TrueCloudLab/coredns
16
0
Fork 2
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

plugin/forward: improve tls configuration (#1643)

Browse source
This commit is contained in:
Ruslan Drozhdzh 2018-03-30 16:35:09 +03:00 • committed by Miek Gieben
parent 0e0a641f16
commit f19a3b24ca
2 changed files with 10 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
plugin/forward/README.md
View file

@ -60,8 +60,14 @@ forward FROM TO... {
an upstream to be down. If 0, the upstream will never be marked as down (nor health checked). an upstream to be down. If 0, the upstream will never be marked as down (nor health checked).
Default is 2. Default is 2.
* `expire` **DURATION**, expire (cached) connections after this time, the default is 10s. * `expire` **DURATION**, expire (cached) connections after this time, the default is 10s.
* `tls` **CERT** **KEY** **CA** define the TLS properties for TLS; if you leave this out the * `tls` **CERT** **KEY** **CA** define the TLS properties for TLS connection. From 0 to 3 arguments can be
system's configuration will be used. provided with the meaning as described below
* `tls` - no client authentication is used, and the system CAs are used to verify the server certificate
* `tls` **CA** - no client authentication is used, and the file CA is used to verify the server certificate
* `tls` **CERT** **KEY** - client authentication is used with the specified cert/key pair.
The server certificate is verified with the system CAs
* `tls` **CERT** **KEY** **CA** - client authentication is used with the specified cert/key pair.
The server certificate is verified using the specified CA file
* `tls_servername` **NAME** allows you to set a server name in the TLS configuration; for instance 9.9.9.9 * `tls_servername` **NAME** allows you to set a server name in the TLS configuration; for instance 9.9.9.9
needs this to be set to `dns.quad9.net`. needs this to be set to `dns.quad9.net`.
* `policy` specifies the policy to use for selecting upstream servers. The default is `random`. * `policy` specifies the policy to use for selecting upstream servers. The default is `random`.

4
plugin/forward/setup.go
View file

@ -200,11 +200,11 @@ func parseBlock(c *caddy.Controller, f *Forward) error {
f.forceTCP = true f.forceTCP = true
case "tls": case "tls":
args := c.RemainingArgs() args := c.RemainingArgs()
if len(args) != 3 { if len(args) > 3 {
return c.ArgErr() return c.ArgErr()
} }
tlsConfig, err := pkgtls.NewTLSConfig(args[0], args[1], args[2]) tlsConfig, err := pkgtls.NewTLSConfigFromArgs(args...)
if err != nil { if err != nil {
return err return err
} }