aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorAlex Auvolat <alex@adnab.me>2021-12-08 11:11:22 +0100
committerAlex Auvolat <alex@adnab.me>2021-12-08 11:11:22 +0100
commit098a6cf2cdb9b0370ab7358b005f731b65e9981c (patch)
tree80e862f2ba2aeb03a33ab8e4fcb05d4a221dd308 /src
parent11c6f0b1c29b10893de9390f5be559de49e78410 (diff)
downloadtricot-098a6cf2cdb9b0370ab7358b005f731b65e9981c.tar.gz
tricot-098a6cf2cdb9b0370ab7358b005f731b65e9981c.zip
Implement glob pattern hostnames
no wildcard certificates: one certificate per matching hostname that actually recieves requests
Diffstat (limited to 'src')
-rw-r--r--src/cert_store.rs10
-rw-r--r--src/https.rs2
-rw-r--r--src/proxy_config.rs35
3 files changed, 40 insertions, 7 deletions
diff --git a/src/cert_store.rs b/src/cert_store.rs
index f1b7d2b..8d45df4 100644
--- a/src/cert_store.rs
+++ b/src/cert_store.rs
@@ -14,7 +14,7 @@ use rustls::sign::CertifiedKey;
use crate::cert::{Cert, CertSer};
use crate::consul::*;
-use crate::proxy_config::ProxyConfig;
+use crate::proxy_config::*;
pub struct CertStore {
consul: Consul,
@@ -39,11 +39,13 @@ impl CertStore {
let proxy_config: Arc<ProxyConfig> = rx_proxy_config.borrow().clone();
for ent in proxy_config.entries.iter() {
- domains.insert(ent.host.clone());
+ if let HostDescription::Hostname(domain) = &ent.host {
+ domains.insert(domain.clone());
+ }
}
- info!("Ensuring we have certs for domains: {:?}", domains);
for dom in domains.iter() {
+ info!("Ensuring we have certs for domains: {:?}", domains);
if let Err(e) = self.get_cert(dom).await {
warn!("Error get_cert {}: {}", dom, e);
}
@@ -58,7 +60,7 @@ impl CertStore {
.borrow()
.entries
.iter()
- .any(|ent| ent.host == domain)
+ .any(|ent| ent.host.matches(domain))
{
bail!("Domain {} should not have a TLS certificate.", domain);
}
diff --git a/src/https.rs b/src/https.rs
index 3621e4f..2d97476 100644
--- a/src/https.rs
+++ b/src/https.rs
@@ -93,7 +93,7 @@ async fn handle(
.entries
.iter()
.filter(|ent| {
- ent.host == host
+ ent.host.matches(host)
&& ent
.path_prefix
.as_ref()
diff --git a/src/proxy_config.rs b/src/proxy_config.rs
index d4fe039..9092b59 100644
--- a/src/proxy_config.rs
+++ b/src/proxy_config.rs
@@ -16,10 +16,33 @@ use crate::consul::*;
// ---- Extract proxy config from Consul catalog ----
#[derive(Debug)]
+pub enum HostDescription {
+ Hostname(String),
+ Pattern(glob::Pattern),
+}
+
+impl HostDescription {
+ fn new(desc: &str) -> Result<Self> {
+ if desc.chars().any(|x| matches!(x, '*' | '?' | '[' | ']')) {
+ Ok(Self::Pattern(glob::Pattern::new(desc)?))
+ } else {
+ Ok(Self::Hostname(desc.to_string()))
+ }
+ }
+
+ pub fn matches(&self, v: &str) -> bool {
+ match self {
+ Self::Pattern(p) => p.matches(v),
+ Self::Hostname(s) => s == v,
+ }
+ }
+}
+
+#[derive(Debug)]
pub struct ProxyEntry {
pub target_addr: SocketAddr,
- pub host: String,
+ pub host: HostDescription,
pub path_prefix: Option<String>,
pub priority: u32,
pub add_headers: Vec<(String, String)>,
@@ -65,9 +88,17 @@ fn parse_tricot_tag(
_ => 100,
};
+ let host = match HostDescription::new(host) {
+ Ok(h) => h,
+ Err(e) => {
+ warn!("Invalid hostname pattern {}: {}", host, e);
+ return None;
+ }
+ };
+
Some(ProxyEntry {
target_addr,
- host: host.to_string(),
+ host,
path_prefix,
priority,
add_headers: add_headers.to_vec(),