forked from TrueCloudLab/certificates
109 lines
2.6 KiB
Go
109 lines
2.6 KiB
Go
package ca
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"sync"
|
|
|
|
"github.com/smallstep/certificates/api"
|
|
)
|
|
|
|
// mutableTLSConfig allows to use a tls.Config with mutable cert pools.
|
|
type mutableTLSConfig struct {
|
|
sync.RWMutex
|
|
config *tls.Config
|
|
clientCerts []*x509.Certificate
|
|
rootCerts []*x509.Certificate
|
|
mutClientCerts []*x509.Certificate
|
|
mutRootCerts []*x509.Certificate
|
|
}
|
|
|
|
// newMutableTLSConfig creates a new mutableTLSConfig that will be later
|
|
// initialized with a tls.Config.
|
|
func newMutableTLSConfig() *mutableTLSConfig {
|
|
return &mutableTLSConfig{
|
|
clientCerts: []*x509.Certificate{},
|
|
rootCerts: []*x509.Certificate{},
|
|
mutClientCerts: []*x509.Certificate{},
|
|
mutRootCerts: []*x509.Certificate{},
|
|
}
|
|
}
|
|
|
|
// Init initializes the mutable tls.Config with the given tls.Config.
|
|
func (c *mutableTLSConfig) Init(base *tls.Config) {
|
|
c.Lock()
|
|
c.config = base.Clone()
|
|
c.Unlock()
|
|
}
|
|
|
|
// TLSConfig returns the updated tls.Config it it has changed. It's used in the
|
|
// tls.Config GetConfigForClient.
|
|
func (c *mutableTLSConfig) TLSConfig() (config *tls.Config) {
|
|
c.RLock()
|
|
config = c.config
|
|
c.RUnlock()
|
|
return
|
|
}
|
|
|
|
// Reload reloads the tls.Config with the new CAs.
|
|
func (c *mutableTLSConfig) Reload() {
|
|
// Prepare new pools
|
|
c.RLock()
|
|
rootCAs := x509.NewCertPool()
|
|
clientCAs := x509.NewCertPool()
|
|
// Fixed certs
|
|
for _, cert := range c.rootCerts {
|
|
rootCAs.AddCert(cert)
|
|
}
|
|
for _, cert := range c.clientCerts {
|
|
clientCAs.AddCert(cert)
|
|
}
|
|
// Mutable certs
|
|
for _, cert := range c.mutRootCerts {
|
|
rootCAs.AddCert(cert)
|
|
}
|
|
for _, cert := range c.mutClientCerts {
|
|
clientCAs.AddCert(cert)
|
|
}
|
|
c.RUnlock()
|
|
|
|
// Set new pool
|
|
c.Lock()
|
|
c.config.RootCAs = rootCAs
|
|
c.config.ClientCAs = clientCAs
|
|
c.mutRootCerts = []*x509.Certificate{}
|
|
c.mutClientCerts = []*x509.Certificate{}
|
|
c.Unlock()
|
|
}
|
|
|
|
// AddImmutableClientCACert add an immutable cert to ClientCAs.
|
|
func (c *mutableTLSConfig) AddImmutableClientCACert(cert *x509.Certificate) {
|
|
c.Lock()
|
|
c.clientCerts = append(c.clientCerts, cert)
|
|
c.Unlock()
|
|
}
|
|
|
|
// AddImmutableRootCACert add an immutable cert to RootCas.
|
|
func (c *mutableTLSConfig) AddImmutableRootCACert(cert *x509.Certificate) {
|
|
c.Lock()
|
|
c.rootCerts = append(c.rootCerts, cert)
|
|
c.Unlock()
|
|
}
|
|
|
|
// AddClientCAs add mutable certs to ClientCAs.
|
|
func (c *mutableTLSConfig) AddClientCAs(certs []api.Certificate) {
|
|
c.Lock()
|
|
for _, cert := range certs {
|
|
c.mutClientCerts = append(c.mutClientCerts, cert.Certificate)
|
|
}
|
|
c.Unlock()
|
|
}
|
|
|
|
// AddRootCAs add mutable certs to RootCAs.
|
|
func (c *mutableTLSConfig) AddRootCAs(certs []api.Certificate) {
|
|
c.Lock()
|
|
for _, cert := range certs {
|
|
c.mutRootCerts = append(c.mutRootCerts, cert.Certificate)
|
|
}
|
|
c.Unlock()
|
|
}
|