@marcel91200 / caddy Mirror · read-only / commits / 44d078b6
Fork 0

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

Mirrored from https://github.com/Slazee/caddy.git

Synced Nov 11, 23:30 UTC

acme_server: fix policy parsing in caddyfile (#7006)

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

Mohammed Al Sahaf committed May 8, 2025 at 20:54 UTC 44d078b6705c7abcabb2a60f501568ff7f5a57a1
4 files changed +245 -26
caddytest/integration/caddyfile_adapt/acme_server_policy-allow.caddyfiletest new
+72
@@ -0,0 +1,72 @@
1 +{
2 + pki {
3 + ca custom-ca {
4 + name "Custom CA"
5 + }
6 + }
7 +}
8 +
9 +acme.example.com {
10 + acme_server {
11 + ca custom-ca
12 + allow {
13 + domains host-1.internal.example.com host-2.internal.example.com
14 + }
15 + }
16 +}
17 +----------
18 +{
19 + "apps": {
20 + "http": {
21 + "servers": {
22 + "srv0": {
23 + "listen": [
24 + ":443"
25 + ],
26 + "routes": [
27 + {
28 + "match": [
29 + {
30 + "host": [
31 + "acme.example.com"
32 + ]
33 + }
34 + ],
35 + "handle": [
36 + {
37 + "handler": "subroute",
38 + "routes": [
39 + {
40 + "handle": [
41 + {
42 + "ca": "custom-ca",
43 + "handler": "acme_server",
44 + "policy": {
45 + "allow": {
46 + "domains": [
47 + "host-1.internal.example.com",
48 + "host-2.internal.example.com"
49 + ]
50 + }
51 + }
52 + }
53 + ]
54 + }
55 + ]
56 + }
57 + ],
58 + "terminal": true
59 + }
60 + ]
61 + }
62 + }
63 + },
64 + "pki": {
65 + "certificate_authorities": {
66 + "custom-ca": {
67 + "name": "Custom CA"
68 + }
69 + }
70 + }
71 + }
72 +}
caddytest/integration/caddyfile_adapt/acme_server_policy-both.caddyfiletest new
+80
@@ -0,0 +1,80 @@
1 +{
2 + pki {
3 + ca custom-ca {
4 + name "Custom CA"
5 + }
6 + }
7 +}
8 +
9 +acme.example.com {
10 + acme_server {
11 + ca custom-ca
12 + allow {
13 + domains host-1.internal.example.com host-2.internal.example.com
14 + }
15 + deny {
16 + domains dc.internal.example.com
17 + }
18 + }
19 +}
20 +----------
21 +{
22 + "apps": {
23 + "http": {
24 + "servers": {
25 + "srv0": {
26 + "listen": [
27 + ":443"
28 + ],
29 + "routes": [
30 + {
31 + "match": [
32 + {
33 + "host": [
34 + "acme.example.com"
35 + ]
36 + }
37 + ],
38 + "handle": [
39 + {
40 + "handler": "subroute",
41 + "routes": [
42 + {
43 + "handle": [
44 + {
45 + "ca": "custom-ca",
46 + "handler": "acme_server",
47 + "policy": {
48 + "allow": {
49 + "domains": [
50 + "host-1.internal.example.com",
51 + "host-2.internal.example.com"
52 + ]
53 + },
54 + "deny": {
55 + "domains": [
56 + "dc.internal.example.com"
57 + ]
58 + }
59 + }
60 + }
61 + ]
62 + }
63 + ]
64 + }
65 + ],
66 + "terminal": true
67 + }
68 + ]
69 + }
70 + }
71 + },
72 + "pki": {
73 + "certificate_authorities": {
74 + "custom-ca": {
75 + "name": "Custom CA"
76 + }
77 + }
78 + }
79 + }
80 +}
caddytest/integration/caddyfile_adapt/acme_server_policy-deny.caddyfiletest new
+71
@@ -0,0 +1,71 @@
1 +{
2 + pki {
3 + ca custom-ca {
4 + name "Custom CA"
5 + }
6 + }
7 +}
8 +
9 +acme.example.com {
10 + acme_server {
11 + ca custom-ca
12 + deny {
13 + domains dc.internal.example.com
14 + }
15 + }
16 +}
17 +----------
18 +{
19 + "apps": {
20 + "http": {
21 + "servers": {
22 + "srv0": {
23 + "listen": [
24 + ":443"
25 + ],
26 + "routes": [
27 + {
28 + "match": [
29 + {
30 + "host": [
31 + "acme.example.com"
32 + ]
33 + }
34 + ],
35 + "handle": [
36 + {
37 + "handler": "subroute",
38 + "routes": [
39 + {
40 + "handle": [
41 + {
42 + "ca": "custom-ca",
43 + "handler": "acme_server",
44 + "policy": {
45 + "deny": {
46 + "domains": [
47 + "dc.internal.example.com"
48 + ]
49 + }
50 + }
51 + }
52 + ]
53 + }
54 + ]
55 + }
56 + ],
57 + "terminal": true
58 + }
59 + ]
60 + }
61 + }
62 + },
63 + "pki": {
64 + "certificate_authorities": {
65 + "custom-ca": {
66 + "name": "Custom CA"
67 + }
68 + }
69 + }
70 + }
71 +}
modules/caddypki/acmeserver/caddyfile.go
+22 -26
@@ -91,19 +91,17 @@ func parseACMEServer(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error
91 acmeServer.Policy.AllowWildcardNames = true
92 case "allow":
93 r := &RuleSet{}
94 - for h.Next() {
95 - for h.NextBlock(h.Nesting() - 1) {
96 - if h.CountRemainingArgs() == 0 {
97 - return nil, h.ArgErr() // TODO:
98 - }
99 - switch h.Val() {
100 - case "domains":
101 - r.Domains = append(r.Domains, h.RemainingArgs()...)
102 - case "ip_ranges":
103 - r.IPRanges = append(r.IPRanges, h.RemainingArgs()...)
104 - default:
105 - return nil, h.Errf("unrecognized 'allow' subdirective: %s", h.Val())
106 - }
94 + for nesting := h.Nesting(); h.NextBlock(nesting); {
95 + if h.CountRemainingArgs() == 0 {
96 + return nil, h.ArgErr() // TODO:
97 + }
98 + switch h.Val() {
99 + case "domains":
100 + r.Domains = append(r.Domains, h.RemainingArgs()...)
101 + case "ip_ranges":
102 + r.IPRanges = append(r.IPRanges, h.RemainingArgs()...)
103 + default:
104 + return nil, h.Errf("unrecognized 'allow' subdirective: %s", h.Val())
105 }
106 }
107 if acmeServer.Policy == nil {
@@ -112,19 +110,17 @@ func parseACMEServer(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error
110 acmeServer.Policy.Allow = r
111 case "deny":
112 r := &RuleSet{}
115 - for h.Next() {
116 - for h.NextBlock(h.Nesting() - 1) {
117 - if h.CountRemainingArgs() == 0 {
118 - return nil, h.ArgErr() // TODO:
119 - }
120 - switch h.Val() {
121 - case "domains":
122 - r.Domains = append(r.Domains, h.RemainingArgs()...)
123 - case "ip_ranges":
124 - r.IPRanges = append(r.IPRanges, h.RemainingArgs()...)
125 - default:
126 - return nil, h.Errf("unrecognized 'deny' subdirective: %s", h.Val())
127 - }
113 + for nesting := h.Nesting(); h.NextBlock(nesting); {
114 + if h.CountRemainingArgs() == 0 {
115 + return nil, h.ArgErr() // TODO:
116 + }
117 + switch h.Val() {
118 + case "domains":
119 + r.Domains = append(r.Domains, h.RemainingArgs()...)
120 + case "ip_ranges":
121 + r.IPRanges = append(r.IPRanges, h.RemainingArgs()...)
122 + default:
123 + return nil, h.Errf("unrecognized 'deny' subdirective: %s", h.Val())
124 }
125 }
126 if acmeServer.Policy == nil {