httpcaddyfile: Properly record whether we added catch-all conn policy

We recently introduced `if !cp.SettingsEmpty()` which conditionally adds the connection policy to the list. If the condition evaluates to false, the policy wouldn't actually be added, even if hasCatchAllTLSConnPolicy was set to true on the previous line. Now we set that variable in accordance with whether we actually add the policy. While debugging this I noticed that catch-all policies added early in that loop (i.e. not at the end if we later determine we need one) are not always at the end of the list. They should be, though, since they are selected by which one matches first, and having a catch-all first would nullify any more specific ones later in the list. So I added a sort in consolidateConnPolicies to take care of that. Should fix #3670 and https://caddy.community/t/combining-on-demand-tls-with-custom-ssl-certs-doesnt-seem-to-work-in-2-1-1/9719 but I won't know for sure until somebody verifies it, since at least in the GitHub issue there is not yet enough information (the configs are redacted).

Matthew Holt committed Sep 11, 2020 at 13:45 UTC 4217217badf220d7d2c25f43f955fdc8454f2c64

1 file changed +9 -3

caddyconfig/httpcaddyfile/httptype.go

+9 -3

@@ -446,12 +446,12 @@ func (st *ServerType) serversFromPairings(

446 }

447 } else {

448 cp.DefaultSNI = defaultSNI

449 - hasCatchAllTLSConnPolicy = true

449 }

450

451 // only append this policy if it actually changes something

452 if !cp.SettingsEmpty() {

453 srv.TLSConnPolicies = append(srv.TLSConnPolicies, cp)

454 + hasCatchAllTLSConnPolicy = len(hosts) == 0

455 }

456 }

457 }

@@ -653,9 +653,15 @@ func detectConflictingSchemes(srv *caddyhttp.Server, serverBlocks []serverBlock,

653 return nil

654 }

655

656 -// consolidateConnPolicies removes empty TLS connection policies and combines

657 -// equivalent ones for a cleaner overall output.

656 +// consolidateConnPolicies sorts any catch-all policy to the end, removes empty TLS connection

657 +// policies, and combines equivalent ones for a cleaner overall output.

658 func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.ConnectionPolicies, error) {

659 + // catch-all policies (those without any matcher) should be at the

660 + // end, otherwise it nullifies any more specific policies

661 + sort.SliceStable(cps, func(i, j int) bool {

662 + return cps[j].MatchersRaw == nil && cps[i].MatchersRaw != nil

663 + })

664 +

665 for i := 0; i < len(cps); i++ {

666 // compare it to the others

667 for j := 0; j < len(cps); j++ {