host trust store.
|
||
|
|
tlsConfig.InsecureSkipVerify = true //nolint:gosec
|
||
|
|
tlsConfig.VerifyConnection = func(state tls.ConnectionState) error {
|
||
|
|
return verifyPinnedConnection(state, pins, time.Now())
|
||
|
|
}
|
||
|
|
return tlsConfig, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
tlsConfig.InsecureSkipVerify = options.InsecureSkipVerify //nolint:gosec
|
||
|
|
return tlsConfig, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func decodePins(values []string) ([][]byte, error) {
|
||
|
|
result := make([][]byte, 0, len(values))
|
||
|
|
for _, value := range values {
|
||
|
|
value = strings.TrimSpace(strings.TrimPrefix(value, "sha256/"))
|
||
|
|
if value == "" {
|
||
|
|
continue
|
||
|
|
}
|
||
|
|
decoded, err := base64.StdEncoding.DecodeString(value)
|
||
|
|
if err != nil || len(decoded) != sha256.Size {
|
||
|
|
return nil, fmt.Errorf("invalid TLS SPKI pin %q", value)
|
||
|
|
}
|
||
|
|
result = append(result, decoded)
|
||
|
|
}
|
||
|
|
return result, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func verifyPinnedConnection(state tls.ConnectionState, pins [][]byte, now time.Time) error {
|
||
|
|
if len(state.PeerCertificates) == 0 {
|
||
|
|
return errors.New("TLS peer did not provide a certificate")
|
||
|
|
}
|
||
|
|
leaf := state.PeerCertificates[0]
|
||
|
|
if now.Before(leaf.NotBefore) || now.After(leaf.NotAfter) {
|
||
|
|
return fmt.Errorf("TLS peer certificate is not valid at %s", now.UTC().Format(time.RFC3339))
|
||
|
|
}
|
||
|
|
sum := sha256.Sum256(leaf.RawSubjectPublicKeyInfo)
|
||
|
|
for _, pin := range pins {
|
||
|
|
if bytes.Equal(sum[:], pin) {
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return fmt.Errorf(
|
||
|
|
"TLS server identity pin mismatch (received sha256/%s)",
|
||
|
|
base64.StdEncoding.EncodeToString(sum[:]),
|
||
|
|
)
|
||
|
|
}
|