Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 02:00 UTC
caddytls: Fix TrustedCACerts backwards compatibility (#6889)
* add failing test * fix ca pool provisioning * remove unused param
jjiang-stripe committed
Mar 10, 2025 at 11:50 UTC
49f9af9a4ab2a28fa5c445630017f5284a5afa48
2 files changed
+53
-2
modules/caddytls/connpolicy.go
+6
-2
@@ -798,10 +798,14 @@ func (clientauth *ClientAuthentication) provision(ctx caddy.Context) error {
798
799
// if we have TrustedCACerts explicitly set, create an 'inline' CA and return
800
if len(clientauth.TrustedCACerts) > 0 {
801
- clientauth.ca = InlineCAPool{
801
+ caPool := InlineCAPool{
802
TrustedCACerts: clientauth.TrustedCACerts,
803
}
804
- return nil
804
+ err := caPool.Provision(ctx)
805
+ if err != nil {
806
+ return nil
807
+ }
808
+ clientauth.ca = caPool
809
}
810
811
// if we don't have any CARaw set, there's not much work to do
modules/caddytls/connpolicy_test.go
+47
@@ -20,6 +20,7 @@ import (
20
"reflect"
21
"testing"
22
23
+ "github.com/caddyserver/caddy/v2"
24
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
25
)
26
@@ -278,3 +279,49 @@ func TestClientAuthenticationUnmarshalCaddyfileWithDirectiveName(t *testing.T) {
279
})
280
}
281
}
282
+
283
+func TestClientAuthenticationProvision(t *testing.T) {
284
+ tests := []struct {
285
+ name string
286
+ ca ClientAuthentication
287
+ wantErr bool
288
+ }{
289
+ {
290
+ name: "specifying both 'CARaw' and 'TrustedCACerts' produces an error",
291
+ ca: ClientAuthentication{
292
+ CARaw: json.RawMessage(`{"provider":"inline","trusted_ca_certs":["foo"]}`),
293
+ TrustedCACerts: []string{"foo"},
294
+ },
295
+ wantErr: true,
296
+ },
297
+ {
298
+ name: "specifying both 'CARaw' and 'TrustedCACertPEMFiles' produces an error",
299
+ ca: ClientAuthentication{
300
+ CARaw: json.RawMessage(`{"provider":"inline","trusted_ca_certs":["foo"]}`),
301
+ TrustedCACertPEMFiles: []string{"foo"},
302
+ },
303
+ wantErr: true,
304
+ },
305
+ {
306
+ name: "setting 'TrustedCACerts' provisions the cert pool",
307
+ ca: ClientAuthentication{
308
+ TrustedCACerts: []string{test_der_1},
309
+ },
310
+ },
311
+ }
312
+
313
+ for _, tt := range tests {
314
+ t.Run(tt.name, func(t *testing.T) {
315
+ err := tt.ca.provision(caddy.Context{})
316
+ if (err != nil) != tt.wantErr {
317
+ t.Errorf("ClientAuthentication.provision() error = %v, wantErr %v", err, tt.wantErr)
318
+ return
319
+ }
320
+ if !tt.wantErr {
321
+ if tt.ca.ca.CertPool() == nil {
322
+ t.Error("CertPool is nil, expected non-nil value")
323
+ }
324
+ }
325
+ })
326
+ }
327
+}