49 lines
1.8 KiB
Go
49 lines
1.8 KiB
Go
// Serverul de proba al retetei Go din remediere.mjs (profilul `go`, pentru hndl-exposed + tls12-accepted + hsts-missing):
|
|
// &tls.Config{MinVersion: tls.VersionTLS13, CurvePreferences: []tls.CurveID{tls.X25519MLKEM768, tls.X25519}}
|
|
// w.Header().Set("Strict-Transport-Security", "max-age=31536000")
|
|
// Certificat autosemnat generat la pornire (ECDSA P-256), asculta pe 127.0.0.1:<port>, raspunde "ok" la orice cale.
|
|
package main
|
|
|
|
import (
|
|
"crypto/ecdsa"
|
|
"crypto/elliptic"
|
|
"crypto/rand"
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"crypto/x509/pkix"
|
|
"fmt"
|
|
"log"
|
|
"math/big"
|
|
"net/http"
|
|
"os"
|
|
"runtime"
|
|
"time"
|
|
)
|
|
|
|
func main() {
|
|
port := "8445"
|
|
if len(os.Args) > 1 {
|
|
port = os.Args[1]
|
|
}
|
|
key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
tmpl := &x509.Certificate{SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "proba.local"}, NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(48 * time.Hour), DNSNames: []string{"proba.local", "localhost"}}
|
|
der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
cert := tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}
|
|
// EXACT fragmentul retetei (remediere.mjs, profilul go, setarile groups + tlsMin 1.3 + hsts):
|
|
cfg := &tls.Config{MinVersion: tls.VersionTLS13, CurvePreferences: []tls.CurveID{tls.X25519MLKEM768, tls.X25519}, Certificates: []tls.Certificate{cert}}
|
|
mux := http.NewServeMux()
|
|
mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Strict-Transport-Security", "max-age=31536000")
|
|
fmt.Fprintln(w, "ok")
|
|
})
|
|
srv := &http.Server{Addr: "127.0.0.1:" + port, Handler: mux, TLSConfig: cfg}
|
|
fmt.Printf("listening 127.0.0.1:%s go=%s\n", port, runtime.Version())
|
|
log.Fatal(srv.ListenAndServeTLS("", ""))
|
|
}
|