webnet/tailscale
1
0
Fork 0
Code Issues 1 Pull Requests 1 Packages Projects Releases Wiki Activity

derp/derpserver,cmd/derper: use slices.Clip for cert chain copies (#20484)

Browse Source
This commit is contained in:
Mike O'Driscoll
2026-07-15 22:13:27 -04:00
committed by GitHub
parent bf7d815631
commit 71b90de0d4
2 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/derper/cert.go
+4 -4
View File
@@ -23,6 +23,7 @@ import (
"os" "os"
"path/filepath" "path/filepath"
"regexp" "regexp"
"slices"
"time" "time"
"golang.org/x/crypto/acme" "golang.org/x/crypto/acme"
@@ -158,10 +159,9 @@ func (m *manualCertManager) getCertificate(hi *tls.ClientHelloInfo) (*tls.Certif
// Return a shallow copy of the cert with a capacity-clamped chain // Return a shallow copy of the cert with a capacity-clamped chain
// so callers can never mutate the manager's long-lived certificate. // so callers can never mutate the manager's long-lived certificate.
certCopy := new(tls.Certificate) certCopy := *m.cert
*certCopy = *m.cert certCopy.Certificate = slices.Clip(certCopy.Certificate)
certCopy.Certificate = certCopy.Certificate[:len(certCopy.Certificate):len(certCopy.Certificate)] return &certCopy, nil
return certCopy, nil
} }
func (m *manualCertManager) HTTPHandler(fallback http.Handler) http.Handler { func (m *manualCertManager) HTTPHandler(fallback http.Handler) http.Handler {
derp/derpserver/derpserver.go
+1 -2
View File
@@ -744,8 +744,7 @@ func (s *Server) ModifyTLSConfigToAddMetaCert(c *tls.Config) {
// cached value. Return a shallow copy with the meta cert // cached value. Return a shallow copy with the meta cert
// appended to a freshly allocated chain slice. // appended to a freshly allocated chain slice.
certCopy := *cert certCopy := *cert
chain := cert.Certificate certCopy.Certificate = append(slices.Clip(cert.Certificate), s.MetaCert())
certCopy.Certificate = append(chain[:len(chain):len(chain)], s.MetaCert())
return &certCopy, nil return &certCopy, nil
} }
} }