github-mirror/caddy
2
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2025-06-04 19:24:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

reverseproxy: Skip TLS for certain configured ports (#4843)

Browse Source 
* Make reverse proxy TLS server name replaceable for SNI upstreams.

* Reverted previous TLS server name replacement, and implemented thread safe version.

* Move TLS servername replacement into it's own function

* Moved SNI servername replacement into httptransport.

* Solve issue when dynamic upstreams use wrong protocol upstream.

* Revert previous commit.

Old commit was: Solve issue when dynamic upstreams use wrong protocol upstream.
Id: 3c9806ccb63e66bdcac8e1ed4520c9d135cb011d

* Added SkipTLSPorts option to http transport.

* Fix typo in test config file.

* Rename config option as suggested by Matt

Co-authored-by: Matt Holt <mholt@users.noreply.github.com>

* Update code to match renamed config option.

* Fix typo in config option name.

* Fix another typo that I missed.

* Tests not completing because of apparent wrong ordering of options.

Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
This commit is contained in:
Kiss Károly Pál
2022-06-20 19:51:42 +02:00
committed by GitHub
parent 56013934a4
commit b6e96fa3c5
3 changed files with 33 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
modules/caddyhttp/reverseproxy/httptransport.go
View File

@ -296,9 +296,20 @@ func (h *HTTPTransport) RoundTrip(req *http.Request) (*http.Response, error) {
// has the scheme set in its URL; the underlying
// http.Transport requires a scheme to be set.
func (h *HTTPTransport) SetScheme(req *http.Request) {
skipTLSport := false
if h.TLS.ExceptPorts != nil {
port := req.URL.Port()
for i := range h.TLS.ExceptPorts {
if h.TLS.ExceptPorts[i] == port {
skipTLSport = true
break
}
}
}
if req.URL.Scheme == "" {
req.URL.Scheme = "http"
if h.TLS != nil {
if h.TLS != nil && !skipTLSport {
req.URL.Scheme = "https"
}
}
@ -369,6 +380,13 @@ type TLSConfig struct {
// - "once": allows a remote server to request renegotiation once per connection.
// - "freely": allows a remote server to repeatedly request renegotiation.
Renegotiation string `json:"renegotiation,omitempty"`
// Skip TLS ports specifies a list of upstream ports on which TLS should not be
// attempted even if it is configured. Handy when using dynamic upstreams that
// return HTTP and HTTPS endpoints too.
// When specified, TLS will automatically be configured on the transport.
// The value can be a list of any valid tcp port numbers, default empty.
ExceptPorts []string `json:"except_ports,omitempty"`
}
// MakeTLSClientConfig returns a tls.Config usable by a client to a backend.