mirror of
https://github.com/hanzoai/grpc-web.git
synced 2026-10-30 18:35:37 +00:00
Cyrille HemidyandMilan Pavlik
f445f22229
* fix doc for WithAllowedRequestHeaders * fix example * gofmt * golint
83 lines
2.4 KiB
Go
83 lines
2.4 KiB
Go
package main
|
|
|
|
import (
|
|
"crypto/tls"
|
|
|
|
"github.com/mwitkow/go-conntrack/connhelpers"
|
|
logrus "github.com/sirupsen/logrus"
|
|
"github.com/spf13/pflag"
|
|
|
|
"crypto/x509"
|
|
"io/ioutil"
|
|
)
|
|
|
|
var (
|
|
flagTlsServerCert = pflag.String(
|
|
"server_tls_cert_file",
|
|
"",
|
|
"Path to the PEM certificate for server use.")
|
|
|
|
flagTlsServerKey = pflag.String(
|
|
"server_tls_key_file",
|
|
"../misc/localhost.key",
|
|
"Path to the PEM key for the certificate for the server use.")
|
|
|
|
flagTlsServerClientCertVerification = pflag.String(
|
|
"server_tls_client_cert_verification",
|
|
"none",
|
|
"Controls whether a client certificate is on. Values: none, verify_if_given, require.")
|
|
|
|
flagTlsServerClientCAFiles = pflag.StringSlice(
|
|
"server_tls_client_ca_files",
|
|
[]string{},
|
|
"Paths (comma separated) to PEM certificate chains used for client-side verification. If empty, host CA chain will be used.",
|
|
)
|
|
)
|
|
|
|
func buildServerTlsOrFail() *tls.Config {
|
|
if *flagTlsServerCert == "" || *flagTlsServerKey == "" {
|
|
logrus.Fatalf("flags server_tls_cert_file and server_tls_key_file must be set")
|
|
}
|
|
tlsConfig, err := connhelpers.TlsConfigForServerCerts(*flagTlsServerCert, *flagTlsServerKey)
|
|
if err != nil {
|
|
logrus.Fatalf("failed reading TLS server keys: %v", err)
|
|
}
|
|
tlsConfig.MinVersion = tls.VersionTLS12
|
|
switch *flagTlsServerClientCertVerification {
|
|
case "none":
|
|
tlsConfig.ClientAuth = tls.NoClientCert
|
|
case "verify_if_given":
|
|
tlsConfig.ClientAuth = tls.VerifyClientCertIfGiven
|
|
case "require":
|
|
tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
|
|
default:
|
|
logrus.Fatalf("Uknown value '%v' for server_tls_client_cert_verification", *flagTlsServerClientCertVerification)
|
|
}
|
|
if tlsConfig.ClientAuth != tls.NoClientCert {
|
|
if len(*flagTlsServerClientCAFiles) > 0 {
|
|
tlsConfig.ClientCAs = x509.NewCertPool()
|
|
for _, path := range *flagTlsServerClientCAFiles {
|
|
data, err := ioutil.ReadFile(path)
|
|
if err != nil {
|
|
logrus.Fatalf("failed reading client CA file %v: %v", path, err)
|
|
}
|
|
if ok := tlsConfig.ClientCAs.AppendCertsFromPEM(data); !ok {
|
|
logrus.Fatalf("failed processing client CA file %v", path)
|
|
}
|
|
}
|
|
} else {
|
|
var err error
|
|
tlsConfig.ClientCAs, err = x509.SystemCertPool()
|
|
if err != nil {
|
|
logrus.Fatalf("no client CA files specified, fallback to system CA chain failed: %v", err)
|
|
}
|
|
}
|
|
|
|
}
|
|
tlsConfig, err = connhelpers.TlsConfigWithHttp2Enabled(tlsConfig)
|
|
if err != nil {
|
|
logrus.Fatalf("can't configure h2 handling: %v", err)
|
|
}
|
|
return tlsConfig
|
|
}
|