Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 16:45 UTC
reverseproxy: Add renegotiation param in TLS client (#4784)
* Add renegotiation option in reverseproxy tls client * Update modules/caddyhttp/reverseproxy/httptransport.go Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
Yaacov Akiba Slama committed
Jun 10, 2022 at 18:33 UTC
aaf6794b31ca790ecc501edf983ebf95a45b3897
3 files changed
+38
-1
caddytest/integration/caddyfile_adapt/reverse_proxy_options.txt
+4
-1
@@ -24,6 +24,7 @@ https://example.com {
24
max_conns_per_host 5
25
keepalive_idle_conns_per_host 2
26
keepalive_interval 30s
27
+ renegotiation freely
28
}
29
}
30
}
@@ -91,7 +92,9 @@ https://example.com {
92
]
93
},
94
"response_header_timeout": 8000000000,
94
- "tls": {},
95
+ "tls": {
96
+ "renegotiation": "freely"
97
+ },
98
"versions": [
99
"h2c",
100
"2"
modules/caddyhttp/reverseproxy/caddyfile.go
+14
@@ -922,6 +922,20 @@ func (h *HTTPTransport) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
922
return d.ArgErr()
923
}
924
925
+ case "renegotiation":
926
+ if h.TLS == nil {
927
+ h.TLS = new(TLSConfig)
928
+ }
929
+ if !d.NextArg() {
930
+ return d.ArgErr()
931
+ }
932
+ switch renegotiation := d.Val(); renegotiation {
933
+ case "never", "once", "freely":
934
+ h.TLS.Renegotiation = renegotiation
935
+ default:
936
+ return d.ArgErr()
937
+ }
938
+
939
case "tls":
940
if h.TLS == nil {
941
h.TLS = new(TLSConfig)
modules/caddyhttp/reverseproxy/httptransport.go
+20
@@ -324,6 +324,14 @@ type TLSConfig struct {
324
// support placeholders because the TLS config is not provisioned on each
325
// connection, so a static value must be used.
326
ServerName string `json:"server_name,omitempty"`
327
+
328
+ // TLS renegotiation level. TLS renegotiation is the act of performing
329
+ // subsequent handshakes on a connection after the first.
330
+ // The level can be:
331
+ // - "never": (the default) disables renegotiation.
332
+ // - "once": allows a remote server to request renegotiation once per connection.
333
+ // - "freely": allows a remote server to repeatedly request renegotiation.
334
+ Renegotiation string `json:"renegotiation,omitempty"`
335
}
336
337
// MakeTLSClientConfig returns a tls.Config usable by a client to a backend.
@@ -393,6 +401,18 @@ func (t TLSConfig) MakeTLSClientConfig(ctx caddy.Context) (*tls.Config, error) {
401
cfg.RootCAs = rootPool
402
}
403
404
+ // Renegotiation
405
+ switch t.Renegotiation {
406
+ case "never":
407
+ cfg.Renegotiation = tls.RenegotiateNever
408
+ case "once":
409
+ cfg.Renegotiation = tls.RenegotiateOnceAsClient
410
+ case "freely":
411
+ cfg.Renegotiation = tls.RenegotiateFreelyAsClient
412
+ default:
413
+ return nil, fmt.Errorf("invalid TLS renegotiation level: %v", t.Renegotiation)
414
+ }
415
+
416
// override for the server name used verify the TLS handshake
417
cfg.ServerName = t.ServerName
418