Mirrors/gitea
0
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-26 13:54:48 +02:00
Code Issues Activity

fix: preserve SNI for local internal API (#39412)

Browse Source 
https://github.com/go-gitea/gitea/pull/38406 stopped setting
`ServerName` on the internal API client, which
https://github.com/go-gitea/gitea/pull/5820 had added for ACME. Internal
requests to a local `LOCAL_ROOT_URL` now send SNI `localhost` (or none
for IPs). The ACME listener selects its certificate by SNI, finds none
and aborts the handshake with `tls: internal error`, breaking SSH access
and git hooks.

Send the `ROOT_URL` host as SNI again for local targets, and treat
unspecified addresses (`0.0.0.0`, `::`) as local since dialing them
reaches the local host. Remote targets are still verified against their
own hostname.

Fixes: https://github.com/go-gitea/gitea/issues/38903

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
bircni
2026-09-25 13:46:52 +00:00
committed by GitHub
co-authored by silverwind
parent 448f8c67e0
commit d42128d71d
2 changed files with 21 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/private/internal.go
+12 -15
View File
@@ -54,12 +54,7 @@ func dialContextInternalAPI(ctx context.Context, network, address string) (conn
return conn, nil
}
// internalAPIConnectionIsLocal reports whether the internal API transport connects to a local target,
// where the self-signed local certificate cannot be verified so skipping verification is safe. It mirrors
// what dialContextInternalAPI actually dials: a unix socket whenever Protocol is HTTPUnix (always local,
// whatever LOCAL_ROOT_URL says), otherwise the LOCAL_ROOT_URL host directly. A non-loopback LOCAL_ROOT_URL
// is a real network hop, so its certificate must be verified, else the internal token can be MITM'd. An
// unparseable LOCAL_ROOT_URL is a hard misconfiguration and fails closed (verify).
// unspecified IPs dial the local host too, other targets are network hops that must be verified to protect INTERNAL_TOKEN
func internalAPIConnectionIsLocal(protocol setting.Scheme, localURL string) bool {
if protocol == setting.HTTPUnix {
return true
@@ -73,19 +68,21 @@ func internalAPIConnectionIsLocal(protocol setting.Scheme, localURL string) bool
return true
}
ip := net.ParseIP(host)
return ip != nil && ip.IsLoopback()
return ip != nil && (ip.IsLoopback() || ip.IsUnspecified())
}
func internalAPITLSConfig(protocol setting.Scheme, localURL, domain string) *tls.Config {
if internalAPIConnectionIsLocal(protocol, localURL) {
// the ACME listener selects its certificate by SNI, so send the public domain instead of the local host
return &tls.Config{InsecureSkipVerify: true, ServerName: domain}
}
return &tls.Config{}
}
var internalAPITransport = sync.OnceValue(func() http.RoundTripper {
return &http.Transport{
DialContext: dialContextInternalAPI,
TLSClientConfig: &tls.Config{
// Skip verification only for a local target (unix socket, or a loopback LOCAL_ROOT_URL), where the
// self-signed local cert can't be verified anyway; a non-loopback LOCAL_ROOT_URL is a real network
// hop and must be verified so the internal token can't be MITM'd. When verifying, Go's default
// ServerName (the dialed LOCAL_ROOT_URL host) is already correct, so it is not overridden.
InsecureSkipVerify: internalAPIConnectionIsLocal(setting.Protocol, setting.LocalURL),
},
DialContext: dialContextInternalAPI,
TLSClientConfig: internalAPITLSConfig(setting.Protocol, setting.LocalURL, setting.AppDomain),
}
})
modules/private/internal_test.go
+9 -4
View File
@@ -7,23 +7,26 @@ import (
"testing"
"gitea.dev/modules/setting"
"gitea.dev/modules/util"
"github.com/stretchr/testify/assert"
)
func TestInternalAPIConnectionIsLocal(t *testing.T) {
func TestInternalAPITLSConfig(t *testing.T) {
cases := []struct {
name string
protocol setting.Scheme
localURL string
want bool
local bool
}{
// HTTPUnix always dials the unix socket (a local target), whatever LOCAL_ROOT_URL says
{"unix socket", setting.HTTPUnix, "https://gitea.example.com/", true},
{"localhost", setting.HTTP, "http://localhost:3000/", true},
{"loopback ipv4", setting.HTTPS, "https://127.0.0.1:3000/", true},
{"loopback ipv6", setting.HTTPS, "https://[::1]:3000/", true},
// a non-loopback LOCAL_ROOT_URL is a real network hop and must be verified
{"unspecified ipv4", setting.HTTPS, "https://0.0.0.0:3000/", true},
{"unspecified ipv6", setting.HTTPS, "https://[::]:3000/", true},
// any other LOCAL_ROOT_URL is a real network hop and must be verified
{"remote host", setting.HTTPS, "https://gitea.internal:443/", false},
{"remote ip", setting.HTTPS, "https://10.0.0.5:3000/", false},
// an unparseable LOCAL_ROOT_URL is a hard misconfiguration; fail closed to verification
@@ -31,7 +34,9 @@ func TestInternalAPIConnectionIsLocal(t *testing.T) {
}
for _, c := range cases {
t.Run(c.name, func(t *testing.T) {
assert.Equal(t, c.want, internalAPIConnectionIsLocal(c.protocol, c.localURL))
config := internalAPITLSConfig(c.protocol, c.localURL, "gitea.example.com")
assert.Equal(t, c.local, config.InsecureSkipVerify)
assert.Equal(t, util.Iif(c.local, "gitea.example.com", ""), config.ServerName)
})
}
}