|
|
|
@ -9,9 +9,9 @@ import (
|
|
|
|
"crypto/x509"
|
|
|
|
"crypto/x509"
|
|
|
|
"fmt"
|
|
|
|
"fmt"
|
|
|
|
"io"
|
|
|
|
"io"
|
|
|
|
"net"
|
|
|
|
|
|
|
|
"net/http"
|
|
|
|
"net/http"
|
|
|
|
"net/netip"
|
|
|
|
"net/netip"
|
|
|
|
|
|
|
|
"slices"
|
|
|
|
"time"
|
|
|
|
"time"
|
|
|
|
|
|
|
|
|
|
|
|
"tailscale.com/util/multierr"
|
|
|
|
"tailscale.com/util/multierr"
|
|
|
|
@ -28,33 +28,31 @@ const letsEncryptStartedStaplingCRL int64 = 1746576000 // 2025-05-07 00:00:00 UT
|
|
|
|
// The ProbeFunc connects to a hostPort (host:port string), does a TLS
|
|
|
|
// The ProbeFunc connects to a hostPort (host:port string), does a TLS
|
|
|
|
// handshake, verifies that the hostname matches the presented certificate,
|
|
|
|
// handshake, verifies that the hostname matches the presented certificate,
|
|
|
|
// checks certificate validity time and OCSP revocation status.
|
|
|
|
// checks certificate validity time and OCSP revocation status.
|
|
|
|
func TLS(hostPort string) ProbeClass {
|
|
|
|
//
|
|
|
|
|
|
|
|
// The TLS config is optional and may be nil.
|
|
|
|
|
|
|
|
func TLS(hostPort string, config *tls.Config) ProbeClass {
|
|
|
|
return ProbeClass{
|
|
|
|
return ProbeClass{
|
|
|
|
Probe: func(ctx context.Context) error {
|
|
|
|
Probe: func(ctx context.Context) error {
|
|
|
|
certDomain, _, err := net.SplitHostPort(hostPort)
|
|
|
|
return probeTLS(ctx, config, hostPort)
|
|
|
|
if err != nil {
|
|
|
|
|
|
|
|
return err
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
return probeTLS(ctx, certDomain, hostPort)
|
|
|
|
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Class: "tls",
|
|
|
|
Class: "tls",
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// TLSWithIP is like TLS, but dials the provided dialAddr instead
|
|
|
|
// TLSWithIP is like TLS, but dials the provided dialAddr instead of using DNS
|
|
|
|
// of using DNS resolution. The certDomain is the expected name in
|
|
|
|
// resolution. Use config.ServerName to send SNI and validate the name in the
|
|
|
|
// the cert (and the SNI name to send).
|
|
|
|
// cert.
|
|
|
|
func TLSWithIP(certDomain string, dialAddr netip.AddrPort) ProbeClass {
|
|
|
|
func TLSWithIP(dialAddr netip.AddrPort, config *tls.Config) ProbeClass {
|
|
|
|
return ProbeClass{
|
|
|
|
return ProbeClass{
|
|
|
|
Probe: func(ctx context.Context) error {
|
|
|
|
Probe: func(ctx context.Context) error {
|
|
|
|
return probeTLS(ctx, certDomain, dialAddr.String())
|
|
|
|
return probeTLS(ctx, config, dialAddr.String())
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Class: "tls",
|
|
|
|
Class: "tls",
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
func probeTLS(ctx context.Context, certDomain string, dialHostPort string) error {
|
|
|
|
func probeTLS(ctx context.Context, config *tls.Config, dialHostPort string) error {
|
|
|
|
dialer := &tls.Dialer{Config: &tls.Config{ServerName: certDomain}}
|
|
|
|
dialer := &tls.Dialer{Config: config}
|
|
|
|
conn, err := dialer.DialContext(ctx, "tcp", dialHostPort)
|
|
|
|
conn, err := dialer.DialContext(ctx, "tcp", dialHostPort)
|
|
|
|
if err != nil {
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("connecting to %q: %w", dialHostPort, err)
|
|
|
|
return fmt.Errorf("connecting to %q: %w", dialHostPort, err)
|
|
|
|
@ -108,6 +106,10 @@ func validateConnState(ctx context.Context, cs *tls.ConnectionState) (returnerr
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if len(leafCert.CRLDistributionPoints) == 0 {
|
|
|
|
if len(leafCert.CRLDistributionPoints) == 0 {
|
|
|
|
|
|
|
|
if !slices.Contains(leafCert.Issuer.Organization, "Let's Encrypt") {
|
|
|
|
|
|
|
|
// LE certs contain a CRL, but certs from other CAs might not.
|
|
|
|
|
|
|
|
return
|
|
|
|
|
|
|
|
}
|
|
|
|
if leafCert.NotBefore.Before(time.Unix(letsEncryptStartedStaplingCRL, 0)) {
|
|
|
|
if leafCert.NotBefore.Before(time.Unix(letsEncryptStartedStaplingCRL, 0)) {
|
|
|
|
// Certificate might not have a CRL.
|
|
|
|
// Certificate might not have a CRL.
|
|
|
|
return
|
|
|
|
return
|
|
|
|
|