Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
caddytls: Refactor certificate selection policies (close #1575)
Certificate selection used to be a module, but this seems unnecessary, especially since the built-in CustomSelectionPolicy allows quite complex selection logic on a number of fields in certs. If we need to extend that logic, we can, but I don't think there are SO many possibilities that we need modules. This update also allows certificate selection to choose between multiple matching certs based on client compatibility and makes a number of other improvements in the default cert selection logic, both here and in the latest CertMagic. The hardest part of this was the conn policy consolidation logic (Caddyfile only, of course). We have to merge connection policies that we can easily combine, because if two certs are manually loaded in a Caddyfile site block, that produces two connection policies, and each cert is tagged with a different tag, meaning only the first would ever be selected. So given the same matchers, we can merge the two, but this required improving the Tag selection logic to support multiple tags to choose from, hence "tags" changed to "any_tag" or "all_tags" (but we use any_tag in our Caddyfile logic). Combining conn policies with conflicting settings is impossible, so that should return an error if two policies with the exact same matchers have non-empty settings that are not the same (the one exception being any_tag which we can merge because the logic for them is to OR them). It was a bit complicated. It seems to work in numerous tests I've conducted, but we'll see how it pans out in the release candidates.
Matthew Holt committed
Apr 1, 2020 at 20:49 UTC
6ca5828221b25cb781932836d9c6959af857196c
8 files changed
+195
-62
caddyconfig/caddyfile/adapter.go
+5
@@ -68,6 +68,11 @@ func (a Adapter) Adapt(body []byte, options map[string]interface{}) ([]byte, []c
68
// into JSON. Caddyfile-unmarshaled values
69
// will not be used directly; they will be
70
// encoded as JSON and then used from that.
71
+// Implementations must be able to support
72
+// multiple segments (instances of their
73
+// directive or batch of tokens); typically
74
+// this means wrapping all token logic in
75
+// a loop: `for d.Next() { ... }`.
76
type Unmarshaler interface {
77
UnmarshalCaddyfile(d *Dispenser) error
78
}
caddyconfig/httpcaddyfile/builtins.go
+8
-2
@@ -71,6 +71,7 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
71
cp := new(caddytls.ConnectionPolicy)
72
var fileLoader caddytls.FileLoader
73
var folderLoader caddytls.FolderLoader
74
+ var certSelector caddytls.CustomCertSelectionPolicy
75
var acmeIssuer *caddytls.ACMEIssuer
76
var internalIssuer *caddytls.InternalIssuer
77
var onDemand bool
@@ -135,8 +136,8 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
136
// remember this for next time we see this cert file
137
tlsCertTags[certFilename] = tag
138
}
138
- certSelector := caddytls.CustomCertSelectionPolicy{Tag: tag}
139
- cp.CertSelection = caddyconfig.JSONModuleObject(certSelector, "policy", "custom", h.warnings)
139
+ certSelector.AnyTag = append(certSelector.AnyTag, tag)
140
+
141
default:
142
return nil, h.ArgErr()
143
}
@@ -297,6 +298,11 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
298
})
299
}
300
301
+ // custom certificate selection
302
+ if len(certSelector.AnyTag) > 0 {
303
+ cp.CertSelection = &certSelector
304
+ }
305
+
306
// connection policy -- always add one, to ensure that TLS
307
// is enabled, because this directive was used (this is
308
// needed, for instance, when a site block has a key of
caddyconfig/httpcaddyfile/httptype.go
+104
-3
@@ -527,7 +527,11 @@ func (st *ServerType) serversFromPairings(
527
}
528
529
// tidy things up a bit
530
- srv.TLSConnPolicies = consolidateConnPolicies(srv.TLSConnPolicies)
530
+ var err error
531
+ srv.TLSConnPolicies, err = consolidateConnPolicies(srv.TLSConnPolicies)
532
+ if err != nil {
533
+ return nil, fmt.Errorf("consolidating TLS connection policies for server %d: %v", i, err)
534
+ }
535
srv.Routes = consolidateRoutes(srv.Routes)
536
537
servers[fmt.Sprintf("srv%d", i)] = srv
@@ -538,7 +542,7 @@ func (st *ServerType) serversFromPairings(
542
543
// consolidateConnPolicies combines TLS connection policies that are the same,
544
// for a cleaner overall output.
541
-func consolidateConnPolicies(cps caddytls.ConnectionPolicies) caddytls.ConnectionPolicies {
545
+func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.ConnectionPolicies, error) {
546
for i := 0; i < len(cps); i++ {
547
for j := 0; j < len(cps); j++ {
548
if j == i {
@@ -551,9 +555,106 @@ func consolidateConnPolicies(cps caddytls.ConnectionPolicies) caddytls.Connectio
555
i--
556
break
557
}
558
+
559
+ // if they have the same matcher, try to reconcile each field: either they must
560
+ // be identical, or we have to be able to combine them safely
561
+ if reflect.DeepEqual(cps[i].MatchersRaw, cps[j].MatchersRaw) {
562
+ if len(cps[i].ALPN) > 0 &&
563
+ len(cps[j].ALPN) > 0 &&
564
+ !reflect.DeepEqual(cps[i].ALPN, cps[j].ALPN) {
565
+ return nil, fmt.Errorf("two policies with same match criteria have conflicting ALPN: %v vs. %v",
566
+ cps[i].ALPN, cps[j].ALPN)
567
+ }
568
+ if len(cps[i].CipherSuites) > 0 &&
569
+ len(cps[j].CipherSuites) > 0 &&
570
+ !reflect.DeepEqual(cps[i].CipherSuites, cps[j].CipherSuites) {
571
+ return nil, fmt.Errorf("two policies with same match criteria have conflicting cipher suites: %v vs. %v",
572
+ cps[i].CipherSuites, cps[j].CipherSuites)
573
+ }
574
+ if cps[i].ClientAuthentication == nil &&
575
+ cps[j].ClientAuthentication != nil &&
576
+ !reflect.DeepEqual(cps[i].ClientAuthentication, cps[j].ClientAuthentication) {
577
+ return nil, fmt.Errorf("two policies with same match criteria have conflicting client auth configuration: %+v vs. %+v",
578
+ cps[i].ClientAuthentication, cps[j].ClientAuthentication)
579
+ }
580
+ if len(cps[i].Curves) > 0 &&
581
+ len(cps[j].Curves) > 0 &&
582
+ !reflect.DeepEqual(cps[i].Curves, cps[j].Curves) {
583
+ return nil, fmt.Errorf("two policies with same match criteria have conflicting curves: %v vs. %v",
584
+ cps[i].Curves, cps[j].Curves)
585
+ }
586
+ if cps[i].DefaultSNI != "" &&
587
+ cps[j].DefaultSNI != "" &&
588
+ cps[i].DefaultSNI != cps[j].DefaultSNI {
589
+ return nil, fmt.Errorf("two policies with same match criteria have conflicting default SNI: %s vs. %s",
590
+ cps[i].DefaultSNI, cps[j].DefaultSNI)
591
+ }
592
+ if cps[i].ProtocolMin != "" &&
593
+ cps[j].ProtocolMin != "" &&
594
+ cps[i].ProtocolMin != cps[j].ProtocolMin {
595
+ return nil, fmt.Errorf("two policies with same match criteria have conflicting min protocol: %s vs. %s",
596
+ cps[i].ProtocolMin, cps[j].ProtocolMin)
597
+ }
598
+ if cps[i].ProtocolMax != "" &&
599
+ cps[j].ProtocolMax != "" &&
600
+ cps[i].ProtocolMax != cps[j].ProtocolMax {
601
+ return nil, fmt.Errorf("two policies with same match criteria have conflicting max protocol: %s vs. %s",
602
+ cps[i].ProtocolMax, cps[j].ProtocolMax)
603
+ }
604
+ if cps[i].CertSelection != nil && cps[j].CertSelection != nil {
605
+ // merging fields other than AnyTag is not implemented
606
+ if !reflect.DeepEqual(cps[i].CertSelection.SerialNumber, cps[j].CertSelection.SerialNumber) ||
607
+ !reflect.DeepEqual(cps[i].CertSelection.SubjectOrganization, cps[j].CertSelection.SubjectOrganization) ||
608
+ cps[i].CertSelection.PublicKeyAlgorithm != cps[j].CertSelection.PublicKeyAlgorithm ||
609
+ !reflect.DeepEqual(cps[i].CertSelection.AllTags, cps[j].CertSelection.AllTags) {
610
+ return nil, fmt.Errorf("two policies with same match criteria have conflicting cert selections: %+v vs. %+v",
611
+ cps[i].CertSelection, cps[j].CertSelection)
612
+ }
613
+ }
614
+
615
+ // by now we've decided that we can merge the two -- we'll keep i and drop j
616
+
617
+ if len(cps[i].ALPN) == 0 && len(cps[j].ALPN) > 0 {
618
+ cps[i].ALPN = cps[j].ALPN
619
+ }
620
+ if len(cps[i].CipherSuites) == 0 && len(cps[j].CipherSuites) > 0 {
621
+ cps[i].CipherSuites = cps[j].CipherSuites
622
+ }
623
+ if cps[i].ClientAuthentication == nil && cps[j].ClientAuthentication != nil {
624
+ cps[i].ClientAuthentication = cps[j].ClientAuthentication
625
+ }
626
+ if len(cps[i].Curves) == 0 && len(cps[j].Curves) > 0 {
627
+ cps[i].Curves = cps[j].Curves
628
+ }
629
+ if cps[i].DefaultSNI == "" && cps[j].DefaultSNI != "" {
630
+ cps[i].DefaultSNI = cps[j].DefaultSNI
631
+ }
632
+ if cps[i].ProtocolMin == "" && cps[j].ProtocolMin != "" {
633
+ cps[i].ProtocolMin = cps[j].ProtocolMin
634
+ }
635
+ if cps[i].ProtocolMax == "" && cps[j].ProtocolMax != "" {
636
+ cps[i].ProtocolMax = cps[j].ProtocolMax
637
+ }
638
+
639
+ if cps[i].CertSelection == nil && cps[j].CertSelection != nil {
640
+ // if j is the only one with a policy, move it over to i
641
+ cps[i].CertSelection = cps[j].CertSelection
642
+ } else if cps[i].CertSelection != nil && cps[j].CertSelection != nil {
643
+ // if both have one, then combine AnyTag
644
+ for _, tag := range cps[j].CertSelection.AnyTag {
645
+ if !sliceContains(cps[i].CertSelection.AnyTag, tag) {
646
+ cps[i].CertSelection.AnyTag = append(cps[i].CertSelection.AnyTag, tag)
647
+ }
648
+ }
649
+ }
650
+
651
+ cps = append(cps[:j], cps[j+1:]...)
652
+ i--
653
+ break
654
+ }
655
}
656
}
556
- return cps
657
+ return cps, nil
658
}
659
660
// appendSubrouteToRouteList appends the routes in subroute
caddytest/integration/sni_test.go
+3
-6
@@ -57,8 +57,7 @@ func TestDefaultSNI(t *testing.T) {
57
"tls_connection_policies": [
58
{
59
"certificate_selection": {
60
- "policy": "custom",
61
- "tag": "cert0"
60
+ "any_tag": ["cert0"]
61
},
62
"match": {
63
"sni": [
@@ -155,8 +154,7 @@ func TestDefaultSNIWithNamedHostAndExplicitIP(t *testing.T) {
154
"tls_connection_policies": [
155
{
156
"certificate_selection": {
158
- "policy": "custom",
159
- "tag": "cert0"
157
+ "any_tag": ["cert0"]
158
},
159
"default_sni": "a.caddy.localhost",
160
"match": {
@@ -238,8 +236,7 @@ func TestDefaultSNIWithPortMappingOnly(t *testing.T) {
236
"tls_connection_policies": [
237
{
238
"certificate_selection": {
241
- "policy": "custom",
242
- "tag": "cert0"
239
+ "any_tag": ["cert0"]
240
},
241
"default_sni": "a.caddy.localhost"
242
}
go.mod
+1
-1
@@ -5,7 +5,7 @@ go 1.14
5
require (
6
github.com/Masterminds/sprig/v3 v3.0.2
7
github.com/alecthomas/chroma v0.7.2-0.20200305040604-4f3623dce67a
8
- github.com/caddyserver/certmagic v0.10.6
8
+ github.com/caddyserver/certmagic v0.10.7
9
github.com/dustin/go-humanize v1.0.1-0.20200219035652-afde56e7acac
10
github.com/go-acme/lego/v3 v3.5.0
11
github.com/google/cel-go v0.4.1
go.sum
+2
-2
@@ -120,8 +120,8 @@ github.com/bombsimon/wsl/v2 v2.0.0/go.mod h1:mf25kr/SqFEPhhcxW1+7pxzGlW+hIl/hYTK
120
github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
121
github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
122
github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
123
-github.com/caddyserver/certmagic v0.10.6 h1:sCya6FmfaN74oZE46kqfaFOVoROD/mF36rTQfjN7TZc=
124
-github.com/caddyserver/certmagic v0.10.6/go.mod h1:Y8jcUBctgk/IhpAzlHKfimZNyXCkfGgRTC0orl8gROQ=
123
+github.com/caddyserver/certmagic v0.10.7 h1:OwT4Delj91ee7vumu+CnFJdWLsYBYj6kJ2PwsoqI7LA=
124
+github.com/caddyserver/certmagic v0.10.7/go.mod h1:Y8jcUBctgk/IhpAzlHKfimZNyXCkfGgRTC0orl8gROQ=
125
github.com/cenkalti/backoff/v4 v4.0.0 h1:6VeaLF9aI+MAUQ95106HwWzYZgJJpZ4stumjj6RFYAU=
126
github.com/cenkalti/backoff/v4 v4.0.0/go.mod h1:eEew/i+1Q6OrCDZh3WiXYv3+nJwBASZ8Bog/87DQnVg=
127
github.com/census-instrumentation/opencensus-proto v0.2.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
modules/caddytls/certselection.go
+70
-31
@@ -20,65 +20,104 @@ import (
20
"fmt"
21
"math/big"
22
23
- "github.com/caddyserver/caddy/v2"
23
"github.com/caddyserver/certmagic"
24
)
25
27
-func init() {
28
- caddy.RegisterModule(CustomCertSelectionPolicy{})
29
-}
30
-
26
// CustomCertSelectionPolicy represents a policy for selecting the certificate
27
// used to complete a handshake when there may be multiple options. All fields
28
// specified must match the candidate certificate for it to be chosen.
29
// This was needed to solve https://github.com/caddyserver/caddy/issues/2588.
30
type CustomCertSelectionPolicy struct {
36
- SerialNumber *big.Int `json:"serial_number,omitempty"`
37
- SubjectOrganization string `json:"subject_organization,omitempty"`
38
- PublicKeyAlgorithm PublicKeyAlgorithm `json:"public_key_algorithm,omitempty"`
39
- Tag string `json:"tag,omitempty"`
40
-}
31
+ // The certificate must have one of these serial numbers.
32
+ SerialNumber []*big.Int `json:"serial_number,omitempty"`
33
42
-// CaddyModule returns the Caddy module information.
43
-func (CustomCertSelectionPolicy) CaddyModule() caddy.ModuleInfo {
44
- return caddy.ModuleInfo{
45
- ID: "tls.certificate_selection.custom",
46
- New: func() caddy.Module { return new(CustomCertSelectionPolicy) },
47
- }
34
+ // The certificate must have one of these organization names.
35
+ SubjectOrganization []string `json:"subject_organization,omitempty"`
36
+
37
+ // The certificate must use this public key algorithm.
38
+ PublicKeyAlgorithm PublicKeyAlgorithm `json:"public_key_algorithm,omitempty"`
39
+
40
+ // The certificate must have at least one of the tags in the list.
41
+ AnyTag []string `json:"any_tag,omitempty"`
42
+
43
+ // The certificate must have all of the tags in the list.
44
+ AllTags []string `json:"all_tags,omitempty"`
45
}
46
50
-// SelectCertificate implements certmagic.CertificateSelector.
51
-func (p CustomCertSelectionPolicy) SelectCertificate(_ *tls.ClientHelloInfo, choices []certmagic.Certificate) (certmagic.Certificate, error) {
47
+// SelectCertificate implements certmagic.CertificateSelector. It
48
+// only chooses a certificate that at least meets the criteria in
49
+// p. It then chooses the first non-expired certificate that is
50
+// compatible with the client. If none are valid, it chooses the
51
+// first viable candidate anyway.
52
+func (p CustomCertSelectionPolicy) SelectCertificate(hello *tls.ClientHelloInfo, choices []certmagic.Certificate) (certmagic.Certificate, error) {
53
+ viable := make([]certmagic.Certificate, 0, len(choices))
54
+
55
+nextChoice:
56
for _, cert := range choices {
53
- if p.SerialNumber != nil && cert.SerialNumber.Cmp(p.SerialNumber) != 0 {
54
- continue
57
+ if len(p.SerialNumber) > 0 {
58
+ var found bool
59
+ for _, sn := range p.SerialNumber {
60
+ if cert.Leaf.SerialNumber.Cmp(sn) == 0 {
61
+ found = true
62
+ break
63
+ }
64
+ }
65
+ if !found {
66
+ continue
67
+ }
68
+ }
69
+
70
+ if len(p.SubjectOrganization) > 0 {
71
+ var found bool
72
+ for _, subjOrg := range p.SubjectOrganization {
73
+ for _, org := range cert.Leaf.Subject.Organization {
74
+ if subjOrg == org {
75
+ found = true
76
+ break
77
+ }
78
+ }
79
+ }
80
+ if !found {
81
+ continue
82
+ }
83
}
84
85
if p.PublicKeyAlgorithm != PublicKeyAlgorithm(x509.UnknownPublicKeyAlgorithm) &&
58
- PublicKeyAlgorithm(cert.PublicKeyAlgorithm) != p.PublicKeyAlgorithm {
86
+ PublicKeyAlgorithm(cert.Leaf.PublicKeyAlgorithm) != p.PublicKeyAlgorithm {
87
continue
88
}
89
62
- if p.SubjectOrganization != "" {
63
- var matchOrg bool
64
- for _, org := range cert.Subject.Organization {
65
- if p.SubjectOrganization == org {
66
- matchOrg = true
90
+ if len(p.AnyTag) > 0 {
91
+ var found bool
92
+ for _, tag := range p.AnyTag {
93
+ if cert.HasTag(tag) {
94
+ found = true
95
break
96
}
97
}
70
- if !matchOrg {
98
+ if !found {
99
continue
100
}
101
}
102
75
- if p.Tag != "" && !cert.HasTag(p.Tag) {
76
- continue
103
+ if len(p.AllTags) > 0 {
104
+ for _, tag := range p.AllTags {
105
+ if !cert.HasTag(tag) {
106
+ continue nextChoice
107
+ }
108
+ }
109
}
110
79
- return cert, nil
111
+ // this certificate at least meets the policy's requirements,
112
+ // but we still have to check expiration and compatibility
113
+ viable = append(viable, cert)
114
}
81
- return certmagic.Certificate{}, fmt.Errorf("no certificates matched custom selection policy")
115
+
116
+ if len(viable) == 0 {
117
+ return certmagic.Certificate{}, fmt.Errorf("no certificates matched custom selection policy")
118
+ }
119
+
120
+ return certmagic.DefaultCertificateSelector(hello, viable)
121
}
122
123
// Interface guard
modules/caddytls/connpolicy.go
+2
-17
@@ -18,12 +18,10 @@ import (
18
"crypto/tls"
19
"crypto/x509"
20
"encoding/base64"
21
- "encoding/json"
21
"fmt"
22
"strings"
23
24
"github.com/caddyserver/caddy/v2"
26
- "github.com/caddyserver/certmagic"
25
"github.com/go-acme/lego/v3/challenge/tlsalpn01"
26
)
27
@@ -46,15 +44,6 @@ func (cp ConnectionPolicies) Provision(ctx caddy.Context) error {
44
cp[i].matchers = append(cp[i].matchers, modIface.(ConnectionMatcher))
45
}
46
49
- // certificate selector
50
- if pol.CertSelection != nil {
51
- val, err := ctx.LoadModule(pol, "CertSelection")
52
- if err != nil {
53
- return fmt.Errorf("loading certificate selection module: %s", err)
54
- }
55
- cp[i].certSelector = val.(certmagic.CertificateSelector)
56
- }
57
-
47
// enable HTTP/2 by default
48
if len(pol.ALPN) == 0 {
49
pol.ALPN = append(pol.ALPN, defaultALPN...)
@@ -123,7 +112,7 @@ type ConnectionPolicy struct {
112
113
// How to choose a certificate if more than one matched
114
// the given ServerName (SNI) value.
126
- CertSelection json.RawMessage `json:"certificate_selection,omitempty" caddy:"namespace=tls.certificate_selection inline_key=policy"`
115
+ CertSelection *CustomCertSelectionPolicy `json:"certificate_selection,omitempty"`
116
117
// The list of cipher suites to support. Caddy's
118
// defaults are modern and secure.
@@ -151,8 +140,6 @@ type ConnectionPolicy struct {
140
DefaultSNI string `json:"default_sni,omitempty"`
141
142
matchers []ConnectionMatcher
154
- certSelector certmagic.CertificateSelector
155
-
143
stdTLSConfig *tls.Config
144
}
145
@@ -184,9 +171,7 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error {
171
// more at handshake-time, but I don't know how to practically pre-build
172
// a certmagic config for each combination of conn policy + automation policy...
173
cfg := *tlsApp.getConfigForName(hello.ServerName)
187
- if p.certSelector != nil {
188
- cfg.CertSelection = p.certSelector
189
- }
174
+ cfg.CertSelection = p.CertSelection
175
cfg.DefaultServerName = p.DefaultSNI
176
return cfg.GetCertificate(hello)
177
},