Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
admin: Disable host checking if wildcard interface is specified
To clarify, listening on wildcard interfaces is NOT the default and should only be done under certain circumstances and when you know what you're doing. Emits a warning in the log. Fixes https://github.com/caddyserver/caddy-docker/issues/71
Matthew Holt committed
Apr 16, 2020 at 11:41 UTC
f5ccb904a3db2bffd980feee685afaa762224cb2
2 files changed
+31
-13
admin.go
+21
-13
@@ -60,10 +60,11 @@ type AdminConfig struct {
60
// default.
61
EnforceOrigin bool `json:"enforce_origin,omitempty"`
62
63
- // The list of allowed origins for API requests. Only used if
64
- // `enforce_origin` is true. If not set, the listener address
65
- // will be the default value. If set but empty, no origins will
66
- // be allowed.
63
+ // The list of allowed origins/hosts for API requests. Only needed
64
+ // if accessing the admin endpoint from a host different from the
65
+ // socket's network interface or if `enforce_origin` is true. If not
66
+ // set, the listener address will be the default value. If set but
67
+ // empty, no origins will be allowed.
68
Origins []string `json:"origins,omitempty"`
69
70
// Options related to configuration management.
@@ -99,6 +100,7 @@ func (admin AdminConfig) listenAddr() (NetworkAddress, error) {
100
func (admin AdminConfig) newAdminHandler(addr NetworkAddress) adminHandler {
101
muxWrap := adminHandler{
102
enforceOrigin: admin.EnforceOrigin,
103
+ enforceHost: !addr.isWildcardInterface(),
104
allowedOrigins: admin.allowedOrigins(addr),
105
mux: http.NewServeMux(),
106
}
@@ -234,12 +236,15 @@ func replaceAdmin(cfg *Config) error {
236
237
go adminServer.Serve(ln)
238
237
- Log().Named("admin").Info(
238
- "admin endpoint started",
239
+ Log().Named("admin").Info("admin endpoint started",
240
zap.String("address", addr.String()),
241
zap.Bool("enforce_origin", adminConfig.EnforceOrigin),
241
- zap.Strings("origins", handler.allowedOrigins),
242
- )
242
+ zap.Strings("origins", handler.allowedOrigins))
243
+
244
+ if !handler.enforceHost {
245
+ Log().Named("admin").Warn("admin endpoint on open interface; host checking disabled",
246
+ zap.String("address", addr.String()))
247
+ }
248
249
return nil
250
}
@@ -271,6 +276,7 @@ type AdminRoute struct {
276
277
type adminHandler struct {
278
enforceOrigin bool
279
+ enforceHost bool
280
allowedOrigins []string
281
mux *http.ServeMux
282
}
@@ -292,11 +298,13 @@ func (h adminHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
298
// be called more than once per request, for example if a request
299
// is rewritten (i.e. internal redirect).
300
func (h adminHandler) serveHTTP(w http.ResponseWriter, r *http.Request) {
295
- // DNS rebinding mitigation
296
- err := h.checkHost(r)
297
- if err != nil {
298
- h.handleError(w, r, err)
299
- return
301
+ if h.enforceHost {
302
+ // DNS rebinding mitigation
303
+ err := h.checkHost(r)
304
+ if err != nil {
305
+ h.handleError(w, r, err)
306
+ return
307
+ }
308
}
309
310
if h.enforceOrigin {
listeners.go
+10
@@ -302,6 +302,16 @@ func (na NetworkAddress) isLoopback() bool {
302
return false
303
}
304
305
+func (na NetworkAddress) isWildcardInterface() bool {
306
+ if na.Host == "" {
307
+ return true
308
+ }
309
+ if ip := net.ParseIP(na.Host); ip != nil {
310
+ return ip.IsUnspecified()
311
+ }
312
+ return false
313
+}
314
+
315
func (na NetworkAddress) port() string {
316
if na.StartPort == na.EndPort {
317
return strconv.FormatUint(uint64(na.StartPort), 10)