Skip to content

Commit cc5c48c

Browse files
VivekSubrVivekSubr
committedMar 1, 2025
crypto
1 parent 26c341c commit cc5c48c

19 files changed

+298
-56
lines changed
 

‎crypto/README.md

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
------------------------------------------------
2+
A note on self signed certificates.
3+
------------------------------------------------
4+
The ca cert generated by 'generate_tls_cert.sh' is self signed. Self signed certificates are created without reference to any
5+
authority, and hence will have 'subject' and 'issuer' fields as same.
6+
7+
openssl x509 -in ca-crt -noout -issuer
8+
issuer=C = US, ST = Denial, L = Springfield, O = Dis, CN = litest.com
9+
10+
openssl x509 -in ca-crt -noout -subject
11+
subject=C = US, ST = Denial, L = Springfield, O = Dis, CN = litest.com
12+
13+
Hence it is own ca cert: openssl verify -CAfile ca-crt ca-crt

‎crypto/certs/CA-CERT

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIFezCCA2OgAwIBAgIDEAISMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVT
3+
MQ8wDQYDVQQIDAZEZW5pYWwxFDASBgNVBAcMC1NwcmluZ2ZpZWxkMQwwCgYDVQQK
4+
DANEaXMxEzARBgNVBAMMCmxpdGVzdC5jb20wHhcNMjEwNDE1MTMzNDMxWhcNMzEw
5+
NDEzMTMzNDMxWjBBMQswCQYDVQQGEwJVUzEPMA0GA1UECAwGRGVuaWFsMQwwCgYD
6+
VQQKDANEaXMxEzARBgNVBAMMCmxpdGVzdC5jb20wggIiMA0GCSqGSIb3DQEBAQUA
7+
A4ICDwAwggIKAoICAQDIY8JMwxElMOd0iA8WtSwbWAD51o+3G9A0yYkZzRCMmmFo
8+
Jt+AWAkIny/mY9wB5P6pLqJD3fpMfi9eiruS/u8azWtgLJUmPnHlH8n/BkRogXem
9+
TlNzohaQVaH+cyLJ9mJ/Y718l2b8kjPCYFvJyjf0QZv8I1jjk+WKVcS7h9FxAGgS
10+
EJAki2tjCFyjc973SP5aSCqfhvxnGUd+9JlVqlfEGEVjvsTAbcRT5ysbk2AkQeik
11+
zviA8V17vHRRDs7p+O235ecpQU+abjg0i6HapOqDMRyBxqBLoX8sk5ZJbM5tERki
12+
RCU6d2LZXZJkd9lxMT+pz3GLQCJQBVAGgzw46uxZC/o9ps0HzsJpsnYVeSQ1aIVp
13+
d+xo8pfmllXV0h6/k7LpddD7GgcWdAWuwz+5Hflm5wp96MWAj0YC6lVRSkaZFE0b
14+
2PsKrpUgOYg5BietkJMULwIeZ3B8lsKdHB8dmyN5RTepN//SPuiW+G/PS5ISWpki
15+
6B0JrqUWEIX/N2xxQ39F7gP7twjgAZlIiGxXQ9gOkokj+fc6UhXq0P+IF0s3S/jC
16+
oMLAvA6u+xcHoKkXT4z/FcTEGFd91hklSMmrfzQfcbEufloJnmXKpErrfHsG6Ety
17+
jBpvJA5yKKyKkTUjlX3AYijIvmSZXZoZ6y3Yca3iDm4wpfiVtvMZH7QkQudKhQID
18+
AQABo2YwZDAdBgNVHQ4EFgQUyg5CGktgLoddPZ1QHWJ1/x2Fzb4wHwYDVR0jBBgw
19+
FoAUP8d/e2Ex8yl2RYKgVlgsgJrNKK0wEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNV
20+
HQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBACPp4o9dF02piT/zUxdC8y1A
21+
b9CpzeqvFtE1zRec8yiUX352Lc6K/G9oNofYjCWt4gjcb+iTlXzUDjMMzzEs+DsB
22+
DvtAmmE0HE94YCBTCSjcn0SGJ6TDQhNn1btCT0YECE8IzGoKzIVUk5JXOrbXUT6j
23+
zEeIIlvdh5DjRFIEFucp8Nqnd80tazGNdaW/dVmxanp2SL+02bDtxSGSfXr4gtD0
24+
zL/kD8jdSBbhaqhMTOkUC/5wkj8SUwFdQy7CsBBJb8j6MtU5NSQEWi4axTEc165b
25+
Pxp6VKc8LofMChrV3uoVj+rdLVcXYaUypK78gIqaa0Rl2S2D3oRi8ynRD2M+4VqZ
26+
Q+iG36kFeKITbK9JSQ0EcYN6Wp6FBsanaXZQEQggCLsO+DzQYgn4GM/MYEmHi7uu
27+
6YlZgyo9BjlpZ2EAbsQdreYNX2pbfFTaE5zLhTDnZNMDH5FMfE+L6UBatVoqj/6G
28+
hO/GcZEJhcprRnvk77hPpYNsr4MwQrsOWU20y4aT+e8EsiNGtqbUbmmQ54bIGoZ5
29+
iIkSXR7ifkAowqsPipB8lyRwHH0nybE3ZxDWj2ejJV0o/0L3AUH/cEgjjwxNO7KN
30+
n05LnPjICTysxv3BI6Cy3eb64UaBAQbFhk3XqZl6T3nwcgw5TRkA+ZYH/b4NCK/5
31+
pDMNTboqXrEpH02poYfs
32+
-----END CERTIFICATE-----
33+
-----BEGIN CERTIFICATE-----
34+
MIIFnzCCA4egAwIBAgIUOCQ752A9OPgnSiSMBgITMcikTIowDQYJKoZIhvcNAQEL
35+
BQAwVzELMAkGA1UEBhMCVVMxDzANBgNVBAgMBkRlbmlhbDEUMBIGA1UEBwwLU3By
36+
aW5nZmllbGQxDDAKBgNVBAoMA0RpczETMBEGA1UEAwwKbGl0ZXN0LmNvbTAeFw0y
37+
MTA0MTUxMzM0MzBaFw00MTA0MTAxMzM0MzBaMFcxCzAJBgNVBAYTAlVTMQ8wDQYD
38+
VQQIDAZEZW5pYWwxFDASBgNVBAcMC1NwcmluZ2ZpZWxkMQwwCgYDVQQKDANEaXMx
39+
EzARBgNVBAMMCmxpdGVzdC5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
40+
AoICAQDnc08pi0+hpSW8iao2oXr6slhe7YiNbkM1ZmbS4uh2J+pJsZ91+gqP875Y
41+
QTP1urCsNhA5dZqyjzWVp7YZvT13riXtF/ZuoK1QAB57fhcNm6FfG59gl07Kgurl
42+
3l1EcGtwWNGEqCgNxLZKtNXJoQ6YEjR+X+wHCAU+YQByYN6Hs81iUtxMqfNTHydV
43+
Jh2YBkOjjoSCPZhzDMcdS6l0pQyKGgeU+vp49WscN+kFMC0+t0mDq0imLMatbZz2
44+
QFVsJcgObG62SHCIR4KeFr32cA4TgC+hEIB8tuJVs8MR+2qheF0XuFpVU/u1f/V0
45+
ylVap02Sb+v1a5qoI3sgyJkCCj42UxnGzCprh8ENKiSg2huZxN87idiAdyZcwoRl
46+
KPFFtiRiRiE7a6FE8NnC9n181muUXeozvqaCeveHVkB/UaG0Zj6yHaZYcHHkXGXA
47+
RclqByV7Cmrhp+HF1izKQ97uM7liO5jhDpEMF3gE2ofJTFHZudBdK8/cXlVOMwys
48+
tAjqCffslOJtQ6XzabeUeVqhE1cChSr/XPxmVTit+/1aoE9VLsWl0y5vWoIVSKsr
49+
RTmoFEnLUjlZXs67uxpJQ9f/F7c0cbRc8akNyiqBHEzf29YvtufxYTrzCgEmO46E
50+
kbGrTESBvm2X7dcxvG30U5QV+SwQlQkPWYsYDFI2/QQUkSwkwQIDAQABo2MwYTAd
51+
BgNVHQ4EFgQUP8d/e2Ex8yl2RYKgVlgsgJrNKK0wHwYDVR0jBBgwFoAUP8d/e2Ex
52+
8yl2RYKgVlgsgJrNKK0wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYw
53+
DQYJKoZIhvcNAQELBQADggIBAKuKM9k0oCrWU3BGdCC3Mor2/AESxtIszsFrpOME
54+
H0LGa4m8Cx1Cs5pceXERDlLYf+n9CMH1JJEYuNfNXhACgiV2OAUwt3kupbox2YEG
55+
Br5vCosncdJJBkQ5g3Inf5j1LlQ3C4fHKKcAvG9U51BV6fGGs2Ru6siPg/MvwHSW
56+
L+JExKGHhVAICR61ShL0iKhgAIRafTdyd/455MoA88VYJBZ1IcPpnJ51PhkqzZNJ
57+
2GaQmLEVWatSwt2aKNkCkzsKXl9N9UYatLkvRcXN76fhb7Puif/m13EqINEC3c1G
58+
dqRHOsDop6ZZYMmCT+OsBq8zW0yvVd5GryXOUJ+MXbYi+XzABvPvsYcWM5Zd3Rjs
59+
4layYA8Y6Lj5MHCGgwlYA+KjVcZ61ES6mMoczrAwEQabN+OAJimcI/YqSHLXdb8G
60+
Z0wb/cE4uzR0pCHTaWJL/9hKRkSQCM6rwR7HPx3zo1c54SDrVWS3sTSDn6q+k8Lz
61+
E8+QwCPm0+Q2T6Xpkfdl2pbf3nMm0KCQUvkfKAzFbvbQMfnUkw3E9SixbiHHeO9w
62+
eeQvYjufMQhbyC5YZ+2Da+6ajHAjKrgshR/L7f9ua9lNUMOjH7X7cqJJkohtWET4
63+
jVZpgTYJrNIqnwB+YK2or6K2kLI4bAw20Tr+EXGqj1BNwZt5V5IQsP8o5WytSkrZ
64+
wYJE
65+
-----END CERTIFICATE-----
66+

‎crypto/certs/CLIENT-TLS-CERT

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIE2zCCAsOgAwIBAgIDEAITMA0GCSqGSIb3DQEBCwUAMEExCzAJBgNVBAYTAlVT
3+
MQ8wDQYDVQQIDAZEZW5pYWwxDDAKBgNVBAoMA0RpczETMBEGA1UEAwwKbGl0ZXN0
4+
LmNvbTAeFw0yMTA0MTUxMzM1MzhaFw0zMTAyMjIxMzM1MzhaMFcxCzAJBgNVBAYT
5+
AlVTMQ8wDQYDVQQIDAZEZW5pYWwxFDASBgNVBAcMC1NwcmluZ2ZpZWxkMQwwCgYD
6+
VQQKDANEaXMxEzARBgNVBAMMCmxpdGVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUA
7+
A4IBDwAwggEKAoIBAQC/fKSB5sa4cY4h3C40d6oj4z9Um26Su0PBFf4DjoIn4XLc
8+
R2H6qb1pYdVRsjmw/otE7nOO/FpF/IVvM36PilDOcrkvXybxE2hHDC6zFiho9W4i
9+
W0WpvEF2dGfSLgRLFyy4HfEA6h6KCX910oRt7sBpJIcBnIxDxptNfO8JY87VExfs
10+
t1n6YnCNBZC25hkQ8WauSUp2S0+jPS9+BKMXsfkEMJodV9Y1RobhnhEY1Xu9lRiA
11+
NEBHF6i2vOoHr9xAjLb2fv82t0Xw8bSn7Z1TSriG0fGQB6vq/XolPamnMP1x10Di
12+
XcmpIwiJWR8y47xyqhpy71Q/YZPXhDiXDEMeTPXJAgMBAAGjgcUwgcIwCQYDVR0T
13+
BAIwADARBglghkgBhvhCAQEEBAMCBaAwMwYJYIZIAYb4QgENBCYWJE9wZW5TU0wg
14+
R2VuZXJhdGVkIENsaWVudCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUh2nzfghU6RO5
15+
ww0fUu4EKekTu4owHwYDVR0jBBgwFoAUyg5CGktgLoddPZ1QHWJ1/x2Fzb4wDgYD
16+
VR0PAQH/BAQDAgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDANBgkq
17+
hkiG9w0BAQsFAAOCAgEADwIaBXDoCkL7E7InQJd0cBXL5IYUTPYN2ZkOROzkHAsW
18+
t+cAYZer7Z14ErutrsEEfYgeP4UZdSE48TRzZ539+EIxrSxWLrG971NyUyiFTSws
19+
JbFI4lUVnQGHA3i/BWLW+TJR2aKJ9nGQ1W6xD6ASU409jwnjUCNrXBwqho6GdZNo
20+
1zKYzx8WONKWdYw01qa/XOR/UBZBiYDVD/e5jH7ojMMBkNAmYXGvVEjQShlA0uuR
21+
/SwLCVjGKUhqR7fjwAYYJLe3+CvW9Mn935olgeYhIc0/OPSYv7voqy5jyS6yXTEa
22+
EkvJGxS433F9510KVdGX7cjAJiMZKJiERE20Tfx307DN2rZxTbDKmJD4nAwo3QAL
23+
djhmRSW0bW7G4ZBxUi441nOlfznj0ZNhsrU2kw4jznkw45ggmQqJqTMg4Ntj+B71
24+
xNctGgQjzGXC9uegrcehscuHhbQ7Nd/jkqd2v1FRxIb2C4vjNv2eZySrVNklfyEZ
25+
J5eWyolWEIn8VU+W8CqNEFYmqlRrLJZ8LIxecLRq2fqXospDAAjgdklKRz3GCkUL
26+
CtNUCOBqqhv9XAPwY+zBImAdJlj8mkUKKTCZUz66d+oEzA++wvEHSsvRKMCGpuMp
27+
51d3yKSlnI6Vj/PCzgxY7WXX4H+LPa29jbQpeqSl1aXm7e/7KHHjTE4arRpYsFc=
28+
-----END CERTIFICATE-----
29+

‎crypto/certs/CLIENT-TLS-KEY

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIIEogIBAAKCAQEAv3ykgebGuHGOIdwuNHeqI+M/VJtukrtDwRX+A46CJ+Fy3Edh
3+
+qm9aWHVUbI5sP6LRO5zjvxaRfyFbzN+j4pQznK5L18m8RNoRwwusxYoaPVuIltF
4+
qbxBdnRn0i4ESxcsuB3xAOoeigl/ddKEbe7AaSSHAZyMQ8abTXzvCWPO1RMX7LdZ
5+
+mJwjQWQtuYZEPFmrklKdktPoz0vfgSjF7H5BDCaHVfWNUaG4Z4RGNV7vZUYgDRA
6+
RxeotrzqB6/cQIy29n7/NrdF8PG0p+2dU0q4htHxkAer6v16JT2ppzD9cddA4l3J
7+
qSMIiVkfMuO8cqoacu9UP2GT14Q4lwxDHkz1yQIDAQABAoIBADDNlKPi7FzP3Di3
8+
BDOtF/jjjx2CK9FL1v3cHAxOAtAlPn/z1X3sSvET1SloMhnxFg+wclVL7boOnPd1
9+
eVkeGHA1fwsaxjMFDjulWDWefRgbDUHGX1/eMhT9oARKZB+7PVODlgv0n2nw98JQ
10+
sB3Qjst9WsdHXdxcPvKl18pd3LYjIb1zYo89Clbfn4gMarxzcci+Cd5zwR3gIhBr
11+
Eet72eNb7DTYKerNaKjoXCTi7pvsaTFdiWy2ED0+OR+aaXFJZNx1tkcrqNRoXYAg
12+
pWZSHiJkACgxTuiUx0lVTLROZVftQY02rH6TkWMPV3IGGha2zPgTz2NvGn8KZHA1
13+
stNx5/ECgYEA4zPMO6h/qe6CX9MPbxxktU5Drw9iEhTX/iInPtExbxH8KsHL4UWs
14+
zmpgno/da9g+lYLZzT+eJzDsZHzUDXWoD7TK15epWCaHX+I24QM4iGRt+TwWwh4V
15+
49hd+7AjZd6+l8JE/8kgX5wRLJohEqerrw/LBHlx6L2sMWC3TvHfU00CgYEA18H1
16+
jkF2PUtV7OQVpOZHG0do/ZeIZfpl3jv7w4l3rKRs38gdVUeGLA3WulIs3rMgssAw
17+
ZXoIjLyxJHtXBHx4MzyTa9OQczkSAWNcYJVqej71CwnoEXuOT8/E50b24ioF/Euq
18+
t621I3f5unMn6LIydUZYuK4QrtK3AeJ6XY6Vdm0CgYA+IbIeNmwDCoh4r/0ug3M+
19+
6ZI0014cV7rhcnGNCiQcnax5/NlGV4l0QT7+3ZTNoysqM8hgCp+zU/uxVzmeHKjC
20+
8svtvTnAM3kdzXz4d6sEEYLJf5cxqoyN7GN3Kqnjd9BjK+s2j8fcnY9MxTF6KoQW
21+
sZjxNkziOsxWDH7UhexumQKBgCCV8Ko9hMgZGq8ee45eIRsjm93BBx6vxLbdxFZx
22+
6psucisSJCv/E2qP5IBbbN9tmmCk2ipZVfU7gl2KK0hILDdAzNsaJtTgJ7IB+a+0
23+
oVI5M/Uo193cFVBEhu6PLzZVNnY2T2BSYesrcZIRVlO0ph5EM54g2/Arbuxf8i8z
24+
G6u5AoGAWZbzwUY/kcfmWgSTIv2TpnwZow1ksD9vAMEw8DWR+T+ZBWc56KNgS+iu
25+
oLOPPeQ9DZAjQsag3ZV7MedWnXGrNbKUYJUbj2+02DmFAa/uiE+gka1EhFeFxgjy
26+
nAkP+KPa4u1XFnQH/0BPWIKY8YbmAlr2+agmBH3QxdFJodMuI58=
27+
-----END RSA PRIVATE KEY-----
28+

‎crypto/ingress-li-tls-crt ‎crypto/certs/SERVER-TLS-CERT

+2-1
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,5 @@ ckMYrGHVic7Xk5gANxUeAlJp4IZAGSVyefOgmUBu8ULkVeIGvumHXyCk8t0qjzsh
2727
XEroHk7y+m8d6wYyK3T9vIZhVsTVNVT8AS27i0C2cPA+MjhCoZqvpR3eIK0BJJn0
2828
qrezCQ3I3rSslh/DKcjtJQR5VX6pmZBx+t0F+Ht0u88IqzBHRIBmIBE1Sk4+m6FL
2929
kCVJXNVlwq978uUcVuv1QZ3nHsDMejrIumie7myngnohL2bk8SQSOuXU
30-
-----END CERTIFICATE-----
30+
-----END CERTIFICATE-----
31+

‎crypto/ingress-li-tls-key ‎crypto/certs/SERVER-TLS-KEY

+2-1
Original file line numberDiff line numberDiff line change
@@ -24,4 +24,5 @@ oqVNjwfzFF5UA/vZNbbxVnLH5iXzbXbRfUl2k1WHktf+dew9sO+osCwvDSnEHflc
2424
RtOebwKBgQDJV1oXz+ORLaHtIGPquZ7vBtsOKW9Fc6SS1xbiizEgZE13QD6N+gP/
2525
SgsdXuYkptdXofQ9VKb6axjxaP2RaE0OpR/oOvJ51O5X5yfILuZVAabsEVXfOEYt
2626
utoBOKDJsmzJHF+qZqviGE5OTTdryhit/Y8HKPcnq7uDhzS0HUO7qg==
27-
-----END RSA PRIVATE KEY-----
27+
-----END RSA PRIVATE KEY-----
28+

‎crypto/client/tlsClient

-5.29 MB
Binary file not shown.

‎crypto/client/tls_client.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ func main() {
1515
portPtr := flag.String("port", "3000", "port server listening to")
1616
crtPtr := flag.String("crt", "../server/selfSigned.cert", "certificate")
1717
keyPtr := flag.String("key", "../server/private.pem", "PEM encoded private key file.")
18-
insecurePtr := flag.String("insecure", "true", "skip verifying cert chain")
18+
insecurePtr := flag.String("insecure", "false", "skip verifying cert chain")
1919
caCrtPtr := flag.String("caCrt", "", "ca cert")
2020

2121
flag.Parse()
@@ -52,6 +52,7 @@ func main() {
5252
conf = &tls.Config{
5353
Certificates: []tls.Certificate{cert},
5454
InsecureSkipVerify: insecure,
55+
MinVersion: tls.VersionTLS12,
5556
}
5657
}
5758

‎crypto/envoy/envoy-config.yaml

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
static_resources:
2+
listeners:
3+
- name: listener_0
4+
address:
5+
socket_address: { address: 0.0.0.0, port_value: 10000 }
6+
filter_chains:
7+
transport_socket:
8+
name: envoy.transport_sockets.tls
9+
typed_config:
10+
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
11+
common_tls_context:
12+
tls_certificates:
13+
- certificate_chain: { filename: /ca/LI-SERVER-TLS-CERT }
14+
private_key: { filename: /ca/LI-SERVER-TLS-KEY }
15+
16+
filter_chains:
17+
- filters:
18+
- name: envoy.filters.network.tcp_proxy
19+
typed_config:
20+
"@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
21+
stat_prefix: destination
22+
cluster: cluster_0
23+
24+
clusters:
25+
- name: cluster_0
26+
connect_timeout: 30s
27+
load_assignment:
28+
cluster_name: cluster_0
29+
endpoints:
30+
- lb_endpoints:
31+
- endpoint:
32+
address:
33+
socket_address: { address: 127.0.0.1, port_value: 1447 }
34+
transport_socket:
35+
name: envoy.transport_sockets.cluster.tls
36+
typed_config:
37+
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
38+
common_tls_context:
39+
tls_certificates:
40+
- certificate_chain: { filename: /ca/LI-CLIENT-TLS-CERT }
41+
private_key: { filename: /ca/LI-CLIENT-TLS-KEY }
42+
validation_context:
43+
trusted_ca: { filename : /ca/LI-CA-CERT }

‎crypto/envoy/test_envoy_tls.sh

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
set -x
2+
3+
function kill_proc() {
4+
killall envoy
5+
killall http2_client
6+
killall server
7+
killall tlsServer
8+
killall tlsClient
9+
}
10+
11+
trap `kill_proc` SIGINT
12+
13+
SERVER_IP=127.0.0.1
14+
CLIENT_IP=127.0.0.1
15+
SERVER_PORT=1447
16+
CLIENT_PORT=10000
17+
ENVOY_YAML=envoy-config.yaml
18+
GO_SERVER=../server/tlsServer
19+
GO_CLIENT=../client/tlsClient
20+
ADDL_CLIENT_FLAGS="-key=/ca/tls-key"
21+
ADDL_SERVER_FLAGS="-crt=/ca/tls-crt -key=/ca/tls-key"
22+
23+
#Run envoy proxy
24+
make clean build
25+
envoy --log-level debug -c envoy/$ENVOY_YAML --log-path $PWD/envoy.log &
26+
27+
#Run http2 server and client, both should refer to envoy proxy
28+
$GO_SERVER -ip=$SERVER_IP -port=$SERVER_PORT $ADDL_SERVER_FLAGS &> server.log &
29+
$GO_CLIENT -ip=$CLIENT_IP -port=$CLIENT_PORT $ADDL_CLIENT_FLAGS &> client.log &
30+
31+
#verify communication
32+
tail -f server.log | while read temp
33+
do
34+
found=`echo $temp | grep "Replied"`
35+
echo $found
36+
if [[ "$found" == "Replied" ]]; then
37+
echo "test passed\n"
38+
break
39+
fi
40+
done
41+
42+
#kill process
43+
kill_proc

‎crypto/ingress-li-ca-crt

-33
This file was deleted.

‎crypto/server/Makefile

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
build:
22
go build
33

4+
debug: #change the args
5+
dlv debug tls_server.go -- -ip=127.0.0.1 -port=1447 -crt=/ca/tls-crt -key=/ca/tls-key
6+
7+
test:
8+
openssl s_client 127.0.0.1:1447
9+
410
clean:
511
go clean
6-
rm -f *.pem *.cert
12+
rm -f *.pem *.cert *.key *.csr *.crt

‎crypto/server/generate_tls_cert.sh

+19-4
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,32 @@
11
set -x
22

33
#clean
4-
rm -f *.pem *.cert
4+
rm -f *.pem *.cert *.key *.csr *.crt
55

66
#generate private key
77
#This key is a 1024 bit RSA key which is encrypted using Triple-DES and stored in a PEM format so
88
#that it is readable as ASCII text.
9-
openssl genrsa -out private.pem 1024
9+
#openssl genrsa -out private.pem 1024
1010

1111
#create public key
12-
openssl rsa -in private.pem -outform PEM -pubout -out public.pem
12+
#openssl rsa -in private.pem -outform PEM -pubout -out public.pem
1313

1414
#create X509 cert
1515
#X.509 certificate is a standard way to distribute public keys, signed by a certificate authority...
1616
#here, this is self signed
17-
openssl req -new -x509 -key private.pem -out selfSigned.cert -days 365 -config server.req
17+
#openssl req -new -x509 -key private.pem -out ca.cert -days 365 -config server.req
18+
19+
#generate ca private key,
20+
openssl genpkey -algorithm RSA -out ca.key -config server.req
21+
22+
#generate ca cert
23+
openssl req -new -x509 -key ca.key -out ca.cert -days 365 -config server.req
24+
25+
#generate user private key
26+
openssl genpkey -algorithm RSA -out user.key
27+
28+
#create certificate signing request using user key
29+
openssl req -new -key user.key -out user.csr -config server.req
30+
31+
#create and sign cert using ca cert
32+
openssl x509 -req -in user.csr -CA ca.cert -CAkey ca.key -CAcreateserial -out user.crt -days 365 -sha256

‎crypto/server/tlsServer

-5.49 MB
Binary file not shown.

‎crypto/server/tls_server.go

+42-10
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,16 @@ import (
99
"net"
1010
"bufio"
1111
"io/ioutil"
12+
//"time"
1213
)
1314

1415
func main() {
15-
ipPtr := flag.String("ip", "0.0.0.0", "ip server listening to")
16-
portPtr := flag.String("port", "3000", "port server listening to")
17-
crtPtr := flag.String("crt", "selfSigned.cert", "X.509 certificate")
18-
keyPtr := flag.String("key", "private.pem", "private key")
19-
caCrtPtr := flag.String("caCrt", "", "A PEM encoded CA's certificate file")
16+
ipPtr := flag.String("ip", "0.0.0.0", "ip server listening to")
17+
portPtr := flag.String("port", "3000", "port server listening to")
18+
crtPtr := flag.String("crt", "selfSigned.cert", "X.509 certificate")
19+
keyPtr := flag.String("key", "private.pem", "private key")
20+
caCrtPtr := flag.String("caCrt", "", "A PEM encoded CA's certificate file")
21+
insecurePtr := flag.String("insecure", "false", "skip verifying cert chain")
2022
flag.Parse()
2123

2224
fmt.Printf("listening on %s\n", *ipPtr + ":" + *portPtr)
@@ -28,13 +30,20 @@ func main() {
2830
return
2931
}
3032

33+
insecure := false
34+
if *insecurePtr == "true" {
35+
insecure = true
36+
}
37+
3138
var config *tls.Config
3239
if *caCrtPtr == "" {
3340
config = &tls.Config{
3441
Certificates: []tls.Certificate{cer},
35-
MinVersion: tls.VersionTLS13,
42+
MinVersion: tls.VersionTLS12,
43+
InsecureSkipVerify: insecure,
3644
}
3745
} else {
46+
fmt.Printf("Using ca cert %s\n", *caCrtPtr)
3847
caCert, err := ioutil.ReadFile(*caCrtPtr)
3948
if err != nil {
4049
log.Fatal(err)
@@ -45,10 +54,12 @@ func main() {
4554
config = &tls.Config{
4655
Certificates: []tls.Certificate{cer},
4756
RootCAs: caCertPool,
48-
MinVersion: tls.VersionTLS13,
57+
MinVersion: tls.VersionTLS12,
58+
InsecureSkipVerify: insecure,
4959
}
5060
}
5161

62+
printTlsConfig(config)
5263
ln, err := tls.Listen("tcp", *ipPtr + ":" + *portPtr, config)
5364
if err != nil {
5465
log.Println(err)
@@ -58,6 +69,7 @@ func main() {
5869

5970
for {
6071
conn, err := ln.Accept()
72+
//conn.SetReadDeadline(time.Now().Add(30*time.Second))
6173
if err != nil {
6274
log.Println(err)
6375
continue
@@ -72,11 +84,15 @@ func handleConnection(conn net.Conn) {
7284
for {
7385
msg, err := r.ReadString('\n')
7486
if err != nil {
75-
log.Println(err)
76-
return
87+
fmt.Printf("errored - %v\n", err.Error())
88+
continue
7789
}
7890

79-
println(msg)
91+
if(msg == "") {
92+
fmt.Println("empty message")
93+
}
94+
95+
fmt.Println(msg)
8096

8197
n, err := conn.Write([]byte("world\n"))
8298
if err != nil {
@@ -87,3 +103,19 @@ func handleConnection(conn net.Conn) {
87103
fmt.Print("Replied\n")
88104
}
89105
}
106+
107+
func printTlsConfig(config *tls.Config) {
108+
tlsVersion := ""
109+
switch(config.MinVersion) {
110+
case tls.VersionTLS11: tlsVersion = "TLS 1.1"
111+
case tls.VersionTLS12: tlsVersion = "TLS 1.2"
112+
case tls.VersionTLS13: tlsVersion = "TLS 1.3"
113+
}
114+
115+
insecure := "false"
116+
if config.InsecureSkipVerify {
117+
insecure = "true"
118+
}
119+
120+
fmt.Printf("TLS Config\n minVersion : %s\tInsecure:%s", tlsVersion, insecure)
121+
}

‎crypto/verify_certs.sh

-3
This file was deleted.

‎sockets/dns_lookup/arp.cc

+1-1
Original file line numberDiff line numberDiff line change
@@ -283,4 +283,4 @@ int main(int argc, const char **argv) {
283283
const char *ifname = argv[1];
284284
const char *ip = argv[2];
285285
return test_arping(ifname, ip);
286-
}
286+
}

‎sockets/socket_client.cc

-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ int main(int argc, char **argv)
2323
std::cout<<"set dscp : "<<dscp<<"\n";
2424

2525
if(connect(sock, (struct sockaddr*)&client, sizeof(client)) < 0) retError("failed to connect socket");
26-
std::cout<<"connected to 127.0.0.1:3000\n";
2726

2827
std::string msg = "test";
2928
while(true) {

‎sockets/utils.h

+1
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ int retError(const std::string sError)
2222
std::unique_ptr<host> getHostFromArg(int argc, char** argv, int ipIndex, int portIndex)
2323
{
2424
if(argc < ipIndex || argc < portIndex) return nullptr;
25+
std::cout<<"Connecting to "<<argv[ipIndex]<<":"<<argv[portIndex]<<"\n";
2526
return std::make_unique<host>(argv[ipIndex], std::atoi(argv[portIndex]));
2627
}
2728

0 commit comments

Comments
 (0)
Please sign in to comment.