From ab2c98d931b167c305f4dc19ff3fb16057693060 Mon Sep 17 00:00:00 2001 From: Daniel Tomcej Date: Tue, 18 Sep 2018 01:22:03 -0500 Subject: [PATCH] Ensure only certificates from ACME enabled entrypoint are used --- cmd/traefik/traefik.go | 14 +++-- integration/acme_test.go | 20 ++++++- .../acme/acme_tls_multiple_entrypoints.toml | 59 +++++++++++++++++++ integration/https_test.go | 28 ++++----- 4 files changed, 99 insertions(+), 22 deletions(-) create mode 100644 integration/fixtures/acme/acme_tls_multiple_entrypoints.toml diff --git a/cmd/traefik/traefik.go b/cmd/traefik/traefik.go index 8cf540dac..412027507 100644 --- a/cmd/traefik/traefik.go +++ b/cmd/traefik/traefik.go @@ -200,22 +200,24 @@ func runCmd(globalConfiguration *configuration.GlobalConfiguration, configFile s internalRouter := router.NewInternalRouterAggregator(*globalConfiguration, entryPointName) if acmeprovider != nil { - if acmeprovider.HTTPChallenge != nil && acmeprovider.HTTPChallenge.EntryPoint == entryPointName { + if acmeprovider.HTTPChallenge != nil && entryPointName == acmeprovider.HTTPChallenge.EntryPoint { internalRouter.AddRouter(acmeprovider) } // TLS ALPN 01 - if acmeprovider.HTTPChallenge == nil && acmeprovider.DNSChallenge == nil && acmeprovider.TLSChallenge != nil { + if acmeprovider.TLSChallenge != nil && acmeprovider.HTTPChallenge == nil && acmeprovider.DNSChallenge == nil { entryPoint.TLSALPNGetter = acmeprovider.GetTLSALPNCertificate } - if acmeprovider.EntryPoint == entryPointName && acmeprovider.OnDemand { + if acmeprovider.OnDemand && entryPointName == acmeprovider.EntryPoint { entryPoint.OnDemandListener = acmeprovider.ListenRequest } - entryPoint.CertificateStore = traefiktls.NewCertificateStore() - acmeprovider.SetCertificateStore(entryPoint.CertificateStore) - + if entryPointName == acmeprovider.EntryPoint { + entryPoint.CertificateStore = traefiktls.NewCertificateStore() + acmeprovider.SetCertificateStore(entryPoint.CertificateStore) + log.Debugf("Setting Acme Certificate store from Entrypoint: %s", entryPointName) + } } entryPoint.InternalRouter = internalRouter diff --git a/integration/acme_test.go b/integration/acme_test.go index 906f48cf2..ebb5342c6 100644 --- a/integration/acme_test.go +++ b/integration/acme_test.go @@ -287,6 +287,22 @@ func (s *AcmeSuite) TestHTTP01OnDemandStaticCertificatesWithWildcard(c *check.C) s.retrieveAcmeCertificate(c, testCase) } +func (s *AcmeSuite) TestHTTP01OnDemandStaticCertificatesWithWildcardMultipleEntrypoints(c *check.C) { + testCase := acmeTestCase{ + traefikConfFilePath: "fixtures/acme/acme_tls_multiple_entrypoints.toml", + template: templateModel{ + Acme: acme.Configuration{ + HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"}, + OnDemand: true, + }, + }, + expectedCommonName: acmeDomain, + expectedAlgorithm: x509.RSA, + } + + s.retrieveAcmeCertificate(c, testCase) +} + func (s *AcmeSuite) TestHTTP01OnDemandDynamicCertificatesWithWildcard(c *check.C) { testCase := acmeTestCase{ traefikConfFilePath: "fixtures/acme/acme_tls_dynamic.toml", @@ -379,11 +395,11 @@ func (s *AcmeSuite) TestTLSALPN01DomainsWithProvidedWildcardDomainAtStart(c *che Acme: acme.Configuration{ TLSChallenge: &acme.TLSChallenge{}, Domains: types.Domains{types.Domain{ - Main: "traefik.acme.wtf", + Main: acmeDomain, }}, }, }, - expectedCommonName: "traefik.acme.wtf", + expectedCommonName: wildcardDomain, expectedAlgorithm: x509.RSA, } diff --git a/integration/fixtures/acme/acme_tls_multiple_entrypoints.toml b/integration/fixtures/acme/acme_tls_multiple_entrypoints.toml new file mode 100644 index 000000000..4288b0225 --- /dev/null +++ b/integration/fixtures/acme/acme_tls_multiple_entrypoints.toml @@ -0,0 +1,59 @@ +logLevel = "DEBUG" + +defaultEntryPoints = ["http", "https"] + +[entryPoints] + [entryPoints.http] + address = "{{ .PortHTTP }}" + [entryPoints.https] + address = "{{ .PortHTTPS }}" + [entryPoints.https.tls] + [entryPoints.traefik] + address = ":9000" + [entryPoints.traefik.tls] + [[entryPoints.traefik.tls.certificates]] + certFile = "fixtures/acme/ssl/wildcard.crt" + keyFile = "fixtures/acme/ssl/wildcard.key" + +[acme] + email = "test@traefik.io" + storage = "/tmp/acme.json" + entryPoint = "https" + acmeLogging = true + onDemand = {{ .Acme.OnDemand }} + onHostRule = {{ .Acme.OnHostRule }} + keyType = "{{ .Acme.KeyType }}" + caServer = "{{ .Acme.CAServer }}" + + {{if .Acme.HTTPChallenge }} + [acme.httpChallenge] + entryPoint = "{{ .Acme.HTTPChallenge.EntryPoint }}" + {{end}} + + {{if .Acme.TLSChallenge }} + [acme.tlsChallenge] + {{end}} + + {{range .Acme.Domains}} + [[acme.domains]] + main = "{{ .Main }}" + sans = [{{range .SANs }} + "{{.}}", + {{end}}] + {{end}} + +[api] + +[file] + +[backends] + [backends.backend] + [backends.backend.servers.server1] + url = "http://127.0.0.1:9010" + weight = 1 + +[frontends] + [frontends.frontend] + backend = "backend" + [frontends.frontend.routes.test] + rule = "Host:traefik.acme.wtf" diff --git a/integration/https_test.go b/integration/https_test.go index cf6dee11e..1eade1045 100644 --- a/integration/https_test.go +++ b/integration/https_test.go @@ -704,31 +704,31 @@ func (s *HTTPSSuite) TestWithSNIDynamicConfigRouteWithTlsConfigurationDeletion(c // modifyCertificateConfFileContent replaces the content of a HTTPS configuration file. func modifyCertificateConfFileContent(c *check.C, certFileName, confFileName, entryPoint string) { - f, err := os.OpenFile("./"+confFileName, os.O_WRONLY, os.ModeExclusive) + file, err := os.OpenFile("./"+confFileName, os.O_WRONLY, os.ModeExclusive) c.Assert(err, checker.IsNil) defer func() { - f.Close() + file.Close() }() - f.Truncate(0) + err = file.Truncate(0) + c.Assert(err, checker.IsNil) + // If certificate file is not provided, just truncate the configuration file if len(certFileName) > 0 { tlsConf := types.Configuration{ - TLS: []*traefiktls.Configuration{ - { - Certificate: &traefiktls.Certificate{ - CertFile: traefiktls.FileOrContent("fixtures/https/" + certFileName + ".cert"), - KeyFile: traefiktls.FileOrContent("fixtures/https/" + certFileName + ".key"), - }, - EntryPoints: []string{entryPoint}, + TLS: []*traefiktls.Configuration{{ + Certificate: &traefiktls.Certificate{ + CertFile: traefiktls.FileOrContent("fixtures/https/" + certFileName + ".cert"), + KeyFile: traefiktls.FileOrContent("fixtures/https/" + certFileName + ".key"), }, - }, + EntryPoints: []string{entryPoint}, + }}, } + var confBuffer bytes.Buffer - e := toml.NewEncoder(&confBuffer) - err := e.Encode(tlsConf) + err := toml.NewEncoder(&confBuffer).Encode(tlsConf) c.Assert(err, checker.IsNil) - _, err = f.Write(confBuffer.Bytes()) + _, err = file.Write(confBuffer.Bytes()) c.Assert(err, checker.IsNil) } }