Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
httpcaddyfile, caddytls: Multiple edge case fixes; add tests
- Create two default automation policies; if the TLS app is used in isolation with the 'automate' certificate loader, it will now use an internal issuer for internal-only names, and an ACME issuer for all other names by default. - If the HTTP Caddyfile adds an 'automate' loader, it now also adds an automation policy for any names in that loader that do not qualify for public certificates so that they will be issued internally. (It might be nice if this wasn't necessary, but the alternative is to either make auto-HTTPS logic way more complex by scanning the names in the 'automate' loader, or to have an automation policy without an issuer switch between default issuer based on the name being issued a certificate - I think I like the latter option better, right now we do something kind of like that but at a level above each individual automation policies, we do that switch only when no automation policies match, rather than when a policy without an issuer does match.) - Set the default LoggerName rather than a LoggerNames with an empty host value, which is now taken literally rather than as a catch-all. - hostsFromKeys, the function that gets a list of hosts from server block keys, no longer returns an empty string in its resulting slice, ever.
Matthew Holt committed
Apr 8, 2020 at 14:46 UTC
28fdf64dc510472ccd9e6d46eb149d19cd70919a
6 files changed
+186
-39
caddyconfig/httpcaddyfile/directives.go
+32
-14
@@ -393,23 +393,30 @@ type serverBlock struct {
393
}
394
395
// hostsFromKeys returns a list of all the non-empty hostnames found in
396
-// the keys of the server block sb, unless allowEmpty is true, in which
397
-// case a key with no host (e.g. ":443") will be added to the list as an
398
-// empty string. Otherwise, if allowEmpty is false, and if sb has a key
399
-// that omits the hostname (i.e. is a catch-all/empty host), then the returned
400
-// list is empty, because the server block effectively matches ALL hosts.
401
-// The list may not be in a consistent order. If includePorts is true, then
402
-// any non-empty, non-standard ports will be included.
403
-func (sb serverBlock) hostsFromKeys(allowEmpty, includePorts bool) []string {
404
- // first get each unique hostname
396
+// the keys of the server block sb. If logger mode is false, a key with
397
+// an empty hostname portion will return an empty slice, since that
398
+// server block is interpreted to effectively match all hosts. An empty
399
+// string is never added to the slice.
400
+//
401
+// If loggerMode is true, then the non-standard ports of keys will be
402
+// joined to the hostnames. This is to effectively match the Host
403
+// header of requests that come in for that key.
404
+//
405
+// The resulting slice is not sorted but will never have duplicates.
406
+func (sb serverBlock) hostsFromKeys(loggerMode bool) []string {
407
+ // ensure each entry in our list is unique
408
hostMap := make(map[string]struct{})
409
for _, addr := range sb.keys {
407
- if addr.Host == "" && !allowEmpty {
408
- // server block contains a key like ":443", i.e. the host portion
409
- // is empty / catch-all, which means to match all hosts
410
- return []string{}
410
+ if addr.Host == "" {
411
+ if !loggerMode {
412
+ // server block contains a key like ":443", i.e. the host portion
413
+ // is empty / catch-all, which means to match all hosts
414
+ return []string{}
415
+ }
416
+ // never append an empty string
417
+ continue
418
}
412
- if includePorts &&
419
+ if loggerMode &&
420
addr.Port != "" &&
421
addr.Port != strconv.Itoa(caddyhttp.DefaultHTTPPort) &&
422
addr.Port != strconv.Itoa(caddyhttp.DefaultHTTPSPort) {
@@ -428,6 +435,17 @@ func (sb serverBlock) hostsFromKeys(allowEmpty, includePorts bool) []string {
435
return sblockHosts
436
}
437
438
+// hasHostCatchAllKey returns true if sb has a key that
439
+// omits a host portion, i.e. it "catches all" hosts.
440
+func (sb serverBlock) hasHostCatchAllKey() bool {
441
+ for _, addr := range sb.keys {
442
+ if addr.Host == "" {
443
+ return true
444
+ }
445
+ }
446
+ return false
447
+}
448
+
449
type (
450
// UnmarshalFunc is a function which can unmarshal Caddyfile
451
// tokens into zero or more config values using a Helper type.
caddyconfig/httpcaddyfile/directives_test.go
new
+94
@@ -0,0 +1,94 @@
1
+package httpcaddyfile
2
+
3
+import (
4
+ "reflect"
5
+ "sort"
6
+ "testing"
7
+)
8
+
9
+func TestHostsFromKeys(t *testing.T) {
10
+ for i, tc := range []struct {
11
+ keys []Address
12
+ expectNormalMode []string
13
+ expectLoggerMode []string
14
+ }{
15
+ {
16
+ []Address{
17
+ Address{Original: "foo", Host: "foo"},
18
+ },
19
+ []string{"foo"},
20
+ []string{"foo"},
21
+ },
22
+ {
23
+ []Address{
24
+ Address{Original: "foo", Host: "foo"},
25
+ Address{Original: "bar", Host: "bar"},
26
+ },
27
+ []string{"bar", "foo"},
28
+ []string{"bar", "foo"},
29
+ },
30
+ {
31
+ []Address{
32
+ Address{Original: ":2015", Port: "2015"},
33
+ },
34
+ []string{}, []string{},
35
+ },
36
+ {
37
+ []Address{
38
+ Address{Original: ":443", Port: "443"},
39
+ },
40
+ []string{}, []string{},
41
+ },
42
+ {
43
+ []Address{
44
+ Address{Original: "foo", Host: "foo"},
45
+ Address{Original: ":2015", Port: "2015"},
46
+ },
47
+ []string{}, []string{"foo"},
48
+ },
49
+ {
50
+ []Address{
51
+ Address{Original: "example.com:2015", Host: "example.com", Port: "2015"},
52
+ },
53
+ []string{"example.com"},
54
+ []string{"example.com:2015"},
55
+ },
56
+ {
57
+ []Address{
58
+ Address{Original: "example.com:80", Host: "example.com", Port: "80"},
59
+ },
60
+ []string{"example.com"},
61
+ []string{"example.com"},
62
+ },
63
+ {
64
+ []Address{
65
+ Address{Original: "https://:2015/foo", Scheme: "https", Port: "2015", Path: "/foo"},
66
+ },
67
+ []string{},
68
+ []string{},
69
+ },
70
+ {
71
+ []Address{
72
+ Address{Original: "https://example.com:2015/foo", Scheme: "https", Host: "example.com", Port: "2015", Path: "/foo"},
73
+ },
74
+ []string{"example.com"},
75
+ []string{"example.com:2015"},
76
+ },
77
+ } {
78
+ sb := serverBlock{keys: tc.keys}
79
+
80
+ // test in normal mode
81
+ actual := sb.hostsFromKeys(false)
82
+ sort.Strings(actual)
83
+ if !reflect.DeepEqual(tc.expectNormalMode, actual) {
84
+ t.Errorf("Test %d (loggerMode=false): Expected: %v Actual: %v", i, tc.expectNormalMode, actual)
85
+ }
86
+
87
+ // test in logger mode
88
+ actual = sb.hostsFromKeys(true)
89
+ sort.Strings(actual)
90
+ if !reflect.DeepEqual(tc.expectLoggerMode, actual) {
91
+ t.Errorf("Test %d (loggerMode=true): Expected: %v Actual: %v", i, tc.expectLoggerMode, actual)
92
+ }
93
+ }
94
+}
caddyconfig/httpcaddyfile/httptype.go
+8
-4
@@ -378,7 +378,7 @@ func (st *ServerType) serversFromPairings(
378
return nil, fmt.Errorf("server block %v: compiling matcher sets: %v", sblock.block.Keys, err)
379
}
380
381
- hosts := sblock.hostsFromKeys(false, false)
381
+ hosts := sblock.hostsFromKeys(false)
382
383
// tls: connection policies
384
if cpVals, ok := sblock.pile["tls.connection_policy"]; ok {
@@ -450,9 +450,13 @@ func (st *ServerType) serversFromPairings(
450
LoggerNames: make(map[string]string),
451
}
452
}
453
- for _, h := range sblock.hostsFromKeys(true, true) {
454
- if ncl.name != "" {
455
- srv.Logs.LoggerNames[h] = ncl.name
453
+ if sblock.hasHostCatchAllKey() {
454
+ srv.Logs.LoggerName = ncl.name
455
+ } else {
456
+ for _, h := range sblock.hostsFromKeys(true) {
457
+ if ncl.name != "" {
458
+ srv.Logs.LoggerNames[h] = ncl.name
459
+ }
460
}
461
}
462
}
caddyconfig/httpcaddyfile/tlsapp.go
+30
-15
@@ -16,6 +16,7 @@ package httpcaddyfile
16
17
import (
18
"bytes"
19
+ "encoding/json"
20
"fmt"
21
"reflect"
22
"sort"
@@ -53,7 +54,7 @@ func (st ServerType) buildTLSApp(
54
continue
55
}
56
if otherAddr.Host != "" {
56
- hostsSharedWithHostlessKey[addr.Host] = struct{}{}
57
+ hostsSharedWithHostlessKey[otherAddr.Host] = struct{}{}
58
}
59
}
60
break
@@ -72,7 +73,7 @@ func (st ServerType) buildTLSApp(
73
// get values that populate an automation policy for this block
74
var ap *caddytls.AutomationPolicy
75
75
- sblockHosts := sblock.hostsFromKeys(false, false)
76
+ sblockHosts := sblock.hostsFromKeys(false)
77
if len(sblockHosts) == 0 {
78
ap = catchAllAP
79
}
@@ -263,6 +264,33 @@ func (st ServerType) buildTLSApp(
264
tlsApp.Automation.OnDemand = onDemand
265
}
266
267
+ // if any hostnames appear on the same server block as a key with
268
+ // no host, they will not be used with route matchers because the
269
+ // hostless key matches all hosts, therefore, it wouldn't be
270
+ // considered for auto-HTTPS, so we need to make sure those hosts
271
+ // are manually considered for managed certificates; we also need
272
+ // to make sure that any of these names which are internal-only
273
+ // get internal certificates by default rather than ACME
274
+ var al caddytls.AutomateLoader
275
+ internalAP := &caddytls.AutomationPolicy{
276
+ IssuerRaw: json.RawMessage(`{"module":"internal"}`),
277
+ }
278
+ for h := range hostsSharedWithHostlessKey {
279
+ al = append(al, h)
280
+ if !certmagic.SubjectQualifiesForPublicCert(h) {
281
+ internalAP.Subjects = append(internalAP.Subjects, h)
282
+ }
283
+ }
284
+ if len(al) > 0 {
285
+ tlsApp.CertificatesRaw["automate"] = caddyconfig.JSON(al, &warnings)
286
+ }
287
+ if len(internalAP.Subjects) > 0 {
288
+ if tlsApp.Automation == nil {
289
+ tlsApp.Automation = new(caddytls.AutomationConfig)
290
+ }
291
+ tlsApp.Automation.Policies = append(tlsApp.Automation.Policies, internalAP)
292
+ }
293
+
294
// if there is a global/catch-all automation policy, ensure it goes last
295
if catchAllAP != nil {
296
// first, encode its issuer
@@ -276,19 +304,6 @@ func (st ServerType) buildTLSApp(
304
tlsApp.Automation.Policies = append(tlsApp.Automation.Policies, catchAllAP)
305
}
306
279
- // if any hostnames appear on the same server block as a key with
280
- // no host, they will not be used with route matchers because the
281
- // hostless key matches all hosts, therefore, it wouldn't be
282
- // considered for auto-HTTPS, so we need to make sure those hosts
283
- // are manually considered for managed certificates
284
- var al caddytls.AutomateLoader
285
- for h := range hostsSharedWithHostlessKey {
286
- al = append(al, h)
287
- }
288
- if len(al) > 0 {
289
- tlsApp.CertificatesRaw["automate"] = caddyconfig.JSON(al, &warnings)
290
- }
291
-
307
// do a little verification & cleanup
308
if tlsApp.Automation != nil {
309
// ensure automation policies don't overlap subjects (this should be
modules/caddytls/automation.go
+4
-2
@@ -53,7 +53,8 @@ type AutomationConfig struct {
53
// a low value.
54
RenewCheckInterval caddy.Duration `json:"renew_interval,omitempty"`
55
56
- defaultAutomationPolicy *AutomationPolicy
56
+ defaultPublicAutomationPolicy *AutomationPolicy
57
+ defaultInternalAutomationPolicy *AutomationPolicy
58
}
59
60
// AutomationPolicy designates the policy for automating the
@@ -67,7 +68,8 @@ type AutomationPolicy struct {
68
// Which subjects (hostnames or IP addresses) this policy applies to.
69
Subjects []string `json:"subjects,omitempty"`
70
70
- // The module that will issue certificates. Default: acme
71
+ // The module that will issue certificates. Default: internal if all
72
+ // subjects do not qualify for public certificates; othewise acme.
73
IssuerRaw json.RawMessage `json:"issuer,omitempty" caddy:"namespace=tls.issuance inline_key=module"`
74
75
// If true, certificates will be requested with MustStaple. Not all
modules/caddytls/tls.go
+18
-4
@@ -93,10 +93,17 @@ func (t *TLS) Provision(ctx caddy.Context) error {
93
if t.Automation == nil {
94
t.Automation = new(AutomationConfig)
95
}
96
- t.Automation.defaultAutomationPolicy = new(AutomationPolicy)
97
- err := t.Automation.defaultAutomationPolicy.Provision(t)
96
+ t.Automation.defaultPublicAutomationPolicy = new(AutomationPolicy)
97
+ err := t.Automation.defaultPublicAutomationPolicy.Provision(t)
98
if err != nil {
99
- return fmt.Errorf("provisioning default automation policy: %v", err)
99
+ return fmt.Errorf("provisioning default public automation policy: %v", err)
100
+ }
101
+ t.Automation.defaultInternalAutomationPolicy = &AutomationPolicy{
102
+ IssuerRaw: json.RawMessage(`{"module":"internal"}`),
103
+ }
104
+ err = t.Automation.defaultInternalAutomationPolicy.Provision(t)
105
+ if err != nil {
106
+ return fmt.Errorf("provisioning default internal automation policy: %v", err)
107
}
108
for i, ap := range t.Automation.Policies {
109
err := ap.Provision(t)
@@ -318,6 +325,10 @@ func (t *TLS) getConfigForName(name string) *certmagic.Config {
325
return ap.magic
326
}
327
328
+// getAutomationPolicyForName returns the first matching automation policy
329
+// for the given subject name. If no matching policy can be found, the
330
+// default policy is used, depending on whether the name qualifies for a
331
+// public certificate or not.
332
func (t *TLS) getAutomationPolicyForName(name string) *AutomationPolicy {
333
for _, ap := range t.Automation.Policies {
334
if len(ap.Subjects) == 0 {
@@ -329,7 +340,10 @@ func (t *TLS) getAutomationPolicyForName(name string) *AutomationPolicy {
340
}
341
}
342
}
332
- return t.Automation.defaultAutomationPolicy
343
+ if certmagic.SubjectQualifiesForPublicCert(name) {
344
+ return t.Automation.defaultPublicAutomationPolicy
345
+ }
346
+ return t.Automation.defaultInternalAutomationPolicy
347
}
348
349
// AllMatchingCertificates returns the list of all certificates in