hyung-hwan/hodu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

updated the server to trust the embedded cert if no client ca is explicitly specified

Browse Source
This commit is contained in:
hyung-hwan 2024-12-07 21:31:06 +09:00
parent 21997e6f74
commit 6d87351e5e
2 changed files with 24 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
client.go
View File

@ -519,7 +519,9 @@ func (r *ClientRoute) ReportEvent(pts_id uint32, event_type PACKET_KIND, event_d
} else { } else {
_, err = ptc.conn.Write(data) _, err = ptc.conn.Write(data)
if err != nil { if err != nil {
r.cts.cli.log.Write(r.cts.sid, LOG_ERROR, "Failed to write to peer(%d,%d,%s,%s) - %s", r.id, pts_id, ptc.conn.RemoteAddr().String(), ptc.conn.LocalAddr().String(), err.Error()) r.cts.cli.log.Write(r.cts.sid, LOG_ERROR,
"Failed to write to peer(%d,%d,%s,%s) - %s",
r.id, pts_id, ptc.conn.RemoteAddr().String(), ptc.conn.LocalAddr().String(), err.Error())
ptc.ReqStop() ptc.ReqStop()
} }
} }

42
cmd/config.go
View File

@ -128,6 +128,7 @@ func make_tls_server_config(cfg *ServerTLSConfig) (*tls.Config, error) {
if cfg.Enabled { if cfg.Enabled {
var cert tls.Certificate var cert tls.Certificate
var cert_pool *x509.CertPool var cert_pool *x509.CertPool
var ok bool
var err error var err error
if cfg.CertText != "" && cfg.KeyText != "" { if cfg.CertText != "" && cfg.KeyText != "" {
@ -142,26 +143,26 @@ func make_tls_server_config(cfg *ServerTLSConfig) (*tls.Config, error) {
return nil, fmt.Errorf("failed to load key pair - %s", err) return nil, fmt.Errorf("failed to load key pair - %s", err)
} }
if cfg.ClientCACertText != "" || cfg.ClientCACertFile != ""{ cert_pool = x509.NewCertPool()
var ok bool if cfg.ClientCACertText != "" {
ok = cert_pool.AppendCertsFromPEM([]byte(cfg.ClientCACertText))
cert_pool = x509.NewCertPool() if !ok {
return nil, fmt.Errorf("failed to append certificate to pool")
if cfg.ClientCACertText != "" { }
ok = cert_pool.AppendCertsFromPEM([]byte(cfg.ClientCACertText)) } else if cfg.ClientCACertFile != "" {
if !ok { var text []byte
return nil, fmt.Errorf("failed to append certificate to pool") text, err = ioutil.ReadFile(cfg.ClientCACertFile)
} if err != nil {
} else if cfg.ClientCACertFile != "" { return nil, fmt.Errorf("failed to load ca certficate file %s - %s", cfg.ClientCACertFile, err.Error())
var text []byte }
text, err = ioutil.ReadFile(cfg.ClientCACertFile) ok = cert_pool.AppendCertsFromPEM(text)
if err != nil { if !ok {
return nil, fmt.Errorf("failed to load ca certficate file %s - %s", cfg.ClientCACertFile, err.Error()) return nil, fmt.Errorf("failed to append certificate to pool")
} }
ok = cert_pool.AppendCertsFromPEM(text) } else {
if !ok { ok = cert_pool.AppendCertsFromPEM(hodu_tls_cert_text)
return nil, fmt.Errorf("failed to append certificate to pool") if !ok {
} return nil, fmt.Errorf("failed to append certificate to pool")
} }
} }
@ -201,7 +202,6 @@ func make_tls_client_config(cfg *ClientTLSConfig) (*tls.Config, error) {
} }
cert_pool = x509.NewCertPool() cert_pool = x509.NewCertPool()
if cfg.ServerCACertText != "" { if cfg.ServerCACertText != "" {
ok = cert_pool.AppendCertsFromPEM([]byte(cfg.ServerCACertText)) ok = cert_pool.AppendCertsFromPEM([]byte(cfg.ServerCACertText))
if !ok { if !ok {