toki
2d6fde0876
apps/node 중심 구현 — TCP+JSON transport, Hexagonal Architecture, mock/cli adapter, fx DI, SQLite 실행 이력 저장. edge/control-plane/worker는 cobra placeholder. 유닛 테스트 및 통합 테스트 클라이언트 계획서 추가.
58 lines
1.5 KiB
Go
58 lines
1.5 KiB
Go
// Package auth provides mTLS certificate helpers for IOP transport.
|
|
package auth
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"fmt"
|
|
"os"
|
|
)
|
|
|
|
// LoadServerTLS builds a *tls.Config for the IOP TCP server with mTLS.
|
|
// cert, key: server certificate and private key paths.
|
|
// ca: path to the CA certificate that signs client certificates.
|
|
func LoadServerTLS(cert, key, ca string) (*tls.Config, error) {
|
|
serverCert, err := tls.LoadX509KeyPair(cert, key)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("load server cert: %w", err)
|
|
}
|
|
|
|
caCert, err := os.ReadFile(ca)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("read CA cert: %w", err)
|
|
}
|
|
pool := x509.NewCertPool()
|
|
if !pool.AppendCertsFromPEM(caCert) {
|
|
return nil, fmt.Errorf("failed to parse CA cert")
|
|
}
|
|
|
|
return &tls.Config{
|
|
Certificates: []tls.Certificate{serverCert},
|
|
ClientCAs: pool,
|
|
ClientAuth: tls.RequireAndVerifyClientCert,
|
|
MinVersion: tls.VersionTLS13,
|
|
}, nil
|
|
}
|
|
|
|
// LoadClientTLS builds a *tls.Config for an IOP TCP client with mTLS.
|
|
func LoadClientTLS(cert, key, ca string) (*tls.Config, error) {
|
|
clientCert, err := tls.LoadX509KeyPair(cert, key)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("load client cert: %w", err)
|
|
}
|
|
|
|
caCert, err := os.ReadFile(ca)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("read CA cert: %w", err)
|
|
}
|
|
pool := x509.NewCertPool()
|
|
if !pool.AppendCertsFromPEM(caCert) {
|
|
return nil, fmt.Errorf("failed to parse CA cert")
|
|
}
|
|
|
|
return &tls.Config{
|
|
Certificates: []tls.Certificate{clientCert},
|
|
RootCAs: pool,
|
|
MinVersion: tls.VersionTLS13,
|
|
}, nil
|
|
}
|