github-mirror/caddy
2
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2024-11-22 12:08:28 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

proxy: ability to use client certs in reverse proxy (#2914)

Browse Source 
* ability to use client certs in reverse proxy

* changed to http3.RoundTripper after review
This commit is contained in:
evtr 2019-12-04 23:35:36 +01:00 committed by Matt Holt
parent 6f9a39525a
commit 5ec503386c
2 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
caddyhttp/proxy/reverseproxy.go
View File

@ -337,6 +337,26 @@ func (rp *ReverseProxy) UseOwnCACertificates(CaCertPool *x509.CertPool) {
}
}
// UseClientCertificates is used to facilitate HTTPS proxying
// with locally provided certificate.
func (rp *ReverseProxy) UseClientCertificates(keyPair *tls.Certificate) {
if transport, ok := rp.Transport.(*http.Transport); ok {
if transport.TLSClientConfig == nil {
transport.TLSClientConfig = &tls.Config{}
}
transport.TLSClientConfig.Certificates = []tls.Certificate{ *keyPair }
// No http2.ConfigureTransport() here.
// For now this is only added in places where
// an http.Transport is actually created.
} else if transport, ok := rp.Transport.(*http3.RoundTripper); ok {
if transport.TLSClientConfig == nil {
transport.TLSClientConfig = &tls.Config{}
}
transport.TLSClientConfig.Certificates = []tls.Certificate{ *keyPair }
}
}
// ServeHTTP serves the proxied request to the upstream by performing a roundtrip.
// It is designed to handle websocket connection upgrades as well.
func (rp *ReverseProxy) ServeHTTP(rw http.ResponseWriter, outreq *http.Request, respUpdateFn respUpdateFn) error {

19
caddyhttp/proxy/upstream.go
View File

@ -76,6 +76,7 @@ type staticUpstream struct {
CaCertPool *x509.CertPool
upstreamHeaderReplacements headerReplacements
downstreamHeaderReplacements headerReplacements
ClientKeyPair *tls.Certificate
}
type srvResolver interface {
@ -267,6 +268,10 @@ func (u *staticUpstream) NewHost(host string) (*UpstreamHost, error) {
uh.ReverseProxy.UseOwnCACertificates(u.CaCertPool)
}
if u.ClientKeyPair != nil {
uh.ReverseProxy.UseClientCertificates(u.ClientKeyPair)
}
return uh, nil
}
@ -564,6 +569,20 @@ func parseBlock(c *caddyfile.Dispenser, u *staticUpstream, hasSrv bool) error {
return c.Errf("unable to parse timeout duration '%s'", c.Val())
}
u.Timeout = dur
case "tls_client":
if !c.NextArg() {
return c.ArgErr()
}
clientCertFile := c.Val()
if !c.NextArg() {
return c.ArgErr()
}
clientKeyFile := c.Val()
clientKeyPair, err := tls.LoadX509KeyPair(clientCertFile, clientKeyFile)
if (err != nil) {
return c.Errf("unable to load keypair from certfile:%s keyfile:%s", clientCertFile, clientKeyFile)
}
u.ClientKeyPair = &clientKeyPair
default:
return c.Errf("unknown property '%s'", c.Val())
}