reverseproxy: Add `tls_curves` option to HTTP transport (#5851)

Bas Westerbaan committed Jan 13, 2024 at 21:56 UTC f658fd05ace8f01727bc733e46657d2f6218db87

2 files changed +23

modules/caddyhttp/reverseproxy/caddyfile.go

+10

@@ -1072,6 +1072,16 @@ func (h *HTTPTransport) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {

1072 }

1073 h.TLS.InsecureSkipVerify = true

1074

1075 + case "tls_curves":

1076 + args := d.RemainingArgs()

1077 + if len(args) == 0 {

1078 + return d.ArgErr()

1079 + }

1080 + if h.TLS == nil {

1081 + h.TLS = new(TLSConfig)

1082 + }

1083 + h.TLS.Curves = args

1084 +

1085 case "tls_timeout":

1086 if !d.NextArg() {

1087 return d.ArgErr()

modules/caddyhttp/reverseproxy/httptransport.go

+13

@@ -491,6 +491,10 @@ type TLSConfig struct {

491 // When specified, TLS will automatically be configured on the transport.

492 // The value can be a list of any valid tcp port numbers, default empty.

493 ExceptPorts []string `json:"except_ports,omitempty"`

494 +

495 + // The list of elliptic curves to support. Caddy's

496 + // defaults are modern and secure.

497 + Curves []string `json:"curves,omitempty"`

498 }

499

500 // MakeTLSClientConfig returns a tls.Config usable by a client to a backend.

@@ -579,6 +583,15 @@ func (t TLSConfig) MakeTLSClientConfig(ctx caddy.Context) (*tls.Config, error) {

583 // throw all security out the window

584 cfg.InsecureSkipVerify = t.InsecureSkipVerify

585

586 + curvesAdded := make(map[tls.CurveID]struct{})

587 + for _, curveName := range t.Curves {

588 + curveID := caddytls.SupportedCurves[curveName]

589 + if _, ok := curvesAdded[curveID]; !ok {

590 + curvesAdded[curveID] = struct{}{}

591 + cfg.CurvePreferences = append(cfg.CurvePreferences, curveID)

592 + }

593 + }

594 +

595 // only return a config if it's not empty

596 if reflect.DeepEqual(cfg, new(tls.Config)) {

597 return nil, nil