From 3c1def243020a3897121d4c5badf07ed45d2397d Mon Sep 17 00:00:00 2001 From: Matthew Holt Date: Fri, 20 Mar 2020 15:51:37 -0600 Subject: caddytls: Support wildcard matching in ServerName conn policy matcher --- modules/caddytls/matchers.go | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) (limited to 'modules/caddytls/matchers.go') diff --git a/modules/caddytls/matchers.go b/modules/caddytls/matchers.go index 9e2dfc5..1f5f9b6 100644 --- a/modules/caddytls/matchers.go +++ b/modules/caddytls/matchers.go @@ -16,6 +16,7 @@ package caddytls import ( "crypto/tls" + "strings" "github.com/caddyserver/caddy/v2" ) @@ -24,7 +25,9 @@ func init() { caddy.RegisterModule(MatchServerName{}) } -// MatchServerName matches based on SNI. +// MatchServerName matches based on SNI. Names in +// this list may use left-most-label wildcards, +// similar to wildcard certificates. type MatchServerName []string // CaddyModule returns the Caddy module information. @@ -38,10 +41,23 @@ func (MatchServerName) CaddyModule() caddy.ModuleInfo { // Match matches hello based on SNI. func (m MatchServerName) Match(hello *tls.ClientHelloInfo) bool { for _, name := range m { - // TODO: support wildcards (and regex?) if hello.ServerName == name { return true } + + // check for wildcard match on this name, but only + // bother if there is even a wildcard character + if !strings.Contains(name, "*") { + continue + } + labels := strings.Split(hello.ServerName, ".") + for i := range labels { + labels[i] = "*" + candidate := strings.Join(labels, ".") + if candidate == name { + return true + } + } } return false } -- cgit v1.2.3