External/nuclei
1
0
Fork 0
mirror of https://github.com/projectdiscovery/nuclei.git synced 2025-12-18 15:15:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improving error handling in client certificate library (#1237)

Browse Source
This commit is contained in:
Mzack9999 2021-11-10 18:12:49 +01:00 committed by GitHub
parent 09b5fb11e8
commit ac75d9aa9b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 23 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
v2/pkg/protocols/headless/engine/engine.go
View File

@ -88,7 +88,12 @@ func New(options *types.Options) (*Browser, error) {
if customAgent == "" { if customAgent == "" {
customAgent = uarand.GetRandom() customAgent = uarand.GetRandom()
} }
httpclient := newhttpClient(options)
httpclient, err := newhttpClient(options)
if err != nil {
return nil, err
}
engine := &Browser{ engine := &Browser{
tempDir: dataStore, tempDir: dataStore,
customAgent: customAgent, customAgent: customAgent,

10
v2/pkg/protocols/headless/engine/http_client.go
View File

@ -18,7 +18,7 @@ import (
) )
// newhttpClient creates a new http client for headless communication with a timeout // newhttpClient creates a new http client for headless communication with a timeout
func newhttpClient(options *types.Options) *http.Client { func newhttpClient(options *types.Options) (*http.Client, error) {
dialer := protocolstate.Dialer dialer := protocolstate.Dialer
// Set the base TLS configuration definition // Set the base TLS configuration definition
@ -28,7 +28,11 @@ func newhttpClient(options *types.Options) *http.Client {
} }
// Add the client certificate authentication to the request if it's configured // Add the client certificate authentication to the request if it's configured
tlsConfig = utils.AddConfiguredClientCertToRequest(tlsConfig, options) var err error
tlsConfig, err = utils.AddConfiguredClientCertToRequest(tlsConfig, options)
if err != nil {
return nil, err
}
transport := &http.Transport{ transport := &http.Transport{
DialContext: dialer.Dial, DialContext: dialer.Dial,
@ -70,5 +74,5 @@ func newhttpClient(options *types.Options) *http.Client {
}, },
} }
return httpclient return httpclient, nil
} }

5
v2/pkg/protocols/http/httpclientpool/clientpool.go
View File

@ -169,7 +169,10 @@ func wrappedGet(options *types.Options, configuration *Configuration) (*retryabl
} }
// Add the client certificate authentication to the request if it's configured // Add the client certificate authentication to the request if it's configured
tlsConfig = utils.AddConfiguredClientCertToRequest(tlsConfig, options) tlsConfig, err = utils.AddConfiguredClientCertToRequest(tlsConfig, options)
if err != nil {
return nil, errors.Wrap(err, "could not create client certificate")
}
transport := &http.Transport{ transport := &http.Transport{
DialContext: Dialer.Dial, DialContext: Dialer.Dial,

12
v2/pkg/protocols/utils/utils.go
View File

@ -3,13 +3,13 @@ package utils
import ( import (
"crypto/tls" "crypto/tls"
"crypto/x509" "crypto/x509"
"github.com/projectdiscovery/nuclei/v2/pkg/types"
"io/ioutil" "io/ioutil"
"log"
"github.com/projectdiscovery/nuclei/v2/pkg/types"
) )
// AddConfiguredClientCertToRequest adds the client certificate authentication to the tls.Config object and returns it // AddConfiguredClientCertToRequest adds the client certificate authentication to the tls.Config object and returns it
func AddConfiguredClientCertToRequest(tlsConfig *tls.Config, options *types.Options) *tls.Config { func AddConfiguredClientCertToRequest(tlsConfig *tls.Config, options *types.Options) (*tls.Config, error) {
// Build the TLS config with the client certificate if it has been configured with the appropriate options. // Build the TLS config with the client certificate if it has been configured with the appropriate options.
// Only one of the options needs to be checked since the validation checks in main.go ensure that all three // Only one of the options needs to be checked since the validation checks in main.go ensure that all three
// files are set if any of the client certification configuration options are. // files are set if any of the client certification configuration options are.
@ -17,18 +17,18 @@ func AddConfiguredClientCertToRequest(tlsConfig *tls.Config, options *types.Opti
// Load the client certificate using the PEM encoded client certificate and the private key file // Load the client certificate using the PEM encoded client certificate and the private key file
cert, err := tls.LoadX509KeyPair(options.ClientCertFile, options.ClientKeyFile) cert, err := tls.LoadX509KeyPair(options.ClientCertFile, options.ClientKeyFile)
if err != nil { if err != nil {
log.Fatal(err) return nil, err
} }
tlsConfig.Certificates = []tls.Certificate{cert} tlsConfig.Certificates = []tls.Certificate{cert}
// Load the certificate authority PEM certificate into the TLS configuration // Load the certificate authority PEM certificate into the TLS configuration
caCert, err := ioutil.ReadFile(options.ClientCAFile) caCert, err := ioutil.ReadFile(options.ClientCAFile)
if err != nil { if err != nil {
log.Fatal(err) return nil, err
} }
caCertPool := x509.NewCertPool() caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCert) caCertPool.AppendCertsFromPEM(caCert)
tlsConfig.RootCAs = caCertPool tlsConfig.RootCAs = caCertPool
} }
return tlsConfig return tlsConfig, nil
} }