Merge pull request #342 from fosrl/dev

1.12.4

flake.nix

@@ -25,7 +25,7 @@
           inherit (pkgs) lib;
 
           # Update version when releasing
-          version = "1.12.5";
+          version = "1.12.4";
         in
         {
           default = self.packages.${system}.pangolin-newt;

netstack2/http_handler.go

@@ -131,23 +131,18 @@ func (l *chanListener) send(conn net.Conn) bool {
 // httpConnCtx – conn wrapper that carries a SubnetRule through the listener
 // ---------------------------------------------------------------------------
 
-// httpConnCtx wraps a net.Conn so the matching SubnetRule and TLS state can
-// be passed through the chanListener into the http.Server's ConnContext
-// callback, making them available to request handlers via the request context.
+// httpConnCtx wraps a net.Conn so the matching SubnetRule can be passed
+// through the chanListener into the http.Server's ConnContext callback,
+// making it available to request handlers via the request context.
 type httpConnCtx struct {
 	net.Conn
-	rule  *SubnetRule
-	isTLS bool // true when the conn was wrapped with tls.Server
+	rule *SubnetRule
 }
 
 // connCtxKey is the unexported context key used to store a *SubnetRule on the
 // per-connection context created by http.Server.ConnContext.
 type connCtxKey struct{}
 
-// connTLSKey is the unexported context key used to store the isTLS flag on
-// the per-connection context created by http.Server.ConnContext.
-type connTLSKey struct{}
-
 // ---------------------------------------------------------------------------
 // Constructor and lifecycle
 // ---------------------------------------------------------------------------
@@ -180,8 +175,7 @@ func (h *HTTPHandler) Start() error {
 		// that handleRequest can retrieve it without any global state.
 		ConnContext: func(ctx context.Context, c net.Conn) context.Context {
 			if cc, ok := c.(*httpConnCtx); ok {
-				ctx = context.WithValue(ctx, connCtxKey{}, cc.rule)
-				ctx = context.WithValue(ctx, connTLSKey{}, cc.isTLS)
+				return context.WithValue(ctx, connCtxKey{}, cc.rule)
 			}
 			return ctx
 		},
@@ -209,28 +203,19 @@ func (h *HTTPHandler) HandleConn(conn net.Conn, rule *SubnetRule) {
 	var effectiveConn net.Conn = conn
 
 	if rule.Protocol == "https" {
-		// Only perform TLS termination for connections arriving on port 443.
-		// Connections on port 80 are passed through as plain HTTP so that
-		// handleRequest can issue the HTTP→HTTPS redirect.
-		doTLS := false
-		if tcpAddr, ok := conn.LocalAddr().(*net.TCPAddr); ok {
-			doTLS = tcpAddr.Port == 443
-		}
-		if doTLS {
-			tlsCfg, err := h.getTLSConfig(rule)
-			if err != nil {
-				logger.Error("HTTP handler: cannot build TLS config for connection from %s: %v",
-					conn.RemoteAddr(), err)
-				conn.Close()
-				return
-			}
-			// tls.Server wraps the raw conn; the TLS handshake is deferred until
-			// the first Read, which the http.Server will trigger naturally.
-			effectiveConn = tls.Server(conn, tlsCfg)
+		tlsCfg, err := h.getTLSConfig(rule)
+		if err != nil {
+			logger.Error("HTTP handler: cannot build TLS config for connection from %s: %v",
+				conn.RemoteAddr(), err)
+			conn.Close()
+			return
 		}
+		// tls.Server wraps the raw conn; the TLS handshake is deferred until
+		// the first Read, which the http.Server will trigger naturally.
+		effectiveConn = tls.Server(conn, tlsCfg)
 	}
 
-	wrapped := &httpConnCtx{Conn: effectiveConn, rule: rule, isTLS: effectiveConn != conn}
+	wrapped := &httpConnCtx{Conn: effectiveConn, rule: rule}
 	if !h.listener.send(wrapped) {
 		// Listener is already closed — clean up the orphaned connection.
 		effectiveConn.Close()
@@ -306,9 +291,6 @@ func (h *HTTPHandler) getProxy(target HTTPTarget) *httputil.ReverseProxy {
 	proxy := &httputil.ReverseProxy{
 		Rewrite: func(pr *httputil.ProxyRequest) {
 			pr.SetURL(targetURL)
-			if host := pr.In.Host; host != "" {
-				pr.Out.Host = host
-			}
 			// SetXForwarded sets X-Forwarded-For from the inbound request's
 			// RemoteAddr (the WireGuard/netstack client address), along with
 			// X-Forwarded-Host and X-Forwarded-Proto. Using Rewrite instead of
@@ -374,13 +356,9 @@ func (h *HTTPHandler) handleRequest(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// If the rule is HTTPS but the incoming request arrived over plain HTTP
-	// (port 80), redirect to HTTPS. We use the isTLS flag stored on the
-	// connection context rather than r.TLS, because Go's http.Server calls
-	// ConnectionState() before the TLS handshake completes, so r.TLS.Version
-	// is 0 even for genuine TLS connections at that point.
-	isTLS, _ := r.Context().Value(connTLSKey{}).(bool)
-	if rule.Protocol == "https" && !isTLS {
+	// If the rule is HTTPS and a TLS certificate is configured, but the
+	// incoming request arrived over plain HTTP, redirect to HTTPS.
+	if rule.Protocol == "https" && rule.TLSCert != "" && rule.TLSKey != "" && r.TLS == nil {
 		host := r.Host
 		if host == "" {
 			host = r.URL.Host

netstack2/http_handler_tls_test.go

@@ -1,48 +0,0 @@
-package netstack2
-
-import (
-	"crypto/tls"
-	"net"
-	"testing"
-)
-
-// tlsConnStub is a minimal net.Conn that also exposes TLS state, matching
-// *tls.Conn's ConnectionState used by net/http.Server.
-type tlsConnStub struct {
-	net.Conn
-	state tls.ConnectionState
-}
-
-func (t *tlsConnStub) ConnectionState() tls.ConnectionState {
-	return t.state
-}
-
-func TestHTTPConnCtxForwardsConnectionState(t *testing.T) {
-	c1, c2 := net.Pipe()
-	defer c1.Close()
-	defer c2.Close()
-
-	inner := &tlsConnStub{
-		Conn:  c1,
-		state: tls.ConnectionState{Version: tls.VersionTLS12, HandshakeComplete: true},
-	}
-	wrapped := &httpConnCtx{Conn: inner, rule: nil}
-
-	got := wrapped.ConnectionState()
-	if got.Version != tls.VersionTLS12 || !got.HandshakeComplete {
-		t.Fatalf("ConnectionState = %+v, want TLS 1.2 and HandshakeComplete", got)
-	}
-}
-
-func TestHTTPConnCtxConnectionStatePlainTCP(t *testing.T) {
-	c1, c2 := net.Pipe()
-	defer c1.Close()
-	defer c2.Close()
-
-	wrapped := &httpConnCtx{Conn: c1, rule: nil}
-	got := wrapped.ConnectionState()
-	if got.Version != 0 {
-		t.Fatalf("expected zero ConnectionState for plain conn, got %+v", got)
-	}
-	_ = c2
-}