public/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-10-01 20:59:45 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix: preserve SNI for local internal API (#39412)

Browse Source 
https://github.com/go-gitea/gitea/pull/38406 stopped setting
`ServerName` on the internal API client, which
https://github.com/go-gitea/gitea/pull/5820 had added for ACME. Internal
requests to a local `LOCAL_ROOT_URL` now send SNI `localhost` (or none
for IPs). The ACME listener selects its certificate by SNI, finds none
and aborts the handshake with `tls: internal error`, breaking SSH access
and git hooks.

Send the `ROOT_URL` host as SNI again for local targets, and treat
unspecified addresses (`0.0.0.0`, `::`) as local since dialing them
reaches the local host. Remote targets are still verified against their
own hostname.

Fixes: https://github.com/go-gitea/gitea/issues/38903

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
bircni
2026-09-25 15:46:52 +02:00
committed by GitHub
parent 448f8c67e0
commit d42128d71d
2 changed files with 21 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/private/internal.go
+12 -15
View File
@@ -54,12 +54,7 @@ func dialContextInternalAPI(ctx context.Context, network, address string) (conn
return conn, nil
}
// internalAPIConnectionIsLocal reports whether the internal API transport connects to a local target,
// where the self-signed local certificate cannot be verified so skipping verification is safe. It mirrors
// what dialContextInternalAPI actually dials: a unix socket whenever Protocol is HTTPUnix (always local,
// whatever LOCAL_ROOT_URL says), otherwise the LOCAL_ROOT_URL host directly. A non-loopback LOCAL_ROOT_URL
// is a real network hop, so its certificate must be verified, else the internal token can be MITM'd. An
// unparseable LOCAL_ROOT_URL is a hard misconfiguration and fails closed (verify).
// unspecified IPs dial the local host too, other targets are network hops that must be verified to protect INTERNAL_TOKEN
func internalAPIConnectionIsLocal(protocol setting.Scheme, localURL string) bool {
if protocol == setting.HTTPUnix {
return true
@@ -73,19 +68,21 @@ func internalAPIConnectionIsLocal(protocol setting.Scheme, localURL string) bool
return true
}
ip := net.ParseIP(host)
return ip != nil && ip.IsLoopback()
return ip != nil && (ip.IsLoopback() || ip.IsUnspecified())
}
func internalAPITLSConfig(protocol setting.Scheme, localURL, domain string) *tls.Config {
if internalAPIConnectionIsLocal(protocol, localURL) {
// the ACME listener selects its certificate by SNI, so send the public domain instead of the local host
return &tls.Config{InsecureSkipVerify: true, ServerName: domain}
}
return &tls.Config{}
}
var internalAPITransport = sync.OnceValue(func() http.RoundTripper {
return &http.Transport{
DialContext: dialContextInternalAPI,
TLSClientConfig: &tls.Config{
// Skip verification only for a local target (unix socket, or a loopback LOCAL_ROOT_URL), where the
// self-signed local cert can't be verified anyway; a non-loopback LOCAL_ROOT_URL is a real network
// hop and must be verified so the internal token can't be MITM'd. When verifying, Go's default
// ServerName (the dialed LOCAL_ROOT_URL host) is already correct, so it is not overridden.
InsecureSkipVerify: internalAPIConnectionIsLocal(setting.Protocol, setting.LocalURL),
},
DialContext: dialContextInternalAPI,
TLSClientConfig: internalAPITLSConfig(setting.Protocol, setting.LocalURL, setting.AppDomain),
}
})