github/certigo
4
0
Fork 0
mirror of https://github.com/square/certigo.git synced 2024-04-21 12:32:40 +00:00
Code Issues Releases Wiki Activity

Add a --asuser flag which sets DB user & stmp EHLO hostname.

Browse Source
This commit is contained in:
Matthew McPherrin
2017-03-31 15:36:38 -07:00
parent 0232a800cf
commit 60f1c25a94
2 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
main.go
+2 -1
View File
@@ -50,6 +50,7 @@ var (
connectCert = connect.Flag("cert", "Client certificate chain for connecting to server (PEM).").ExistingFile()
connectKey = connect.Flag("key", "Private key for client certificate, if not in same file (PEM).").ExistingFile()
connectStartTLS = connect.Flag("start-tls", "Enable StartTLS protocol ('ldap', 'mysql', 'postgres', 'smtp' or 'ftp').").Short('t').PlaceHolder("PROTOCOL").Enum("mysql", "postgres", "psql", "smtp", "ldap", "ftp")
connectAs = connect.Flag("asuser", "With starttls, connect as this db user (or smtp ehlo)").Default("certigo").String()
connectTimeout = connect.Flag("timeout", "Timeout for connecting to remote server (can be '5m', '1s', etc).").Default("5s").Duration()
connectPem = connect.Flag("pem", "Write output as PEM blocks instead of human-readable format.").Short('m').Bool()
connectJSON = connect.Flag("json", "Write output as machine-readable JSON format.").Short('j').Bool()
@@ -104,7 +105,7 @@ func main() {
}
case connect.FullCommand(): // Get certs by connecting to a server
connState, err := starttls.GetConnectionState(*connectStartTLS, *connectName, *connectTo, *connectCert, *connectKey, *connectTimeout)
connState, err := starttls.GetConnectionState(*connectStartTLS, *connectName, *connectTo, *connectAs, *connectCert, *connectKey, *connectTimeout)
if err != nil {
fmt.Fprintf(os.Stderr, "%s\n", strings.TrimSuffix(err.Error(), "\n"))
os.Exit(1)
starttls/starttls.go
+6 -6
View File
@@ -62,9 +62,9 @@ func tlsConfigForConnect(connectName, clientCert, clientKey string) (*tls.Config
// GetConnectionState connects to a TLS server, returning the connection state.
// Currently, startTLSType can be one of "mysql", "postgres" or "psql", or the
// empty string, which does a normal TLS connection. connectTo specifies the
// address to connect to. connectName sets SNI. connectCert and connectKey are
// client certs
func GetConnectionState(startTLSType, connectName, connectTo, clientCert, clientKey string, timeout time.Duration) (*tls.ConnectionState, error) {
// address to connect to. connectName sets SNI. connectAs sets db username, smtp ehlo
// connectCert and connectKey are client certs
func GetConnectionState(startTLSType, connectName, connectTo, connectAs, clientCert, clientKey string, timeout time.Duration) (*tls.ConnectionState, error) {
var state *tls.ConnectionState
var err error
var tlsConfig *tls.Config
@@ -124,7 +124,7 @@ func GetConnectionState(startTLSType, connectName, connectTo, clientCert, client
res <- connectResult{state, nil}
case "mysql":
mysql.RegisterTLSConfig("certigo", tlsConfig)
state, err = mysql.DumpTLS(fmt.Sprintf("certigo@tcp(%s)/?tls=certigo&timeout=%s", connectTo, timeout.String()))
state, err = mysql.DumpTLS(fmt.Sprintf("%s@tcp(%s)/?tls=certigo&timeout=%s", connectAs, connectTo, timeout.String()))
if err != nil {
res <- connectResult{nil, err}
return
@@ -132,7 +132,7 @@ func GetConnectionState(startTLSType, connectName, connectTo, clientCert, client
res <- connectResult{state, nil}
case "postgres", "psql":
// Setting sslmode to "require" skips verification.
url := fmt.Sprintf("postgres://certigo@%s/?sslmode=require&connect_timeout=%d", connectTo, timeout/time.Second)
url := fmt.Sprintf("postgres://%s@%s/?sslmode=require&connect_timeout=%d", connectAs, connectTo, timeout/time.Second)
if clientCert != "" {
url += fmt.Sprintf("&sslcert=%s", clientCert)
}
@@ -154,7 +154,7 @@ func GetConnectionState(startTLSType, connectName, connectTo, clientCert, client
res <- connectResult{nil, err}
return
}
err = client.Hello("certigo")
err = client.Hello(connectAs)
if err != nil {
res <- connectResult{nil, err}
return