Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 12:00 UTC
caddytls: set server name in context (#6324)
Set the requested server name in a context value for CertGetter implementations to use. Pass ctx to tscert.GetCertificateWithContext. Signed-off-by: Will Norris <will@tailscale.com>
Will Norris committed
May 18, 2024 at 02:52 UTC
e66040a6f0b384d9cebd38a78f746f08f4cb22c1
3 files changed
+8
-4
go.mod
+1
-1
@@ -26,7 +26,7 @@ require (
26
github.com/spf13/cobra v1.8.0
27
github.com/spf13/pflag v1.0.5
28
github.com/stretchr/testify v1.9.0
29
- github.com/tailscale/tscert v0.0.0-20230806124524-28a91b69a046
29
+ github.com/tailscale/tscert v0.0.0-20240517230440-bbccfbf48933
30
github.com/yuin/goldmark v1.7.1
31
github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
32
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1
go.sum
+2
-2
@@ -410,8 +410,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
410
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
411
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
412
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
413
-github.com/tailscale/tscert v0.0.0-20230806124524-28a91b69a046 h1:8rUlviSVOEe7TMk7W0gIPrW8MqEzYfZHpsNWSf8s2vg=
414
-github.com/tailscale/tscert v0.0.0-20230806124524-28a91b69a046/go.mod h1:kNGUQ3VESx3VZwRwA9MSCUegIl6+saPL8Noq82ozCaU=
413
+github.com/tailscale/tscert v0.0.0-20240517230440-bbccfbf48933 h1:pV0H+XIvFoP7pl1MRtyPXh5hqoxB5I7snOtTHgrn6HU=
414
+github.com/tailscale/tscert v0.0.0-20240517230440-bbccfbf48933/go.mod h1:kNGUQ3VESx3VZwRwA9MSCUegIl6+saPL8Noq82ozCaU=
415
github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
416
github.com/urfave/cli v1.22.14 h1:ebbhrRiGK2i4naQJr+1Xj92HXZCrK7MsyTS/ob3HnAk=
417
github.com/urfave/cli v1.22.14/go.mod h1:X0eDS6pD6Exaclxm99NJ3FiCDRED7vIHpx2mDOHLvkA=
modules/caddytls/certmanagers.go
+5
-1
@@ -22,6 +22,9 @@ func init() {
22
caddy.RegisterModule(HTTPCertGetter{})
23
}
24
25
+// For referencing the requested SNI server name.
26
+const ClientHelloSNICtxKey caddy.CtxKey = "client_hello_sni"
27
+
28
// Tailscale is a module that can get certificates from the local Tailscale process.
29
type Tailscale struct {
30
logger *zap.Logger
@@ -41,6 +44,7 @@ func (ts *Tailscale) Provision(ctx caddy.Context) error {
44
}
45
46
func (ts Tailscale) GetCertificate(ctx context.Context, hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
47
+ ctx = context.WithValue(ctx, ClientHelloSNICtxKey, hello.ServerName)
48
canGetCert, err := ts.canHazCertificate(ctx, hello)
49
if err == nil && !canGetCert {
50
return nil, nil // pass-thru: Tailscale can't offer a cert for this name
@@ -48,7 +52,7 @@ func (ts Tailscale) GetCertificate(ctx context.Context, hello *tls.ClientHelloIn
52
if err != nil {
53
ts.logger.Warn("could not get status; will try to get certificate anyway", zap.Error(err))
54
}
51
- return tscert.GetCertificate(hello)
55
+ return tscert.GetCertificateWithContext(ctx, hello)
56
}
57
58
// canHazCertificate returns true if Tailscale reports it can get a certificate for the given ClientHello.