SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 11:55:40 +01:00
Code Issues Releases Activity Actions

Add options to use TLS client certificate for authentication (Uploader)

Browse source 
* Add "client-cert" and "client-key" flag options to allow the uploader to use
TLS client certificate for authentication with the provider.

Co-authored-by: Bernhard Reiter <bernhard@intevation.de>
This commit is contained in:
Fadi Abbud 2022-03-31 15:57:00 +02:00 • committed by GitHub
parent b99322708e
commit b9603b7742
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 29 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -42,6 +42,8 @@ Following options are supported:
| -I, --passphrase-interacive | Enter passphrase interactively |
| -c, --config=INI-FILE | Path to config ini file |
| --insecure | Do not check TSL certificates from provider |
| --client-cert | TLS client certificate file (PEM encoded data) |
| --client-key | TLS client private key file (PEM encoded data) |
| -h, --help | Show help |
E.g. creating the initial directiories and files

33
cmd/csaf_uploader/main.go
View file

@ -40,6 +40,8 @@ type options struct {
Key *string `short:"k" long:"key" description:"OpenPGP key to sign the CSAF files" value-name:"KEY-FILE"`
Password *string `short:"p" long:"password" description:"Authentication password for accessing the CSAF provider" value-name:"PASSWORD"`
Passphrase *string `short:"P" long:"passphrase" description:"Passphrase to unlock the OpenPGP key" value-name:"PASSPHRASE"`
ClientCert *string `long:"client-cert" description:"TLS client certificate file (PEM encoded data)" value-name:"CERT-FILE.crt"`
ClientKey *string `long:"client-key" description:"TLS client private key file (PEM encoded data)" value-name:"KEY-FILE.pem"`
PasswordInteractive bool `short:"i" long:"password-interactive" description:"Enter password interactively" no-ini:"true"`
PassphraseInteractive bool `short:"I" long:"passphrase-interacive" description:"Enter passphrase interactively" no-ini:"true"`
@ -111,17 +113,29 @@ func newProcessor(opts *options) (*processor, error) {
return &p, nil
}
// httpClient initializes the http client according
// to the "Insecure" flag option and returns it.
// httpClient initializes the http.Client according to the "Insecure" flag
// and the TLS client files for authentication and returns it.
func (p *processor) httpClient() *http.Client {
var client http.Client
var tlsConfig tls.Config
if p.opts.Insecure {
tlsConfig.InsecureSkipVerify = true
}
if p.opts.ClientCert != nil && p.opts.ClientKey != nil {
cert, err := tls.LoadX509KeyPair(*p.opts.ClientCert, *p.opts.ClientKey)
if err != nil {
log.Fatal(err)
}
tlsConfig.Certificates = []tls.Certificate{cert}
}
client.Transport = &http.Transport{
TLSClientConfig: &tls.Config{
InsecureSkipVerify: true,
},
}
TLSClientConfig: &tlsConfig,
}
return &client
}
@ -257,7 +271,7 @@ func (p *processor) uploadRequest(filename string) (*http.Request, error) {
return req, nil
}
// process attemps to upload a file filename to the server.
// process attemps to upload a file to the server.
// It prints the response messages.
func (p *processor) process(filename string) error {
@ -365,6 +379,11 @@ func main() {
check(readInteractive("Enter OpenPGP passphrase: ", &opts.Passphrase))
}
if (opts.ClientCert != nil && opts.ClientKey == nil) || (opts.ClientCert == nil && opts.ClientKey != nil) {
log.Println("Both client-key and client-cert options must be set for the authentication.")
return
}
p, err := newProcessor(&opts)
check(err)