Skip to content

Commit

Permalink
config: reload tikv/tidb cluster tls for every new established conn (#…
Browse files Browse the repository at this point in the history
  • Loading branch information
sre-bot authored Mar 10, 2020
1 parent 99660f4 commit a517f34
Showing 1 changed file with 31 additions and 22 deletions.
53 changes: 31 additions & 22 deletions config/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -149,38 +149,47 @@ func (e *ErrConfigValidationFailed) Error() string {
}

// ToTLSConfig generates tls's config based on security section of the config.
func (s *Security) ToTLSConfig() (*tls.Config, error) {
var tlsConfig *tls.Config
func (s *Security) ToTLSConfig() (tlsConfig *tls.Config, err error) {
if len(s.ClusterSSLCA) != 0 {
var certificates = make([]tls.Certificate, 0)
if len(s.ClusterSSLCert) != 0 && len(s.ClusterSSLKey) != 0 {
// Load the client certificates from disk
certificate, err := tls.LoadX509KeyPair(s.ClusterSSLCert, s.ClusterSSLKey)
if err != nil {
return nil, errors.Errorf("could not load client key pair: %s", err)
}
certificates = append(certificates, certificate)
}

// Create a certificate pool from the certificate authority
certPool := x509.NewCertPool()
ca, err := ioutil.ReadFile(s.ClusterSSLCA)
// Create a certificate pool from the certificate authority
var ca []byte
ca, err = ioutil.ReadFile(s.ClusterSSLCA)
if err != nil {
return nil, errors.Errorf("could not read ca certificate: %s", err)
err = errors.Errorf("could not read ca certificate: %s", err)
return
}

// Append the certificates from the CA
if !certPool.AppendCertsFromPEM(ca) {
return nil, errors.New("failed to append ca certs")
err = errors.New("failed to append ca certs")
return
}

tlsConfig = &tls.Config{
Certificates: certificates,
RootCAs: certPool,
RootCAs: certPool,
}
}

return tlsConfig, nil
if len(s.ClusterSSLCert) != 0 && len(s.ClusterSSLKey) != 0 {
getCert := func() (*tls.Certificate, error) {
// Load the client certificates from disk
cert, err := tls.LoadX509KeyPair(s.ClusterSSLCert, s.ClusterSSLKey)
if err != nil {
return nil, errors.Errorf("could not load client key pair: %s", err)
}
return &cert, nil
}
// pre-test cert's loading.
if _, err = getCert(); err != nil {
return
}
tlsConfig.GetClientCertificate = func(info *tls.CertificateRequestInfo) (certificate *tls.Certificate, err error) {
return getCert()
}
tlsConfig.GetCertificate = func(info *tls.ClientHelloInfo) (certificate *tls.Certificate, err error) {
return getCert()
}
}
}
return
}

// Status is the status section of the config.
Expand Down

0 comments on commit a517f34

Please sign in to comment.