Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 05:30 UTC
caddytls: Zero out throttle window first (#5443)
* caddytls: Zero out throttle window first * Don't error for on-demand Fixes https://github.com/caddyserver/caddy/commit/b97c76fb4789b8da0b80f5a2c1c1c5bebba163b5 --------- Co-authored-by: Francis Lavoie <lavofr@gmail.com>
Matt Holt committed
Mar 20, 2023 at 12:06 UTC
0cc49c053f77bf6efa8107fa50d2e256a91d0ff8
2 files changed
+23
-15
modules/caddytls/automation.go
+21
-2
@@ -19,6 +19,7 @@ import (
19
"errors"
20
"fmt"
21
"net/http"
22
+ "strings"
23
"time"
24
25
"github.com/caddyserver/caddy/v2"
@@ -224,8 +225,10 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
225
// on-demand TLS
226
var ond *certmagic.OnDemandConfig
227
if ap.OnDemand {
227
- // ask endpoint is now required after a number of negligence cases causing abuse
228
- if !ap.onlyInternalIssuer() && (tlsApp.Automation == nil || tlsApp.Automation.OnDemand == nil || tlsApp.Automation.OnDemand.Ask == "") {
228
+ // ask endpoint is now required after a number of negligence cases causing abuse;
229
+ // but is still allowed for explicit subjects (non-wildcard, non-unbounded),
230
+ // and for the internal issuer since it doesn't cause ACME issuer pressure
231
+ if ap.isWildcardOrDefault() && !ap.onlyInternalIssuer() && (tlsApp.Automation == nil || tlsApp.Automation.OnDemand == nil || tlsApp.Automation.OnDemand.Ask == "") {
232
return fmt.Errorf("on-demand TLS cannot be enabled without an 'ask' endpoint to prevent abuse; please refer to documentation for details")
233
}
234
ond = &certmagic.OnDemandConfig{
@@ -294,6 +297,22 @@ func (ap *AutomationPolicy) onlyInternalIssuer() bool {
297
return ok
298
}
299
300
+// isWildcardOrDefault determines if the subjects include any wildcard domains,
301
+// or is the "default" policy (i.e. no subjects) which is unbounded.
302
+func (ap *AutomationPolicy) isWildcardOrDefault() bool {
303
+ isWildcardOrDefault := false
304
+ if len(ap.Subjects) == 0 {
305
+ isWildcardOrDefault = true
306
+ }
307
+ for _, sub := range ap.Subjects {
308
+ if strings.HasPrefix(sub, "*") {
309
+ isWildcardOrDefault = true
310
+ break
311
+ }
312
+ }
313
+ return isWildcardOrDefault
314
+}
315
+
316
// DefaultIssuers returns empty Issuers (not provisioned) to be used as defaults.
317
// This function is experimental and has no compatibility promises.
318
func DefaultIssuers() []certmagic.Issuer {
modules/caddytls/tls.go
+2
-13
@@ -22,7 +22,6 @@ import (
22
"log"
23
"net/http"
24
"runtime/debug"
25
- "strings"
25
"sync"
26
"time"
27
@@ -182,8 +181,8 @@ func (t *TLS) Provision(ctx caddy.Context) error {
181
onDemandRateLimiter.SetWindow(time.Duration(t.Automation.OnDemand.RateLimit.Interval))
182
} else {
183
// remove any existing rate limiter
185
- onDemandRateLimiter.SetMaxEvents(0)
184
onDemandRateLimiter.SetWindow(0)
185
+ onDemandRateLimiter.SetMaxEvents(0)
186
}
187
188
// run replacer on ask URL (for environment variables) -- return errors to prevent surprises (#5036)
@@ -260,17 +259,7 @@ func (t *TLS) Start() error {
259
if t.Automation.OnDemand == nil ||
260
(t.Automation.OnDemand.Ask == "" && t.Automation.OnDemand.RateLimit == nil) {
261
for _, ap := range t.Automation.Policies {
263
- isWildcardOrDefault := false
264
- if len(ap.Subjects) == 0 {
265
- isWildcardOrDefault = true
266
- }
267
- for _, sub := range ap.Subjects {
268
- if strings.HasPrefix(sub, "*") {
269
- isWildcardOrDefault = true
270
- break
271
- }
272
- }
273
- if ap.OnDemand && isWildcardOrDefault {
262
+ if ap.OnDemand && ap.isWildcardOrDefault() {
263
t.logger.Warn("YOUR SERVER MAY BE VULNERABLE TO ABUSE: on-demand TLS is enabled, but no protections are in place",
264
zap.String("docs", "https://caddyserver.com/docs/automatic-https#on-demand-tls"))
265
break