tlsutil

Documentation

Index

• func WrapTLSClient(conn net.Conn, tlsConfig *tls.Config) (net.Conn, error)
• type Config
  • func (c *Config) AppendCA(pool *x509.CertPool) error
  • func (c *Config) IncomingTLSConfig() (*tls.Config, error)
  • func (c *Config) KeyPair() (*tls.Certificate, error)
  • func (c *Config) OutgoingTLSConfig() (*tls.Config, error)

Functions

func WrapTLSClient

func WrapTLSClient(conn net.Conn, tlsConfig *tls.Config) (net.Conn, error)

Wrap a net.Conn into a client tls connection, performing any additional verification as needed.

As of go 1.3, crypto/tls only supports either doing no certificate verification, or doing full verification including of the peer's DNS name. For consul, we want to validate that the certificate is signed by a known CA, but because consul doesn't use DNS names for node names, we don't verify the certificate DNS names. Since go 1.3 no longer supports this mode of operation, we have to do it manually.

Types

type Config

type Config struct {
	// VerifyIncoming is used to verify the authenticity of incoming connections.
	// This means that TCP requests are forbidden, only allowing for TLS. TLS connections
	// must match a provided certificate authority. This can be used to force client auth.
	VerifyIncoming bool

	// VerifyOutgoing is used to verify the authenticity of outgoing connections.
	// This means that TLS requests are used, and TCP requests are not made. TLS connections
	// must match a provided certificate authority. This is used to verify authenticity of
	// server nodes.
	VerifyOutgoing bool

	// CAFile is a path to a certificate authority file. This is used with VerifyIncoming
	// or VerifyOutgoing to verify the TLS connection.
	CAFile string

	// CertFile is used to provide a TLS certificate that is used for serving TLS connections.
	// Must be provided to serve TLS connections.
	CertFile string

	// KeyFile is used to provide a TLS key that is used for serving TLS connections.
	// Must be provided to serve TLS connections.
	KeyFile string

	// Node name is the name we use to advertise. Defaults to hostname.
	NodeName string

	// ServerName is used with the TLS certificate to ensure the name we
	// provide matches the certificate
	ServerName string
}

Config used to create tls.Config

func (*Config) AppendCA

func (c *Config) AppendCA(pool *x509.CertPool) error

AppendCA opens and parses the CA file and adds the certificates to the provided CertPool.

func (*Config) IncomingTLSConfig

func (c *Config) IncomingTLSConfig() (*tls.Config, error)

IncomingTLSConfig generates a TLS configuration for incoming requests

func (*Config) KeyPair

func (c *Config) KeyPair() (*tls.Certificate, error)

KeyPair is used to open and parse a certificate and key file

func (*Config) OutgoingTLSConfig

func (c *Config) OutgoingTLSConfig() (*tls.Config, error)

OutgoingTLSConfig generates a TLS configuration for outgoing requests. It will return a nil config if this configuration should not use TLS for outgoing connections.