mirror of
https://github.com/go-gitea/gitea.git
synced 2026-09-26 16:04:43 +02:00
d42128d71d
https://github.com/go-gitea/gitea/pull/38406 stopped setting `ServerName` on the internal API client, which https://github.com/go-gitea/gitea/pull/5820 had added for ACME. Internal requests to a local `LOCAL_ROOT_URL` now send SNI `localhost` (or none for IPs). The ACME listener selects its certificate by SNI, finds none and aborts the handshake with `tls: internal error`, breaking SSH access and git hooks. Send the `ROOT_URL` host as SNI again for local targets, and treat unspecified addresses (`0.0.0.0`, `::`) as local since dialing them reaches the local host. Remote targets are still verified against their own hostname. Fixes: https://github.com/go-gitea/gitea/issues/38903 --------- Co-authored-by: silverwind <me@silverwind.io>
43 lines
1.5 KiB
Go
43 lines
1.5 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package private
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"gitea.dev/modules/setting"
|
|
"gitea.dev/modules/util"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestInternalAPITLSConfig(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
protocol setting.Scheme
|
|
localURL string
|
|
local bool
|
|
}{
|
|
// HTTPUnix always dials the unix socket (a local target), whatever LOCAL_ROOT_URL says
|
|
{"unix socket", setting.HTTPUnix, "https://gitea.example.com/", true},
|
|
{"localhost", setting.HTTP, "http://localhost:3000/", true},
|
|
{"loopback ipv4", setting.HTTPS, "https://127.0.0.1:3000/", true},
|
|
{"loopback ipv6", setting.HTTPS, "https://[::1]:3000/", true},
|
|
{"unspecified ipv4", setting.HTTPS, "https://0.0.0.0:3000/", true},
|
|
{"unspecified ipv6", setting.HTTPS, "https://[::]:3000/", true},
|
|
// any other LOCAL_ROOT_URL is a real network hop and must be verified
|
|
{"remote host", setting.HTTPS, "https://gitea.internal:443/", false},
|
|
{"remote ip", setting.HTTPS, "https://10.0.0.5:3000/", false},
|
|
// an unparseable LOCAL_ROOT_URL is a hard misconfiguration; fail closed to verification
|
|
{"invalid url", setting.HTTPS, "://bad", false},
|
|
}
|
|
for _, c := range cases {
|
|
t.Run(c.name, func(t *testing.T) {
|
|
config := internalAPITLSConfig(c.protocol, c.localURL, "gitea.example.com")
|
|
assert.Equal(t, c.local, config.InsecureSkipVerify)
|
|
assert.Equal(t, util.Iif(c.local, "gitea.example.com", ""), config.ServerName)
|
|
})
|
|
}
|
|
}
|