From fb665ee94ad3b5c026bf5ed67fa587bf0934db00 Mon Sep 17 00:00:00 2001 From: ydx <906907952@qq.com> Date: Thu, 2 Sep 2021 04:12:03 +0800 Subject: [PATCH] add client certificate verify (#1169) --- infra/conf/transport_internet.go | 2 ++ transport/internet/tls/config.go | 6 ++++-- transport/internet/tls/config.pb.go | 33 +++++++++++++++++++---------- transport/internet/tls/config.proto | 3 +++ 4 files changed, 31 insertions(+), 13 deletions(-) diff --git a/infra/conf/transport_internet.go b/infra/conf/transport_internet.go index 07bd33a51..d24e94a43 100644 --- a/infra/conf/transport_internet.go +++ b/infra/conf/transport_internet.go @@ -318,6 +318,7 @@ type TLSConfig struct { EnableSessionResumption bool `json:"enableSessionResumption"` DisableSystemRoot bool `json:"disableSystemRoot"` PinnedPeerCertificateChainSha256 *[]string `json:"pinnedPeerCertificateChainSha256"` + ClientVerify bool `json:"clientVerify"` } // Build implements Buildable. @@ -333,6 +334,7 @@ func (c *TLSConfig) Build() (proto.Message, error) { } serverName := c.ServerName config.AllowInsecure = c.Insecure + config.ClientVerify = c.ClientVerify if len(c.ServerName) > 0 { config.ServerName = serverName } diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go index cbdd6a08c..fbaf50d53 100644 --- a/transport/internet/tls/config.go +++ b/transport/internet/tls/config.go @@ -211,7 +211,6 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config { SessionTicketsDisabled: true, } } - config := &tls.Config{ ClientSessionCache: globalSessionCache, RootCAs: root, @@ -219,12 +218,15 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config { NextProtos: c.NextProtocol, SessionTicketsDisabled: !c.EnableSessionResumption, VerifyPeerCertificate: c.verifyPeerCert, + ClientCAs: root, } for _, opt := range opts { opt(config) } - + if c.ClientVerify { + config.ClientAuth = tls.RequireAndVerifyClientCert + } config.Certificates = c.BuildCertificates() config.BuildNameToCertificate() diff --git a/transport/internet/tls/config.pb.go b/transport/internet/tls/config.pb.go index 82565fa08..0c6f095d6 100644 --- a/transport/internet/tls/config.pb.go +++ b/transport/internet/tls/config.pb.go @@ -157,6 +157,8 @@ type Config struct { //@Document This value replace allow_insecure. //@Critical PinnedPeerCertificateChainSha256 [][]byte `protobuf:"bytes,7,rep,name=pinned_peer_certificate_chain_sha256,json=pinnedPeerCertificateChainSha256,proto3" json:"pinned_peer_certificate_chain_sha256,omitempty"` + // Whether or not server verify client cert + ClientVerify bool `protobuf:"varint,8,opt,name=client_verify,json=clientVerify,proto3" json:"client_verify,omitempty"` } func (x *Config) Reset() { @@ -240,6 +242,13 @@ func (x *Config) GetPinnedPeerCertificateChainSha256() [][]byte { return nil } +func (x *Config) GetClientVerify() bool { + if x != nil { + return x.ClientVerify + } + return false +} + var File_transport_internet_tls_config_proto protoreflect.FileDescriptor var file_transport_internet_tls_config_proto_rawDesc = []byte{ @@ -260,7 +269,7 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{ 0x65, 0x12, 0x10, 0x0a, 0x0c, 0x45, 0x4e, 0x43, 0x49, 0x50, 0x48, 0x45, 0x52, 0x4d, 0x45, 0x4e, 0x54, 0x10, 0x00, 0x12, 0x14, 0x0a, 0x10, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x56, 0x45, 0x52, 0x49, 0x46, 0x59, 0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x41, 0x55, 0x54, - 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x49, 0x53, 0x53, 0x55, 0x45, 0x10, 0x02, 0x22, 0x83, + 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x49, 0x53, 0x53, 0x55, 0x45, 0x10, 0x02, 0x22, 0xa8, 0x03, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x25, 0x0a, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x69, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x49, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, @@ -285,16 +294,18 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{ 0x63, 0x68, 0x61, 0x69, 0x6e, 0x5f, 0x73, 0x68, 0x61, 0x32, 0x35, 0x36, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x20, 0x70, 0x69, 0x6e, 0x6e, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x53, 0x68, - 0x61, 0x32, 0x35, 0x36, 0x42, 0x84, 0x01, 0x0a, 0x25, 0x63, 0x6f, 0x6d, 0x2e, 0x76, 0x32, 0x72, - 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, - 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x74, 0x6c, 0x73, 0x50, 0x01, - 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x76, 0x32, 0x66, - 0x6c, 0x79, 0x2f, 0x76, 0x32, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x76, 0x34, - 0x2f, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, - 0x6e, 0x65, 0x74, 0x2f, 0x74, 0x6c, 0x73, 0xaa, 0x02, 0x21, 0x56, 0x32, 0x52, 0x61, 0x79, 0x2e, - 0x43, 0x6f, 0x72, 0x65, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x49, - 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x54, 0x6c, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, - 0x74, 0x6f, 0x33, + 0x61, 0x32, 0x35, 0x36, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x76, + 0x65, 0x72, 0x69, 0x66, 0x79, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x63, 0x6c, 0x69, + 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x42, 0x84, 0x01, 0x0a, 0x25, 0x63, 0x6f, + 0x6d, 0x2e, 0x76, 0x32, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x61, + 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, + 0x74, 0x6c, 0x73, 0x50, 0x01, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, + 0x6d, 0x2f, 0x76, 0x32, 0x66, 0x6c, 0x79, 0x2f, 0x76, 0x32, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, + 0x72, 0x65, 0x2f, 0x76, 0x34, 0x2f, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2f, + 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2f, 0x74, 0x6c, 0x73, 0xaa, 0x02, 0x21, 0x56, + 0x32, 0x52, 0x61, 0x79, 0x2e, 0x43, 0x6f, 0x72, 0x65, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, + 0x6f, 0x72, 0x74, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x54, 0x6c, 0x73, + 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( diff --git a/transport/internet/tls/config.proto b/transport/internet/tls/config.proto index 6d8e77435..6f2737bf1 100644 --- a/transport/internet/tls/config.proto +++ b/transport/internet/tls/config.proto @@ -48,4 +48,7 @@ message Config { @Critical */ repeated bytes pinned_peer_certificate_chain_sha256 = 7; + + // Whether or not server verify client cert + bool client_verify = 8; }