Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
http: Refactor automatic HTTPS (fixes #2972)
This splits automatic HTTPS into two phases. The first provisions the route matchers and uses them to build the domain set and configure auto HTTP->HTTPS redirects. This happens before the rest of the provisioning does. The second phase takes place at the beginning of the app start. It attaches pointers to the tls app to each server, and begins certificate management for the domains that were found in the first phase.
Matthew Holt committed
Jan 13, 2020 at 16:16 UTC
271b5af14894a8cca5fc6aa6f1c17823a1fb5ff3
4 files changed
+404
-297
modules/caddyhttp/autohttps.go
new
+344
@@ -0,0 +1,344 @@
1
+package caddyhttp
2
+
3
+import (
4
+ "fmt"
5
+ "net/http"
6
+ "strconv"
7
+ "strings"
8
+
9
+ "github.com/caddyserver/caddy/v2"
10
+ "github.com/caddyserver/caddy/v2/modules/caddytls"
11
+ "github.com/mholt/certmagic"
12
+ "go.uber.org/zap"
13
+)
14
+
15
+// AutoHTTPSConfig is used to disable automatic HTTPS
16
+// or certain aspects of it for a specific server.
17
+// HTTPS is enabled automatically and by default when
18
+// qualifying hostnames are available from the config.
19
+type AutoHTTPSConfig struct {
20
+ // If true, automatic HTTPS will be entirely disabled.
21
+ Disabled bool `json:"disable,omitempty"`
22
+
23
+ // If true, only automatic HTTP->HTTPS redirects will
24
+ // be disabled.
25
+ DisableRedir bool `json:"disable_redirects,omitempty"`
26
+
27
+ // Hosts/domain names listed here will not be included
28
+ // in automatic HTTPS (they will not have certificates
29
+ // loaded nor redirects applied).
30
+ Skip []string `json:"skip,omitempty"`
31
+
32
+ // Hosts/domain names listed here will still be enabled
33
+ // for automatic HTTPS (unless in the Skip list), except
34
+ // that certificates will not be provisioned and managed
35
+ // for these names.
36
+ SkipCerts []string `json:"skip_certificates,omitempty"`
37
+
38
+ // By default, automatic HTTPS will obtain and renew
39
+ // certificates for qualifying hostnames. However, if
40
+ // a certificate with a matching SAN is already loaded
41
+ // into the cache, certificate management will not be
42
+ // enabled. To force automated certificate management
43
+ // regardless of loaded certificates, set this to true.
44
+ IgnoreLoadedCerts bool `json:"ignore_loaded_certificates,omitempty"`
45
+
46
+ domainSet map[string]struct{}
47
+}
48
+
49
+// Skipped returns true if name is in skipSlice, which
50
+// should be one of the Skip* fields on ahc.
51
+func (ahc AutoHTTPSConfig) Skipped(name string, skipSlice []string) bool {
52
+ for _, n := range skipSlice {
53
+ if name == n {
54
+ return true
55
+ }
56
+ }
57
+ return false
58
+}
59
+
60
+// automaticHTTPSPhase1 provisions all route matchers, determines
61
+// which domain names found in the routes qualify for automatic
62
+// HTTPS, and sets up HTTP->HTTPS redirects. This phase must occur
63
+// at the beginning of provisioning, because it may add routes and
64
+// even servers to the app, which still need to be set up with the
65
+// rest of them.
66
+func (app *App) automaticHTTPSPhase1(ctx caddy.Context, repl *caddy.Replacer) error {
67
+ // this map will store associations of HTTP listener
68
+ // addresses to the routes that do HTTP->HTTPS redirects
69
+ lnAddrRedirRoutes := make(map[string]Route)
70
+
71
+ for srvName, srv := range app.Servers {
72
+ // as a prerequisite, provision route matchers; this is
73
+ // required for all routes on all servers, and must be
74
+ // done before we attempt to do phase 1 of auto HTTPS,
75
+ // since we have to access the decoded host matchers the
76
+ // handlers will be provisioned later
77
+ if srv.Routes != nil {
78
+ err := srv.Routes.ProvisionMatchers(ctx)
79
+ if err != nil {
80
+ return fmt.Errorf("server %s: setting up route matchers: %v", srvName, err)
81
+ }
82
+ }
83
+
84
+ // prepare for automatic HTTPS
85
+ if srv.AutoHTTPS == nil {
86
+ srv.AutoHTTPS = new(AutoHTTPSConfig)
87
+ }
88
+ if srv.AutoHTTPS.Disabled {
89
+ continue
90
+ }
91
+
92
+ // skip if all listeners use the HTTP port
93
+ if !srv.listenersUseAnyPortOtherThan(app.httpPort()) {
94
+ app.logger.Info("server is listening only on the HTTP port, so no automatic HTTPS will be applied to this server",
95
+ zap.String("server_name", srvName),
96
+ zap.Int("http_port", app.httpPort()),
97
+ )
98
+ srv.AutoHTTPS.Disabled = true
99
+ continue
100
+ }
101
+
102
+ defaultConnPolicies := caddytls.ConnectionPolicies{
103
+ &caddytls.ConnectionPolicy{ALPN: defaultALPN},
104
+ }
105
+
106
+ // if all listeners are on the HTTPS port, make sure
107
+ // there is at least one TLS connection policy; it
108
+ // should be obvious that they want to use TLS without
109
+ // needing to specify one empty policy to enable it
110
+ if srv.TLSConnPolicies == nil &&
111
+ !srv.listenersUseAnyPortOtherThan(app.httpsPort()) {
112
+ app.logger.Info("server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS",
113
+ zap.String("server_name", srvName),
114
+ zap.Int("https_port", app.httpsPort()),
115
+ )
116
+ srv.TLSConnPolicies = defaultConnPolicies
117
+ }
118
+
119
+ // find all qualifying domain names in this server
120
+ srv.AutoHTTPS.domainSet = make(map[string]struct{})
121
+ for routeIdx, route := range srv.Routes {
122
+ for matcherSetIdx, matcherSet := range route.MatcherSets {
123
+ for matcherIdx, m := range matcherSet {
124
+ if hm, ok := m.(*MatchHost); ok {
125
+ for hostMatcherIdx, d := range *hm {
126
+ var err error
127
+ d, err = repl.ReplaceOrErr(d, true, false)
128
+ if err != nil {
129
+ return fmt.Errorf("%s: route %d, matcher set %d, matcher %d, host matcher %d: %v",
130
+ srvName, routeIdx, matcherSetIdx, matcherIdx, hostMatcherIdx, err)
131
+ }
132
+ if certmagic.HostQualifies(d) &&
133
+ !srv.AutoHTTPS.Skipped(d, srv.AutoHTTPS.Skip) {
134
+ srv.AutoHTTPS.domainSet[d] = struct{}{}
135
+ }
136
+ }
137
+ }
138
+ }
139
+ }
140
+ }
141
+
142
+ // nothing more to do here if there are no
143
+ // domains that qualify for automatic HTTPS
144
+ if len(srv.AutoHTTPS.domainSet) == 0 {
145
+ continue
146
+ }
147
+
148
+ // tell the server to use TLS if it is not already doing so
149
+ if srv.TLSConnPolicies == nil {
150
+ srv.TLSConnPolicies = defaultConnPolicies
151
+ }
152
+
153
+ // nothing left to do if auto redirects are disabled
154
+ if srv.AutoHTTPS.DisableRedir {
155
+ continue
156
+ }
157
+
158
+ app.logger.Info("enabling automatic HTTP->HTTPS redirects",
159
+ zap.String("server_name", srvName),
160
+ )
161
+
162
+ // create HTTP->HTTPS redirects
163
+ for _, addr := range srv.Listen {
164
+ netw, host, port, err := caddy.SplitNetworkAddress(addr)
165
+ if err != nil {
166
+ return fmt.Errorf("%s: invalid listener address: %v", srvName, addr)
167
+ }
168
+
169
+ if parts := strings.SplitN(port, "-", 2); len(parts) == 2 {
170
+ port = parts[0]
171
+ }
172
+ redirTo := "https://{http.request.host}"
173
+
174
+ if port != strconv.Itoa(app.httpsPort()) {
175
+ redirTo += ":" + port
176
+ }
177
+ redirTo += "{http.request.uri}"
178
+
179
+ // build the plaintext HTTP variant of this address
180
+ httpRedirLnAddr := caddy.JoinNetworkAddress(netw, host, strconv.Itoa(app.httpPort()))
181
+
182
+ // build the matcher set for this redirect route
183
+ // (note that we happen to bypass Provision and
184
+ // Validate steps for these matcher modules)
185
+ matcherSet := MatcherSet{MatchProtocol("http")}
186
+ if len(srv.AutoHTTPS.Skip) > 0 {
187
+ matcherSet = append(matcherSet, MatchNegate{
188
+ Matchers: MatcherSet{MatchHost(srv.AutoHTTPS.Skip)},
189
+ })
190
+ }
191
+
192
+ // create the route that does the redirect and associate
193
+ // it with the listener address it will be served from
194
+ // (note that we happen to bypass any Provision or Validate
195
+ // steps on the handler modules created here)
196
+ lnAddrRedirRoutes[httpRedirLnAddr] = Route{
197
+ MatcherSets: []MatcherSet{matcherSet},
198
+ Handlers: []MiddlewareHandler{
199
+ StaticResponse{
200
+ StatusCode: WeakString(strconv.Itoa(http.StatusPermanentRedirect)),
201
+ Headers: http.Header{
202
+ "Location": []string{redirTo},
203
+ "Connection": []string{"close"},
204
+ },
205
+ Close: true,
206
+ },
207
+ },
208
+ }
209
+ }
210
+ }
211
+
212
+ // if there are HTTP->HTTPS redirects to add, do so now
213
+ if len(lnAddrRedirRoutes) == 0 {
214
+ return nil
215
+ }
216
+
217
+ var redirServerAddrs []string
218
+ var redirRoutes RouteList
219
+
220
+ // for each redirect listener, see if there's already a
221
+ // server configured to listen on that exact address; if so,
222
+ // simply add the redirect route to the end of its route
223
+ // list; otherwise, we'll create a new server for all the
224
+ // listener addresses that are unused and serve the
225
+ // remaining redirects from it
226
+redirRoutesLoop:
227
+ for addr, redirRoute := range lnAddrRedirRoutes {
228
+ for srvName, srv := range app.Servers {
229
+ if srv.hasListenerAddress(addr) {
230
+ // user has configured a server for the same address
231
+ // that the redirect runs from; simply append our
232
+ // redirect route to the existing routes, with a
233
+ // caveat that their config might override ours
234
+ app.logger.Warn("server is listening on same interface as redirects, so automatic HTTP->HTTPS redirects might be overridden by your own configuration",
235
+ zap.String("server_name", srvName),
236
+ zap.String("interface", addr),
237
+ )
238
+ srv.Routes = append(srv.Routes, redirRoute)
239
+ continue redirRoutesLoop
240
+ }
241
+ }
242
+ // no server with this listener address exists;
243
+ // save this address and route for custom server
244
+ redirServerAddrs = append(redirServerAddrs, addr)
245
+ redirRoutes = append(redirRoutes, redirRoute)
246
+ }
247
+
248
+ // if there are routes remaining which do not belong
249
+ // in any existing server, make our own to serve the
250
+ // rest of the redirects
251
+ if len(redirServerAddrs) > 0 {
252
+ app.Servers["remaining_auto_https_redirects"] = &Server{
253
+ Listen: redirServerAddrs,
254
+ Routes: redirRoutes,
255
+ }
256
+ }
257
+
258
+ return nil
259
+}
260
+
261
+// automaticHTTPSPhase2 attaches a TLS app pointer to each
262
+// server and begins certificate management for all names
263
+// in the qualifying domain set for each server. This phase
264
+// must occur after provisioning, and at the beginning of
265
+// the app start, before starting each of the servers.
266
+func (app *App) automaticHTTPSPhase2() error {
267
+ tlsAppIface, err := app.ctx.App("tls")
268
+ if err != nil {
269
+ return fmt.Errorf("getting tls app: %v", err)
270
+ }
271
+ tlsApp := tlsAppIface.(*caddytls.TLS)
272
+
273
+ // set the tlsApp pointer before starting any
274
+ // challenges, since it is required to solve
275
+ // the ACME HTTP challenge
276
+ for _, srv := range app.Servers {
277
+ srv.tlsApp = tlsApp
278
+ }
279
+
280
+ // begin managing certificates for enabled servers
281
+ for srvName, srv := range app.Servers {
282
+ if srv.AutoHTTPS == nil ||
283
+ srv.AutoHTTPS.Disabled ||
284
+ len(srv.AutoHTTPS.domainSet) == 0 {
285
+ continue
286
+ }
287
+
288
+ // marshal the domains into a slice
289
+ var domains, domainsForCerts []string
290
+ for d := range srv.AutoHTTPS.domainSet {
291
+ domains = append(domains, d)
292
+ if !srv.AutoHTTPS.Skipped(d, srv.AutoHTTPS.SkipCerts) {
293
+ // if a certificate for this name is already loaded,
294
+ // don't obtain another one for it, unless we are
295
+ // supposed to ignore loaded certificates
296
+ if !srv.AutoHTTPS.IgnoreLoadedCerts &&
297
+ len(tlsApp.AllMatchingCertificates(d)) > 0 {
298
+ app.logger.Info("skipping automatic certificate management because one or more matching certificates are already loaded",
299
+ zap.String("domain", d),
300
+ zap.String("server_name", srvName),
301
+ )
302
+ continue
303
+ }
304
+ domainsForCerts = append(domainsForCerts, d)
305
+ }
306
+ }
307
+
308
+ // ensure that these certificates are managed properly;
309
+ // for example, it's implied that the HTTPPort should also
310
+ // be the port the HTTP challenge is solved on, and so
311
+ // for HTTPS port and TLS-ALPN challenge also - we need
312
+ // to tell the TLS app to manage these certs by honoring
313
+ // those port configurations
314
+ acmeManager := &caddytls.ACMEManagerMaker{
315
+ Challenges: &caddytls.ChallengesConfig{
316
+ HTTP: &caddytls.HTTPChallengeConfig{
317
+ AlternatePort: app.HTTPPort, // we specifically want the user-configured port, if any
318
+ },
319
+ TLSALPN: &caddytls.TLSALPNChallengeConfig{
320
+ AlternatePort: app.HTTPSPort, // we specifically want the user-configured port, if any
321
+ },
322
+ },
323
+ }
324
+ if tlsApp.Automation == nil {
325
+ tlsApp.Automation = new(caddytls.AutomationConfig)
326
+ }
327
+ tlsApp.Automation.Policies = append(tlsApp.Automation.Policies,
328
+ caddytls.AutomationPolicy{
329
+ Hosts: domainsForCerts,
330
+ Management: acmeManager,
331
+ })
332
+
333
+ // manage their certificates
334
+ app.logger.Info("enabling automatic TLS certificate management",
335
+ zap.Strings("domains", domainsForCerts),
336
+ )
337
+ err := tlsApp.Manage(domainsForCerts)
338
+ if err != nil {
339
+ return fmt.Errorf("%s: managing certificate for %s: %s", srvName, domains, err)
340
+ }
341
+ }
342
+
343
+ return nil
344
+}
modules/caddyhttp/caddyhttp.go
+31
-244
@@ -25,13 +25,10 @@ import (
25
"net"
26
"net/http"
27
"strconv"
28
- "strings"
28
"time"
29
30
"github.com/caddyserver/caddy/v2"
32
- "github.com/caddyserver/caddy/v2/modules/caddytls"
31
"github.com/lucas-clemente/quic-go/http3"
34
- "github.com/mholt/certmagic"
32
"go.uber.org/zap"
33
)
34
@@ -52,7 +49,7 @@ func init() {
49
// only on the HTTPS port but which do not have any TLS connection policies
50
// defined by adding a good, default TLS connection policy.
51
//
55
-// In HTTP routes, additional placeholders are available:
52
+// In HTTP routes, additional placeholders are available (replace any `*`):
53
//
54
// Placeholder | Description
55
// ------------|---------------
@@ -127,6 +124,14 @@ func (app *App) Provision(ctx caddy.Context) error {
124
125
repl := caddy.NewReplacer()
126
127
+ // this provisions the matchers for each route,
128
+ // and prepares auto HTTP->HTTP redirects, and
129
+ // is required before we provision each server
130
+ err := app.automaticHTTPSPhase1(ctx, repl)
131
+ if err != nil {
132
+ return err
133
+ }
134
+
135
for srvName, srv := range app.Servers {
136
srv.logger = app.logger.Named("log")
137
srv.errorLogger = app.logger.Named("log.error")
@@ -136,11 +141,6 @@ func (app *App) Provision(ctx caddy.Context) error {
141
srv.accessLogger = app.logger.Named("log.access")
142
}
143
139
- if srv.AutoHTTPS == nil {
140
- // avoid nil pointer dereferences
141
- srv.AutoHTTPS = new(AutoHTTPSConfig)
142
- }
143
-
144
// if not explicitly configured by the user, disallow TLS
145
// client auth bypass (domain fronting) which could
146
// otherwise be exploited by sending an unprotected SNI
@@ -151,6 +151,9 @@ func (app *App) Provision(ctx caddy.Context) error {
151
// domain fronting is desired and access is not restricted
152
// based on hostname
153
if srv.StrictSNIHost == nil && srv.hasTLSClientAuth() {
154
+ app.logger.Info("enabling strict SNI-Host matching because TLS client auth is configured",
155
+ zap.String("server_name", srvName),
156
+ )
157
trueBool := true
158
srv.StrictSNIHost = &trueBool
159
}
@@ -164,18 +167,19 @@ func (app *App) Provision(ctx caddy.Context) error {
167
srv.Listen[i] = lnOut
168
}
169
170
+ // pre-compile the primary handler chain, and be sure to wrap it in our
171
+ // route handler so that important security checks are done, etc.
172
primaryRoute := emptyHandler
173
if srv.Routes != nil {
169
- err := srv.Routes.Provision(ctx)
174
+ err := srv.Routes.ProvisionHandlers(ctx)
175
if err != nil {
171
- return fmt.Errorf("server %s: setting up server routes: %v", srvName, err)
176
+ return fmt.Errorf("server %s: setting up route handlers: %v", srvName, err)
177
}
173
- // pre-compile the handler chain, and be sure to wrap it in our
174
- // route handler so that important security checks are done, etc.
178
primaryRoute = srv.Routes.Compile(emptyHandler)
179
}
180
srv.primaryHandlerChain = srv.wrapPrimaryRoute(primaryRoute)
181
182
+ // pre-compile the error handler chain
183
if srv.Errors != nil {
184
err := srv.Errors.Routes.Provision(ctx)
185
if err != nil {
@@ -213,9 +217,12 @@ func (app *App) Validate() error {
217
return nil
218
}
219
216
-// Start runs the app. It sets up automatic HTTPS if enabled.
220
+// Start runs the app. It finishes automatic HTTPS if enabled,
221
+// including management of certificates.
222
func (app *App) Start() error {
218
- err := app.automaticHTTPS()
223
+ // finish setting up automatic HTTPS and manage certs;
224
+ // this must happen before each server is started
225
+ err := app.automaticHTTPSPhase2()
226
if err != nil {
227
return fmt.Errorf("enabling automatic HTTPS: %v", err)
228
}
@@ -235,8 +242,8 @@ func (app *App) Start() error {
242
if err != nil {
243
return fmt.Errorf("%s: parsing listen address '%s': %v", srvName, lnAddr, err)
244
}
238
- for i := uint(0); i < listenAddr.PortRangeSize(); i++ {
239
- hostport := listenAddr.JoinHostPort(i)
245
+ for portOffset := uint(0); portOffset < listenAddr.PortRangeSize(); portOffset++ {
246
+ hostport := listenAddr.JoinHostPort(portOffset)
247
ln, err := caddy.Listen(listenAddr.Network, hostport)
248
if err != nil {
249
return fmt.Errorf("%s: listening on %s: %v", listenAddr.Network, hostport, err)
@@ -249,8 +256,10 @@ func (app *App) Start() error {
256
}
257
}
258
252
- // enable TLS
253
- if len(srv.TLSConnPolicies) > 0 && int(i) != app.httpPort() {
259
+ // enable TLS if there is a policy and if this is not the HTTP port
260
+ if len(srv.TLSConnPolicies) > 0 &&
261
+ int(listenAddr.StartPort+portOffset) != app.httpPort() {
262
+ // create TLS listener
263
tlsCfg, err := srv.TLSConnPolicies.TLSConfig(app.ctx)
264
if err != nil {
265
return fmt.Errorf("%s/%s: making TLS configuration: %v", listenAddr.Network, hostport, err)
@@ -330,230 +339,6 @@ func (app *App) Stop() error {
339
return nil
340
}
341
333
-func (app *App) automaticHTTPS() error {
334
- tlsAppIface, err := app.ctx.App("tls")
335
- if err != nil {
336
- return fmt.Errorf("getting tls app: %v", err)
337
- }
338
- tlsApp := tlsAppIface.(*caddytls.TLS)
339
-
340
- // this map will store associations of HTTP listener
341
- // addresses to the routes that do HTTP->HTTPS redirects
342
- lnAddrRedirRoutes := make(map[string]Route)
343
-
344
- repl := caddy.NewReplacer()
345
-
346
- for srvName, srv := range app.Servers {
347
- srv.tlsApp = tlsApp
348
-
349
- if srv.AutoHTTPS.Disabled {
350
- continue
351
- }
352
-
353
- // skip if all listeners use the HTTP port
354
- if !srv.listenersUseAnyPortOtherThan(app.httpPort()) {
355
- app.logger.Info("server is only listening on the HTTP port, so no automatic HTTPS will be applied to this server",
356
- zap.String("server_name", srvName),
357
- zap.Int("http_port", app.httpPort()),
358
- )
359
- continue
360
- }
361
-
362
- // if all listeners are on the HTTPS port, make sure
363
- // there is at least one TLS connection policy; it
364
- // should be obvious that they want to use TLS without
365
- // needing to specify one empty policy to enable it
366
- if !srv.listenersUseAnyPortOtherThan(app.httpsPort()) && len(srv.TLSConnPolicies) == 0 {
367
- app.logger.Info("server is only listening on the HTTPS port but has no TLS connection policies; adding one to enable TLS",
368
- zap.String("server_name", srvName),
369
- zap.Int("https_port", app.httpsPort()),
370
- )
371
- srv.TLSConnPolicies = append(srv.TLSConnPolicies, new(caddytls.ConnectionPolicy))
372
- }
373
-
374
- // find all qualifying domain names, de-duplicated
375
- domainSet := make(map[string]struct{})
376
- for routeIdx, route := range srv.Routes {
377
- for matcherSetIdx, matcherSet := range route.MatcherSets {
378
- for matcherIdx, m := range matcherSet {
379
- if hm, ok := m.(*MatchHost); ok {
380
- for hostMatcherIdx, d := range *hm {
381
- d, err = repl.ReplaceOrErr(d, true, false)
382
- if err != nil {
383
- return fmt.Errorf("%s: route %d, matcher set %d, matcher %d, host matcher %d: %v",
384
- srvName, routeIdx, matcherSetIdx, matcherIdx, hostMatcherIdx, err)
385
- }
386
- if certmagic.HostQualifies(d) &&
387
- !srv.AutoHTTPS.Skipped(d, srv.AutoHTTPS.Skip) {
388
- domainSet[d] = struct{}{}
389
- }
390
- }
391
- }
392
- }
393
- }
394
- }
395
-
396
- if len(domainSet) > 0 {
397
- // marshal the domains into a slice
398
- var domains, domainsForCerts []string
399
- for d := range domainSet {
400
- domains = append(domains, d)
401
- if !srv.AutoHTTPS.Skipped(d, srv.AutoHTTPS.SkipCerts) {
402
- // if a certificate for this name is already loaded,
403
- // don't obtain another one for it, unless we are
404
- // supposed to ignore loaded certificates
405
- if !srv.AutoHTTPS.IgnoreLoadedCerts &&
406
- len(tlsApp.AllMatchingCertificates(d)) > 0 {
407
- app.logger.Info("skipping automatic certificate management because one or more matching certificates are already loaded",
408
- zap.String("domain", d),
409
- zap.String("server_name", srvName),
410
- )
411
- continue
412
- }
413
- domainsForCerts = append(domainsForCerts, d)
414
- }
415
- }
416
-
417
- // ensure that these certificates are managed properly;
418
- // for example, it's implied that the HTTPPort should also
419
- // be the port the HTTP challenge is solved on, and so
420
- // for HTTPS port and TLS-ALPN challenge also - we need
421
- // to tell the TLS app to manage these certs by honoring
422
- // those port configurations
423
- acmeManager := &caddytls.ACMEManagerMaker{
424
- Challenges: &caddytls.ChallengesConfig{
425
- HTTP: &caddytls.HTTPChallengeConfig{
426
- AlternatePort: app.HTTPPort, // we specifically want the user-configured port, if any
427
- },
428
- TLSALPN: &caddytls.TLSALPNChallengeConfig{
429
- AlternatePort: app.HTTPSPort, // we specifically want the user-configured port, if any
430
- },
431
- },
432
- }
433
- if tlsApp.Automation == nil {
434
- tlsApp.Automation = new(caddytls.AutomationConfig)
435
- }
436
- tlsApp.Automation.Policies = append(tlsApp.Automation.Policies,
437
- caddytls.AutomationPolicy{
438
- Hosts: domainsForCerts,
439
- Management: acmeManager,
440
- })
441
-
442
- // manage their certificates
443
- app.logger.Info("enabling automatic TLS certificate management",
444
- zap.Strings("domains", domainsForCerts),
445
- )
446
- err := tlsApp.Manage(domainsForCerts)
447
- if err != nil {
448
- return fmt.Errorf("%s: managing certificate for %s: %s", srvName, domains, err)
449
- }
450
-
451
- // tell the server to use TLS if it is not already doing so
452
- if srv.TLSConnPolicies == nil {
453
- srv.TLSConnPolicies = caddytls.ConnectionPolicies{
454
- &caddytls.ConnectionPolicy{ALPN: defaultALPN},
455
- }
456
- }
457
-
458
- if srv.AutoHTTPS.DisableRedir {
459
- continue
460
- }
461
-
462
- app.logger.Info("enabling automatic HTTP->HTTPS redirects",
463
- zap.Strings("domains", domains),
464
- )
465
-
466
- // create HTTP->HTTPS redirects
467
- for _, addr := range srv.Listen {
468
- netw, host, port, err := caddy.SplitNetworkAddress(addr)
469
- if err != nil {
470
- return fmt.Errorf("%s: invalid listener address: %v", srvName, addr)
471
- }
472
-
473
- if parts := strings.SplitN(port, "-", 2); len(parts) == 2 {
474
- port = parts[0]
475
- }
476
- redirTo := "https://{http.request.host}"
477
-
478
- if port != strconv.Itoa(app.httpsPort()) {
479
- redirTo += ":" + port
480
- }
481
- redirTo += "{http.request.uri}"
482
-
483
- // build the plaintext HTTP variant of this address
484
- httpRedirLnAddr := caddy.JoinNetworkAddress(netw, host, strconv.Itoa(app.httpPort()))
485
-
486
- // create the route that does the redirect and associate
487
- // it with the listener address it will be served from
488
- lnAddrRedirRoutes[httpRedirLnAddr] = Route{
489
- MatcherSets: []MatcherSet{{MatchProtocol("http")}},
490
- Handlers: []MiddlewareHandler{
491
- StaticResponse{
492
- StatusCode: WeakString(strconv.Itoa(http.StatusPermanentRedirect)),
493
- Headers: http.Header{
494
- "Location": []string{redirTo},
495
- "Connection": []string{"close"},
496
- },
497
- Close: true,
498
- },
499
- },
500
- }
501
-
502
- }
503
- }
504
- }
505
-
506
- // if there are HTTP->HTTPS redirects to add, do so now
507
- if len(lnAddrRedirRoutes) > 0 {
508
- var redirServerAddrs []string
509
- var redirRoutes RouteList
510
-
511
- // for each redirect listener, see if there's already a
512
- // server configured to listen on that exact address; if so,
513
- // simply add the redirect route to the end of its route
514
- // list; otherwise, we'll create a new server for all the
515
- // listener addresses that are unused and serve the
516
- // remaining redirects from it
517
- redirRoutesLoop:
518
- for addr, redirRoute := range lnAddrRedirRoutes {
519
- for srvName, srv := range app.Servers {
520
- if srv.hasListenerAddress(addr) {
521
- // user has configured a server for the same address
522
- // that the redirect runs from; simply append our
523
- // redirect route to the existing routes, with a
524
- // caveat that their config might override ours
525
- app.logger.Warn("server is listening on same interface as redirects, so automatic HTTP->HTTPS redirects might be overridden by your own configuration",
526
- zap.String("server_name", srvName),
527
- zap.String("interface", addr),
528
- )
529
- srv.Routes = append(srv.Routes, redirRoute)
530
- continue redirRoutesLoop
531
- }
532
- }
533
- // no server with this listener address exists;
534
- // save this address and route for custom server
535
- redirServerAddrs = append(redirServerAddrs, addr)
536
- redirRoutes = append(redirRoutes, redirRoute)
537
- }
538
-
539
- // if there are routes remaining which do not belong
540
- // in any existing server, make our own to serve the
541
- // rest of the redirects
542
- if len(redirServerAddrs) > 0 {
543
- app.Servers["remaining_auto_https_redirects"] = &Server{
544
- Listen: redirServerAddrs,
545
- Routes: redirRoutes,
546
- tlsApp: tlsApp, // required to solve HTTP challenge
547
- logger: app.logger.Named("log"),
548
- errorLogger: app.logger.Named("log.error"),
549
- primaryHandlerChain: redirRoutes.Compile(emptyHandler),
550
- }
551
- }
552
- }
553
-
554
- return nil
555
-}
556
-
342
func (app *App) httpPort() int {
343
if app.HTTPPort == 0 {
344
return DefaultHTTPPort
@@ -709,7 +494,9 @@ func StatusCodeMatches(actual, configured int) bool {
494
if actual == configured {
495
return true
496
}
712
- if configured < 100 && actual >= configured*100 && actual < (configured+1)*100 {
497
+ if configured < 100 &&
498
+ actual >= configured*100 &&
499
+ actual < (configured+1)*100 {
500
return true
501
}
502
return false
modules/caddyhttp/routes.go
+24
-5
@@ -113,23 +113,43 @@ func (r Route) Empty() bool {
113
// create a middleware chain.
114
type RouteList []Route
115
116
-// Provision sets up all the routes by loading the modules.
116
+// Provision sets up both the matchers and handlers in the route.
117
func (routes RouteList) Provision(ctx caddy.Context) error {
118
+ err := routes.ProvisionMatchers(ctx)
119
+ if err != nil {
120
+ return err
121
+ }
122
+ return routes.ProvisionHandlers(ctx)
123
+}
124
+
125
+// ProvisionMatchers sets up all the matchers by loading the
126
+// matcher modules. Only call this method directly if you need
127
+// to set up matchers and handlers separately without having
128
+// to provision a second time; otherwise use Provision instead.
129
+func (routes RouteList) ProvisionMatchers(ctx caddy.Context) error {
130
for i := range routes {
131
// matchers
132
matchersIface, err := ctx.LoadModule(&routes[i], "MatcherSetsRaw")
133
if err != nil {
122
- return fmt.Errorf("loading matchers in route %d: %v", i, err)
134
+ return fmt.Errorf("route %d: loading matcher modules: %v", i, err)
135
}
136
err = routes[i].MatcherSets.FromInterface(matchersIface)
137
if err != nil {
138
return fmt.Errorf("route %d: %v", i, err)
139
}
140
+ }
141
+ return nil
142
+}
143
129
- // handlers
144
+// ProvisionHandlers sets up all the handlers by loading the
145
+// handler modules. Only call this method directly if you need
146
+// to set up matchers and handlers separately without having
147
+// to provision a second time; otherwise use Provision instead.
148
+func (routes RouteList) ProvisionHandlers(ctx caddy.Context) error {
149
+ for i := range routes {
150
handlersIface, err := ctx.LoadModule(&routes[i], "HandlersRaw")
151
if err != nil {
132
- return fmt.Errorf("loading handler modules in route %d: %v", i, err)
152
+ return fmt.Errorf("route %d: loading handler modules: %v", i, err)
153
}
154
for _, handler := range handlersIface.([]interface{}) {
155
routes[i].Handlers = append(routes[i].Handlers, handler.(MiddlewareHandler))
@@ -140,7 +160,6 @@ func (routes RouteList) Provision(ctx caddy.Context) error {
160
routes[i].middleware = append(routes[i].middleware, wrapMiddleware(midhandler))
161
}
162
}
143
-
163
return nil
164
}
165
modules/caddyhttp/server.go
+5
-48
@@ -173,7 +173,7 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
173
}
174
175
log("handled request",
176
- zap.String("common_log", repl.ReplaceAll(CommonLogFormat, "-")),
176
+ zap.String("common_log", repl.ReplaceAll(commonLogFormat, "-")),
177
zap.Duration("latency", latency),
178
zap.Int("size", wrec.Size()),
179
zap.Int("status", wrec.Status()),
@@ -317,49 +317,6 @@ func (s *Server) hasTLSClientAuth() bool {
317
return false
318
}
319
320
-// AutoHTTPSConfig is used to disable automatic HTTPS
321
-// or certain aspects of it for a specific server.
322
-// HTTPS is enabled automatically and by default when
323
-// qualifying hostnames are available from the config.
324
-type AutoHTTPSConfig struct {
325
- // If true, automatic HTTPS will be entirely disabled.
326
- Disabled bool `json:"disable,omitempty"`
327
-
328
- // If true, only automatic HTTP->HTTPS redirects will
329
- // be disabled.
330
- DisableRedir bool `json:"disable_redirects,omitempty"`
331
-
332
- // Hosts/domain names listed here will not be included
333
- // in automatic HTTPS (they will not have certificates
334
- // loaded nor redirects applied).
335
- Skip []string `json:"skip,omitempty"`
336
-
337
- // Hosts/domain names listed here will still be enabled
338
- // for automatic HTTPS (unless in the Skip list), except
339
- // that certificates will not be provisioned and managed
340
- // for these names.
341
- SkipCerts []string `json:"skip_certificates,omitempty"`
342
-
343
- // By default, automatic HTTPS will obtain and renew
344
- // certificates for qualifying hostnames. However, if
345
- // a certificate with a matching SAN is already loaded
346
- // into the cache, certificate management will not be
347
- // enabled. To force automated certificate management
348
- // regardless of loaded certificates, set this to true.
349
- IgnoreLoadedCerts bool `json:"ignore_loaded_certificates,omitempty"`
350
-}
351
-
352
-// Skipped returns true if name is in skipSlice, which
353
-// should be one of the Skip* fields on ahc.
354
-func (ahc AutoHTTPSConfig) Skipped(name string, skipSlice []string) bool {
355
- for _, n := range skipSlice {
356
- if name == n {
357
- return true
358
- }
359
- }
360
- return false
361
-}
362
-
320
// HTTPErrorConfig determines how to handle errors
321
// from the HTTP handlers.
322
type HTTPErrorConfig struct {
@@ -466,11 +423,11 @@ func cloneURL(from, to *url.URL) {
423
}
424
425
const (
469
- // CommonLogFormat is the common log format. https://en.wikipedia.org/wiki/Common_Log_Format
470
- CommonLogFormat = `{http.request.remote.host} ` + CommonLogEmptyValue + ` {http.authentication.user.id} [{time.now.common_log}] "{http.request.orig_method} {http.request.orig_uri} {http.request.proto}" {http.response.status} {http.response.size}`
426
+ // commonLogFormat is the common log format. https://en.wikipedia.org/wiki/Common_Log_Format
427
+ commonLogFormat = `{http.request.remote.host} ` + commonLogEmptyValue + ` {http.authentication.user.id} [{time.now.common_log}] "{http.request.orig_method} {http.request.orig_uri} {http.request.proto}" {http.response.status} {http.response.size}`
428
472
- // CommonLogEmptyValue is the common empty log value.
473
- CommonLogEmptyValue = "-"
429
+ // commonLogEmptyValue is the common empty log value.
430
+ commonLogEmptyValue = "-"
431
)
432
433
// Context keys for HTTP request context values.