tAdd support for TLS client certificate verification. - tlstun - simple go program to add tls support to other listeners (HTM) git clone https://git.parazyd.org/tlstun (DIR) Log (DIR) Files (DIR) Refs (DIR) README (DIR) LICENSE --- (DIR) commit 48ad34fd00cc54697ce8c1768c904b607a7f0a49 (DIR) parent d96f89b04770e586b53e5d03c96b808b0be887cc (HTM) Author: parazyd <parazyd@dyne.org> Date: Tue, 9 Jul 2019 15:23:20 +0200 Add support for TLS client certificate verification. Diffstat: M tlstun.go | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) --- (DIR) diff --git a/tlstun.go b/tlstun.go t@@ -21,18 +21,23 @@ package main import ( "crypto/tls" + "crypto/x509" + "errors" "flag" "io" + "io/ioutil" "log" "net" "os" ) var ( + cacert = flag.String("ca", "ca.pem", "Path for CA certificate file") cert = flag.String("c", "server.pem", "Path for Certificate file") key = flag.String("k", "server-key.pem", "Path for Key file") listen = flag.String("l", "127.0.0.1:7443", "Listen address") forward = flag.String("f", "127.0.0.1:72", "Forward address") + client = flag.Bool("vc", false, "Do client verification") verbose = flag.Bool("v", false, "Verbose mode") ) t@@ -42,10 +47,25 @@ func tlsConfig(cert, key string) (*tls.Config, error) { return nil, err } - return &tls.Config{ + tlscfg := &tls.Config{ Certificates: []tls.Certificate{creds}, MinVersion: tls.VersionTLS13, }, nil + + if *client { + certpool := x509.NewCertPool() + pem, err := ioutil.ReadFile(*cacert) + if err != nil { + return nil, err + } + if !certpool.AppendCertsFromPEM(pem) { + return nil, errors.New("Cannot parse client certificate authority") + } + tlscfg.ClientCAs = certpool + tlscfg.ClientAuth = tls.RequireAndVerifyClientCert + } + + return tlscfg, nil } func tunnel(conn net.Conn) { t@@ -87,6 +107,12 @@ func server() (net.Listener, error) { func main() { flag.Parse() + if *client { + if _, err := os.Stat(*cacert); os.IsNotExist(err) { + log.Fatal("Cannot find CA certificate.") + } + } + if _, err := os.Stat(*cert); os.IsNotExist(err) { log.Fatal("Cannot find certificate.") }