lib/http: use TLS on all --addr listeners when --cert and --key are set GHSA-mfvx-7rcj-9m5g

When --cert and --key were supplied TLS was only applied to the listener if
exactly one --addr was given. With two or more --addr flags every listener
without an explicit tls:// prefix silently served cleartext HTTP, so adding a
second --addr to an HTTPS server quietly disabled TLS on both.

Now when TLS is configured every listener serves TLS. An individual listener
can be prefixed with http:// to serve unencrypted HTTP on that address, and
tls:// still marks a listener as TLS explicitly. Using a tls:// address
without --cert and --key is now an error instead of silently serving
cleartext with an https:// URL.

Addresses GHSA-mfvx-7rcj-9m5g finding 3.

lib/http/middleware.go

@@ -79,11 +79,15 @@ func basicAuth(authenticator *LoggedBasicAuth) func(next http.Handler) http.Hand
 func MiddlewareAuthCertificateUser() Middleware {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			for _, cert := range r.TLS.PeerCertificates {
-				if cert.Subject.CommonName != "" {
-					r = r.WithContext(context.WithValue(r.Context(), ctxKeyUser, cert.Subject.CommonName))
-					next.ServeHTTP(w, r)
-					return
+			// r.TLS is nil on a plain HTTP listener (http:// prefix) where
+			// there can be no client certificate
+			if r.TLS != nil {
+				for _, cert := range r.TLS.PeerCertificates {
+					if cert.Subject.CommonName != "" {
+						r = r.WithContext(context.WithValue(r.Context(), ctxKeyUser, cert.Subject.CommonName))
+						next.ServeHTTP(w, r)
+						return
+					}
 				}
 			}
 			code := http.StatusUnauthorized