public/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-10-01 20:59:45 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix: preserve SNI for local internal API (#39412)

Browse Source 
https://github.com/go-gitea/gitea/pull/38406 stopped setting
`ServerName` on the internal API client, which
https://github.com/go-gitea/gitea/pull/5820 had added for ACME. Internal
requests to a local `LOCAL_ROOT_URL` now send SNI `localhost` (or none
for IPs). The ACME listener selects its certificate by SNI, finds none
and aborts the handshake with `tls: internal error`, breaking SSH access
and git hooks.

Send the `ROOT_URL` host as SNI again for local targets, and treat
unspecified addresses (`0.0.0.0`, `::`) as local since dialing them
reaches the local host. Remote targets are still verified against their
own hostname.

Fixes: https://github.com/go-gitea/gitea/issues/38903

---------

Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
bircni
2026-09-25 15:46:52 +02:00
committed by GitHub
parent 448f8c67e0
commit d42128d71d
2 changed files with 21 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/private/internal_test.go
+9 -4
View File
@@ -7,23 +7,26 @@ import (
"testing"
"gitea.dev/modules/setting"
"gitea.dev/modules/util"
"github.com/stretchr/testify/assert"
)
func TestInternalAPIConnectionIsLocal(t *testing.T) {
func TestInternalAPITLSConfig(t *testing.T) {
cases := []struct {
name string
protocol setting.Scheme
localURL string
want bool
local bool
}{
// HTTPUnix always dials the unix socket (a local target), whatever LOCAL_ROOT_URL says
{"unix socket", setting.HTTPUnix, "https://gitea.example.com/", true},
{"localhost", setting.HTTP, "http://localhost:3000/", true},
{"loopback ipv4", setting.HTTPS, "https://127.0.0.1:3000/", true},
{"loopback ipv6", setting.HTTPS, "https://[::1]:3000/", true},
// a non-loopback LOCAL_ROOT_URL is a real network hop and must be verified
{"unspecified ipv4", setting.HTTPS, "https://0.0.0.0:3000/", true},
{"unspecified ipv6", setting.HTTPS, "https://[::]:3000/", true},
// any other LOCAL_ROOT_URL is a real network hop and must be verified
{"remote host", setting.HTTPS, "https://gitea.internal:443/", false},
{"remote ip", setting.HTTPS, "https://10.0.0.5:3000/", false},
// an unparseable LOCAL_ROOT_URL is a hard misconfiguration; fail closed to verification
@@ -31,7 +34,9 @@ func TestInternalAPIConnectionIsLocal(t *testing.T) {
}
for _, c := range cases {
t.Run(c.name, func(t *testing.T) {
assert.Equal(t, c.want, internalAPIConnectionIsLocal(c.protocol, c.localURL))
config := internalAPITLSConfig(c.protocol, c.localURL, "gitea.example.com")
assert.Equal(t, c.local, config.InsecureSkipVerify)
assert.Equal(t, util.Iif(c.local, "gitea.example.com", ""), config.ServerName)
})
}
}