Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 04:30 UTC
go.mod: Upgrade ACMEz to v3; and upgrade CertMagic
Matthew Holt committed
Dec 19, 2024 at 12:17 UTC
ed1c594cdbddf89829eaf1174f414028577b432d
10 files changed
+47
-29
caddyconfig/httpcaddyfile/builtins.go
+1
-1
@@ -24,7 +24,7 @@ import (
24
"time"
25
26
"github.com/caddyserver/certmagic"
27
- "github.com/mholt/acmez/v2/acme"
27
+ "github.com/mholt/acmez/v3/acme"
28
"go.uber.org/zap/zapcore"
29
30
"github.com/caddyserver/caddy/v2"
caddyconfig/httpcaddyfile/options.go
+1
-1
@@ -19,7 +19,7 @@ import (
19
"strconv"
20
21
"github.com/caddyserver/certmagic"
22
- "github.com/mholt/acmez/v2/acme"
22
+ "github.com/mholt/acmez/v3/acme"
23
24
"github.com/caddyserver/caddy/v2"
25
"github.com/caddyserver/caddy/v2/caddyconfig"
caddyconfig/httpcaddyfile/tlsapp.go
+1
-1
@@ -25,7 +25,7 @@ import (
25
"strings"
26
27
"github.com/caddyserver/certmagic"
28
- "github.com/mholt/acmez/v2/acme"
28
+ "github.com/mholt/acmez/v3/acme"
29
30
"github.com/caddyserver/caddy/v2"
31
"github.com/caddyserver/caddy/v2/caddyconfig"
caddytest/integration/acme_test.go
+6
-4
@@ -6,6 +6,7 @@ import (
6
"crypto/elliptic"
7
"crypto/rand"
8
"fmt"
9
+ "log/slog"
10
"net"
11
"net/http"
12
"strings"
@@ -13,10 +14,11 @@ import (
14
15
"github.com/caddyserver/caddy/v2"
16
"github.com/caddyserver/caddy/v2/caddytest"
16
- "github.com/mholt/acmez/v2"
17
- "github.com/mholt/acmez/v2/acme"
17
+ "github.com/mholt/acmez/v3"
18
+ "github.com/mholt/acmez/v3/acme"
19
smallstepacme "github.com/smallstep/certificates/acme"
20
"go.uber.org/zap"
21
+ "go.uber.org/zap/exp/zapslog"
22
)
23
24
const acmeChallengePort = 9081
@@ -48,7 +50,7 @@ func TestACMEServerWithDefaults(t *testing.T) {
50
Client: &acme.Client{
51
Directory: "https://acme.localhost:9443/acme/local/directory",
52
HTTPClient: tester.Client,
51
- Logger: logger,
53
+ Logger: slog.New(zapslog.NewHandler(logger.Core())),
54
},
55
ChallengeSolvers: map[string]acmez.Solver{
56
acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
@@ -117,7 +119,7 @@ func TestACMEServerWithMismatchedChallenges(t *testing.T) {
119
Client: &acme.Client{
120
Directory: "https://acme.localhost:9443/acme/local/directory",
121
HTTPClient: tester.Client,
120
- Logger: logger,
122
+ Logger: slog.New(zapslog.NewHandler(logger.Core())),
123
},
124
ChallengeSolvers: map[string]acmez.Solver{
125
acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
caddytest/integration/acmeserver_test.go
+6
-4
@@ -5,13 +5,15 @@ import (
5
"crypto/ecdsa"
6
"crypto/elliptic"
7
"crypto/rand"
8
+ "log/slog"
9
"strings"
10
"testing"
11
12
"github.com/caddyserver/caddy/v2/caddytest"
12
- "github.com/mholt/acmez/v2"
13
- "github.com/mholt/acmez/v2/acme"
13
+ "github.com/mholt/acmez/v3"
14
+ "github.com/mholt/acmez/v3/acme"
15
"go.uber.org/zap"
16
+ "go.uber.org/zap/exp/zapslog"
17
)
18
19
func TestACMEServerDirectory(t *testing.T) {
@@ -76,7 +78,7 @@ func TestACMEServerAllowPolicy(t *testing.T) {
78
Client: &acme.Client{
79
Directory: "https://acme.localhost:9443/acme/local/directory",
80
HTTPClient: tester.Client,
79
- Logger: logger,
81
+ Logger: slog.New(zapslog.NewHandler(logger.Core())),
82
},
83
ChallengeSolvers: map[string]acmez.Solver{
84
acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
@@ -165,7 +167,7 @@ func TestACMEServerDenyPolicy(t *testing.T) {
167
Client: &acme.Client{
168
Directory: "https://acme.localhost:9443/acme/local/directory",
169
HTTPClient: tester.Client,
168
- Logger: logger,
170
+ Logger: slog.New(zapslog.NewHandler(logger.Core())),
171
},
172
ChallengeSolvers: map[string]acmez.Solver{
173
acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
go.mod
+5
-5
@@ -9,15 +9,15 @@ require (
9
github.com/Masterminds/sprig/v3 v3.3.0
10
github.com/alecthomas/chroma/v2 v2.14.0
11
github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b
12
- github.com/caddyserver/certmagic v0.21.5-0.20241105180249-4293198e094d
12
+ github.com/caddyserver/certmagic v0.21.5-0.20241219182349-258b5328e49e
13
github.com/caddyserver/zerossl v0.1.3
14
github.com/dustin/go-humanize v1.0.1
15
github.com/go-chi/chi/v5 v5.0.12
16
github.com/google/cel-go v0.21.0
17
github.com/google/uuid v1.6.0
18
github.com/klauspost/compress v1.17.11
19
- github.com/klauspost/cpuid/v2 v2.2.8
20
- github.com/mholt/acmez/v2 v2.0.3
19
+ github.com/klauspost/cpuid/v2 v2.2.9
20
+ github.com/mholt/acmez/v3 v3.0.0
21
github.com/prometheus/client_golang v1.19.1
22
github.com/quic-go/quic-go v0.48.2
23
github.com/smallstep/certificates v0.26.1
@@ -37,9 +37,9 @@ require (
37
go.uber.org/automaxprocs v1.6.0
38
go.uber.org/zap v1.27.0
39
go.uber.org/zap/exp v0.3.0
40
- golang.org/x/crypto v0.30.0
40
+ golang.org/x/crypto v0.31.0
41
golang.org/x/crypto/x509roots/fallback v0.0.0-20241104001025-71ed71b4faf9
42
- golang.org/x/net v0.32.0
42
+ golang.org/x/net v0.33.0
43
golang.org/x/sync v0.10.0
44
golang.org/x/term v0.27.0
45
golang.org/x/time v0.7.0
go.sum
+10
-10
@@ -89,8 +89,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
89
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
90
github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
91
github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
92
-github.com/caddyserver/certmagic v0.21.5-0.20241105180249-4293198e094d h1:+zOduGxxC4WBAnlDf5Uf0TXbWXRqjUXkJKevDZZa79A=
93
-github.com/caddyserver/certmagic v0.21.5-0.20241105180249-4293198e094d/go.mod h1:swUXjQ1T9ZtMv95qj7/InJvWLXURU85r+CfG0T+ZbDE=
92
+github.com/caddyserver/certmagic v0.21.5-0.20241219182349-258b5328e49e h1:AFPVZ2IOgM6NdL2GwMMf+V7NDU3IQ9t4aPbcNbHsitY=
93
+github.com/caddyserver/certmagic v0.21.5-0.20241219182349-258b5328e49e/go.mod h1:n1sCo7zV1Ez2j+89wrzDxo4N/T1Ws/Vx8u5NvuBFabw=
94
github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+YTAyA=
95
github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
96
github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
@@ -304,8 +304,8 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
304
github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
305
github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
306
github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
307
-github.com/klauspost/cpuid/v2 v2.2.8 h1:+StwCXwm9PdpiEkPyzBXIy+M9KUb4ODm0Zarf1kS5BM=
308
-github.com/klauspost/cpuid/v2 v2.2.8/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
307
+github.com/klauspost/cpuid/v2 v2.2.9 h1:66ze0taIn2H33fBvCkXuv9BmCwDfafmiIVpKV9kKGuY=
308
+github.com/klauspost/cpuid/v2 v2.2.9/go.mod h1:rqkxqrZ1EhYM9G+hXH7YdowN5R5RGN6NK4QwQ3WMXF8=
309
github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
310
github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
311
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -344,8 +344,8 @@ github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D
344
github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
345
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
346
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
347
-github.com/mholt/acmez/v2 v2.0.3 h1:CgDBlEwg3QBp6s45tPQmFIBrkRIkBT4rW4orMM6p4sw=
348
-github.com/mholt/acmez/v2 v2.0.3/go.mod h1:pQ1ysaDeGrIMvJ9dfJMk5kJNkn7L2sb3UhyrX6Q91cw=
347
+github.com/mholt/acmez/v3 v3.0.0 h1:r1NcjuWR0VaKP2BTjDK9LRFBw/WvURx3jlaEUl9Ht8E=
348
+github.com/mholt/acmez/v3 v3.0.0/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
349
github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4=
350
github.com/miekg/dns v1.1.62 h1:cN8OuEF1/x5Rq6Np+h1epln8OiyPWV+lROx9LxcGgIQ=
351
github.com/miekg/dns v1.1.62/go.mod h1:mvDlcItzm+br7MToIKqkglaGhlFMHJ9DTNNWONWXbNQ=
@@ -595,8 +595,8 @@ golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5y
595
golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
596
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
597
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
598
-golang.org/x/crypto v0.30.0 h1:RwoQn3GkWiMkzlX562cLB7OxWvjH1L8xutO2WoJcRoY=
599
-golang.org/x/crypto v0.30.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
598
+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
599
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
600
golang.org/x/crypto/x509roots/fallback v0.0.0-20241104001025-71ed71b4faf9 h1:4cEcP5+OjGppY79LCQ5Go2B1Boix2x0v6pvA01P3FoA=
601
golang.org/x/crypto/x509roots/fallback v0.0.0-20241104001025-71ed71b4faf9/go.mod h1:kNa9WdvYnzFwC79zRpLRMJbdEFlhyM5RPFBBZp/wWH8=
602
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -628,8 +628,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
628
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
629
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
630
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
631
-golang.org/x/net v0.32.0 h1:ZqPmj8Kzc+Y6e0+skZsuACbx+wzMgo5MQsJh9Qd6aYI=
632
-golang.org/x/net v0.32.0/go.mod h1:CwU0IoeOlnQQWJ6ioyFrfRuomB8GKF6KbYXZVyeXNfs=
631
+golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
632
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
633
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
634
golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
635
golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
modules/caddytls/acmeissuer.go
+1
-1
@@ -28,7 +28,7 @@ import (
28
29
"github.com/caddyserver/certmagic"
30
"github.com/caddyserver/zerossl"
31
- "github.com/mholt/acmez/v2/acme"
31
+ "github.com/mholt/acmez/v3/acme"
32
"go.uber.org/zap"
33
"go.uber.org/zap/zapcore"
34
modules/caddytls/automation.go
+1
-1
@@ -25,7 +25,7 @@ import (
25
"strings"
26
27
"github.com/caddyserver/certmagic"
28
- "github.com/mholt/acmez/v2"
28
+ "github.com/mholt/acmez/v3"
29
"go.uber.org/zap"
30
"go.uber.org/zap/zapcore"
31
modules/caddytls/connpolicy.go
+15
-1
@@ -26,7 +26,7 @@ import (
26
"os"
27
"strings"
28
29
- "github.com/mholt/acmez/v2"
29
+ "github.com/mholt/acmez/v3"
30
"go.uber.org/zap"
31
"go.uber.org/zap/zapcore"
32
@@ -350,6 +350,20 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error {
350
if err := p.ClientAuthentication.ConfigureTLSConfig(cfg); err != nil {
351
return fmt.Errorf("configuring TLS client authentication: %v", err)
352
}
353
+
354
+ // Prevent privilege escalation in case multiple vhosts are configured for
355
+ // this TLS server; we could potentially figure out if that's the case, but
356
+ // that might be complex to get right every time. Actually, two proper
357
+ // solutions could leave tickets enabled, but I am not sure how to do them
358
+ // properly without significant time investment; there may be new Go
359
+ // APIs that alloaw this (Wrap/UnwrapSession?) but I do not know how to use
360
+ // them at this time. TODO: one of these is a possible future enhancement:
361
+ // A) Prevent resumptions across server identities (certificates): binding the ticket to the
362
+ // certificate we would serve in a full handshake, or even bind a ticket to the exact SNI
363
+ // it was issued under (though there are proposals for session resumption across hostnames).
364
+ // B) Prevent resumptions falsely authenticating a client: include the realm in the ticket,
365
+ // so that it can be validated upon resumption.
366
+ cfg.SessionTicketsDisabled = true
367
}
368
369
if p.InsecureSecretsLog != "" {