Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

client certificates can be optional #59

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

client certificates can be optional #59

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7a6e5aa
tls can be served without client cert
lidakaml Jun 7, 2022
9334dfc
added require_client_certs option to sys.config
lidakaml Jun 7, 2022
c6a5475
if require_client_certs does not exist, require client certs by default
lidakaml Jun 7, 2022
269aef9
add require_client_certs description in readme.md
lidakaml Jun 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 13 additions & 12 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,18 +107,19 @@ of Erlang property list.

*Configuration variables*

| Variable name | Expected values | Apache equivalent | Definition
-----------------------|------------------------------------|-----------------------|--------------------------------------------
| `dev_mode` | `true`, `false` | None | Enables TCP access without TLS.
| `tls_port` | `700` | Listen | At which port should we open a TLS socket. Default is 700.
| `tcp_port` | `70000` | Listen | At which port should we open a TCP socket. Only in `dev_mode`.
| `epp_session_url` | `https://example.com/epp/session` | EppSessionRoot | HTTP address of the session endpoints including schema and port.
| `epp_command_url` | `https://example.com/epp/command` | EppCommandRoot | HTTP address of the command endpoints including schema and port.
| `epp_error_url` | `https://example.com/epp/error` | EppErrorRoot | HTTP address of the error endpoints including schema and port.
| `cacertfile_path` | `/opt/ca/ca.crt.pem` | SSLCACertificateFile | Where is the client root CA located. Can be inside apps/epp_proxy/priv or absolute path.
| `certfile_path` | `/opt/ca/server.crt.pem` | SSLCertificateFile | Where is the server certificate located. Can be inside apps/epp_proxy/priv or absolute path.
| `keyfile_path` | `/opt/ca/server.key.pem` | SSLCertificateKeyFile | Where is the server key located. Can be inside apps/epp_proxy/priv or absolute path.
| `crlfile_path` | `/opt/ca/crl.pem` | SSLCARevocationFile | Where is the CRL file located. Can be inside apps/epp_proxy/priv or absolute path. When not set, not CRL check is performed.
| Variable name | Expected values | Apache equivalent | Definition
-------------------------|------------------------------------|-----------------------|--------------------------------------------
| `dev_mode` | `true`, `false` | None | Enables TCP access without TLS.
| `tls_port` | `700` | Listen | At which port should we open a TLS socket. Default is 700.
| `tcp_port` | `70000` | Listen | At which port should we open a TCP socket. Only in `dev_mode`.
| `epp_session_url` | `https://example.com/epp/session` | EppSessionRoot | HTTP address of the session endpoints including schema and port.
| `epp_command_url` | `https://example.com/epp/command` | EppCommandRoot | HTTP address of the command endpoints including schema and port.
| `epp_error_url` | `https://example.com/epp/error` | EppErrorRoot | HTTP address of the error endpoints including schema and port.
| `require_client_certs` | `true`, `false` | None | Enables TLS connections with required or optional client certificates. Provided optional client certificates are still being verified.
| `cacertfile_path` | `/opt/ca/ca.crt.pem` | SSLCACertificateFile | Where is the client root CA located. Can be inside apps/epp_proxy/priv or absolute path.
| `certfile_path` | `/opt/ca/server.crt.pem` | SSLCertificateFile | Where is the server certificate located. Can be inside apps/epp_proxy/priv or absolute path.
| `keyfile_path` | `/opt/ca/server.key.pem` | SSLCertificateKeyFile | Where is the server key located. Can be inside apps/epp_proxy/priv or absolute path.
| `crlfile_path` | `/opt/ca/crl.pem` | SSLCARevocationFile | Where is the CRL file located. Can be inside apps/epp_proxy/priv or absolute path. When not set, not CRL check is performed.


Migrating from mod_epp
Expand Down
31 changes: 22 additions & 9 deletions apps/epp_proxy/src/epp_tls_worker.erl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,20 +169,33 @@ log_opened_connection(Ip) ->
"~p.~n",
[ReadableIp, self()]).

require_client_certs() ->
case application:get_env(epp_proxy, require_client_certs) of
{ok, false} -> false;
{ok, true} -> true;
_ -> true
end.

%% Extract state info from socket. Fail if you must.
state_from_socket(Socket, State) ->
{ok, PeerCert} = ssl:peercert(Socket),
{ok, {PeerIp, _PeerPort}} = ssl:peername(Socket),
{SSL_CLIENT_S_DN_CN, SSL_CLIENT_CERT} =
epp_certs:headers_from_cert(PeerCert),
Headers = [{"SSL-CLIENT-CERT", SSL_CLIENT_CERT},
{"SSL-CLIENT-S-DN-CN", SSL_CLIENT_S_DN_CN},
{"User-Agent", <<"EPP proxy">>},
{"X-Forwarded-for", epp_util:readable_ip(PeerIp)}],
PlainHeaders = [
{"User-Agent", <<"EPP proxy">>},
{"X-Forwarded-for", epp_util:readable_ip(PeerIp)}],
case {ssl:peercert(Socket), require_client_certs()} of
{{error, no_peercert}, false} -> Headers = PlainHeaders;
% {{error, no_peercert}, true} -> ; %% TODO: maybe send the reason of connection close
{{ok, PeerCert}, _} ->
{SSL_CLIENT_S_DN_CN, SSL_CLIENT_CERT} =
epp_certs:headers_from_cert(PeerCert),
Headers = lists:append(PlainHeaders, [
{"SSL-CLIENT-CERT", SSL_CLIENT_CERT},
{"SSL-CLIENT-S-DN-CN", SSL_CLIENT_S_DN_CN}])
end,
NewState = State#state{socket = Socket,
headers = Headers},
headers = Headers},
lager:info("Established connection with: [~p]~n",
[NewState]),
[NewState]),
NewState.

%% Get status, XML record, command and clTRID if defined.
Expand Down
2 changes: 2 additions & 0 deletions config/sys.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@
{epp_session_url, "https://registry.test/epp/session/"},
{epp_command_url, "https://registry.test/epp/command/"},
{epp_error_url, "https://registry.test/epp/error/"},
%% Allows client to connect to epp_proxy without client certificate using TLS
{require_client_certs, true},
%% Path to root CA that should check the client certificates.
{cacertfile_path, "/opt/shared/ca/certs/ca.crt.pem"},
%% Path to server's certficate file.
Expand Down