-
Notifications
You must be signed in to change notification settings - Fork 23
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* added .p12 filetype to gitignore * added additional parameters for pkcs12 support * added additional config params for pkcs12 support. To avoid breaking change, CertType will automatically set to PEM if not configured. This will ensure previous configurations will remain working even if the new parameters are not defined. see line 77-81 * - "github.com/go-kit/kit/log" -> "github.com/go-kit/log" -> deprecation warning - added kingpin flags for pkcs12 parameters - added support for pkcs12 decoding and using for http.ListenAndServeTLS - specifying min tls version 1.2, ciphers and preferences * moved tls logic to separate file * fixed typo * extended README with PKCS12 relevant configuration options/examples
- Loading branch information
1 parent
1d88bb1
commit 84d2306
Showing
8 changed files
with
223 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,3 +5,4 @@ solace_prometheus_exporter | |
| .idea | ||
| *.iml | ||
| *.pem | ||
| *.p12 | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| package exporter | ||
|
|
||
| import ( | ||
| "crypto/tls" | ||
| "net/http" | ||
| "os" | ||
| "strings" | ||
|
|
||
| "github.com/go-kit/log/level" | ||
| "github.com/prometheus/common/promlog" | ||
| "software.sslmate.com/src/go-pkcs12" | ||
| ) | ||
|
|
||
| func ListenAndServeTLS(conf Config) { | ||
|
|
||
| promlogConfig := promlog.Config{ | ||
| Level: &promlog.AllowedLevel{}, | ||
| Format: &promlog.AllowedFormat{}, | ||
| } | ||
| promlogConfig.Level.Set("info") | ||
| promlogConfig.Format.Set("logfmt") | ||
|
|
||
| logger := promlog.New(&promlogConfig) | ||
|
|
||
| var tlsCert tls.Certificate | ||
|
|
||
| if strings.ToUpper(conf.CertType) == CERTTYPE_PKCS12 { | ||
|
|
||
| // Read byte data from pkcs12 keystore | ||
| p12_data, err := os.ReadFile(conf.Pkcs12File) | ||
| if err != nil { | ||
| level.Error(logger).Log("Error reading PKCS12 file", err) | ||
| return | ||
| } | ||
|
|
||
| // Extract cert and key from pkcs12 keystore | ||
| privateKey, leafCert, caCerts, err := pkcs12.DecodeChain(p12_data, conf.Pkcs12Pass) | ||
| if err != nil { | ||
| level.Error(logger).Log("PKCS12 - Error decoding chain", err) | ||
| return | ||
| } | ||
|
|
||
| certBytes := [][]byte{leafCert.Raw} | ||
| for _, ca := range caCerts { | ||
| certBytes = append(certBytes, ca.Raw) | ||
| } | ||
| tlsCert = tls.Certificate{ | ||
| Certificate: certBytes, | ||
| PrivateKey: privateKey, | ||
| } | ||
| } else { | ||
| var err error | ||
| tlsCert, err = tls.LoadX509KeyPair(conf.Certificate, conf.PrivateKey) | ||
| if err != nil { | ||
| level.Error(logger).Log("PEM - Error loading keypair", err) | ||
| return | ||
| } | ||
| } | ||
|
|
||
| cfg := &tls.Config{ | ||
| MinVersion: tls.VersionTLS12, | ||
| CurvePreferences: []tls.CurveID{tls.CurveP521, tls.CurveP384, tls.CurveP256}, | ||
| PreferServerCipherSuites: true, | ||
| CipherSuites: []uint16{ | ||
| tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, | ||
| tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, | ||
| tls.TLS_RSA_WITH_AES_256_GCM_SHA384, | ||
| tls.TLS_RSA_WITH_AES_256_CBC_SHA, | ||
| }, | ||
| Certificates: []tls.Certificate{tlsCert}, | ||
| } | ||
| http := &http.Server{ | ||
| Addr: conf.ListenAddr, | ||
| TLSConfig: cfg, | ||
| TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler), 0), | ||
| } | ||
|
|
||
| if err := http.ListenAndServeTLS("", ""); err != nil { | ||
| level.Error(logger).Log("msg", "Error starting HTTP server", "err", err) | ||
| os.Exit(2) | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters