Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 06:00 UTC
core: fix ParseNetworkAddress port-range span off-by-one (#7975)
A port range is inclusive on both ends, so a range from start to end spans (end - start + 1) ports. The old (end - start) > maxPortSpan check let 0-65535 through even though that spans 65536 ports, one above the 65535 cap. Include the trailing port in the count. Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
Mohammed Al Sahaf committed
Aug 31, 2026 at 23:20 UTC
62a72977e58c87fad7e7726c18b58f10c653f2d3
2 files changed
+61
-1
listeners.go
+1
-1
@@ -361,7 +361,7 @@ func ParseNetworkAddressWithDefaults(addr, defaultNetwork string, defaultPort ui
361
if end < start {
362
return NetworkAddress{}, fmt.Errorf("end port must not be less than start port")
363
}
364
- if (end - start) > maxPortSpan {
364
+ if (end-start)+1 > maxPortSpan {
365
return NetworkAddress{}, fmt.Errorf("port range exceeds %d ports", maxPortSpan)
366
}
367
}
listeners_port_span_test.go
new
+60
@@ -0,0 +1,60 @@
1
+// Copyright 2015 Matthew Holt and The Caddy Authors
2
+//
3
+// Licensed under the Apache License, Version 2.0 (the "License");
4
+// you may not use this file except in compliance with the License.
5
+// You may obtain a copy of the License at
6
+//
7
+// http://www.apache.org/licenses/LICENSE-2.0
8
+//
9
+// Unless required by applicable law or agreed to in writing, software
10
+// distributed under the License is distributed on an "AS IS" BASIS,
11
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
+// See the License for the specific language governing permissions and
13
+// limitations under the License.
14
+
15
+package caddy
16
+
17
+import (
18
+ "strings"
19
+ "testing"
20
+)
21
+
22
+// TestParseNetworkAddress_PortSpanBoundary is the regression test for
23
+// the off-by-one in the port-range span check. A range like "0-65535"
24
+// spans 65536 ports (inclusive on both ends) and should be rejected,
25
+// but the old (end-start)>maxPortSpan check let it through. The maximum
26
+// valid full-16-bit range "1-65535" (65535 ports) must still be accepted.
27
+func TestParseNetworkAddress_PortSpanBoundary(t *testing.T) {
28
+ for _, tt := range []struct {
29
+ name string
30
+ addr string
31
+ wantErr bool
32
+ }{
33
+ {
34
+ name: "0-65535 spans 65536 ports and is rejected",
35
+ addr: "tcp/:0-65535",
36
+ wantErr: true,
37
+ },
38
+ {
39
+ name: "1-65535 spans 65535 ports and is accepted",
40
+ addr: "tcp/:1-65535",
41
+ wantErr: false,
42
+ },
43
+ } {
44
+ t.Run(tt.name, func(t *testing.T) {
45
+ _, err := ParseNetworkAddress(tt.addr)
46
+ if tt.wantErr {
47
+ if err == nil {
48
+ t.Fatal("expected error, got nil")
49
+ }
50
+ if !strings.Contains(err.Error(), "port range exceeds") {
51
+ t.Errorf("expected 'port range exceeds' error, got: %v", err)
52
+ }
53
+ return
54
+ }
55
+ if err != nil {
56
+ t.Errorf("unexpected error: %v", err)
57
+ }
58
+ })
59
+ }
60
+}