Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 05:30 UTC
caddytls: Relax the warning for on-demand (#5384)
Francis Lavoie committed
Feb 22, 2023 at 13:41 UTC
be53e432fcac0a9b9accbc36885304639e8ca70b
1 file changed
+12
-1
modules/caddytls/tls.go
+12
-1
@@ -22,6 +22,7 @@ import (
22
"log"
23
"net/http"
24
"runtime/debug"
25
+ "strings"
26
"sync"
27
"time"
28
@@ -259,7 +260,17 @@ func (t *TLS) Start() error {
260
if t.Automation.OnDemand == nil ||
261
(t.Automation.OnDemand.Ask == "" && t.Automation.OnDemand.RateLimit == nil) {
262
for _, ap := range t.Automation.Policies {
262
- if ap.OnDemand {
263
+ isWildcardOrDefault := false
264
+ if len(ap.Subjects) == 0 {
265
+ isWildcardOrDefault = true
266
+ }
267
+ for _, sub := range ap.Subjects {
268
+ if strings.HasPrefix(sub, "*") {
269
+ isWildcardOrDefault = true
270
+ break
271
+ }
272
+ }
273
+ if ap.OnDemand && isWildcardOrDefault {
274
t.logger.Warn("YOUR SERVER MAY BE VULNERABLE TO ABUSE: on-demand TLS is enabled, but no protections are in place",
275
zap.String("docs", "https://caddyserver.com/docs/automatic-https#on-demand-tls"))
276
break