|
|
@ -16,23 +16,108 @@ package httpcaddyfile |
|
|
|
|
|
|
|
import ( |
|
|
|
"github.com/caddyserver/caddy/v2/caddyconfig" |
|
|
|
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile" |
|
|
|
"github.com/caddyserver/caddy/v2/modules/caddypki" |
|
|
|
) |
|
|
|
|
|
|
|
func init() { |
|
|
|
RegisterGlobalOption("pki", parsePKIApp) |
|
|
|
} |
|
|
|
|
|
|
|
// parsePKIApp parses the global log option. Syntax:
|
|
|
|
//
|
|
|
|
// pki {
|
|
|
|
// ca [<id>] {
|
|
|
|
// name <name>
|
|
|
|
// root_cn <name>
|
|
|
|
// intermediate_cn <name>
|
|
|
|
// }
|
|
|
|
// }
|
|
|
|
//
|
|
|
|
// When the CA ID is unspecified, 'local' is assumed.
|
|
|
|
//
|
|
|
|
func parsePKIApp(d *caddyfile.Dispenser, existingVal interface{}) (interface{}, error) { |
|
|
|
pki := &caddypki.PKI{CAs: make(map[string]*caddypki.CA)} |
|
|
|
|
|
|
|
for d.Next() { |
|
|
|
for nesting := d.Nesting(); d.NextBlock(nesting); { |
|
|
|
switch d.Val() { |
|
|
|
case "ca": |
|
|
|
pkiCa := new(caddypki.CA) |
|
|
|
if d.NextArg() { |
|
|
|
pkiCa.ID = d.Val() |
|
|
|
if d.NextArg() { |
|
|
|
return nil, d.ArgErr() |
|
|
|
} |
|
|
|
} |
|
|
|
if pkiCa.ID == "" { |
|
|
|
pkiCa.ID = caddypki.DefaultCAID |
|
|
|
} |
|
|
|
|
|
|
|
for nesting := d.Nesting(); d.NextBlock(nesting); { |
|
|
|
switch d.Val() { |
|
|
|
case "name": |
|
|
|
if !d.NextArg() { |
|
|
|
return nil, d.ArgErr() |
|
|
|
} |
|
|
|
pkiCa.Name = d.Val() |
|
|
|
|
|
|
|
case "root_cn": |
|
|
|
if !d.NextArg() { |
|
|
|
return nil, d.ArgErr() |
|
|
|
} |
|
|
|
pkiCa.RootCommonName = d.Val() |
|
|
|
|
|
|
|
case "intermediate_cn": |
|
|
|
if !d.NextArg() { |
|
|
|
return nil, d.ArgErr() |
|
|
|
} |
|
|
|
pkiCa.IntermediateCommonName = d.Val() |
|
|
|
|
|
|
|
default: |
|
|
|
return nil, d.Errf("unrecognized pki ca option '%s'", d.Val()) |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
pki.CAs[pkiCa.ID] = pkiCa |
|
|
|
|
|
|
|
default: |
|
|
|
return nil, d.Errf("unrecognized pki option '%s'", d.Val()) |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
return pki, nil |
|
|
|
} |
|
|
|
|
|
|
|
func (st ServerType) buildPKIApp( |
|
|
|
pairings []sbAddrAssociation, |
|
|
|
options map[string]interface{}, |
|
|
|
warnings []caddyconfig.Warning, |
|
|
|
) (*caddypki.PKI, []caddyconfig.Warning, error) { |
|
|
|
|
|
|
|
pkiApp := &caddypki.PKI{CAs: make(map[string]*caddypki.CA)} |
|
|
|
|
|
|
|
skipInstallTrust := false |
|
|
|
if _, ok := options["skip_install_trust"]; ok { |
|
|
|
skipInstallTrust = true |
|
|
|
} |
|
|
|
falseBool := false |
|
|
|
|
|
|
|
// Load the PKI app configured via global options
|
|
|
|
var pkiApp *caddypki.PKI |
|
|
|
unwrappedPki, ok := options["pki"].(*caddypki.PKI) |
|
|
|
if ok { |
|
|
|
pkiApp = unwrappedPki |
|
|
|
} else { |
|
|
|
pkiApp = &caddypki.PKI{CAs: make(map[string]*caddypki.CA)} |
|
|
|
} |
|
|
|
for _, ca := range pkiApp.CAs { |
|
|
|
if skipInstallTrust { |
|
|
|
ca.InstallTrust = &falseBool |
|
|
|
} |
|
|
|
pkiApp.CAs[ca.ID] = ca |
|
|
|
} |
|
|
|
|
|
|
|
// Add in the CAs configured via directives
|
|
|
|
for _, p := range pairings { |
|
|
|
for _, sblock := range p.serverBlocks { |
|
|
|
// find all the CAs that were defined and add them to the app config
|
|
|
@ -42,10 +127,15 @@ func (st ServerType) buildPKIApp( |
|
|
|
if skipInstallTrust { |
|
|
|
ca.InstallTrust = &falseBool |
|
|
|
} |
|
|
|
|
|
|
|
// the CA might already exist from global options, so
|
|
|
|
// don't overwrite it in that case
|
|
|
|
if _, ok := pkiApp.CAs[ca.ID]; !ok { |
|
|
|
pkiApp.CAs[ca.ID] = ca |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
// if there was no CAs defined in any of the servers,
|
|
|
|
// and we were requested to not install trust, then
|
|
|
|