Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 03:00 UTC
caddytls: Configurable fallback SNI (#5527)
* Initial implementation of fallback_sni * Apply upstream patch
Matt Holt committed
May 10, 2023 at 14:29 UTC
faf0399e80391ba5229321e2ee7d05262e4cc531
5 files changed
+26
-5
caddyconfig/httpcaddyfile/httptype.go
+9
-2
@@ -413,6 +413,7 @@ func (st *ServerType) serversFromPairings(
413
) (map[string]*caddyhttp.Server, error) {
414
servers := make(map[string]*caddyhttp.Server)
415
defaultSNI := tryString(options["default_sni"], warnings)
416
+ fallbackSNI := tryString(options["fallback_sni"], warnings)
417
418
httpPort := strconv.Itoa(caddyhttp.DefaultHTTPPort)
419
if hp, ok := options["http_port"].(int); ok {
@@ -570,6 +571,11 @@ func (st *ServerType) serversFromPairings(
571
cp.DefaultSNI = defaultSNI
572
break
573
}
574
+ if h == fallbackSNI {
575
+ hosts = append(hosts, "")
576
+ cp.FallbackSNI = fallbackSNI
577
+ break
578
+ }
579
}
580
581
if len(hosts) > 0 {
@@ -578,6 +584,7 @@ func (st *ServerType) serversFromPairings(
584
}
585
} else {
586
cp.DefaultSNI = defaultSNI
587
+ cp.FallbackSNI = fallbackSNI
588
}
589
590
// only append this policy if it actually changes something
@@ -703,8 +710,8 @@ func (st *ServerType) serversFromPairings(
710
// policy missing for any HTTPS-enabled hosts, if so, add it... maybe?
711
if addressQualifiesForTLS &&
712
!hasCatchAllTLSConnPolicy &&
706
- (len(srv.TLSConnPolicies) > 0 || !autoHTTPSWillAddConnPolicy || defaultSNI != "") {
707
- srv.TLSConnPolicies = append(srv.TLSConnPolicies, &caddytls.ConnectionPolicy{DefaultSNI: defaultSNI})
713
+ (len(srv.TLSConnPolicies) > 0 || !autoHTTPSWillAddConnPolicy || defaultSNI != "" || fallbackSNI != "") {
714
+ srv.TLSConnPolicies = append(srv.TLSConnPolicies, &caddytls.ConnectionPolicy{DefaultSNI: defaultSNI, FallbackSNI: fallbackSNI})
715
}
716
717
// tidy things up a bit
caddyconfig/httpcaddyfile/options.go
+1
@@ -33,6 +33,7 @@ func init() {
33
RegisterGlobalOption("grace_period", parseOptDuration)
34
RegisterGlobalOption("shutdown_delay", parseOptDuration)
35
RegisterGlobalOption("default_sni", parseOptSingleString)
36
+ RegisterGlobalOption("fallback_sni", parseOptSingleString)
37
RegisterGlobalOption("order", parseOptOrder)
38
RegisterGlobalOption("storage", parseOptStorage)
39
RegisterGlobalOption("storage_clean_interval", parseOptDuration)
go.mod
+1
-1
@@ -7,7 +7,7 @@ require (
7
github.com/Masterminds/sprig/v3 v3.2.3
8
github.com/alecthomas/chroma/v2 v2.7.0
9
github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b
10
- github.com/caddyserver/certmagic v0.17.3-0.20230507010158-25b55042e516
10
+ github.com/caddyserver/certmagic v0.17.3-0.20230510193943-53140d52202c
11
github.com/dustin/go-humanize v1.0.1
12
github.com/go-chi/chi v4.1.2+incompatible
13
github.com/google/cel-go v0.14.0
go.sum
+2
-2
@@ -97,8 +97,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
97
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
98
github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
99
github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
100
-github.com/caddyserver/certmagic v0.17.3-0.20230507010158-25b55042e516 h1:D+jLysrPbU0EN+IbLvPuGIpvCi6wgoPmQiKxAQCh+gI=
101
-github.com/caddyserver/certmagic v0.17.3-0.20230507010158-25b55042e516/go.mod h1:e0YLTnXIopZ05bBWCLzpIf1Yvk27Q90FGUmGowFRDY8=
100
+github.com/caddyserver/certmagic v0.17.3-0.20230510193943-53140d52202c h1:pEMS0l8kE/5xxrncv+Qq81fzr29R+zk++E7KAYiyBe4=
101
+github.com/caddyserver/certmagic v0.17.3-0.20230510193943-53140d52202c/go.mod h1:e0YLTnXIopZ05bBWCLzpIf1Yvk27Q90FGUmGowFRDY8=
102
github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
103
github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
104
github.com/cenkalti/backoff/v4 v4.2.0 h1:HN5dHm3WBOgndBH6E8V0q2jIYIR3s9yglV8k/+MN3u4=
modules/caddytls/connpolicy.go
+13
@@ -159,6 +159,18 @@ type ConnectionPolicy struct {
159
// is no policy configured for the empty SNI value.
160
DefaultSNI string `json:"default_sni,omitempty"`
161
162
+ // FallbackSNI becomes the ServerName in a ClientHello if
163
+ // the original ServerName doesn't match any certificates
164
+ // in the cache. The use cases for this are very niche;
165
+ // typically if a client is a CDN and passes through the
166
+ // ServerName of the downstream handshake but can accept
167
+ // a certificate with the origin's hostname instead, then
168
+ // you would set this to your origin's hostname. Note that
169
+ // Caddy must be managing a certificate for this name.
170
+ //
171
+ // This feature is EXPERIMENTAL and subject to change or removal.
172
+ FallbackSNI string `json:"fallback_sni,omitempty"`
173
+
174
// Also known as "SSLKEYLOGFILE", TLS secrets will be written to
175
// this file in NSS key log format which can then be parsed by
176
// Wireshark and other tools. This is INSECURE as it allows other
@@ -216,6 +228,7 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error {
228
cfg.CertSelection = p.CertSelection
229
}
230
cfg.DefaultServerName = p.DefaultSNI
231
+ cfg.FallbackServerName = p.FallbackSNI
232
return cfg.GetCertificate(hello)
233
},
234
MinVersion: tls.VersionTLS12,