commit e1475a441a87852de7cb3252062905c76425f979
Author: David Fifield <[email protected]>
Date: Sat Sep 30 23:18:24 2017 -0700
Make it non-fatal when using --acme-hostnames without a port-443 binaddr.
The user might have set up their own forwarding or reverse proxy that
doesn't require meek-server itself to listen on 443.
---
meek-server/meek-server.go | 30 ++++++++++++++----------------
1 file changed, 14 insertions(+), 16 deletions(-)
diff --git a/meek-server/meek-server.go b/meek-server/meek-server.go
index eceba0c..f0f03b9 100644
--- a/meek-server/meek-server.go
+++ b/meek-server/meek-server.go
@@ -404,8 +404,8 @@ func main() {
// --cert and --key together
// --disable-tls
// The outputs of this block of code are the disableTLS,
- // missing443Listener, and getCertificate variables.
- var missing443Listener = false
+ // need443Listener, and getCertificate variables.
+ var need443Listener = false
var getCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error)
if disableTLS {
if acmeEmail != "" || acmeHostnamesCommas != "" || certFilename
!= "" || keyFilename != "" {
@@ -424,18 +424,9 @@ func main() {
acmeHostnames := strings.Split(acmeHostnamesCommas, ",")
log.Printf("ACME hostnames: %q", acmeHostnames)
- missing443Listener = true
// The ACME responder only works when it is running on port 443.
//
https://letsencrypt.github.io/acme-spec/#domain-validation-with-server-name-indication-dvsni
- for _, bindaddr := range ptInfo.Bindaddrs {
- if port == 443 || bindaddr.Addr.Port == 443 {
- missing443Listener = false
- break
- }
- }
- // Don't quit immediately if we need a 443 listener and don't
- // have it; do it later in the SMETHOD loop so it appears in the
- // tor log.
+ need443Listener = true
var cache autocert.Cache
cacheDir, err := getCertificateCacheDir()
@@ -459,20 +450,20 @@ func main() {
log.Printf("starting version %s (%s)", programVersion,
runtime.Version())
servers := make([]*http.Server, 0)
+ have443Listener := false
for _, bindaddr := range ptInfo.Bindaddrs {
if port != 0 {
bindaddr.Addr.Port = port
}
switch bindaddr.MethodName {
case ptMethodName:
- if missing443Listener {
- pt.SmethodError(bindaddr.MethodName, "The
--acme-hostnames option requires one of the bindaddrs to be on port 443.")
- break
- }
var server *http.Server
if disableTLS {
server, err = startServer(bindaddr.Addr)
} else {
+ if bindaddr.Addr.Port == 443 {
+ have443Listener = true
+ }
server, err = startServerTLS(bindaddr.Addr,
getCertificate)
}
if err != nil {
@@ -487,6 +478,13 @@ func main() {
}
pt.SmethodsDone()
+ // Emit a warning if we're using ACME certificates and don't have a 443
+ // listener. Don't quit, in case the user has made other provisions for
+ // forwarding port 443.
+ if need443Listener && !have443Listener {
+ log.Printf("warning: the --acme-hostnames option requires one
of the bindaddrs to be on port 443.")
+ }
+
var numHandlers int = 0
var sig os.Signal
sigChan := make(chan os.Signal, 1)
_______________________________________________
tor-commits mailing list
[email protected]
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits
