Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 00:30 UTC
cmd: Split unix sockets for admin endpoint addresses (#5696)
* cmd: fix cli when admin endpoint uses new unix socket permission format Fixes a bug where the following Caddyfile ```Caddyfile { admin unix/admin.sock|0660 } ``` and `caddy reload --config Caddyfile` would throw the following error instead of reloading it: ``` INFO using provided configuration {"config_file": "Caddyfile", "config_adapter": ""} Error: sending configuration to instance: performing request: Post "http://127.0.0.1/load": dial unix admin.sock|0660: connect: no such file or directory [ERROR] exit status 1 ``` --- This bug also affected `caddy start` and `caddy stop`. * Move splitter function to internal --------- Co-authored-by: Matthew Holt <mholt@users.noreply.github.com>
Emily committed
Aug 6, 2023 at 02:09 UTC
8d304a4566de36219b31e1cb5a636431362c673c
4 files changed
+73
-37
cmd/commandfuncs.go
+11
@@ -35,6 +35,7 @@ import (
35
"github.com/caddyserver/caddy/v2"
36
"github.com/caddyserver/caddy/v2/caddyconfig"
37
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
38
+ "github.com/caddyserver/caddy/v2/internal"
39
"go.uber.org/zap"
40
)
41
@@ -611,6 +612,16 @@ func AdminAPIRequest(adminAddr, method, uri string, headers http.Header, body io
612
origin := "http://" + parsedAddr.JoinHostPort(0)
613
if parsedAddr.IsUnixNetwork() {
614
origin = "http://127.0.0.1" // bogus host is a hack so that http.NewRequest() is happy
615
+
616
+ // the unix address at this point might still contain the optional
617
+ // unix socket permissions, which are part of the address/host.
618
+ // those need to be removed first, as they aren't part of the
619
+ // resulting unix file path
620
+ addr, _, err := internal.SplitUnixSocketPermissionsBits(parsedAddr.Host)
621
+ if err != nil {
622
+ return nil, err
623
+ }
624
+ parsedAddr.Host = addr
625
}
626
627
// form the request
internal/sockets.go
new
+56
@@ -0,0 +1,56 @@
1
+// Copyright 2015 Matthew Holt and The Caddy Authors
2
+//
3
+// Licensed under the Apache License, Version 2.0 (the "License");
4
+// you may not use this file except in compliance with the License.
5
+// You may obtain a copy of the License at
6
+//
7
+// http://www.apache.org/licenses/LICENSE-2.0
8
+//
9
+// Unless required by applicable law or agreed to in writing, software
10
+// distributed under the License is distributed on an "AS IS" BASIS,
11
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
+// See the License for the specific language governing permissions and
13
+// limitations under the License.
14
+
15
+package internal
16
+
17
+import (
18
+ "fmt"
19
+ "io/fs"
20
+ "strconv"
21
+ "strings"
22
+)
23
+
24
+// SplitUnixSocketPermissionsBits takes a unix socket address in the
25
+// unusual "path|bits" format (e.g. /run/caddy.sock|0222) and tries
26
+// to split it into socket path (host) and permissions bits (port).
27
+// Colons (":") can't be used as separator, as socket paths on Windows
28
+// may include a drive letter (e.g. `unix/c:\absolute\path.sock`).
29
+// Permission bits will default to 0200 if none are specified.
30
+// Throws an error, if the first carrying bit does not
31
+// include write perms (e.g. `0422` or `022`).
32
+// Symbolic permission representation (e.g. `u=w,g=w,o=w`)
33
+// is not supported and will throw an error for now!
34
+func SplitUnixSocketPermissionsBits(addr string) (path string, fileMode fs.FileMode, err error) {
35
+ addrSplit := strings.SplitN(addr, "|", 2)
36
+
37
+ if len(addrSplit) == 2 {
38
+ // parse octal permission bit string as uint32
39
+ fileModeUInt64, err := strconv.ParseUint(addrSplit[1], 8, 32)
40
+ if err != nil {
41
+ return "", 0, fmt.Errorf("could not parse octal permission bits in %s: %v", addr, err)
42
+ }
43
+ fileMode = fs.FileMode(fileModeUInt64)
44
+
45
+ // FileMode.String() returns a string like `-rwxr-xr--` for `u=rwx,g=rx,o=r` (`0754`)
46
+ if string(fileMode.String()[2]) != "w" {
47
+ return "", 0, fmt.Errorf("owner of the socket requires '-w-' (write, octal: '2') permissions at least; got '%s' in %s", fileMode.String()[1:4], addr)
48
+ }
49
+
50
+ return addrSplit[0], fileMode, nil
51
+ }
52
+
53
+ // default to 0200 (symbolic: `u=w,g=,o=`)
54
+ // if no permission bits are specified
55
+ return addr, 0200, nil
56
+}
listeners.go
+3
-36
@@ -31,6 +31,7 @@ import (
31
"syscall"
32
"time"
33
34
+ "github.com/caddyserver/caddy/v2/internal"
35
"github.com/quic-go/quic-go"
36
"github.com/quic-go/quic-go/http3"
37
"go.uber.org/zap"
@@ -157,7 +158,7 @@ func (na NetworkAddress) listen(ctx context.Context, portOffset uint, config net
158
// is independent of permissions bits
159
if na.IsUnixNetwork() {
160
var err error
160
- address, unixFileMode, err = splitUnixSocketPermissionsBits(na.Host)
161
+ address, unixFileMode, err = internal.SplitUnixSocketPermissionsBits(na.Host)
162
if err != nil {
163
return nil, err
164
}
@@ -319,40 +320,6 @@ func IsUnixNetwork(netw string) bool {
320
return strings.HasPrefix(netw, "unix")
321
}
322
322
-// Takes a unix socket address in the unusual "path|bits" format
323
-// (e.g. /run/caddy.sock|0222) and tries to split it into
324
-// socket path (host) and permissions bits (port). Colons (":")
325
-// can't be used as separator, as socket paths on Windows may
326
-// include a drive letter (e.g. `unix/c:\absolute\path.sock`).
327
-// Permission bits will default to 0200 if none are specified.
328
-// Throws an error, if the first carrying bit does not
329
-// include write perms (e.g. `0422` or `022`).
330
-// Symbolic permission representation (e.g. `u=w,g=w,o=w`)
331
-// is not supported and will throw an error for now!
332
-func splitUnixSocketPermissionsBits(addr string) (path string, fileMode fs.FileMode, err error) {
333
- addrSplit := strings.SplitN(addr, "|", 2)
334
-
335
- if len(addrSplit) == 2 {
336
- // parse octal permission bit string as uint32
337
- fileModeUInt64, err := strconv.ParseUint(addrSplit[1], 8, 32)
338
- if err != nil {
339
- return "", 0, fmt.Errorf("could not parse octal permission bits in %s: %v", addr, err)
340
- }
341
- fileMode = fs.FileMode(fileModeUInt64)
342
-
343
- // FileMode.String() returns a string like `-rwxr-xr--` for `u=rwx,g=rx,o=r` (`0754`)
344
- if string(fileMode.String()[2]) != "w" {
345
- return "", 0, fmt.Errorf("owner of the socket requires '-w-' (write, octal: '2') permissions at least; got '%s' in %s", fileMode.String()[1:4], addr)
346
- }
347
-
348
- return addrSplit[0], fileMode, nil
349
- }
350
-
351
- // default to 0200 (symbolic: `u=w,g=,o=`)
352
- // if no permission bits are specified
353
- return addr, 0200, nil
354
-}
355
-
323
// ParseNetworkAddress parses addr into its individual
324
// components. The input string is expected to be of
325
// the form "network/host:port-range" where any part is
@@ -377,7 +344,7 @@ func ParseNetworkAddressWithDefaults(addr, defaultNetwork string, defaultPort ui
344
network = defaultNetwork
345
}
346
if IsUnixNetwork(network) {
380
- _, _, err := splitUnixSocketPermissionsBits(host)
347
+ _, _, err := internal.SplitUnixSocketPermissionsBits(host)
348
return NetworkAddress{
349
Network: network,
350
Host: host,
listeners_test.go
+3
-1
@@ -17,6 +17,8 @@ package caddy
17
import (
18
"reflect"
19
"testing"
20
+
21
+ "github.com/caddyserver/caddy/v2/internal"
22
)
23
24
func TestSplitNetworkAddress(t *testing.T) {
@@ -634,7 +636,7 @@ func TestSplitUnixSocketPermissionsBits(t *testing.T) {
636
expectErr: true,
637
},
638
} {
637
- actualPath, actualFileMode, err := splitUnixSocketPermissionsBits(tc.input)
639
+ actualPath, actualFileMode, err := internal.SplitUnixSocketPermissionsBits(tc.input)
640
if tc.expectErr && err == nil {
641
t.Errorf("Test %d: Expected error but got: %v", i, err)
642
}