Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 02:00 UTC
caddytls: Minor fixes for ECH
Matthew Holt committed
Mar 11, 2025 at 08:12 UTC
39262f86632401ae4915600b042ef5a28141d3d5
3 files changed
+50
-42
modules/caddytls/acmeissuer.go
+7
-8
@@ -507,21 +507,20 @@ func (iss *ACMEIssuer) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
507
iss.TrustedRootsPEMFiles = d.RemainingArgs()
508
509
case "dns":
510
- if !d.NextArg() {
511
- return d.ArgErr()
512
- }
513
- provName := d.Val()
510
if iss.Challenges == nil {
511
iss.Challenges = new(ChallengesConfig)
512
}
513
if iss.Challenges.DNS == nil {
514
iss.Challenges.DNS = new(DNSChallengeConfig)
515
}
520
- unm, err := caddyfile.UnmarshalModule(d, "dns.providers."+provName)
521
- if err != nil {
522
- return err
516
+ if d.NextArg() {
517
+ provName := d.Val()
518
+ unm, err := caddyfile.UnmarshalModule(d, "dns.providers."+provName)
519
+ if err != nil {
520
+ return err
521
+ }
522
+ iss.Challenges.DNS.ProviderRaw = caddyconfig.JSONModuleObject(unm, "name", provName, nil)
523
}
524
- iss.Challenges.DNS.ProviderRaw = caddyconfig.JSONModuleObject(unm, "name", provName, nil)
524
525
case "propagation_delay":
526
if !d.NextArg() {
modules/caddytls/connpolicy.go
+4
-11
@@ -940,17 +940,10 @@ func setDefaultTLSParams(cfg *tls.Config) {
940
cfg.CurvePreferences = defaultCurves
941
}
942
943
- if cfg.MinVersion == 0 {
944
- // crypto/tls docs:
945
- // "If EncryptedClientHelloKeys is set, MinVersion, if set, must be VersionTLS13."
946
- if cfg.EncryptedClientHelloKeys == nil {
947
- cfg.MinVersion = tls.VersionTLS12
948
- } else {
949
- cfg.MinVersion = tls.VersionTLS13
950
- }
951
- }
952
- if cfg.MaxVersion == 0 {
953
- cfg.MaxVersion = tls.VersionTLS13
943
+ // crypto/tls docs:
944
+ // "If EncryptedClientHelloKeys is set, MinVersion, if set, must be VersionTLS13."
945
+ if cfg.EncryptedClientHelloKeys != nil && cfg.MinVersion != 0 && cfg.MinVersion < tls.VersionTLS13 {
946
+ cfg.MinVersion = tls.VersionTLS13
947
}
948
}
949
modules/caddytls/ech.go
+39
-23
@@ -44,6 +44,10 @@ func init() {
44
// each individual publication config object. (Requires a custom build with a
45
// DNS provider module.)
46
//
47
+// ECH requires at least TLS 1.3, so any TLS connection policies with ECH
48
+// applied will automatically upgrade the minimum TLS version to 1.3, even if
49
+// configured to a lower version.
50
+//
51
// Note that, as of Caddy 2.10.0 (~March 2025), ECH keys are not automatically
52
// rotated due to a limitation in the Go standard library (see
53
// https://github.com/golang/go/issues/71920). This should be resolved when
@@ -294,31 +298,36 @@ func (t *TLS) publishECHConfigs() error {
298
// publish this ECH config list with this publisher
299
pubTime := time.Now()
300
err := publisher.PublishECHConfigList(t.ctx, dnsNamesToPublish, echCfgListBin)
297
- if err != nil {
298
- t.logger.Error("publishing ECH configuration list",
299
- zap.Strings("for_domains", publication.Domains),
301
+ if err == nil {
302
+ t.logger.Info("published ECH configuration list",
303
+ zap.Strings("domains", publication.Domains),
304
+ zap.Uint8s("config_ids", configIDs),
305
zap.Error(err))
301
- }
302
-
303
- // update publication history, so that we don't unnecessarily republish every time
304
- for _, cfg := range echCfgList {
305
- if cfg.meta.Publications == nil {
306
- cfg.meta.Publications = make(publicationHistory)
307
- }
308
- if _, ok := cfg.meta.Publications[publisherKey]; !ok {
309
- cfg.meta.Publications[publisherKey] = make(map[string]time.Time)
310
- }
311
- for _, name := range dnsNamesToPublish {
312
- cfg.meta.Publications[publisherKey][name] = pubTime
313
- }
314
- metaBytes, err := json.Marshal(cfg.meta)
315
- if err != nil {
316
- return fmt.Errorf("marshaling ECH config metadata: %v", err)
317
- }
318
- metaKey := path.Join(echConfigsKey, strconv.Itoa(int(cfg.ConfigID)), "meta.json")
319
- if err := t.ctx.Storage().Store(t.ctx, metaKey, metaBytes); err != nil {
320
- return fmt.Errorf("storing updated ECH config metadata: %v", err)
306
+ // update publication history, so that we don't unnecessarily republish every time
307
+ for _, cfg := range echCfgList {
308
+ if cfg.meta.Publications == nil {
309
+ cfg.meta.Publications = make(publicationHistory)
310
+ }
311
+ if _, ok := cfg.meta.Publications[publisherKey]; !ok {
312
+ cfg.meta.Publications[publisherKey] = make(map[string]time.Time)
313
+ }
314
+ for _, name := range dnsNamesToPublish {
315
+ cfg.meta.Publications[publisherKey][name] = pubTime
316
+ }
317
+ metaBytes, err := json.Marshal(cfg.meta)
318
+ if err != nil {
319
+ return fmt.Errorf("marshaling ECH config metadata: %v", err)
320
+ }
321
+ metaKey := path.Join(echConfigsKey, strconv.Itoa(int(cfg.ConfigID)), "meta.json")
322
+ if err := t.ctx.Storage().Store(t.ctx, metaKey, metaBytes); err != nil {
323
+ return fmt.Errorf("storing updated ECH config metadata: %v", err)
324
+ }
325
}
326
+ } else {
327
+ t.logger.Error("publishing ECH configuration list",
328
+ zap.Strings("domains", publication.Domains),
329
+ zap.Uint8s("config_ids", configIDs),
330
+ zap.Error(err))
331
}
332
}
333
}
@@ -640,6 +649,10 @@ func (dnsPub *ECHDNSPublisher) PublishECHConfigList(ctx context.Context, innerNa
649
continue
650
}
651
relName := libdns.RelativeName(domain+".", zone)
652
+ // TODO: libdns.RelativeName should probably return "@" instead of "".
653
+ if relName == "" {
654
+ relName = "@"
655
+ }
656
var httpsRec libdns.Record
657
for _, rec := range recs {
658
if rec.Name == relName && rec.Type == "HTTPS" && (rec.Target == "" || rec.Target == ".") {
@@ -674,8 +687,11 @@ func (dnsPub *ECHDNSPublisher) PublishECHConfigList(ctx context.Context, innerNa
687
},
688
})
689
if err != nil {
690
+ // TODO: Maybe this should just stop and return the error...
691
dnsPub.logger.Error("unable to publish ECH data to HTTPS DNS record",
692
zap.String("domain", domain),
693
+ zap.String("zone", zone),
694
+ zap.String("dns_record_name", relName),
695
zap.Error(err))
696
continue
697
}