-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathtls.go
More file actions
98 lines (82 loc) · 2.59 KB
/
Copy pathtls.go
File metadata and controls
98 lines (82 loc) · 2.59 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
package main
import (
"crypto/rand"
"crypto/rsa"
"crypto/sha256"
"crypto/tls"
"crypto/x509"
"encoding/hex"
"encoding/pem"
"fmt"
"io"
"math/big"
"os"
"time"
)
func loadTLSCerts() {
keyPair, err := tls.LoadX509KeyPair(local.DataDir+"cert.pem", local.DataDir+"key.pem")
if err != nil {
if os.IsNotExist(err) {
// Keys don't exist --> Generate now!
fmt.Println("No TLS Certificate found. Generating now...")
if err := generateTLSCerts(); err != nil {
fmt.Println("Could not generate TLS Certificates:", err)
logger.Fatal(err)
}
// Retry loading exactly once!
keyPair, err = tls.LoadX509KeyPair(local.DataDir+"cert.pem", local.DataDir+"key.pem")
if err != nil {
logger.Fatal(err)
}
} else {
// Something else went wrong!
fmt.Println("Error reading TLS Certificates:", err)
logger.Fatal(err)
}
}
local.keyPair = keyPair
logger.Println("Loaded TLS Certificate from files")
}
func generateTLSCerts() error {
key, err := rsa.GenerateKey(rand.Reader, 2048)
if err != nil {
panic(err)
}
// Serials should not collide, otherwise Browsers might complain if multiple instances try to access
// the Web UI and a cert using the same serial number is already registered locally. (It is however not relevant to security)
serial, _ := rand.Int(rand.Reader, big.NewInt(1<<63-1))
template := x509.Certificate{SerialNumber: serial, NotBefore: time.Now(), NotAfter: time.Now().Add(10 * 365 * 24 * time.Hour)}
certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
if err != nil {
panic(err)
}
keyFile, err := os.OpenFile(local.DataDir+"key.pem", os.O_CREATE|os.O_WRONLY, 0700)
certFile, err := os.OpenFile(local.DataDir+"cert.pem", os.O_CREATE|os.O_WRONLY, 0700)
err = pem.Encode(io.Writer(keyFile), &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
if err != nil {
return err
}
err = pem.Encode(io.Writer(certFile), &pem.Block{Type: "CERTIFICATE", Bytes: certDER})
if err != nil {
return err
}
keyFile.Close()
certFile.Close()
return err
}
func SHA256FromTLSCert(cert *x509.Certificate) string {
sha256sum := sha256.Sum256(cert.Raw)
return hex.EncodeToString(sha256sum[:])
}
func matchesAuthorizedKey(instanceUUID, sha256Sum string) bool {
if local.authorizedKeys.IsSet(instanceUUID) {
if local.authorizedKeys.Get(instanceUUID) == sha256Sum {
return true
} else {
logger.Println("Error: Authorized Keys: Instance", instanceUUID, "provided wrong certificate!")
return false
}
}
logger.Println("Error: Authorized Keys: No entry for instance", instanceUUID)
return false
}