@marcel91200 / caddy Mirror · read-only / commits / a58f240d
Fork 0

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

Mirrored from https://github.com/Slazee/caddy.git

Synced Nov 13, 20:30 UTC

httpcaddyfile: Fix #4640 (auto-HTTPS edgecase) (#4661)

Guh, this is complicated. Fixes #4640 This also follows up on #4398 (reverting it) which made a change that technically worked, but was incorrect. It changed the condition in `hostsFromKeysNotHTTP` from `&&` to `||`, but then the function no longer did what its name said it would do, and it would return hosts even if they were marked with `http://`, if they used a non-HTTP port. That wasn't the intent of it. The test added in there was kept though, because it is a valid usecase. The actual fix is to check _earlier_ whether all the addresses explicitly have `http://`, and if so we can short circuit and skip considering the rest.

Francis Lavoie committed Mar 25, 2022 at 00:54 UTC a58f240d3ecbb59285303746406cab50217f8d24
4 files changed +75 -2
caddyconfig/httpcaddyfile/directives.go
+12 -1
@@ -494,7 +494,7 @@ func (sb serverBlock) hostsFromKeysNotHTTP(httpPort string) []string {
494 if addr.Host == "" {
495 continue
496 }
497 - if addr.Scheme != "http" || addr.Port != httpPort {
497 + if addr.Scheme != "http" && addr.Port != httpPort {
498 hostMap[addr.Host] = struct{}{}
499 }
500 }
@@ -519,6 +519,17 @@ func (sb serverBlock) hasHostCatchAllKey() bool {
519 return false
520 }
521
522 +// isAllHTTP returns true if all sb keys explicitly specify
523 +// the http:// scheme
524 +func (sb serverBlock) isAllHTTP() bool {
525 + for _, addr := range sb.keys {
526 + if addr.Scheme != "http" {
527 + return false
528 + }
529 + }
530 + return true
531 +}
532 +
533 type (
534 // UnmarshalFunc is a function which can unmarshal Caddyfile
535 // tokens into zero or more config values using a Helper type.
caddyconfig/httpcaddyfile/httptype.go
+1 -1
@@ -581,7 +581,7 @@ func (st *ServerType) serversFromPairings(
581 }
582
583 for _, addr := range sblock.keys {
584 - // if server only uses HTTPS port, auto-HTTPS will not apply
584 + // if server only uses HTTP port, auto-HTTPS will not apply
585 if listenersUseAnyPortOtherThan(srv.Listen, httpPort) {
586 // exclude any hosts that were defined explicitly with "http://"
587 // in the key from automated cert management (issue #2998)
caddyconfig/httpcaddyfile/tlsapp.go
+6
@@ -101,6 +101,12 @@ func (st ServerType) buildTLSApp(
101 }
102
103 for _, sblock := range p.serverBlocks {
104 + // check the scheme of all the site addresses,
105 + // skip building AP if they all had http://
106 + if sblock.isAllHTTP() {
107 + continue
108 + }
109 +
110 // get values that populate an automation policy for this block
111 ap, err := newBaseAutomationPolicy(options, warnings, true)
112 if err != nil {
caddytest/integration/caddyfile_adapt/tls_automation_policies_9.txt new
+56
@@ -0,0 +1,56 @@
1 +# example from issue #4640
2 +http://foo:8447, http://127.0.0.1:8447 {
3 + reverse_proxy 127.0.0.1:8080
4 +}
5 +----------
6 +{
7 + "apps": {
8 + "http": {
9 + "servers": {
10 + "srv0": {
11 + "listen": [
12 + ":8447"
13 + ],
14 + "routes": [
15 + {
16 + "match": [
17 + {
18 + "host": [
19 + "foo",
20 + "127.0.0.1"
21 + ]
22 + }
23 + ],
24 + "handle": [
25 + {
26 + "handler": "subroute",
27 + "routes": [
28 + {
29 + "handle": [
30 + {
31 + "handler": "reverse_proxy",
32 + "upstreams": [
33 + {
34 + "dial": "127.0.0.1:8080"
35 + }
36 + ]
37 + }
38 + ]
39 + }
40 + ]
41 + }
42 + ],
43 + "terminal": true
44 + }
45 + ],
46 + "automatic_https": {
47 + "skip": [
48 + "foo",
49 + "127.0.0.1"
50 + ]
51 + }
52 + }
53 + }
54 + }
55 + }
56 +}
\ No newline at end of file