github-mirror/caddy
2
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2025-05-31 00:06:04 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Initial implementation of TLS client authentication (#2731)

Browse Source 
* Add support for client TLS authentication

Signed-off-by: Alexandre Stein <alexandre_stein@interlab-net.com>

* make and use client authentication struct

* force StrictSNIHost if TLSConnPolicies is not empty

* Implement leafs verification

* Fixes issue when using multiple verification

* applies the comments from maintainers

* Apply comment

* Refactor/cleanup initial TLS client auth implementation
This commit is contained in:
Alexandre Stein
2019-09-03 17:35:36 +02:00
committed by Matt Holt
parent 8e821b5039
commit 50961ecc77
3 changed files with 155 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
modules/caddyhttp/caddyhttp.go
View File

@ -75,6 +75,15 @@ func (app *App) Provision(ctx caddy.Context) error {
srv.AutoHTTPS = new(AutoHTTPSConfig)
}
// disallow TLS client auth bypass which could
// otherwise be exploited by sending an unprotected
// SNI value during TLS handshake, then a protected
// Host header during HTTP request later on that
// connection
if srv.hasTLSClientAuth() {
srv.StrictSNIHost = true
}
// TODO: Test this function to ensure these replacements are performed
for i := range srv.Listen {
srv.Listen[i] = repl.ReplaceAll(srv.Listen[i], "")
@ -159,8 +168,7 @@ func (app *App) Start() error {
return fmt.Errorf("%s: listening on %s: %v", network, addr, err)
}
// enable HTTP/2 (and support for solving the
// TLS-ALPN ACME challenge) by default
// enable HTTP/2 by default
for _, pol := range srv.TLSConnPolicies {
if len(pol.ALPN) == 0 {
pol.ALPN = append(pol.ALPN, defaultALPN...)
@ -294,11 +302,11 @@ func (app *App) automaticHTTPS() error {
return fmt.Errorf("%s: managing certificate for %s: %s", srvName, domains, err)
}
// tell the server to use TLS by specifying a TLS
// connection policy (which supports HTTP/2 and the
// TLS-ALPN ACME challenge as well)
srv.TLSConnPolicies = caddytls.ConnectionPolicies{
{ALPN: defaultALPN},
// tell the server to use TLS if it is not already doing so
if srv.TLSConnPolicies == nil {
srv.TLSConnPolicies = caddytls.ConnectionPolicies{
&caddytls.ConnectionPolicy{ALPN: defaultALPN},
}
}
if srv.AutoHTTPS.DisableRedir {