Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 17:00 UTC
caddytls: verifier: caddyfile: re-add Caddyfile support (#6127)
* caddytls: verifier: caddyfile: re-add Caddyfile support * appease the linter * caddytls: client_auth: verifier: change namespace to `tls.client_auth.verifier`
Mohammed Al Sahaf committed
Feb 26, 2024 at 00:13 UTC
03f703a00e006a1e53a2eaf5f4e33a1b3a5e4237
4 files changed
+139
-4
caddytest/integration/caddyfile_adapt/tls_client_auth_cert_file-legacy-with-verifier.caddyfiletest
new
+75
@@ -0,0 +1,75 @@
1
+localhost
2
+
3
+respond "hello from localhost"
4
+tls {
5
+ client_auth {
6
+ mode request
7
+ trusted_ca_cert_file ../caddy.ca.cer
8
+ verifier dummy
9
+ }
10
+}
11
+----------
12
+{
13
+ "apps": {
14
+ "http": {
15
+ "servers": {
16
+ "srv0": {
17
+ "listen": [
18
+ ":443"
19
+ ],
20
+ "routes": [
21
+ {
22
+ "match": [
23
+ {
24
+ "host": [
25
+ "localhost"
26
+ ]
27
+ }
28
+ ],
29
+ "handle": [
30
+ {
31
+ "handler": "subroute",
32
+ "routes": [
33
+ {
34
+ "handle": [
35
+ {
36
+ "body": "hello from localhost",
37
+ "handler": "static_response"
38
+ }
39
+ ]
40
+ }
41
+ ]
42
+ }
43
+ ],
44
+ "terminal": true
45
+ }
46
+ ],
47
+ "tls_connection_policies": [
48
+ {
49
+ "match": {
50
+ "sni": [
51
+ "localhost"
52
+ ]
53
+ },
54
+ "client_authentication": {
55
+ "ca": {
56
+ "provider": "inline",
57
+ "trusted_ca_certs": [
58
+ "MIIDSzCCAjOgAwIBAgIUfIRObjWNUA4jxQ/0x8BOCvE2Vw4wDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMTkwODI4MTYyNTU5WhcNMjkwODI1MTYyNTU5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5m5elxhQfMp/3aVJ4JnpN9PUSz6LlP6LePAPFU7gqohVVFVtDkChJAG3FNkNQNlieVTja/bgH9IcC6oKbROwdY1h0MvNV8AHHigvl03WuJD8g2ReVFXXwsnrPmKXCFzQyMI6TYk3m2gYrXsZOU1GLnfMRC3KAMRgE2F45twOs9hqG169YJ6mM2eQjzjCHWI6S2/iUYvYxRkCOlYUbLsMD/AhgAf1plzg6LPqNxtdlwxZnA0ytgkmhK67HtzJu0+ovUCsMv0RwcMhsEo9T8nyFAGt9XLZ63X5WpBCTUApaAUhnG0XnerjmUWb6eUWw4zev54sEfY5F3x002iQaW6cECAwEAAaOBkDCBjTAdBgNVHQ4EFgQU4CBUbZsS2GaNIkGRz/cBsD5ivjswUQYDVR0jBEowSIAU4CBUbZsS2GaNIkGRz/cBsD5ivjuhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8hE5uNY1QDiPFD/THwE4K8TZXDjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAKB3V4HIzoiO/Ch6WMj9bLJ2FGbpkMrcb/Eq01hT5zcfKD66lVS1MlK+cRL446Z2b2KDP1oFyVs+qmrmtdwrWgD+nfe2sBmmIHo9m9KygMkEOfG3MghGTEcS+0cTKEcoHYWYyOqQh6jnedXY8Cdm4GM1hAc9MiL3/sqV8YCVSLNnkoNysmr06/rZ0MCUZPGUtRmfd0heWhrfzAKw2HLgX+RAmpOE2MZqWcjvqKGyaRiaZks4nJkP6521aC2Lgp0HhCz1j8/uQ5ldoDszCnu/iro0NAsNtudTMD+YoLQxLqdleIh6CW+illc2VdXwj7mn6J04yns9jfE2jRjW/yTLFuQ=="
59
+ ]
60
+ },
61
+ "verifiers": [
62
+ {
63
+ "verifier": "dummy"
64
+ }
65
+ ],
66
+ "mode": "request"
67
+ }
68
+ },
69
+ {}
70
+ ]
71
+ }
72
+ }
73
+ }
74
+ }
75
+}
\ No newline at end of file
caddytest/integration/caddyfile_adapt_test.go
+2
@@ -10,6 +10,8 @@ import (
10
"testing"
11
12
"github.com/caddyserver/caddy/v2/caddytest"
13
+
14
+ _ "github.com/caddyserver/caddy/v2/internal/testmocks"
15
)
16
17
func TestCaddyfileAdaptToJSON(t *testing.T) {
internal/testmocks/dummyverifier.go
new
+41
@@ -0,0 +1,41 @@
1
+package testmocks
2
+
3
+import (
4
+ "crypto/x509"
5
+
6
+ "github.com/caddyserver/caddy/v2"
7
+ "github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
8
+ "github.com/caddyserver/caddy/v2/modules/caddytls"
9
+)
10
+
11
+func init() {
12
+ caddy.RegisterModule(new(dummyVerifier))
13
+}
14
+
15
+type dummyVerifier struct{}
16
+
17
+// UnmarshalCaddyfile implements caddyfile.Unmarshaler.
18
+func (dummyVerifier) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
19
+ return nil
20
+}
21
+
22
+// CaddyModule implements caddy.Module.
23
+func (dummyVerifier) CaddyModule() caddy.ModuleInfo {
24
+ return caddy.ModuleInfo{
25
+ ID: "tls.client_auth.verifier.dummy",
26
+ New: func() caddy.Module {
27
+ return new(dummyVerifier)
28
+ },
29
+ }
30
+}
31
+
32
+// VerifyClientCertificate implements ClientCertificateVerifier.
33
+func (dummyVerifier) VerifyClientCertificate(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
34
+ return nil
35
+}
36
+
37
+var (
38
+ _ caddy.Module = dummyVerifier{}
39
+ _ caddytls.ClientCertificateVerifier = dummyVerifier{}
40
+ _ caddyfile.Unmarshaler = dummyVerifier{}
41
+)
modules/caddytls/connpolicy.go
+21
-4
@@ -379,7 +379,7 @@ type ClientAuthentication struct {
379
380
// DEPRECATED: This field is deprecated and will be removed in
381
// a future version. Please use the `validators` field instead
382
- // with the tls.client_auth.leaf module instead.
382
+ // with the tls.client_auth.verifier.leaf module instead.
383
//
384
// A list of base64 DER-encoded client leaf certs
385
// to accept. If this list is not empty, client certs
@@ -389,7 +389,7 @@ type ClientAuthentication struct {
389
// Client certificate verification modules. These can perform
390
// custom client authentication checks, such as ensuring the
391
// certificate is not revoked.
392
- VerifiersRaw []json.RawMessage `json:"verifiers,omitempty" caddy:"namespace=tls.client_auth inline_key=verifier"`
392
+ VerifiersRaw []json.RawMessage `json:"verifiers,omitempty" caddy:"namespace=tls.client_auth.verifier inline_key=verifier"`
393
394
verifiers []ClientCertificateVerifier
395
@@ -494,6 +494,23 @@ func (ca *ClientAuthentication) UnmarshalCaddyfile(d *caddyfile.Dispenser) error
494
return fmt.Errorf("trust_pool module '%s' is not a certificate pool provider", caMod)
495
}
496
ca.CARaw = caddyconfig.JSONModuleObject(caMod, "provider", modName, nil)
497
+ case "verifier":
498
+ if !d.NextArg() {
499
+ return d.ArgErr()
500
+ }
501
+
502
+ vType := d.Val()
503
+ modID := "tls.client_auth.verifier." + vType
504
+ unm, err := caddyfile.UnmarshalModule(d, modID)
505
+ if err != nil {
506
+ return err
507
+ }
508
+
509
+ _, ok := unm.(ClientCertificateVerifier)
510
+ if !ok {
511
+ return d.Errf("module '%s' is not a caddytls.ClientCertificatVerifier", modID)
512
+ }
513
+ ca.VerifiersRaw = append(ca.VerifiersRaw, caddyconfig.JSONModuleObject(unm, "verifier", vType, nil))
514
default:
515
return d.Errf("unknown subdirective for client_auth: %s", subdir)
516
}
@@ -566,7 +583,7 @@ func (clientauth *ClientAuthentication) provision(ctx caddy.Context) error {
583
}
584
ca, ok := caRaw.(CA)
585
if !ok {
569
- return fmt.Errorf("CARaw module '%s' is not a certificate pool provider", ca)
586
+ return fmt.Errorf("'ca' module '%s' is not a certificate pool provider", ca)
587
}
588
clientauth.ca = ca
589
@@ -704,7 +721,7 @@ type LeafCertClientAuth struct {
721
// CaddyModule returns the Caddy module information.
722
func (LeafCertClientAuth) CaddyModule() caddy.ModuleInfo {
723
return caddy.ModuleInfo{
707
- ID: "tls.client_auth.leaf",
724
+ ID: "tls.client_auth.verifier.leaf",
725
New: func() caddy.Module { return new(LeafCertClientAuth) },
726
}
727
}