Skip to content

Allow more mtls curve #281

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Allow more mtls curve #281

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4173bd9
Add support for custom elliptic curve in AutoMTLS
luoxiaohei Sep 20, 2023
55f8c1a
Merge branch 'main' into HEAD
luoxiaohei Sep 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ package plugin
import (
"bufio"
"context"
"crypto/elliptic"
"crypto/subtle"
"crypto/tls"
"crypto/x509"
Expand Down Expand Up @@ -232,6 +233,11 @@ type ClientConfig struct {
// You cannot Reattach to a server with this option enabled.
AutoMTLS bool

// AutoMTLSCurve is the elliptic curve to use for generating the certificates
// used for AutoMTLS.
// If this is nil, then the default of elliptic.P521() is used.
AutoMTLSCurve elliptic.Curve

// GRPCDialOptions allows plugin users to pass custom grpc.DialOption
// to create gRPC connections. This only affects plugins using the gRPC
// protocol.
Expand Down Expand Up @@ -393,6 +399,10 @@ func NewClient(config *ClientConfig) (c *Client) {
})
}

if config.AutoMTLSCurve == nil {
config.AutoMTLSCurve = defaultMTLSCurve
}

c = &Client{
config: config,
logger: config.Logger,
Expand Down Expand Up @@ -630,7 +640,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
// certificate to the plugin.
if c.config.AutoMTLS {
c.logger.Info("configuring client automatic mTLS")
certPEM, keyPEM, err := generateCert()
certPEM, keyPEM, err := generateCert(c.config.AutoMTLSCurve)
if err != nil {
c.logger.Error("failed to generate client certificate", "error", err)
return nil, err
Expand Down
7 changes: 5 additions & 2 deletions mtls.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,13 @@ import (
"time"
)

// defaultMTLSCurve is the default curve used for generating mTLS certificates.
var defaultMTLSCurve = elliptic.P521()

// generateCert generates a temporary certificate for plugin authentication. The
// certificate and private key are returns in PEM format.
func generateCert() (cert []byte, privateKey []byte, err error) {
key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
func generateCert(c elliptic.Curve) (cert []byte, privateKey []byte, err error) {
key, err := ecdsa.GenerateKey(c, rand.Reader)
if err != nil {
return nil, nil, err
}
Expand Down
13 changes: 12 additions & 1 deletion server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ package plugin

import (
"context"
"crypto/elliptic"
"crypto/tls"
"crypto/x509"
"encoding/base64"
Expand Down Expand Up @@ -100,6 +101,12 @@ type ServeConfig struct {
// * Connection information will not be sent to stdout
//
Test *ServeTestConfig

// AutoMTLSCurve is the elliptic curve to use for generating the certificates
// used for AutoMTLS.
// This is only used if the client is configured to use AutoMTLS.
// If this is nil, then the default of elliptic.P521() is used.
AutoMTLSCurve elliptic.Curve
}

// ServeTestConfig configures plugin serving for test mode. See ServeConfig.Test.
Expand Down Expand Up @@ -305,7 +312,11 @@ func Serve(opts *ServeConfig) {
logger.Error("client cert provided but failed to parse", "cert", clientCert)
}

certPEM, keyPEM, err := generateCert()
if opts.AutoMTLSCurve == nil {
opts.AutoMTLSCurve = defaultMTLSCurve
}

certPEM, keyPEM, err := generateCert(opts.AutoMTLSCurve)
if err != nil {
logger.Error("failed to generate server certificate", "error", err)
panic(err)
Expand Down