GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — armor/tls.go at master · labstack/armor

This repository was archived by the owner on Sep 27, 2026. It is now read-only.

Expand file tree

/

tls.go

Copy path
More file actions
More file actions

Latest commit

 

History

History
History
94 lines (76 loc) · 2.32 KB
/

tls.go

Copy path

File metadata and controls

94 lines (76 loc) · 2.32 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
package armor
import (
"crypto/tls"
"crypto/x509"
"encoding/base64"
"os"
)
func init() {
os.Setenv("GODEBUG", os.Getenv("GODEBUG")+",tls13=1")
}
// setupTLSConfig builds the TLS configuration
func (a *Armor) setupTLSConfig() *tls.Config {
cfg := new(tls.Config)
cfg.GetConfigForClient = a.GetConfigForClient
if a.TLS.Secured {
cfg.MinVersion = tls.VersionTLS12
cfg.CipherSuites = []uint16{
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
}
}
return cfg
}
// GetConfigForClient implements the Config.GetClientCertificate callback
func (a *Armor) GetConfigForClient(clientHelloInfo *tls.ClientHelloInfo) (*tls.Config, error) {
// Get the host from the hello info
host := a.Hosts[clientHelloInfo.ServerName]
// If the host or the clientCAs are not configured the function
// returns the default TLS configuration
if host == nil || len(host.ClientCAs) == 0 {
return nil, nil
}
// Use existing host config if exist
if host.TLSConfig != nil {
return host.TLSConfig, nil
}
// Build and save the host config
host.TLSConfig = a.buildTLSConfig(clientHelloInfo, host)
return host.TLSConfig, nil
}
func (a *Armor) buildTLSConfig(clientHelloInfo *tls.ClientHelloInfo, host *Host) *tls.Config {
// Copy the configurations from the regular server
tlsConfig := new(tls.Config)
*tlsConfig = *a.Echo.TLSServer.TLSConfig
// Set the client validation and the certification pool
tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
tlsConfig.ClientCAs = a.buildClientCertPool(host)
return tlsConfig
}
func (a *Armor) buildClientCertPool(host *Host) (certPool *x509.CertPool) {
certPool = x509.NewCertPool()
// Loop every CA certs given as base64 DER encoding
for _, clientCAString := range host.ClientCAs {
// Decode base64
derBytes, err := base64.StdEncoding.DecodeString(clientCAString)
if err != nil {
continue
}
if len(derBytes) == 0 {
continue
}
// Parse the DER encoded certificate
var caCert *x509.Certificate
caCert, err = x509.ParseCertificate(derBytes)
if err != nil {
continue
}
// Add the certificate to CertPool
certPool.AddCert(caCert)
}
return certPool
}
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.