Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
reverse_proxy: Add tls_trusted_ca_certs to Caddyfile (#2936)
Allows specifying ca certs with by filename in `reverse_proxy.transport`. Example ``` reverse_proxy /api api:443 { transport http { tls tls_trusted_ca_certs certs/rootCA.pem } } ```
Zaq? Wiedmann committed
Jan 7, 2020 at 11:07 UTC
21f1f95e7b4d37786c34eff8965a284340c2164a
2 files changed
+27
-1
modules/caddyhttp/reverseproxy/caddyfile.go
+12
@@ -425,6 +425,7 @@ func (h *Handler) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
425
// tls_client_auth <cert_file> <key_file>
426
// tls_insecure_skip_verify
427
// tls_timeout <duration>
428
+// tls_trusted_ca_certs <cert_files...>
429
// keepalive [off|<duration>]
430
// keepalive_idle_conns <max_count>
431
// }
@@ -501,6 +502,17 @@ func (h *HTTPTransport) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
502
}
503
h.TLS.HandshakeTimeout = caddy.Duration(dur)
504
505
+ case "tls_trusted_ca_certs":
506
+ args := d.RemainingArgs()
507
+ if len(args) == 0 {
508
+ return d.ArgErr()
509
+ }
510
+ if h.TLS == nil {
511
+ h.TLS = new(TLSConfig)
512
+ }
513
+
514
+ h.TLS.RootCAPemFiles = args
515
+
516
case "keepalive":
517
if !d.NextArg() {
518
return d.ArgErr()
modules/caddyhttp/reverseproxy/httptransport.go
+15
-1
@@ -20,6 +20,7 @@ import (
20
"crypto/x509"
21
"encoding/base64"
22
"fmt"
23
+ "io/ioutil"
24
"net"
25
"net/http"
26
"reflect"
@@ -166,6 +167,9 @@ func (h *HTTPTransport) setScheme(req *http.Request) {
167
168
// Cleanup implements caddy.CleanerUpper and closes any idle connections.
169
func (h HTTPTransport) Cleanup() error {
170
+ if h.Transport == nil {
171
+ return nil
172
+ }
173
h.Transport.CloseIdleConnections()
174
return nil
175
}
@@ -174,6 +178,8 @@ func (h HTTPTransport) Cleanup() error {
178
// TLS configuration for the transport/client.
179
type TLSConfig struct {
180
RootCAPool []string `json:"root_ca_pool,omitempty"`
181
+ // Added to the same pool as above, but brought in from files
182
+ RootCAPemFiles []string `json:"root_ca_pem_files,omitempty"`
183
// TODO: Should the client cert+key config use caddytls.CertificateLoader modules?
184
ClientCertificateFile string `json:"client_certificate_file,omitempty"`
185
ClientCertificateKeyFile string `json:"client_certificate_key_file,omitempty"`
@@ -203,7 +209,7 @@ func (t TLSConfig) MakeTLSClientConfig() (*tls.Config, error) {
209
}
210
211
// trusted root CAs
206
- if len(t.RootCAPool) > 0 {
212
+ if len(t.RootCAPool) > 0 || len(t.RootCAPemFiles) > 0 {
213
rootPool := x509.NewCertPool()
214
for _, encodedCACert := range t.RootCAPool {
215
caCert, err := decodeBase64DERCert(encodedCACert)
@@ -212,6 +218,14 @@ func (t TLSConfig) MakeTLSClientConfig() (*tls.Config, error) {
218
}
219
rootPool.AddCert(caCert)
220
}
221
+ for _, pemFile := range t.RootCAPemFiles {
222
+ pemData, err := ioutil.ReadFile(pemFile)
223
+ if err != nil {
224
+ return nil, fmt.Errorf("failed reading ca cert: %v", err)
225
+ }
226
+ rootPool.AppendCertsFromPEM(pemData)
227
+
228
+ }
229
cfg.RootCAs = rootPool
230
}
231