Allow domain fronting with TLS client auth if explicitly configured

Matthew Holt committed Sep 17, 2019 at 23:13 UTC 4c289fc6ad3d7c2afa69e36cdf2cc9a172cb1c9c

2 files changed +14 -10

modules/caddyhttp/caddyhttp.go

+12 -8

@@ -78,16 +78,20 @@ func (app *App) Provision(ctx caddy.Context) error {

78 srv.AutoHTTPS = new(AutoHTTPSConfig)

79 }

81 - // disallow TLS client auth bypass which could

82 - // otherwise be exploited by sending an unprotected

83 - // SNI value during TLS handshake, then a protected

84 - // Host header during HTTP request later on that

85 - // connection

86 - if srv.hasTLSClientAuth() {

87 - srv.StrictSNIHost = true

81 + // if not explicitly configured by the user, disallow TLS

82 + // client auth bypass (domain fronting) which could

83 + // otherwise be exploited by sending an unprotected SNI

84 + // value during a TLS handshake, then putting a protected

85 + // domain in the Host header after establishing connection;

86 + // this is a safe default, but we allow users to override

87 + // it for example in the case of running a proxy where

88 + // domain fronting is desired and access is not restricted

89 + // based on hostname

90 + if srv.StrictSNIHost == nil && srv.hasTLSClientAuth() {

91 + trueBool := true

92 + srv.StrictSNIHost = &trueBool

93 }

90 - // TODO: Test this function to ensure these replacements are performed

95 for i := range srv.Listen {

96 srv.Listen[i] = repl.ReplaceAll(srv.Listen[i], "")

97 }

modules/caddyhttp/server.go

+2 -2

@@ -42,7 +42,7 @@ type Server struct {

42 TLSConnPolicies caddytls.ConnectionPolicies `json:"tls_connection_policies,omitempty"`

43 AutoHTTPS *AutoHTTPSConfig `json:"automatic_https,omitempty"`

44 MaxRehandles *int `json:"max_rehandles,omitempty"`

45 - StrictSNIHost bool `json:"strict_sni_host,omitempty"`

45 + StrictSNIHost *bool `json:"strict_sni_host,omitempty"`

47 // This field is not subject to compatibility promises

48 ExperimentalHTTP3 bool `json:"experimental_http3,omitempty"`

@@ -164,7 +164,7 @@ func (s *Server) enforcementHandler(w http.ResponseWriter, r *http.Request, next

164 // servers that rely on TLS ClientAuth sharing a listener

165 // with servers that do not; if not enforced, client could

166 // bypass by sending benign SNI then restricted Host header

167 - if s.StrictSNIHost && r.TLS != nil {

167 + if s.StrictSNIHost != nil && *s.StrictSNIHost && r.TLS != nil {

168 hostname, _, err := net.SplitHostPort(r.Host)

169 if err != nil {

170 hostname = r.Host // OK; probably lacked port