tAdd support for TLS client certificate verification. - tlstun - simple go program to add tls support to other listeners
HTML git clone https://git.parazyd.org/tlstun
DIR Log
DIR Files
DIR Refs
DIR README
DIR LICENSE
---
DIR commit 48ad34fd00cc54697ce8c1768c904b607a7f0a49
DIR parent d96f89b04770e586b53e5d03c96b808b0be887cc
HTML Author: parazyd <parazyd@dyne.org>
Date: Tue, 9 Jul 2019 15:23:20 +0200
Add support for TLS client certificate verification.
Diffstat:
M tlstun.go | 28 +++++++++++++++++++++++++++-
1 file changed, 27 insertions(+), 1 deletion(-)
---
DIR diff --git a/tlstun.go b/tlstun.go
t@@ -21,18 +21,23 @@ package main
import (
"crypto/tls"
+ "crypto/x509"
+ "errors"
"flag"
"io"
+ "io/ioutil"
"log"
"net"
"os"
)
var (
+ cacert = flag.String("ca", "ca.pem", "Path for CA certificate file")
cert = flag.String("c", "server.pem", "Path for Certificate file")
key = flag.String("k", "server-key.pem", "Path for Key file")
listen = flag.String("l", "127.0.0.1:7443", "Listen address")
forward = flag.String("f", "127.0.0.1:72", "Forward address")
+ client = flag.Bool("vc", false, "Do client verification")
verbose = flag.Bool("v", false, "Verbose mode")
)
t@@ -42,10 +47,25 @@ func tlsConfig(cert, key string) (*tls.Config, error) {
return nil, err
}
- return &tls.Config{
+ tlscfg := &tls.Config{
Certificates: []tls.Certificate{creds},
MinVersion: tls.VersionTLS13,
}, nil
+
+ if *client {
+ certpool := x509.NewCertPool()
+ pem, err := ioutil.ReadFile(*cacert)
+ if err != nil {
+ return nil, err
+ }
+ if !certpool.AppendCertsFromPEM(pem) {
+ return nil, errors.New("Cannot parse client certificate authority")
+ }
+ tlscfg.ClientCAs = certpool
+ tlscfg.ClientAuth = tls.RequireAndVerifyClientCert
+ }
+
+ return tlscfg, nil
}
func tunnel(conn net.Conn) {
t@@ -87,6 +107,12 @@ func server() (net.Listener, error) {
func main() {
flag.Parse()
+ if *client {
+ if _, err := os.Stat(*cacert); os.IsNotExist(err) {
+ log.Fatal("Cannot find CA certificate.")
+ }
+ }
+
if _, err := os.Stat(*cert); os.IsNotExist(err) {
log.Fatal("Cannot find certificate.")
}