Browse Source

caddytls: Don't initialize default internal issuer unless necessary

Otherwise, a password prompt can occur unnecessarily.
master
Matthew Holt 5 years ago
parent
commit
85f5f47f31
No known key found for this signature in database GPG Key ID: 2A349DD577D586A5
  1. 2
      modules/caddyhttp/autohttps.go
  2. 2
      modules/caddytls/automation.go
  3. 52
      modules/caddytls/tls.go

2
modules/caddyhttp/autohttps.go

@ -339,7 +339,7 @@ uniqueDomainsLoop:
} }
redirTo += "{http.request.uri}" redirTo += "{http.request.uri}"
routes = append(routes, Route{ routes = append(routes, Route{
MatcherSets: []MatcherSet{MatcherSet{MatchProtocol("http")}}, MatcherSets: []MatcherSet{{MatchProtocol("http")}},
Handlers: []MiddlewareHandler{ Handlers: []MiddlewareHandler{
StaticResponse{ StaticResponse{
StatusCode: WeakString(strconv.Itoa(http.StatusPermanentRedirect)), StatusCode: WeakString(strconv.Itoa(http.StatusPermanentRedirect)),

2
modules/caddytls/automation.go

@ -54,7 +54,7 @@ type AutomationConfig struct {
RenewCheckInterval caddy.Duration `json:"renew_interval,omitempty"` RenewCheckInterval caddy.Duration `json:"renew_interval,omitempty"`
defaultPublicAutomationPolicy *AutomationPolicy defaultPublicAutomationPolicy *AutomationPolicy
defaultInternalAutomationPolicy *AutomationPolicy defaultInternalAutomationPolicy *AutomationPolicy // only initialized if necessary
} }
// AutomationPolicy designates the policy for automating the // AutomationPolicy designates the policy for automating the

52
modules/caddytls/tls.go

@ -89,15 +89,41 @@ func (t *TLS) Provision(ctx caddy.Context) error {
} }
t.certCache = certmagic.NewCache(cacheOpts) t.certCache = certmagic.NewCache(cacheOpts)
// certificate loaders
val, err := ctx.LoadModule(t, "CertificatesRaw")
if err != nil {
return fmt.Errorf("loading certificate loader modules: %s", err)
}
for modName, modIface := range val.(map[string]interface{}) {
if modName == "automate" {
// special case; these will be loaded in later using our automation facilities,
// which we want to avoid doing during provisioning
if automateNames, ok := modIface.(*AutomateLoader); ok && automateNames != nil {
t.automateNames = []string(*automateNames)
} else {
return fmt.Errorf("loading certificates with 'automate' requires array of strings, got: %T", modIface)
}
continue
}
t.certificateLoaders = append(t.certificateLoaders, modIface.(CertificateLoader))
}
// automation/management policies // automation/management policies
if t.Automation == nil { if t.Automation == nil {
t.Automation = new(AutomationConfig) t.Automation = new(AutomationConfig)
} }
t.Automation.defaultPublicAutomationPolicy = new(AutomationPolicy) t.Automation.defaultPublicAutomationPolicy = new(AutomationPolicy)
err := t.Automation.defaultPublicAutomationPolicy.Provision(t) err = t.Automation.defaultPublicAutomationPolicy.Provision(t)
if err != nil { if err != nil {
return fmt.Errorf("provisioning default public automation policy: %v", err) return fmt.Errorf("provisioning default public automation policy: %v", err)
} }
for _, n := range t.automateNames {
// if any names specified by the "automate" loader do not qualify for a public
// certificate, we should initialize a default internal automation policy
// (but we don't want to do this unnecessarily, since it may prompt for password!)
if certmagic.SubjectQualifiesForPublicCert(n) {
continue
}
t.Automation.defaultInternalAutomationPolicy = &AutomationPolicy{ t.Automation.defaultInternalAutomationPolicy = &AutomationPolicy{
IssuerRaw: json.RawMessage(`{"module":"internal"}`), IssuerRaw: json.RawMessage(`{"module":"internal"}`),
} }
@ -105,6 +131,8 @@ func (t *TLS) Provision(ctx caddy.Context) error {
if err != nil { if err != nil {
return fmt.Errorf("provisioning default internal automation policy: %v", err) return fmt.Errorf("provisioning default internal automation policy: %v", err)
} }
break
}
for i, ap := range t.Automation.Policies { for i, ap := range t.Automation.Policies {
err := ap.Provision(t) err := ap.Provision(t)
if err != nil { if err != nil {
@ -112,26 +140,6 @@ func (t *TLS) Provision(ctx caddy.Context) error {
} }
} }
// certificate loaders
val, err := ctx.LoadModule(t, "CertificatesRaw")
if err != nil {
return fmt.Errorf("loading certificate loader modules: %s", err)
}
for modName, modIface := range val.(map[string]interface{}) {
if modName == "automate" {
// special case; these will be loaded in later
// using our automation facilities, which we
// want to avoid during provisioning
if automateNames, ok := modIface.(*AutomateLoader); ok && automateNames != nil {
t.automateNames = []string(*automateNames)
} else {
return fmt.Errorf("loading certificates with 'automate' requires array of strings, got: %T", modIface)
}
continue
}
t.certificateLoaders = append(t.certificateLoaders, modIface.(CertificateLoader))
}
// session ticket ephemeral keys (STEK) service and provider // session ticket ephemeral keys (STEK) service and provider
if t.SessionTickets != nil { if t.SessionTickets != nil {
err := t.SessionTickets.provision(ctx) err := t.SessionTickets.provision(ctx)
@ -340,7 +348,7 @@ func (t *TLS) getAutomationPolicyForName(name string) *AutomationPolicy {
} }
} }
} }
if certmagic.SubjectQualifiesForPublicCert(name) { if certmagic.SubjectQualifiesForPublicCert(name) || t.Automation.defaultInternalAutomationPolicy == nil {
return t.Automation.defaultPublicAutomationPolicy return t.Automation.defaultPublicAutomationPolicy
} }
return t.Automation.defaultInternalAutomationPolicy return t.Automation.defaultInternalAutomationPolicy

Loading…
Cancel
Save