Infrastructure/caddy
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2025-01-06 22:40:31 -05:00
Code Issues Activity

caddyfile: tls: Tag manual certificates (#2588)

Browse source 
This ensure that if there are multiple certs that match a particular
ServerName or other parameter, then specifically the one the user
provided in the Caddyfile will be used.
This commit is contained in:
Matthew Holt 2020-02-06 12:55:26 -07:00
parent 5c7ca7d96e
commit b81ae38686
No known key found for this signature in database
GPG key ID: 2A349DD577D586A5
2 changed files with 21 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
caddyconfig/httpcaddyfile/builtins.go
View file

@ -127,11 +127,21 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
} }
mgr.Email = firstLine[0] mgr.Email = firstLine[0]
case 2: case 2:
tag := fmt.Sprintf("cert%d", tagCounter)
fileLoader = append(fileLoader, caddytls.CertKeyFilePair{ fileLoader = append(fileLoader, caddytls.CertKeyFilePair{
Certificate: firstLine[0], Certificate: firstLine[0],
Key: firstLine[1], Key: firstLine[1],
// TODO: add tags, to ensure this certificate is always used for this server name Tags: []string{tag},
}) })
// tag this certificate so if multiple certs match, specifically
// this one that the user has provided will be used, see #2588:
// https://github.com/caddyserver/caddy/issues/2588
tagCounter++
certSelector := caddytls.CustomCertSelectionPolicy{Tag: tag}
if cp == nil {
cp = new(caddytls.ConnectionPolicy)
}
cp.CertSelection = caddyconfig.JSONModuleObject(certSelector, "policy", "custom", h.warnings)
default: default:
return nil, h.ArgErr() return nil, h.ArgErr()
} }
@ -382,3 +392,5 @@ func parseHandle(h Helper) (caddyhttp.MiddlewareHandler, error) {
return nil, nil return nil, nil
} }
var tagCounter = 0

16
modules/caddytls/certselection.go
View file

@ -11,14 +11,14 @@ import (
) )
func init() { func init() {
caddy.RegisterModule(Policy{}) caddy.RegisterModule(CustomCertSelectionPolicy{})
} }
// Policy represents a policy for selecting the certificate used to // CertSelectionPolicy represents a policy for selecting the certificate used
// complete a handshake when there may be multiple options. All fields // to complete a handshake when there may be multiple options. All fields
// specified must match the candidate certificate for it to be chosen. // specified must match the candidate certificate for it to be chosen.
// This was needed to solve https://github.com/caddyserver/caddy/issues/2588. // This was needed to solve https://github.com/caddyserver/caddy/issues/2588.
type Policy struct { type CustomCertSelectionPolicy struct {
SerialNumber *big.Int `json:"serial_number,omitempty"` SerialNumber *big.Int `json:"serial_number,omitempty"`
SubjectOrganization string `json:"subject_organization,omitempty"` SubjectOrganization string `json:"subject_organization,omitempty"`
PublicKeyAlgorithm PublicKeyAlgorithm `json:"public_key_algorithm,omitempty"` PublicKeyAlgorithm PublicKeyAlgorithm `json:"public_key_algorithm,omitempty"`
@ -26,15 +26,15 @@ type Policy struct {
} }
// CaddyModule returns the Caddy module information. // CaddyModule returns the Caddy module information.
func (Policy) CaddyModule() caddy.ModuleInfo { func (CustomCertSelectionPolicy) CaddyModule() caddy.ModuleInfo {
return caddy.ModuleInfo{ return caddy.ModuleInfo{
ID: "tls.certificate_selection.custom", ID: "tls.certificate_selection.custom",
New: func() caddy.Module { return new(Policy) }, New: func() caddy.Module { return new(CustomCertSelectionPolicy) },
} }
} }
// SelectCertificate implements certmagic.CertificateSelector. // SelectCertificate implements certmagic.CertificateSelector.
func (p Policy) SelectCertificate(_ *tls.ClientHelloInfo, choices []certmagic.Certificate) (certmagic.Certificate, error) { func (p CustomCertSelectionPolicy) SelectCertificate(_ *tls.ClientHelloInfo, choices []certmagic.Certificate) (certmagic.Certificate, error) {
for _, cert := range choices { for _, cert := range choices {
if p.SerialNumber != nil && cert.SerialNumber.Cmp(p.SerialNumber) != 0 { if p.SerialNumber != nil && cert.SerialNumber.Cmp(p.SerialNumber) != 0 {
continue continue
@ -68,4 +68,4 @@ func (p Policy) SelectCertificate(_ *tls.ClientHelloInfo, choices []certmagic.Ce
} }
// Interface guard // Interface guard
var _ certmagic.CertificateSelector = (*Policy)(nil) var _ certmagic.CertificateSelector = (*CustomCertSelectionPolicy)(nil)