From 3dedf8fac2e1d4792ec1a7f67b7b70c09b275b22 Mon Sep 17 00:00:00 2001 From: chenyu1990 Date: Sun, 14 Jun 2020 00:21:25 +0800 Subject: [PATCH 1/5] multiple domain TLS --- configs/config.toml | 22 +++++++++++--- internal/app/app.go | 55 ++++++++++++++++++++++++++++++----- internal/app/config/config.go | 3 +- 3 files changed, 67 insertions(+), 13 deletions(-) diff --git a/configs/config.toml b/configs/config.toml index e5ca9ebe..b9c27646 100644 --- a/configs/config.toml +++ b/configs/config.toml @@ -15,15 +15,29 @@ PrintConfig = true Host = "0.0.0.0" # http监听端口 Port = 10088 -# 证书路径 -CertFile = "" -# 证书密钥 -KeyFile = "" # http优雅关闭等待超时时长(单位秒) ShutdownTimeout = 30 # 允许的最大内容长度(64M) MaxContentLength = 67108864 +# 证书 a.com +[[HTTP.Certificates]] +# 启用证书 +Enable = false +# 证书路径 +CertFile = "/srv/cert/letsencript/a.com/fullchain.pem" +# 证书密钥 +KeyFile = "/srv/cert/letsencript/a.com/privkey.pem" + +# 证书 b.com +[[HTTP.Certificates]] +# 启用证书 +Enable = false +# 证书路径 +CertFile = "/srv/cert/letsencript/b.com/fullchain.pem" +# 证书密钥 +KeyFile = "/srv/cert/letsencript/b.com/privkey.pem" + [Menu] # 使用启用初始化菜单数据 Enable = true diff --git a/internal/app/app.go b/internal/app/app.go index 40d0beb1..ab39b834 100644 --- a/internal/app/app.go +++ b/internal/app/app.go @@ -167,15 +167,56 @@ func InitHTTPServer(ctx context.Context, handler http.Handler) func() { go func() { logger.Printf(ctx, "HTTP server is running at %s.", addr) - var err error - if cfg.CertFile != "" && cfg.KeyFile != "" { - srv.TLSConfig = &tls.Config{MinVersion: tls.VersionTLS12} - err = srv.ListenAndServeTLS(cfg.CertFile, cfg.KeyFile) + var ( + err error + enableTLS bool + tlsConfig tls.Config + ) + if l := len(cfg.Certificates); l > 0 { + tlsConfig.Certificates = make([]tls.Certificate, l) + for index, cert := range cfg.Certificates { + enable, ok := cert["Enable"].(bool) + if !ok || !enable { + continue + } + + certFile, ok := cert["CertFile"].(string) + if !ok || certFile == "" { + panic("CertFile错误") + } + keyFile, ok := cert["KeyFile"].(string) + if !ok || keyFile == "" { + panic("KeyFile错误") + } + tlsConfig.Certificates[index], err = tls.LoadX509KeyPair( + certFile, + keyFile, + ) + if err != nil { + panic(err) + } + + enableTLS = true + } + } + + if enableTLS { + tlsConfig.MinVersion = tls.VersionTLS12 + tlsConfig.BuildNameToCertificate() + srv.TLSConfig = &tlsConfig + listener, err := tls.Listen("tcp", addr, &tlsConfig) + if err != nil { + panic(err) + } + err = srv.Serve(listener) + if err != nil { + panic(err) + } } else { err = srv.ListenAndServe() - } - if err != nil && err != http.ErrServerClosed { - panic(err) + if err != nil && err != http.ErrServerClosed { + panic(err) + } } }() diff --git a/internal/app/config/config.go b/internal/app/config/config.go index 51361483..af140cab 100644 --- a/internal/app/config/config.go +++ b/internal/app/config/config.go @@ -173,8 +173,7 @@ type JWTAuth struct { type HTTP struct { Host string Port int - CertFile string - KeyFile string + Certificates []map[string]interface{} ShutdownTimeout int MaxContentLength int64 } From 8192df7200de3d0c628323b54d4be67492acce0f Mon Sep 17 00:00:00 2001 From: chenyu1990 Date: Sun, 14 Jun 2020 23:20:41 +0800 Subject: [PATCH 2/5] multiple domain TLS --- configs/config.toml | 4 ++-- internal/app/app.go | 9 +++------ 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/configs/config.toml b/configs/config.toml index b9c27646..0124f9f5 100644 --- a/configs/config.toml +++ b/configs/config.toml @@ -159,13 +159,13 @@ RedisDB = 10 [CORS] # 是否启用 -Enable = false +Enable = true # 允许跨域请求的域名列表(*表示全部允许) AllowOrigins = ["*"] # 允许跨域请求的请求方式列表 AllowMethods = ["GET","POST","PUT","DELETE","PATCH"] # 允许客户端与跨域请求一起使用的非简单标头的列表 -AllowHeaders = [] +AllowHeaders = ["DNT","X-Mx-ReqToken","Keep-Alive","User-Agent","X-Requested-With","If-Modified-Since","Cache-Control","Content-Type","Authorization"] # 请求是否可以包含cookie，HTTP身份验证或客户端SSL证书等用户凭据 AllowCredentials = true # 可以缓存预检请求结果的时间（以秒为单位） diff --git a/internal/app/app.go b/internal/app/app.go index ab39b834..a0e9ea3b 100644 --- a/internal/app/app.go +++ b/internal/app/app.go @@ -209,14 +209,11 @@ func InitHTTPServer(ctx context.Context, handler http.Handler) func() { panic(err) } err = srv.Serve(listener) - if err != nil { - panic(err) - } } else { err = srv.ListenAndServe() - if err != nil && err != http.ErrServerClosed { - panic(err) - } + } + if err != nil && err != http.ErrServerClosed { + panic(err) } }() From e70bc091699c757f0bb6023bf43d460058f417d4 Mon Sep 17 00:00:00 2001 From: chenyu1990 Date: Sun, 14 Jun 2020 23:23:36 +0800 Subject: [PATCH 3/5] multiple domain TLS --- configs/config.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/configs/config.toml b/configs/config.toml index 0124f9f5..b9c27646 100644 --- a/configs/config.toml +++ b/configs/config.toml @@ -159,13 +159,13 @@ RedisDB = 10 [CORS] # 是否启用 -Enable = true +Enable = false # 允许跨域请求的域名列表(*表示全部允许) AllowOrigins = ["*"] # 允许跨域请求的请求方式列表 AllowMethods = ["GET","POST","PUT","DELETE","PATCH"] # 允许客户端与跨域请求一起使用的非简单标头的列表 -AllowHeaders = ["DNT","X-Mx-ReqToken","Keep-Alive","User-Agent","X-Requested-With","If-Modified-Since","Cache-Control","Content-Type","Authorization"] +AllowHeaders = [] # 请求是否可以包含cookie，HTTP身份验证或客户端SSL证书等用户凭据 AllowCredentials = true # 可以缓存预检请求结果的时间（以秒为单位） From 794f0cf6ffe174f9a8ed487a2131957b42c47389 Mon Sep 17 00:00:00 2001 From: chenyu1990 Date: Mon, 6 Jul 2020 12:19:20 +0800 Subject: [PATCH 4/5] update --- configs/config.toml | 3 ++ internal/app/app.go | 59 ++++++++++++++++++----------------- internal/app/config/config.go | 1 + 3 files changed, 35 insertions(+), 28 deletions(-) diff --git a/configs/config.toml b/configs/config.toml index b9c27646..5f8451a7 100644 --- a/configs/config.toml +++ b/configs/config.toml @@ -19,6 +19,9 @@ Port = 10088 ShutdownTimeout = 30 # 允许的最大内容长度(64M) MaxContentLength = 67108864 +# TLS 最低版本 1.0 - 1.3 +# IE 浏览器 和 Windows部分程序，默认只支持的1.1协议，请留意 +VersionTLS = 1.1 # 证书 a.com [[HTTP.Certificates]] diff --git a/internal/app/app.go b/internal/app/app.go index a0e9ea3b..97bde0a3 100644 --- a/internal/app/app.go +++ b/internal/app/app.go @@ -169,39 +169,42 @@ func InitHTTPServer(ctx context.Context, handler http.Handler) func() { logger.Printf(ctx, "HTTP server is running at %s.", addr) var ( err error - enableTLS bool tlsConfig tls.Config + certificates []tls.Certificate ) - if l := len(cfg.Certificates); l > 0 { - tlsConfig.Certificates = make([]tls.Certificate, l) - for index, cert := range cfg.Certificates { - enable, ok := cert["Enable"].(bool) - if !ok || !enable { - continue - } - - certFile, ok := cert["CertFile"].(string) - if !ok || certFile == "" { - panic("CertFile错误") - } - keyFile, ok := cert["KeyFile"].(string) - if !ok || keyFile == "" { - panic("KeyFile错误") - } - tlsConfig.Certificates[index], err = tls.LoadX509KeyPair( - certFile, - keyFile, - ) - if err != nil { - panic(err) - } - - enableTLS = true + + for _, cert := range cfg.Certificates { + enable, ok := cert["Enable"].(bool) + if !ok || !enable { + continue + } + + certFile, ok := cert["CertFile"].(string) + if !ok || certFile == "" { + panic("CertFile错误") } + keyFile, ok := cert["KeyFile"].(string) + if !ok || keyFile == "" { + panic("KeyFile错误") + } + certificate, err := tls.LoadX509KeyPair( + certFile, + keyFile, + ) + if err != nil { + panic(err) + } + + certificates = append(certificates, certificate) } - if enableTLS { - tlsConfig.MinVersion = tls.VersionTLS12 + if len(certificates) > 0 { + tlsConfig.Certificates = certificates + if v := config.C.HTTP.VersionTLS; v >= 1.0 && v <= 1.0 { + tlsConfig.MinVersion = uint16(tls.VersionTLS10 + int(v*10-10)) + } else { + tlsConfig.MinVersion = tls.VersionTLS12 + } tlsConfig.BuildNameToCertificate() srv.TLSConfig = &tlsConfig listener, err := tls.Listen("tcp", addr, &tlsConfig) diff --git a/internal/app/config/config.go b/internal/app/config/config.go index af140cab..0ed3a814 100644 --- a/internal/app/config/config.go +++ b/internal/app/config/config.go @@ -176,6 +176,7 @@ type HTTP struct { Certificates []map[string]interface{} ShutdownTimeout int MaxContentLength int64 + VersionTLS float64 } // Monitor 监控配置参数 From 5a3f07be2bb7613d9941279be14d627e808089da Mon Sep 17 00:00:00 2001 From: chenyu1990 Date: Mon, 6 Jul 2020 12:37:29 +0800 Subject: [PATCH 5/5] update --- internal/app/app.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/app/app.go b/internal/app/app.go index 97bde0a3..c2dc5216 100644 --- a/internal/app/app.go +++ b/internal/app/app.go @@ -200,7 +200,7 @@ func InitHTTPServer(ctx context.Context, handler http.Handler) func() { if len(certificates) > 0 { tlsConfig.Certificates = certificates - if v := config.C.HTTP.VersionTLS; v >= 1.0 && v <= 1.0 { + if v := config.C.HTTP.VersionTLS; v >= 1.0 && v <= 1.3 { tlsConfig.MinVersion = uint16(tls.VersionTLS10 + int(v*10-10)) } else { tlsConfig.MinVersion = tls.VersionTLS12