Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
tls: Ensure conn policy is created when providing certs in Caddyfile
Fixes #2929
Matthew Holt committed
Dec 13, 2019 at 16:32 UTC
6ea121ddf8c5be6de892971782d6f0fe2938ebbf
2 files changed
+44
-16
caddyconfig/httpcaddyfile/builtins.go
+32
-7
@@ -81,7 +81,7 @@ func parseRoot(h Helper) ([]ConfigValue, error) {
81
func parseTLS(h Helper) ([]ConfigValue, error) {
82
var configVals []ConfigValue
83
84
- cp := new(caddytls.ConnectionPolicy)
84
+ var cp *caddytls.ConnectionPolicy
85
var fileLoader caddytls.FileLoader
86
var folderLoader caddytls.FolderLoader
87
var mgr caddytls.ACMEManagerMaker
@@ -131,12 +131,18 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
131
if _, ok := caddytls.SupportedProtocols[args[0]]; !ok {
132
return nil, h.Errf("Wrong protocol name or protocol not supported: '%s'", args[0])
133
}
134
+ if cp == nil {
135
+ cp = new(caddytls.ConnectionPolicy)
136
+ }
137
cp.ProtocolMin = args[0]
138
}
139
if len(args) > 1 {
140
if _, ok := caddytls.SupportedProtocols[args[1]]; !ok {
141
return nil, h.Errf("Wrong protocol name or protocol not supported: '%s'", args[1])
142
}
143
+ if cp == nil {
144
+ cp = new(caddytls.ConnectionPolicy)
145
+ }
146
cp.ProtocolMax = args[1]
147
}
148
case "ciphers":
@@ -144,6 +150,9 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
150
if _, ok := caddytls.SupportedCipherSuites[h.Val()]; !ok {
151
return nil, h.Errf("Wrong cipher suite name or cipher suite not supported: '%s'", h.Val())
152
}
153
+ if cp == nil {
154
+ cp = new(caddytls.ConnectionPolicy)
155
+ }
156
cp.CipherSuites = append(cp.CipherSuites, h.Val())
157
}
158
case "curves":
@@ -151,6 +160,9 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
160
if _, ok := caddytls.SupportedCurves[h.Val()]; !ok {
161
return nil, h.Errf("Wrong curve name or curve not supported: '%s'", h.Val())
162
}
163
+ if cp == nil {
164
+ cp = new(caddytls.ConnectionPolicy)
165
+ }
166
cp.Curves = append(cp.Curves, h.Val())
167
}
168
case "alpn":
@@ -158,6 +170,9 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
170
if len(args) == 0 {
171
return nil, h.ArgErr()
172
}
173
+ if cp == nil {
174
+ cp = new(caddytls.ConnectionPolicy)
175
+ }
176
cp.ALPN = args
177
178
// certificate folder loader
@@ -183,24 +198,34 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
198
}
199
}
200
186
- // connection policy
187
- configVals = append(configVals, ConfigValue{
188
- Class: "tls.connection_policy",
189
- Value: cp,
190
- })
191
-
201
// certificate loaders
202
if len(fileLoader) > 0 {
203
configVals = append(configVals, ConfigValue{
204
Class: "tls.certificate_loader",
205
Value: fileLoader,
206
})
207
+ // ensure server uses HTTPS by setting non-nil conn policy
208
+ if cp == nil {
209
+ cp = new(caddytls.ConnectionPolicy)
210
+ }
211
}
212
if len(folderLoader) > 0 {
213
configVals = append(configVals, ConfigValue{
214
Class: "tls.certificate_loader",
215
Value: folderLoader,
216
})
217
+ // ensure server uses HTTPS by setting non-nil conn policy
218
+ if cp == nil {
219
+ cp = new(caddytls.ConnectionPolicy)
220
+ }
221
+ }
222
+
223
+ // connection policy
224
+ if cp != nil {
225
+ configVals = append(configVals, ConfigValue{
226
+ Class: "tls.connection_policy",
227
+ Value: cp,
228
+ })
229
}
230
231
// automation policy
caddyconfig/httpcaddyfile/httptype.go
+12
-9
@@ -275,6 +275,9 @@ func (st *ServerType) hostsFromServerBlockKeys(sb caddyfile.ServerBlock) ([]stri
275
return nil, fmt.Errorf("parsing server block key: %v", err)
276
}
277
addr = addr.Normalize()
278
+ if addr.Host == "" {
279
+ continue
280
+ }
281
hostMap[addr.Host] = struct{}{}
282
}
283
@@ -328,20 +331,20 @@ func (st *ServerType) serversFromPairings(
331
// tls connection policies
332
for _, cpVal := range cpVals {
333
cp := cpVal.Value.(*caddytls.ConnectionPolicy)
331
- // only create if there is a non-empty policy
332
- if !reflect.DeepEqual(cp, new(caddytls.ConnectionPolicy)) {
333
- // make sure the policy covers all hostnames from the block
334
- hosts, err := st.hostsFromServerBlockKeys(sblock.block)
335
- if err != nil {
336
- return nil, err
337
- }
334
339
- // TODO: are matchers needed if every hostname of the config is matched?
335
+ // make sure the policy covers all hostnames from the block
336
+ hosts, err := st.hostsFromServerBlockKeys(sblock.block)
337
+ if err != nil {
338
+ return nil, err
339
+ }
340
+
341
+ // TODO: are matchers needed if every hostname of the config is matched?
342
+ if len(hosts) > 0 {
343
cp.MatchersRaw = caddy.ModuleMap{
344
"sni": caddyconfig.JSON(hosts, warnings), // make sure to match all hosts, not just auto-HTTPS-qualified ones
345
}
343
- srv.TLSConnPolicies = append(srv.TLSConnPolicies, cp)
346
}
347
+ srv.TLSConnPolicies = append(srv.TLSConnPolicies, cp)
348
}
349
// TODO: consolidate equal conn policies
350
}