Tiny refactor, no keep-alive restrictions

diff --git a/dane.go b/dane.go
index 2b850d83a4345435061eb2da09399845f4ce71d1..f660f026cc0797b69e4928561179ac1812a69e03 100644 (file)
--- a/dane.go
+++ b/dane.go
@@ -28,6 +28,10 @@ import (
        "github.com/miekg/dns"
 )
 
+var (
+       dnsSrv *string
+)
+
 func dane(addr string, cert *x509.Certificate) (bool, bool) {
        if *dnsSrv == "" {
                return false, false

diff --git a/main.go b/main.go
index 79e355ebdc131ae2bc32f9d89607c1a0865ec9cf..ac80e2a80b92ee73ca76ef779532783bb0c1239a 100644 (file)
--- a/main.go
+++ b/main.go
@@ -19,10 +19,8 @@ package main
 import (
        "context"
        "crypto"
-       "crypto/sha256"
        "crypto/tls"
        "crypto/x509"
-       "encoding/hex"
        "flag"
        "fmt"
        "io"
@@ -33,7 +31,6 @@ import (
        "os"
        "os/exec"
        "strings"
-       "sync"
        "time"
 
        "github.com/dustin/go-humanize"
@@ -42,51 +39,18 @@ import (
 
 var (
        tlsNextProtoS = make(map[string]func(*http.Server, *tls.Conn, http.Handler))
-       tlsNextProtoC = make(map[string]func(string, *tls.Conn) http.RoundTripper)
        caCert        *x509.Certificate
        caPrv         crypto.PrivateKey
-       certs         *string
-       dnsSrv        *string
        transport     = http.Transport{
-               ForceAttemptHTTP2:   false,
-               DisableKeepAlives:   true,
-               MaxIdleConnsPerHost: 2,
-               TLSNextProto:        tlsNextProtoC,
-               DialTLSContext:      dialTLS,
+               ForceAttemptHTTP2: false,
+               TLSNextProto:      make(map[string]func(string, *tls.Conn) http.RoundTripper),
+               DialTLSContext:    dialTLS,
        }
 
-       accepted  = make(map[string]string)
-       acceptedM sync.RWMutex
-       rejected  = make(map[string]string)
-       rejectedM sync.RWMutex
-
        CmdDWebP = "dwebp"
        CmdDJXL  = "djxl"
 )
 
-func spkiHash(cert *x509.Certificate) string {
-       hsh := sha256.Sum256(cert.RawSubjectPublicKeyInfo)
-       return hex.EncodeToString(hsh[:])
-}
-
-func acceptedAdd(addr, h string) {
-       acceptedM.Lock()
-       accepted[addr] = h
-       acceptedM.Unlock()
-}
-
-func rejectedAdd(addr, h string) {
-       rejectedM.Lock()
-       rejected[addr] = h
-       rejectedM.Unlock()
-}
-
-type ErrRejected struct {
-       addr string
-}
-
-func (err ErrRejected) Error() string { return err.addr + " was rejected" }
-
 func dialTLS(ctx context.Context, network, addr string) (net.Conn, error) {
        host := strings.TrimSuffix(addr, ":443")
        cfg := tls.Config{
@@ -411,7 +375,6 @@ func main() {
                Handler:      &Handler{},
                TLSNextProto: tlsNextProtoS,
        }
-       srv.SetKeepAlivesEnabled(false)
        log.Println("listening:", *bind)
        if err := srv.Serve(ln); err != nil {
                log.Fatalln(err)

diff --git a/verify.go b/verify.go
index 6c1ed9e2f1e89118838b991dab597dea6d3ae4c2..f6844cd997f7fd13a3198eb488ca6ff102ba6e01 100644 (file)
--- a/verify.go
+++ b/verify.go
@@ -18,7 +18,9 @@ package main
 
 import (
        "bytes"
+       "crypto/sha256"
        "crypto/x509"
+       "encoding/hex"
        "encoding/pem"
        "fmt"
        "log"
@@ -26,6 +28,7 @@ import (
        "os/exec"
        "path/filepath"
        "strings"
+       "sync"
 
        "go.cypherpunks.ru/ucspi"
 )
@@ -33,8 +36,37 @@ import (
 var (
        CmdCerttool = "certtool"
        CmdWish     = "wish8.7"
+
+       certs     *string
+       accepted  = make(map[string]string)
+       acceptedM sync.RWMutex
+       rejected  = make(map[string]string)
+       rejectedM sync.RWMutex
 )
 
+func spkiHash(cert *x509.Certificate) string {
+       hsh := sha256.Sum256(cert.RawSubjectPublicKeyInfo)
+       return hex.EncodeToString(hsh[:])
+}
+
+func acceptedAdd(addr, h string) {
+       acceptedM.Lock()
+       accepted[addr] = h
+       acceptedM.Unlock()
+}
+
+func rejectedAdd(addr, h string) {
+       rejectedM.Lock()
+       rejected[addr] = h
+       rejectedM.Unlock()
+}
+
+type ErrRejected struct {
+       addr string
+}
+
+func (err ErrRejected) Error() string { return err.addr + " was rejected" }
+
 func certInfo(certRaw []byte) string {
        cmd := exec.Command(CmdCerttool, "--certificate-info", "--inder")
        cmd.Stdin = bytes.NewReader(certRaw)