OrgGo
/
caddy
mirror of https://github.com/caddyserver/caddy.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

caddytls: set server name in context (#6324) 

Set the requested server name in a context value for CertGetter
implementations to use. Pass ctx to tscert.GetCertificateWithContext.

Signed-off-by: Will Norris <will@tailscale.com>
This commit is contained in:
Will Norris 2024-05-18 02:52:19 -07:00 committed by GitHub
parent 44860482d2
commit e66040a6f0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
go.mod
View File

@ -26,7 +26,7 @@ require (
github.com/spf13/cobra v1.8.0 github.com/spf13/cobra v1.8.0
github.com/spf13/pflag v1.0.5 github.com/spf13/pflag v1.0.5
github.com/stretchr/testify v1.9.0 github.com/stretchr/testify v1.9.0
github.com/tailscale/tscert v0.0.0-20230806124524-28a91b69a046 github.com/tailscale/tscert v0.0.0-20240517230440-bbccfbf48933
github.com/yuin/goldmark v1.7.1 github.com/yuin/goldmark v1.7.1
github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1

4
go.sum
View File

@ -410,8 +410,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg= github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
github.com/tailscale/tscert v0.0.0-20230806124524-28a91b69a046 h1:8rUlviSVOEe7TMk7W0gIPrW8MqEzYfZHpsNWSf8s2vg= github.com/tailscale/tscert v0.0.0-20240517230440-bbccfbf48933 h1:pV0H+XIvFoP7pl1MRtyPXh5hqoxB5I7snOtTHgrn6HU=
github.com/tailscale/tscert v0.0.0-20230806124524-28a91b69a046/go.mod h1:kNGUQ3VESx3VZwRwA9MSCUegIl6+saPL8Noq82ozCaU= github.com/tailscale/tscert v0.0.0-20240517230440-bbccfbf48933/go.mod h1:kNGUQ3VESx3VZwRwA9MSCUegIl6+saPL8Noq82ozCaU=
github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0= github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
github.com/urfave/cli v1.22.14 h1:ebbhrRiGK2i4naQJr+1Xj92HXZCrK7MsyTS/ob3HnAk= github.com/urfave/cli v1.22.14 h1:ebbhrRiGK2i4naQJr+1Xj92HXZCrK7MsyTS/ob3HnAk=
github.com/urfave/cli v1.22.14/go.mod h1:X0eDS6pD6Exaclxm99NJ3FiCDRED7vIHpx2mDOHLvkA= github.com/urfave/cli v1.22.14/go.mod h1:X0eDS6pD6Exaclxm99NJ3FiCDRED7vIHpx2mDOHLvkA=

6
modules/caddytls/certmanagers.go
View File

@ -22,6 +22,9 @@ func init() {
caddy.RegisterModule(HTTPCertGetter{}) caddy.RegisterModule(HTTPCertGetter{})
} }
// For referencing the requested SNI server name.
const ClientHelloSNICtxKey caddy.CtxKey = "client_hello_sni"
// Tailscale is a module that can get certificates from the local Tailscale process. // Tailscale is a module that can get certificates from the local Tailscale process.
type Tailscale struct { type Tailscale struct {
logger *zap.Logger logger *zap.Logger
@ -41,6 +44,7 @@ func (ts *Tailscale) Provision(ctx caddy.Context) error {
} }
func (ts Tailscale) GetCertificate(ctx context.Context, hello *tls.ClientHelloInfo) (*tls.Certificate, error) { func (ts Tailscale) GetCertificate(ctx context.Context, hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
ctx = context.WithValue(ctx, ClientHelloSNICtxKey, hello.ServerName)
canGetCert, err := ts.canHazCertificate(ctx, hello) canGetCert, err := ts.canHazCertificate(ctx, hello)
if err == nil && !canGetCert { if err == nil && !canGetCert {
return nil, nil // pass-thru: Tailscale can't offer a cert for this name return nil, nil // pass-thru: Tailscale can't offer a cert for this name
@ -48,7 +52,7 @@ func (ts Tailscale) GetCertificate(ctx context.Context, hello *tls.ClientHelloIn
if err != nil { if err != nil {
ts.logger.Warn("could not get status; will try to get certificate anyway", zap.Error(err)) ts.logger.Warn("could not get status; will try to get certificate anyway", zap.Error(err))
} }
return tscert.GetCertificate(hello) return tscert.GetCertificateWithContext(ctx, hello)
} }
// canHazCertificate returns true if Tailscale reports it can get a certificate for the given ClientHello. // canHazCertificate returns true if Tailscale reports it can get a certificate for the given ClientHello.