Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 02:00 UTC
caddytls: Initialize permission module earlier (fix #6901)
Bug introduced in 4ebcfed9c942c59f473f12f8108e1d0fa92e0855
Matthew Holt committed
Mar 17, 2025 at 12:02 UTC
e276994174983dbb190d4bb9acaab157ef14373b
2 files changed
+16
-18
modules/caddytls/automation.go
+4
-6
@@ -173,9 +173,6 @@ type AutomationPolicy struct {
173
subjects []string
174
magic *certmagic.Config
175
storage certmagic.Storage
176
-
177
- // Whether this policy had explicit managers configured directly on it.
178
- hadExplicitManagers bool
176
}
177
178
// Provision sets up ap and builds its underlying CertMagic config.
@@ -212,8 +209,9 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
209
// store them on the policy before putting it on the config
210
211
// load and provision any cert manager modules
212
+ var hadExplicitManagers bool
213
if ap.ManagersRaw != nil {
216
- ap.hadExplicitManagers = true
214
+ hadExplicitManagers = true
215
vals, err := tlsApp.ctx.LoadModule(ap, "ManagersRaw")
216
if err != nil {
217
return fmt.Errorf("loading external certificate manager modules: %v", err)
@@ -273,9 +271,9 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
271
// prevent issuance from Issuers (when Managers don't provide a certificate) if there's no
272
// permission module configured
273
noProtections := ap.isWildcardOrDefault() && !ap.onlyInternalIssuer() && (tlsApp.Automation == nil || tlsApp.Automation.OnDemand == nil || tlsApp.Automation.OnDemand.permission == nil)
276
- failClosed := noProtections && !ap.hadExplicitManagers // don't allow on-demand issuance (other than implicit managers) if no managers have been explicitly configured
274
+ failClosed := noProtections && !hadExplicitManagers // don't allow on-demand issuance (other than implicit managers) if no managers have been explicitly configured
275
if noProtections {
278
- if !ap.hadExplicitManagers {
276
+ if !hadExplicitManagers {
277
// no managers, no explicitly-configured permission module, this is a config error
278
return fmt.Errorf("on-demand TLS cannot be enabled without a permission module to prevent abuse; please refer to documentation for details")
279
}
modules/caddytls/tls.go
+12
-12
@@ -262,6 +262,18 @@ func (t *TLS) Provision(ctx caddy.Context) error {
262
}
263
}
264
265
+ // on-demand permission module
266
+ if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.PermissionRaw != nil {
267
+ if t.Automation.OnDemand.Ask != "" {
268
+ return fmt.Errorf("on-demand TLS config conflict: both 'ask' endpoint and a 'permission' module are specified; 'ask' is deprecated, so use only the permission module")
269
+ }
270
+ val, err := ctx.LoadModule(t.Automation.OnDemand, "PermissionRaw")
271
+ if err != nil {
272
+ return fmt.Errorf("loading on-demand TLS permission module: %v", err)
273
+ }
274
+ t.Automation.OnDemand.permission = val.(OnDemandPermission)
275
+ }
276
+
277
// automation/management policies
278
if t.Automation == nil {
279
t.Automation = new(AutomationConfig)
@@ -294,18 +306,6 @@ func (t *TLS) Provision(ctx caddy.Context) error {
306
}
307
}
308
297
- // on-demand permission module
298
- if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.PermissionRaw != nil {
299
- if t.Automation.OnDemand.Ask != "" {
300
- return fmt.Errorf("on-demand TLS config conflict: both 'ask' endpoint and a 'permission' module are specified; 'ask' is deprecated, so use only the permission module")
301
- }
302
- val, err := ctx.LoadModule(t.Automation.OnDemand, "PermissionRaw")
303
- if err != nil {
304
- return fmt.Errorf("loading on-demand TLS permission module: %v", err)
305
- }
306
- t.Automation.OnDemand.permission = val.(OnDemandPermission)
307
- }
308
-
309
// run replacer on ask URL (for environment variables) -- return errors to prevent surprises (#5036)
310
if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.Ask != "" {
311
t.Automation.OnDemand.Ask, err = repl.ReplaceOrErr(t.Automation.OnDemand.Ask, true, true)