@marcel91200 / caddy Mirror · read-only / commits / b6e96fa3
Fork 0

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

Mirrored from https://github.com/Slazee/caddy.git

Synced Nov 13, 16:45 UTC

reverseproxy: Skip TLS for certain configured ports (#4843)

* Make reverse proxy TLS server name replaceable for SNI upstreams. * Reverted previous TLS server name replacement, and implemented thread safe version. * Move TLS servername replacement into it's own function * Moved SNI servername replacement into httptransport. * Solve issue when dynamic upstreams use wrong protocol upstream. * Revert previous commit. Old commit was: Solve issue when dynamic upstreams use wrong protocol upstream. Id: 3c9806ccb63e66bdcac8e1ed4520c9d135cb011d * Added SkipTLSPorts option to http transport. * Fix typo in test config file. * Rename config option as suggested by Matt Co-authored-by: Matt Holt <mholt@users.noreply.github.com> * Update code to match renamed config option. * Fix typo in config option name. * Fix another typo that I missed. * Tests not completing because of apparent wrong ordering of options. Co-authored-by: Matt Holt <mholt@users.noreply.github.com>

Kiss Károly Pál committed Jun 20, 2022 at 19:51 UTC b6e96fa3c5fcb7601142b8ad569793a1b9c2c5eb
3 files changed +33 -1
caddytest/integration/caddyfile_adapt/reverse_proxy_options.txt
+5
@@ -25,6 +25,7 @@ https://example.com {
25 keepalive_idle_conns_per_host 2
26 keepalive_interval 30s
27 renegotiation freely
28 + except_ports 8181 8182
29 }
30 }
31 }
@@ -93,6 +94,10 @@ https://example.com {
94 },
95 "response_header_timeout": 8000000000,
96 "tls": {
97 + "except_ports": [
98 + "8181",
99 + "8182"
100 + ],
101 "renegotiation": "freely"
102 },
103 "versions": [
modules/caddyhttp/reverseproxy/caddyfile.go
+9
@@ -1063,6 +1063,15 @@ func (h *HTTPTransport) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
1063 }
1064 h.MaxConnsPerHost = num
1065
1066 + case "except_ports":
1067 + if h.TLS == nil {
1068 + h.TLS = new(TLSConfig)
1069 + }
1070 + h.TLS.ExceptPorts = d.RemainingArgs()
1071 + if len(h.TLS.ExceptPorts) == 0 {
1072 + return d.ArgErr()
1073 + }
1074 +
1075 default:
1076 return d.Errf("unrecognized subdirective %s", d.Val())
1077 }
modules/caddyhttp/reverseproxy/httptransport.go
+19 -1
@@ -296,9 +296,20 @@ func (h *HTTPTransport) RoundTrip(req *http.Request) (*http.Response, error) {
296 // has the scheme set in its URL; the underlying
297 // http.Transport requires a scheme to be set.
298 func (h *HTTPTransport) SetScheme(req *http.Request) {
299 + skipTLSport := false
300 + if h.TLS.ExceptPorts != nil {
301 + port := req.URL.Port()
302 + for i := range h.TLS.ExceptPorts {
303 + if h.TLS.ExceptPorts[i] == port {
304 + skipTLSport = true
305 + break
306 + }
307 + }
308 + }
309 +
310 if req.URL.Scheme == "" {
311 req.URL.Scheme = "http"
301 - if h.TLS != nil {
312 + if h.TLS != nil && !skipTLSport {
313 req.URL.Scheme = "https"
314 }
315 }
@@ -369,6 +380,13 @@ type TLSConfig struct {
380 // - "once": allows a remote server to request renegotiation once per connection.
381 // - "freely": allows a remote server to repeatedly request renegotiation.
382 Renegotiation string `json:"renegotiation,omitempty"`
383 +
384 + // Skip TLS ports specifies a list of upstream ports on which TLS should not be
385 + // attempted even if it is configured. Handy when using dynamic upstreams that
386 + // return HTTP and HTTPS endpoints too.
387 + // When specified, TLS will automatically be configured on the transport.
388 + // The value can be a list of any valid tcp port numbers, default empty.
389 + ExceptPorts []string `json:"except_ports,omitempty"`
390 }
391
392 // MakeTLSClientConfig returns a tls.Config usable by a client to a backend.