If you had HTTPS_PROXY=https://some-valid-cert.example.com running a CONNECT proxy, we should've been able to do a TLS CONNECT request to e.g. controlplane.tailscale.com:443 through that, and I'm pretty sure it used to work, but refactorings and lack of integration tests made it regress. It probably regressed when we added the baked-in LetsEncrypt root cert validation fallback code, which was testing against the wrong hostname (the ultimate one, not the one which we were being asked to validate) Fixes #16222 Change-Id: If014e395f830e2f87f056f588edacad5c15e91bc Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>main
Brad Fitzpatrick
10 months ago
committed by
Brad Fitzpatrick
parent
4979ce7a94
commit
e92eb6b17b
@ -0,0 +1,81 @@ |
||||
// Copyright (c) Tailscale Inc & AUTHORS
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
// The proxy-test-server command is a simple HTTP proxy server for testing
|
||||
// Tailscale's client proxy functionality.
|
||||
package main |
||||
|
||||
import ( |
||||
"crypto/tls" |
||||
"flag" |
||||
"fmt" |
||||
"log" |
||||
"net" |
||||
"net/http" |
||||
"os" |
||||
"strings" |
||||
|
||||
"golang.org/x/crypto/acme/autocert" |
||||
"tailscale.com/net/connectproxy" |
||||
"tailscale.com/tempfork/acme" |
||||
) |
||||
|
||||
var ( |
||||
listen = flag.String("listen", ":8080", "Address to listen on for HTTPS proxy requests") |
||||
hostname = flag.String("hostname", "localhost", "Hostname for the proxy server") |
||||
tailscaleOnly = flag.Bool("tailscale-only", true, "Restrict proxy to Tailscale targets only") |
||||
extraAllowedHosts = flag.String("allow-hosts", "", "Comma-separated list of allowed target hosts to additionally allow if --tailscale-only is true") |
||||
) |
||||
|
||||
func main() { |
||||
flag.Parse() |
||||
|
||||
am := &autocert.Manager{ |
||||
HostPolicy: autocert.HostWhitelist(*hostname), |
||||
Prompt: autocert.AcceptTOS, |
||||
Cache: autocert.DirCache(os.ExpandEnv("$HOME/.cache/autocert/proxy-test-server")), |
||||
} |
||||
var allowTarget func(hostPort string) error |
||||
if *tailscaleOnly { |
||||
allowTarget = func(hostPort string) error { |
||||
host, port, err := net.SplitHostPort(hostPort) |
||||
if err != nil { |
||||
return fmt.Errorf("invalid target %q: %v", hostPort, err) |
||||
} |
||||
if port != "443" { |
||||
return fmt.Errorf("target %q must use port 443", hostPort) |
||||
} |
||||
for allowed := range strings.SplitSeq(*extraAllowedHosts, ",") { |
||||
if host == allowed { |
||||
return nil // explicitly allowed target
|
||||
} |
||||
} |
||||
if !strings.HasSuffix(host, ".tailscale.com") { |
||||
return fmt.Errorf("target %q is not a Tailscale host", hostPort) |
||||
} |
||||
return nil // valid Tailscale target
|
||||
} |
||||
} |
||||
|
||||
go func() { |
||||
if err := http.ListenAndServe(":http", am.HTTPHandler(nil)); err != nil { |
||||
log.Fatalf("autocert HTTP server failed: %v", err) |
||||
} |
||||
}() |
||||
hs := &http.Server{ |
||||
Addr: *listen, |
||||
Handler: &connectproxy.Handler{ |
||||
Check: allowTarget, |
||||
Logf: log.Printf, |
||||
}, |
||||
TLSConfig: &tls.Config{ |
||||
GetCertificate: am.GetCertificate, |
||||
NextProtos: []string{ |
||||
"http/1.1", // enable HTTP/2
|
||||
acme.ALPNProto, // enable tls-alpn ACME challenges
|
||||
}, |
||||
}, |
||||
} |
||||
log.Printf("Starting proxy-test-server on %s (hostname: %q)\n", *listen, *hostname) |
||||
log.Fatal(hs.ListenAndServeTLS("", "")) // cert and key are provided by autocert
|
||||
} |
||||
@ -0,0 +1,93 @@ |
||||
// Copyright (c) Tailscale Inc & AUTHORS
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
// Package connectproxy contains some CONNECT proxy code.
|
||||
package connectproxy |
||||
|
||||
import ( |
||||
"context" |
||||
"io" |
||||
"log" |
||||
"net" |
||||
"net/http" |
||||
"time" |
||||
|
||||
"tailscale.com/net/netx" |
||||
"tailscale.com/types/logger" |
||||
) |
||||
|
||||
// Handler is an HTTP CONNECT proxy handler.
|
||||
type Handler struct { |
||||
// Dial, if non-nil, is an alternate dialer to use
|
||||
// instead of the default dialer.
|
||||
Dial netx.DialFunc |
||||
|
||||
// Logf, if non-nil, is an alterate logger to
|
||||
// use instead of log.Printf.
|
||||
Logf logger.Logf |
||||
|
||||
// Check, if non-nil, validates the CONNECT target.
|
||||
Check func(hostPort string) error |
||||
} |
||||
|
||||
func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { |
||||
ctx := r.Context() |
||||
if r.Method != "CONNECT" { |
||||
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed) |
||||
return |
||||
} |
||||
|
||||
dial := h.Dial |
||||
if dial == nil { |
||||
var d net.Dialer |
||||
dial = d.DialContext |
||||
} |
||||
logf := h.Logf |
||||
if logf == nil { |
||||
logf = log.Printf |
||||
} |
||||
|
||||
hostPort := r.RequestURI |
||||
if h.Check != nil { |
||||
if err := h.Check(hostPort); err != nil { |
||||
logf("CONNECT target %q not allowed: %v", hostPort, err) |
||||
http.Error(w, "Invalid CONNECT target", http.StatusForbidden) |
||||
return |
||||
} |
||||
} |
||||
|
||||
ctx, cancel := context.WithTimeout(ctx, 15*time.Second) |
||||
defer cancel() |
||||
back, err := dial(ctx, "tcp", hostPort) |
||||
if err != nil { |
||||
logf("error CONNECT dialing %v: %v", hostPort, err) |
||||
http.Error(w, "Connect failure", http.StatusBadGateway) |
||||
return |
||||
} |
||||
defer back.Close() |
||||
|
||||
hj, ok := w.(http.Hijacker) |
||||
if !ok { |
||||
http.Error(w, "CONNECT hijack unavailable", http.StatusInternalServerError) |
||||
return |
||||
} |
||||
c, br, err := hj.Hijack() |
||||
if err != nil { |
||||
logf("CONNECT hijack: %v", err) |
||||
return |
||||
} |
||||
defer c.Close() |
||||
|
||||
io.WriteString(c, "HTTP/1.1 200 OK\r\n\r\n") |
||||
|
||||
errc := make(chan error, 2) |
||||
go func() { |
||||
_, err := io.Copy(c, back) |
||||
errc <- err |
||||
}() |
||||
go func() { |
||||
_, err := io.Copy(back, br) |
||||
errc <- err |
||||
}() |
||||
<-errc |
||||
} |
||||
@ -0,0 +1,5 @@ |
||||
-----BEGIN EC PRIVATE KEY----- |
||||
MHcCAQEEIHcxOQNVyqvBSSlu7c93QW6OsyccjL+R1evW4acd32MWoAoGCCqGSM49 |
||||
AwEHoUQDQgAEIOY5/CQ8CMuKYPLf+r6OEneqfzQ5RfgPnLdkL22qhm8xb69ZCXxz |
||||
UecawU0KEDfHLYbUYXSuhAFxxuPh9I3x5Q== |
||||
-----END EC PRIVATE KEY----- |
||||
@ -0,0 +1,5 @@ |
||||
-----BEGIN EC PRIVATE KEY----- |
||||
MHcCAQEEING1XBDWFXQjqBmLjhp20hXOf2rk/I0N6W7muv9RVvk3oAoGCCqGSM49 |
||||
AwEHoUQDQgAE8lxnEEeLqYikwmXbXSsIQSw20R0oLA831s960KQZEgt0P9SbWcJc |
||||
QTk98rdfYT/QDdHn157Oh4FPcDtxmdQ4vw== |
||||
-----END EC PRIVATE KEY----- |
||||
@ -0,0 +1,5 @@ |
||||
-----BEGIN EC PRIVATE KEY----- |
||||
MHcCAQEEIMl3xjqt1dnXBpYJSEqevirAcnSJ79I2tucdRazlrDG9oAoGCCqGSM49 |
||||
AwEHoUQDQgAEQ/+Jme+16hgO7TtPSIFHVV0Yt969ltVlARVcNUZmWc0upQaq7uiJ |
||||
Aur5KtzwxU3YI4bhNK0593OK2TLvEEWIdw== |
||||
-----END EC PRIVATE KEY----- |
||||
@ -0,0 +1,167 @@ |
||||
// Copyright (c) Tailscale Inc & AUTHORS
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
// Package tlstest contains code to help test Tailscale's client proxy support.
|
||||
package tlstest |
||||
|
||||
import ( |
||||
"bytes" |
||||
"crypto/ecdsa" |
||||
"crypto/rand" |
||||
"crypto/tls" |
||||
"crypto/x509" |
||||
"crypto/x509/pkix" |
||||
_ "embed" |
||||
"encoding/pem" |
||||
"fmt" |
||||
"math/big" |
||||
"sync" |
||||
"time" |
||||
) |
||||
|
||||
// Some baked-in ECDSA keys to speed up tests, not having to burn CPU to
|
||||
// generate them each time. We only make the certs (which have expiry times)
|
||||
// at runtime.
|
||||
//
|
||||
// They were made with:
|
||||
//
|
||||
// openssl ecparam -name prime256v1 -genkey -noout -out root-ca.key
|
||||
var ( |
||||
//go:embed testdata/root-ca.key
|
||||
rootCAKeyPEM []byte |
||||
|
||||
// TestProxyServerKey is the PEM private key for [TestProxyServerCert].
|
||||
//
|
||||
//go:embed testdata/proxy.tstest.key
|
||||
TestProxyServerKey []byte |
||||
|
||||
// TestControlPlaneKey is the PEM private key for [TestControlPlaneCert].
|
||||
//
|
||||
//go:embed testdata/controlplane.tstest.key
|
||||
TestControlPlaneKey []byte |
||||
) |
||||
|
||||
// TestRootCA returns a self-signed ECDSA root CA certificate (as PEM) for
|
||||
// testing purposes.
|
||||
func TestRootCA() []byte { |
||||
return bytes.Clone(testRootCAOncer()) |
||||
} |
||||
|
||||
var testRootCAOncer = sync.OnceValue(func() []byte { |
||||
key := rootCAKey() |
||||
now := time.Now().Add(-time.Hour) |
||||
tpl := &x509.Certificate{ |
||||
SerialNumber: big.NewInt(1), |
||||
Subject: pkix.Name{ |
||||
CommonName: "Tailscale Unit Test ECDSA Root", |
||||
Organization: []string{"Tailscale Test Org"}, |
||||
}, |
||||
NotBefore: now, |
||||
NotAfter: now.AddDate(5, 0, 0), |
||||
|
||||
IsCA: true, |
||||
BasicConstraintsValid: true, |
||||
KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign, |
||||
SubjectKeyId: mustSKID(&key.PublicKey), |
||||
} |
||||
|
||||
der, err := x509.CreateCertificate(rand.Reader, tpl, tpl, &key.PublicKey, key) |
||||
if err != nil { |
||||
panic(err) |
||||
} |
||||
return pemCert(der) |
||||
}) |
||||
|
||||
func pemCert(der []byte) []byte { |
||||
var buf bytes.Buffer |
||||
if err := pem.Encode(&buf, &pem.Block{Type: "CERTIFICATE", Bytes: der}); err != nil { |
||||
panic(fmt.Sprintf("failed to encode PEM: %v", err)) |
||||
} |
||||
return buf.Bytes() |
||||
} |
||||
|
||||
var rootCAKey = sync.OnceValue(func() *ecdsa.PrivateKey { |
||||
return mustParsePEM(rootCAKeyPEM, x509.ParseECPrivateKey) |
||||
}) |
||||
|
||||
func mustParsePEM[T any](pemBytes []byte, parse func([]byte) (T, error)) T { |
||||
block, rest := pem.Decode(pemBytes) |
||||
if block == nil || len(rest) > 0 { |
||||
panic("invalid PEM") |
||||
} |
||||
v, err := parse(block.Bytes) |
||||
if err != nil { |
||||
panic(fmt.Sprintf("invalid PEM: %v", err)) |
||||
} |
||||
return v |
||||
} |
||||
|
||||
// KeyPair is a simple struct to hold a certificate and its private key.
|
||||
type KeyPair struct { |
||||
Domain string |
||||
KeyPEM []byte // PEM-encoded private key
|
||||
} |
||||
|
||||
// ServerTLSConfig returns a TLS configuration suitable for a server
|
||||
// using the KeyPair's certificate and private key.
|
||||
func (p KeyPair) ServerTLSConfig() *tls.Config { |
||||
cert, err := tls.X509KeyPair(p.CertPEM(), p.KeyPEM) |
||||
if err != nil { |
||||
panic("invalid TLS key pair: " + err.Error()) |
||||
} |
||||
return &tls.Config{ |
||||
Certificates: []tls.Certificate{cert}, |
||||
} |
||||
} |
||||
|
||||
// ProxyServerKeyPair is a KeyPair for a test control plane server
|
||||
// with domain name "proxy.tstest".
|
||||
var ProxyServerKeyPair = KeyPair{ |
||||
Domain: "proxy.tstest", |
||||
KeyPEM: TestProxyServerKey, |
||||
} |
||||
|
||||
// ControlPlaneKeyPair is a KeyPair for a test control plane server
|
||||
// with domain name "controlplane.tstest".
|
||||
var ControlPlaneKeyPair = KeyPair{ |
||||
Domain: "controlplane.tstest", |
||||
KeyPEM: TestControlPlaneKey, |
||||
} |
||||
|
||||
func (p KeyPair) CertPEM() []byte { |
||||
caCert := mustParsePEM(TestRootCA(), x509.ParseCertificate) |
||||
caPriv := mustParsePEM(rootCAKeyPEM, x509.ParseECPrivateKey) |
||||
leafKey := mustParsePEM(p.KeyPEM, x509.ParseECPrivateKey) |
||||
|
||||
serial, err := rand.Int(rand.Reader, big.NewInt(0).Lsh(big.NewInt(1), 128)) |
||||
if err != nil { |
||||
panic(err) |
||||
} |
||||
|
||||
now := time.Now().Add(-time.Hour) |
||||
tpl := &x509.Certificate{ |
||||
SerialNumber: serial, |
||||
Subject: pkix.Name{CommonName: p.Domain}, |
||||
NotBefore: now, |
||||
NotAfter: now.AddDate(2, 0, 0), |
||||
|
||||
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment, |
||||
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, |
||||
BasicConstraintsValid: true, |
||||
DNSNames: []string{p.Domain}, |
||||
} |
||||
|
||||
der, err := x509.CreateCertificate(rand.Reader, tpl, caCert, &leafKey.PublicKey, caPriv) |
||||
if err != nil { |
||||
panic(err) |
||||
} |
||||
return pemCert(der) |
||||
} |
||||
|
||||
func mustSKID(pub *ecdsa.PublicKey) []byte { |
||||
skid, err := x509.MarshalPKIXPublicKey(pub) |
||||
if err != nil { |
||||
panic(err) |
||||
} |
||||
return skid[:20] // same as x509 library
|
||||
} |
||||
Loading…
Reference in new issue