Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
httpcaddyfile: Don't add HTTP hosts to TLS APs (fix #4176 and fix #4198)
In the Caddyfile, hosts specified for HTTP sockets (either scheme is "http" or it is on the HTTP port) should not be used as subjects in TLS automation policies (APs).
Matthew Holt committed
Jun 9, 2021 at 14:34 UTC
05656a60b3b089ce1735a1ebb02539cca9f68fb4
3 files changed
+90
-1
caddyconfig/httpcaddyfile/directives.go
+21
@@ -478,6 +478,27 @@ func (sb serverBlock) hostsFromKeys(loggerMode bool) []string {
478
return sblockHosts
479
}
480
481
+func (sb serverBlock) hostsFromKeysNotHTTP(httpPort string) []string {
482
+ // ensure each entry in our list is unique
483
+ hostMap := make(map[string]struct{})
484
+ for _, addr := range sb.keys {
485
+ if addr.Host == "" {
486
+ continue
487
+ }
488
+ if addr.Scheme != "http" && addr.Port != httpPort {
489
+ hostMap[addr.Host] = struct{}{}
490
+ }
491
+ }
492
+
493
+ // convert map to slice
494
+ sblockHosts := make([]string, 0, len(hostMap))
495
+ for host := range hostMap {
496
+ sblockHosts = append(sblockHosts, host)
497
+ }
498
+
499
+ return sblockHosts
500
+}
501
+
502
// hasHostCatchAllKey returns true if sb has a key that
503
// omits a host portion, i.e. it "catches all" hosts.
504
func (sb serverBlock) hasHostCatchAllKey() bool {
caddyconfig/httpcaddyfile/tlsapp.go
+1
-1
@@ -189,7 +189,7 @@ func (st ServerType) buildTLSApp(
189
}
190
191
// associate our new automation policy with this server block's hosts
192
- ap.Subjects = sblockHosts
192
+ ap.Subjects = sblock.hostsFromKeysNotHTTP(httpPort)
193
sort.Strings(ap.Subjects) // solely for deterministic test results
194
195
// if a combination of public and internal names were given
caddytest/integration/caddyfile_adapt/tls_automation_policies_7.txt
new
+68
@@ -0,0 +1,68 @@
1
+# (this Caddyfile is contrived, but based on issues #4176 and #4198)
2
+
3
+http://example.com {
4
+}
5
+
6
+https://example.com {
7
+ tls internal
8
+}
9
+
10
+----------
11
+{
12
+ "apps": {
13
+ "http": {
14
+ "servers": {
15
+ "srv0": {
16
+ "listen": [
17
+ ":443"
18
+ ],
19
+ "routes": [
20
+ {
21
+ "match": [
22
+ {
23
+ "host": [
24
+ "example.com"
25
+ ]
26
+ }
27
+ ],
28
+ "terminal": true
29
+ }
30
+ ]
31
+ },
32
+ "srv1": {
33
+ "listen": [
34
+ ":80"
35
+ ],
36
+ "routes": [
37
+ {
38
+ "match": [
39
+ {
40
+ "host": [
41
+ "example.com"
42
+ ]
43
+ }
44
+ ],
45
+ "terminal": true
46
+ }
47
+ ]
48
+ }
49
+ }
50
+ },
51
+ "tls": {
52
+ "automation": {
53
+ "policies": [
54
+ {
55
+ "subjects": [
56
+ "example.com"
57
+ ],
58
+ "issuers": [
59
+ {
60
+ "module": "internal"
61
+ }
62
+ ]
63
+ }
64
+ ]
65
+ }
66
+ }
67
+ }
68
+}
\ No newline at end of file