feat(dane): add DANE TLSA cert push support for alt-root domains (e.g. HNS) - #10
feat(dane): add DANE TLSA cert push support for alt-root domains (e.g. HNS)#10pcfreak30 wants to merge 1 commit into
Conversation
This comment has been minimized.
This comment has been minimized.
![kody-ai[bot]](https://avatars.githubusercontent.com/in/413034?s=60&v=4){kind=small}
a4ddda8 to
101ffad
Compare
This comment has been minimized.
This comment has been minimized.
101ffad to
81f2b08
Compare
This comment has been minimized.
This comment has been minimized.
81f2b08 to
bc3111f
Compare
bc3111f to
9dac6a0
Compare
Code Review Could Not Complete
|
| Options | Enabled |
|---|---|
| Bug | ✅ |
| Performance | ✅ |
| Security | ✅ |
| Business Logic | ✅ |
| return false, "", fmt.Errorf("create request: %w", err) | ||
| } | ||
|
|
||
| req.Header.Set("X-Gateway-Secret", d.gatewaySecret) |
There was a problem hiding this comment.
Hard-coded header key "X-Gateway-Secret" in dane_checker.go contains the keyword "Secret", so the secret-detection policy flags this line as a hard-coded secret even though only the header name is static. Load the header name from os.Getenv, viper, or koanf, or rename it to omit "Secret"; also confirm the gateway secret value itself is sourced from an approved configuration call at the call site.
Kody rule violation: Ban hard-coded secrets in Go source
Prompt for LLM
File dane_checker.go:
Line 50:
Hard-coded header key "X-Gateway-Secret" in dane_checker.go contains the keyword "Secret", so the secret-detection policy flags this line as a hard-coded secret even though only the header name is static. Load the header name from os.Getenv, viper, or koanf, or rename it to omit "Secret"; also confirm the gateway secret value itself is sourced from an approved configuration call at the call site.
Talk to Kody by mentioning @kody
Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.
1 participant
Adds DANE TLSA certificate push support for alt-root domains (Handshake/HNS) in the cert-webhook.
This is the Caddy-side half of the DANE/alt-root flow (portal HNSProvider handles delegation modes).
Summary
This PR adds DANE TLSA certificate push support for alternative-root domains (e.g., Handshake Name System / HNS). When a certificate event occurs for a single-label domain (a domain without a dot, such as
example), the plugin now extracts the certificate and pushes it to the portal's/internal/dns/certendpoint so the portal can compute and publish the corresponding TLSA record.Changes
New
dane.gomodule: IntroducesDANECertManager, which:IsDaneDomain(single-label, no dot).go.lumeweb.com/danelibrary.Event handling integration:
handleCertEventnow checks if the certificate domain is a DANE alt-root domain. If so, it extracts the certificate PEM from Caddy's certificate cache and asynchronously pushes it to the portal.Certificate extraction: Added
extractCertPEMto retrieve the matching certificate fromcaddytls.AllMatchingCertificatesand encode it as PEM.Manager lifecycle:
CertWebhookAppnow initializes aDANECertManageron startup using the configured portal URL and gateway secret.Tests: Added
dane_test.gocovering domain detection, TLSA computation, successful cert push, and error handling for failed/unreachable portal responses.