Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 02:00 UTC
caddytls: Don't publish HTTPS record for CNAME'd domain (fix #6922)
Matthew Holt committed
Mar 24, 2025 at 09:55 UTC
782a3c7ac60c82311fe9fb8889dd843dfe26c0bc
1 file changed
+9
modules/caddytls/ech.go
+9
@@ -630,6 +630,7 @@ func (dnsPub ECHDNSPublisher) PublisherKey() string {
630
func (dnsPub *ECHDNSPublisher) PublishECHConfigList(ctx context.Context, innerNames []string, configListBin []byte) error {
631
nameservers := certmagic.RecursiveNameservers(nil) // TODO: we could make resolvers configurable
632
633
+nextName:
634
for _, domain := range innerNames {
635
zone, err := certmagic.FindZoneByFQDN(ctx, dnsPub.logger, domain, nameservers)
636
if err != nil {
@@ -660,6 +661,14 @@ func (dnsPub *ECHDNSPublisher) PublishECHConfigList(ctx context.Context, innerNa
661
var nameHasExistingRecord bool
662
for _, rec := range recs {
663
if rec.Name == relName {
664
+ // CNAME records are exclusive of all other records, so we cannot publish an HTTPS
665
+ // record for a domain that is CNAME'd. See #6922.
666
+ if rec.Type == "CNAME" {
667
+ dnsPub.logger.Warn("domain has CNAME record, so unable to publish ECH data to HTTPS record",
668
+ zap.String("domain", domain),
669
+ zap.String("cname_value", rec.Value))
670
+ continue nextName
671
+ }
672
nameHasExistingRecord = true
673
if rec.Type == "HTTPS" && (rec.Target == "" || rec.Target == ".") {
674
httpsRec = rec