|  | @ -16,23 +16,108 @@ package httpcaddyfile | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | import ( |  |  | import ( | 
			
		
	
		
		
			
				
					|  |  | 	"github.com/caddyserver/caddy/v2/caddyconfig" |  |  | 	"github.com/caddyserver/caddy/v2/caddyconfig" | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile" | 
			
		
	
		
		
			
				
					|  |  | 	"github.com/caddyserver/caddy/v2/modules/caddypki" |  |  | 	"github.com/caddyserver/caddy/v2/modules/caddypki" | 
			
		
	
		
		
			
				
					|  |  | ) |  |  | ) | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | func init() { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	RegisterGlobalOption("pki", parsePKIApp) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | } | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | // parsePKIApp parses the global log option. Syntax:
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | //
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | //     pki {
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | //         ca [<id>] {
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | //             name            <name>
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | //             root_cn         <name>
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | //             intermediate_cn <name>
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | //         }
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | //     }
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | //
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | // When the CA ID is unspecified, 'local' is assumed.
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | //
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | func parsePKIApp(d *caddyfile.Dispenser, existingVal interface{}) (interface{}, error) { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	pki := &caddypki.PKI{CAs: make(map[string]*caddypki.CA)} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	for d.Next() { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		for nesting := d.Nesting(); d.NextBlock(nesting); { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			switch d.Val() { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			case "ca": | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				pkiCa := new(caddypki.CA) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				if d.NextArg() { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 					pkiCa.ID = d.Val() | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 					if d.NextArg() { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 						return nil, d.ArgErr() | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 					} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				if pkiCa.ID == "" { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 					pkiCa.ID = caddypki.DefaultCAID | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				for nesting := d.Nesting(); d.NextBlock(nesting); { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 					switch d.Val() { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 					case "name": | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 						if !d.NextArg() { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 							return nil, d.ArgErr() | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 						} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 						pkiCa.Name = d.Val() | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 					case "root_cn": | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 						if !d.NextArg() { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 							return nil, d.ArgErr() | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 						} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 						pkiCa.RootCommonName = d.Val() | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 					case "intermediate_cn": | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 						if !d.NextArg() { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 							return nil, d.ArgErr() | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 						} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 						pkiCa.IntermediateCommonName = d.Val() | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 					default: | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 						return nil, d.Errf("unrecognized pki ca option '%s'", d.Val()) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 					} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				pki.CAs[pkiCa.ID] = pkiCa | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			default: | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				return nil, d.Errf("unrecognized pki option '%s'", d.Val()) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	return pki, nil | 
			
		
	
		
		
			
				
					|  |  |  |  |  | } | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | func (st ServerType) buildPKIApp( |  |  | func (st ServerType) buildPKIApp( | 
			
		
	
		
		
			
				
					|  |  | 	pairings []sbAddrAssociation, |  |  | 	pairings []sbAddrAssociation, | 
			
		
	
		
		
			
				
					|  |  | 	options map[string]interface{}, |  |  | 	options map[string]interface{}, | 
			
		
	
		
		
			
				
					|  |  | 	warnings []caddyconfig.Warning, |  |  | 	warnings []caddyconfig.Warning, | 
			
		
	
		
		
			
				
					|  |  | ) (*caddypki.PKI, []caddyconfig.Warning, error) { |  |  | ) (*caddypki.PKI, []caddyconfig.Warning, error) { | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | 	pkiApp := &caddypki.PKI{CAs: make(map[string]*caddypki.CA)} |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	skipInstallTrust := false |  |  | 	skipInstallTrust := false | 
			
		
	
		
		
			
				
					|  |  | 	if _, ok := options["skip_install_trust"]; ok { |  |  | 	if _, ok := options["skip_install_trust"]; ok { | 
			
		
	
		
		
			
				
					|  |  | 		skipInstallTrust = true |  |  | 		skipInstallTrust = true | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  | 	falseBool := false |  |  | 	falseBool := false | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	// Load the PKI app configured via global options
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	var pkiApp *caddypki.PKI | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	unwrappedPki, ok := options["pki"].(*caddypki.PKI) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	if ok { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		pkiApp = unwrappedPki | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	} else { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		pkiApp = &caddypki.PKI{CAs: make(map[string]*caddypki.CA)} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	for _, ca := range pkiApp.CAs { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		if skipInstallTrust { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			ca.InstallTrust = &falseBool | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		pkiApp.CAs[ca.ID] = ca | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	// Add in the CAs configured via directives
 | 
			
		
	
		
		
			
				
					|  |  | 	for _, p := range pairings { |  |  | 	for _, p := range pairings { | 
			
		
	
		
		
			
				
					|  |  | 		for _, sblock := range p.serverBlocks { |  |  | 		for _, sblock := range p.serverBlocks { | 
			
		
	
		
		
			
				
					|  |  | 			// find all the CAs that were defined and add them to the app config
 |  |  | 			// find all the CAs that were defined and add them to the app config
 | 
			
		
	
	
		
		
			
				
					|  | @ -42,10 +127,15 @@ func (st ServerType) buildPKIApp( | 
			
		
	
		
		
			
				
					|  |  | 				if skipInstallTrust { |  |  | 				if skipInstallTrust { | 
			
		
	
		
		
			
				
					|  |  | 					ca.InstallTrust = &falseBool |  |  | 					ca.InstallTrust = &falseBool | 
			
		
	
		
		
			
				
					|  |  | 				} |  |  | 				} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				// the CA might already exist from global options, so
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				// don't overwrite it in that case
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				if _, ok := pkiApp.CAs[ca.ID]; !ok { | 
			
		
	
		
		
			
				
					|  |  | 					pkiApp.CAs[ca.ID] = ca |  |  | 					pkiApp.CAs[ca.ID] = ca | 
			
		
	
		
		
			
				
					|  |  | 				} |  |  | 				} | 
			
		
	
		
		
			
				
					|  |  | 			} |  |  | 			} | 
			
		
	
		
		
			
				
					|  |  | 		} |  |  | 		} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | 	// if there was no CAs defined in any of the servers,
 |  |  | 	// if there was no CAs defined in any of the servers,
 | 
			
		
	
		
		
			
				
					|  |  | 	// and we were requested to not install trust, then
 |  |  | 	// and we were requested to not install trust, then
 | 
			
		
	
	
		
		
			
				
					|  | 
 |