2019-06-30 17:07:58 -05:00
|
|
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
2019-04-25 14:54:48 -05:00
|
|
|
package caddytls
|
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto/tls"
|
2021-04-30 11:14:52 -05:00
|
|
|
"fmt"
|
|
|
|
"net"
|
2022-08-17 17:10:57 -05:00
|
|
|
"net/netip"
|
2021-04-30 11:14:52 -05:00
|
|
|
"strings"
|
2019-04-25 14:54:48 -05:00
|
|
|
|
2019-07-02 13:37:06 -05:00
|
|
|
"github.com/caddyserver/caddy/v2"
|
2020-03-26 15:01:38 -05:00
|
|
|
"github.com/caddyserver/certmagic"
|
2021-04-30 11:14:52 -05:00
|
|
|
"go.uber.org/zap"
|
2019-04-25 14:54:48 -05:00
|
|
|
)
|
|
|
|
|
2019-08-21 11:46:35 -05:00
|
|
|
func init() {
|
|
|
|
caddy.RegisterModule(MatchServerName{})
|
2021-04-30 11:14:52 -05:00
|
|
|
caddy.RegisterModule(MatchRemoteIP{})
|
2019-08-21 11:46:35 -05:00
|
|
|
}
|
|
|
|
|
2020-03-20 16:51:37 -05:00
|
|
|
// MatchServerName matches based on SNI. Names in
|
|
|
|
// this list may use left-most-label wildcards,
|
|
|
|
// similar to wildcard certificates.
|
2019-05-07 12:58:58 -05:00
|
|
|
type MatchServerName []string
|
2019-04-25 14:54:48 -05:00
|
|
|
|
2019-08-21 11:46:35 -05:00
|
|
|
// CaddyModule returns the Caddy module information.
|
|
|
|
func (MatchServerName) CaddyModule() caddy.ModuleInfo {
|
|
|
|
return caddy.ModuleInfo{
|
2019-12-10 15:36:46 -05:00
|
|
|
ID: "tls.handshake_match.sni",
|
|
|
|
New: func() caddy.Module { return new(MatchServerName) },
|
2019-08-21 11:46:35 -05:00
|
|
|
}
|
2019-04-25 14:54:48 -05:00
|
|
|
}
|
|
|
|
|
2019-04-26 13:35:39 -05:00
|
|
|
// Match matches hello based on SNI.
|
2019-04-25 14:54:48 -05:00
|
|
|
func (m MatchServerName) Match(hello *tls.ClientHelloInfo) bool {
|
|
|
|
for _, name := range m {
|
2020-03-26 15:01:38 -05:00
|
|
|
if certmagic.MatchWildcard(hello.ServerName, name) {
|
2019-04-25 14:54:48 -05:00
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2021-04-30 11:14:52 -05:00
|
|
|
// MatchRemoteIP matches based on the remote IP of the
|
|
|
|
// connection. Specific IPs or CIDR ranges can be specified.
|
|
|
|
//
|
|
|
|
// Note that IPs can sometimes be spoofed, so do not rely
|
|
|
|
// on this as a replacement for actual authentication.
|
|
|
|
type MatchRemoteIP struct {
|
|
|
|
// The IPs or CIDR ranges to match.
|
|
|
|
Ranges []string `json:"ranges,omitempty"`
|
|
|
|
|
|
|
|
// The IPs or CIDR ranges to *NOT* match.
|
|
|
|
NotRanges []string `json:"not_ranges,omitempty"`
|
|
|
|
|
2022-08-17 17:10:57 -05:00
|
|
|
cidrs []netip.Prefix
|
|
|
|
notCidrs []netip.Prefix
|
2021-04-30 11:14:52 -05:00
|
|
|
logger *zap.Logger
|
|
|
|
}
|
|
|
|
|
|
|
|
// CaddyModule returns the Caddy module information.
|
|
|
|
func (MatchRemoteIP) CaddyModule() caddy.ModuleInfo {
|
|
|
|
return caddy.ModuleInfo{
|
|
|
|
ID: "tls.handshake_match.remote_ip",
|
|
|
|
New: func() caddy.Module { return new(MatchRemoteIP) },
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Provision parses m's IP ranges, either from IP or CIDR expressions.
|
|
|
|
func (m *MatchRemoteIP) Provision(ctx caddy.Context) error {
|
|
|
|
m.logger = ctx.Logger(m)
|
|
|
|
for _, str := range m.Ranges {
|
|
|
|
cidrs, err := m.parseIPRange(str)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2022-01-13 11:56:18 -05:00
|
|
|
m.cidrs = append(m.cidrs, cidrs...)
|
2021-04-30 11:14:52 -05:00
|
|
|
}
|
|
|
|
for _, str := range m.NotRanges {
|
|
|
|
cidrs, err := m.parseIPRange(str)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2022-01-13 11:56:18 -05:00
|
|
|
m.notCidrs = append(m.notCidrs, cidrs...)
|
2021-04-30 11:14:52 -05:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Match matches hello based on the connection's remote IP.
|
|
|
|
func (m MatchRemoteIP) Match(hello *tls.ClientHelloInfo) bool {
|
|
|
|
remoteAddr := hello.Conn.RemoteAddr().String()
|
|
|
|
ipStr, _, err := net.SplitHostPort(remoteAddr)
|
|
|
|
if err != nil {
|
|
|
|
ipStr = remoteAddr // weird; maybe no port?
|
|
|
|
}
|
2022-08-17 17:10:57 -05:00
|
|
|
ipAddr, err := netip.ParseAddr(ipStr)
|
|
|
|
if err != nil {
|
2021-04-30 11:14:52 -05:00
|
|
|
m.logger.Error("invalid client IP addresss", zap.String("ip", ipStr))
|
|
|
|
return false
|
|
|
|
}
|
2022-08-17 17:10:57 -05:00
|
|
|
return (len(m.cidrs) == 0 || m.matches(ipAddr, m.cidrs)) &&
|
|
|
|
(len(m.notCidrs) == 0 || !m.matches(ipAddr, m.notCidrs))
|
2021-04-30 11:14:52 -05:00
|
|
|
}
|
|
|
|
|
2022-08-17 17:10:57 -05:00
|
|
|
func (MatchRemoteIP) parseIPRange(str string) ([]netip.Prefix, error) {
|
|
|
|
var cidrs []netip.Prefix
|
2021-04-30 11:14:52 -05:00
|
|
|
if strings.Contains(str, "/") {
|
2022-08-17 17:10:57 -05:00
|
|
|
ipNet, err := netip.ParsePrefix(str)
|
2021-04-30 11:14:52 -05:00
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("parsing CIDR expression: %v", err)
|
|
|
|
}
|
|
|
|
cidrs = append(cidrs, ipNet)
|
|
|
|
} else {
|
2022-08-17 17:10:57 -05:00
|
|
|
ipAddr, err := netip.ParseAddr(str)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("invalid IP address: '%s': %v", str, err)
|
2021-04-30 11:14:52 -05:00
|
|
|
}
|
2022-08-17 17:10:57 -05:00
|
|
|
ip := netip.PrefixFrom(ipAddr, ipAddr.BitLen())
|
|
|
|
cidrs = append(cidrs, ip)
|
2021-04-30 11:14:52 -05:00
|
|
|
}
|
|
|
|
return cidrs, nil
|
|
|
|
}
|
|
|
|
|
2022-08-17 17:10:57 -05:00
|
|
|
func (MatchRemoteIP) matches(ip netip.Addr, ranges []netip.Prefix) bool {
|
2021-04-30 11:14:52 -05:00
|
|
|
for _, ipRange := range ranges {
|
|
|
|
if ipRange.Contains(ip) {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// Interface guards
|
|
|
|
var (
|
|
|
|
_ ConnectionMatcher = (*MatchServerName)(nil)
|
|
|
|
_ ConnectionMatcher = (*MatchRemoteIP)(nil)
|
|
|
|
)
|