Skip to content

Commit c1b76fe

Browse files
author
Julien Pivotto
authored
Merge pull request #158 from fayzal-g/pass-tls-config-inline
Allow passing of TLS certificates inline
2 parents ef8864f + 6192b91 commit c1b76fe

7 files changed

+261
-30
lines changed

‎docs/web-configuration.md‎

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,24 @@ Generic placeholders are defined as follows:
2323

2424
```
2525
tls_server_config:
26+
# Certificate for server to use to authenticate to client.
27+
# Expected to be passed as a PEM encoded sequence of bytes as a string.
28+
#
29+
# NOTE: If passing the cert inline, cert_file should not be specified below.
30+
[ cert: <string> ]
31+
32+
# Key for server to use to authenticate to client.
33+
# Expected to be passed as a PEM encoded sequence of bytes as a string.
34+
#
35+
# NOTE: If passing the key inline, key_file should not be specified below.
36+
[ key: <secret> ]
37+
38+
# CA certificate for client certificate authentication to the server.
39+
# Expected to be passed as a PEM encoded sequence of bytes as a string.
40+
#
41+
# NOTE: If passing the client_ca inline, client_ca_file should not be specified below.
42+
[ client_ca: <string> ]
43+
2644
# Certificate and key files for server to use to authenticate to client.
2745
cert_file: <filename>
2846
key_file: <filename>
@@ -37,14 +55,14 @@ tls_server_config:
3755
3856
# CA certificate for client certificate authentication to the server.
3957
[ client_ca_file: <filename> ]
40-
41-
# Verify that the client certificate has a Subject Alternate Name (SAN)
42-
# which is an exact match to an entry in this list, else terminate the
43-
# connection. SAN match can be one or multiple of the following: DNS,
58+
59+
# Verify that the client certificate has a Subject Alternate Name (SAN)
60+
# which is an exact match to an entry in this list, else terminate the
61+
# connection. SAN match can be one or multiple of the following: DNS,
4462
# IP, e-mail, or URI address from https://pkg.go.dev/crypto/x509#Certificate.
4563
[ client_allowed_sans:
4664
[ - <string> ] ]
47-
65+
4866
# Minimum TLS version that is acceptable.
4967
[ min_version: <string> | default = "TLS12" ]
5068

‎web/testdata/tls_config_noAuth.requireanyclientcertkeyinline.good.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
tls_server_config:
2+
cert_file: "server.crt"
3+
key: |
4+
-----BEGIN PRIVATE KEY-----
5+
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDT5dSL/8/jPIxx
6+
1EoIDobwkv9CHzYvNvjqa8GpZoUi9Rckaxnhw6SgKyKx4Wpe6LpIsyavesCk3XVF
7+
boYz0e7K0mF+ydqD85429hZix5w/Mvs8TvN1zQOVggwdMgPyoVh4Q5ndqYoU02Tq
8+
PY7xot/i8iKl1HosCKcbjZx9oIaFMvg08zQpJy5CCgFZwz6DNQCNFrtuK7NeAPGV
9+
Vor82Pz/MRsJTJg53a6x8CczEhDHh+yCYvYceMyWpaaGE1aumdEb9Pu0qUvorMIv
10+
3jCCw4Zkry8NEeMd9cZM7DzrVLKHFY4AQhhhh6O9CErAMbC+hPUBXtrsGUr2wSn6
11+
LiWjNLcUSGWoTHh8uXoIdvidPL7mSqPTwwVsCsKkGeCm+1rYHpIsnC5hWvzmBy1F
12+
/jsPEF7uR1Pb/V5T/RldhUA5GtiLjE7UuSQhLeXvXXUm+ClW5EQIXy9rJwPsNJ5q
13+
3wgZa5U4Rc+RL8uUDQKNTkcIhPvIDVHNdhALvSt0yvVklGDaywm5Dd6AS/g1afGO
14+
qqrlKShGxJYbCfVePRK69yz2l6c+Wlu04eqBau1Dge3IaikNkjZd/4U5TVMPMBW/
15+
UIvAF7PuEsx6ONSBHvUGQb6XrnFZnXsGySrzUvFMbNsJrU6thtgHt6hs1pevNie2
16+
lMNV+mOOjmp0AzbQ1ULxjdQluZLwlwIDAQABAoICAQCxGs9jlBQ1YU4hdcXKphmy
17+
yan/ogavv8qcZCQhakasyRzmm32ubM8T7/m3oyg821eXm+Uhlf+dzFtQBOi2NyjW
18+
7LAAQMYas2vxlA1x0lSNnhbOeU6Tjx8HvwJRBJS4HpLLMfVQh3uZnHYkMf9fhzqJ
19+
fMfowoa6dyD0ro+1kI3elpNN7lgSbWUEXUhztfRxxcMIKY/OrUflsfQ5VXQlkVck
20+
E+78/r/c3aQ9pPOeg+LyYnETKZN6iJy27Q0Z0uAIXxefvksC3N1NQ9eqGpOBN9sE
21+
HEe/LMwfJmTvtiPUrZ3pueJN5PBr0+rO/Dc+HEoVcxs0Yguoehtl0l07dYaPumep
22+
TmXdrKvCkwM5cwnbXSWrCpqMS8Medb3zWvNnWO/mjRwTZyhmNdscjh3Ilvo+YCus
23+
wM8HJFD4FuMtL3GtIfoKeszppACTkOOYiViGHmKUiQaSEwF7nhuIQqgN3ULCP7Z5
24+
mhL2RhLWacPfATITNkm4g2o16mFohZ9HPZSkPGm8rw7yhB1s2emoocXsms2iR1oa
25+
mggNnUS3m87Z/HmOEyObIQZtYf1ZNuVAGGP4kmhhtNfMTmq3CPYM3oMRR1nb8Ci8
26+
zYwjEIvLYuDVlZFff4+IA7tCBZPichieoioaxutnYtO+nvuzDRiitL4my2EcXeE7
27+
tcIunkP9u5BNiXsfNcy3gQKCAQEA3X9eZ/IPF9Rrsjwtqkt7Oxn/uJ8JCotVBLnq
28+
SCd7sCSaM06jUzMjMoj4SYyjzBYLycH/q+euT4UoPdPMKCfwx2NgR87MfuehWzwG
29+
pmPbAbLJtLmZ+M/Bz5QzGS3J3f4qYxLptLHX971JgtTdcJhOAc+p/Elt3l43d/fr
30+
sMVrZ8hqHlXmA6WuwqHjHnGP1ML6xFfsjDZ2jQ3VEV17XKtinucgitvkVuHYmtdQ
31+
wm/yrM8vDkyglgk47j9CyfQdL10elBxe32WY5B0g9TmhIMypmlJk7inPPnAqJ4TF
32+
JJBMvZOB9cJAjrtsDN3tAW/1q+wPF1HLwurqTLluZEc5MVjaOQKCAQEA9OenKlxB
33+
5HiANjH0riaokFDtjC27iHoeBkbEt+CyegGXVHEotVcKnG+N4Tw/GXcS9m33vu/X
34+
Lmeowp/Z2BKxB7xvw81jQh8gEoUHFlH6DgksTPjVVSEa4wnESrqlFjRquBexpU6e
35+
X//xVD72b0txAqJvpvtbxZC41WIwUBTBkHDlj2hegEzUvgzdO92FPRUDrAgB0wSv
36+
05U6fh1/4c3XTHqIHK4/gxiVRmjnpEdjEbOZsfbN8LGQK2eq4FkIS870VKigUZ/U
37+
m2YB+8PKKyqKdXpWQHMZ9QvXoU9AwMw4Q+NEk4a/ZrnnMo59voKP1Qoqhd/rEAP7
38+
xa1AMOAl2DhhTwKCAQBdY4Z6bSTP91AxJg5a7thWYu/e967oMzb1dy3AnmUYL1aU
39+
q2NRgQ4mEHofCJ1HP0RZHOKfqF9mR85fwx0hETYD23KM1DSEjUULIpPrM87zOF6z
40+
RE4XCgG9c87XnuauIqvceezvssxMOBL2hqmW/6BkQxp4tL0ONMtOWcmWDqbqayXT
41+
BISmpQS6K2eHPnpWSp9QiYHC3HO/pUVgvPl2aQx70xd1dKEhwLeDEaWLVYgMNI6y
42+
iLxshhbq3OFcJQDpJ2ntKMkXh86e32k1+8Zj/ebEmljT0ez/dmtPnjtA31Z71+XD
43+
qNNvWraD9k4nfP0oL69tNZ+j30hKcSSKQz1qAPyBAoIBAGBaI3KPCX2Ryx+HV/SM
44+
URU2Qb883uM66EUf4pVVWeKWbatTOejebdZOLUvIICsspdE+QpJkWgxvy/2GVnak
45+
I/IfOPmX/M0u4bdnjvpBFlgfU8aUv5nWhHV+ijO8aubpiHMVH1ciLz0lvRSgEOSI
46+
kdWvgq33houb/Jw3HTrkb6McR7S8IzHnCGwdM40yAhGeCuvL2qvi1CoyM+kaQg3c
47+
pi/4pURjaalyKoihDUGctGVqe7WAnFVuBoKNLrVFUfZBXe9QyIJUl5jr8SvUQ93n
48+
xsGhd/2zSysVlahpPdicgCZ1a61+/h60VTmWxfIF/ACdF03EYv7SEmQbXX3dMgZ3
49+
aBECggEBALXqdEIkb9pBhwCvUHFG+c/IKBhS6j7BUj9PrZ3MATPXHo6Iy09d/dlV
50+
psFQzWVvBmf3pcI0MEi7xdUMSN0jhZ8xp1owDlOQSM8DCQPFLaC38sfhZNThIfz0
51+
Q+fWYPe1lkRBtMVSokN1PtE5zETHlUKkh3fdQs0wihX4Wikc64rjCgXqXc8ng8Lk
52+
NCUNBY/7pNfrEm0Zxz+8CvmRaBbL4OT2/hFsdcMiO3P24mCdAPgJ4v97pr8KxRHe
53+
SmOyiSdaAyXHr/6+3KgO5pX8YUn9WiTF2hxo4SG3NQuuva0SBZT9B8iFXt1uFUtP
54+
Rri7hsjysanKPyaPM1oofbRyWApMyRo=
55+
-----END PRIVATE KEY-----
56+
client_auth_type: "RequireAnyClientCert"

‎web/testdata/web_config_noAuth_cert_empty.bad.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
tls_server_config:
2+
cert: ""
3+
key_file: "server.key"

‎web/testdata/web_config_noAuth_key_empty.bad.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
tls_server_config:
2+
cert_file: "server.crt"
3+
key: ""

‎web/testdata/web_config_noAuth_tlsInline.good.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
tls_server_config:
2+
cert: |
3+
-----BEGIN CERTIFICATE-----
4+
MIIFsDCCA5igAwIBAgIRAMMSh5NoexSCjSvDRf1fpgMwDQYJKoZIhvcNAQELBQAw
5+
aTELMAkGA1UEBhMCVVMxEzARBgNVBAoTClByb21ldGhldXMxKTAnBgNVBAsTIFBy
6+
b21ldGhldXMgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRowGAYDVQQDExFQcm9tZXRo
7+
ZXVzIFRMUyBDQTAgFw0yMjA3MDgwOTE1MDdaGA8yMDcyMDYyNTA5MTUwN1owNjEL
8+
MAkGA1UEBhMCVVMxEzARBgNVBAoTClByb21ldGhldXMxEjAQBgNVBAMTCWxvY2Fs
9+
aG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANPl1Iv/z+M8jHHU
10+
SggOhvCS/0IfNi82+OprwalmhSL1FyRrGeHDpKArIrHhal7oukizJq96wKTddUVu
11+
hjPR7srSYX7J2oPznjb2FmLHnD8y+zxO83XNA5WCDB0yA/KhWHhDmd2pihTTZOo9
12+
jvGi3+LyIqXUeiwIpxuNnH2ghoUy+DTzNCknLkIKAVnDPoM1AI0Wu24rs14A8ZVW
13+
ivzY/P8xGwlMmDndrrHwJzMSEMeH7IJi9hx4zJalpoYTVq6Z0Rv0+7SpS+iswi/e
14+
MILDhmSvLw0R4x31xkzsPOtUsocVjgBCGGGHo70ISsAxsL6E9QFe2uwZSvbBKfou
15+
JaM0txRIZahMeHy5egh2+J08vuZKo9PDBWwKwqQZ4Kb7WtgekiycLmFa/OYHLUX+
16+
Ow8QXu5HU9v9XlP9GV2FQDka2IuMTtS5JCEt5e9ddSb4KVbkRAhfL2snA+w0nmrf
17+
CBlrlThFz5Evy5QNAo1ORwiE+8gNUc12EAu9K3TK9WSUYNrLCbkN3oBL+DVp8Y6q
18+
quUpKEbElhsJ9V49Err3LPaXpz5aW7Th6oFq7UOB7chqKQ2SNl3/hTlNUw8wFb9Q
19+
i8AXs+4SzHo41IEe9QZBvpeucVmdewbJKvNS8Uxs2wmtTq2G2Ae3qGzWl682J7aU
20+
w1X6Y46OanQDNtDVQvGN1CW5kvCXAgMBAAGjgYMwgYAwDgYDVR0PAQH/BAQDAgUg
21+
MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB8G
22+
A1UdIwQYMBaAFMaaHh5g0+YopeLd1IkizXyK9K/zMCAGA1UdEQQZMBeCCWxvY2Fs
23+
aG9zdIcEfwAAAYcEfwAAADANBgkqhkiG9w0BAQsFAAOCAgEAUXL/lzbgbs6whVrE
24+
3wkp0oDGVZ0Jti1hpeQk7Slt3PHsgu9OQOSGcv9QHs0ybhkDWZQjoCH6Nurx5QaY
25+
GnpNQjylfy3zAziO0c7C1uXf7Z9AEMQwbOHFLefnvq86MtnwJ7sadQo+ViwtMgOW
26+
He4YhkTyu2CqK8GFXRQUNm/SunffXp5zErPCNQURh4hrDUGlXPzyxgx1DyqFvF4S
27+
X8IpsoED3d7cbEL7E9dgXNl7wuy3qoPi9P9KydFTIELBGt1oco980S1attSM9159
28+
t9iUIUMT4EdzmZxpIyJMCD+Lz9Y3zWVyz7DTqFWOtAtmhM4lu44K4S4d/JfAGEal
29+
3h3SMCbBPKwpsloO4r9TeGi2f+T7hfiFMdCezEyG8sXrObCDyVudyUnXnxDkZ5TQ
30+
NOzqJaUJHeKzb+Z9WSovce3Pb8ok3GoDugmwqyjuN/rz/0jsDTJm18I6HHtONbUp
31+
AIV/H/4+Kewc+Ztv97J7MeQB/2VKcY3vpZpMSEkg2ummRhXUfi0haxfoSCKvRwiD
32+
BElUVtwHTsn3OBnKMGcBt32iLVsvbb/0AtNpohznPdQT7dqDVguejmwHn/fc4u4Q
33+
vfAay/ACARti9XKGplQi7xn+OoYcAVPLYitYBRNEc6t+4f3EKehrDIMRCnxOFBVX
34+
9Dnm1DebturSQQEOuX5rP15lG1I=
35+
-----END CERTIFICATE-----
36+
key: |
37+
-----BEGIN PRIVATE KEY-----
38+
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDT5dSL/8/jPIxx
39+
1EoIDobwkv9CHzYvNvjqa8GpZoUi9Rckaxnhw6SgKyKx4Wpe6LpIsyavesCk3XVF
40+
boYz0e7K0mF+ydqD85429hZix5w/Mvs8TvN1zQOVggwdMgPyoVh4Q5ndqYoU02Tq
41+
PY7xot/i8iKl1HosCKcbjZx9oIaFMvg08zQpJy5CCgFZwz6DNQCNFrtuK7NeAPGV
42+
Vor82Pz/MRsJTJg53a6x8CczEhDHh+yCYvYceMyWpaaGE1aumdEb9Pu0qUvorMIv
43+
3jCCw4Zkry8NEeMd9cZM7DzrVLKHFY4AQhhhh6O9CErAMbC+hPUBXtrsGUr2wSn6
44+
LiWjNLcUSGWoTHh8uXoIdvidPL7mSqPTwwVsCsKkGeCm+1rYHpIsnC5hWvzmBy1F
45+
/jsPEF7uR1Pb/V5T/RldhUA5GtiLjE7UuSQhLeXvXXUm+ClW5EQIXy9rJwPsNJ5q
46+
3wgZa5U4Rc+RL8uUDQKNTkcIhPvIDVHNdhALvSt0yvVklGDaywm5Dd6AS/g1afGO
47+
qqrlKShGxJYbCfVePRK69yz2l6c+Wlu04eqBau1Dge3IaikNkjZd/4U5TVMPMBW/
48+
UIvAF7PuEsx6ONSBHvUGQb6XrnFZnXsGySrzUvFMbNsJrU6thtgHt6hs1pevNie2
49+
lMNV+mOOjmp0AzbQ1ULxjdQluZLwlwIDAQABAoICAQCxGs9jlBQ1YU4hdcXKphmy
50+
yan/ogavv8qcZCQhakasyRzmm32ubM8T7/m3oyg821eXm+Uhlf+dzFtQBOi2NyjW
51+
7LAAQMYas2vxlA1x0lSNnhbOeU6Tjx8HvwJRBJS4HpLLMfVQh3uZnHYkMf9fhzqJ
52+
fMfowoa6dyD0ro+1kI3elpNN7lgSbWUEXUhztfRxxcMIKY/OrUflsfQ5VXQlkVck
53+
E+78/r/c3aQ9pPOeg+LyYnETKZN6iJy27Q0Z0uAIXxefvksC3N1NQ9eqGpOBN9sE
54+
HEe/LMwfJmTvtiPUrZ3pueJN5PBr0+rO/Dc+HEoVcxs0Yguoehtl0l07dYaPumep
55+
TmXdrKvCkwM5cwnbXSWrCpqMS8Medb3zWvNnWO/mjRwTZyhmNdscjh3Ilvo+YCus
56+
wM8HJFD4FuMtL3GtIfoKeszppACTkOOYiViGHmKUiQaSEwF7nhuIQqgN3ULCP7Z5
57+
mhL2RhLWacPfATITNkm4g2o16mFohZ9HPZSkPGm8rw7yhB1s2emoocXsms2iR1oa
58+
mggNnUS3m87Z/HmOEyObIQZtYf1ZNuVAGGP4kmhhtNfMTmq3CPYM3oMRR1nb8Ci8
59+
zYwjEIvLYuDVlZFff4+IA7tCBZPichieoioaxutnYtO+nvuzDRiitL4my2EcXeE7
60+
tcIunkP9u5BNiXsfNcy3gQKCAQEA3X9eZ/IPF9Rrsjwtqkt7Oxn/uJ8JCotVBLnq
61+
SCd7sCSaM06jUzMjMoj4SYyjzBYLycH/q+euT4UoPdPMKCfwx2NgR87MfuehWzwG
62+
pmPbAbLJtLmZ+M/Bz5QzGS3J3f4qYxLptLHX971JgtTdcJhOAc+p/Elt3l43d/fr
63+
sMVrZ8hqHlXmA6WuwqHjHnGP1ML6xFfsjDZ2jQ3VEV17XKtinucgitvkVuHYmtdQ
64+
wm/yrM8vDkyglgk47j9CyfQdL10elBxe32WY5B0g9TmhIMypmlJk7inPPnAqJ4TF
65+
JJBMvZOB9cJAjrtsDN3tAW/1q+wPF1HLwurqTLluZEc5MVjaOQKCAQEA9OenKlxB
66+
5HiANjH0riaokFDtjC27iHoeBkbEt+CyegGXVHEotVcKnG+N4Tw/GXcS9m33vu/X
67+
Lmeowp/Z2BKxB7xvw81jQh8gEoUHFlH6DgksTPjVVSEa4wnESrqlFjRquBexpU6e
68+
X//xVD72b0txAqJvpvtbxZC41WIwUBTBkHDlj2hegEzUvgzdO92FPRUDrAgB0wSv
69+
05U6fh1/4c3XTHqIHK4/gxiVRmjnpEdjEbOZsfbN8LGQK2eq4FkIS870VKigUZ/U
70+
m2YB+8PKKyqKdXpWQHMZ9QvXoU9AwMw4Q+NEk4a/ZrnnMo59voKP1Qoqhd/rEAP7
71+
xa1AMOAl2DhhTwKCAQBdY4Z6bSTP91AxJg5a7thWYu/e967oMzb1dy3AnmUYL1aU
72+
q2NRgQ4mEHofCJ1HP0RZHOKfqF9mR85fwx0hETYD23KM1DSEjUULIpPrM87zOF6z
73+
RE4XCgG9c87XnuauIqvceezvssxMOBL2hqmW/6BkQxp4tL0ONMtOWcmWDqbqayXT
74+
BISmpQS6K2eHPnpWSp9QiYHC3HO/pUVgvPl2aQx70xd1dKEhwLeDEaWLVYgMNI6y
75+
iLxshhbq3OFcJQDpJ2ntKMkXh86e32k1+8Zj/ebEmljT0ez/dmtPnjtA31Z71+XD
76+
qNNvWraD9k4nfP0oL69tNZ+j30hKcSSKQz1qAPyBAoIBAGBaI3KPCX2Ryx+HV/SM
77+
URU2Qb883uM66EUf4pVVWeKWbatTOejebdZOLUvIICsspdE+QpJkWgxvy/2GVnak
78+
I/IfOPmX/M0u4bdnjvpBFlgfU8aUv5nWhHV+ijO8aubpiHMVH1ciLz0lvRSgEOSI
79+
kdWvgq33houb/Jw3HTrkb6McR7S8IzHnCGwdM40yAhGeCuvL2qvi1CoyM+kaQg3c
80+
pi/4pURjaalyKoihDUGctGVqe7WAnFVuBoKNLrVFUfZBXe9QyIJUl5jr8SvUQ93n
81+
xsGhd/2zSysVlahpPdicgCZ1a61+/h60VTmWxfIF/ACdF03EYv7SEmQbXX3dMgZ3
82+
aBECggEBALXqdEIkb9pBhwCvUHFG+c/IKBhS6j7BUj9PrZ3MATPXHo6Iy09d/dlV
83+
psFQzWVvBmf3pcI0MEi7xdUMSN0jhZ8xp1owDlOQSM8DCQPFLaC38sfhZNThIfz0
84+
Q+fWYPe1lkRBtMVSokN1PtE5zETHlUKkh3fdQs0wihX4Wikc64rjCgXqXc8ng8Lk
85+
NCUNBY/7pNfrEm0Zxz+8CvmRaBbL4OT2/hFsdcMiO3P24mCdAPgJ4v97pr8KxRHe
86+
SmOyiSdaAyXHr/6+3KgO5pX8YUn9WiTF2hxo4SG3NQuuva0SBZT9B8iFXt1uFUtP
87+
Rri7hsjysanKPyaPM1oofbRyWApMyRo=
88+
-----END PRIVATE KEY-----
89+
client_auth_type: "VerifyClientCertIfGiven"

‎web/tls_config.go‎

Lines changed: 59 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -43,16 +43,19 @@ type Config struct {
4343
}
4444

4545
type TLSConfig struct {
46-
TLSCertPath string `yaml:"cert_file"`
47-
TLSKeyPath string `yaml:"key_file"`
48-
ClientAuth string `yaml:"client_auth_type"`
49-
ClientCAs string `yaml:"client_ca_file"`
50-
CipherSuites []Cipher `yaml:"cipher_suites"`
51-
CurvePreferences []Curve `yaml:"curve_preferences"`
52-
MinVersion TLSVersion `yaml:"min_version"`
53-
MaxVersion TLSVersion `yaml:"max_version"`
54-
PreferServerCipherSuites bool `yaml:"prefer_server_cipher_suites"`
55-
ClientAllowedSans []string `yaml:"client_allowed_sans"`
46+
TLSCert string `yaml:"cert"`
47+
TLSKey config_util.Secret `yaml:"key"`
48+
ClientCAsText string `yaml:"client_ca"`
49+
TLSCertPath string `yaml:"cert_file"`
50+
TLSKeyPath string `yaml:"key_file"`
51+
ClientAuth string `yaml:"client_auth_type"`
52+
ClientCAs string `yaml:"client_ca_file"`
53+
CipherSuites []Cipher `yaml:"cipher_suites"`
54+
CurvePreferences []Curve `yaml:"curve_preferences"`
55+
MinVersion TLSVersion `yaml:"min_version"`
56+
MaxVersion TLSVersion `yaml:"max_version"`
57+
PreferServerCipherSuites bool `yaml:"prefer_server_cipher_suites"`
58+
ClientAllowedSans []string `yaml:"client_allowed_sans"`
5659
}
5760

5861
type FlagConfig struct {
@@ -132,22 +135,54 @@ func getTLSConfig(configPath string) (*tls.Config, error) {
132135
return ConfigToTLSConfig(&c.TLSConfig)
133136
}
134137

135-
// ConfigToTLSConfig generates the golang tls.Config from the TLSConfig struct.
136-
func ConfigToTLSConfig(c *TLSConfig) (*tls.Config, error) {
137-
if c.TLSCertPath == "" && c.TLSKeyPath == "" && c.ClientAuth == "" && c.ClientCAs == "" {
138-
return nil, errNoTLSConfig
138+
func validateTLSPaths(c *TLSConfig) error {
139+
if c.TLSCertPath == "" && c.TLSCert == "" &&
140+
c.TLSKeyPath == "" && c.TLSKey == "" &&
141+
c.ClientCAs == "" && c.ClientCAsText == "" &&
142+
c.ClientAuth == "" {
143+
return errNoTLSConfig
139144
}
140145

141-
if c.TLSCertPath == "" {
142-
return nil, errors.New("missing cert_file")
146+
if c.TLSCertPath == "" && c.TLSCert == "" {
147+
return errors.New("missing one of cert or cert_file")
143148
}
144149

145-
if c.TLSKeyPath == "" {
146-
return nil, errors.New("missing key_file")
150+
if c.TLSKeyPath == "" && c.TLSKey == "" {
151+
return errors.New("missing one of key or key_file")
152+
}
153+
154+
return nil
155+
}
156+
157+
// ConfigToTLSConfig generates the golang tls.Config from the TLSConfig struct.
158+
func ConfigToTLSConfig(c *TLSConfig) (*tls.Config, error) {
159+
if err := validateTLSPaths(c); err != nil {
160+
return nil, err
147161
}
148162

149163
loadCert := func() (*tls.Certificate, error) {
150-
cert, err := tls.LoadX509KeyPair(c.TLSCertPath, c.TLSKeyPath)
164+
var certData, keyData []byte
165+
var err error
166+
167+
if c.TLSCertPath != "" {
168+
certData, err = os.ReadFile(c.TLSCertPath)
169+
if err != nil {
170+
return nil, fmt.Errorf("failed to read cert_file (%s): %s", c.TLSCertPath, err)
171+
}
172+
} else {
173+
certData = []byte(c.TLSCert)
174+
}
175+
176+
if c.TLSKeyPath != "" {
177+
keyData, err = os.ReadFile(c.TLSKeyPath)
178+
if err != nil {
179+
return nil, fmt.Errorf("failed to read key_file (%s): %s", c.TLSKeyPath, err)
180+
}
181+
} else {
182+
keyData = []byte(c.TLSKey)
183+
}
184+
185+
cert, err := tls.X509KeyPair(certData, keyData)
151186
if err != nil {
152187
return nil, fmt.Errorf("failed to load X509KeyPair: %w", err)
153188
}
@@ -193,6 +228,10 @@ func ConfigToTLSConfig(c *TLSConfig) (*tls.Config, error) {
193228
}
194229
clientCAPool.AppendCertsFromPEM(clientCAFile)
195230
cfg.ClientCAs = clientCAPool
231+
} else if c.ClientCAsText != "" {
232+
clientCAPool := x509.NewCertPool()
233+
clientCAPool.AppendCertsFromPEM([]byte(c.ClientCAsText))
234+
cfg.ClientCAs = clientCAPool
196235
}
197236

198237
if c.ClientAllowedSans != nil {
@@ -215,7 +254,7 @@ func ConfigToTLSConfig(c *TLSConfig) (*tls.Config, error) {
215254
return nil, errors.New("Invalid ClientAuth: " + c.ClientAuth)
216255
}
217256

218-
if c.ClientCAs != "" && cfg.ClientAuth == tls.NoClientCert {
257+
if (c.ClientCAs != "" || c.ClientCAsText != "") && cfg.ClientAuth == tls.NoClientCert {
219258
return nil, errors.New("Client CA's have been configured without a Client Auth Policy")
220259
}
221260

‎web/tls_config_test.go‎

Lines changed: 28 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,8 @@ var (
5151
"Invalid ClientAuth": regexp.MustCompile(`invalid ClientAuth`),
5252
"TLS handshake": regexp.MustCompile(`tls`),
5353
"HTTP Request to HTTPS server": regexp.MustCompile(`HTTP`),
54-
"Invalid CertPath": regexp.MustCompile(`missing cert_file`),
55-
"Invalid KeyPath": regexp.MustCompile(`missing key_file`),
54+
"Invalid Cert or CertPath": regexp.MustCompile(`missing one of cert or cert_file`),
55+
"Invalid Key or KeyPath": regexp.MustCompile(`missing one of key or key_file`),
5656
"ClientCA set without policy": regexp.MustCompile(`Client CA's have been configured without a Client Auth Policy`),
5757
"Bad password": regexp.MustCompile(`hashedSecret too short to be a bcrypted password`),
5858
"Unauthorized": regexp.MustCompile(`Unauthorized`),
@@ -127,17 +127,27 @@ func TestYAMLFiles(t *testing.T) {
127127
{
128128
Name: `invalid config yml (cert path empty)`,
129129
YAMLConfigPath: "testdata/web_config_noAuth_certPath_empty.bad.yml",
130-
ExpectedError: ErrorMap["Invalid CertPath"],
130+
ExpectedError: ErrorMap["Invalid Cert or CertPath"],
131+
},
132+
{
133+
Name: `invalid config yml (cert empty)`,
134+
YAMLConfigPath: "testdata/web_config_noAuth_cert_empty.bad.yml",
135+
ExpectedError: ErrorMap["Invalid Cert or CertPath"],
131136
},
132137
{
133138
Name: `invalid config yml (key path empty)`,
134139
YAMLConfigPath: "testdata/web_config_noAuth_keyPath_empty.bad.yml",
135-
ExpectedError: ErrorMap["Invalid KeyPath"],
140+
ExpectedError: ErrorMap["Invalid Key or KeyPath"],
141+
},
142+
{
143+
Name: `invalid config yml (key empty)`,
144+
YAMLConfigPath: "testdata/web_config_noAuth_key_empty.bad.yml",
145+
ExpectedError: ErrorMap["Invalid Key or KeyPath"],
136146
},
137147
{
138148
Name: `invalid config yml (cert path and key path empty)`,
139149
YAMLConfigPath: "testdata/web_config_noAuth_certPath_keyPath_empty.bad.yml",
140-
ExpectedError: ErrorMap["Invalid CertPath"],
150+
ExpectedError: ErrorMap["Invalid Cert or CertPath"],
141151
},
142152
{
143153
Name: `invalid config yml (cert path invalid)`,
@@ -215,6 +225,12 @@ func TestServerBehaviour(t *testing.T) {
215225
UseTLSClient: true,
216226
ExpectedError: nil,
217227
},
228+
{
229+
Name: `valid tls config yml (cert and key inline) and tls client`,
230+
YAMLConfigPath: "testdata/web_config_noAuth_tlsInline.good.yml",
231+
UseTLSClient: true,
232+
ExpectedError: nil,
233+
},
218234
{
219235
Name: `valid tls config yml with TLS 1.1 client`,
220236
YAMLConfigPath: "testdata/web_config_noAuth.good.yml",
@@ -328,6 +344,13 @@ func TestServerBehaviour(t *testing.T) {
328344
ClientCertificate: "client_selfsigned",
329345
ExpectedError: nil,
330346
},
347+
{
348+
Name: `valid tls config yml (cert from file, key inline) and tls client with RequireAnyClientCert (present certificate)`,
349+
YAMLConfigPath: "testdata/tls_config_noAuth.requireanyclientcert.good.yml",
350+
UseTLSClient: true,
351+
ClientCertificate: "client_selfsigned",
352+
ExpectedError: nil,
353+
},
331354
{
332355
Name: `valid tls config yml and tls client with RequireAndVerifyClientCert`,
333356
YAMLConfigPath: "testdata/tls_config_noAuth.requireandverifyclientcert.good.yml",

0 commit comments

Comments
 (0)