TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-03-01 19:51:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

cmd/derper: provide support for forcing autocert renewals

Browse Source 
Change-Id: I127a803144ec5ca989823610f1bbd21dc5cfadba
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
This commit is contained in:
Brad Fitzpatrick 2022-01-26 12:16:02 -08:00
parent 1af26222b6
commit b1cf0a04d6
1 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
cmd/derper/cert.go
View File

@ -10,8 +10,11 @@ import (
"errors"
"fmt"
"net/http"
"os"
"path/filepath"
"regexp"
"strings"
"time"
"golang.org/x/crypto/acme/autocert"
)
@ -39,6 +42,24 @@ func certProviderByCertMode(mode, dir, hostname string) (certProvider, error) {
if hostname == "derp.tailscale.com" {
certManager.HostPolicy = prodAutocertHostPolicy
certManager.Email = "security@tailscale.com"
if v, err := os.ReadFile("/home/derp/forcerenew.secret"); err == nil {
proto := strings.TrimSpace(string(v))
am2 := *certManager
am2.RenewBefore = 89 * 24 * time.Hour
defGetCertificate := certManager.TLSConfig().GetCertificate
tlsConf2 := am2.TLSConfig()
getCertificate := func(hi *tls.ClientHelloInfo) (*tls.Certificate, error) {
for _, p := range hi.SupportedProtos {
if p == proto {
return tlsConf2.GetCertificate(hi)
}
}
return defGetCertificate(hi)
}
altConf := certManager.TLSConfig()
altConf.GetCertificate = getCertificate
return altConfig{certManager, altConf}, nil
}
}
return certManager, nil
case "manual":
@ -48,6 +69,14 @@ func certProviderByCertMode(mode, dir, hostname string) (certProvider, error) {
}
}
// altConfig is a certProvider wrapper that returns an explicit tls.Config.
type altConfig struct {
certProvider
tlsConfig *tls.Config
}
func (ac altConfig) TLSConfig() *tls.Config { return ac.tlsConfig }
type manualCertManager struct {
cert *tls.Certificate
hostname string