Link refactoring, admin socket changes

src/core/link_tls.go

@@ -1,20 +1,11 @@
 package core
 
 import (
-	"bytes"
 	"context"
-	"crypto/rand"
 	"crypto/tls"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/hex"
-	"encoding/pem"
 	"fmt"
-	"math/big"
 	"net"
 	"net/url"
-	"strings"
-	"time"
 
 	"github.com/Arceliar/phony"
 )
@@ -36,27 +27,23 @@ func (l *links) newLinkTLS(tcp *linkTCP) *linkTLS {
 			Control:   tcp.tcpContext,
 			KeepAlive: -1,
 		},
+		config:     l.core.config.tls.Clone(),
 		_listeners: map[*Listener]context.CancelFunc{},
 	}
-	var err error
-	lt.config, err = lt.generateConfig()
-	if err != nil {
-		panic(err)
-	}
 	return lt
 }
 
-func (l *linkTLS) dial(url *url.URL, options linkOptions, sintf, sni string) error {
-	dialers, err := l.tcp.dialersFor(url, options, sintf)
+func (l *linkTLS) dial(url *url.URL, info linkInfo, options linkOptions) (net.Conn, error) {
+	dialers, err := l.tcp.dialersFor(url, info)
 	if err != nil {
-		return err
+		return nil, err
 	}
 	if len(dialers) == 0 {
-		return nil
+		return nil, nil
 	}
 	for _, d := range dialers {
 		tlsconfig := l.config.Clone()
-		tlsconfig.ServerName = sni
+		tlsconfig.ServerName = options.tlsSNI
 		tlsdialer := &tls.Dialer{
 			NetDialer: d.dialer,
 			Config:    tlsconfig,
@@ -66,18 +53,12 @@ func (l *linkTLS) dial(url *url.URL, options linkOptions, sintf, sni string) err
 		if err != nil {
 			continue
 		}
-		name := strings.TrimRight(strings.SplitN(url.String(), "?", 2)[0], "/")
-		dial := &linkDial{
-			url:   url,
-			sintf: sintf,
-		}
-		return l.handler(dial, name, d.info, conn, options, false, false)
+		return conn, nil
 	}
-	return fmt.Errorf("failed to connect via %d address(es), last error: %w", len(dialers), err)
+	return nil, err
 }
 
-func (l *linkTLS) listen(url *url.URL, sintf string) (*Listener, error) {
-	ctx, cancel := context.WithCancel(l.core.ctx)
+func (l *linkTLS) listen(ctx context.Context, url *url.URL, sintf string) (net.Listener, error) {
 	hostport := url.Host
 	if sintf != "" {
 		if host, port, err := net.SplitHostPort(hostport); err == nil {
@@ -86,88 +67,8 @@ func (l *linkTLS) listen(url *url.URL, sintf string) (*Listener, error) {
 	}
 	listener, err := l.listener.Listen(ctx, "tcp", hostport)
 	if err != nil {
-		cancel()
 		return nil, err
 	}
 	tlslistener := tls.NewListener(listener, l.config)
-	entry := &Listener{
-		Listener: tlslistener,
-		closed:   make(chan struct{}),
-	}
-	phony.Block(l, func() {
-		l._listeners[entry] = cancel
-	})
-	l.core.log.Printf("TLS listener started on %s", listener.Addr())
-	go func() {
-		defer phony.Block(l, func() {
-			delete(l._listeners, entry)
-		})
-		for {
-			conn, err := tlslistener.Accept()
-			if err != nil {
-				cancel()
-				break
-			}
-			laddr := conn.LocalAddr().(*net.TCPAddr)
-			raddr := conn.RemoteAddr().(*net.TCPAddr)
-			name := fmt.Sprintf("tls://%s", raddr)
-			info := linkInfoFor("tls", sintf, tcpIDFor(laddr, raddr))
-			if err = l.handler(nil, name, info, conn, linkOptionsForListener(url), true, raddr.IP.IsLinkLocalUnicast()); err != nil {
-				l.core.log.Errorln("Failed to create inbound link:", err)
-			}
-		}
-		_ = tlslistener.Close()
-		close(entry.closed)
-		l.core.log.Printf("TLS listener stopped on %s", listener.Addr())
-	}()
-	return entry, nil
-}
-
-// RFC5280 section 4.1.2.5
-var notAfterNeverExpires = time.Date(9999, time.December, 31, 23, 59, 59, 0, time.UTC)
-
-func (l *linkTLS) generateConfig() (*tls.Config, error) {
-	certBuf := &bytes.Buffer{}
-	cert := x509.Certificate{
-		SerialNumber: big.NewInt(1),
-		Subject: pkix.Name{
-			CommonName: hex.EncodeToString(l.links.core.public[:]),
-		},
-		NotBefore:             time.Now(),
-		NotAfter:              notAfterNeverExpires,
-		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		BasicConstraintsValid: true,
-	}
-
-	certbytes, err := x509.CreateCertificate(rand.Reader, &cert, &cert, l.links.core.public, l.links.core.secret)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := pem.Encode(certBuf, &pem.Block{
-		Type:  "CERTIFICATE",
-		Bytes: certbytes,
-	}); err != nil {
-		return nil, err
-	}
-
-	rootCAs := x509.NewCertPool()
-	rootCAs.AppendCertsFromPEM(certbytes)
-
-	return &tls.Config{
-		RootCAs: rootCAs,
-		Certificates: []tls.Certificate{
-			{
-				Certificate: [][]byte{certbytes},
-				PrivateKey:  l.links.core.secret,
-			},
-		},
-		InsecureSkipVerify: true,
-		MinVersion:         tls.VersionTLS13,
-	}, nil
-}
-
-func (l *linkTLS) handler(dial *linkDial, name string, info linkInfo, conn net.Conn, options linkOptions, incoming, force bool) error {
-	return l.tcp.handler(dial, name, info, conn, options, incoming, force)
+	return tlslistener, nil
 }