Merge pull request #43 from dfinity/igornovg/default-cert

Add --cert-default option

src/cli.rs

@@ -234,6 +234,12 @@ pub struct Cert {
     #[clap(env, long, default_value = "5s", value_parser = parse_duration)]
     pub cert_provider_poll_interval: Duration,
 
+    /// Default certificate to serve when there's no SNI in the request.
+    /// Tries to find a certificate that covers given FQDN.
+    /// If not found or not specified - picks the first one available.
+    #[clap(env, long)]
+    pub cert_default: Option<FQDN>,
+
     /// Disable OCSP stapling
     #[clap(env, long)]
     pub cert_ocsp_stapling_disable: bool,

src/tls/cert/mod.rs

@@ -341,9 +341,10 @@ pub mod test {
             AtomicUsize::new(0),
         );
 
-        let storage = Arc::new(storage::StorageKey::new(storage::Metrics::new(
-            &Registry::new(),
-        )));
+        let storage = Arc::new(storage::StorageKey::new(
+            None,
+            storage::Metrics::new(&Registry::new()),
+        ));
         let aggregator = Aggregator::new(
             vec![Arc::new(prov1), Arc::new(prov2)],
             storage,

src/tls/cert/storage.rs

@@ -45,6 +45,7 @@ struct StorageInner<T: Clone + Send + Sync> {
 pub struct Storage<T: Clone + Send + Sync> {
     #[new(default)]
     inner: ArcSwapOption<StorageInner<T>>,
+    cert_default: Option<FQDN>,
     metrics: Metrics,
 }
 
@@ -75,12 +76,19 @@ impl<T: Clone + Send + Sync> Storage<T> {
         let inner = self.inner.load_full()?;
 
         // Try to find some certificate
-        inner
-            .certs
-            .first_key_value()
-            .or_else(|| inner.certs_wildcard.first_key_value())
-            .map(|x| x.1)
-            .cloned()
+        self.cert_default
+            .as_ref()
+            // Try to find the default one if specified first
+            .and_then(|x| self.lookup_cert(x))
+            // Then just pick first available
+            .or_else(|| {
+                inner
+                    .certs
+                    .first_key_value()
+                    .or_else(|| inner.certs_wildcard.first_key_value())
+                    .map(|x| x.1)
+                    .cloned()
+            })
     }
 }
 
@@ -160,7 +168,8 @@ pub mod test {
     use super::*;
 
     pub fn create_test_storage() -> Storage<String> {
-        let storage: Storage<String> = Storage::new(Metrics::new(&Registry::new()));
+        let storage: Storage<String> =
+            Storage::new(Some(fqdn!("foo.baz")), Metrics::new(&Registry::new()));
 
         let certs = vec![
             Cert {
@@ -244,8 +253,8 @@ pub mod test {
             "foo.bar.cert"
         );
 
-        // Check any
-        assert_eq!(storage.any().unwrap().cert, "foo.bar.cert");
+        // Check any, make sure it returns the cert_default
+        assert_eq!(storage.any().unwrap().cert, "foo.baz.cert");
 
         Ok(())
     }

src/tls/mod.rs

@@ -142,7 +142,10 @@ pub async fn setup(
     registry: &Registry,
 ) -> Result<(ServerConfig, Vec<Arc<dyn ProvidesCustomDomains>>), Error> {
     // Prepare certificate storage
-    let cert_storage = Arc::new(storage::Storage::new(storage::Metrics::new(registry)));
+    let cert_storage = Arc::new(storage::Storage::new(
+        cli.cert.cert_default.clone(),
+        storage::Metrics::new(registry),
+    ));
 
     let mut cert_providers: Vec<Arc<dyn ProvidesCertificates>> = vec![];
     let mut custom_domain_providers: Vec<Arc<dyn ProvidesCustomDomains>> = vec![];