github/certigo
4
0
Fork 0
mirror of https://github.com/square/certigo.git synced 2024-04-21 12:32:40 +00:00
Code Issues Releases Wiki Activity

Merge pull request #136 from square/mmc/hello

Browse Source 
Add --identity flag for use with start-tls
This commit is contained in:
Matthew McPherrin
2017-04-04 17:30:44 -07:00
committed by GitHub
parent 1446099f4f b61f9af0af
commit 4c6e60fed5
2 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
main.go
+6 -1
View File
@@ -50,6 +50,7 @@ var (
connectCert = connect.Flag("cert", "Client certificate chain for connecting to server (PEM).").ExistingFile()
connectKey = connect.Flag("key", "Private key for client certificate, if not in same file (PEM).").ExistingFile()
connectStartTLS = connect.Flag("start-tls", "Enable StartTLS protocol ('ldap', 'mysql', 'postgres', 'smtp' or 'ftp').").Short('t').PlaceHolder("PROTOCOL").Enum("mysql", "postgres", "psql", "smtp", "ldap", "ftp")
connectIdentity = connect.Flag("identity", "With --start-tls, sets the DB user or SMTP EHLO name").Default("certigo").String()
connectTimeout = connect.Flag("timeout", "Timeout for connecting to remote server (can be '5m', '1s', etc).").Default("5s").Duration()
connectPem = connect.Flag("pem", "Write output as PEM blocks instead of human-readable format.").Short('m').Bool()
connectJSON = connect.Flag("json", "Write output as machine-readable JSON format.").Short('j').Bool()
@@ -104,7 +105,11 @@ func main() {
}
case connect.FullCommand(): // Get certs by connecting to a server
connState, err := starttls.GetConnectionState(*connectStartTLS, *connectName, *connectTo, *connectCert, *connectKey, *connectTimeout)
if connectStartTLS == nil && connectIdentity != nil {
fmt.Fprintln(os.Stderr, "--identity can only be used with --start-tls")
os.Exit(1)
}
connState, err := starttls.GetConnectionState(*connectStartTLS, *connectName, *connectTo, *connectIdentity, *connectCert, *connectKey, *connectTimeout)
if err != nil {
fmt.Fprintf(os.Stderr, "%s\n", strings.TrimSuffix(err.Error(), "\n"))
os.Exit(1)
starttls/starttls.go
+10 -5
View File
@@ -62,9 +62,9 @@ func tlsConfigForConnect(connectName, clientCert, clientKey string) (*tls.Config
// GetConnectionState connects to a TLS server, returning the connection state.
// Currently, startTLSType can be one of "mysql", "postgres" or "psql", or the
// empty string, which does a normal TLS connection. connectTo specifies the
// address to connect to. connectName sets SNI. connectCert and connectKey are
// client certs
func GetConnectionState(startTLSType, connectName, connectTo, clientCert, clientKey string, timeout time.Duration) (*tls.ConnectionState, error) {
// address to connect to. connectName sets SNI. connectAs sets db username, smtp ehlo
// connectCert and connectKey are client certs
func GetConnectionState(startTLSType, connectName, connectTo, identity, clientCert, clientKey string, timeout time.Duration) (*tls.ConnectionState, error) {
var state *tls.ConnectionState
var err error
var tlsConfig *tls.Config
@@ -124,7 +124,7 @@ func GetConnectionState(startTLSType, connectName, connectTo, clientCert, client
res <- connectResult{state, nil}
case "mysql":
mysql.RegisterTLSConfig("certigo", tlsConfig)
state, err = mysql.DumpTLS(fmt.Sprintf("certigo@tcp(%s)/?tls=certigo&timeout=%s", connectTo, timeout.String()))
state, err = mysql.DumpTLS(fmt.Sprintf("%s@tcp(%s)/?tls=certigo&timeout=%s", identity, connectTo, timeout.String()))
if err != nil {
res <- connectResult{nil, err}
return
@@ -132,7 +132,7 @@ func GetConnectionState(startTLSType, connectName, connectTo, clientCert, client
res <- connectResult{state, nil}
case "postgres", "psql":
// Setting sslmode to "require" skips verification.
url := fmt.Sprintf("postgres://certigo@%s/?sslmode=require&connect_timeout=%d", connectTo, timeout/time.Second)
url := fmt.Sprintf("postgres://%s@%s/?sslmode=require&connect_timeout=%d", identity, connectTo, timeout/time.Second)
if clientCert != "" {
url += fmt.Sprintf("&sslcert=%s", clientCert)
}
@@ -154,6 +154,11 @@ func GetConnectionState(startTLSType, connectName, connectTo, clientCert, client
res <- connectResult{nil, err}
return
}
err = client.Hello(identity)
if err != nil {
res <- connectResult{nil, err}
return
}
err = client.StartTLS(tlsConfig)
if err != nil {
res <- connectResult{nil, err}