Merge pull request #247 from SenseUnit/fix_mtls_go1.27.0

Add workaround to fix mTLS auth on early versions of go1.27

Author: Snawoot

auth/cert.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"crypto/tls"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -16,9 +17,10 @@ import (
 	"time"
 
 	clog "github.com/SenseUnit/dumbproxy/log"
-	"github.com/hashicorp/go-multierror"
+	"github.com/SenseUnit/dumbproxy/tlsutil"
 
 	us "github.com/Snawoot/uniqueslice"
+	"github.com/hashicorp/go-multierror"
 )
 
 type serialNumberSetFile struct {
@@ -94,10 +96,26 @@ func (auth *CertAuth) handleReject(ctx context.Context, wr http.ResponseWriter,
 }
 
 func (auth *CertAuth) Validate(ctx context.Context, wr http.ResponseWriter, req *http.Request) (string, bool) {
-	if req.TLS == nil || len(req.TLS.VerifiedChains) < 1 || len(req.TLS.VerifiedChains[0]) < 1 {
+	cs := req.TLS
+	if cs == nil {
+		auth.logger.Debug("resorting to workaround for go bug #81384")
+		// could be issue https://go.dev/issue/81384
+		conn, ok := tlsutil.ConnFromContext(ctx)
+		if ok {
+			if cstater, ok := conn.(interface{ ConnectionState() tls.ConnectionState }); ok {
+				cs = new(tls.ConnectionState)
+				*cs = cstater.ConnectionState()
+			} else {
+				auth.logger.Debug("...and conn does not support required interface!")
+			}
+		} else {
+			auth.logger.Debug("...and conn was not recovered from context!")
+		}
+	}
+	if cs == nil || len(cs.VerifiedChains) < 1 || len(cs.VerifiedChains[0]) < 1 {
 		return auth.handleReject(ctx, wr, req)
 	}
-	eeCert := req.TLS.VerifiedChains[0][0]
+	eeCert := cs.VerifiedChains[0][0]
 	if auth.blacklist.Load().file.Has(eeCert.SerialNumber) {
 		return auth.handleReject(ctx, wr, req)
 	}

auth/tlscookie.go

@@ -87,9 +87,14 @@ func (auth *TLSCookieAuth) addLearned(sessionID tlsutil.TLSSessionID) {
 }
 
 func (auth *TLSCookieAuth) Validate(ctx context.Context, wr http.ResponseWriter, req *http.Request) (string, bool) {
-	sessionID, ok := tlsutil.TLSSessionIDFromContext(ctx)
+	conn, ok := tlsutil.ConnFromContext(ctx)
 	if !ok {
-		auth.logger.Debug("tlscookie: no session extracted for %s", req.RemoteAddr)
+		auth.logger.Debug("tlscookie: no conn found in context for %s", req.RemoteAddr)
+		return auth.handleReject(ctx, wr, req)
+	}
+	sessionID, ok := tlsutil.GetTLSSessionID(conn)
+	if !ok {
+		auth.logger.Debug("tlscookie: no session ID recovered for %s", req.RemoteAddr)
 		return auth.handleReject(ctx, wr, req)
 	}
 	if auth.hiddenDomain != "" {

main.go

@@ -963,7 +963,7 @@ func run() int {
 				return stopContext
 			},
 			ConnContext: func(ctx context.Context, conn net.Conn) context.Context {
-				return tlsutil.TLSSessionIDToContext(ctx, conn)
+				return tlsutil.ConnToContext(ctx, conn)
 			},
 		}
 		if args.disableHTTP2 {

tlsutil/session.go

@@ -63,17 +63,14 @@ func GetTLSSessionID(conn net.Conn) (TLSSessionID, bool) {
 	return getTLSSessionID(tagger)
 }
 
-func TLSSessionIDToContext(ctx context.Context, conn net.Conn) context.Context {
+func ConnToContext(ctx context.Context, conn net.Conn) context.Context {
 	return context.WithValue(ctx, connKey{}, conn)
 }
 
-func TLSSessionIDFromContext(ctx context.Context) (TLSSessionID, bool) {
+func ConnFromContext(ctx context.Context) (net.Conn, bool) {
 	val := ctx.Value(connKey{})
 	conn, ok := val.(net.Conn)
-	if !ok {
-		return TLSSessionID{}, false
-	}
-	return GetTLSSessionID(conn)
+	return conn, ok
 }
 
 func EnableTLSCookies(cfg *tls.Config, logger *clog.CondLogger) *tls.Config {