Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

httpcaddyfile: Add client certificate config to tls #3335

Merged
merged 11 commits into from
Jun 5, 2020
Merged

httpcaddyfile: Add client certificate config to tls #3335

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
75aa84a
reading client certificate config from Caddyfile
nwhirschfeld May 3, 2020
a8b1bed
Update caddyconfig/httpcaddyfile/builtins.go
nwhirschfeld May 4, 2020
86a31b8
added adapt test for parsing client certificate configuration from Ca…
nwhirschfeld May 4, 2020
90e2720
read client ca and leaf certificates from file https://github.com/cad…
nwhirschfeld May 15, 2020
3ca7299
Merge branch 'master' into master
nwhirschfeld May 15, 2020
24d0961
Merge branch 'master' into master
nwhirschfeld May 17, 2020
5cfc091
Merge branch 'master' into master
nwhirschfeld May 29, 2020
362b76c
Merge branch 'master' into master
nwhirschfeld May 29, 2020
c93b97a
Merge branch 'master' into master
nwhirschfeld May 29, 2020
3b4c2d8
Update modules/caddytls/connpolicy.go
mholt Jun 1, 2020
fee8bd9
Make review adjustments
mholt Jun 5, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions caddyconfig/httpcaddyfile/builtins.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,11 @@ func parseBind(h Helper) ([]ConfigValue, error) {
// protocols <min> [<max>]
// ciphers <cipher_suites...>
// curves <curves...>
// clients {
// mode [request|require|verify_if_given|require_and_verify]
// trusted_ca_certs <trusted_ca_certs...>
// trusted_leaf_certs <trusted_leaf_certs...>
// }
nwhirschfeld marked this conversation as resolved.
Show resolved Hide resolved
// alpn <values...>
// load <paths...>
// ca <acme_ca_endpoint>
Expand Down Expand Up @@ -181,6 +186,36 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
cp.Curves = append(cp.Curves, h.Val())
}

case "clients":
mholt marked this conversation as resolved.
Show resolved Hide resolved
ch := h.NewFromNextSegment() // new helper for client auth config
cp.ClientAuthentication = &caddytls.ClientAuthentication{}
for ch.Next() {
for ch.NextBlock(0) {
switch ch.Val() {
case "mode":
for ch.NextArg() {
cp.ClientAuthentication.Mode = ch.Val()
}
case "trusted_ca_certs":
mholt marked this conversation as resolved.
Show resolved Hide resolved
for ch.NextArg() {
if _, err := caddytls.DecodeBase64DERCert(ch.Val()); err != nil {
return nil, h.Errf("cannot decode trusted CA certificate '%s'", ch.Val())
mholt marked this conversation as resolved.
Show resolved Hide resolved
}
cp.ClientAuthentication.TrustedCACerts = append(cp.ClientAuthentication.TrustedCACerts, ch.Val())
}
case "trusted_leaf_certs":
mholt marked this conversation as resolved.
Show resolved Hide resolved
for ch.NextArg() {
if _, err := caddytls.DecodeBase64DERCert(ch.Val()); err != nil {
return nil, h.Errf("cannot decode trusted leaf certificate '%s'", ch.Val())
}
mholt marked this conversation as resolved.
Show resolved Hide resolved
cp.ClientAuthentication.TrustedLeafCerts = append(cp.ClientAuthentication.TrustedLeafCerts, ch.Val())
}
default:
return nil, h.Errf("Unknown param for Client Certificate Check: '%s'", ch.Val())
}
}
}

case "alpn":
args := h.RemainingArgs()
if len(args) == 0 {
Expand Down
6 changes: 3 additions & 3 deletions modules/caddytls/connpolicy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -336,7 +336,7 @@ func (clientauth *ClientAuthentication) ConfigureTLSConfig(cfg *tls.Config) erro
if len(clientauth.TrustedCACerts) > 0 {
caPool := x509.NewCertPool()
for _, clientCAString := range clientauth.TrustedCACerts {
clientCA, err := decodeBase64DERCert(clientCAString)
clientCA, err := DecodeBase64DERCert(clientCAString)
if err != nil {
return fmt.Errorf("parsing certificate: %v", err)
}
Expand All @@ -350,7 +350,7 @@ func (clientauth *ClientAuthentication) ConfigureTLSConfig(cfg *tls.Config) erro
clientauth.trustedLeafCerts = []*x509.Certificate{}

for _, clientCertString := range clientauth.TrustedLeafCerts {
clientCert, err := decodeBase64DERCert(clientCertString)
clientCert, err := DecodeBase64DERCert(clientCertString)
if err != nil {
return fmt.Errorf("parsing certificate: %v", err)
}
Expand Down Expand Up @@ -397,7 +397,7 @@ func (clientauth ClientAuthentication) verifyPeerCertificate(rawCerts [][]byte,
}

// decodeBase64DERCert base64-decodes, then DER-decodes, certStr.
mholt marked this conversation as resolved.
Show resolved Hide resolved
func decodeBase64DERCert(certStr string) (*x509.Certificate, error) {
func DecodeBase64DERCert(certStr string) (*x509.Certificate, error) {
// decode base64
derBytes, err := base64.StdEncoding.DecodeString(certStr)
if err != nil {
Expand Down