Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
caddytls: Fix for TLS conn policy being applied to HTTP-only servers (#3243)
* httpcaddyfile: Don't add TLS policy to HTTP-only server (#3193, #3223) * Account for HTTP port * Add integration test written by @sarge
Matt Holt committed
Apr 9, 2020 at 12:39 UTC
d89ad2fd5ba8de6dee0ff420458b634431da9b89
2 files changed
+55
-2
caddyconfig/httpcaddyfile/httptype.go
+12
-2
@@ -332,6 +332,11 @@ func (st *ServerType) serversFromPairings(
332
servers := make(map[string]*caddyhttp.Server)
333
defaultSNI := tryString(options["default_sni"], warnings)
334
335
+ httpPort := strconv.Itoa(caddyhttp.DefaultHTTPPort)
336
+ if hp, ok := options["http_port"].(int); ok {
337
+ httpPort = strconv.Itoa(hp)
338
+ }
339
+
340
for i, p := range pairings {
341
srv := &caddyhttp.Server{
342
Listen: p.addresses,
@@ -369,7 +374,7 @@ func (st *ServerType) serversFromPairings(
374
return specificity(iLongestHost) > specificity(jLongestHost)
375
})
376
372
- var hasCatchAllTLSConnPolicy bool
377
+ var hasCatchAllTLSConnPolicy, usesTLS bool
378
379
// create a subroute for each site in the server block
380
for _, sblock := range p.serverBlocks {
@@ -419,6 +424,9 @@ func (st *ServerType) serversFromPairings(
424
srv.AutoHTTPS.Skip = append(srv.AutoHTTPS.Skip, addr.Host)
425
}
426
}
427
+ if addr.Scheme != "http" && addr.Host != "" && addr.Port != httpPort {
428
+ usesTLS = true
429
+ }
430
}
431
432
// set up each handler directive, making sure to honor directive order
@@ -481,7 +489,9 @@ func (st *ServerType) serversFromPairings(
489
// TODO: maybe a smarter way to handle this might be to just make the
490
// auto-HTTPS logic at provision-time detect if there is any connection
491
// policy missing for any HTTPS-enabled hosts, if so, add it... maybe?
484
- if !hasCatchAllTLSConnPolicy && (len(srv.TLSConnPolicies) > 0 || defaultSNI != "") {
492
+ if usesTLS &&
493
+ !hasCatchAllTLSConnPolicy &&
494
+ (len(srv.TLSConnPolicies) > 0 || defaultSNI != "") {
495
srv.TLSConnPolicies = append(srv.TLSConnPolicies, &caddytls.ConnectionPolicy{DefaultSNI: defaultSNI})
496
}
497
caddytest/integration/sni_test.go
+43
@@ -272,3 +272,46 @@ func TestDefaultSNIWithPortMappingOnly(t *testing.T) {
272
// makes a request with no sni
273
caddytest.AssertGetResponse(t, "https://127.0.0.1:9443/version", 200, "hello from a")
274
}
275
+
276
+func TestHttpOnlyOnDomainWithSNI(t *testing.T) {
277
+ caddytest.AssertAdapt(t, `
278
+ {
279
+ default_sni a.caddy.localhost
280
+ }
281
+ :80 {
282
+ respond /version 200 {
283
+ body "hello from localhost"
284
+ }
285
+ }
286
+ `, "caddyfile", `{
287
+ "apps": {
288
+ "http": {
289
+ "servers": {
290
+ "srv0": {
291
+ "listen": [
292
+ ":80"
293
+ ],
294
+ "routes": [
295
+ {
296
+ "match": [
297
+ {
298
+ "path": [
299
+ "/version"
300
+ ]
301
+ }
302
+ ],
303
+ "handle": [
304
+ {
305
+ "body": "hello from localhost",
306
+ "handler": "static_response",
307
+ "status_code": 200
308
+ }
309
+ ]
310
+ }
311
+ ]
312
+ }
313
+ }
314
+ }
315
+ }
316
+}`)
317
+}