@marcel91200 / caddy Mirror · read-only / commits / 1481c041

Fork 0

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

Mirrored from https://github.com/Slazee/caddy.git

Synced Nov 11, 23:30 UTC

caddytls: wire up client_auth leaf verifier Caddyfile (#6772)

* client_auth: wire up leaf verifier Caddyfile Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * review feedback + tests Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

Mohammed Al Sahaf committed Jun 9, 2025 at 17:18 UTC 1481c0411aa3ce3a53c206e18ee9ce4223cc156d

10 files changed +607 -6

caddytest/integration/caddyfile_adapt/tls_client_auth_leaf_verifier_file_loader_block.caddyfiletest new

+87

@@ -0,0 +1,87 @@

1 +localhost

2 +

3 +respond "hello from localhost"

4 +tls {

5 + client_auth {

6 + mode request

7 + trust_pool inline {

8 + trust_der MIIDSzCCAjOgAwIBAgIUfIRObjWNUA4jxQ/0x8BOCvE2Vw4wDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMTkwODI4MTYyNTU5WhcNMjkwODI1MTYyNTU5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5m5elxhQfMp/3aVJ4JnpN9PUSz6LlP6LePAPFU7gqohVVFVtDkChJAG3FNkNQNlieVTja/bgH9IcC6oKbROwdY1h0MvNV8AHHigvl03WuJD8g2ReVFXXwsnrPmKXCFzQyMI6TYk3m2gYrXsZOU1GLnfMRC3KAMRgE2F45twOs9hqG169YJ6mM2eQjzjCHWI6S2/iUYvYxRkCOlYUbLsMD/AhgAf1plzg6LPqNxtdlwxZnA0ytgkmhK67HtzJu0+ovUCsMv0RwcMhsEo9T8nyFAGt9XLZ63X5WpBCTUApaAUhnG0XnerjmUWb6eUWw4zev54sEfY5F3x002iQaW6cECAwEAAaOBkDCBjTAdBgNVHQ4EFgQU4CBUbZsS2GaNIkGRz/cBsD5ivjswUQYDVR0jBEowSIAU4CBUbZsS2GaNIkGRz/cBsD5ivjuhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8hE5uNY1QDiPFD/THwE4K8TZXDjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAKB3V4HIzoiO/Ch6WMj9bLJ2FGbpkMrcb/Eq01hT5zcfKD66lVS1MlK+cRL446Z2b2KDP1oFyVs+qmrmtdwrWgD+nfe2sBmmIHo9m9KygMkEOfG3MghGTEcS+0cTKEcoHYWYyOqQh6jnedXY8Cdm4GM1hAc9MiL3/sqV8YCVSLNnkoNysmr06/rZ0MCUZPGUtRmfd0heWhrfzAKw2HLgX+RAmpOE2MZqWcjvqKGyaRiaZks4nJkP6521aC2Lgp0HhCz1j8/uQ5ldoDszCnu/iro0NAsNtudTMD+YoLQxLqdleIh6CW+illc2VdXwj7mn6J04yns9jfE2jRjW/yTLFuQ==

9 + }

10 + verifier leaf {

11 + file ../caddy.ca.cer

12 + }

13 + }

14 +}

15 +----------

16 +{

17 + "apps": {

18 + "http": {

19 + "servers": {

20 + "srv0": {

21 + "listen": [

22 + ":443"

23 + ],

24 + "routes": [

25 + {

26 + "match": [

27 + {

28 + "host": [

29 + "localhost"

30 + ]

31 + }

32 + ],

33 + "handle": [

34 + {

35 + "handler": "subroute",

36 + "routes": [

37 + {

38 + "handle": [

39 + {

40 + "body": "hello from localhost",

41 + "handler": "static_response"

42 + }

43 + ]

44 + }

45 + ]

46 + }

47 + ],

48 + "terminal": true

49 + }

50 + ],

51 + "tls_connection_policies": [

52 + {

53 + "match": {

54 + "sni": [

55 + "localhost"

56 + ]

57 + },

58 + "client_authentication": {

59 + "ca": {

60 + "provider": "inline",

61 + "trusted_ca_certs": [

62 + "MIIDSzCCAjOgAwIBAgIUfIRObjWNUA4jxQ/0x8BOCvE2Vw4wDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMTkwODI4MTYyNTU5WhcNMjkwODI1MTYyNTU5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5m5elxhQfMp/3aVJ4JnpN9PUSz6LlP6LePAPFU7gqohVVFVtDkChJAG3FNkNQNlieVTja/bgH9IcC6oKbROwdY1h0MvNV8AHHigvl03WuJD8g2ReVFXXwsnrPmKXCFzQyMI6TYk3m2gYrXsZOU1GLnfMRC3KAMRgE2F45twOs9hqG169YJ6mM2eQjzjCHWI6S2/iUYvYxRkCOlYUbLsMD/AhgAf1plzg6LPqNxtdlwxZnA0ytgkmhK67HtzJu0+ovUCsMv0RwcMhsEo9T8nyFAGt9XLZ63X5WpBCTUApaAUhnG0XnerjmUWb6eUWw4zev54sEfY5F3x002iQaW6cECAwEAAaOBkDCBjTAdBgNVHQ4EFgQU4CBUbZsS2GaNIkGRz/cBsD5ivjswUQYDVR0jBEowSIAU4CBUbZsS2GaNIkGRz/cBsD5ivjuhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8hE5uNY1QDiPFD/THwE4K8TZXDjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAKB3V4HIzoiO/Ch6WMj9bLJ2FGbpkMrcb/Eq01hT5zcfKD66lVS1MlK+cRL446Z2b2KDP1oFyVs+qmrmtdwrWgD+nfe2sBmmIHo9m9KygMkEOfG3MghGTEcS+0cTKEcoHYWYyOqQh6jnedXY8Cdm4GM1hAc9MiL3/sqV8YCVSLNnkoNysmr06/rZ0MCUZPGUtRmfd0heWhrfzAKw2HLgX+RAmpOE2MZqWcjvqKGyaRiaZks4nJkP6521aC2Lgp0HhCz1j8/uQ5ldoDszCnu/iro0NAsNtudTMD+YoLQxLqdleIh6CW+illc2VdXwj7mn6J04yns9jfE2jRjW/yTLFuQ=="

63 + ]

64 + },

65 + "verifiers": [

66 + {

67 + "leaf_certs_loaders": [

68 + {

69 + "files": [

70 + "../caddy.ca.cer"

71 + ],

72 + "loader": "file"

73 + }

74 + ],

75 + "verifier": "leaf"

76 + }

77 + ],

78 + "mode": "request"

79 + }

80 + },

81 + {}

82 + ]

83 + }

84 + }

85 + }

86 + }

87 +}

\ No newline at end of file

caddytest/integration/caddyfile_adapt/tls_client_auth_leaf_verifier_file_loader_inline.caddyfiletest new

+85

@@ -0,0 +1,85 @@

1 +localhost

2 +

3 +respond "hello from localhost"

4 +tls {

5 + client_auth {

6 + mode request

7 + trust_pool inline {

9 + }

10 + verifier leaf file ../caddy.ca.cer

11 + }

12 +}

13 +----------

14 +{

15 + "apps": {

16 + "http": {

17 + "servers": {

18 + "srv0": {

19 + "listen": [

20 + ":443"

21 + ],

22 + "routes": [

23 + {

24 + "match": [

25 + {

26 + "host": [

27 + "localhost"

28 + ]

29 + }

30 + ],

31 + "handle": [

32 + {

33 + "handler": "subroute",

34 + "routes": [

35 + {

36 + "handle": [

37 + {

38 + "body": "hello from localhost",

39 + "handler": "static_response"

40 + }

41 + ]

42 + }

43 + ]

44 + }

45 + ],

46 + "terminal": true

47 + }

48 + ],

49 + "tls_connection_policies": [

50 + {

51 + "match": {

52 + "sni": [

53 + "localhost"

54 + ]

55 + },

56 + "client_authentication": {

57 + "ca": {

58 + "provider": "inline",

59 + "trusted_ca_certs": [

60 + "MIIDSzCCAjOgAwIBAgIUfIRObjWNUA4jxQ/0x8BOCvE2Vw4wDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMTkwODI4MTYyNTU5WhcNMjkwODI1MTYyNTU5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5m5elxhQfMp/3aVJ4JnpN9PUSz6LlP6LePAPFU7gqohVVFVtDkChJAG3FNkNQNlieVTja/bgH9IcC6oKbROwdY1h0MvNV8AHHigvl03WuJD8g2ReVFXXwsnrPmKXCFzQyMI6TYk3m2gYrXsZOU1GLnfMRC3KAMRgE2F45twOs9hqG169YJ6mM2eQjzjCHWI6S2/iUYvYxRkCOlYUbLsMD/AhgAf1plzg6LPqNxtdlwxZnA0ytgkmhK67HtzJu0+ovUCsMv0RwcMhsEo9T8nyFAGt9XLZ63X5WpBCTUApaAUhnG0XnerjmUWb6eUWw4zev54sEfY5F3x002iQaW6cECAwEAAaOBkDCBjTAdBgNVHQ4EFgQU4CBUbZsS2GaNIkGRz/cBsD5ivjswUQYDVR0jBEowSIAU4CBUbZsS2GaNIkGRz/cBsD5ivjuhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8hE5uNY1QDiPFD/THwE4K8TZXDjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAKB3V4HIzoiO/Ch6WMj9bLJ2FGbpkMrcb/Eq01hT5zcfKD66lVS1MlK+cRL446Z2b2KDP1oFyVs+qmrmtdwrWgD+nfe2sBmmIHo9m9KygMkEOfG3MghGTEcS+0cTKEcoHYWYyOqQh6jnedXY8Cdm4GM1hAc9MiL3/sqV8YCVSLNnkoNysmr06/rZ0MCUZPGUtRmfd0heWhrfzAKw2HLgX+RAmpOE2MZqWcjvqKGyaRiaZks4nJkP6521aC2Lgp0HhCz1j8/uQ5ldoDszCnu/iro0NAsNtudTMD+YoLQxLqdleIh6CW+illc2VdXwj7mn6J04yns9jfE2jRjW/yTLFuQ=="

61 + ]

62 + },

63 + "verifiers": [

64 + {

65 + "leaf_certs_loaders": [

66 + {

67 + "files": [

68 + "../caddy.ca.cer"

69 + ],

70 + "loader": "file"

71 + }

72 + ],

73 + "verifier": "leaf"

74 + }

75 + ],

76 + "mode": "request"

77 + }

78 + },

79 + {}

80 + ]

81 + }

82 + }

83 + }

84 + }

85 +}

\ No newline at end of file

caddytest/integration/caddyfile_adapt/tls_client_auth_leaf_verifier_file_loader_multi-in-block.caddyfiletest new

+94

@@ -0,0 +1,94 @@

1 +localhost

2 +

3 +respond "hello from localhost"

4 +tls {

5 + client_auth {

6 + mode request

7 + trust_pool inline {

9 + }

10 + verifier leaf {

11 + file ../caddy.ca.cer

12 + file ../caddy.ca.cer

13 + }

14 + }

15 +}

16 +----------

17 +{

18 + "apps": {

19 + "http": {

20 + "servers": {

21 + "srv0": {

22 + "listen": [

23 + ":443"

24 + ],

25 + "routes": [

26 + {

27 + "match": [

28 + {

29 + "host": [

30 + "localhost"

31 + ]

32 + }

33 + ],

34 + "handle": [

35 + {

36 + "handler": "subroute",

37 + "routes": [

38 + {

39 + "handle": [

40 + {

41 + "body": "hello from localhost",

42 + "handler": "static_response"

43 + }

44 + ]

45 + }

46 + ]

47 + }

48 + ],

49 + "terminal": true

50 + }

51 + ],

52 + "tls_connection_policies": [

53 + {

54 + "match": {

55 + "sni": [

56 + "localhost"

57 + ]

58 + },

59 + "client_authentication": {

60 + "ca": {

61 + "provider": "inline",

62 + "trusted_ca_certs": [

63 + "MIIDSzCCAjOgAwIBAgIUfIRObjWNUA4jxQ/0x8BOCvE2Vw4wDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMTkwODI4MTYyNTU5WhcNMjkwODI1MTYyNTU5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5m5elxhQfMp/3aVJ4JnpN9PUSz6LlP6LePAPFU7gqohVVFVtDkChJAG3FNkNQNlieVTja/bgH9IcC6oKbROwdY1h0MvNV8AHHigvl03WuJD8g2ReVFXXwsnrPmKXCFzQyMI6TYk3m2gYrXsZOU1GLnfMRC3KAMRgE2F45twOs9hqG169YJ6mM2eQjzjCHWI6S2/iUYvYxRkCOlYUbLsMD/AhgAf1plzg6LPqNxtdlwxZnA0ytgkmhK67HtzJu0+ovUCsMv0RwcMhsEo9T8nyFAGt9XLZ63X5WpBCTUApaAUhnG0XnerjmUWb6eUWw4zev54sEfY5F3x002iQaW6cECAwEAAaOBkDCBjTAdBgNVHQ4EFgQU4CBUbZsS2GaNIkGRz/cBsD5ivjswUQYDVR0jBEowSIAU4CBUbZsS2GaNIkGRz/cBsD5ivjuhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8hE5uNY1QDiPFD/THwE4K8TZXDjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAKB3V4HIzoiO/Ch6WMj9bLJ2FGbpkMrcb/Eq01hT5zcfKD66lVS1MlK+cRL446Z2b2KDP1oFyVs+qmrmtdwrWgD+nfe2sBmmIHo9m9KygMkEOfG3MghGTEcS+0cTKEcoHYWYyOqQh6jnedXY8Cdm4GM1hAc9MiL3/sqV8YCVSLNnkoNysmr06/rZ0MCUZPGUtRmfd0heWhrfzAKw2HLgX+RAmpOE2MZqWcjvqKGyaRiaZks4nJkP6521aC2Lgp0HhCz1j8/uQ5ldoDszCnu/iro0NAsNtudTMD+YoLQxLqdleIh6CW+illc2VdXwj7mn6J04yns9jfE2jRjW/yTLFuQ=="

64 + ]

65 + },

66 + "verifiers": [

67 + {

68 + "leaf_certs_loaders": [

69 + {

70 + "files": [

71 + "../caddy.ca.cer"

72 + ],

73 + "loader": "file"

74 + },

75 + {

76 + "files": [

77 + "../caddy.ca.cer"

78 + ],

79 + "loader": "file"

80 + }

81 + ],

82 + "verifier": "leaf"

83 + }

84 + ],

85 + "mode": "request"

86 + }

87 + },

88 + {}

89 + ]

90 + }

91 + }

92 + }

93 + }

94 +}

\ No newline at end of file

caddytest/integration/caddyfile_adapt/tls_client_auth_leaf_verifier_folder_loader_block.caddyfiletest new

+87

@@ -0,0 +1,87 @@

1 +localhost

2 +

3 +respond "hello from localhost"

4 +tls {

5 + client_auth {

6 + mode request

7 + trust_pool inline {

9 + }

10 + verifier leaf {

11 + folder ../

12 + }

13 + }

14 +}

15 +----------

16 +{

17 + "apps": {

18 + "http": {

19 + "servers": {

20 + "srv0": {

21 + "listen": [

22 + ":443"

23 + ],

24 + "routes": [

25 + {

26 + "match": [

27 + {

28 + "host": [

29 + "localhost"

30 + ]

31 + }

32 + ],

33 + "handle": [

34 + {

35 + "handler": "subroute",

36 + "routes": [

37 + {

38 + "handle": [

39 + {

40 + "body": "hello from localhost",

41 + "handler": "static_response"

42 + }

43 + ]

44 + }

45 + ]

46 + }

47 + ],

48 + "terminal": true

49 + }

50 + ],

51 + "tls_connection_policies": [

52 + {

53 + "match": {

54 + "sni": [

55 + "localhost"

56 + ]

57 + },

58 + "client_authentication": {

59 + "ca": {

60 + "provider": "inline",

61 + "trusted_ca_certs": [

63 + ]

64 + },

65 + "verifiers": [

66 + {

67 + "leaf_certs_loaders": [

68 + {

69 + "folders": [

70 + "../"

71 + ],

72 + "loader": "folder"

73 + }

74 + ],

75 + "verifier": "leaf"

76 + }

77 + ],

78 + "mode": "request"

79 + }

80 + },

81 + {}

82 + ]

83 + }

84 + }

85 + }

86 + }

87 +}

\ No newline at end of file

caddytest/integration/caddyfile_adapt/tls_client_auth_leaf_verifier_folder_loader_inline.caddyfiletest new

+85

@@ -0,0 +1,85 @@

1 +localhost

2 +

3 +respond "hello from localhost"

4 +tls {

5 + client_auth {

6 + mode request

7 + trust_pool inline {

9 + }

10 + verifier leaf folder ../

11 + }

12 +}

13 +----------

14 +{

15 + "apps": {

16 + "http": {

17 + "servers": {

18 + "srv0": {

19 + "listen": [

20 + ":443"

21 + ],

22 + "routes": [

23 + {

24 + "match": [

25 + {

26 + "host": [

27 + "localhost"

28 + ]

29 + }

30 + ],

31 + "handle": [

32 + {

33 + "handler": "subroute",

34 + "routes": [

35 + {

36 + "handle": [

37 + {

38 + "body": "hello from localhost",

39 + "handler": "static_response"

40 + }

41 + ]

42 + }

43 + ]

44 + }

45 + ],

46 + "terminal": true

47 + }

48 + ],

49 + "tls_connection_policies": [

50 + {

51 + "match": {

52 + "sni": [

53 + "localhost"

54 + ]

55 + },

56 + "client_authentication": {

57 + "ca": {

58 + "provider": "inline",

59 + "trusted_ca_certs": [

61 + ]

62 + },

63 + "verifiers": [

64 + {

65 + "leaf_certs_loaders": [

66 + {

67 + "folders": [

68 + "../"

69 + ],

70 + "loader": "folder"

71 + }

72 + ],

73 + "verifier": "leaf"

74 + }

75 + ],

76 + "mode": "request"

77 + }

78 + },

79 + {}

80 + ]

81 + }

82 + }

83 + }

84 + }

85 +}

\ No newline at end of file

caddytest/integration/caddyfile_adapt/tls_client_auth_leaf_verifier_folder_loader_multi-in-block.caddyfiletest new

+94

@@ -0,0 +1,94 @@

1 +localhost

2 +

3 +respond "hello from localhost"

4 +tls {

5 + client_auth {

6 + mode request

7 + trust_pool inline {

9 + }

10 + verifier leaf {

11 + folder ../

12 + folder ../

13 + }

14 + }

15 +}

16 +----------

17 +{

18 + "apps": {

19 + "http": {

20 + "servers": {

21 + "srv0": {

22 + "listen": [

23 + ":443"

24 + ],

25 + "routes": [

26 + {

27 + "match": [

28 + {

29 + "host": [

30 + "localhost"

31 + ]

32 + }

33 + ],

34 + "handle": [

35 + {

36 + "handler": "subroute",

37 + "routes": [

38 + {

39 + "handle": [

40 + {

41 + "body": "hello from localhost",

42 + "handler": "static_response"

43 + }

44 + ]

45 + }

46 + ]

47 + }

48 + ],

49 + "terminal": true

50 + }

51 + ],

52 + "tls_connection_policies": [

53 + {

54 + "match": {

55 + "sni": [

56 + "localhost"

57 + ]

58 + },

59 + "client_authentication": {

60 + "ca": {

61 + "provider": "inline",

62 + "trusted_ca_certs": [

64 + ]

65 + },

66 + "verifiers": [

67 + {

68 + "leaf_certs_loaders": [

69 + {

70 + "folders": [

71 + "../"

72 + ],

73 + "loader": "folder"

74 + },

75 + {

76 + "folders": [

77 + "../"

78 + ],

79 + "loader": "folder"

80 + }

81 + ],

82 + "verifier": "leaf"

83 + }

84 + ],

85 + "mode": "request"

86 + }

87 + },

88 + {}

89 + ]

90 + }

91 + }

92 + }

93 + }

94 +}

\ No newline at end of file

modules/caddytls/connpolicy.go

+43

@@ -989,6 +989,48 @@ func (l *LeafCertClientAuth) Provision(ctx caddy.Context) error {

989 return nil

990 }

991

992 +// UnmarshalCaddyfile implements caddyfile.Unmarshaler.

993 +func (l *LeafCertClientAuth) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {

994 + d.NextArg()

995 +

996 + // accommodate the use of one-liners

997 + if d.CountRemainingArgs() > 1 {

998 + d.NextArg()

999 + modName := d.Val()

1000 + mod, err := caddyfile.UnmarshalModule(d, "tls.leaf_cert_loader."+modName)

1001 + if err != nil {

1002 + return d.WrapErr(err)

1003 + }

1004 + vMod, ok := mod.(LeafCertificateLoader)

1005 + if !ok {

1006 + return fmt.Errorf("leaf module '%s' is not a leaf certificate loader", vMod)

1007 + }

1008 + l.LeafCertificateLoadersRaw = append(

1009 + l.LeafCertificateLoadersRaw,

1010 + caddyconfig.JSONModuleObject(vMod, "loader", modName, nil),

1011 + )

1012 + return nil

1013 + }

1014 +

1015 + // accommodate the use of nested blocks

1016 + for nesting := d.Nesting(); d.NextBlock(nesting); {

1017 + modName := d.Val()

1018 + mod, err := caddyfile.UnmarshalModule(d, "tls.leaf_cert_loader."+modName)

1019 + if err != nil {

1020 + return d.WrapErr(err)

1021 + }

1022 + vMod, ok := mod.(LeafCertificateLoader)

1023 + if !ok {

1024 + return fmt.Errorf("leaf module '%s' is not a leaf certificate loader", vMod)

1025 + }

1026 + l.LeafCertificateLoadersRaw = append(

1027 + l.LeafCertificateLoadersRaw,

1028 + caddyconfig.JSONModuleObject(vMod, "loader", modName, nil),

1029 + )

1030 + }

1031 + return nil

1032 +}

1033 +

1034 func (l LeafCertClientAuth) VerifyClientCertificate(rawCerts [][]byte, _ [][]*x509.Certificate) error {

1035 if len(rawCerts) == 0 {

1036 return fmt.Errorf("no client certificate provided")

@@ -1050,6 +1092,7 @@ var secretsLogPool = caddy.NewUsagePool()

1092 var (

1093 _ caddyfile.Unmarshaler = (*ClientAuthentication)(nil)

1094 _ caddyfile.Unmarshaler = (*ConnectionPolicy)(nil)

1095 + _ caddyfile.Unmarshaler = (*LeafCertClientAuth)(nil)

1096 )

1097

1098 // ParseCaddyfileNestedMatcherSet parses the Caddyfile tokens for a nested

modules/caddytls/leaffileloader.go

+15 -6

@@ -21,6 +21,7 @@ import (

21 "os"

23 "github.com/caddyserver/caddy/v2"

24 + "github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"

25 )

27 func init() {

@@ -32,6 +33,14 @@ type LeafFileLoader struct {

33 Files []string `json:"files,omitempty"`

34 }

36 +// CaddyModule returns the Caddy module information.

37 +func (LeafFileLoader) CaddyModule() caddy.ModuleInfo {

38 + return caddy.ModuleInfo{

39 + ID: "tls.leaf_cert_loader.file",

40 + New: func() caddy.Module { return new(LeafFileLoader) },

41 + }

42 +}

43 +

44 // Provision implements caddy.Provisioner.

45 func (fl *LeafFileLoader) Provision(ctx caddy.Context) error {

46 repl, ok := ctx.Value(caddy.ReplacerCtxKey).(*caddy.Replacer)

@@ -44,12 +53,11 @@ func (fl *LeafFileLoader) Provision(ctx caddy.Context) error {

53 return nil

54 }

47 -// CaddyModule returns the Caddy module information.

48 -func (LeafFileLoader) CaddyModule() caddy.ModuleInfo {

49 - return caddy.ModuleInfo{

50 - ID: "tls.leaf_cert_loader.file",

51 - New: func() caddy.Module { return new(LeafFileLoader) },

52 - }

56 +// UnmarshalCaddyfile implements caddyfile.Unmarshaler.

57 +func (fl *LeafFileLoader) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {

58 + d.NextArg()

59 + fl.Files = append(fl.Files, d.RemainingArgs()...)

60 + return nil

61 }

63 // LoadLeafCertificates returns the certificates to be loaded by fl.

@@ -96,4 +104,5 @@ func convertPEMFilesToDERBytes(filename string) ([]byte, error) {

104 var (

105 _ LeafCertificateLoader = (*LeafFileLoader)(nil)

106 _ caddy.Provisioner = (*LeafFileLoader)(nil)

107 + _ caddyfile.Unmarshaler = (*LeafFileLoader)(nil)

108 )

modules/caddytls/leaffolderloader.go

@@ -22,6 +22,7 @@ import (

22 "strings"

24 "github.com/caddyserver/caddy/v2"

25 + "github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"

26 )

28 func init() {

@@ -55,6 +56,13 @@ func (fl *LeafFolderLoader) Provision(ctx caddy.Context) error {

56 return nil

57 }

59 +// UnmarshalCaddyfile implements caddyfile.Unmarshaler.

60 +func (fl *LeafFolderLoader) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {

61 + d.NextArg()

62 + fl.Folders = append(fl.Folders, d.RemainingArgs()...)

63 + return nil

64 +}

65 +

66 // LoadLeafCertificates loads all the leaf certificates in the directories

67 // listed in fl from all files ending with .pem.

68 func (fl LeafFolderLoader) LoadLeafCertificates() ([]*x509.Certificate, error) {

@@ -94,4 +102,5 @@ func (fl LeafFolderLoader) LoadLeafCertificates() ([]*x509.Certificate, error) {

102 var (

103 _ LeafCertificateLoader = (*LeafFolderLoader)(nil)

104 _ caddy.Provisioner = (*LeafFolderLoader)(nil)

105 + _ caddyfile.Unmarshaler = (*LeafFolderLoader)(nil)

106 )

modules/caddytls/leafpemloader.go

@@ -19,6 +19,7 @@ import (

19 "fmt"

21 "github.com/caddyserver/caddy/v2"

22 + "github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"

23 )

25 func init() {

@@ -52,6 +53,13 @@ func (LeafPEMLoader) CaddyModule() caddy.ModuleInfo {

53 }

54 }

56 +// UnmarshalCaddyfile implements caddyfile.Unmarshaler.

57 +func (fl *LeafPEMLoader) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {

58 + d.NextArg()

59 + fl.Certificates = append(fl.Certificates, d.RemainingArgs()...)

60 + return nil

61 +}

62 +

63 // LoadLeafCertificates returns the certificates contained in pl.

64 func (pl LeafPEMLoader) LoadLeafCertificates() ([]*x509.Certificate, error) {

65 certs := make([]*x509.Certificate, 0, len(pl.Certificates))