add tls

pkg/crypto/tls.go

@@ -7,23 +7,21 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
-	"encoding/pem"
 	"math/big"
 	"net"
-	"os"
 	"time"
 )
 
-// GenerateSelfSignedCert 生成自签名证书
-func GenerateSelfSignedCert(certFile, keyFile string) error {
+// GenerateTLSConfig 生成内存中的自签名证书并返回 TLS 配置
+func GenerateTLSConfig() (*tls.Config, error) {
 	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
-		return err
+		return nil, err
 	}
 
 	serialNumber, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
 	if err != nil {
-		return err
+		return nil, err
 	}
 
 	template := x509.Certificate{
@@ -33,7 +31,7 @@ func GenerateSelfSignedCert(certFile, keyFile string) error {
 			CommonName:   "GoTunnel Server",
 		},
 		NotBefore:             time.Now(),
-		NotAfter:              time.Now().AddDate(10, 0, 0), // 10年有效期
+		NotAfter:              time.Now().AddDate(10, 0, 0),
 		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 		BasicConstraintsValid: true,
@@ -43,29 +41,24 @@ func GenerateSelfSignedCert(certFile, keyFile string) error {
 
 	certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	// 写入证书文件
-	certOut, err := os.Create(certFile)
-	if err != nil {
-		return err
+	cert := tls.Certificate{
+		Certificate: [][]byte{certDER},
+		PrivateKey:  priv,
 	}
-	defer certOut.Close()
-	pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: certDER})
 
-	// 写入私钥文件
-	keyOut, err := os.Create(keyFile)
-	if err != nil {
-		return err
-	}
-	defer keyOut.Close()
-
-	privBytes, err := x509.MarshalECPrivateKey(priv)
-	if err != nil {
-		return err
-	}
-	pem.Encode(keyOut, &pem.Block{Type: "EC PRIVATE KEY", Bytes: privBytes})
-
-	return nil
+	return &tls.Config{
+		Certificates: []tls.Certificate{cert},
+		MinVersion:   tls.VersionTLS12,
+	}, nil
+}
+
+// ClientTLSConfig 创建客户端 TLS 配置
+func ClientTLSConfig() *tls.Config {
+	return &tls.Config{
+		InsecureSkipVerify: true,
+		MinVersion:         tls.VersionTLS12,
+	}
 }