1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
package networkdial
import (
"cmp"
"crypto/tls"
"crypto/x509"
"fmt"
)
type TLSConfigOptions struct {
CABundle []byte
ServerName string
Certificates []tls.Certificate
MinVersion uint16
}
func NewTLSConfig(opts TLSConfigOptions) (*tls.Config, error) {
cfg := &tls.Config{
ServerName: normalizeHost(opts.ServerName),
Certificates: append([]tls.Certificate(nil), opts.Certificates...),
MinVersion: opts.MinVersion,
}
cfg.MinVersion = cmp.Or(cfg.MinVersion, tls.VersionTLS12)
if len(opts.CABundle) > 0 {
pool := x509.NewCertPool()
if !pool.AppendCertsFromPEM(opts.CABundle) {
return nil, ErrInvalidCABundle
}
cfg.RootCAs = pool
}
return cfg, nil
}
func TLSConfigFromCA(caBundlePEM []byte, serverName string) (*tls.Config, error) {
if len(caBundlePEM) == 0 {
return nil, ErrNoCABundle
}
cfg, err := NewTLSConfig(TLSConfigOptions{CABundle: caBundlePEM, ServerName: serverName})
if err != nil {
return nil, fmt.Errorf("networkdial: building the network TLS config: %w", err)
}
return cfg, nil
}
