homelab/traefik
1
0
Fork 0
Code Activity

acme: new HTTP and TLS challenges implementations.

Browse source
This commit is contained in:
Ludovic Fernandez 2020-10-29 15:40:04 +01:00 • committed by GitHub
parent 49cdb67ddc
commit 05333b9579
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
13 changed files with 398 additions and 254 deletions
Download patch file Download diff file Expand all files Collapse all files

24
pkg/tls/tlsmanager.go
View file

@ -20,12 +20,11 @@ var DefaultTLSOptions = Options{}
// Manager is the TLS option/store/configuration factory.
type Manager struct {
storesConfig map[string]Store
stores map[string]*CertificateStore
configs map[string]Options
certs []*CertAndStores
TLSAlpnGetter func(string) (*tls.Certificate, error)
lock sync.RWMutex
storesConfig map[string]Store
stores map[string]*CertificateStore
configs map[string]Options
certs []*CertAndStores
lock sync.RWMutex
}
// NewManager creates a new Manager.
@ -95,6 +94,7 @@ func (m *Manager) Get(storeName, configName string) (*tls.Config, error) {
}
store := m.getStore(storeName)
acmeTLSStore := m.getStore(tlsalpn01.ACMETLS1Protocol)
if err == nil {
tlsConfig, err = buildTLSConfig(config)
@ -106,15 +106,13 @@ func (m *Manager) Get(storeName, configName string) (*tls.Config, error) {
tlsConfig.GetCertificate = func(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
domainToCheck := types.CanonicalDomain(clientHello.ServerName)
if m.TLSAlpnGetter != nil && isACMETLS(clientHello) {
cert, err := m.TLSAlpnGetter(domainToCheck)
if err != nil {
return nil, err
if isACMETLS(clientHello) {
certificate := acmeTLSStore.GetBestCertificate(clientHello)
if certificate == nil {
return nil, fmt.Errorf("no certificate for TLSALPN challenge: %s", domainToCheck)
}
if cert != nil {
return cert, nil
}
return certificate, nil
}
bestCertificate := store.GetBestCertificate(clientHello)