caddytls: Require 'ask' endpoint for on-demand TLS

Matthew Holt committed Mar 14, 2023 at 10:02 UTC b97c76fb4789b8da0b80f5a2c1c1c5bebba163b5

1 file changed +18 -14

modules/caddytls/automation.go

+18 -14

@@ -168,22 +168,26 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {

168 // on-demand TLS

169 var ond *certmagic.OnDemandConfig

170 if ap.OnDemand {

171 + // ask endpoint is now required after a number of negligence cases causing abuse

172 + if tlsApp.Automation == nil || tlsApp.Automation.OnDemand == nil || tlsApp.Automation.OnDemand.Ask == "" {

173 + return fmt.Errorf("on-demand TLS cannot be enabled without an 'ask' endpoint to prevent abuse; please refer to documentation for details")

174 + }

175 ond = &certmagic.OnDemandConfig{

176 DecisionFunc: func(name string) error {

173 - // if an "ask" endpoint was defined, consult it first

174 - if tlsApp.Automation != nil &&

175 - tlsApp.Automation.OnDemand != nil &&

176 - tlsApp.Automation.OnDemand.Ask != "" {

177 - if err := onDemandAskRequest(tlsApp.logger, tlsApp.Automation.OnDemand.Ask, name); err != nil {

178 - // distinguish true errors from denials, because it's important to log actual errors

179 - if !errors.Is(err, errAskDenied) {

180 - tlsApp.logger.Error("request to 'ask' endpoint failed",

181 - zap.Error(err),

182 - zap.String("endpoint", tlsApp.Automation.OnDemand.Ask),

183 - zap.String("domain", name))

184 - }

185 - return err

177 + if err := onDemandAskRequest(tlsApp.logger, tlsApp.Automation.OnDemand.Ask, name); err != nil {

178 + // distinguish true errors from denials, because it's important to elevate actual errors

179 + if errors.Is(err, errAskDenied) {

180 + tlsApp.logger.Debug("certificate issuance denied",

181 + zap.String("ask_endpoint", tlsApp.Automation.OnDemand.Ask),

182 + zap.String("domain", name),

183 + zap.Error(err))

184 + } else {

185 + tlsApp.logger.Error("request to 'ask' endpoint failed",

186 + zap.String("ask_endpoint", tlsApp.Automation.OnDemand.Ask),

187 + zap.String("domain", name),

188 + zap.Error(err))

189 }

190 + return err

191 }

192 // check the rate limiter last because

193 // doing so makes a reservation

@@ -404,7 +408,7 @@ type OnDemandConfig struct {

408 // issuance of certificates from handshakes.

409 RateLimit *RateLimit `json:"rate_limit,omitempty"`

410

407 - // If Caddy needs to obtain or renew a certificate

411 + // REQUIRED. If Caddy needs to obtain/renew a certificate

412 // during a TLS handshake, it will perform a quick

413 // HTTP request to this URL to check if it should be

414 // allowed to try to get a certificate for the name