v0.22.0 several enhancements and fixes for security, network, doc, test, packaging

internal/tlsx/tlsx.go

@@ -63,7 +63,8 @@ func Server(o *config.TLSOptions) (*tls.Config, error) {
 
 // Client builds the *tls.Config for dialer plugins (tcp_chain/http_chain
 // sinks). host seeds ServerName when no override is set; Go verifies IP SANs
-// when host is an address. Returns (nil, nil) when disabled.
+// when host is an address, without its zone, which names a local interface
+// and no certificate carries. Returns (nil, nil) when disabled.
 func Client(o *config.TLSOptions, host string) (*tls.Config, error) {
 	if o == nil || !o.Enabled {
 		return nil, nil
@@ -78,7 +79,7 @@ func Client(o *config.TLSOptions, host string) (*tls.Config, error) {
 		InsecureSkipVerify: o.InsecureSkipVerify,
 	}
 	if cfg.ServerName == "" {
-		cfg.ServerName = host
+		cfg.ServerName, _, _ = strings.Cut(host, "%")
 	}
 	if o.CAFile != "" {
 		pool, err := loadPool(o.CAFile)

internal/tlsx/tlsx_test.go

@@ -6,8 +6,24 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"logwisp/internal/config"
 )
 
+// A dialer verifies an IPv6 target by its address: the zone names a local
+// interface, which no certificate carries.
+func TestClientServerNameDropsTheZone(t *testing.T) {
+	for host, want := range map[string]string{"fe80::1%eth0": "fe80::1", "::1": "::1", "relay.example": "relay.example"} {
+		cfg, err := Client(&config.TLSOptions{Enabled: true}, host)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if cfg.ServerName != want {
+			t.Errorf("Client(%q).ServerName = %q, want %q", host, cfg.ServerName, want)
+		}
+	}
+}
+
 // Startup names a certificate outside its validity window or within 30 days
 // of leaving it; a healthy one stays silent.
 func TestExpiryWarning(t *testing.T) {