Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 13:30 UTC
Fix lint errors
Use VerifyConnection instead of VerifyPeerCertificate; the other 2 fixes are "meh" not really a big deal or an issue at all.
Matthew Holt committed
Mar 11, 2026 at 13:33 UTC
1fbb28720b5d20d54074593b3c5d12f3549f371b
3 files changed
+31
-16
cmd/commandfuncs.go
+1
-1
@@ -697,7 +697,7 @@ func cmdFmt(fl Flags) (int, error) {
697
output := caddyfile.Format(input)
698
699
if fl.Bool("overwrite") {
700
- if err := os.WriteFile(configFile, output, 0o600); err != nil {
700
+ if err := os.WriteFile(configFile, output, 0o600); err != nil { //nolint:gosec // path traversal is not really a thing here, this is either "Caddyfile" or admin-controlled
701
return caddy.ExitCodeFailedStartup, fmt.Errorf("overwriting formatted file: %v", err)
702
}
703
return caddy.ExitCodeSuccess, nil
modules/caddytls/connpolicy.go
+14
-9
@@ -885,24 +885,29 @@ func (clientauth *ClientAuthentication) ConfigureTLSConfig(cfg *tls.Config) erro
885
886
// if a custom verification function already exists, wrap it
887
clientauth.existingVerifyPeerCert = cfg.VerifyPeerCertificate
888
- cfg.VerifyPeerCertificate = clientauth.verifyPeerCertificate
888
+ cfg.VerifyConnection = clientauth.verifyConnection
889
return nil
890
}
891
892
-// verifyPeerCertificate is for use as a tls.Config.VerifyPeerCertificate
893
-// callback to do custom client certificate verification. It is intended
894
-// for installation only by clientauth.ConfigureTLSConfig().
895
-func (clientauth *ClientAuthentication) verifyPeerCertificate(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
892
+// verifyConnection is for use as a tls.Config.VerifyConnection callback
893
+// to do custom client certificate verification. It is intended for
894
+// installation only by clientauth.ConfigureTLSConfig().
895
+//
896
+// Unlike VerifyPeerCertificate, VerifyConnection is called on every
897
+// connection including resumed sessions, preventing session-resumption bypass.
898
+func (clientauth *ClientAuthentication) verifyConnection(cs tls.ConnectionState) error {
899
// first use any pre-existing custom verification function
900
if clientauth.existingVerifyPeerCert != nil {
898
- err := clientauth.existingVerifyPeerCert(rawCerts, verifiedChains)
899
- if err != nil {
901
+ rawCerts := make([][]byte, len(cs.PeerCertificates))
902
+ for i, cert := range cs.PeerCertificates {
903
+ rawCerts[i] = cert.Raw
904
+ }
905
+ if err := clientauth.existingVerifyPeerCert(rawCerts, cs.VerifiedChains); err != nil {
906
return err
907
}
908
}
909
for _, verifier := range clientauth.verifiers {
904
- err := verifier.VerifyClientCertificate(rawCerts, verifiedChains)
905
- if err != nil {
910
+ if err := verifier.VerifyClientCertificate(nil, cs.VerifiedChains); err != nil {
911
return err
912
}
913
}
modules/caddytls/folderloader.go
+16
-6
@@ -19,6 +19,7 @@ import (
19
"crypto/tls"
20
"encoding/pem"
21
"fmt"
22
+ "io/fs"
23
"os"
24
"path/filepath"
25
"strings"
@@ -62,18 +63,27 @@ func (fl FolderLoader) Provision(ctx caddy.Context) error {
63
func (fl FolderLoader) LoadCertificates() ([]Certificate, error) {
64
var certs []Certificate
65
for _, dir := range fl {
65
- err := filepath.Walk(dir, func(fpath string, info os.FileInfo, err error) error {
66
+ root, err := os.OpenRoot(dir)
67
+ if err != nil {
68
+ return nil, fmt.Errorf("unable to open root directory %s: %w", dir, err)
69
+ }
70
+ err = filepath.WalkDir(dir, func(fpath string, d fs.DirEntry, err error) error {
71
if err != nil {
72
return fmt.Errorf("unable to traverse into path: %s", fpath)
73
}
69
- if info.IsDir() {
74
+ if d.IsDir() {
75
return nil
76
}
72
- if !strings.HasSuffix(strings.ToLower(info.Name()), ".pem") {
77
+ if !strings.HasSuffix(strings.ToLower(d.Name()), ".pem") {
78
return nil
79
}
80
76
- bundle, err := os.ReadFile(fpath)
81
+ rel, err := filepath.Rel(dir, fpath)
82
+ if err != nil {
83
+ return fmt.Errorf("unable to get relative path for %s: %w", fpath, err)
84
+ }
85
+
86
+ bundle, err := root.ReadFile(rel)
87
if err != nil {
88
return err
89
}
@@ -83,11 +93,11 @@ func (fl FolderLoader) LoadCertificates() ([]Certificate, error) {
93
}
94
95
certs = append(certs, Certificate{Certificate: cert})
86
-
96
return nil
97
})
98
+ _ = root.Close()
99
if err != nil {
90
- return nil, err
100
+ return nil, fmt.Errorf("walking certificates directory %s: %w", dir, err)
101
}
102
}
103
return certs, nil