Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 14:30 UTC
reverseproxy: Implement modular CA provider for TLS transport (#6065)
* added new modular ca providers to caddy tls HttpTransport * reverse-proxy, httptransport: added tests and caddyfile support for ca module --------- Co-authored-by: Mohammed Al Sahaf <msaa1990@gmail.com>
Aziz Rmadi committed
Apr 12, 2024 at 08:19 UTC
0b381eb766dfad11f374342c34fe3606b9005562
5 files changed
+241
caddytest/integration/caddyfile_adapt/reverse_proxy_http_transport_tls_file_cert.txt
new
+47
@@ -0,0 +1,47 @@
1
+:8884
2
+reverse_proxy 127.0.0.1:65535 {
3
+ transport http {
4
+ tls_trust_pool file {
5
+ pem_file ../caddy.ca.cer
6
+ }
7
+ }
8
+}
9
+----------
10
+{
11
+ "apps": {
12
+ "http": {
13
+ "servers": {
14
+ "srv0": {
15
+ "listen": [
16
+ ":8884"
17
+ ],
18
+ "routes": [
19
+ {
20
+ "handle": [
21
+ {
22
+ "handler": "reverse_proxy",
23
+ "transport": {
24
+ "protocol": "http",
25
+ "tls": {
26
+ "ca": {
27
+ "pem_files": [
28
+ "../caddy.ca.cer"
29
+ ],
30
+ "provider": "file"
31
+ }
32
+ }
33
+ },
34
+ "upstreams": [
35
+ {
36
+ "dial": "127.0.0.1:65535"
37
+ }
38
+ ]
39
+ }
40
+ ]
41
+ }
42
+ ]
43
+ }
44
+ }
45
+ }
46
+ }
47
+}
caddytest/integration/caddyfile_adapt/reverse_proxy_http_transport_tls_inline_cert.txt
new
+47
@@ -0,0 +1,47 @@
1
+:8884
2
+reverse_proxy 127.0.0.1:65535 {
3
+ transport http {
4
+ tls_trust_pool inline {
5
+ trust_der MIIDSzCCAjOgAwIBAgIUfIRObjWNUA4jxQ/0x8BOCvE2Vw4wDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMTkwODI4MTYyNTU5WhcNMjkwODI1MTYyNTU5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5m5elxhQfMp/3aVJ4JnpN9PUSz6LlP6LePAPFU7gqohVVFVtDkChJAG3FNkNQNlieVTja/bgH9IcC6oKbROwdY1h0MvNV8AHHigvl03WuJD8g2ReVFXXwsnrPmKXCFzQyMI6TYk3m2gYrXsZOU1GLnfMRC3KAMRgE2F45twOs9hqG169YJ6mM2eQjzjCHWI6S2/iUYvYxRkCOlYUbLsMD/AhgAf1plzg6LPqNxtdlwxZnA0ytgkmhK67HtzJu0+ovUCsMv0RwcMhsEo9T8nyFAGt9XLZ63X5WpBCTUApaAUhnG0XnerjmUWb6eUWw4zev54sEfY5F3x002iQaW6cECAwEAAaOBkDCBjTAdBgNVHQ4EFgQU4CBUbZsS2GaNIkGRz/cBsD5ivjswUQYDVR0jBEowSIAU4CBUbZsS2GaNIkGRz/cBsD5ivjuhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8hE5uNY1QDiPFD/THwE4K8TZXDjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAKB3V4HIzoiO/Ch6WMj9bLJ2FGbpkMrcb/Eq01hT5zcfKD66lVS1MlK+cRL446Z2b2KDP1oFyVs+qmrmtdwrWgD+nfe2sBmmIHo9m9KygMkEOfG3MghGTEcS+0cTKEcoHYWYyOqQh6jnedXY8Cdm4GM1hAc9MiL3/sqV8YCVSLNnkoNysmr06/rZ0MCUZPGUtRmfd0heWhrfzAKw2HLgX+RAmpOE2MZqWcjvqKGyaRiaZks4nJkP6521aC2Lgp0HhCz1j8/uQ5ldoDszCnu/iro0NAsNtudTMD+YoLQxLqdleIh6CW+illc2VdXwj7mn6J04yns9jfE2jRjW/yTLFuQ==
6
+ }
7
+ }
8
+}
9
+----------
10
+{
11
+ "apps": {
12
+ "http": {
13
+ "servers": {
14
+ "srv0": {
15
+ "listen": [
16
+ ":8884"
17
+ ],
18
+ "routes": [
19
+ {
20
+ "handle": [
21
+ {
22
+ "handler": "reverse_proxy",
23
+ "transport": {
24
+ "protocol": "http",
25
+ "tls": {
26
+ "ca": {
27
+ "provider": "inline",
28
+ "trusted_ca_certs": [
29
+ "MIIDSzCCAjOgAwIBAgIUfIRObjWNUA4jxQ/0x8BOCvE2Vw4wDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMTkwODI4MTYyNTU5WhcNMjkwODI1MTYyNTU5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5m5elxhQfMp/3aVJ4JnpN9PUSz6LlP6LePAPFU7gqohVVFVtDkChJAG3FNkNQNlieVTja/bgH9IcC6oKbROwdY1h0MvNV8AHHigvl03WuJD8g2ReVFXXwsnrPmKXCFzQyMI6TYk3m2gYrXsZOU1GLnfMRC3KAMRgE2F45twOs9hqG169YJ6mM2eQjzjCHWI6S2/iUYvYxRkCOlYUbLsMD/AhgAf1plzg6LPqNxtdlwxZnA0ytgkmhK67HtzJu0+ovUCsMv0RwcMhsEo9T8nyFAGt9XLZ63X5WpBCTUApaAUhnG0XnerjmUWb6eUWw4zev54sEfY5F3x002iQaW6cECAwEAAaOBkDCBjTAdBgNVHQ4EFgQU4CBUbZsS2GaNIkGRz/cBsD5ivjswUQYDVR0jBEowSIAU4CBUbZsS2GaNIkGRz/cBsD5ivjuhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8hE5uNY1QDiPFD/THwE4K8TZXDjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAKB3V4HIzoiO/Ch6WMj9bLJ2FGbpkMrcb/Eq01hT5zcfKD66lVS1MlK+cRL446Z2b2KDP1oFyVs+qmrmtdwrWgD+nfe2sBmmIHo9m9KygMkEOfG3MghGTEcS+0cTKEcoHYWYyOqQh6jnedXY8Cdm4GM1hAc9MiL3/sqV8YCVSLNnkoNysmr06/rZ0MCUZPGUtRmfd0heWhrfzAKw2HLgX+RAmpOE2MZqWcjvqKGyaRiaZks4nJkP6521aC2Lgp0HhCz1j8/uQ5ldoDszCnu/iro0NAsNtudTMD+YoLQxLqdleIh6CW+illc2VdXwj7mn6J04yns9jfE2jRjW/yTLFuQ=="
30
+ ]
31
+ }
32
+ }
33
+ },
34
+ "upstreams": [
35
+ {
36
+ "dial": "127.0.0.1:65535"
37
+ }
38
+ ]
39
+ }
40
+ ]
41
+ }
42
+ ]
43
+ }
44
+ }
45
+ }
46
+ }
47
+}
modules/caddyhttp/reverseproxy/caddyfile.go
+29
@@ -30,6 +30,7 @@ import (
30
"github.com/caddyserver/caddy/v2/modules/caddyhttp"
31
"github.com/caddyserver/caddy/v2/modules/caddyhttp/headers"
32
"github.com/caddyserver/caddy/v2/modules/caddyhttp/rewrite"
33
+ "github.com/caddyserver/caddy/v2/modules/caddytls"
34
)
35
36
func init() {
@@ -1145,6 +1146,9 @@ func (h *HTTPTransport) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
1146
if h.TLS == nil {
1147
h.TLS = new(TLSConfig)
1148
}
1149
+ if len(h.TLS.CARaw) != 0 {
1150
+ return d.Err("cannot specify both 'tls_trust_pool' and 'tls_trusted_ca_certs")
1151
+ }
1152
h.TLS.RootCAPEMFiles = args
1153
1154
case "tls_server_name":
@@ -1260,6 +1264,31 @@ func (h *HTTPTransport) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
1264
}
1265
h.MaxConnsPerHost = num
1266
1267
+ case "tls_trust_pool":
1268
+ if !d.NextArg() {
1269
+ return d.ArgErr()
1270
+ }
1271
+ modStem := d.Val()
1272
+ modID := "tls.ca_pool.source." + modStem
1273
+ unm, err := caddyfile.UnmarshalModule(d, modID)
1274
+ if err != nil {
1275
+ return err
1276
+ }
1277
+ ca, ok := unm.(caddytls.CA)
1278
+ if !ok {
1279
+ return d.Errf("module %s is not a caddytls.CA", modID)
1280
+ }
1281
+ if h.TLS == nil {
1282
+ h.TLS = new(TLSConfig)
1283
+ }
1284
+ if len(h.TLS.RootCAPEMFiles) != 0 {
1285
+ return d.Err("cannot specify both 'tls_trust_pool' and 'tls_trusted_ca_certs'")
1286
+ }
1287
+ if h.TLS.CARaw != nil {
1288
+ return d.Err("cannot specify \"tls_trust_pool\" twice in caddyfile")
1289
+ }
1290
+ h.TLS.CARaw = caddyconfig.JSONModuleObject(ca, "provider", modStem, nil)
1291
+
1292
default:
1293
return d.Errf("unrecognized subdirective %s", d.Val())
1294
}
modules/caddyhttp/reverseproxy/httptransport.go
+22
@@ -19,6 +19,7 @@ import (
19
"crypto/tls"
20
"crypto/x509"
21
"encoding/base64"
22
+ "encoding/json"
23
"fmt"
24
weakrand "math/rand"
25
"net"
@@ -472,9 +473,14 @@ func (h HTTPTransport) Cleanup() error {
473
// TLSConfig holds configuration related to the TLS configuration for the
474
// transport/client.
475
type TLSConfig struct {
476
+ // Certificate authority module which provides the certificate pool of trusted certificates
477
+ CARaw json.RawMessage `json:"ca,omitempty" caddy:"namespace=tls.ca_pool.source inline_key=provider"`
478
+
479
+ // DEPRECATED: Use the `ca` field with the `tls.ca_pool.source.inline` module instead.
480
// Optional list of base64-encoded DER-encoded CA certificates to trust.
481
RootCAPool []string `json:"root_ca_pool,omitempty"`
482
483
+ // DEPRECATED: Use the `ca` field with the `tls.ca_pool.source.file` module instead.
484
// List of PEM-encoded CA certificate files to add to the same trust
485
// store as RootCAPool (or root_ca_pool in the JSON).
486
RootCAPEMFiles []string `json:"root_ca_pem_files,omitempty"`
@@ -576,6 +582,7 @@ func (t TLSConfig) MakeTLSClientConfig(ctx caddy.Context) (*tls.Config, error) {
582
583
// trusted root CAs
584
if len(t.RootCAPool) > 0 || len(t.RootCAPEMFiles) > 0 {
585
+ ctx.Logger().Warn("root_ca_pool and root_ca_pem_files are deprecated. Use one of the tls.ca_pool.source modules instead")
586
rootPool := x509.NewCertPool()
587
for _, encodedCACert := range t.RootCAPool {
588
caCert, err := decodeBase64DERCert(encodedCACert)
@@ -594,6 +601,21 @@ func (t TLSConfig) MakeTLSClientConfig(ctx caddy.Context) (*tls.Config, error) {
601
cfg.RootCAs = rootPool
602
}
603
604
+ if t.CARaw != nil {
605
+ if len(t.RootCAPool) > 0 || len(t.RootCAPEMFiles) > 0 {
606
+ return nil, fmt.Errorf("conflicting config for Root CA pool")
607
+ }
608
+ caRaw, err := ctx.LoadModule(t, "CARaw")
609
+ if err != nil {
610
+ return nil, fmt.Errorf("failed to load ca module: %v", err)
611
+ }
612
+ ca, ok := caRaw.(caddytls.CA)
613
+ if !ok {
614
+ return nil, fmt.Errorf("CA module '%s' is not a certificate pool provider", ca)
615
+ }
616
+ cfg.RootCAs = ca.CertPool()
617
+ }
618
+
619
// Renegotiation
620
switch t.Renegotiation {
621
case "never", "":
modules/caddyhttp/reverseproxy/httptransport_test.go
new
+96
@@ -0,0 +1,96 @@
1
+package reverseproxy
2
+
3
+import (
4
+ "encoding/json"
5
+ "fmt"
6
+ "reflect"
7
+ "testing"
8
+
9
+ "github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
10
+)
11
+
12
+func TestHTTPTransportUnmarshalCaddyFileWithCaPools(t *testing.T) {
13
+ const test_der_1 = `MIIDSzCCAjOgAwIBAgIUfIRObjWNUA4jxQ/0x8BOCvE2Vw4wDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMTkwODI4MTYyNTU5WhcNMjkwODI1MTYyNTU5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5m5elxhQfMp/3aVJ4JnpN9PUSz6LlP6LePAPFU7gqohVVFVtDkChJAG3FNkNQNlieVTja/bgH9IcC6oKbROwdY1h0MvNV8AHHigvl03WuJD8g2ReVFXXwsnrPmKXCFzQyMI6TYk3m2gYrXsZOU1GLnfMRC3KAMRgE2F45twOs9hqG169YJ6mM2eQjzjCHWI6S2/iUYvYxRkCOlYUbLsMD/AhgAf1plzg6LPqNxtdlwxZnA0ytgkmhK67HtzJu0+ovUCsMv0RwcMhsEo9T8nyFAGt9XLZ63X5WpBCTUApaAUhnG0XnerjmUWb6eUWw4zev54sEfY5F3x002iQaW6cECAwEAAaOBkDCBjTAdBgNVHQ4EFgQU4CBUbZsS2GaNIkGRz/cBsD5ivjswUQYDVR0jBEowSIAU4CBUbZsS2GaNIkGRz/cBsD5ivjuhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8hE5uNY1QDiPFD/THwE4K8TZXDjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAKB3V4HIzoiO/Ch6WMj9bLJ2FGbpkMrcb/Eq01hT5zcfKD66lVS1MlK+cRL446Z2b2KDP1oFyVs+qmrmtdwrWgD+nfe2sBmmIHo9m9KygMkEOfG3MghGTEcS+0cTKEcoHYWYyOqQh6jnedXY8Cdm4GM1hAc9MiL3/sqV8YCVSLNnkoNysmr06/rZ0MCUZPGUtRmfd0heWhrfzAKw2HLgX+RAmpOE2MZqWcjvqKGyaRiaZks4nJkP6521aC2Lgp0HhCz1j8/uQ5ldoDszCnu/iro0NAsNtudTMD+YoLQxLqdleIh6CW+illc2VdXwj7mn6J04yns9jfE2jRjW/yTLFuQ==`
14
+ type args struct {
15
+ d *caddyfile.Dispenser
16
+ }
17
+ tests := []struct {
18
+ name string
19
+ args args
20
+ expectedTLSConfig TLSConfig
21
+ wantErr bool
22
+ }{
23
+ {
24
+ name: "tls_trust_pool without a module argument returns an error",
25
+ args: args{
26
+ d: caddyfile.NewTestDispenser(
27
+ `http {
28
+ tls_trust_pool
29
+ }`),
30
+ },
31
+ wantErr: true,
32
+ },
33
+ {
34
+ name: "providing both 'tls_trust_pool' and 'tls_trusted_ca_certs' returns an error",
35
+ args: args{
36
+ d: caddyfile.NewTestDispenser(fmt.Sprintf(
37
+ `http {
38
+ tls_trust_pool inline %s
39
+ tls_trusted_ca_certs %s
40
+ }`, test_der_1, test_der_1)),
41
+ },
42
+ wantErr: true,
43
+ },
44
+ {
45
+ name: "setting 'tls_trust_pool' and 'tls_trusted_ca_certs' produces an error",
46
+ args: args{
47
+ d: caddyfile.NewTestDispenser(fmt.Sprintf(
48
+ `http {
49
+ tls_trust_pool inline {
50
+ trust_der %s
51
+ }
52
+ tls_trusted_ca_certs %s
53
+ }`, test_der_1, test_der_1)),
54
+ },
55
+ wantErr: true,
56
+ },
57
+ {
58
+ name: "using 'inline' tls_trust_pool loads the module successfully",
59
+ args: args{
60
+ d: caddyfile.NewTestDispenser(fmt.Sprintf(
61
+ `http {
62
+ tls_trust_pool inline {
63
+ trust_der %s
64
+ }
65
+ }
66
+ `, test_der_1)),
67
+ },
68
+ expectedTLSConfig: TLSConfig{CARaw: json.RawMessage(fmt.Sprintf(`{"provider":"inline","trusted_ca_certs":["%s"]}`, test_der_1))},
69
+ },
70
+ {
71
+ name: "setting 'tls_trusted_ca_certs' and 'tls_trust_pool' produces an error",
72
+ args: args{
73
+ d: caddyfile.NewTestDispenser(fmt.Sprintf(
74
+ `http {
75
+ tls_trusted_ca_certs %s
76
+ tls_trust_pool inline {
77
+ trust_der %s
78
+ }
79
+ }`, test_der_1, test_der_1)),
80
+ },
81
+ wantErr: true,
82
+ },
83
+ }
84
+ for _, tt := range tests {
85
+ t.Run(tt.name, func(t *testing.T) {
86
+ ht := &HTTPTransport{}
87
+ if err := ht.UnmarshalCaddyfile(tt.args.d); (err != nil) != tt.wantErr {
88
+ t.Errorf("HTTPTransport.UnmarshalCaddyfile() error = %v, wantErr %v", err, tt.wantErr)
89
+ return
90
+ }
91
+ if !tt.wantErr && !reflect.DeepEqual(&tt.expectedTLSConfig, ht.TLS) {
92
+ t.Errorf("HTTPTransport.UnmarshalCaddyfile() = %v, want %v", ht, tt.expectedTLSConfig)
93
+ }
94
+ })
95
+ }
96
+}