initializeNoX509HttpClient() returns an http client based on the bootstrap connection information, but without any x509 keypair included in the tls config. This client can be used to perform basic authentication checks against the server. Client creation otherwise clones the approach used by gocb.
(ctx context.Context)
| 1915 | // authentication checks against the server. |
| 1916 | // Client creation otherwise clones the approach used by gocb. |
| 1917 | func (sc *ServerContext) initializeNoX509HttpClient(ctx context.Context) (*http.Client, error) { |
| 1918 | |
| 1919 | // baseTlsConfig defines the tlsConfig except for ServerName, which is updated based |
| 1920 | // on addr in DialTLS |
| 1921 | baseTlsConfig := &tls.Config{ |
| 1922 | MinVersion: tls.VersionTLS12, |
| 1923 | } |
| 1924 | var rootCAs *x509.CertPool |
| 1925 | tlsRootCAProvider, err := base.GoCBCoreTLSRootCAProvider(ctx, sc.Config.Bootstrap.ServerTLSSkipVerify, sc.Config.Bootstrap.CACertPath) |
| 1926 | if err != nil { |
| 1927 | return nil, err |
| 1928 | } |
| 1929 | rootCAs = tlsRootCAProvider() |
| 1930 | if rootCAs != nil { |
| 1931 | baseTlsConfig.RootCAs = rootCAs |
| 1932 | baseTlsConfig.InsecureSkipVerify = false |
| 1933 | } else { |
| 1934 | baseTlsConfig.InsecureSkipVerify = true |
| 1935 | } |
| 1936 | |
| 1937 | httpDialer := &net.Dialer{ |
| 1938 | Timeout: 30 * time.Second, |
| 1939 | KeepAlive: 30 * time.Second, |
| 1940 | } |
| 1941 | |
| 1942 | // gocbcore: We set ForceAttemptHTTP2, which will update the base-config to support HTTP2 |
| 1943 | // automatically, so that all configs from it will look for that. |
| 1944 | httpTransport := &http.Transport{ |
| 1945 | ForceAttemptHTTP2: true, |
| 1946 | |
| 1947 | Dial: func(network, addr string) (net.Conn, error) { |
| 1948 | return httpDialer.Dial(network, addr) |
| 1949 | }, |
| 1950 | DialTLS: func(network, addr string) (net.Conn, error) { |
| 1951 | tcpConn, err := httpDialer.Dial(network, addr) |
| 1952 | if err != nil { |
| 1953 | return nil, err |
| 1954 | } |
| 1955 | |
| 1956 | // Update tlsConfig.ServerName based on addr |
| 1957 | tlsConfig := baseTlsConfig.Clone() |
| 1958 | host, _, err := net.SplitHostPort(addr) |
| 1959 | if err != nil { |
| 1960 | return nil, err |
| 1961 | } |
| 1962 | tlsConfig.ServerName = host |
| 1963 | tlsConn := tls.Client(tcpConn, tlsConfig) |
| 1964 | return tlsConn, nil |
| 1965 | }, |
| 1966 | MaxIdleConns: base.DefaultHttpMaxIdleConns, |
| 1967 | MaxIdleConnsPerHost: base.DefaultHttpMaxIdleConnsPerHost, |
| 1968 | IdleConnTimeout: base.DefaultHttpIdleConnTimeout, |
| 1969 | } |
| 1970 | |
| 1971 | httpCli := &http.Client{ |
| 1972 | Transport: httpTransport, |
| 1973 | CheckRedirect: func(req *http.Request, via []*http.Request) error { |
| 1974 | // gocbcore: All that we're doing here is setting auth on any redirects. |