mirror of
https://github.com/libp2p/go-openssl.git
synced 2025-04-23 17:40:31 +08:00
stop using the deprecated io/ioutil package
This commit is contained in:
web3-bot
parent
aac7f17850
commit
d170df1036
4
cert.go
4
cert.go
@ -19,7 +19,7 @@ import "C"
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"io/ioutil"
|
||||
"io"
|
||||
"math/big"
|
||||
"runtime"
|
||||
"time"
|
||||
@ -383,7 +383,7 @@ func (c *Certificate) MarshalPEM() (pem_block []byte, err error) {
|
||||
if int(C.PEM_write_bio_X509(bio, c.x)) != 1 {
|
||||
return nil, errors.New("failed dumping certificate")
|
||||
}
|
||||
return ioutil.ReadAll(asAnyBio(bio))
|
||||
return io.ReadAll(asAnyBio(bio))
|
||||
}
|
||||
|
||||
// PublicKey returns the public key embedded in the X509 certificate.
|
||||
|
||||
5
ctx.go
5
ctx.go
@ -20,7 +20,6 @@ import "C"
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"runtime"
|
||||
"sync"
|
||||
@ -121,7 +120,7 @@ func NewCtxFromFiles(cert_file string, key_file string) (*Ctx, error) {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
cert_bytes, err := ioutil.ReadFile(cert_file)
|
||||
cert_bytes, err := os.ReadFile(cert_file)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@ -152,7 +151,7 @@ func NewCtxFromFiles(cert_file string, key_file string) (*Ctx, error) {
|
||||
}
|
||||
}
|
||||
|
||||
key_bytes, err := ioutil.ReadFile(key_file)
|
||||
key_bytes, err := os.ReadFile(key_file)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
6
fips.go
6
fips.go
@ -25,8 +25,10 @@ package openssl
|
||||
|
||||
*/
|
||||
import "C"
|
||||
import "errors"
|
||||
import "runtime"
|
||||
import (
|
||||
"errors"
|
||||
"runtime"
|
||||
)
|
||||
|
||||
// FIPSModeSet enables a FIPS 140-2 validated mode of operation.
|
||||
// https://wiki.openssl.org/index.php/FIPS_mode_set()
|
||||
|
||||
66
init.go
66
init.go
@ -18,65 +18,69 @@ Package openssl is a light wrapper around OpenSSL for Go.
|
||||
It strives to provide a near-drop-in replacement for the Go standard library
|
||||
tls package, while allowing for:
|
||||
|
||||
Performance
|
||||
# Performance
|
||||
|
||||
OpenSSL is battle-tested and optimized C. While Go's built-in library shows
|
||||
great promise, it is still young and in some places, inefficient. This simple
|
||||
OpenSSL wrapper can often do at least 2x with the same cipher and protocol.
|
||||
|
||||
On my lappytop, I get the following benchmarking speeds:
|
||||
BenchmarkSHA1Large_openssl 1000 2611282 ns/op 401.56 MB/s
|
||||
BenchmarkSHA1Large_stdlib 500 3963983 ns/op 264.53 MB/s
|
||||
BenchmarkSHA1Small_openssl 1000000 3476 ns/op 0.29 MB/s
|
||||
BenchmarkSHA1Small_stdlib 5000000 550 ns/op 1.82 MB/s
|
||||
BenchmarkSHA256Large_openssl 200 8085314 ns/op 129.69 MB/s
|
||||
BenchmarkSHA256Large_stdlib 100 18948189 ns/op 55.34 MB/s
|
||||
BenchmarkSHA256Small_openssl 1000000 4262 ns/op 0.23 MB/s
|
||||
BenchmarkSHA256Small_stdlib 1000000 1444 ns/op 0.69 MB/s
|
||||
BenchmarkOpenSSLThroughput 100000 21634 ns/op 47.33 MB/s
|
||||
BenchmarkStdlibThroughput 50000 58974 ns/op 17.36 MB/s
|
||||
|
||||
Interoperability
|
||||
BenchmarkSHA1Large_openssl 1000 2611282 ns/op 401.56 MB/s
|
||||
BenchmarkSHA1Large_stdlib 500 3963983 ns/op 264.53 MB/s
|
||||
BenchmarkSHA1Small_openssl 1000000 3476 ns/op 0.29 MB/s
|
||||
BenchmarkSHA1Small_stdlib 5000000 550 ns/op 1.82 MB/s
|
||||
BenchmarkSHA256Large_openssl 200 8085314 ns/op 129.69 MB/s
|
||||
BenchmarkSHA256Large_stdlib 100 18948189 ns/op 55.34 MB/s
|
||||
BenchmarkSHA256Small_openssl 1000000 4262 ns/op 0.23 MB/s
|
||||
BenchmarkSHA256Small_stdlib 1000000 1444 ns/op 0.69 MB/s
|
||||
BenchmarkOpenSSLThroughput 100000 21634 ns/op 47.33 MB/s
|
||||
BenchmarkStdlibThroughput 50000 58974 ns/op 17.36 MB/s
|
||||
|
||||
# Interoperability
|
||||
|
||||
Many systems support OpenSSL with a variety of plugins and modules for things,
|
||||
such as hardware acceleration in embedded devices.
|
||||
|
||||
Greater flexibility and configuration
|
||||
# Greater flexibility and configuration
|
||||
|
||||
OpenSSL allows for far greater configuration of corner cases and backwards
|
||||
compatibility (such as support of SSLv2). You shouldn't be using SSLv2 if you
|
||||
can help but, but sometimes you can't help it.
|
||||
|
||||
Security
|
||||
# Security
|
||||
|
||||
Yeah yeah, Heartbleed. But according to the author of the standard library's
|
||||
TLS implementation, Go's TLS library is vulnerable to timing attacks. And
|
||||
whether or not OpenSSL received the appropriate amount of scrutiny
|
||||
pre-Heartbleed, it sure is receiving it now.
|
||||
|
||||
Usage
|
||||
# Usage
|
||||
|
||||
Starting an HTTP server that uses OpenSSL is very easy. It's as simple as:
|
||||
log.Fatal(openssl.ListenAndServeTLS(
|
||||
":8443", "my_server.crt", "my_server.key", myHandler))
|
||||
|
||||
log.Fatal(openssl.ListenAndServeTLS(
|
||||
":8443", "my_server.crt", "my_server.key", myHandler))
|
||||
|
||||
Getting a net.Listener that uses OpenSSL is also easy:
|
||||
ctx, err := openssl.NewCtxFromFiles("my_server.crt", "my_server.key")
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
l, err := openssl.Listen("tcp", ":7777", ctx)
|
||||
|
||||
ctx, err := openssl.NewCtxFromFiles("my_server.crt", "my_server.key")
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
l, err := openssl.Listen("tcp", ":7777", ctx)
|
||||
|
||||
Making a client connection is straightforward too:
|
||||
ctx, err := NewCtx()
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
err = ctx.LoadVerifyLocations("/etc/ssl/certs/ca-certificates.crt", "")
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
conn, err := openssl.Dial("tcp", "localhost:7777", ctx, 0)
|
||||
|
||||
ctx, err := NewCtx()
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
err = ctx.LoadVerifyLocations("/etc/ssl/certs/ca-certificates.crt", "")
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
conn, err := openssl.Dial("tcp", "localhost:7777", ctx, 0)
|
||||
|
||||
Help wanted: To get this library to work with net/http's client, we
|
||||
had to fork net/http. It would be nice if an alternate http client library
|
||||
|
||||
10
key.go
10
key.go
@ -19,7 +19,7 @@ import "C"
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"io/ioutil"
|
||||
"io"
|
||||
"runtime"
|
||||
"unsafe"
|
||||
)
|
||||
@ -242,7 +242,7 @@ func (key *pKey) MarshalPKCS1PrivateKeyPEM() (pem_block []byte,
|
||||
return nil, errors.New("failed dumping private key")
|
||||
}
|
||||
|
||||
return ioutil.ReadAll(asAnyBio(bio))
|
||||
return io.ReadAll(asAnyBio(bio))
|
||||
}
|
||||
|
||||
func (key *pKey) MarshalPKCS1PrivateKeyDER() (der_block []byte,
|
||||
@ -257,7 +257,7 @@ func (key *pKey) MarshalPKCS1PrivateKeyDER() (der_block []byte,
|
||||
return nil, errors.New("failed dumping private key der")
|
||||
}
|
||||
|
||||
return ioutil.ReadAll(asAnyBio(bio))
|
||||
return io.ReadAll(asAnyBio(bio))
|
||||
}
|
||||
|
||||
func (key *pKey) MarshalPKIXPublicKeyPEM() (pem_block []byte,
|
||||
@ -272,7 +272,7 @@ func (key *pKey) MarshalPKIXPublicKeyPEM() (pem_block []byte,
|
||||
return nil, errors.New("failed dumping public key pem")
|
||||
}
|
||||
|
||||
return ioutil.ReadAll(asAnyBio(bio))
|
||||
return io.ReadAll(asAnyBio(bio))
|
||||
}
|
||||
|
||||
func (key *pKey) MarshalPKIXPublicKeyDER() (der_block []byte,
|
||||
@ -287,7 +287,7 @@ func (key *pKey) MarshalPKIXPublicKeyDER() (der_block []byte,
|
||||
return nil, errors.New("failed dumping public key der")
|
||||
}
|
||||
|
||||
return ioutil.ReadAll(asAnyBio(bio))
|
||||
return io.ReadAll(asAnyBio(bio))
|
||||
}
|
||||
|
||||
// LoadPrivateKeyFromPEM loads a private key from a PEM-encoded block.
|
||||
|
||||
54
key_test.go
54
key_test.go
@ -22,7 +22,7 @@ import (
|
||||
"crypto/x509"
|
||||
"encoding/hex"
|
||||
pem_pkg "encoding/pem"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"testing"
|
||||
)
|
||||
|
||||
@ -51,8 +51,8 @@ func TestMarshal(t *testing.T) {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(pem, certBytes) {
|
||||
ioutil.WriteFile("generated", pem, 0644)
|
||||
ioutil.WriteFile("hardcoded", certBytes, 0644)
|
||||
os.WriteFile("generated", pem, 0644)
|
||||
os.WriteFile("hardcoded", certBytes, 0644)
|
||||
t.Fatal("invalid cert pem bytes")
|
||||
}
|
||||
|
||||
@ -61,8 +61,8 @@ func TestMarshal(t *testing.T) {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(pem, keyBytes) {
|
||||
ioutil.WriteFile("generated", pem, 0644)
|
||||
ioutil.WriteFile("hardcoded", keyBytes, 0644)
|
||||
os.WriteFile("generated", pem, 0644)
|
||||
os.WriteFile("hardcoded", keyBytes, 0644)
|
||||
t.Fatal("invalid private key pem bytes")
|
||||
}
|
||||
tls_cert, err := tls.X509KeyPair(certBytes, keyBytes)
|
||||
@ -94,8 +94,8 @@ func TestMarshal(t *testing.T) {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(der, tls_der) {
|
||||
ioutil.WriteFile("generated", []byte(hex.Dump(der)), 0644)
|
||||
ioutil.WriteFile("hardcoded", []byte(hex.Dump(tls_der)), 0644)
|
||||
os.WriteFile("generated", []byte(hex.Dump(der)), 0644)
|
||||
os.WriteFile("hardcoded", []byte(hex.Dump(tls_der)), 0644)
|
||||
t.Fatal("invalid public key der bytes")
|
||||
}
|
||||
|
||||
@ -106,8 +106,8 @@ func TestMarshal(t *testing.T) {
|
||||
tls_pem := pem_pkg.EncodeToMemory(&pem_pkg.Block{
|
||||
Type: "PUBLIC KEY", Bytes: tls_der})
|
||||
if !bytes.Equal(pem, tls_pem) {
|
||||
ioutil.WriteFile("generated", pem, 0644)
|
||||
ioutil.WriteFile("hardcoded", tls_pem, 0644)
|
||||
os.WriteFile("generated", pem, 0644)
|
||||
os.WriteFile("hardcoded", tls_pem, 0644)
|
||||
t.Fatal("invalid public key pem bytes")
|
||||
}
|
||||
|
||||
@ -132,14 +132,14 @@ func TestMarshal(t *testing.T) {
|
||||
}
|
||||
|
||||
if !bytes.Equal(new_der_from_der, tls_der) {
|
||||
ioutil.WriteFile("generated", []byte(hex.Dump(new_der_from_der)), 0644)
|
||||
ioutil.WriteFile("hardcoded", []byte(hex.Dump(tls_der)), 0644)
|
||||
os.WriteFile("generated", []byte(hex.Dump(new_der_from_der)), 0644)
|
||||
os.WriteFile("hardcoded", []byte(hex.Dump(tls_der)), 0644)
|
||||
t.Fatal("invalid public key der bytes")
|
||||
}
|
||||
|
||||
if !bytes.Equal(new_der_from_pem, tls_der) {
|
||||
ioutil.WriteFile("generated", []byte(hex.Dump(new_der_from_pem)), 0644)
|
||||
ioutil.WriteFile("hardcoded", []byte(hex.Dump(tls_der)), 0644)
|
||||
os.WriteFile("generated", []byte(hex.Dump(new_der_from_pem)), 0644)
|
||||
os.WriteFile("hardcoded", []byte(hex.Dump(tls_der)), 0644)
|
||||
t.Fatal("invalid public key der bytes")
|
||||
}
|
||||
}
|
||||
@ -303,8 +303,8 @@ func TestMarshalEC(t *testing.T) {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(pem, prime256v1CertBytes) {
|
||||
ioutil.WriteFile("generated", pem, 0644)
|
||||
ioutil.WriteFile("hardcoded", prime256v1CertBytes, 0644)
|
||||
os.WriteFile("generated", pem, 0644)
|
||||
os.WriteFile("hardcoded", prime256v1CertBytes, 0644)
|
||||
t.Fatal("invalid cert pem bytes")
|
||||
}
|
||||
|
||||
@ -313,8 +313,8 @@ func TestMarshalEC(t *testing.T) {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(pem, prime256v1KeyBytes) {
|
||||
ioutil.WriteFile("generated", pem, 0644)
|
||||
ioutil.WriteFile("hardcoded", prime256v1KeyBytes, 0644)
|
||||
os.WriteFile("generated", pem, 0644)
|
||||
os.WriteFile("hardcoded", prime256v1KeyBytes, 0644)
|
||||
t.Fatal("invalid private key pem bytes")
|
||||
}
|
||||
tls_cert, err := tls.X509KeyPair(prime256v1CertBytes, prime256v1KeyBytes)
|
||||
@ -349,8 +349,8 @@ func TestMarshalEC(t *testing.T) {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(der, tls_der) {
|
||||
ioutil.WriteFile("generated", []byte(hex.Dump(der)), 0644)
|
||||
ioutil.WriteFile("hardcoded", []byte(hex.Dump(tls_der)), 0644)
|
||||
os.WriteFile("generated", []byte(hex.Dump(der)), 0644)
|
||||
os.WriteFile("hardcoded", []byte(hex.Dump(tls_der)), 0644)
|
||||
t.Fatal("invalid public key der bytes")
|
||||
}
|
||||
|
||||
@ -361,8 +361,8 @@ func TestMarshalEC(t *testing.T) {
|
||||
tls_pem := pem_pkg.EncodeToMemory(&pem_pkg.Block{
|
||||
Type: "PUBLIC KEY", Bytes: tls_der})
|
||||
if !bytes.Equal(pem, tls_pem) {
|
||||
ioutil.WriteFile("generated", pem, 0644)
|
||||
ioutil.WriteFile("hardcoded", tls_pem, 0644)
|
||||
os.WriteFile("generated", pem, 0644)
|
||||
os.WriteFile("hardcoded", tls_pem, 0644)
|
||||
t.Fatal("invalid public key pem bytes")
|
||||
}
|
||||
|
||||
@ -387,14 +387,14 @@ func TestMarshalEC(t *testing.T) {
|
||||
}
|
||||
|
||||
if !bytes.Equal(new_der_from_der, tls_der) {
|
||||
ioutil.WriteFile("generated", []byte(hex.Dump(new_der_from_der)), 0644)
|
||||
ioutil.WriteFile("hardcoded", []byte(hex.Dump(tls_der)), 0644)
|
||||
os.WriteFile("generated", []byte(hex.Dump(new_der_from_der)), 0644)
|
||||
os.WriteFile("hardcoded", []byte(hex.Dump(tls_der)), 0644)
|
||||
t.Fatal("invalid public key der bytes")
|
||||
}
|
||||
|
||||
if !bytes.Equal(new_der_from_pem, tls_der) {
|
||||
ioutil.WriteFile("generated", []byte(hex.Dump(new_der_from_pem)), 0644)
|
||||
ioutil.WriteFile("hardcoded", []byte(hex.Dump(tls_der)), 0644)
|
||||
os.WriteFile("generated", []byte(hex.Dump(new_der_from_pem)), 0644)
|
||||
os.WriteFile("hardcoded", []byte(hex.Dump(tls_der)), 0644)
|
||||
t.Fatal("invalid public key der bytes")
|
||||
}
|
||||
}
|
||||
@ -423,8 +423,8 @@ func TestMarshalEd25519(t *testing.T) {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(pem, ed25519CertBytes) {
|
||||
ioutil.WriteFile("generated", pem, 0644)
|
||||
ioutil.WriteFile("hardcoded", ed25519CertBytes, 0644)
|
||||
os.WriteFile("generated", pem, 0644)
|
||||
os.WriteFile("hardcoded", ed25519CertBytes, 0644)
|
||||
t.Fatal("invalid cert pem bytes")
|
||||
}
|
||||
|
||||
|
||||
@ -19,7 +19,6 @@ import (
|
||||
"crypto/rand"
|
||||
"crypto/tls"
|
||||
"io"
|
||||
"io/ioutil"
|
||||
"net"
|
||||
"sync"
|
||||
"testing"
|
||||
@ -283,7 +282,7 @@ func ClosingTest(t *testing.T, constructor func(
|
||||
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
data, err := ioutil.ReadAll(sslconn2)
|
||||
data, err := io.ReadAll(sslconn2)
|
||||
if !bytes.Equal(data, []byte("hello")) {
|
||||
t.Error("bytes don't match")
|
||||
}
|
||||
@ -589,7 +588,7 @@ func LotsOfConns(t *testing.T, payload_size int64, loops, clients int,
|
||||
}
|
||||
}()
|
||||
for i := 0; i < loops; i++ {
|
||||
_, err := io.Copy(ioutil.Discard,
|
||||
_, err := io.Copy(io.Discard,
|
||||
io.LimitReader(conn, payload_size))
|
||||
if err != nil {
|
||||
t.Errorf("failed reading: %s", err)
|
||||
@ -635,7 +634,7 @@ func LotsOfConns(t *testing.T, payload_size int64, loops, clients int,
|
||||
t.Errorf("failed writing: %s", err)
|
||||
return
|
||||
}
|
||||
_, err = io.Copy(ioutil.Discard,
|
||||
_, err = io.Copy(io.Discard,
|
||||
io.LimitReader(ssl_client, payload_size))
|
||||
if err != nil {
|
||||
t.Errorf("failed reading: %s", err)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user