acme/autocert: Enable custom ports

acme/autocert/listener.go

@@ -58,6 +58,15 @@ func NewListener(domains ...string) net.Listener {
 	return m.Listener()
 }
 
+func (m *Manager) listener(address string) net.Listener {
+	ln := &listener{
+		m:    m,
+		conf: m.TLSConfig(),
+	}
+	ln.tcpListener, ln.tcpListenErr = net.Listen("tcp", address)
+	return ln
+}
+
 // Listener listens on the standard TLS port (443) on all interfaces
 // and returns a net.Listener returning *tls.Conn connections.
 //
@@ -71,12 +80,30 @@ func NewListener(domains ...string) net.Listener {
 // Unlike NewListener, it is the caller's responsibility to initialize
 // the Manager m's Prompt, Cache, HostPolicy, and other desired options.
 func (m *Manager) Listener() net.Listener {
-	ln := &listener{
-		m:    m,
-		conf: m.TLSConfig(),
-	}
-	ln.tcpListener, ln.tcpListenErr = net.Listen("tcp", ":443")
-	return ln
+	return m.listener(":443")
+}
+
+// ListenerCustomAddress listens on the given address
+// and returns a net.Listener returning *tls.Conn connections.
+//
+// Your service must be reacheable on port 443 from the public internet.
+//
+// ListenerCustomAddress("<IP>:443") binds your service to a specific IP address
+// ListenerCustomAddress(":<port>") binds your service to the given port. This will
+// not work without something like NAT to make your service reachable on
+// port 443 from the public internet.
+//
+// The returned listener uses a *tls.Config that enables HTTP/2, and
+// should only be used with servers that support HTTP/2.
+//
+// The returned Listener also enables TCP keep-alives on the accepted
+// connections. The returned *tls.Conn are returned before their TLS
+// handshake has completed.
+//
+// Unlike NewListener, it is the caller's responsibility to initialize
+// the Manager m's Prompt, Cache, HostPolicy, and other desired options.
+func (m *Manager) ListenerCustomAddress(address string) net.Listener {
+	return m.listener(address)
 }
 
 type listener struct {

acme/autocert/listener_test.go

@@ -0,0 +1,66 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package autocert
+
+import (
+	"net"
+	"testing"
+)
+
+func TestManager_Listener(t *testing.T) {
+	man := Manager{}
+	ln := man.Listener()
+	defer ln.Close()
+	host, port, err := net.SplitHostPort(ln.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if host != "::" || port != "443" {
+		t.Errorf("Wrong host or port: %s%s", host, port)
+	}
+}
+
+func TestManager_ListenerCustomAddress(t *testing.T) {
+	tests := []struct {
+		name         string
+		m            *Manager
+		address      string
+		wantHostIPv6 string
+		wantHostIPv4 string
+		wantPort     string
+	}{
+		{
+			name:         "PortOnly",
+			m:            &Manager{},
+			address:      ":4433",
+			wantHostIPv6: "::",
+			wantHostIPv4: "0.0.0.0",
+			wantPort:     "4433",
+		},
+		{
+			name:         "FullAddress",
+			m:            &Manager{},
+			address:      "127.0.0.1:443",
+			wantHostIPv6: "dummy",
+			wantHostIPv4: "127.0.0.1",
+			wantPort:     "443",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ln := tt.m.ListenerCustomAddress(tt.address)
+			gotHost, gotPort, err := net.SplitHostPort(ln.Addr().String())
+			if err != nil {
+				t.Fatal(err)
+			}
+			if gotHost != tt.wantHostIPv6 && gotHost != tt.wantHostIPv4 {
+				t.Errorf("Wrong host. Want %s or %s got %s", tt.wantHostIPv6, tt.wantHostIPv4, gotHost)
+			}
+			if gotPort != tt.wantPort {
+				t.Errorf("Wrong port. Want %s got %s", tt.wantPort, gotPort)
+			}
+		})
+	}
+}