Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 09:30 UTC
caddytls,caddyhttp: Placeholders for some TLS and HTTP matchers (#6480)
* Runtime placeholders for caddytls matchers (1/3): - remove IPs validation in UnmarshalCaddyfile * Runtime placeholders for caddytls matchers (2/3): - add placeholder replacement for IPs in Provision * Runtime placeholders for caddytls matchers (3/3): - add placeholder replacement for other strings * Runtime placeholders for caddyhttp matchers (1/1): - add placeholder replacement for IPs in Provision * Runtime placeholders for caddyhttp/caddytls matchers: - move PrivateRandesCIDR under internal
vnxme committed
Aug 7, 2024 at 20:02 UTC
59cbb2c83a03b6fe352ae0b5d05581d9148a4d24
5 files changed
+57
-41
internal/ranges.go
new
+14
@@ -0,0 +1,14 @@
1
+package internal
2
+
3
+// PrivateRangesCIDR returns a list of private CIDR range
4
+// strings, which can be used as a configuration shortcut.
5
+func PrivateRangesCIDR() []string {
6
+ return []string{
7
+ "192.168.0.0/16",
8
+ "172.16.0.0/12",
9
+ "10.0.0.0/8",
10
+ "127.0.0.1/8",
11
+ "fd00::/8",
12
+ "::1",
13
+ }
14
+}
modules/caddyhttp/ip_matchers.go
+5
-2
@@ -29,6 +29,7 @@ import (
29
30
"github.com/caddyserver/caddy/v2"
31
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
32
+ "github.com/caddyserver/caddy/v2/internal"
33
)
34
35
// MatchRemoteIP matches requests by the remote IP address,
@@ -79,7 +80,7 @@ func (m *MatchRemoteIP) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
80
return d.Err("the 'forwarded' option is no longer supported; use the 'client_ip' matcher instead")
81
}
82
if d.Val() == "private_ranges" {
82
- m.Ranges = append(m.Ranges, PrivateRangesCIDR()...)
83
+ m.Ranges = append(m.Ranges, internal.PrivateRangesCIDR()...)
84
continue
85
}
86
m.Ranges = append(m.Ranges, d.Val())
@@ -173,7 +174,7 @@ func (m *MatchClientIP) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
174
for d.Next() {
175
for d.NextArg() {
176
if d.Val() == "private_ranges" {
176
- m.Ranges = append(m.Ranges, PrivateRangesCIDR()...)
177
+ m.Ranges = append(m.Ranges, internal.PrivateRangesCIDR()...)
178
continue
179
}
180
m.Ranges = append(m.Ranges, d.Val())
@@ -250,7 +251,9 @@ func (m MatchClientIP) Match(r *http.Request) bool {
251
func provisionCidrsZonesFromRanges(ranges []string) ([]*netip.Prefix, []string, error) {
252
cidrs := []*netip.Prefix{}
253
zones := []string{}
254
+ repl := caddy.NewReplacer()
255
for _, str := range ranges {
256
+ str = repl.ReplaceAll(str, "")
257
// Exclude the zone_id from the IP
258
if strings.Contains(str, "%") {
259
split := strings.Split(str, "%")
modules/caddyhttp/ip_range.go
+2
-14
@@ -22,6 +22,7 @@ import (
22
23
"github.com/caddyserver/caddy/v2"
24
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
25
+ "github.com/caddyserver/caddy/v2/internal"
26
)
27
28
func init() {
@@ -92,7 +93,7 @@ func (m *StaticIPRange) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
93
}
94
for d.NextArg() {
95
if d.Val() == "private_ranges" {
95
- m.Ranges = append(m.Ranges, PrivateRangesCIDR()...)
96
+ m.Ranges = append(m.Ranges, internal.PrivateRangesCIDR()...)
97
continue
98
}
99
m.Ranges = append(m.Ranges, d.Val())
@@ -121,19 +122,6 @@ func CIDRExpressionToPrefix(expr string) (netip.Prefix, error) {
122
return prefix, nil
123
}
124
124
-// PrivateRangesCIDR returns a list of private CIDR range
125
-// strings, which can be used as a configuration shortcut.
126
-func PrivateRangesCIDR() []string {
127
- return []string{
128
- "192.168.0.0/16",
129
- "172.16.0.0/12",
130
- "10.0.0.0/8",
131
- "127.0.0.1/8",
132
- "fd00::/8",
133
- "::1",
134
- }
135
-}
136
-
125
// Interface guards
126
var (
127
_ caddy.Provisioner = (*StaticIPRange)(nil)
modules/caddyhttp/reverseproxy/caddyfile.go
+2
-1
@@ -28,6 +28,7 @@ import (
28
"github.com/caddyserver/caddy/v2/caddyconfig"
29
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
30
"github.com/caddyserver/caddy/v2/caddyconfig/httpcaddyfile"
31
+ "github.com/caddyserver/caddy/v2/internal"
32
"github.com/caddyserver/caddy/v2/modules/caddyhttp"
33
"github.com/caddyserver/caddy/v2/modules/caddyhttp/headers"
34
"github.com/caddyserver/caddy/v2/modules/caddyhttp/rewrite"
@@ -688,7 +689,7 @@ func (h *Handler) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
689
case "trusted_proxies":
690
for d.NextArg() {
691
if d.Val() == "private_ranges" {
691
- h.TrustedProxies = append(h.TrustedProxies, caddyhttp.PrivateRangesCIDR()...)
692
+ h.TrustedProxies = append(h.TrustedProxies, internal.PrivateRangesCIDR()...)
693
continue
694
}
695
h.TrustedProxies = append(h.TrustedProxies, d.Val())
modules/caddytls/matchers.go
+34
-24
@@ -26,6 +26,7 @@ import (
26
27
"github.com/caddyserver/caddy/v2"
28
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
29
+ "github.com/caddyserver/caddy/v2/internal"
30
)
31
32
func init() {
@@ -49,8 +50,17 @@ func (MatchServerName) CaddyModule() caddy.ModuleInfo {
50
51
// Match matches hello based on SNI.
52
func (m MatchServerName) Match(hello *tls.ClientHelloInfo) bool {
53
+ // caddytls.TestServerNameMatcher calls this function without any context
54
+ var repl *caddy.Replacer
55
+ if ctx := hello.Context(); ctx != nil {
56
+ repl = ctx.Value(caddy.ReplacerCtxKey).(*caddy.Replacer)
57
+ } else {
58
+ repl = caddy.NewReplacer()
59
+ }
60
+
61
for _, name := range m {
53
- if certmagic.MatchWildcard(hello.ServerName, name) {
62
+ rs := repl.ReplaceAll(name, "")
63
+ if certmagic.MatchWildcard(hello.ServerName, rs) {
64
return true
65
}
66
}
@@ -107,16 +117,19 @@ func (MatchRemoteIP) CaddyModule() caddy.ModuleInfo {
117
118
// Provision parses m's IP ranges, either from IP or CIDR expressions.
119
func (m *MatchRemoteIP) Provision(ctx caddy.Context) error {
120
+ repl := caddy.NewReplacer()
121
m.logger = ctx.Logger()
122
for _, str := range m.Ranges {
112
- cidrs, err := m.parseIPRange(str)
123
+ rs := repl.ReplaceAll(str, "")
124
+ cidrs, err := m.parseIPRange(rs)
125
if err != nil {
126
return err
127
}
128
m.cidrs = append(m.cidrs, cidrs...)
129
}
130
for _, str := range m.NotRanges {
119
- cidrs, err := m.parseIPRange(str)
131
+ rs := repl.ReplaceAll(str, "")
132
+ cidrs, err := m.parseIPRange(rs)
133
if err != nil {
134
return err
135
}
@@ -185,22 +198,18 @@ func (m *MatchRemoteIP) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
198
199
for d.NextArg() {
200
val := d.Val()
201
+ var exclamation bool
202
if len(val) > 1 && val[0] == '!' {
189
- prefixes, err := m.parseIPRange(val[1:])
190
- if err != nil {
191
- return err
192
- }
193
- for _, prefix := range prefixes {
194
- m.NotRanges = append(m.NotRanges, prefix.String())
195
- }
203
+ exclamation, val = true, val[1:]
204
+ }
205
+ ranges := []string{val}
206
+ if val == "private_ranges" {
207
+ ranges = internal.PrivateRangesCIDR()
208
+ }
209
+ if exclamation {
210
+ m.NotRanges = append(m.NotRanges, ranges...)
211
} else {
197
- prefixes, err := m.parseIPRange(val)
198
- if err != nil {
199
- return err
200
- }
201
- for _, prefix := range prefixes {
202
- m.Ranges = append(m.Ranges, prefix.String())
203
- }
212
+ m.Ranges = append(m.Ranges, ranges...)
213
}
214
}
215
@@ -233,9 +242,11 @@ func (MatchLocalIP) CaddyModule() caddy.ModuleInfo {
242
243
// Provision parses m's IP ranges, either from IP or CIDR expressions.
244
func (m *MatchLocalIP) Provision(ctx caddy.Context) error {
245
+ repl := caddy.NewReplacer()
246
m.logger = ctx.Logger()
247
for _, str := range m.Ranges {
238
- cidrs, err := m.parseIPRange(str)
248
+ rs := repl.ReplaceAll(str, "")
249
+ cidrs, err := m.parseIPRange(rs)
250
if err != nil {
251
return err
252
}
@@ -300,13 +311,12 @@ func (m *MatchLocalIP) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
311
}
312
313
for d.NextArg() {
303
- prefixes, err := m.parseIPRange(d.Val())
304
- if err != nil {
305
- return err
306
- }
307
- for _, prefix := range prefixes {
308
- m.Ranges = append(m.Ranges, prefix.String())
314
+ val := d.Val()
315
+ if val == "private_ranges" {
316
+ m.Ranges = append(m.Ranges, internal.PrivateRangesCIDR()...)
317
+ continue
318
}
319
+ m.Ranges = append(m.Ranges, val)
320
}
321
322
// No blocks are supported