Repository: caddyserver/caddy
File: modules/caddytls/connpolicy.go (Go)

Code before:
	// -----|---------------
	// `request` | Ask clients for a certificate, but allow even if there isn't one; do not verify it
	// `require` | Require clients to present a certificate, but do not verify it
	// `verify_if_given` | Ask clients for a certificate; allow even if there isn't one, but verify it if there is
	// `require_and_verify` | Require clients to present a valid certificate that is verified
	//
	// The default mode is `require_and_verify` if any
	// TrustedCACerts or TrustedCACertPEMFiles or TrustedLeafCerts
	// are provided; otherwise, the default mode is `require`.
	Mode string `json:"mode,omitempty"`

	existingVerifyPeerCert func([][]byte, [][]*x509.Certificate) error
}

// UnmarshalCaddyfile parses the Caddyfile segment to set up the client authentication. Syntax:
//
//	client_auth {
//		mode                   [request|require|verify_if_given|require_and_verify]
//	 	trust_pool			   <module> {
//			...
//		}
//		verifier               <module>
//	}
//
// If `mode` is not provided, it defaults to `require_and_verify` if `trust_pool` is provided. Otherwise,
// it defaults to `require`.
func (ca *ClientAuthentication) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
	for d.NextArg() {
		// consume any tokens on the same line, if any.
	}
	for nesting := d.Nesting(); d.NextBlock(nesting); {
		subdir := d.Val()
		switch subdir {
		case "mode":
			if d.CountRemainingArgs() > 1 {
				return d.ArgErr()
			}
			if !d.Args(&ca.Mode) {
				return d.ArgErr()
			}
		case "trusted_ca_cert":
			caddy.Log().Warn("The 'trusted_ca_cert' field is deprecated. Use the 'trust_pool' field instead.")
			if len(ca.CARaw) != 0 {
				return d.Err("cannot specify both 'trust_pool' and 'trusted_ca_cert' or 'trusted_ca_cert_file'")
			}
			if !d.NextArg() {
				return d.ArgErr()
			}
			ca.TrustedCACerts = append(ca.TrustedCACerts, d.Val())
		case "trusted_leaf_cert":
			if !d.NextArg() {

Review comment (suggestion):
```suggestion
// If `mode` is not provided, it defaults to `require_and_verify` if `trust_pool` is provided.
// Otherwise, it defaults to `require`.
```

Code after:
	// -----|---------------
	// `request` | Ask clients for a certificate, but allow even if there isn't one; do not verify it
	// `require` | Require clients to present a certificate, but do not verify it
	// `verify_if_given` | Ask clients for a certificate; allow even if there isn't one, but verify it if there is
	// `require_and_verify` | Require clients to present a valid certificate that is verified
	//
	// The default mode is `require_and_verify` if any
	// TrustedCACerts or TrustedCACertPEMFiles or TrustedLeafCerts
	// are provided; otherwise, the default mode is `require`.
	Mode string `json:"mode,omitempty"`

	existingVerifyPeerCert func([][]byte, [][]*x509.Certificate) error
}

// UnmarshalCaddyfile parses the Caddyfile segment to set up the client authentication. Syntax:
//
//	client_auth {
//		mode                   [request|require|verify_if_given|require_and_verify]
//	 	trust_pool			   <module> {
//			...
//		}
//		verifier               <module>
//	}
//
// If `mode` is not provided, it defaults to `require_and_verify` if `trust_pool` is provided.
// Otherwise, it defaults to `require`.
func (ca *ClientAuthentication) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
	for d.NextArg() {
		// consume any tokens on the same line, if any.
	}
	for nesting := d.Nesting(); d.NextBlock(nesting); {
		subdir := d.Val()
		switch subdir {
		case "mode":
			if d.CountRemainingArgs() > 1 {
				return d.ArgErr()
			}
			if !d.Args(&ca.Mode) {
				return d.ArgErr()
			}
		case "trusted_ca_cert":
			caddy.Log().Warn("The 'trusted_ca_cert' field is deprecated. Use the 'trust_pool' field instead.")
			if len(ca.CARaw) != 0 {
				return d.Err("cannot specify both 'trust_pool' and 'trusted_ca_cert' or 'trusted_ca_cert_file'")
			}
			if !d.NextArg() {
				return d.ArgErr()
			}
			ca.TrustedCACerts = append(ca.TrustedCACerts, d.Val())
		case "trusted_leaf_cert":
			if !d.NextArg() {