Added Session Ticket Key rotation

Author: renthraysk

README.md

@@ -1,7 +1 @@
 # tlsutil
-
-Example of creating a tls.Config
-
-```
-    cfg, err := NewTLSConfig(WithTLS12(),
-        WithKeyPair("localhost.pem", "localhost.key"))

keyrotation.go

@@ -0,0 +1,79 @@
+package tlsutil
+
+import (
+	"crypto/rand"
+	"crypto/tls"
+	"io"
+	"time"
+
+	"github.com/renthraysk/group"
+)
+
+type KeyRotator struct {
+	cfg      *tls.Config
+	duration time.Duration
+	keys     [][32]byte
+	stop     chan chan struct{}
+}
+
+func (r *KeyRotator) read(key []byte) (int, error) {
+	if r.cfg.Rand != nil {
+		return io.ReadFull(r.cfg.Rand, key)
+	}
+	return rand.Read(key)
+}
+
+func (r *KeyRotator) rotate() error {
+	var key [32]byte
+
+	if len(r.keys) < cap(r.keys) {
+		r.keys = r.keys[:len(r.keys)+1]
+	}
+	copy(r.keys[1:], r.keys[:])
+
+	_, err := r.read(key[:])
+	if err == nil {
+		r.keys[0] = key
+	}
+	r.cfg.SetSessionTicketKeys(r.keys)
+	return err
+}
+
+func (r *KeyRotator) Start() error {
+	timer := time.NewTicker(r.duration)
+	defer timer.Stop()
+	for {
+		select {
+		case <-timer.C:
+			r.rotate()
+
+		case q := <-r.stop:
+			close(q)
+			return nil
+		}
+	}
+}
+
+func (r *KeyRotator) Stop(err error) {
+	q := make(chan struct{})
+	r.stop <- q
+	<-q
+}
+
+// WithSessionTicketKeyRotation
+func WithSessionTicketKeyRotation(g *group.Group, n int, d time.Duration) Option {
+	return func(cfg *tls.Config) error {
+		r := &KeyRotator{
+			cfg:      cfg,
+			duration: d,
+			keys:     make([][32]byte, 0, n),
+			stop:     make(chan chan struct{}),
+		}
+		if err := r.rotate(); err != nil {
+			cfg.SessionTicketsDisabled = true
+			return nil
+		}
+		g.Add(r)
+		return nil
+	}
+}

tlsutil.go

@@ -23,6 +23,12 @@ func Wrap(opts ...Option) Option {
 	}
 }
 
+func WithError(err error) Option {
+	return func(cfg *tls.Config) error {
+		return err
+	}
+}
+
 // WithKeyPair load a certificate from a certFile, keyFile pair, and append to tls.Config's Certificates
 func WithKeyPair(certFile, keyFile string) Option {
 	return func(cfg *tls.Config) error {