f/twins-upstream
1
0
Fork 0
mirror of https://code.rocketnine.space/tslocum/twins.git synced 2024-11-27 12:38:14 +01:00
Code Issues Projects Releases Wiki Activity

Include client certificate hashes in FastCGI requests

Browse source
This commit is contained in:
Trevor Slocum 2020-12-15 14:02:25 -08:00
parent 74dc22338e
commit 207e7c4030
5 changed files with 21 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
CONFIGURATION.md
View file

@ -129,9 +129,12 @@ for more information.
##### FastCGI
Forward requests to [FastCGI](https://en.wikipedia.org/wiki/FastCGI) server at
specified address or path.
specified address or path. A `Root` attribute must also be specified.
A `Root` attribute must also be specified.
When a client certificate is provided with a request, the SHA-1 hash of the
first certificate is available as `$_SERVER['CLIENT_CERT_A']`. If a second
certificate is provided, it is available as `$_SERVER['CLIENT_CERT_B']`, and so
on.
Connect via Unix socket:

2
go.mod
View file

@ -7,6 +7,6 @@ require (
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
github.com/yookoala/gofast v0.4.1-0.20201013050739-975113c54107
gitlab.com/tslocum/gmitohtml v1.0.3-0.20201203184239-2a1abe8efe7c
golang.org/x/tools v0.0.0-20201206230334-368bee879bfd // indirect
golang.org/x/tools v0.0.0-20201215192005-fa10ef0b8743 // indirect
gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776
)

4
go.sum
View file

@ -36,8 +36,8 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20200908211811-12e1bf57a112/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
golang.org/x/tools v0.0.0-20201206230334-368bee879bfd h1:EqFvKLTxjH6gEy2baWxX2AgJwZkBIDIcZFYcoYlI9RA=
golang.org/x/tools v0.0.0-20201206230334-368bee879bfd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
golang.org/x/tools v0.0.0-20201215192005-fa10ef0b8743 h1:SLHKXsC4wI4NdEGVGe/yxcTBkF/mPUS7agW3Qt5smVg=
golang.org/x/tools v0.0.0-20201215192005-fa10ef0b8743/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

12
serve_fcgi.go
View file

@ -2,10 +2,12 @@ package main
import (
"bytes"
"crypto/sha1"
"crypto/tls"
"fmt"
"io"
"io/ioutil"
"log"
"net"
"net/http"
"net/url"
"path/filepath"
@ -34,7 +36,7 @@ func (w *fakeResponseWriter) WriteHeader(statusCode int) {
// Do nothing
}
func serveFastCGI(c net.Conn, connFactory gofast.ConnFactory, u *url.URL, filePath string) {
func serveFastCGI(c *tls.Conn, connFactory gofast.ConnFactory, u *url.URL, filePath string) {
header := map[string][]string{
"Accept": {"*/*"},
"Host": {u.Hostname()},
@ -73,6 +75,12 @@ func serveFastCGI(c net.Conn, connFactory gofast.ConnFactory, u *url.URL, filePa
req.Params["SCRIPT_FILENAME"] = filePath
req.Params["SCRIPT_NAME"] = filepath.Base(filePath)
certLabel := 'A'
clientCerts := c.ConnectionState().PeerCertificates
for i := 0; i < len(clientCerts) && i < 26; i++ {
req.Params["CLIENT_CERT_"+string(certLabel+rune(i))] = fmt.Sprintf("%x", sha1.Sum(clientCerts[i].Raw))
}
w := newFakeResponseWriter(c)
client, err := gofast.SimpleClientFactory(connFactory, 0)()

5
server.go
View file

@ -491,8 +491,9 @@ func getCertificate(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
func listen(address string) {
tlsConfig := &tls.Config{
ClientAuth: tls.RequestClientCert,
GetCertificate: getCertificate,
ClientAuth: tls.RequestClientCert,
GetCertificate: getCertificate,
InsecureSkipVerify: true,
}
listener, err := tls.Listen("tcp", address, tlsConfig)