tlsConfig extracts a context docker endpoint TLS config
()
| 43 | |
| 44 | // tlsConfig extracts a context docker endpoint TLS config |
| 45 | func (ep *Endpoint) tlsConfig() (*tls.Config, error) { |
| 46 | if ep.TLSData == nil && !ep.SkipTLSVerify { |
| 47 | // there is no specific tls config |
| 48 | return nil, nil |
| 49 | } |
| 50 | var tlsOpts []func(*tls.Config) |
| 51 | if ep.TLSData != nil && ep.TLSData.CA != nil { |
| 52 | certPool := x509.NewCertPool() |
| 53 | if !certPool.AppendCertsFromPEM(ep.TLSData.CA) { |
| 54 | return nil, errors.New("failed to retrieve context tls info: ca.pem seems invalid") |
| 55 | } |
| 56 | tlsOpts = append(tlsOpts, func(cfg *tls.Config) { |
| 57 | cfg.RootCAs = certPool |
| 58 | }) |
| 59 | } |
| 60 | if ep.TLSData != nil && ep.TLSData.Key != nil && ep.TLSData.Cert != nil { |
| 61 | keyBytes := ep.TLSData.Key |
| 62 | pemBlock, _ := pem.Decode(keyBytes) |
| 63 | if pemBlock == nil { |
| 64 | return nil, errors.New("no valid private key found") |
| 65 | } |
| 66 | if x509.IsEncryptedPEMBlock(pemBlock) { //nolint:staticcheck // SA1019: x509.IsEncryptedPEMBlock is deprecated, and insecure by design |
| 67 | return nil, errors.New("private key is encrypted - support for encrypted private keys has been removed, see https://docs.docker.com/go/deprecated/") |
| 68 | } |
| 69 | |
| 70 | x509cert, err := tls.X509KeyPair(ep.TLSData.Cert, keyBytes) |
| 71 | if err != nil { |
| 72 | return nil, fmt.Errorf("failed to retrieve context tls info: %w", err) |
| 73 | } |
| 74 | tlsOpts = append(tlsOpts, func(cfg *tls.Config) { |
| 75 | cfg.Certificates = []tls.Certificate{x509cert} |
| 76 | }) |
| 77 | } |
| 78 | if ep.SkipTLSVerify { |
| 79 | tlsOpts = append(tlsOpts, func(cfg *tls.Config) { |
| 80 | cfg.InsecureSkipVerify = true |
| 81 | }) |
| 82 | } |
| 83 | return tlsconfig.ClientDefault(tlsOpts...), nil |
| 84 | } |
| 85 | |
| 86 | // ClientOpts returns a slice of Client options to configure an API client with this endpoint |
| 87 | func (ep *Endpoint) ClientOpts() ([]client.Opt, error) { |