(args *CLIArgs, logger *clog.CondLogger)
| 1061 | } |
| 1062 | |
| 1063 | func makeServerTLSConfig(args *CLIArgs, logger *clog.CondLogger) (*tls.Config, error) { |
| 1064 | cfg := &tls.Config{ |
| 1065 | MinVersion: uint16(args.minTLSVersion), |
| 1066 | MaxVersion: uint16(args.maxTLSVersion), |
| 1067 | } |
| 1068 | if args.cert != "" { |
| 1069 | cert, err := tls.LoadX509KeyPair(args.cert, args.key) |
| 1070 | if err != nil { |
| 1071 | return nil, err |
| 1072 | } |
| 1073 | cfg.Certificates = []tls.Certificate{cert} |
| 1074 | } |
| 1075 | if args.cafile != "" { |
| 1076 | roots, err := tlsutil.LoadCAfile(args.cafile) |
| 1077 | if err != nil { |
| 1078 | return nil, err |
| 1079 | } |
| 1080 | cfg.ClientCAs = roots |
| 1081 | cfg.ClientAuth = tls.VerifyClientCertIfGiven |
| 1082 | } |
| 1083 | var err error |
| 1084 | cfg.CipherSuites, err = tlsutil.ParseCipherList(args.ciphers) |
| 1085 | if err != nil { |
| 1086 | return nil, err |
| 1087 | } |
| 1088 | cfg.CurvePreferences, err = tlsutil.ParseCurveList(args.curves) |
| 1089 | if err != nil { |
| 1090 | return nil, err |
| 1091 | } |
| 1092 | if args.tlsALPNEnabled { |
| 1093 | if !args.disableHTTP2 { |
| 1094 | cfg.NextProtos = []string{"h2", "http/1.1"} |
| 1095 | } else { |
| 1096 | cfg.NextProtos = []string{"http/1.1"} |
| 1097 | } |
| 1098 | } |
| 1099 | if len(args.tlsSessionKeys) > 0 { |
| 1100 | cfg.SetSessionTicketKeys(args.tlsSessionKeys) |
| 1101 | if args.tlsCookies { |
| 1102 | cfg = tlsutil.EnableTLSCookies(cfg, logger) |
| 1103 | } |
| 1104 | } |
| 1105 | return cfg, nil |
| 1106 | } |
| 1107 | |
| 1108 | func readConfig(filename string) error { |
| 1109 | f, err := os.Open(filename) |
no test coverage detected