4 changed files with 318 additions and 299 deletions
@ -0,0 +1,301 @@ |
|||
// Copyright 2015 Matthew Holt and The Caddy Authors
|
|||
//
|
|||
// Licensed under the Apache License, Version 2.0 (the "License");
|
|||
// you may not use this file except in compliance with the License.
|
|||
// You may obtain a copy of the License at
|
|||
//
|
|||
// http://www.apache.org/licenses/LICENSE-2.0
|
|||
//
|
|||
// Unless required by applicable law or agreed to in writing, software
|
|||
// distributed under the License is distributed on an "AS IS" BASIS,
|
|||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|||
// See the License for the specific language governing permissions and
|
|||
// limitations under the License.
|
|||
|
|||
package caddytls |
|||
|
|||
import ( |
|||
"encoding/json" |
|||
"fmt" |
|||
"net/http" |
|||
"time" |
|||
|
|||
"github.com/caddyserver/caddy/v2" |
|||
"github.com/caddyserver/certmagic" |
|||
"github.com/go-acme/lego/v3/challenge" |
|||
) |
|||
|
|||
// AutomationConfig designates configuration for the
|
|||
// construction and use of ACME clients.
|
|||
type AutomationConfig struct { |
|||
// The list of automation policies. The first matching
|
|||
// policy will be applied for a given certificate/name.
|
|||
Policies []*AutomationPolicy `json:"policies,omitempty"` |
|||
|
|||
// On-Demand TLS defers certificate operations to the
|
|||
// moment they are needed, e.g. during a TLS handshake.
|
|||
// Useful when you don't know all the hostnames up front.
|
|||
// Caddy was the first web server to deploy this technology.
|
|||
OnDemand *OnDemandConfig `json:"on_demand,omitempty"` |
|||
|
|||
// Caddy staples OCSP (and caches the response) for all
|
|||
// qualifying certificates by default. This setting
|
|||
// changes how often it scans responses for freshness,
|
|||
// and updates them if they are getting stale.
|
|||
OCSPCheckInterval caddy.Duration `json:"ocsp_interval,omitempty"` |
|||
|
|||
// Every so often, Caddy will scan all loaded, managed
|
|||
// certificates for expiration. This setting changes how
|
|||
// frequently the scan for expiring certificates is
|
|||
// performed. If your certificate lifetimes are very
|
|||
// short (less than ~24 hours), you should set this to
|
|||
// a low value.
|
|||
RenewCheckInterval caddy.Duration `json:"renew_interval,omitempty"` |
|||
|
|||
defaultAutomationPolicy *AutomationPolicy |
|||
} |
|||
|
|||
// AutomationPolicy designates the policy for automating the
|
|||
// management (obtaining, renewal, and revocation) of managed
|
|||
// TLS certificates.
|
|||
//
|
|||
// An AutomationPolicy value is not valid until it has been
|
|||
// provisioned; use the `AddAutomationPolicy()` method on the
|
|||
// TLS app to properly provision a new policy.
|
|||
type AutomationPolicy struct { |
|||
// Which subjects (hostnames or IP addresses) this policy applies to.
|
|||
Subjects []string `json:"subjects,omitempty"` |
|||
|
|||
// The module that will issue certificates. Default: acme
|
|||
IssuerRaw json.RawMessage `json:"issuer,omitempty" caddy:"namespace=tls.issuance inline_key=module"` |
|||
|
|||
// If true, certificates will be requested with MustStaple. Not all
|
|||
// CAs support this, and there are potentially serious consequences
|
|||
// of enabling this feature without proper threat modeling.
|
|||
MustStaple bool `json:"must_staple,omitempty"` |
|||
|
|||
// How long before a certificate's expiration to try renewing it,
|
|||
// as a function of its total lifetime. As a general and conservative
|
|||
// rule, it is a good idea to renew a certificate when it has about
|
|||
// 1/3 of its total lifetime remaining. This utilizes the majority
|
|||
// of the certificate's lifetime while still saving time to
|
|||
// troubleshoot problems. However, for extremely short-lived certs,
|
|||
// you may wish to increase the ratio to ~1/2.
|
|||
RenewalWindowRatio float64 `json:"renewal_window_ratio,omitempty"` |
|||
|
|||
// The type of key to generate for certificates.
|
|||
// Supported values: `ed25519`, `p256`, `p384`, `rsa2048`, `rsa4096`.
|
|||
KeyType string `json:"key_type,omitempty"` |
|||
|
|||
// Optionally configure a separate storage module associated with this
|
|||
// manager, instead of using Caddy's global/default-configured storage.
|
|||
StorageRaw json.RawMessage `json:"storage,omitempty" caddy:"namespace=caddy.storage inline_key=module"` |
|||
|
|||
// If true, certificates will be managed "on demand"; that is, during
|
|||
// TLS handshakes or when needed, as opposed to at startup or config
|
|||
// load.
|
|||
OnDemand bool `json:"on_demand,omitempty"` |
|||
|
|||
// If true, certificate management will be conducted
|
|||
// in the foreground; this will block config reloads
|
|||
// and return errors if there were problems with
|
|||
// obtaining or renewing certificates. This is often
|
|||
// not desirable, especially when serving sites out
|
|||
// of your control. Default: false
|
|||
// TODO: is this really necessary per-policy? why not a global setting...
|
|||
ManageSync bool `json:"manage_sync,omitempty"` |
|||
|
|||
// Issuer stores the decoded issuer parameters. This is only
|
|||
// used to populate an underlying certmagic.Config's Issuer
|
|||
// field; it is not referenced thereafter.
|
|||
Issuer certmagic.Issuer `json:"-"` |
|||
|
|||
magic *certmagic.Config |
|||
storage certmagic.Storage |
|||
} |
|||
|
|||
// provision converts ap into a CertMagic config.
|
|||
func (ap *AutomationPolicy) provision(tlsApp *TLS) error { |
|||
// policy-specific storage implementation
|
|||
if ap.StorageRaw != nil { |
|||
val, err := tlsApp.ctx.LoadModule(ap, "StorageRaw") |
|||
if err != nil { |
|||
return fmt.Errorf("loading TLS storage module: %v", err) |
|||
} |
|||
cmStorage, err := val.(caddy.StorageConverter).CertMagicStorage() |
|||
if err != nil { |
|||
return fmt.Errorf("creating TLS storage configuration: %v", err) |
|||
} |
|||
ap.storage = cmStorage |
|||
} |
|||
|
|||
var ond *certmagic.OnDemandConfig |
|||
if ap.OnDemand { |
|||
var onDemand *OnDemandConfig |
|||
if tlsApp.Automation != nil { |
|||
onDemand = tlsApp.Automation.OnDemand |
|||
} |
|||
|
|||
ond = &certmagic.OnDemandConfig{ |
|||
DecisionFunc: func(name string) error { |
|||
if onDemand != nil { |
|||
if onDemand.Ask != "" { |
|||
err := onDemandAskRequest(onDemand.Ask, name) |
|||
if err != nil { |
|||
return err |
|||
} |
|||
} |
|||
// check the rate limiter last because
|
|||
// doing so makes a reservation
|
|||
if !onDemandRateLimiter.Allow() { |
|||
return fmt.Errorf("on-demand rate limit exceeded") |
|||
} |
|||
} |
|||
return nil |
|||
}, |
|||
} |
|||
} |
|||
|
|||
if ap.IssuerRaw != nil { |
|||
val, err := tlsApp.ctx.LoadModule(ap, "IssuerRaw") |
|||
if err != nil { |
|||
return fmt.Errorf("loading TLS automation management module: %s", err) |
|||
} |
|||
ap.Issuer = val.(certmagic.Issuer) |
|||
} |
|||
|
|||
keySource := certmagic.StandardKeyGenerator{ |
|||
KeyType: supportedCertKeyTypes[ap.KeyType], |
|||
} |
|||
|
|||
storage := ap.storage |
|||
if storage == nil { |
|||
storage = tlsApp.ctx.Storage() |
|||
} |
|||
|
|||
template := certmagic.Config{ |
|||
MustStaple: ap.MustStaple, |
|||
RenewalWindowRatio: ap.RenewalWindowRatio, |
|||
KeySource: keySource, |
|||
OnDemand: ond, |
|||
Storage: storage, |
|||
Issuer: ap.Issuer, // if nil, certmagic.New() will set default in returned Config
|
|||
} |
|||
if rev, ok := ap.Issuer.(certmagic.Revoker); ok { |
|||
template.Revoker = rev |
|||
} |
|||
ap.magic = certmagic.New(tlsApp.certCache, template) |
|||
|
|||
// sometimes issuers may need the parent certmagic.Config in
|
|||
// order to function properly (for example, ACMEIssuer needs
|
|||
// access to the correct storage and cache so it can solve
|
|||
// ACME challenges -- it's an annoying, inelegant circular
|
|||
// dependency that I don't know how to resolve nicely!)
|
|||
if configger, ok := ap.Issuer.(ConfigSetter); ok { |
|||
configger.SetConfig(ap.magic) |
|||
} |
|||
|
|||
return nil |
|||
} |
|||
|
|||
// ChallengesConfig configures the ACME challenges.
|
|||
type ChallengesConfig struct { |
|||
// HTTP configures the ACME HTTP challenge. This
|
|||
// challenge is enabled and used automatically
|
|||
// and by default.
|
|||
HTTP *HTTPChallengeConfig `json:"http,omitempty"` |
|||
|
|||
// TLSALPN configures the ACME TLS-ALPN challenge.
|
|||
// This challenge is enabled and used automatically
|
|||
// and by default.
|
|||
TLSALPN *TLSALPNChallengeConfig `json:"tls-alpn,omitempty"` |
|||
|
|||
// Configures the ACME DNS challenge. Because this
|
|||
// challenge typically requires credentials for
|
|||
// interfacing with a DNS provider, this challenge is
|
|||
// not enabled by default. This is the only challenge
|
|||
// type which does not require a direct connection
|
|||
// to Caddy from an external server.
|
|||
DNSRaw json.RawMessage `json:"dns,omitempty" caddy:"namespace=tls.dns inline_key=provider"` |
|||
|
|||
DNS challenge.Provider `json:"-"` |
|||
} |
|||
|
|||
// HTTPChallengeConfig configures the ACME HTTP challenge.
|
|||
type HTTPChallengeConfig struct { |
|||
// If true, the HTTP challenge will be disabled.
|
|||
Disabled bool `json:"disabled,omitempty"` |
|||
|
|||
// An alternate port on which to service this
|
|||
// challenge. Note that the HTTP challenge port is
|
|||
// hard-coded into the spec and cannot be changed,
|
|||
// so you would have to forward packets from the
|
|||
// standard HTTP challenge port to this one.
|
|||
AlternatePort int `json:"alternate_port,omitempty"` |
|||
} |
|||
|
|||
// TLSALPNChallengeConfig configures the ACME TLS-ALPN challenge.
|
|||
type TLSALPNChallengeConfig struct { |
|||
// If true, the TLS-ALPN challenge will be disabled.
|
|||
Disabled bool `json:"disabled,omitempty"` |
|||
|
|||
// An alternate port on which to service this
|
|||
// challenge. Note that the TLS-ALPN challenge port
|
|||
// is hard-coded into the spec and cannot be changed,
|
|||
// so you would have to forward packets from the
|
|||
// standard TLS-ALPN challenge port to this one.
|
|||
AlternatePort int `json:"alternate_port,omitempty"` |
|||
} |
|||
|
|||
// OnDemandConfig configures on-demand TLS, for obtaining
|
|||
// needed certificates at handshake-time. Because this
|
|||
// feature can easily be abused, you should set up rate
|
|||
// limits and/or an internal endpoint that Caddy can
|
|||
// "ask" if it should be allowed to manage certificates
|
|||
// for a given hostname.
|
|||
type OnDemandConfig struct { |
|||
// An optional rate limit to throttle the
|
|||
// issuance of certificates from handshakes.
|
|||
RateLimit *RateLimit `json:"rate_limit,omitempty"` |
|||
|
|||
// If Caddy needs to obtain or renew a certificate
|
|||
// during a TLS handshake, it will perform a quick
|
|||
// HTTP request to this URL to check if it should be
|
|||
// allowed to try to get a certificate for the name
|
|||
// in the "domain" query string parameter, like so:
|
|||
// `?domain=example.com`. The endpoint must return a
|
|||
// 200 OK status if a certificate is allowed;
|
|||
// anything else will cause it to be denied.
|
|||
// Redirects are not followed.
|
|||
Ask string `json:"ask,omitempty"` |
|||
} |
|||
|
|||
// RateLimit specifies an interval with optional burst size.
|
|||
type RateLimit struct { |
|||
// A duration value. A certificate may be obtained 'burst'
|
|||
// times during this interval.
|
|||
Interval caddy.Duration `json:"interval,omitempty"` |
|||
|
|||
// How many times during an interval a certificate can be obtained.
|
|||
Burst int `json:"burst,omitempty"` |
|||
} |
|||
|
|||
// ConfigSetter is implemented by certmagic.Issuers that
|
|||
// need access to a parent certmagic.Config as part of
|
|||
// their provisioning phase. For example, the ACMEIssuer
|
|||
// requires a config so it can access storage and the
|
|||
// cache to solve ACME challenges.
|
|||
type ConfigSetter interface { |
|||
SetConfig(cfg *certmagic.Config) |
|||
} |
|||
|
|||
// These perpetual values are used for on-demand TLS.
|
|||
var ( |
|||
onDemandRateLimiter = certmagic.NewRateLimiter(0, 0) |
|||
onDemandAskClient = &http.Client{ |
|||
Timeout: 10 * time.Second, |
|||
CheckRedirect: func(req *http.Request, via []*http.Request) error { |
|||
return fmt.Errorf("following http redirects is not allowed") |
|||
}, |
|||
} |
|||
) |
Loading…
Reference in new issue