func createTLSConfig(certFile, keyFile, caCertFile string) (*tls.Config, error) {
	var err error
	config := &tls.Config{}
	config.Certificates = make([]tls.Certificate, 1)
	config.Certificates[0], err = tls.LoadX509KeyPair(certFile, keyFile)
	if err != nil {
		return nil, err
	}
	if caCertFile != "" {
		asn1Data, err := ioutil.ReadFile(caCertFile)
		if err != nil {
			return nil, err
		}
		config.RootCAs = x509.NewCertPool()
		ok := config.RootCAs.AppendCertsFromPEM([]byte(asn1Data))
		if !ok {
			return nil, fmt.Errorf("failed to parse root certificate(s) in %q", caCertFile)
		}
	}
	return config, nil
}
createTLSConfig returns a TLS config from the given cert, key and optionally
Certificate Authority cert.
package tcp
import (
	"crypto/tls"
	"crypto/x509"
	"errors"
	"expvar"
	"fmt"
	"io"
	"io/ioutil"
	"log"
	"net"
	"os"
	"strconv"
	"sync"
	"time"
)
const (
	DefaultTimeout = 30 * time.Second
)
var stats *expvar.Map
const (
	numConnectionsHandled   = "num_connections_handled"
	numUnregisteredHandlers = "num_unregistered_handlers"
)
func init() {
	stats = expvar.NewMap("mux")
	stats.Add(numConnectionsHandled, 0)
	stats.Add(numUnregisteredHandlers, 0)
}
type Layer struct {
	ln   net.Listener
	addr net.Addr
	dialer *Dialer
	nodeX509CACert string
	tlsConfig      *tls.Config
}
func (l *Layer) Dial(addr string, timeout time.Duration) (net.Conn, error) {
	return l.dialer.Dial(addr, timeout)
}
func (l *Layer) Accept() (net.Conn, error) { return l.ln.Accept() }
func (l *Layer) Close() error { return l.ln.Close() }
func (l *Layer) Addr() net.Addr {
	return l.addr
}
type Mux struct {
	ln   net.Listener
	addr net.Addr
	m    map[byte]*listener
	wg sync.WaitGroup
	remoteEncrypted bool
	Timeout time.Duration
	Logger *log.Logger
	x509CACert string
	x509Cert string
	x509Key string
	InsecureSkipVerify bool
	tlsConfig *tls.Config
}
func NewMux(ln net.Listener, adv net.Addr) (*Mux, error) {
	addr := adv
	if addr == nil {
		addr = ln.Addr()
	}
	return &Mux{
		ln:      ln,
		addr:    addr,
		m:       make(map[byte]*listener),
		Timeout: DefaultTimeout,
		Logger:  log.New(os.Stderr, "[mux] ", log.LstdFlags),
	}, nil
}
func NewTLSMux(ln net.Listener, adv net.Addr, cert, key, caCert string) (*Mux, error) {
	mux, err := NewMux(ln, adv)
	if err != nil {
		return nil, err
	}
	mux.tlsConfig, err = createTLSConfig(cert, key, caCert)
	if err != nil {
		return nil, err
	}
	mux.ln = tls.NewListener(ln, mux.tlsConfig)
	mux.remoteEncrypted = true
	mux.x509CACert = caCert
	mux.x509Cert = cert
	mux.x509Key = key
	return mux, nil
}
func (mux *Mux) Serve() error {
	tlsStr := ""
	if mux.tlsConfig != nil {
		tlsStr = "TLS "
	}
	mux.Logger.Printf("%smux serving on %s, advertising %s", tlsStr, mux.ln.Addr().String(), mux.addr)
	for {
		conn, err := mux.ln.Accept()
		if err, ok := err.(interface {
			Temporary() bool
		}); ok && err.Temporary() {
			continue
		}
		if err != nil {
			mux.wg.Wait()
			for _, ln := range mux.m {
				close(ln.c)
			}
			return err
		}
		mux.wg.Add(1)
		go mux.handleConn(conn)
	}
}
func (mux *Mux) Stats() (interface{}, error) {
	s := map[string]string{
		"addr":      mux.addr.String(),
		"timeout":   mux.Timeout.String(),
		"encrypted": strconv.FormatBool(mux.remoteEncrypted),
	}
	if mux.remoteEncrypted {
		s["certificate"] = mux.x509Cert
		s["key"] = mux.x509Key
		s["ca_certificate"] = mux.x509CACert
		s["skip_verify"] = strconv.FormatBool(mux.InsecureSkipVerify)
	}
	return s, nil
}
func (mux *Mux) handleConn(conn net.Conn) {
	stats.Add(numConnectionsHandled, 1)
	defer mux.wg.Done()
	if err := conn.SetReadDeadline(time.Now().Add(mux.Timeout)); err != nil {
		conn.Close()
		mux.Logger.Printf("tcp.Mux: cannot set read deadline: %s", err)
		return
	}
	var typ [1]byte
	if _, err := io.ReadFull(conn, typ[:]); err != nil {
		conn.Close()
		mux.Logger.Printf("tcp.Mux: cannot read header byte: %s", err)
		return
	}
	if err := conn.SetReadDeadline(time.Time{}); err != nil {
		conn.Close()
		mux.Logger.Printf("tcp.Mux: cannot reset set read deadline: %s", err)
		return
	}
	handler := mux.m[typ[0]]
	if handler == nil {
		conn.Close()
		stats.Add(numUnregisteredHandlers, 1)
		mux.Logger.Printf("tcp.Mux: handler not registered for request from %s: %d (unsupported protocol?)",
			conn.RemoteAddr().String(), typ[0])
		return
	}
	handler.c <- conn
}
func (mux *Mux) Listen(header byte) *Layer {
	if _, ok := mux.m[header]; ok {
		panic(fmt.Sprintf("listener already registered under header byte: %d", header))
	}
	ln := &listener{
		c: make(chan net.Conn),
	}
	mux.m[header] = ln
	layer := &Layer{
		ln:             ln,
		addr:           mux.addr,
		nodeX509CACert: mux.x509CACert,
		tlsConfig:      mux.tlsConfig,
	}
	layer.dialer = NewDialer(header, mux.remoteEncrypted, mux.InsecureSkipVerify)
	return layer
}
type listener struct {
	c chan net.Conn
}
func (ln *listener) Accept() (c net.Conn, err error) {
	conn, ok := <-ln.c
	if !ok {
		return nil, errors.New("network connection closed")
	}
	return conn, nil
}
func (ln *listener) Close() error { return nil }
func (ln *listener) Addr() net.Addr { return nil }
func newTLSListener(ln net.Listener, certFile, keyFile, caCertFile string) (net.Listener, error) {
	config, err := createTLSConfig(certFile, keyFile, caCertFile)
	if err != nil {
		return nil, err
	}
	return tls.NewListener(ln, config), nil
}