40 lines
1.2 KiB
Go
40 lines
1.2 KiB
Go
package machine_identity
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"errors"
|
|
"net/http"
|
|
"time"
|
|
)
|
|
|
|
type TransportPolicy struct {
|
|
TLSMinVersion uint16
|
|
VerifyCertificate bool
|
|
VerifyHostname bool
|
|
ConnectTimeout time.Duration
|
|
ResponseHeaderTimeout time.Duration
|
|
RequestTimeout time.Duration
|
|
MaxRequestBytes int64
|
|
}
|
|
|
|
func (p TransportPolicy) Validate() error {
|
|
if p.TLSMinVersion < tls.VersionTLS12 || !p.VerifyCertificate || !p.VerifyHostname || p.ConnectTimeout < 100*time.Millisecond || p.ConnectTimeout > 30*time.Second ||
|
|
p.ResponseHeaderTimeout < 100*time.Millisecond || p.ResponseHeaderTimeout > 30*time.Second || p.RequestTimeout < 100*time.Millisecond || p.RequestTimeout > 60*time.Second ||
|
|
p.MaxRequestBytes < 1 || p.MaxRequestBytes > 10*1024*1024 {
|
|
return errors.New("machine transport policy is unsafe")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (p TransportPolicy) HTTPClient() (*http.Client, error) {
|
|
if err := p.Validate(); err != nil {
|
|
return nil, err
|
|
}
|
|
transport := &http.Transport{
|
|
TLSClientConfig: &tls.Config{MinVersion: p.TLSMinVersion},
|
|
TLSHandshakeTimeout: p.ConnectTimeout,
|
|
ResponseHeaderTimeout: p.ResponseHeaderTimeout,
|
|
}
|
|
return &http.Client{Transport: transport, Timeout: p.RequestTimeout}, nil
|
|
}
|