2018-04-13 04:01:10 -04:00
|
|
|
// +build !windows
|
2019-02-01 14:08:21 -05:00
|
|
|
// +build !confonly
|
2018-04-13 04:01:10 -04:00
|
|
|
|
|
|
|
package tls
|
|
|
|
|
2018-08-09 07:30:29 -04:00
|
|
|
import (
|
2018-11-16 11:00:16 -05:00
|
|
|
"bytes"
|
2018-08-09 07:30:29 -04:00
|
|
|
"crypto/x509"
|
|
|
|
"sync"
|
|
|
|
)
|
|
|
|
|
|
|
|
type certPoolCache struct {
|
|
|
|
sync.Mutex
|
|
|
|
once sync.Once
|
|
|
|
pool *x509.CertPool
|
|
|
|
extraCerts [][]byte
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *certPoolCache) hasCert(cert []byte) bool {
|
|
|
|
for _, xCert := range c.extraCerts {
|
2018-11-16 11:00:16 -05:00
|
|
|
if bytes.Equal(xCert, cert) {
|
2018-08-09 07:30:29 -04:00
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *certPoolCache) get(extraCerts []*Certificate) *x509.CertPool {
|
|
|
|
c.once.Do(func() {
|
|
|
|
pool, err := x509.SystemCertPool()
|
|
|
|
if err != nil {
|
|
|
|
newError("failed to get system cert pool.").Base(err).WriteToLog()
|
|
|
|
return
|
|
|
|
}
|
|
|
|
c.pool = pool
|
|
|
|
})
|
|
|
|
|
|
|
|
if c.pool == nil {
|
2018-04-13 04:01:10 -04:00
|
|
|
return nil
|
|
|
|
}
|
2018-08-09 07:30:29 -04:00
|
|
|
|
|
|
|
if len(extraCerts) == 0 {
|
|
|
|
return c.pool
|
|
|
|
}
|
|
|
|
|
|
|
|
c.Lock()
|
|
|
|
defer c.Unlock()
|
|
|
|
|
|
|
|
for _, cert := range extraCerts {
|
|
|
|
if !c.hasCert(cert.Certificate) {
|
|
|
|
c.pool.AppendCertsFromPEM(cert.Certificate)
|
|
|
|
c.extraCerts = append(c.extraCerts, cert.Certificate)
|
2018-04-13 04:01:10 -04:00
|
|
|
}
|
|
|
|
}
|
2018-08-09 07:30:29 -04:00
|
|
|
|
|
|
|
return c.pool
|
|
|
|
}
|
|
|
|
|
|
|
|
var combineCertPool certPoolCache
|
|
|
|
|
|
|
|
func (c *Config) getCertPool() *x509.CertPool {
|
|
|
|
return combineCertPool.get(c.Certificate)
|
2018-04-13 04:01:10 -04:00
|
|
|
}
|