Verify SPKI hash

[mmc.git] / cmd / mmc / main.go

diff --git a/cmd/mmc/main.go b/cmd/mmc/main.go
index 79a850ab48a4992096c347bbd54ab4903a0c5d69..069f0e41ef7b2b6ff5c65d47d4482e4c49b12a03 100644 (file)
--- a/cmd/mmc/main.go
+++ b/cmd/mmc/main.go
@@ -19,6 +19,7 @@ package main
 import (
        "archive/tar"
        "bytes"
+       "crypto/tls"
        "encoding/json"
        "errors"
        "flag"
@@ -26,6 +27,7 @@ import (
        "io"
        "io/fs"
        "log"
+       "net/http"
        "net/url"
        "os"
        "os/exec"
@@ -38,6 +40,7 @@ import (
        "time"
 
        "github.com/davecgh/go-spew/spew"
+       "github.com/gorilla/websocket"
        "github.com/mattermost/mattermost-server/v6/model"
        "go.cypherpunks.ru/netrc"
        "go.stargrave.org/mmc"
@@ -69,6 +72,7 @@ func mkFifo(pth string) {
 
 func main() {
        entrypoint := flag.String("entrypoint", mmc.GetEntrypoint(), "Entrypoint")
+       spkiHash := flag.String("spki", mmc.GetSPKIHash(), "Entrypoint's SPKI hash")
        notifyCmd := flag.String("notify", "cmd/notify", "Path to notification handler")
        heartbeatCh := flag.String("heartbeat-ch", "town-square", "Channel for heartbeating")
        flag.Parse()
@@ -96,6 +100,20 @@ func main() {
                log.Fatalln("no credentials found for:", entrypointURL.Hostname())
        }
        c := model.NewAPIv4Client(*entrypoint)
+       c.HTTPClient.Transport = &http.Transport{
+               Proxy:                 http.ProxyFromEnvironment,
+               ForceAttemptHTTP2:     true,
+               MaxIdleConns:          100,
+               IdleConnTimeout:       90 * time.Second,
+               TLSHandshakeTimeout:   10 * time.Second,
+               ExpectContinueTimeout: 1 * time.Second,
+               TLSClientConfig: &tls.Config{
+                       ServerName:            entrypointURL.Hostname(),
+                       InsecureSkipVerify:    true,
+                       VerifyPeerCertificate: mmc.NewVerifyPeerCertificate(*spkiHash),
+               },
+       }
+
        c.Login(login, password)
        me, resp, err := c.GetMe("")
        if err != nil {
@@ -452,7 +470,15 @@ func main() {
        default:
                log.Println("unhandled scheme:", entrypointURL.Scheme)
        }
-       wc, err := model.NewWebSocketClient4(entrypointURL.String(), c.AuthToken)
+       wc, err := model.NewWebSocketClient4WithDialer(
+               &websocket.Dialer{
+                       TLSClientConfig: &tls.Config{
+                               ServerName:            entrypointURL.Hostname(),
+                               InsecureSkipVerify:    true,
+                               VerifyPeerCertificate: mmc.NewVerifyPeerCertificate(*spkiHash),
+                       },
+               }, entrypointURL.String(), c.AuthToken,
+       )
        if err != nil {
                log.Fatalln(err)
        }