caddytls: Support wildcard matching in ServerName conn policy matcher

1 files changed, 18 insertions, 2 deletions

diff --git a/modules/caddytls/matchers.go b/modules/caddytls/matchers.go
index 9e2dfc5..1f5f9b6 100644
--- a/modules/caddytls/matchers.go
+++ b/modules/caddytls/matchers.go
@@ -16,6 +16,7 @@ package caddytls
 
 import (
 	"crypto/tls"
+	"strings"
 
 	"github.com/caddyserver/caddy/v2"
 )
@@ -24,7 +25,9 @@ func init() {
 	caddy.RegisterModule(MatchServerName{})
 }
 
-// MatchServerName matches based on SNI.
+// MatchServerName matches based on SNI. Names in
+// this list may use left-most-label wildcards,
+// similar to wildcard certificates.
 type MatchServerName []string
 
 // CaddyModule returns the Caddy module information.
@@ -38,10 +41,23 @@ func (MatchServerName) CaddyModule() caddy.ModuleInfo {
 // Match matches hello based on SNI.
 func (m MatchServerName) Match(hello *tls.ClientHelloInfo) bool {
 	for _, name := range m {
-		// TODO: support wildcards (and regex?)
 		if hello.ServerName == name {
 			return true
 		}
+
+		// check for wildcard match on this name, but only
+		// bother if there is even a wildcard character
+		if !strings.Contains(name, "*") {
+			continue
+		}
+		labels := strings.Split(hello.ServerName, ".")
+		for i := range labels {
+			labels[i] = "*"
+			candidate := strings.Join(labels, ".")
+			if candidate == name {
+				return true
+			}
+		}
 	}
 	return false
 }