From 4b6f6325383a7204dbbcef20518860b8deafd727 Mon Sep 17 00:00:00 2001 From: James Renken Date: Tue, 20 May 2025 23:37:49 -0700 Subject: [PATCH 1/2] feat: add TARGET_SNI to allow overriding the TLS handshake hostname when forwarding requests --- cmd/anubis/main.go | 17 +++++++++++------ docs/docs/CHANGELOG.md | 1 + docs/docs/admin/installation.mdx | 1 + 3 files changed, 13 insertions(+), 6 deletions(-) diff --git a/cmd/anubis/main.go b/cmd/anubis/main.go index 9c1dab70..3cb82193 100644 --- a/cmd/anubis/main.go +++ b/cmd/anubis/main.go @@ -56,6 +56,7 @@ var ( redirectDomains = flag.String("redirect-domains", "", "list of domains separated by commas which anubis is allowed to redirect to. Leaving this unset allows any domain.") slogLevel = flag.String("slog-level", "INFO", "logging level (see https://pkg.go.dev/log/slog#hdr-Levels)") target = flag.String("target", "http://localhost:3923", "target to reverse proxy to, set to an empty string to disable proxying when only using auth request") + targetSNI = flag.String("target-sni", "", "if set, the value of the TLS handshake hostname when forwarding requests to the target") targetHost = flag.String("target-host", "", "if set, the value of the Host header when forwarding requests to the target") targetInsecureSkipVerify = flag.Bool("target-insecure-skip-verify", false, "if true, skips TLS validation for the backend") healthcheck = flag.Bool("healthcheck", false, "run a health check against Anubis") @@ -136,7 +137,7 @@ func setupListener(network string, address string) (net.Listener, string) { return listener, formattedAddress } -func makeReverseProxy(target string, targetHost string, insecureSkipVerify bool) (http.Handler, error) { +func makeReverseProxy(target string, targetSNI string, targetHost string, insecureSkipVerify bool) (http.Handler, error) { targetUri, err := url.Parse(target) if err != nil { return nil, fmt.Errorf("failed to parse target URL: %w", err) @@ -158,10 +159,14 @@ func makeReverseProxy(target string, targetHost string, insecureSkipVerify bool) transport.RegisterProtocol("unix", libanubis.UnixRoundTripper{Transport: transport}) } - if insecureSkipVerify { - slog.Warn("TARGET_INSECURE_SKIP_VERIFY is set to true, TLS certificate validation will not be performed", "target", target) - transport.TLSClientConfig = &tls.Config{ - InsecureSkipVerify: true, + if insecureSkipVerify || targetSNI != "" { + transport.TLSClientConfig = &tls.Config{} + if insecureSkipVerify { + slog.Warn("TARGET_INSECURE_SKIP_VERIFY is set to true, TLS certificate validation will not be performed", "target", target) + transport.TLSClientConfig.InsecureSkipVerify = true + } + if targetSNI != "" { + transport.TLSClientConfig.ServerName = targetSNI } } @@ -214,7 +219,7 @@ func main() { // when using anubis via Systemd and environment variables, then it is not possible to set targe to an empty string but only to space if strings.TrimSpace(*target) != "" { var err error - rp, err = makeReverseProxy(*target, *targetHost, *targetInsecureSkipVerify) + rp, err = makeReverseProxy(*target, *targetSNI, *targetHost, *targetInsecureSkipVerify) if err != nil { log.Fatalf("can't make reverse proxy: %v", err) } diff --git a/docs/docs/CHANGELOG.md b/docs/docs/CHANGELOG.md index 62155754..9739876d 100644 --- a/docs/docs/CHANGELOG.md +++ b/docs/docs/CHANGELOG.md @@ -27,6 +27,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Added SearXNG instance tracker whitelist policy - Added Qualys SSL Labs whitelist policy - Fixed cookie deletion logic ([#520](https://github.com/TecharoHQ/anubis/issues/520), [#522](https://github.com/TecharoHQ/anubis/pull/522)) +- Add `--target-sni` flag/envvar to allow changing the value of the TLS handshake hostname in requests forwarded to the target service. ## v1.18.0: Varis zos Galvus diff --git a/docs/docs/admin/installation.mdx b/docs/docs/admin/installation.mdx index fb13ec95..5db3b8a7 100644 --- a/docs/docs/admin/installation.mdx +++ b/docs/docs/admin/installation.mdx @@ -84,6 +84,7 @@ If you don't know or understand what these settings mean, ignore them. These are | Environment Variable | Default value | Explanation | | :---------------------------- | :------------ | :-------------------------------------------------------------------------------------------------------------------------------------------------- | +| `TARGET_SNI` | unset | If set, overrides the TLS handshake hostname in requests forwarded to `TARGET`. | | `TARGET_HOST` | unset | If set, overrides the Host header in requests forwarded to `TARGET`. | | `TARGET_INSECURE_SKIP_VERIFY` | `false` | If `true`, skip TLS certificate validation for targets that listen over `https`. If your backend does not listen over `https`, ignore this setting. | From fb0b80255a787da38ec741d0b0b212e7e77a6be9 Mon Sep 17 00:00:00 2001 From: Xe Iaso Date: Fri, 23 May 2025 12:22:45 -0400 Subject: [PATCH 2/2] chore: spelling Signed-off-by: Xe Iaso --- .github/actions/spelling/expect.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt index 6380c400..2492f23c 100644 --- a/.github/actions/spelling/expect.txt +++ b/.github/actions/spelling/expect.txt @@ -178,6 +178,7 @@ selfsigned setsebool sitemap sls +sni Sourceware Spambot sparkline