forked from evcc-io/evcc
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore: remove certificate pinning (before expiry) (evcc-io#12670)
- Loading branch information
Showing
4 changed files
with
12 additions
and
104 deletions.
There are no files selected for viewing
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,84 +1,25 @@ | ||
| package cloud | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "crypto/tls" | ||
| "crypto/x509" | ||
| _ "embed" | ||
| "errors" | ||
| "fmt" | ||
| "net" | ||
| "strings" | ||
|
|
||
| "github.com/evcc-io/evcc/util" | ||
| "google.golang.org/grpc" | ||
| "google.golang.org/grpc/credentials" | ||
| "google.golang.org/grpc/credentials/insecure" | ||
| ) | ||
|
|
||
| var Host = "sponsor.evcc.io:8080" | ||
| var ( | ||
| host = util.Getenv("GRPC_URI", "sponsor.evcc.io:8080") | ||
|
|
||
| var conn *grpc.ClientConn | ||
|
|
||
| //go:embed ca-cert.pem | ||
| var caCert []byte | ||
|
|
||
| func caPEM() []byte { | ||
| copy := bytes.NewBuffer(caCert) | ||
| return copy.Bytes() | ||
| } | ||
|
|
||
| func loadTLSCredentials() (*tls.Config, error) { | ||
| certPool, err := x509.SystemCertPool() | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| if !certPool.AppendCertsFromPEM(caPEM()) { | ||
| return nil, fmt.Errorf("failed to add CA certificate") | ||
| } | ||
|
|
||
| // create the credentials and return it | ||
| config := &tls.Config{ | ||
| RootCAs: certPool, | ||
| } | ||
|
|
||
| return config, nil | ||
| } | ||
|
|
||
| func verifyConnection(host string) func(conn tls.ConnectionState) error { | ||
| return func(conn tls.ConnectionState) error { | ||
| if len(conn.PeerCertificates) > 0 { | ||
| peer := conn.PeerCertificates[0] | ||
| return peer.VerifyHostname(host) | ||
| } | ||
| conn *grpc.ClientConn | ||
| ) | ||
|
|
||
| return errors.New("missing host certificate") | ||
| func Connection() (*grpc.ClientConn, error) { | ||
| if conn != nil { | ||
| return conn, nil | ||
| } | ||
| } | ||
|
|
||
| func Connection(hostPort string) (*grpc.ClientConn, error) { | ||
| var err error | ||
| if conn == nil { | ||
| creds := insecure.NewCredentials() | ||
|
|
||
| if !strings.HasPrefix(hostPort, "localhost") { | ||
| host, _, err := net.SplitHostPort(hostPort) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| var tlsConfig *tls.Config | ||
| if tlsConfig, err = loadTLSCredentials(); err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| // make sure it matches the hostname | ||
| tlsConfig.VerifyConnection = verifyConnection(host) | ||
|
|
||
| creds = credentials.NewTLS(tlsConfig) | ||
| } | ||
| conn, err = grpc.Dial(hostPort, grpc.WithTransportCredentials(creds)) | ||
| } | ||
| conn, err = grpc.Dial(host) | ||
|
|
||
| return conn, err | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters