Golang tlscert.Generate函數代碼示例

func (s *S) TestListCertRoutes(c *C) {
	api := s.newTestAPIServer(c)
	defer api.Close()

	srv1 := httptest.NewServer(httpTestHandler("1"))
	defer srv1.Close()
	l := s.newHTTPListener(c)
	defer l.Close()
	domain := "oof.example.org"
	r := addHTTPRouteForDomain(domain, c, l)

	tlsCert, err := tlscert.Generate([]string{domain})
	c.Assert(err, IsNil)
	cert := &router.Certificate{
		Routes: []string{r.ID},
		Cert:   tlsCert.Cert,
		Key:    tlsCert.PrivateKey,
	}
	err = api.CreateCert(cert)
	c.Assert(err, IsNil)

	gotRoutes, err := api.ListCertRoutes(cert.ID)
	c.Assert(err, IsNil)
	c.Assert(len(gotRoutes), Equals, 1)
	gotRoute := gotRoutes[0]
	c.Assert(gotRoute.ID, Equals, r.ID)
	c.Assert(gotRoute.Certificate, IsNil)
}

func (a *GenTLSCertAction) Run(s *State) (err error) {
	data := &tlscert.Cert{}
	s.StepData[a.ID] = data

	a.CACert = interpolate(s, a.CACert)
	a.Cert = interpolate(s, a.Cert)
	a.PrivateKey = interpolate(s, a.PrivateKey)
	if a.CACert != "" && a.Cert != "" && a.PrivateKey != "" {
		data.CACert = a.CACert
		data.Cert = a.Cert
		data.PrivateKey = a.PrivateKey

		// calculate cert pin
		b, _ := pem.Decode([]byte(data.Cert))
		sha := sha256.Sum256(b.Bytes)
		data.Pin = base64.StdEncoding.EncodeToString(sha[:])
		return nil
	}

	for i, h := range a.Hosts {
		a.Hosts[i] = interpolate(s, h)
	}
	c, err := tlscert.Generate(a.Hosts)
	if err != nil {
		return err
	}
	data.CACert = c.CACert
	data.Cert = c.Cert
	data.Pin = c.Pin
	data.PrivateKey = c.PrivateKey

	return err
}

func (s *S) TestListCerts(c *C) {
	api := s.newTestAPIServer(c)
	defer api.Close()

	srv1 := httptest.NewServer(httpTestHandler("1"))
	defer srv1.Close()
	l := s.newHTTPListener(c)
	defer l.Close()
	domain := "oof.example.org"
	r := addHTTPRouteForDomain(domain, c, l)

	tlsCert, err := tlscert.Generate([]string{domain})
	c.Assert(err, IsNil)
	cert := &router.Certificate{
		Routes: []string{r.ID},
		Cert:   tlsCert.Cert,
		Key:    tlsCert.PrivateKey,
	}
	err = api.CreateCert(cert)
	c.Assert(err, IsNil)

	gotCerts, err := api.ListCerts()
	c.Assert(err, IsNil)
	c.Assert(len(gotCerts), Equals, 2)
	gotCert := gotCerts[1] // the first cert was created with the route
	c.Assert(gotCert.ID, Equals, cert.ID)
	c.Assert(gotCert.Cert, Equals, cert.Cert)
	c.Assert(gotCert.Key, Equals, cert.Key)
	c.Assert(gotCert.Routes, DeepEquals, cert.Routes)
}

func (s *S) TestAddHTTPRouteWithInvalidCert(c *C) {
	l := s.newHTTPListener(c)
	defer l.Close()

	c1, _ := tlscert.Generate([]string{"1.example.com"})
	c2, _ := tlscert.Generate([]string{"2.example.com"})

	err := l.AddRoute(router.HTTPRoute{
		Domain:  "example.com",
		Service: "test",
		Certificate: &router.Certificate{
			Cert: c1.Cert,
			Key:  c2.PrivateKey,
		},
	}.ToRoute())
	c.Assert(err, Not(IsNil))
}

func refreshTLSConfigForDomain(domain string) *tlscert.Cert {
	tlsCertsMux.Lock()
	defer tlsCertsMux.Unlock()
	domain = normalizeDomain(domain)
	c, err := tlscert.Generate([]string{domain})
	if err != nil {
		panic(err)
	}
	tlsCerts[domain] = c
	return c
}

func (m *migration) generateTLSCert() (*tlscert.Cert, error) {
	hosts := []string{
		m.dm.Domain,
		fmt.Sprintf("*.%s", m.dm.Domain),
	}
	cert, err := tlscert.Generate(hosts)
	if err != nil {
		return nil, err
	}
	if _, err := m.db.Query("UPDATE domain_migrations SET tls_cert = $1 WHERE migration_id = $2", cert, m.dm.ID); err != nil {
		return nil, err
	}
	return cert, nil
}

func tlsConfigForDomain(domain string) ([]byte, []byte) {
	tlsCertsMux.Lock()
	defer tlsCertsMux.Unlock()
	domain = strings.ToLower(domain)
	if d, _, err := net.SplitHostPort(domain); err == nil {
		domain = d
	}
	if strings.HasSuffix(domain, ".example.com") {
		domain = "example.com"
	}
	if c, ok := tlsCerts[domain]; ok {
		return []byte(c.CACert), []byte(c.PrivateKey)
	}
	c, err := tlscert.Generate([]string{domain})
	if err != nil {
		panic(err)
	}
	tlsCerts[domain] = c
	return []byte(c.Cert), []byte(c.PrivateKey)
}

func tlsConfigForDomain(domain string) *tlscert.Cert {
	tlsCertsMux.Lock()
	defer tlsCertsMux.Unlock()
	domain = normalizeDomain(domain)
	parts := strings.SplitAfter(domain, ".")
	wildcard := "*."
	for i := 1; i < len(parts); i++ {
		wildcard += parts[i]
	}
	if c, ok := tlsCerts[domain]; ok {
		return c
	}
	if c, ok := tlsCerts[wildcard]; ok {
		return c
	}
	c, err := tlscert.Generate([]string{domain})
	if err != nil {
		panic(err)
	}
	tlsCerts[domain] = c
	return c
}

//.........這裏部分代碼省略.........
	pathRoute := app.flynn("route", "add", "http", route+"/path/")
	t.Assert(pathRoute, Succeeds)
	pathRouteID := strings.TrimSpace(pathRoute.Output)
	assertRouteContains(pathRouteID, true)

	// flynn route add domain path duplicate
	dupRoute = app.flynn("route", "add", "http", route+"/path/")
	t.Assert(dupRoute, c.Not(Succeeds))
	t.Assert(dupRoute.Output, c.Equals, "conflict: Duplicate route\n")

	// flynn route add domain path without trailing should correct to trailing
	noTrailingRoute := app.flynn("route", "add", "http", route+"/path2")
	t.Assert(noTrailingRoute, Succeeds)
	noTrailingRouteID := strings.TrimSpace(noTrailingRoute.Output)
	assertRouteContains(noTrailingRouteID, true)
	// flynn route should show the corrected trailing path
	assertRouteContains("/path2/", true)

	// flynn route remove should fail because of dependent route
	delFail := app.flynn("route", "remove", routeID)
	t.Assert(delFail, c.Not(Succeeds))

	// But removing the dependent route and then the default route should work
	t.Assert(app.flynn("route", "remove", pathRouteID), Succeeds)
	assertRouteContains(pathRouteID, false)
	t.Assert(app.flynn("route", "remove", noTrailingRouteID), Succeeds)
	assertRouteContains(noTrailingRouteID, false)
	t.Assert(app.flynn("route", "remove", routeID), Succeeds)
	assertRouteContains(routeID, false)

	// flynn route add tcp
	tcpRoute := app.flynn("route", "add", "tcp")
	t.Assert(tcpRoute, Succeeds)
	routeID = strings.Split(tcpRoute.Output, " ")[0]
	assertRouteContains(routeID, true)

	// flynn route add tcp --port
	portRoute := app.flynn("route", "add", "tcp", "--port", "9999")
	t.Assert(portRoute, Succeeds)
	routeID = strings.Split(portRoute.Output, " ")[0]
	port := strings.Split(portRoute.Output, " ")[4]
	t.Assert(port, c.Equals, "9999\n")
	assertRouteContains(routeID, true)

	// flynn route update --service
	portRoute = app.flynn("route", "update", routeID, "--service", "foo")
	t.Assert(portRoute, Succeeds)
	r, err = client.GetRoute(app.id, routeID)
	t.Assert(err, c.IsNil)
	t.Assert(r.Service, c.Equals, "foo")

	// flynn route remove
	t.Assert(app.flynn("route", "remove", routeID), Succeeds)
	assertRouteContains(routeID, false)

	writeTemp := func(data, prefix string) (string, error) {
		f, err := ioutil.TempFile(os.TempDir(), fmt.Sprintf("flynn-test-%s", prefix))
		t.Assert(err, c.IsNil)
		_, err = f.WriteString(data)
		t.Assert(err, c.IsNil)
		stat, err := f.Stat()
		t.Assert(err, c.IsNil)
		return filepath.Join(os.TempDir(), stat.Name()), nil
	}

	// flynn route add http with tls cert
	cert, err := tlscert.Generate([]string{"example.com"})
	t.Assert(err, c.IsNil)
	certPath, err := writeTemp(cert.Cert, "tls-cert")
	t.Assert(err, c.IsNil)
	keyPath, err := writeTemp(cert.PrivateKey, "tls-key")
	certRoute := app.flynn("route", "add", "http", "--tls-cert", certPath, "--tls-key", keyPath, "example.com")
	t.Assert(certRoute, Succeeds)
	routeID = strings.TrimSpace(certRoute.Output)
	r, err = client.GetRoute(app.id, routeID)
	t.Assert(err, c.IsNil)
	t.Assert(r.Domain, c.Equals, "example.com")
	t.Assert(r.Certificate, c.NotNil)
	t.Assert(r.Certificate.Cert, c.Equals, strings.Trim(cert.Cert, "\n"))
	t.Assert(r.Certificate.Key, c.Equals, strings.Trim(cert.PrivateKey, "\n"))

	// flynn route update tls cert
	cert, err = tlscert.Generate([]string{"example.com"})
	t.Assert(err, c.IsNil)
	certPath, err = writeTemp(cert.Cert, "tls-cert")
	t.Assert(err, c.IsNil)
	keyPath, err = writeTemp(cert.PrivateKey, "tls-key")
	certRoute = app.flynn("route", "update", routeID, "--tls-cert", certPath, "--tls-key", keyPath)
	t.Assert(certRoute, Succeeds)
	r, err = client.GetRoute(app.id, routeID)
	t.Assert(err, c.IsNil)
	t.Assert(r.Domain, c.Equals, "example.com")
	t.Assert(r.Certificate, c.NotNil)
	t.Assert(r.Certificate.Cert, c.Equals, strings.Trim(cert.Cert, "\n"))
	t.Assert(r.Certificate.Key, c.Equals, strings.Trim(cert.PrivateKey, "\n"))

	// flynn route remove
	t.Assert(app.flynn("route", "remove", routeID), Succeeds)
	assertRouteContains(routeID, false)
}