mobi/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2025-07-30 18:23:29 +03:00
Code Activity

Refactor TLS code with a new tlsconfig package

Browse Source 
This patch creates a new `tlsconfig` package to handle creation of
secure-enough TLS configurations for clients and servers.

The package was created by refactoring TLS code in the client and the
daemon. After this patch, it is expected that all code creating TLS
configurations use this `tlsconfig` package for greater security,
consistency and readability.

On the server side, this fixes a bug where --tlsverify was not taken
into account. Now, if specified, it will require the client to
authenticate.

Signed-off-by: Tibor Vass <tibor@docker.com>
This commit is contained in:
Tibor Vass
2015-05-07 09:49:07 -07:00
parent 159f5e0137
commit bfed4b7cc3
6 changed files with 159 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
api/server/server.go
View File

@ -1,6 +1,7 @@
package server
import (
"crypto/tls"
"encoding/base64"
"encoding/json"
"fmt"
@ -44,11 +45,7 @@ type ServerConfig struct {
CorsHeaders string
Version string
SocketGroup string
Tls bool
TlsVerify bool
TlsCa string
TlsCert string
TlsKey string
TLSConfig *tls.Config
}
type Server struct {
@ -1429,22 +1426,15 @@ func (s *Server) ping(version version.Version, w http.ResponseWriter, r *http.Re
}
func (s *Server) initTcpSocket(addr string) (l net.Listener, err error) {
if !s.cfg.TlsVerify {
if s.cfg.TLSConfig == nil || s.cfg.TLSConfig.ClientAuth != tls.RequireAndVerifyClientCert {
logrus.Warn("/!\\ DON'T BIND ON ANY IP ADDRESS WITHOUT setting -tlsverify IF YOU DON'T KNOW WHAT YOU'RE DOING /!\\")
}
var c *sockets.TlsConfig
if s.cfg.Tls || s.cfg.TlsVerify {
c = sockets.NewTlsConfig(s.cfg.TlsCert, s.cfg.TlsKey, s.cfg.TlsCa, s.cfg.TlsVerify)
}
if l, err = sockets.NewTcpSocket(addr, c, s.start); err != nil {
if l, err = sockets.NewTcpSocket(addr, s.cfg.TLSConfig, s.start); err != nil {
return nil, err
}
if err := allocateDaemonPort(addr); err != nil {
return nil, err
}
return
}