73 lines
1.8 KiB
Go
73 lines
1.8 KiB
Go
package frp
|
|
|
|
import (
|
|
"crypto/ecdsa"
|
|
"crypto/elliptic"
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"crypto/x509"
|
|
"crypto/x509/pkix"
|
|
"encoding/hex"
|
|
"encoding/pem"
|
|
"fmt"
|
|
"math/big"
|
|
"net"
|
|
"time"
|
|
)
|
|
|
|
type agentCertificate struct {
|
|
CertPEM string
|
|
KeyPEM string
|
|
Pin string
|
|
NotAfter time.Time
|
|
}
|
|
|
|
func generateAgentCertificate(host string) (agentCertificate, error) {
|
|
key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
|
if err != nil {
|
|
return agentCertificate{}, err
|
|
}
|
|
serialLimit := new(big.Int).Lsh(big.NewInt(1), 128)
|
|
serial, err := rand.Int(rand.Reader, serialLimit)
|
|
if err != nil {
|
|
return agentCertificate{}, err
|
|
}
|
|
now := time.Now()
|
|
template := &x509.Certificate{
|
|
SerialNumber: serial,
|
|
Subject: pkix.Name{CommonName: host},
|
|
NotBefore: now.Add(-5 * time.Minute),
|
|
NotAfter: now.Add(365 * 24 * time.Hour),
|
|
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
|
|
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
|
}
|
|
if ip := net.ParseIP(host); ip != nil {
|
|
template.IPAddresses = []net.IP{ip}
|
|
} else {
|
|
template.DNSNames = []string{host}
|
|
}
|
|
der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
|
|
if err != nil {
|
|
return agentCertificate{}, err
|
|
}
|
|
keyDER, err := x509.MarshalPKCS8PrivateKey(key)
|
|
if err != nil {
|
|
return agentCertificate{}, err
|
|
}
|
|
sum := sha256.Sum256(der)
|
|
return agentCertificate{
|
|
CertPEM: string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})),
|
|
KeyPEM: string(pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER})),
|
|
Pin: hex.EncodeToString(sum[:]),
|
|
NotAfter: template.NotAfter,
|
|
}, nil
|
|
}
|
|
|
|
func validatePin(pin string) error {
|
|
decoded, err := hex.DecodeString(pin)
|
|
if err != nil || len(decoded) != sha256.Size {
|
|
return fmt.Errorf("证书指纹格式无效")
|
|
}
|
|
return nil
|
|
}
|