|
1 | 1 | package connector
|
2 | 2 |
|
3 | 3 | import (
|
| 4 | + "crypto/tls" |
4 | 5 | "crypto/x509"
|
5 | 6 | "encoding/pem"
|
6 | 7 | "github.com/actionpay/postmanq/common"
|
|
20 | 21 |
|
21 | 22 | // почтовые сервисы будут хранится в карте по домену
|
22 | 23 | mailServers = make(map[string]*MailServer)
|
| 24 | + |
| 25 | + cipherSuites = []uint16{ |
| 26 | + tls.TLS_RSA_WITH_AES_128_CBC_SHA, |
| 27 | + tls.TLS_RSA_WITH_AES_256_CBC_SHA, |
| 28 | + tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, |
| 29 | + tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, |
| 30 | + tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, |
| 31 | + tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, |
| 32 | + tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, |
| 33 | + tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, |
| 34 | + } |
23 | 35 | )
|
24 | 36 |
|
25 | 37 | // сервис, управляющий соединениями к почтовым сервисам
|
@@ -60,17 +72,34 @@ func (s *Service) OnInit(event *common.ApplicationEvent) {
|
60 | 72 | func (s *Service) init(conf *Config, hostname string) {
|
61 | 73 | // если указан путь до сертификата
|
62 | 74 | if len(conf.CertFilename) > 0 {
|
| 75 | + conf.tlsConfig = &tls.Config{ |
| 76 | + ClientAuth: tls.RequireAndVerifyClientCert, |
| 77 | + CipherSuites: cipherSuites, |
| 78 | + MinVersion: tls.VersionTLS12, |
| 79 | + SessionTicketsDisabled: true, |
| 80 | + } |
| 81 | + |
63 | 82 | // пытаемся прочитать сертификат
|
64 | 83 | pemBytes, err := ioutil.ReadFile(conf.CertFilename)
|
65 | 84 | if err == nil {
|
66 | 85 | // получаем сертификат
|
67 | 86 | pemBlock, _ := pem.Decode(pemBytes)
|
68 | 87 | cert, _ := x509.ParseCertificate(pemBlock.Bytes)
|
69 |
| - conf.pool = x509.NewCertPool() |
70 |
| - conf.pool.AddCert(cert) |
| 88 | + pool := x509.NewCertPool() |
| 89 | + pool.AddCert(cert) |
| 90 | + conf.tlsConfig.RootCAs = pool |
| 91 | + conf.tlsConfig.ClientCAs = pool |
71 | 92 | } else {
|
72 | 93 | logger.By(hostname).FailExit("connection service can't read certificate %s, error - %v", conf.CertFilename, err)
|
73 | 94 | }
|
| 95 | + cert, err := tls.LoadX509KeyPair(conf.CertFilename, conf.PrivateKeyFilename) |
| 96 | + if err == nil { |
| 97 | + conf.tlsConfig.Certificates = []tls.Certificate{ |
| 98 | + cert, |
| 99 | + } |
| 100 | + } else { |
| 101 | + logger.By(hostname).FailExit("connection service can't load certificate %s, private key %s, error - %v", conf.CertFilename, conf.PrivateKeyFilename, err) |
| 102 | + } |
74 | 103 | } else {
|
75 | 104 | logger.By(hostname).Debug("connection service - certificate is not defined")
|
76 | 105 | }
|
@@ -106,11 +135,19 @@ func (s *Service) OnFinish() {
|
106 | 135 | close(events)
|
107 | 136 | }
|
108 | 137 |
|
109 |
| -func (s Service) getPool(hostname string) *x509.CertPool { |
| 138 | +func (s Service) getTlsConfig(hostname string) *tls.Config { |
110 | 139 | if conf, ok := s.Configs[hostname]; ok {
|
111 |
| - return conf.pool |
| 140 | + //tlsConfig := new(tls.Config) |
| 141 | + //tlsConfig.Certificates = conf.certs |
| 142 | + //tlsConfig.RootCAs = conf.pool |
| 143 | + //tlsConfig.ClientCAs = conf.pool |
| 144 | + //tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert |
| 145 | + //tlsConfig.CipherSuites = cipherSuites |
| 146 | + //tlsConfig.MinVersion = tls.VersionTLS12 |
| 147 | + //tlsConfig.SessionTicketsDisabled = true |
| 148 | + return conf.tlsConfig |
112 | 149 | } else {
|
113 |
| - logger.By(hostname).Err("connection service can't find cert by %s", hostname) |
| 150 | + logger.By(hostname).Err("connection service can't make tls config by %s", hostname) |
114 | 151 | return nil
|
115 | 152 | }
|
116 | 153 | }
|
@@ -172,8 +209,7 @@ type Config struct {
|
172 | 209 | // количество ip
|
173 | 210 | addressesLen int
|
174 | 211 |
|
175 |
| - // пул сертификатов |
176 |
| - pool *x509.CertPool |
| 212 | + tlsConfig *tls.Config |
177 | 213 |
|
178 | 214 | hostname string
|
179 | 215 | }
|
0 commit comments