Nest tls package in crypto, split ocsp

2 files changed, 134 insertions, 126 deletions

diff --git a/tls/ocsp.go b/crypto/tls/ocsp.go
index b80764f..9ae9828 100644
--- a/tls/ocsp.go
+++ b/crypto/tls/ocsp.go
@@ -2,141 +2,15 @@ package tls
 
 import (
         "bytes"
-        "context"
         "crypto/tls"
         "crypto/x509"
-        "errors"
         "fmt"
         "io"
         "net/http"
-        "sync"
-        "time"
 
         "golang.org/x/crypto/ocsp"
 )
 
-type OcspError struct {
-        Err    error
-        AtBoot bool
-}
-
-func (e OcspError) Error() string {
-        return e.Err.Error()
-}
-
-func (e OcspError) Unwrap() error {
-        return e.Err
-}
-
-type OcspLogger interface {
-        Info(...interface{})
-        Errorf(string, ...interface{})
-}
-
-func OcspErrorLogger(l OcspLogger, c <-chan OcspError) func(context.Context, *sync.WaitGroup) error {
-        return func(ctx context.Context, wg *sync.WaitGroup) error {
-                wg.Add(1)
-                defer wg.Done()
-
-                for {
-                        select {
-                        case err := <-c:
-                                l.Errorf("Error in OCSP stapling: %w", errors.Unwrap(err))
-                        case <-ctx.Done():
-                                l.Info("Shutting down OCSP logger")
-                                return nil
-                        }
-                }
-        }
-}
-
-type OcspManager struct {
-        CertPath, KeyPath string
-        Errors            chan<- OcspError
-        cert              *tls.Certificate
-        ocspRes           *ocsp.Response
-        sync.RWMutex
-}
-
-func (m *OcspManager) loadCert() error {
-        cert, err := tls.LoadX509KeyPair(m.CertPath, m.KeyPath)
-        if err != nil {
-                return err
-        }
-        m.Lock()
-        m.cert = &cert
-        m.Unlock()
-
-        return nil
-}
-
-func (m *OcspManager) stapleCert() error {
-        // This makes a network request to an unknown server so don't hold the full
-        // lock while this is happening
-        m.RLock()
-        raw, ocspRes, err := GetOcspResponse(m.cert)
-        if err != nil {
-                return err
-        }
-        m.RUnlock()
-
-        m.Lock()
-        m.cert.OCSPStaple = raw
-        m.ocspRes = ocspRes
-        m.Unlock()
-
-        return nil
-}
-
-func (m *OcspManager) Init() error {
-        // All functions called here will handle locking themselves
-        if err := m.loadCert(); err != nil {
-                return err
-        }
-
-        if err := m.stapleCert(); err != nil {
-                return err
-        }
-
-        return nil
-}
-
-func (m *OcspManager) Run(ctx context.Context, wg *sync.WaitGroup) error {
-        wg.Add(1)
-        defer wg.Done()
-
-        t := time.NewTimer(m.ocspRes.NextUpdate.Sub(time.Now()) - time.Hour)
-
-        for {
-                select {
-                case <-t.C:
-                        if err := m.stapleCert(); err != nil {
-                                if m.Errors != nil {
-                                        m.Errors <- OcspError{err, false}
-                                }
-                                t.Reset(time.Hour)
-                                continue
-                        }
-                        // We own this object and only we write it, no need to lock
-                        t.Reset(m.ocspRes.NextUpdate.Sub(time.Now()) - time.Hour)
-                case <-ctx.Done():
-                        return nil
-                }
-        }
-}
-
-// TODO: TLS.GetCertificate for dyanmic certs for LE (cache these)
-func (m *OcspManager) GetCertificate(h *tls.ClientHelloInfo) (*tls.Certificate, error) {
-        m.RLock()
-        defer m.RUnlock()
-
-        if m.cert != nil {
-                return m.cert, nil
-        }
-
-        return nil, fmt.Errorf("OCSP manager has no certificate stored")
-}
-
 func GetOcspResponse(chain *tls.Certificate) ([]byte, *ocsp.Response, error) {
         var certs []*x509.Certificate
         for _, c := range chain.Certificate {
diff --git a/crypto/tls/ocsp_manager.go b/crypto/tls/ocsp_manager.go
new file mode 100644
index 0000000..dac4c5e
--- /dev/null
+++ b/crypto/tls/ocsp_manager.go
@@ -0,0 +1,134 @@
+package tls
+
+import (
+        "context"
+        "crypto/tls"
+        "errors"
+        "fmt"
+        "sync"
+        "time"
+
+        "golang.org/x/crypto/ocsp"
+)
+
+type OcspError struct {
+        Err    error
+        AtBoot bool
+}
+
+func (e OcspError) Error() string {
+        return e.Err.Error()
+}
+
+func (e OcspError) Unwrap() error {
+        return e.Err
+}
+
+type OcspLogger interface {
+        Info(...interface{})
+        Errorf(string, ...interface{})
+}
+
+func OcspErrorLogger(l OcspLogger, c <-chan OcspError) func(context.Context, *sync.WaitGroup) error {
+        return func(ctx context.Context, wg *sync.WaitGroup) error {
+                wg.Add(1)
+                defer wg.Done()
+
+                for {
+                        select {
+                        case err := <-c:
+                                l.Errorf("Error in OCSP stapling: %w", errors.Unwrap(err))
+                        case <-ctx.Done():
+                                l.Info("Shutting down OCSP logger")
+                                return nil
+                        }
+                }
+        }
+}
+
+type OcspManager struct {
+        CertPath, KeyPath string
+        Errors            chan<- OcspError
+        cert              *tls.Certificate
+        ocspRes           *ocsp.Response
+        sync.RWMutex
+}
+
+func (m *OcspManager) loadCert() error {
+        cert, err := tls.LoadX509KeyPair(m.CertPath, m.KeyPath)
+        if err != nil {
+                return err
+        }
+        m.Lock()
+        m.cert = &cert
+        m.Unlock()
+
+        return nil
+}
+
+func (m *OcspManager) stapleCert() error {
+        // This makes a network request to an unknown server so don't hold the full
+        // lock while this is happening
+        m.RLock()
+        raw, ocspRes, err := GetOcspResponse(m.cert)
+        if err != nil {
+                return err
+        }
+        m.RUnlock()
+
+        m.Lock()
+        m.cert.OCSPStaple = raw
+        m.ocspRes = ocspRes
+        m.Unlock()
+
+        return nil
+}
+
+func (m *OcspManager) Init() error {
+        // All functions called here will handle locking themselves
+        if err := m.loadCert(); err != nil {
+                return err
+        }
+
+        if err := m.stapleCert(); err != nil {
+                return err
+        }
+
+        return nil
+}
+
+func (m *OcspManager) Run(ctx context.Context, wg *sync.WaitGroup) error {
+        wg.Add(1)
+        defer wg.Done()
+
+        t := time.NewTimer(m.ocspRes.NextUpdate.Sub(time.Now()) - time.Hour)
+
+        for {
+                select {
+                case <-t.C:
+                        if err := m.stapleCert(); err != nil {
+                                if m.Errors != nil {
+                                        m.Errors <- OcspError{err, false}
+                                }
+                                t.Reset(time.Hour)
+                                continue
+                        }
+                        // We own this object and only we write it, no need to lock
+                        t.Reset(m.ocspRes.NextUpdate.Sub(time.Now()) - time.Hour)
+                case <-ctx.Done():
+                        return nil
+                }
+        }
+}
+
+// TODO: TLS.GetCertificate for dyanmic certs for LE (cache these)
+func (m *OcspManager) GetCertificate(h *tls.ClientHelloInfo) (*tls.Certificate, error) {
+        m.RLock()
+        defer m.RUnlock()
+
+        if m.cert != nil {
+                return m.cert, nil
+        }
+
+        return nil, fmt.Errorf("OCSP manager has no certificate stored")
+}