Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 01:00 UTC
| 1 | package acmeserver |
| 2 | |
| 3 | import ( |
| 4 | "github.com/smallstep/certificates/authority/policy" |
| 5 | "github.com/smallstep/certificates/authority/provisioner" |
| 6 | ) |
| 7 | |
| 8 | // Policy defines the criteria for the ACME server |
| 9 | // of when to issue a certificate. Refer to the |
| 10 | // [Certificate Issuance Policy](https://smallstep.com/docs/step-ca/policies/) |
| 11 | // on Smallstep website for the evaluation criteria. |
| 12 | type Policy struct { |
| 13 | // If a rule set is configured to allow a certain type of name, |
| 14 | // all other types of names are automatically denied. |
| 15 | Allow *RuleSet `json:"allow,omitempty"` |
| 16 | |
| 17 | // If a rule set is configured to deny a certain type of name, |
| 18 | // all other types of names are still allowed. |
| 19 | Deny *RuleSet `json:"deny,omitempty"` |
| 20 | |
| 21 | // If set to true, the ACME server will allow issuing wildcard certificates. |
| 22 | AllowWildcardNames bool `json:"allow_wildcard_names,omitempty"` |
| 23 | } |
| 24 | |
| 25 | // RuleSet is the specific set of SAN criteria for a certificate |
| 26 | // to be issued or denied. |
| 27 | type RuleSet struct { |
| 28 | // Domains is a list of DNS domains that are allowed to be issued. |
| 29 | // It can be in the form of FQDN for specific domain name, or |
| 30 | // a wildcard domain name format, e.g. *.example.com, to allow |
| 31 | // sub-domains of a domain. |
| 32 | Domains []string `json:"domains,omitempty"` |
| 33 | |
| 34 | // IP ranges in the form of CIDR notation or specific IP addresses |
| 35 | // to be approved or denied for certificates. Non-CIDR IP addresses |
| 36 | // are matched exactly. |
| 37 | IPRanges []string `json:"ip_ranges,omitempty"` |
| 38 | } |
| 39 | |
| 40 | // normalizeAllowRules returns `nil` if policy is nil, the `Allow` rule is `nil`, |
| 41 | // or all rules within the `Allow` rule are empty. Otherwise, it returns the X509NameOptions |
| 42 | // with the content of the `Allow` rule. |
| 43 | func (p *Policy) normalizeAllowRules() *policy.X509NameOptions { |
| 44 | if (p == nil) || (p.Allow == nil) || (len(p.Allow.Domains) == 0 && len(p.Allow.IPRanges) == 0) { |
| 45 | return nil |
| 46 | } |
| 47 | return &policy.X509NameOptions{ |
| 48 | DNSDomains: p.Allow.Domains, |
| 49 | IPRanges: p.Allow.IPRanges, |
| 50 | } |
| 51 | } |
| 52 | |
| 53 | // normalizeDenyRules returns `nil` if policy is nil, the `Deny` rule is `nil`, |
| 54 | // or all rules within the `Deny` rule are empty. Otherwise, it returns the X509NameOptions |
| 55 | // with the content of the `Deny` rule. |
| 56 | func (p *Policy) normalizeDenyRules() *policy.X509NameOptions { |
| 57 | if (p == nil) || (p.Deny == nil) || (len(p.Deny.Domains) == 0 && len(p.Deny.IPRanges) == 0) { |
| 58 | return nil |
| 59 | } |
| 60 | return &policy.X509NameOptions{ |
| 61 | DNSDomains: p.Deny.Domains, |
| 62 | IPRanges: p.Deny.IPRanges, |
| 63 | } |
| 64 | } |
| 65 | |
| 66 | // normalizeRules returns `nil` if policy is nil, the `Allow` and `Deny` rules are `nil`, |
| 67 | func (p *Policy) normalizeRules() *provisioner.X509Options { |
| 68 | if p == nil { |
| 69 | return nil |
| 70 | } |
| 71 | |
| 72 | allow := p.normalizeAllowRules() |
| 73 | deny := p.normalizeDenyRules() |
| 74 | if allow == nil && deny == nil && !p.AllowWildcardNames { |
| 75 | return nil |
| 76 | } |
| 77 | |
| 78 | return &provisioner.X509Options{ |
| 79 | AllowedNames: allow, |
| 80 | DeniedNames: deny, |
| 81 | AllowWildcardNames: p.AllowWildcardNames, |
| 82 | } |
| 83 | } |