mirror of
https://github.com/caddyserver/caddy.git
synced 2025-04-16 16:19:15 +08:00
Merge branch 'master' into requestbody_replace
This commit is contained in:
Matt Holt
GitHub
commit
b3c36636e0
10
.github/SECURITY.md
vendored
10
.github/SECURITY.md
vendored
@ -5,11 +5,11 @@ The Caddy project would like to make sure that it stays on top of all practicall
|
||||
|
||||
## Supported Versions
|
||||
|
||||
| Version | Supported |
|
||||
| ------- | ------------------ |
|
||||
| 2.x | ✔️ |
|
||||
| 1.x | :x: |
|
||||
| < 1.x | :x: |
|
||||
| Version | Supported |
|
||||
| -------- | ----------|
|
||||
| 2.latest | ✔️ |
|
||||
| 1.x | :x: |
|
||||
| < 1.x | :x: |
|
||||
|
||||
|
||||
## Acceptable Scope
|
||||
|
||||
26
.github/workflows/ci.yml
vendored
26
.github/workflows/ci.yml
vendored
@ -12,28 +12,28 @@ on:
|
||||
- master
|
||||
- 2.*
|
||||
|
||||
env:
|
||||
# https://github.com/actions/setup-go/issues/491
|
||||
GOTOOLCHAIN: local
|
||||
|
||||
jobs:
|
||||
test:
|
||||
strategy:
|
||||
# Default is true, cancels jobs for other platforms in the matrix if one fails
|
||||
fail-fast: false
|
||||
matrix:
|
||||
os:
|
||||
os:
|
||||
- linux
|
||||
- mac
|
||||
- windows
|
||||
go:
|
||||
- '1.22'
|
||||
- '1.23'
|
||||
go:
|
||||
- '1.24'
|
||||
|
||||
include:
|
||||
# Set the minimum Go patch version for the given Go minor
|
||||
# Usable via ${{ matrix.GO_SEMVER }}
|
||||
- go: '1.22'
|
||||
GO_SEMVER: '~1.22.3'
|
||||
|
||||
- go: '1.23'
|
||||
GO_SEMVER: '~1.23.0'
|
||||
- go: '1.24'
|
||||
GO_SEMVER: '~1.24.1'
|
||||
|
||||
# Set some variables per OS, usable via ${{ matrix.VAR }}
|
||||
# OS_LABEL: the VM label from GitHub Actions (see https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#standard-github-hosted-runners-for-public-repositories)
|
||||
@ -99,7 +99,7 @@ jobs:
|
||||
env:
|
||||
CGO_ENABLED: 0
|
||||
run: |
|
||||
go build -tags nobadger -trimpath -ldflags="-w -s" -v
|
||||
go build -tags nobadger,nomysql,nopgx -trimpath -ldflags="-w -s" -v
|
||||
|
||||
- name: Smoke test Caddy
|
||||
working-directory: ./cmd/caddy
|
||||
@ -122,7 +122,7 @@ jobs:
|
||||
# continue-on-error: true
|
||||
run: |
|
||||
# (go test -v -coverprofile=cover-profile.out -race ./... 2>&1) > test-results/test-result.out
|
||||
go test -tags nobadger -v -coverprofile="cover-profile.out" -short -race ./...
|
||||
go test -tags nobadger,nomysql,nopgx -v -coverprofile="cover-profile.out" -short -race ./...
|
||||
# echo "status=$?" >> $GITHUB_OUTPUT
|
||||
|
||||
# Relevant step if we reinvestigate publishing test/coverage reports
|
||||
@ -170,7 +170,7 @@ jobs:
|
||||
retries=3
|
||||
exit_code=0
|
||||
while ((retries > 0)); do
|
||||
CGO_ENABLED=0 go test -p 1 -tags nobadger -v ./...
|
||||
CGO_ENABLED=0 go test -p 1 -tags nobadger,nomysql,nopgx -v ./...
|
||||
exit_code=$?
|
||||
if ((exit_code == 0)); then
|
||||
break
|
||||
@ -206,7 +206,7 @@ jobs:
|
||||
- name: Install Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: "~1.23"
|
||||
go-version: "~1.24"
|
||||
check-latest: true
|
||||
- name: Install xcaddy
|
||||
run: |
|
||||
|
||||
18
.github/workflows/cross-build.yml
vendored
18
.github/workflows/cross-build.yml
vendored
@ -10,12 +10,16 @@ on:
|
||||
- master
|
||||
- 2.*
|
||||
|
||||
env:
|
||||
# https://github.com/actions/setup-go/issues/491
|
||||
GOTOOLCHAIN: local
|
||||
|
||||
jobs:
|
||||
build:
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
goos:
|
||||
goos:
|
||||
- 'aix'
|
||||
- 'linux'
|
||||
- 'solaris'
|
||||
@ -26,18 +30,14 @@ jobs:
|
||||
- 'windows'
|
||||
- 'darwin'
|
||||
- 'netbsd'
|
||||
go:
|
||||
- '1.22'
|
||||
- '1.23'
|
||||
go:
|
||||
- '1.24'
|
||||
|
||||
include:
|
||||
# Set the minimum Go patch version for the given Go minor
|
||||
# Usable via ${{ matrix.GO_SEMVER }}
|
||||
- go: '1.22'
|
||||
GO_SEMVER: '~1.22.3'
|
||||
|
||||
- go: '1.23'
|
||||
GO_SEMVER: '~1.23.0'
|
||||
- go: '1.24'
|
||||
GO_SEMVER: '~1.24.1'
|
||||
|
||||
runs-on: ubuntu-latest
|
||||
continue-on-error: true
|
||||
|
||||
8
.github/workflows/lint.yml
vendored
8
.github/workflows/lint.yml
vendored
@ -13,6 +13,10 @@ on:
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
env:
|
||||
# https://github.com/actions/setup-go/issues/491
|
||||
GOTOOLCHAIN: local
|
||||
|
||||
jobs:
|
||||
# From https://github.com/golangci/golangci-lint-action
|
||||
golangci:
|
||||
@ -43,7 +47,7 @@ jobs:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: '~1.23'
|
||||
go-version: '~1.24'
|
||||
check-latest: true
|
||||
|
||||
- name: golangci-lint
|
||||
@ -63,5 +67,5 @@ jobs:
|
||||
- name: govulncheck
|
||||
uses: golang/govulncheck-action@v1
|
||||
with:
|
||||
go-version-input: '~1.23.0'
|
||||
go-version-input: '~1.24.1'
|
||||
check-latest: true
|
||||
|
||||
10
.github/workflows/release.yml
vendored
10
.github/workflows/release.yml
vendored
@ -5,6 +5,10 @@ on:
|
||||
tags:
|
||||
- 'v*.*.*'
|
||||
|
||||
env:
|
||||
# https://github.com/actions/setup-go/issues/491
|
||||
GOTOOLCHAIN: local
|
||||
|
||||
jobs:
|
||||
release:
|
||||
name: Release
|
||||
@ -13,13 +17,13 @@ jobs:
|
||||
os:
|
||||
- ubuntu-latest
|
||||
go:
|
||||
- '1.23'
|
||||
- '1.24'
|
||||
|
||||
include:
|
||||
# Set the minimum Go patch version for the given Go minor
|
||||
# Usable via ${{ matrix.GO_SEMVER }}
|
||||
- go: '1.23'
|
||||
GO_SEMVER: '~1.23.0'
|
||||
- go: '1.24'
|
||||
GO_SEMVER: '~1.24.1'
|
||||
|
||||
runs-on: ${{ matrix.os }}
|
||||
# https://github.com/sigstore/cosign/issues/1258#issuecomment-1002251233
|
||||
|
||||
@ -111,7 +111,7 @@ archives:
|
||||
- id: default
|
||||
format_overrides:
|
||||
- goos: windows
|
||||
format: zip
|
||||
formats: zip
|
||||
name_template: >-
|
||||
{{ .ProjectName }}_
|
||||
{{- .Version }}_
|
||||
|
||||
11
README.md
11
README.md
@ -16,7 +16,7 @@
|
||||
<a href="https://github.com/caddyserver/caddy/actions/workflows/ci.yml"><img src="https://github.com/caddyserver/caddy/actions/workflows/ci.yml/badge.svg"></a>
|
||||
<a href="https://pkg.go.dev/github.com/caddyserver/caddy/v2"><img src="https://img.shields.io/badge/godoc-reference-%23007d9c.svg"></a>
|
||||
<br>
|
||||
<a href="https://twitter.com/caddyserver" title="@caddyserver on Twitter"><img src="https://img.shields.io/badge/twitter-@caddyserver-55acee.svg" alt="@caddyserver on Twitter"></a>
|
||||
<a href="https://x.com/caddyserver" title="@caddyserver on Twitter"><img src="https://img.shields.io/twitter/follow/caddyserver" alt="@caddyserver on Twitter"></a>
|
||||
<a href="https://caddy.community" title="Caddy Forum"><img src="https://img.shields.io/badge/community-forum-ff69b4.svg" alt="Caddy Forum"></a>
|
||||
<br>
|
||||
<a href="https://sourcegraph.com/github.com/caddyserver/caddy?badge" title="Caddy on Sourcegraph"><img src="https://sourcegraph.com/github.com/caddyserver/caddy/-/badge.svg" alt="Caddy on Sourcegraph"></a>
|
||||
@ -67,6 +67,7 @@
|
||||
- Fully-managed local CA for internal names & IPs
|
||||
- Can coordinate with other Caddy instances in a cluster
|
||||
- Multi-issuer fallback
|
||||
- Encrypted ClientHello (ECH) support
|
||||
- **Stays up when other servers go down** due to TLS/OCSP/certificate-related issues
|
||||
- **Production-ready** after serving trillions of requests and managing millions of TLS certificates
|
||||
- **Scales to hundreds of thousands of sites** as proven in production
|
||||
@ -87,7 +88,7 @@ See [our online documentation](https://caddyserver.com/docs/install) for other i
|
||||
|
||||
Requirements:
|
||||
|
||||
- [Go 1.22.3 or newer](https://golang.org/dl/)
|
||||
- [Go 1.24.0 or newer](https://golang.org/dl/)
|
||||
|
||||
### For development
|
||||
|
||||
@ -176,7 +177,7 @@ The docs are also open source. You can contribute to them here: https://github.c
|
||||
|
||||
## Getting help
|
||||
|
||||
- We advise companies using Caddy to secure a support contract through [Ardan Labs](https://www.ardanlabs.com/my/contact-us?dd=caddy) before help is needed.
|
||||
- We advise companies using Caddy to secure a support contract through [Ardan Labs](https://www.ardanlabs.com) before help is needed.
|
||||
|
||||
- A [sponsorship](https://github.com/sponsors/mholt) goes a long way! We can offer private help to sponsors. If Caddy is benefitting your company, please consider a sponsorship. This not only helps fund full-time work to ensure the longevity of the project, it provides your company the resources, support, and discounts you need; along with being a great look for your company to your customers and potential customers!
|
||||
|
||||
@ -192,8 +193,8 @@ Matthew Holt began developing Caddy in 2014 while studying computer science at B
|
||||
|
||||
**The name "Caddy" is trademarked.** The name of the software is "Caddy", not "Caddy Server" or "CaddyServer". Please call it "Caddy" or, if you wish to clarify, "the Caddy web server". Caddy is a registered trademark of Stack Holdings GmbH.
|
||||
|
||||
- _Project on Twitter: [@caddyserver](https://twitter.com/caddyserver)_
|
||||
- _Author on Twitter: [@mholt6](https://twitter.com/mholt6)_
|
||||
- _Project on X: [@caddyserver](https://x.com/caddyserver)_
|
||||
- _Author on X: [@mholt6](https://x.com/mholt6)_
|
||||
|
||||
Caddy is a project of [ZeroSSL](https://zerossl.com), a Stack Holdings company.
|
||||
|
||||
|
||||
2
admin.go
2
admin.go
@ -1139,7 +1139,7 @@ traverseLoop:
|
||||
return fmt.Errorf("[%s] invalid array index '%s': %v",
|
||||
path, idxStr, err)
|
||||
}
|
||||
if idx < 0 || idx >= len(arr) {
|
||||
if idx < 0 || (method != http.MethodPut && idx >= len(arr)) || idx > len(arr) {
|
||||
return fmt.Errorf("[%s] array index out of bounds: %s", path, idxStr)
|
||||
}
|
||||
}
|
||||
|
||||
734
admin_test.go
734
admin_test.go
@ -15,12 +15,19 @@
|
||||
package caddy
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/x509"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"reflect"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"github.com/caddyserver/certmagic"
|
||||
"github.com/prometheus/client_golang/prometheus"
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
)
|
||||
|
||||
var testCfg = []byte(`{
|
||||
@ -203,3 +210,730 @@ func BenchmarkLoad(b *testing.B) {
|
||||
Load(testCfg, true)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAdminHandlerErrorHandling(t *testing.T) {
|
||||
initAdminMetrics()
|
||||
|
||||
handler := adminHandler{
|
||||
mux: http.NewServeMux(),
|
||||
}
|
||||
|
||||
handler.mux.Handle("/error", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
err := fmt.Errorf("test error")
|
||||
handler.handleError(w, r, err)
|
||||
}))
|
||||
|
||||
req := httptest.NewRequest(http.MethodGet, "/error", nil)
|
||||
rr := httptest.NewRecorder()
|
||||
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code == http.StatusOK {
|
||||
t.Error("expected error response, got success")
|
||||
}
|
||||
|
||||
var apiErr APIError
|
||||
if err := json.NewDecoder(rr.Body).Decode(&apiErr); err != nil {
|
||||
t.Fatalf("decoding response: %v", err)
|
||||
}
|
||||
if apiErr.Message != "test error" {
|
||||
t.Errorf("expected error message 'test error', got '%s'", apiErr.Message)
|
||||
}
|
||||
}
|
||||
|
||||
func initAdminMetrics() {
|
||||
if adminMetrics.requestErrors != nil {
|
||||
prometheus.Unregister(adminMetrics.requestErrors)
|
||||
}
|
||||
if adminMetrics.requestCount != nil {
|
||||
prometheus.Unregister(adminMetrics.requestCount)
|
||||
}
|
||||
|
||||
adminMetrics.requestErrors = prometheus.NewCounterVec(prometheus.CounterOpts{
|
||||
Namespace: "caddy",
|
||||
Subsystem: "admin_http",
|
||||
Name: "request_errors_total",
|
||||
Help: "Number of errors that occurred handling admin endpoint requests",
|
||||
}, []string{"handler", "path", "method"})
|
||||
|
||||
adminMetrics.requestCount = prometheus.NewCounterVec(prometheus.CounterOpts{
|
||||
Namespace: "caddy",
|
||||
Subsystem: "admin_http",
|
||||
Name: "requests_total",
|
||||
Help: "Count of requests to the admin endpoint",
|
||||
}, []string{"handler", "path", "code", "method"}) // Added code and method labels
|
||||
|
||||
prometheus.MustRegister(adminMetrics.requestErrors)
|
||||
prometheus.MustRegister(adminMetrics.requestCount)
|
||||
}
|
||||
|
||||
func TestAdminHandlerBuiltinRouteErrors(t *testing.T) {
|
||||
initAdminMetrics()
|
||||
|
||||
cfg := &Config{
|
||||
Admin: &AdminConfig{
|
||||
Listen: "localhost:2019",
|
||||
},
|
||||
}
|
||||
|
||||
err := replaceLocalAdminServer(cfg, Context{})
|
||||
if err != nil {
|
||||
t.Fatalf("setting up admin server: %v", err)
|
||||
}
|
||||
defer func() {
|
||||
stopAdminServer(localAdminServer)
|
||||
}()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
path string
|
||||
method string
|
||||
expectedStatus int
|
||||
}{
|
||||
{
|
||||
name: "stop endpoint wrong method",
|
||||
path: "/stop",
|
||||
method: http.MethodGet,
|
||||
expectedStatus: http.StatusMethodNotAllowed,
|
||||
},
|
||||
{
|
||||
name: "config endpoint wrong content-type",
|
||||
path: "/config/",
|
||||
method: http.MethodPost,
|
||||
expectedStatus: http.StatusBadRequest,
|
||||
},
|
||||
{
|
||||
name: "config ID missing ID",
|
||||
path: "/id/",
|
||||
method: http.MethodGet,
|
||||
expectedStatus: http.StatusBadRequest,
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range tests {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
req := httptest.NewRequest(test.method, fmt.Sprintf("http://localhost:2019%s", test.path), nil)
|
||||
rr := httptest.NewRecorder()
|
||||
|
||||
localAdminServer.Handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code != test.expectedStatus {
|
||||
t.Errorf("expected status %d but got %d", test.expectedStatus, rr.Code)
|
||||
}
|
||||
|
||||
metricValue := testGetMetricValue(map[string]string{
|
||||
"path": test.path,
|
||||
"handler": "admin",
|
||||
"method": test.method,
|
||||
})
|
||||
if metricValue != 1 {
|
||||
t.Errorf("expected error metric to be incremented once, got %v", metricValue)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func testGetMetricValue(labels map[string]string) float64 {
|
||||
promLabels := prometheus.Labels{}
|
||||
for k, v := range labels {
|
||||
promLabels[k] = v
|
||||
}
|
||||
|
||||
metric, err := adminMetrics.requestErrors.GetMetricWith(promLabels)
|
||||
if err != nil {
|
||||
return 0
|
||||
}
|
||||
|
||||
pb := &dto.Metric{}
|
||||
metric.Write(pb)
|
||||
return pb.GetCounter().GetValue()
|
||||
}
|
||||
|
||||
type mockRouter struct {
|
||||
routes []AdminRoute
|
||||
}
|
||||
|
||||
func (m mockRouter) Routes() []AdminRoute {
|
||||
return m.routes
|
||||
}
|
||||
|
||||
type mockModule struct {
|
||||
mockRouter
|
||||
}
|
||||
|
||||
func (m *mockModule) CaddyModule() ModuleInfo {
|
||||
return ModuleInfo{
|
||||
ID: "admin.api.mock",
|
||||
New: func() Module {
|
||||
mm := &mockModule{
|
||||
mockRouter: mockRouter{
|
||||
routes: m.routes,
|
||||
},
|
||||
}
|
||||
return mm
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func TestNewAdminHandlerRouterRegistration(t *testing.T) {
|
||||
originalModules := make(map[string]ModuleInfo)
|
||||
for k, v := range modules {
|
||||
originalModules[k] = v
|
||||
}
|
||||
defer func() {
|
||||
modules = originalModules
|
||||
}()
|
||||
|
||||
mockRoute := AdminRoute{
|
||||
Pattern: "/mock",
|
||||
Handler: AdminHandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
return nil
|
||||
}),
|
||||
}
|
||||
|
||||
mock := &mockModule{
|
||||
mockRouter: mockRouter{
|
||||
routes: []AdminRoute{mockRoute},
|
||||
},
|
||||
}
|
||||
RegisterModule(mock)
|
||||
|
||||
addr, err := ParseNetworkAddress("localhost:2019")
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to parse address: %v", err)
|
||||
}
|
||||
|
||||
admin := &AdminConfig{
|
||||
EnforceOrigin: false,
|
||||
}
|
||||
handler := admin.newAdminHandler(addr, false, Context{})
|
||||
|
||||
req := httptest.NewRequest("GET", "/mock", nil)
|
||||
req.Host = "localhost:2019"
|
||||
rr := httptest.NewRecorder()
|
||||
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code != http.StatusOK {
|
||||
t.Errorf("Expected status code %d but got %d", http.StatusOK, rr.Code)
|
||||
t.Logf("Response body: %s", rr.Body.String())
|
||||
}
|
||||
|
||||
if len(admin.routers) != 1 {
|
||||
t.Errorf("Expected 1 router to be stored, got %d", len(admin.routers))
|
||||
}
|
||||
}
|
||||
|
||||
type mockProvisionableRouter struct {
|
||||
mockRouter
|
||||
provisionErr error
|
||||
provisioned bool
|
||||
}
|
||||
|
||||
func (m *mockProvisionableRouter) Provision(Context) error {
|
||||
m.provisioned = true
|
||||
return m.provisionErr
|
||||
}
|
||||
|
||||
type mockProvisionableModule struct {
|
||||
*mockProvisionableRouter
|
||||
}
|
||||
|
||||
func (m *mockProvisionableModule) CaddyModule() ModuleInfo {
|
||||
return ModuleInfo{
|
||||
ID: "admin.api.mock_provision",
|
||||
New: func() Module {
|
||||
mm := &mockProvisionableModule{
|
||||
mockProvisionableRouter: &mockProvisionableRouter{
|
||||
mockRouter: m.mockRouter,
|
||||
provisionErr: m.provisionErr,
|
||||
},
|
||||
}
|
||||
return mm
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func TestAdminRouterProvisioning(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
provisionErr error
|
||||
wantErr bool
|
||||
routersAfter int // expected number of routers after provisioning
|
||||
}{
|
||||
{
|
||||
name: "successful provisioning",
|
||||
provisionErr: nil,
|
||||
wantErr: false,
|
||||
routersAfter: 0,
|
||||
},
|
||||
{
|
||||
name: "provisioning error",
|
||||
provisionErr: fmt.Errorf("provision failed"),
|
||||
wantErr: true,
|
||||
routersAfter: 1,
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range tests {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
originalModules := make(map[string]ModuleInfo)
|
||||
for k, v := range modules {
|
||||
originalModules[k] = v
|
||||
}
|
||||
defer func() {
|
||||
modules = originalModules
|
||||
}()
|
||||
|
||||
mockRoute := AdminRoute{
|
||||
Pattern: "/mock",
|
||||
Handler: AdminHandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
|
||||
return nil
|
||||
}),
|
||||
}
|
||||
|
||||
// Create provisionable module
|
||||
mock := &mockProvisionableModule{
|
||||
mockProvisionableRouter: &mockProvisionableRouter{
|
||||
mockRouter: mockRouter{
|
||||
routes: []AdminRoute{mockRoute},
|
||||
},
|
||||
provisionErr: test.provisionErr,
|
||||
},
|
||||
}
|
||||
RegisterModule(mock)
|
||||
|
||||
admin := &AdminConfig{}
|
||||
addr, err := ParseNetworkAddress("localhost:2019")
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to parse address: %v", err)
|
||||
}
|
||||
|
||||
_ = admin.newAdminHandler(addr, false, Context{})
|
||||
err = admin.provisionAdminRouters(Context{})
|
||||
|
||||
if test.wantErr {
|
||||
if err == nil {
|
||||
t.Error("Expected error but got nil")
|
||||
}
|
||||
} else {
|
||||
if err != nil {
|
||||
t.Errorf("Expected no error but got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
if len(admin.routers) != test.routersAfter {
|
||||
t.Errorf("Expected %d routers after provisioning, got %d", test.routersAfter, len(admin.routers))
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAllowedOriginsUnixSocket(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
addr NetworkAddress
|
||||
origins []string
|
||||
expectOrigins []string
|
||||
}{
|
||||
{
|
||||
name: "unix socket with default origins",
|
||||
addr: NetworkAddress{
|
||||
Network: "unix",
|
||||
Host: "/tmp/caddy.sock",
|
||||
},
|
||||
origins: nil, // default origins
|
||||
expectOrigins: []string{
|
||||
"", // empty host as per RFC 2616
|
||||
"127.0.0.1",
|
||||
"::1",
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "unix socket with custom origins",
|
||||
addr: NetworkAddress{
|
||||
Network: "unix",
|
||||
Host: "/tmp/caddy.sock",
|
||||
},
|
||||
origins: []string{"example.com"},
|
||||
expectOrigins: []string{
|
||||
"example.com",
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "tcp socket on localhost gets all loopback addresses",
|
||||
addr: NetworkAddress{
|
||||
Network: "tcp",
|
||||
Host: "localhost",
|
||||
StartPort: 2019,
|
||||
EndPort: 2019,
|
||||
},
|
||||
origins: nil,
|
||||
expectOrigins: []string{
|
||||
"localhost:2019",
|
||||
"[::1]:2019",
|
||||
"127.0.0.1:2019",
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range tests {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
admin := AdminConfig{
|
||||
Origins: test.origins,
|
||||
}
|
||||
|
||||
got := admin.allowedOrigins(test.addr)
|
||||
|
||||
var gotOrigins []string
|
||||
for _, u := range got {
|
||||
gotOrigins = append(gotOrigins, u.Host)
|
||||
}
|
||||
|
||||
if len(gotOrigins) != len(test.expectOrigins) {
|
||||
t.Errorf("Expected %d origins but got %d", len(test.expectOrigins), len(gotOrigins))
|
||||
return
|
||||
}
|
||||
|
||||
expectMap := make(map[string]struct{})
|
||||
for _, origin := range test.expectOrigins {
|
||||
expectMap[origin] = struct{}{}
|
||||
}
|
||||
|
||||
gotMap := make(map[string]struct{})
|
||||
for _, origin := range gotOrigins {
|
||||
gotMap[origin] = struct{}{}
|
||||
}
|
||||
|
||||
if !reflect.DeepEqual(expectMap, gotMap) {
|
||||
t.Errorf("Origins mismatch.\nExpected: %v\nGot: %v", test.expectOrigins, gotOrigins)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestReplaceRemoteAdminServer(t *testing.T) {
|
||||
const testCert = `MIIDCTCCAfGgAwIBAgIUXsqJ1mY8pKlHQtI3HJ23x2eZPqwwDQYJKoZIhvcNAQEL
|
||||
BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTIzMDEwMTAwMDAwMFoXDTI0MDEw
|
||||
MTAwMDAwMFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
|
||||
AAOCAQ8AMIIBCgKCAQEA4O4S6BSoYcoxvRqI+h7yPOjF6KjntjzVVm9M+uHK4lzX
|
||||
F1L3pSxJ2nDD4wZEV3FJ5yFOHVFqkG2vXG3BIczOlYG7UeNmKbQnKc5kZj3HGUrS
|
||||
VGEktA4OJbeZhhWP15gcXN5eDM2eH3g9BFXVX6AURxLiUXzhNBUEZuj/OEyH9yEF
|
||||
/qPCE+EjzVvWxvBXwgz/io4r4yok/Vq/bxJ6FlV6R7DX5oJSXyO0VEHZPi9DIyNU
|
||||
kK3F/r4U1sWiJGWOs8i3YQWZ2ejh1C0aLFZpPcCGGgMNpoF31gyYP6ZuPDUyCXsE
|
||||
g36UUw1JHNtIXYcLhnXuqj4A8TybTDpgXLqvwA9DBQIDAQABo1MwUTAdBgNVHQ4E
|
||||
FgQUc13z30pFC63rr/HGKOE7E82vjXwwHwYDVR0jBBgwFoAUc13z30pFC63rr/HG
|
||||
KOE7E82vjXwwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAHO3j
|
||||
oeiUXXJ7xD4P8Wj5t9d+E8lE1Xv1Dk3Z+EdG5+dan+RcToE42JJp9zB7FIh5Qz8g
|
||||
W77LAjqh5oyqz3A2VJcyVgfE3uJP1R1mJM7JfGHf84QH4TZF2Q1RZY4SZs0VQ6+q
|
||||
5wSlIZ4NXDy4Q4XkIJBGS61wT8IzYFXYBpx4PCP1Qj0PIE4sevEGwjsBIgxK307o
|
||||
BxF8AWe6N6e4YZmQLGjQ+SeH0iwZb6vpkHyAY8Kj2hvK+cq2P7vU3VGi0t3r1F8L
|
||||
IvrXHCvO2BMNJ/1UK1M4YNX8LYJqQhg9hEsIROe1OE/m3VhxIYMJI+qZXk9yHfgJ
|
||||
vq+SH04xKhtFudVBAQ==`
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
cfg *Config
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "nil config",
|
||||
cfg: nil,
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "nil admin config",
|
||||
cfg: &Config{
|
||||
Admin: nil,
|
||||
},
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "nil remote config",
|
||||
cfg: &Config{
|
||||
Admin: &AdminConfig{},
|
||||
},
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "invalid listen address",
|
||||
cfg: &Config{
|
||||
Admin: &AdminConfig{
|
||||
Remote: &RemoteAdmin{
|
||||
Listen: "invalid:address",
|
||||
},
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "valid config",
|
||||
cfg: &Config{
|
||||
Admin: &AdminConfig{
|
||||
Identity: &IdentityConfig{},
|
||||
Remote: &RemoteAdmin{
|
||||
Listen: "localhost:2021",
|
||||
AccessControl: []*AdminAccess{
|
||||
{
|
||||
PublicKeys: []string{testCert},
|
||||
Permissions: []AdminPermissions{{Methods: []string{"GET"}, Paths: []string{"/test"}}},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "invalid certificate",
|
||||
cfg: &Config{
|
||||
Admin: &AdminConfig{
|
||||
Identity: &IdentityConfig{},
|
||||
Remote: &RemoteAdmin{
|
||||
Listen: "localhost:2021",
|
||||
AccessControl: []*AdminAccess{
|
||||
{
|
||||
PublicKeys: []string{"invalid-cert-data"},
|
||||
Permissions: []AdminPermissions{{Methods: []string{"GET"}, Paths: []string{"/test"}}},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range tests {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
ctx := Context{
|
||||
Context: context.Background(),
|
||||
cfg: test.cfg,
|
||||
}
|
||||
|
||||
if test.cfg != nil {
|
||||
test.cfg.storage = &certmagic.FileStorage{Path: t.TempDir()}
|
||||
}
|
||||
|
||||
if test.cfg != nil && test.cfg.Admin != nil && test.cfg.Admin.Identity != nil {
|
||||
identityCertCache = certmagic.NewCache(certmagic.CacheOptions{
|
||||
GetConfigForCert: func(certmagic.Certificate) (*certmagic.Config, error) {
|
||||
return &certmagic.Config{}, nil
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
err := replaceRemoteAdminServer(ctx, test.cfg)
|
||||
|
||||
if test.wantErr {
|
||||
if err == nil {
|
||||
t.Error("Expected error but got nil")
|
||||
}
|
||||
} else {
|
||||
if err != nil {
|
||||
t.Errorf("Expected no error but got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Clean up
|
||||
if remoteAdminServer != nil {
|
||||
_ = stopAdminServer(remoteAdminServer)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
type mockIssuer struct {
|
||||
configSet *certmagic.Config
|
||||
}
|
||||
|
||||
func (m *mockIssuer) Issue(ctx context.Context, csr *x509.CertificateRequest) (*certmagic.IssuedCertificate, error) {
|
||||
return &certmagic.IssuedCertificate{
|
||||
Certificate: []byte(csr.Raw),
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (m *mockIssuer) SetConfig(cfg *certmagic.Config) {
|
||||
m.configSet = cfg
|
||||
}
|
||||
|
||||
func (m *mockIssuer) IssuerKey() string {
|
||||
return "mock"
|
||||
}
|
||||
|
||||
type mockIssuerModule struct {
|
||||
*mockIssuer
|
||||
}
|
||||
|
||||
func (m *mockIssuerModule) CaddyModule() ModuleInfo {
|
||||
return ModuleInfo{
|
||||
ID: "tls.issuance.acme",
|
||||
New: func() Module {
|
||||
return &mockIssuerModule{mockIssuer: new(mockIssuer)}
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func TestManageIdentity(t *testing.T) {
|
||||
originalModules := make(map[string]ModuleInfo)
|
||||
for k, v := range modules {
|
||||
originalModules[k] = v
|
||||
}
|
||||
defer func() {
|
||||
modules = originalModules
|
||||
}()
|
||||
|
||||
RegisterModule(&mockIssuerModule{})
|
||||
|
||||
certPEM := []byte(`-----BEGIN CERTIFICATE-----
|
||||
MIIDujCCAqKgAwIBAgIIE31FZVaPXTUwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE
|
||||
BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
|
||||
cm5ldCBBdXRob3JpdHkgRzIwHhcNMTQwMTI5MTMyNzQzWhcNMTQwNTI5MDAwMDAw
|
||||
WjBpMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
|
||||
TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEYMBYGA1UEAwwPbWFp
|
||||
bC5nb29nbGUuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3lcub2pUwkjC
|
||||
5GJQA2ZZfJJi6d1QHhEmkX9VxKYGp6gagZuRqJWy9TXP6++1ZzQQxqZLD0TkuxZ9
|
||||
8i9Nz00000CCBjCCAQQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGgG
|
||||
CCsGAQUFBwEBBFwwWjArBggrBgEFBQcwAoYfaHR0cDovL3BraS5nb29nbGUuY29t
|
||||
L0dJQUcyLmNydDArBggrBgEFBQcwAYYfaHR0cDovL2NsaWVudHMxLmdvb2dsZS5j
|
||||
b20vb2NzcDAdBgNVHQ4EFgQUiJxtimAuTfwb+aUtBn5UYKreKvMwDAYDVR0TAQH/
|
||||
BAIwADAfBgNVHSMEGDAWgBRK3QYWG7z2aLV29YG2u2IaulqBLzAXBgNVHREEEDAO
|
||||
ggxtYWlsLmdvb2dsZTANBgkqhkiG9w0BAQUFAAOCAQEAMP6IWgNGZE8wP9TjFjSZ
|
||||
3mmW3A1eIr0CuPwNZ2LJ5ZD1i70ojzcj4I9IdP5yPg9CAEV4hNASbM1LzfC7GmJE
|
||||
tPzW5tRmpKVWZGRgTgZI8Hp/xZXMwLh9ZmXV4kESFAGj5G5FNvJyUV7R5Eh+7OZX
|
||||
7G4jJ4ZGJh+5jzN9HdJJHQHGYNIYOzC7+HH9UMwCjX9vhQ4RjwFZJThS2Yb+y7pb
|
||||
9yxTJZoXC6J0H5JpnZb7kZEJ+Xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
||||
-----END CERTIFICATE-----`)
|
||||
|
||||
keyPEM := []byte(`-----BEGIN PRIVATE KEY-----
|
||||
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRS0LmTwUT0iwP
|
||||
...
|
||||
-----END PRIVATE KEY-----`)
|
||||
|
||||
testStorage := certmagic.FileStorage{Path: t.TempDir()}
|
||||
err := testStorage.Store(context.Background(), "localhost/localhost.crt", certPEM)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
err = testStorage.Store(context.Background(), "localhost/localhost.key", keyPEM)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
cfg *Config
|
||||
wantErr bool
|
||||
checkState func(*testing.T, *Config)
|
||||
}{
|
||||
{
|
||||
name: "nil config",
|
||||
cfg: nil,
|
||||
},
|
||||
{
|
||||
name: "nil admin config",
|
||||
cfg: &Config{
|
||||
Admin: nil,
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "nil identity config",
|
||||
cfg: &Config{
|
||||
Admin: &AdminConfig{},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "default issuer when none specified",
|
||||
cfg: &Config{
|
||||
Admin: &AdminConfig{
|
||||
Identity: &IdentityConfig{
|
||||
Identifiers: []string{"localhost"},
|
||||
},
|
||||
},
|
||||
storage: &testStorage,
|
||||
},
|
||||
checkState: func(t *testing.T, cfg *Config) {
|
||||
if len(cfg.Admin.Identity.issuers) == 0 {
|
||||
t.Error("Expected at least 1 issuer to be configured")
|
||||
return
|
||||
}
|
||||
if _, ok := cfg.Admin.Identity.issuers[0].(*mockIssuerModule); !ok {
|
||||
t.Error("Expected mock issuer to be configured")
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "custom issuer",
|
||||
cfg: &Config{
|
||||
Admin: &AdminConfig{
|
||||
Identity: &IdentityConfig{
|
||||
Identifiers: []string{"localhost"},
|
||||
IssuersRaw: []json.RawMessage{
|
||||
json.RawMessage(`{"module": "acme"}`),
|
||||
},
|
||||
},
|
||||
},
|
||||
storage: &certmagic.FileStorage{Path: "testdata"},
|
||||
},
|
||||
checkState: func(t *testing.T, cfg *Config) {
|
||||
if len(cfg.Admin.Identity.issuers) != 1 {
|
||||
t.Fatalf("Expected 1 issuer, got %d", len(cfg.Admin.Identity.issuers))
|
||||
}
|
||||
mockIss, ok := cfg.Admin.Identity.issuers[0].(*mockIssuerModule)
|
||||
if !ok {
|
||||
t.Fatal("Expected mock issuer")
|
||||
}
|
||||
if mockIss.configSet == nil {
|
||||
t.Error("Issuer config was not set")
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "invalid issuer module",
|
||||
cfg: &Config{
|
||||
Admin: &AdminConfig{
|
||||
Identity: &IdentityConfig{
|
||||
Identifiers: []string{"localhost"},
|
||||
IssuersRaw: []json.RawMessage{
|
||||
json.RawMessage(`{"module": "doesnt_exist"}`),
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range tests {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
if identityCertCache != nil {
|
||||
// Reset the cert cache before each test
|
||||
identityCertCache.Stop()
|
||||
identityCertCache = nil
|
||||
}
|
||||
|
||||
ctx := Context{
|
||||
Context: context.Background(),
|
||||
cfg: test.cfg,
|
||||
moduleInstances: make(map[string][]Module),
|
||||
}
|
||||
|
||||
err := manageIdentity(ctx, test.cfg)
|
||||
|
||||
if test.wantErr {
|
||||
if err == nil {
|
||||
t.Error("Expected error but got nil")
|
||||
}
|
||||
return
|
||||
}
|
||||
if err != nil {
|
||||
t.Fatalf("Expected no error but got: %v", err)
|
||||
}
|
||||
|
||||
if test.checkState != nil {
|
||||
test.checkState(t, test.cfg)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
6
caddy.go
6
caddy.go
@ -725,8 +725,10 @@ func Validate(cfg *Config) error {
|
||||
// Errors are logged along the way, and an appropriate exit
|
||||
// code is emitted.
|
||||
func exitProcess(ctx context.Context, logger *zap.Logger) {
|
||||
// let the rest of the program know we're quitting
|
||||
atomic.StoreInt32(exiting, 1)
|
||||
// let the rest of the program know we're quitting; only do it once
|
||||
if !atomic.CompareAndSwapInt32(exiting, 0, 1) {
|
||||
return
|
||||
}
|
||||
|
||||
// give the OS or service/process manager our 2 weeks' notice: we quit
|
||||
if err := notify.Stopping(); err != nil {
|
||||
|
||||
@ -24,7 +24,7 @@ import (
|
||||
"time"
|
||||
|
||||
"github.com/caddyserver/certmagic"
|
||||
"github.com/mholt/acmez/v2/acme"
|
||||
"github.com/mholt/acmez/v3/acme"
|
||||
"go.uber.org/zap/zapcore"
|
||||
|
||||
"github.com/caddyserver/caddy/v2"
|
||||
@ -84,7 +84,7 @@ func parseBind(h Helper) ([]ConfigValue, error) {
|
||||
|
||||
// parseTLS parses the tls directive. Syntax:
|
||||
//
|
||||
// tls [<email>|internal]|[<cert_file> <key_file>] {
|
||||
// tls [<email>|internal|force_automate]|[<cert_file> <key_file>] {
|
||||
// protocols <min> [<max>]
|
||||
// ciphers <cipher_suites...>
|
||||
// curves <curves...>
|
||||
@ -99,7 +99,7 @@ func parseBind(h Helper) ([]ConfigValue, error) {
|
||||
// ca <acme_ca_endpoint>
|
||||
// ca_root <pem_file>
|
||||
// key_type [ed25519|p256|p384|rsa2048|rsa4096]
|
||||
// dns <provider_name> [...]
|
||||
// dns [<provider_name> [...]] (required, though, if DNS is not configured as global option)
|
||||
// propagation_delay <duration>
|
||||
// propagation_timeout <duration>
|
||||
// resolvers <dns_servers...>
|
||||
@ -107,6 +107,7 @@ func parseBind(h Helper) ([]ConfigValue, error) {
|
||||
// dns_challenge_override_domain <domain>
|
||||
// on_demand
|
||||
// reuse_private_keys
|
||||
// force_automate
|
||||
// eab <key_id> <mac_key>
|
||||
// issuer <module_name> [...]
|
||||
// get_certificate <module_name> [...]
|
||||
@ -126,6 +127,7 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
|
||||
var certManagers []certmagic.Manager
|
||||
var onDemand bool
|
||||
var reusePrivateKeys bool
|
||||
var forceAutomate bool
|
||||
|
||||
firstLine := h.RemainingArgs()
|
||||
switch len(firstLine) {
|
||||
@ -133,8 +135,10 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
|
||||
case 1:
|
||||
if firstLine[0] == "internal" {
|
||||
internalIssuer = new(caddytls.InternalIssuer)
|
||||
} else if firstLine[0] == "force_automate" {
|
||||
forceAutomate = true
|
||||
} else if !strings.Contains(firstLine[0], "@") {
|
||||
return nil, h.Err("single argument must either be 'internal' or an email address")
|
||||
return nil, h.Err("single argument must either be 'internal', 'force_automate', or an email address")
|
||||
} else {
|
||||
acmeIssuer = &caddytls.ACMEIssuer{
|
||||
Email: firstLine[0],
|
||||
@ -308,10 +312,6 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
|
||||
certManagers = append(certManagers, certManager)
|
||||
|
||||
case "dns":
|
||||
if !h.NextArg() {
|
||||
return nil, h.ArgErr()
|
||||
}
|
||||
provName := h.Val()
|
||||
if acmeIssuer == nil {
|
||||
acmeIssuer = new(caddytls.ACMEIssuer)
|
||||
}
|
||||
@ -321,12 +321,19 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
|
||||
if acmeIssuer.Challenges.DNS == nil {
|
||||
acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
|
||||
}
|
||||
modID := "dns.providers." + provName
|
||||
unm, err := caddyfile.UnmarshalModule(h.Dispenser, modID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
// DNS provider configuration optional, since it may be configured globally via the TLS app with global options
|
||||
if h.NextArg() {
|
||||
provName := h.Val()
|
||||
modID := "dns.providers." + provName
|
||||
unm, err := caddyfile.UnmarshalModule(h.Dispenser, modID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
acmeIssuer.Challenges.DNS.ProviderRaw = caddyconfig.JSONModuleObject(unm, "name", provName, h.warnings)
|
||||
} else if h.Option("dns") == nil {
|
||||
// if DNS is omitted locally, it needs to be configured globally
|
||||
return nil, h.ArgErr()
|
||||
}
|
||||
acmeIssuer.Challenges.DNS.ProviderRaw = caddyconfig.JSONModuleObject(unm, "name", provName, h.warnings)
|
||||
|
||||
case "resolvers":
|
||||
args := h.RemainingArgs()
|
||||
@ -569,6 +576,15 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
|
||||
})
|
||||
}
|
||||
|
||||
// if enabled, the names in the site addresses will be
|
||||
// added to the automation policies
|
||||
if forceAutomate {
|
||||
configVals = append(configVals, ConfigValue{
|
||||
Class: "tls.force_automate",
|
||||
Value: true,
|
||||
})
|
||||
}
|
||||
|
||||
// custom certificate selection
|
||||
if len(certSelector.AnyTag) > 0 {
|
||||
cp.CertSelection = &certSelector
|
||||
|
||||
@ -191,7 +191,7 @@ func (st ServerType) Setup(
|
||||
metrics, _ := options["metrics"].(*caddyhttp.Metrics)
|
||||
for _, s := range servers {
|
||||
if s.Metrics != nil {
|
||||
metrics = cmp.Or[*caddyhttp.Metrics](metrics, &caddyhttp.Metrics{})
|
||||
metrics = cmp.Or(metrics, &caddyhttp.Metrics{})
|
||||
metrics = &caddyhttp.Metrics{
|
||||
PerHost: metrics.PerHost || s.Metrics.PerHost,
|
||||
}
|
||||
@ -350,7 +350,7 @@ func (st ServerType) Setup(
|
||||
|
||||
// avoid duplicates by sorting + compacting
|
||||
sort.Strings(defaultLog.Exclude)
|
||||
defaultLog.Exclude = slices.Compact[[]string, string](defaultLog.Exclude)
|
||||
defaultLog.Exclude = slices.Compact(defaultLog.Exclude)
|
||||
}
|
||||
}
|
||||
// we may have not actually added anything, so remove if empty
|
||||
@ -763,6 +763,14 @@ func (st *ServerType) serversFromPairings(
|
||||
}
|
||||
}
|
||||
|
||||
// collect hosts that are forced to be automated
|
||||
forceAutomatedNames := make(map[string]struct{})
|
||||
if _, ok := sblock.pile["tls.force_automate"]; ok {
|
||||
for _, host := range hosts {
|
||||
forceAutomatedNames[host] = struct{}{}
|
||||
}
|
||||
}
|
||||
|
||||
// tls: connection policies
|
||||
if cpVals, ok := sblock.pile["tls.connection_policy"]; ok {
|
||||
// tls connection policies
|
||||
@ -794,7 +802,7 @@ func (st *ServerType) serversFromPairings(
|
||||
}
|
||||
|
||||
// only append this policy if it actually changes something
|
||||
if !cp.SettingsEmpty() {
|
||||
if !cp.SettingsEmpty() || mapContains(forceAutomatedNames, hosts) {
|
||||
srv.TLSConnPolicies = append(srv.TLSConnPolicies, cp)
|
||||
hasCatchAllTLSConnPolicy = len(hosts) == 0
|
||||
}
|
||||
@ -1113,6 +1121,12 @@ func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.Connecti
|
||||
return nil, fmt.Errorf("two policies with same match criteria have conflicting default SNI: %s vs. %s",
|
||||
cps[i].DefaultSNI, cps[j].DefaultSNI)
|
||||
}
|
||||
if cps[i].FallbackSNI != "" &&
|
||||
cps[j].FallbackSNI != "" &&
|
||||
cps[i].FallbackSNI != cps[j].FallbackSNI {
|
||||
return nil, fmt.Errorf("two policies with same match criteria have conflicting fallback SNI: %s vs. %s",
|
||||
cps[i].FallbackSNI, cps[j].FallbackSNI)
|
||||
}
|
||||
if cps[i].ProtocolMin != "" &&
|
||||
cps[j].ProtocolMin != "" &&
|
||||
cps[i].ProtocolMin != cps[j].ProtocolMin {
|
||||
@ -1153,6 +1167,9 @@ func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.Connecti
|
||||
if cps[i].DefaultSNI == "" && cps[j].DefaultSNI != "" {
|
||||
cps[i].DefaultSNI = cps[j].DefaultSNI
|
||||
}
|
||||
if cps[i].FallbackSNI == "" && cps[j].FallbackSNI != "" {
|
||||
cps[i].FallbackSNI = cps[j].FallbackSNI
|
||||
}
|
||||
if cps[i].ProtocolMin == "" && cps[j].ProtocolMin != "" {
|
||||
cps[i].ProtocolMin = cps[j].ProtocolMin
|
||||
}
|
||||
@ -1661,6 +1678,18 @@ func listenersUseAnyPortOtherThan(addresses []string, otherPort string) bool {
|
||||
return false
|
||||
}
|
||||
|
||||
func mapContains[K comparable, V any](m map[K]V, keys []K) bool {
|
||||
if len(m) == 0 || len(keys) == 0 {
|
||||
return false
|
||||
}
|
||||
for _, key := range keys {
|
||||
if _, ok := m[key]; ok {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// specificity returns len(s) minus any wildcards (*) and
|
||||
// placeholders ({...}). Basically, it's a length count
|
||||
// that penalizes the use of wildcards and placeholders.
|
||||
|
||||
@ -19,7 +19,8 @@ import (
|
||||
"strconv"
|
||||
|
||||
"github.com/caddyserver/certmagic"
|
||||
"github.com/mholt/acmez/v2/acme"
|
||||
"github.com/libdns/libdns"
|
||||
"github.com/mholt/acmez/v3/acme"
|
||||
|
||||
"github.com/caddyserver/caddy/v2"
|
||||
"github.com/caddyserver/caddy/v2/caddyconfig"
|
||||
@ -45,7 +46,7 @@ func init() {
|
||||
RegisterGlobalOption("ocsp_interval", parseOptDuration)
|
||||
RegisterGlobalOption("acme_ca", parseOptSingleString)
|
||||
RegisterGlobalOption("acme_ca_root", parseOptSingleString)
|
||||
RegisterGlobalOption("acme_dns", parseOptACMEDNS)
|
||||
RegisterGlobalOption("acme_dns", parseOptDNS)
|
||||
RegisterGlobalOption("acme_eab", parseOptACMEEAB)
|
||||
RegisterGlobalOption("cert_issuer", parseOptCertIssuer)
|
||||
RegisterGlobalOption("skip_install_trust", parseOptTrue)
|
||||
@ -62,6 +63,8 @@ func init() {
|
||||
RegisterGlobalOption("log", parseLogOptions)
|
||||
RegisterGlobalOption("preferred_chains", parseOptPreferredChains)
|
||||
RegisterGlobalOption("persist_config", parseOptPersistConfig)
|
||||
RegisterGlobalOption("dns", parseOptDNS)
|
||||
RegisterGlobalOption("ech", parseOptECH)
|
||||
}
|
||||
|
||||
func parseOptTrue(d *caddyfile.Dispenser, _ any) (any, error) { return true, nil }
|
||||
@ -238,25 +241,6 @@ func parseOptDuration(d *caddyfile.Dispenser, _ any) (any, error) {
|
||||
return caddy.Duration(dur), nil
|
||||
}
|
||||
|
||||
func parseOptACMEDNS(d *caddyfile.Dispenser, _ any) (any, error) {
|
||||
if !d.Next() { // consume option name
|
||||
return nil, d.ArgErr()
|
||||
}
|
||||
if !d.Next() { // get DNS module name
|
||||
return nil, d.ArgErr()
|
||||
}
|
||||
modID := "dns.providers." + d.Val()
|
||||
unm, err := caddyfile.UnmarshalModule(d, modID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
prov, ok := unm.(certmagic.DNSProvider)
|
||||
if !ok {
|
||||
return nil, d.Errf("module %s (%T) is not a certmagic.DNSProvider", modID, unm)
|
||||
}
|
||||
return prov, nil
|
||||
}
|
||||
|
||||
func parseOptACMEEAB(d *caddyfile.Dispenser, _ any) (any, error) {
|
||||
eab := new(acme.EAB)
|
||||
d.Next() // consume option name
|
||||
@ -570,3 +554,68 @@ func parseOptPreferredChains(d *caddyfile.Dispenser, _ any) (any, error) {
|
||||
d.Next()
|
||||
return caddytls.ParseCaddyfilePreferredChainsOptions(d)
|
||||
}
|
||||
|
||||
func parseOptDNS(d *caddyfile.Dispenser, _ any) (any, error) {
|
||||
d.Next() // consume option name
|
||||
|
||||
if !d.Next() { // get DNS module name
|
||||
return nil, d.ArgErr()
|
||||
}
|
||||
modID := "dns.providers." + d.Val()
|
||||
unm, err := caddyfile.UnmarshalModule(d, modID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
switch unm.(type) {
|
||||
case libdns.RecordGetter,
|
||||
libdns.RecordSetter,
|
||||
libdns.RecordAppender,
|
||||
libdns.RecordDeleter:
|
||||
default:
|
||||
return nil, d.Errf("module %s (%T) is not a libdns provider", modID, unm)
|
||||
}
|
||||
return unm, nil
|
||||
}
|
||||
|
||||
func parseOptECH(d *caddyfile.Dispenser, _ any) (any, error) {
|
||||
d.Next() // consume option name
|
||||
|
||||
ech := new(caddytls.ECH)
|
||||
|
||||
publicNames := d.RemainingArgs()
|
||||
for _, publicName := range publicNames {
|
||||
ech.Configs = append(ech.Configs, caddytls.ECHConfiguration{
|
||||
PublicName: publicName,
|
||||
})
|
||||
}
|
||||
if len(ech.Configs) == 0 {
|
||||
return nil, d.ArgErr()
|
||||
}
|
||||
|
||||
for nesting := d.Nesting(); d.NextBlock(nesting); {
|
||||
switch d.Val() {
|
||||
case "dns":
|
||||
if !d.Next() {
|
||||
return nil, d.ArgErr()
|
||||
}
|
||||
providerName := d.Val()
|
||||
modID := "dns.providers." + providerName
|
||||
unm, err := caddyfile.UnmarshalModule(d, modID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
ech.Publication = append(ech.Publication, &caddytls.ECHPublication{
|
||||
Configs: publicNames,
|
||||
PublishersRaw: caddy.ModuleMap{
|
||||
"dns": caddyconfig.JSON(caddytls.ECHDNSPublisher{
|
||||
ProviderRaw: caddyconfig.JSONModuleObject(unm, "name", providerName, nil),
|
||||
}, nil),
|
||||
},
|
||||
})
|
||||
default:
|
||||
return nil, d.Errf("ech: unrecognized subdirective '%s'", d.Val())
|
||||
}
|
||||
}
|
||||
|
||||
return ech, nil
|
||||
}
|
||||
|
||||
@ -246,6 +246,8 @@ func unmarshalCaddyfileServerOptions(d *caddyfile.Dispenser) (any, error) {
|
||||
switch d.Val() {
|
||||
case "per_host":
|
||||
serverOpts.Metrics.PerHost = true
|
||||
default:
|
||||
return nil, d.Errf("unrecognized metrics option '%s'", d.Val())
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ import (
|
||||
"strings"
|
||||
|
||||
"github.com/caddyserver/certmagic"
|
||||
"github.com/mholt/acmez/v2/acme"
|
||||
"github.com/mholt/acmez/v3/acme"
|
||||
|
||||
"github.com/caddyserver/caddy/v2"
|
||||
"github.com/caddyserver/caddy/v2/caddyconfig"
|
||||
@ -94,6 +94,9 @@ func (st ServerType) buildTLSApp(
|
||||
|
||||
// collect all hosts that have a wildcard in them, and arent HTTP
|
||||
wildcardHosts := []string{}
|
||||
// hosts that have been explicitly marked to be automated,
|
||||
// even if covered by another wildcard
|
||||
forcedAutomatedNames := make(map[string]struct{})
|
||||
for _, p := range pairings {
|
||||
var addresses []string
|
||||
for _, addressWithProtocols := range p.addressesWithProtocols {
|
||||
@ -150,6 +153,13 @@ func (st ServerType) buildTLSApp(
|
||||
ap.OnDemand = true
|
||||
}
|
||||
|
||||
// collect hosts that are forced to be automated
|
||||
if _, ok := sblock.pile["tls.force_automate"]; ok {
|
||||
for _, host := range sblockHosts {
|
||||
forcedAutomatedNames[host] = struct{}{}
|
||||
}
|
||||
}
|
||||
|
||||
// reuse private keys tls
|
||||
if _, ok := sblock.pile["tls.reuse_private_keys"]; ok {
|
||||
ap.ReusePrivateKeys = true
|
||||
@ -349,6 +359,30 @@ func (st ServerType) buildTLSApp(
|
||||
tlsApp.Automation.OnDemand = onDemand
|
||||
}
|
||||
|
||||
// set up "global" (to the TLS app) DNS provider config
|
||||
if globalDNS, ok := options["dns"]; ok && globalDNS != nil {
|
||||
tlsApp.DNSRaw = caddyconfig.JSONModuleObject(globalDNS, "name", globalDNS.(caddy.Module).CaddyModule().ID.Name(), nil)
|
||||
}
|
||||
|
||||
// set up ECH from Caddyfile options
|
||||
if ech, ok := options["ech"].(*caddytls.ECH); ok {
|
||||
tlsApp.EncryptedClientHello = ech
|
||||
|
||||
// outer server names will need certificates, so make sure they're included
|
||||
// in an automation policy for them that applies any global options
|
||||
ap, err := newBaseAutomationPolicy(options, warnings, true)
|
||||
if err != nil {
|
||||
return nil, warnings, err
|
||||
}
|
||||
for _, cfg := range ech.Configs {
|
||||
ap.SubjectsRaw = append(ap.SubjectsRaw, cfg.PublicName)
|
||||
}
|
||||
if tlsApp.Automation == nil {
|
||||
tlsApp.Automation = new(caddytls.AutomationConfig)
|
||||
}
|
||||
tlsApp.Automation.Policies = append(tlsApp.Automation.Policies, ap)
|
||||
}
|
||||
|
||||
// if the storage clean interval is a boolean, then it's "off" to disable cleaning
|
||||
if sc, ok := options["storage_check"].(string); ok && sc == "off" {
|
||||
tlsApp.DisableStorageCheck = true
|
||||
@ -407,6 +441,13 @@ func (st ServerType) buildTLSApp(
|
||||
}
|
||||
}
|
||||
}
|
||||
for name := range forcedAutomatedNames {
|
||||
if slices.Contains(al, name) {
|
||||
continue
|
||||
}
|
||||
al = append(al, name)
|
||||
}
|
||||
slices.Sort(al) // to stabilize the adapt output
|
||||
if len(al) > 0 {
|
||||
tlsApp.CertificatesRaw["automate"] = caddyconfig.JSON(al, &warnings)
|
||||
}
|
||||
@ -536,7 +577,8 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
|
||||
if globalPreferredChains != nil && acmeIssuer.PreferredChains == nil {
|
||||
acmeIssuer.PreferredChains = globalPreferredChains.(*caddytls.ChainPreference)
|
||||
}
|
||||
if globalHTTPPort != nil && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.HTTP == nil || acmeIssuer.Challenges.HTTP.AlternatePort == 0) {
|
||||
// only configure alt HTTP and TLS-ALPN ports if the DNS challenge is not enabled (wouldn't hurt, but isn't necessary since the DNS challenge is exclusive of others)
|
||||
if globalHTTPPort != nil && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.DNS == nil) && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.HTTP == nil || acmeIssuer.Challenges.HTTP.AlternatePort == 0) {
|
||||
if acmeIssuer.Challenges == nil {
|
||||
acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
|
||||
}
|
||||
@ -545,7 +587,7 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
|
||||
}
|
||||
acmeIssuer.Challenges.HTTP.AlternatePort = globalHTTPPort.(int)
|
||||
}
|
||||
if globalHTTPSPort != nil && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.TLSALPN == nil || acmeIssuer.Challenges.TLSALPN.AlternatePort == 0) {
|
||||
if globalHTTPSPort != nil && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.DNS == nil) && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.TLSALPN == nil || acmeIssuer.Challenges.TLSALPN.AlternatePort == 0) {
|
||||
if acmeIssuer.Challenges == nil {
|
||||
acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
|
||||
}
|
||||
|
||||
@ -31,8 +31,8 @@ import (
|
||||
_ "github.com/caddyserver/caddy/v2/modules/standard"
|
||||
)
|
||||
|
||||
// Defaults store any configuration required to make the tests run
|
||||
type Defaults struct {
|
||||
// Config store any configuration required to make the tests run
|
||||
type Config struct {
|
||||
// Port we expect caddy to listening on
|
||||
AdminPort int
|
||||
// Certificates we expect to be loaded before attempting to run the tests
|
||||
@ -44,7 +44,7 @@ type Defaults struct {
|
||||
}
|
||||
|
||||
// Default testing values
|
||||
var Default = Defaults{
|
||||
var Default = Config{
|
||||
AdminPort: 2999, // different from what a real server also running on a developer's machine might be
|
||||
Certificates: []string{"/caddy.localhost.crt", "/caddy.localhost.key"},
|
||||
TestRequestTimeout: 5 * time.Second,
|
||||
@ -61,6 +61,7 @@ type Tester struct {
|
||||
Client *http.Client
|
||||
configLoaded bool
|
||||
t testing.TB
|
||||
config Config
|
||||
}
|
||||
|
||||
// NewTester will create a new testing client with an attached cookie jar
|
||||
@ -78,9 +79,29 @@ func NewTester(t testing.TB) *Tester {
|
||||
},
|
||||
configLoaded: false,
|
||||
t: t,
|
||||
config: Default,
|
||||
}
|
||||
}
|
||||
|
||||
// WithDefaultOverrides this will override the default test configuration with the provided values.
|
||||
func (tc *Tester) WithDefaultOverrides(overrides Config) *Tester {
|
||||
if overrides.AdminPort != 0 {
|
||||
tc.config.AdminPort = overrides.AdminPort
|
||||
}
|
||||
if len(overrides.Certificates) > 0 {
|
||||
tc.config.Certificates = overrides.Certificates
|
||||
}
|
||||
if overrides.TestRequestTimeout != 0 {
|
||||
tc.config.TestRequestTimeout = overrides.TestRequestTimeout
|
||||
tc.Client.Timeout = overrides.TestRequestTimeout
|
||||
}
|
||||
if overrides.LoadRequestTimeout != 0 {
|
||||
tc.config.LoadRequestTimeout = overrides.LoadRequestTimeout
|
||||
}
|
||||
|
||||
return tc
|
||||
}
|
||||
|
||||
type configLoadError struct {
|
||||
Response string
|
||||
}
|
||||
@ -113,7 +134,7 @@ func (tc *Tester) initServer(rawConfig string, configType string) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
err := validateTestPrerequisites(tc.t)
|
||||
err := validateTestPrerequisites(tc)
|
||||
if err != nil {
|
||||
tc.t.Skipf("skipping tests as failed integration prerequisites. %s", err)
|
||||
return nil
|
||||
@ -121,7 +142,7 @@ func (tc *Tester) initServer(rawConfig string, configType string) error {
|
||||
|
||||
tc.t.Cleanup(func() {
|
||||
if tc.t.Failed() && tc.configLoaded {
|
||||
res, err := http.Get(fmt.Sprintf("http://localhost:%d/config/", Default.AdminPort))
|
||||
res, err := http.Get(fmt.Sprintf("http://localhost:%d/config/", tc.config.AdminPort))
|
||||
if err != nil {
|
||||
tc.t.Log("unable to read the current config")
|
||||
return
|
||||
@ -151,10 +172,10 @@ func (tc *Tester) initServer(rawConfig string, configType string) error {
|
||||
tc.t.Logf("After: %s", rawConfig)
|
||||
}
|
||||
client := &http.Client{
|
||||
Timeout: Default.LoadRequestTimeout,
|
||||
Timeout: tc.config.LoadRequestTimeout,
|
||||
}
|
||||
start := time.Now()
|
||||
req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/load", Default.AdminPort), strings.NewReader(rawConfig))
|
||||
req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/load", tc.config.AdminPort), strings.NewReader(rawConfig))
|
||||
if err != nil {
|
||||
tc.t.Errorf("failed to create request. %s", err)
|
||||
return err
|
||||
@ -205,11 +226,11 @@ func (tc *Tester) ensureConfigRunning(rawConfig string, configType string) error
|
||||
}
|
||||
|
||||
client := &http.Client{
|
||||
Timeout: Default.LoadRequestTimeout,
|
||||
Timeout: tc.config.LoadRequestTimeout,
|
||||
}
|
||||
|
||||
fetchConfig := func(client *http.Client) any {
|
||||
resp, err := client.Get(fmt.Sprintf("http://localhost:%d/config/", Default.AdminPort))
|
||||
resp, err := client.Get(fmt.Sprintf("http://localhost:%d/config/", tc.config.AdminPort))
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
@ -237,30 +258,30 @@ func (tc *Tester) ensureConfigRunning(rawConfig string, configType string) error
|
||||
}
|
||||
|
||||
const initConfig = `{
|
||||
admin localhost:2999
|
||||
admin localhost:%d
|
||||
}
|
||||
`
|
||||
|
||||
// validateTestPrerequisites ensures the certificates are available in the
|
||||
// designated path and Caddy sub-process is running.
|
||||
func validateTestPrerequisites(t testing.TB) error {
|
||||
func validateTestPrerequisites(tc *Tester) error {
|
||||
// check certificates are found
|
||||
for _, certName := range Default.Certificates {
|
||||
for _, certName := range tc.config.Certificates {
|
||||
if _, err := os.Stat(getIntegrationDir() + certName); errors.Is(err, fs.ErrNotExist) {
|
||||
return fmt.Errorf("caddy integration test certificates (%s) not found", certName)
|
||||
}
|
||||
}
|
||||
|
||||
if isCaddyAdminRunning() != nil {
|
||||
if isCaddyAdminRunning(tc) != nil {
|
||||
// setup the init config file, and set the cleanup afterwards
|
||||
f, err := os.CreateTemp("", "")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
t.Cleanup(func() {
|
||||
tc.t.Cleanup(func() {
|
||||
os.Remove(f.Name())
|
||||
})
|
||||
if _, err := f.WriteString(initConfig); err != nil {
|
||||
if _, err := f.WriteString(fmt.Sprintf(initConfig, tc.config.AdminPort)); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
@ -271,23 +292,23 @@ func validateTestPrerequisites(t testing.TB) error {
|
||||
}()
|
||||
|
||||
// wait for caddy to start serving the initial config
|
||||
for retries := 10; retries > 0 && isCaddyAdminRunning() != nil; retries-- {
|
||||
for retries := 10; retries > 0 && isCaddyAdminRunning(tc) != nil; retries-- {
|
||||
time.Sleep(1 * time.Second)
|
||||
}
|
||||
}
|
||||
|
||||
// one more time to return the error
|
||||
return isCaddyAdminRunning()
|
||||
return isCaddyAdminRunning(tc)
|
||||
}
|
||||
|
||||
func isCaddyAdminRunning() error {
|
||||
func isCaddyAdminRunning(tc *Tester) error {
|
||||
// assert that caddy is running
|
||||
client := &http.Client{
|
||||
Timeout: Default.LoadRequestTimeout,
|
||||
Timeout: tc.config.LoadRequestTimeout,
|
||||
}
|
||||
resp, err := client.Get(fmt.Sprintf("http://localhost:%d/config/", Default.AdminPort))
|
||||
resp, err := client.Get(fmt.Sprintf("http://localhost:%d/config/", tc.config.AdminPort))
|
||||
if err != nil {
|
||||
return fmt.Errorf("caddy integration test caddy server not running. Expected to be listening on localhost:%d", Default.AdminPort)
|
||||
return fmt.Errorf("caddy integration test caddy server not running. Expected to be listening on localhost:%d", tc.config.AdminPort)
|
||||
}
|
||||
resp.Body.Close()
|
||||
|
||||
|
||||
@ -6,6 +6,7 @@ import (
|
||||
"crypto/elliptic"
|
||||
"crypto/rand"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"net"
|
||||
"net/http"
|
||||
"strings"
|
||||
@ -13,10 +14,11 @@ import (
|
||||
|
||||
"github.com/caddyserver/caddy/v2"
|
||||
"github.com/caddyserver/caddy/v2/caddytest"
|
||||
"github.com/mholt/acmez/v2"
|
||||
"github.com/mholt/acmez/v2/acme"
|
||||
"github.com/mholt/acmez/v3"
|
||||
"github.com/mholt/acmez/v3/acme"
|
||||
smallstepacme "github.com/smallstep/certificates/acme"
|
||||
"go.uber.org/zap"
|
||||
"go.uber.org/zap/exp/zapslog"
|
||||
)
|
||||
|
||||
const acmeChallengePort = 9081
|
||||
@ -48,7 +50,7 @@ func TestACMEServerWithDefaults(t *testing.T) {
|
||||
Client: &acme.Client{
|
||||
Directory: "https://acme.localhost:9443/acme/local/directory",
|
||||
HTTPClient: tester.Client,
|
||||
Logger: logger,
|
||||
Logger: slog.New(zapslog.NewHandler(logger.Core())),
|
||||
},
|
||||
ChallengeSolvers: map[string]acmez.Solver{
|
||||
acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
|
||||
@ -117,7 +119,7 @@ func TestACMEServerWithMismatchedChallenges(t *testing.T) {
|
||||
Client: &acme.Client{
|
||||
Directory: "https://acme.localhost:9443/acme/local/directory",
|
||||
HTTPClient: tester.Client,
|
||||
Logger: logger,
|
||||
Logger: slog.New(zapslog.NewHandler(logger.Core())),
|
||||
},
|
||||
ChallengeSolvers: map[string]acmez.Solver{
|
||||
acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
|
||||
|
||||
@ -5,13 +5,15 @@ import (
|
||||
"crypto/ecdsa"
|
||||
"crypto/elliptic"
|
||||
"crypto/rand"
|
||||
"log/slog"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/caddyserver/caddy/v2/caddytest"
|
||||
"github.com/mholt/acmez/v2"
|
||||
"github.com/mholt/acmez/v2/acme"
|
||||
"github.com/mholt/acmez/v3"
|
||||
"github.com/mholt/acmez/v3/acme"
|
||||
"go.uber.org/zap"
|
||||
"go.uber.org/zap/exp/zapslog"
|
||||
)
|
||||
|
||||
func TestACMEServerDirectory(t *testing.T) {
|
||||
@ -76,7 +78,7 @@ func TestACMEServerAllowPolicy(t *testing.T) {
|
||||
Client: &acme.Client{
|
||||
Directory: "https://acme.localhost:9443/acme/local/directory",
|
||||
HTTPClient: tester.Client,
|
||||
Logger: logger,
|
||||
Logger: slog.New(zapslog.NewHandler(logger.Core())),
|
||||
},
|
||||
ChallengeSolvers: map[string]acmez.Solver{
|
||||
acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
|
||||
@ -165,7 +167,7 @@ func TestACMEServerDenyPolicy(t *testing.T) {
|
||||
Client: &acme.Client{
|
||||
Directory: "https://acme.localhost:9443/acme/local/directory",
|
||||
HTTPClient: tester.Client,
|
||||
Logger: logger,
|
||||
Logger: slog.New(zapslog.NewHandler(logger.Core())),
|
||||
},
|
||||
ChallengeSolvers: map[string]acmez.Solver{
|
||||
acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
|
||||
|
||||
@ -21,6 +21,8 @@ encode {
|
||||
zstd
|
||||
gzip 5
|
||||
}
|
||||
|
||||
encode
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
@ -76,6 +78,17 @@ encode {
|
||||
"zstd",
|
||||
"gzip"
|
||||
]
|
||||
},
|
||||
{
|
||||
"encodings": {
|
||||
"gzip": {},
|
||||
"zstd": {}
|
||||
},
|
||||
"handler": "encode",
|
||||
"prefer": [
|
||||
"zstd",
|
||||
"gzip"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -3,6 +3,10 @@
|
||||
file_server {
|
||||
precompressed zstd br gzip
|
||||
}
|
||||
|
||||
file_server {
|
||||
precompressed
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
@ -30,6 +34,22 @@ file_server {
|
||||
"br",
|
||||
"gzip"
|
||||
]
|
||||
},
|
||||
{
|
||||
"handler": "file_server",
|
||||
"hide": [
|
||||
"./Caddyfile"
|
||||
],
|
||||
"precompressed": {
|
||||
"br": {},
|
||||
"gzip": {},
|
||||
"zstd": {}
|
||||
},
|
||||
"precompressed_order": [
|
||||
"br",
|
||||
"zstd",
|
||||
"gzip"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -12,10 +12,14 @@
|
||||
@images path /images/*
|
||||
header @images {
|
||||
Cache-Control "public, max-age=3600, stale-while-revalidate=86400"
|
||||
match {
|
||||
status 200
|
||||
}
|
||||
}
|
||||
header {
|
||||
+Link "Foo"
|
||||
+Link "Bar"
|
||||
match status 200
|
||||
}
|
||||
header >Set Defer
|
||||
header >Replace Deferred Replacement
|
||||
@ -42,6 +46,11 @@
|
||||
{
|
||||
"handler": "headers",
|
||||
"response": {
|
||||
"require": {
|
||||
"status_code": [
|
||||
200
|
||||
]
|
||||
},
|
||||
"set": {
|
||||
"Cache-Control": [
|
||||
"public, max-age=3600, stale-while-revalidate=86400"
|
||||
@ -136,6 +145,11 @@
|
||||
"Foo",
|
||||
"Bar"
|
||||
]
|
||||
},
|
||||
"require": {
|
||||
"status_code": [
|
||||
200
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
|
||||
@ -0,0 +1,180 @@
|
||||
automated1.example.com {
|
||||
tls force_automate
|
||||
respond "Automated!"
|
||||
}
|
||||
|
||||
automated2.example.com {
|
||||
tls force_automate
|
||||
respond "Automated!"
|
||||
}
|
||||
|
||||
shadowed.example.com {
|
||||
respond "Shadowed!"
|
||||
}
|
||||
|
||||
*.example.com {
|
||||
tls cert.pem key.pem
|
||||
respond "Wildcard!"
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"automated1.example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "Automated!",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
},
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"automated2.example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "Automated!",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
},
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"shadowed.example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "Shadowed!",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
},
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"*.example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "Wildcard!",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
],
|
||||
"tls_connection_policies": [
|
||||
{
|
||||
"match": {
|
||||
"sni": [
|
||||
"automated1.example.com"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"match": {
|
||||
"sni": [
|
||||
"automated2.example.com"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"match": {
|
||||
"sni": [
|
||||
"*.example.com"
|
||||
]
|
||||
},
|
||||
"certificate_selection": {
|
||||
"any_tag": [
|
||||
"cert0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"certificates": {
|
||||
"automate": [
|
||||
"automated1.example.com",
|
||||
"automated2.example.com"
|
||||
],
|
||||
"load_files": [
|
||||
{
|
||||
"certificate": "cert.pem",
|
||||
"key": "key.pem",
|
||||
"tags": [
|
||||
"cert0"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,102 @@
|
||||
subdomain.example.com {
|
||||
respond "Subdomain!"
|
||||
}
|
||||
|
||||
*.example.com {
|
||||
tls cert.pem key.pem
|
||||
respond "Wildcard!"
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"subdomain.example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "Subdomain!",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
},
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"*.example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "Wildcard!",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
],
|
||||
"tls_connection_policies": [
|
||||
{
|
||||
"match": {
|
||||
"sni": [
|
||||
"*.example.com"
|
||||
]
|
||||
},
|
||||
"certificate_selection": {
|
||||
"any_tag": [
|
||||
"cert0"
|
||||
]
|
||||
}
|
||||
},
|
||||
{}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"certificates": {
|
||||
"load_files": [
|
||||
{
|
||||
"certificate": "cert.pem",
|
||||
"key": "key.pem",
|
||||
"tags": [
|
||||
"cert0"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,8 +1,3 @@
|
||||
// The below line is required to enable post-quantum key agreement in Go 1.23
|
||||
// by default without insisting on setting a minimum version of 1.23 in go.mod.
|
||||
// See https://github.com/caddyserver/caddy/issues/6540#issuecomment-2313094905
|
||||
//go:debug tlskyber=1
|
||||
|
||||
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
||||
@ -171,6 +171,10 @@ func cmdStart(fl Flags) (int, error) {
|
||||
func cmdRun(fl Flags) (int, error) {
|
||||
caddy.TrapSignals()
|
||||
|
||||
logger := caddy.Log()
|
||||
undoMaxProcs := setResourceLimits(logger)
|
||||
defer undoMaxProcs()
|
||||
|
||||
configFlag := fl.String("config")
|
||||
configAdapterFlag := fl.String("adapter")
|
||||
resumeFlag := fl.Bool("resume")
|
||||
@ -196,18 +200,18 @@ func cmdRun(fl Flags) (int, error) {
|
||||
config, err = os.ReadFile(caddy.ConfigAutosavePath)
|
||||
if errors.Is(err, fs.ErrNotExist) {
|
||||
// not a bad error; just can't resume if autosave file doesn't exist
|
||||
caddy.Log().Info("no autosave file exists", zap.String("autosave_file", caddy.ConfigAutosavePath))
|
||||
logger.Info("no autosave file exists", zap.String("autosave_file", caddy.ConfigAutosavePath))
|
||||
resumeFlag = false
|
||||
} else if err != nil {
|
||||
return caddy.ExitCodeFailedStartup, err
|
||||
} else {
|
||||
if configFlag == "" {
|
||||
caddy.Log().Info("resuming from last configuration",
|
||||
logger.Info("resuming from last configuration",
|
||||
zap.String("autosave_file", caddy.ConfigAutosavePath))
|
||||
} else {
|
||||
// if they also specified a config file, user should be aware that we're not
|
||||
// using it (doing so could lead to data/config loss by overwriting!)
|
||||
caddy.Log().Warn("--config and --resume flags were used together; ignoring --config and resuming from last configuration",
|
||||
logger.Warn("--config and --resume flags were used together; ignoring --config and resuming from last configuration",
|
||||
zap.String("autosave_file", caddy.ConfigAutosavePath))
|
||||
}
|
||||
}
|
||||
@ -225,7 +229,7 @@ func cmdRun(fl Flags) (int, error) {
|
||||
if pidfileFlag != "" {
|
||||
err := caddy.PIDFile(pidfileFlag)
|
||||
if err != nil {
|
||||
caddy.Log().Error("unable to write PID file",
|
||||
logger.Error("unable to write PID file",
|
||||
zap.String("pidfile", pidfileFlag),
|
||||
zap.Error(err))
|
||||
}
|
||||
@ -236,7 +240,7 @@ func cmdRun(fl Flags) (int, error) {
|
||||
if err != nil {
|
||||
return caddy.ExitCodeFailedStartup, fmt.Errorf("loading initial config: %v", err)
|
||||
}
|
||||
caddy.Log().Info("serving initial configuration")
|
||||
logger.Info("serving initial configuration")
|
||||
|
||||
// if we are to report to another process the successful start
|
||||
// of the server, do so now by echoing back contents of stdin
|
||||
@ -272,15 +276,15 @@ func cmdRun(fl Flags) (int, error) {
|
||||
switch runtime.GOOS {
|
||||
case "windows":
|
||||
if os.Getenv("HOME") == "" && os.Getenv("USERPROFILE") == "" && !hasXDG {
|
||||
caddy.Log().Warn("neither HOME nor USERPROFILE environment variables are set - please fix; some assets might be stored in ./caddy")
|
||||
logger.Warn("neither HOME nor USERPROFILE environment variables are set - please fix; some assets might be stored in ./caddy")
|
||||
}
|
||||
case "plan9":
|
||||
if os.Getenv("home") == "" && !hasXDG {
|
||||
caddy.Log().Warn("$home environment variable is empty - please fix; some assets might be stored in ./caddy")
|
||||
logger.Warn("$home environment variable is empty - please fix; some assets might be stored in ./caddy")
|
||||
}
|
||||
default:
|
||||
if os.Getenv("HOME") == "" && !hasXDG {
|
||||
caddy.Log().Warn("$HOME environment variable is empty - please fix; some assets might be stored in ./caddy")
|
||||
logger.Warn("$HOME environment variable is empty - please fix; some assets might be stored in ./caddy")
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
34
cmd/main.go
34
cmd/main.go
@ -24,6 +24,7 @@ import (
|
||||
"io"
|
||||
"io/fs"
|
||||
"log"
|
||||
"log/slog"
|
||||
"net"
|
||||
"os"
|
||||
"path/filepath"
|
||||
@ -33,10 +34,12 @@ import (
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/KimMachineGun/automemlimit/memlimit"
|
||||
"github.com/caddyserver/certmagic"
|
||||
"github.com/spf13/pflag"
|
||||
"go.uber.org/automaxprocs/maxprocs"
|
||||
"go.uber.org/zap"
|
||||
"go.uber.org/zap/exp/zapslog"
|
||||
|
||||
"github.com/caddyserver/caddy/v2"
|
||||
"github.com/caddyserver/caddy/v2/caddyconfig"
|
||||
@ -66,12 +69,6 @@ func Main() {
|
||||
os.Exit(caddy.ExitCodeFailedStartup)
|
||||
}
|
||||
|
||||
undo, err := maxprocs.Set()
|
||||
defer undo()
|
||||
if err != nil {
|
||||
caddy.Log().Warn("failed to set GOMAXPROCS", zap.Error(err))
|
||||
}
|
||||
|
||||
if err := defaultFactory.Build().Execute(); err != nil {
|
||||
var exitError *exitError
|
||||
if errors.As(err, &exitError) {
|
||||
@ -467,6 +464,31 @@ func printEnvironment() {
|
||||
}
|
||||
}
|
||||
|
||||
func setResourceLimits(logger *zap.Logger) func() {
|
||||
// Configure the maximum number of CPUs to use to match the Linux container quota (if any)
|
||||
// See https://pkg.go.dev/runtime#GOMAXPROCS
|
||||
undo, err := maxprocs.Set(maxprocs.Logger(logger.Sugar().Infof))
|
||||
if err != nil {
|
||||
logger.Warn("failed to set GOMAXPROCS", zap.Error(err))
|
||||
}
|
||||
|
||||
// Configure the maximum memory to use to match the Linux container quota (if any) or system memory
|
||||
// See https://pkg.go.dev/runtime/debug#SetMemoryLimit
|
||||
_, _ = memlimit.SetGoMemLimitWithOpts(
|
||||
memlimit.WithLogger(
|
||||
slog.New(zapslog.NewHandler(logger.Core())),
|
||||
),
|
||||
memlimit.WithProvider(
|
||||
memlimit.ApplyFallback(
|
||||
memlimit.FromCgroup,
|
||||
memlimit.FromSystem,
|
||||
),
|
||||
),
|
||||
)
|
||||
|
||||
return undo
|
||||
}
|
||||
|
||||
// StringSlice is a flag.Value that enables repeated use of a string flag.
|
||||
type StringSlice []string
|
||||
|
||||
|
||||
12
context.go
12
context.go
@ -385,6 +385,17 @@ func (ctx Context) LoadModuleByID(id string, rawMsg json.RawMessage) (any, error
|
||||
return nil, fmt.Errorf("module value cannot be null")
|
||||
}
|
||||
|
||||
// if this is an app module, keep a reference to it,
|
||||
// since submodules may need to reference it during
|
||||
// provisioning (even though the parent app module
|
||||
// may not be fully provisioned yet; this is the case
|
||||
// with the tls app's automation policies, which may
|
||||
// refer to the tls app to check if a global DNS
|
||||
// module has been configured for DNS challenges)
|
||||
if appModule, ok := val.(App); ok {
|
||||
ctx.cfg.apps[id] = appModule
|
||||
}
|
||||
|
||||
ctx.ancestry = append(ctx.ancestry, val)
|
||||
|
||||
if prov, ok := val.(Provisioner); ok {
|
||||
@ -471,7 +482,6 @@ func (ctx Context) App(name string) (any, error) {
|
||||
if appRaw != nil {
|
||||
ctx.cfg.AppsRaw[name] = nil // allow GC to deallocate
|
||||
}
|
||||
ctx.cfg.apps[name] = modVal.(App)
|
||||
return modVal, nil
|
||||
}
|
||||
|
||||
|
||||
67
go.mod
67
go.mod
@ -1,31 +1,31 @@
|
||||
module github.com/caddyserver/caddy/v2
|
||||
|
||||
go 1.22.3
|
||||
|
||||
toolchain go1.23.0
|
||||
go 1.24
|
||||
|
||||
require (
|
||||
github.com/BurntSushi/toml v1.4.0
|
||||
github.com/KimMachineGun/automemlimit v0.7.1
|
||||
github.com/Masterminds/sprig/v3 v3.3.0
|
||||
github.com/alecthomas/chroma/v2 v2.14.0
|
||||
github.com/alecthomas/chroma/v2 v2.15.0
|
||||
github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b
|
||||
github.com/caddyserver/certmagic v0.21.5-0.20241105180249-4293198e094d
|
||||
github.com/caddyserver/certmagic v0.22.0
|
||||
github.com/caddyserver/zerossl v0.1.3
|
||||
github.com/cloudflare/circl v1.6.0
|
||||
github.com/dustin/go-humanize v1.0.1
|
||||
github.com/go-chi/chi/v5 v5.0.12
|
||||
github.com/google/cel-go v0.21.0
|
||||
github.com/go-chi/chi/v5 v5.2.1
|
||||
github.com/google/cel-go v0.24.1
|
||||
github.com/google/uuid v1.6.0
|
||||
github.com/klauspost/compress v1.17.11
|
||||
github.com/klauspost/cpuid/v2 v2.2.8
|
||||
github.com/mholt/acmez/v2 v2.0.3
|
||||
github.com/klauspost/compress v1.18.0
|
||||
github.com/klauspost/cpuid/v2 v2.2.10
|
||||
github.com/mholt/acmez/v3 v3.1.0
|
||||
github.com/prometheus/client_golang v1.19.1
|
||||
github.com/quic-go/quic-go v0.48.2
|
||||
github.com/quic-go/quic-go v0.50.0
|
||||
github.com/smallstep/certificates v0.26.1
|
||||
github.com/smallstep/nosql v0.6.1
|
||||
github.com/smallstep/truststore v0.13.0
|
||||
github.com/spf13/cobra v1.8.1
|
||||
github.com/spf13/pflag v1.0.5
|
||||
github.com/stretchr/testify v1.9.0
|
||||
github.com/spf13/cobra v1.9.1
|
||||
github.com/spf13/pflag v1.0.6
|
||||
github.com/stretchr/testify v1.10.0
|
||||
github.com/tailscale/tscert v0.0.0-20240608151842-d3f834017e53
|
||||
github.com/yuin/goldmark v1.7.8
|
||||
github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
|
||||
@ -37,32 +37,33 @@ require (
|
||||
go.uber.org/automaxprocs v1.6.0
|
||||
go.uber.org/zap v1.27.0
|
||||
go.uber.org/zap/exp v0.3.0
|
||||
golang.org/x/crypto v0.30.0
|
||||
golang.org/x/crypto/x509roots/fallback v0.0.0-20241104001025-71ed71b4faf9
|
||||
golang.org/x/net v0.32.0
|
||||
golang.org/x/sync v0.10.0
|
||||
golang.org/x/term v0.27.0
|
||||
golang.org/x/time v0.7.0
|
||||
golang.org/x/crypto v0.36.0
|
||||
golang.org/x/crypto/x509roots/fallback v0.0.0-20250305170421-49bf5b80c810
|
||||
golang.org/x/net v0.37.0
|
||||
golang.org/x/sync v0.12.0
|
||||
golang.org/x/term v0.30.0
|
||||
golang.org/x/time v0.11.0
|
||||
gopkg.in/natefinch/lumberjack.v2 v2.2.1
|
||||
gopkg.in/yaml.v3 v3.0.1
|
||||
)
|
||||
|
||||
require (
|
||||
cel.dev/expr v0.19.1 // indirect
|
||||
dario.cat/mergo v1.0.1 // indirect
|
||||
github.com/Microsoft/go-winio v0.6.0 // indirect
|
||||
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
|
||||
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||
github.com/francoispqt/gojay v1.2.13 // indirect
|
||||
github.com/fxamacker/cbor/v2 v2.6.0 // indirect
|
||||
github.com/go-jose/go-jose/v3 v3.0.3 // indirect
|
||||
github.com/go-jose/go-jose/v3 v3.0.4 // indirect
|
||||
github.com/go-kit/log v0.2.1 // indirect
|
||||
github.com/golang/glog v1.2.2 // indirect
|
||||
github.com/google/certificate-transparency-go v1.1.8-0.20240110162603-74a5dd331745 // indirect
|
||||
github.com/google/go-tpm v0.9.0 // indirect
|
||||
github.com/google/go-tspi v0.3.0 // indirect
|
||||
github.com/google/pprof v0.0.0-20231212022811-ec68065c825e // indirect
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 // indirect
|
||||
github.com/onsi/ginkgo/v2 v2.13.2 // indirect
|
||||
github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
|
||||
github.com/pmezard/go-difflib v1.0.0 // indirect
|
||||
github.com/quic-go/qpack v0.5.1 // indirect
|
||||
github.com/smallstep/go-attestation v0.4.4-0.20240109183208-413678f90935 // indirect
|
||||
@ -74,7 +75,7 @@ require (
|
||||
go.opentelemetry.io/contrib/propagators/b3 v1.17.0 // indirect
|
||||
go.opentelemetry.io/contrib/propagators/jaeger v1.17.0 // indirect
|
||||
go.opentelemetry.io/contrib/propagators/ot v1.17.0 // indirect
|
||||
go.uber.org/mock v0.4.0 // indirect
|
||||
go.uber.org/mock v0.5.0 // indirect
|
||||
golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9 // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 // indirect
|
||||
@ -90,12 +91,12 @@ require (
|
||||
github.com/cespare/xxhash v1.1.0 // indirect
|
||||
github.com/cespare/xxhash/v2 v2.3.0
|
||||
github.com/chzyer/readline v1.5.1 // indirect
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
|
||||
github.com/dgraph-io/badger v1.6.2 // indirect
|
||||
github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
|
||||
github.com/dgraph-io/ristretto v0.1.0 // indirect
|
||||
github.com/dgraph-io/ristretto v0.2.0 // indirect
|
||||
github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
|
||||
github.com/dlclark/regexp2 v1.11.0 // indirect
|
||||
github.com/dlclark/regexp2 v1.11.4 // indirect
|
||||
github.com/felixge/httpsnoop v1.0.4 // indirect
|
||||
github.com/go-kit/kit v0.13.0 // indirect
|
||||
github.com/go-logfmt/logfmt v0.6.0 // indirect
|
||||
@ -115,18 +116,18 @@ require (
|
||||
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
|
||||
github.com/jackc/pgtype v1.14.0 // indirect
|
||||
github.com/jackc/pgx/v4 v4.18.3 // indirect
|
||||
github.com/libdns/libdns v0.2.2
|
||||
github.com/libdns/libdns v0.2.3
|
||||
github.com/manifoldco/promptui v0.9.0 // indirect
|
||||
github.com/mattn/go-colorable v0.1.13 // indirect
|
||||
github.com/mattn/go-isatty v0.0.20 // indirect
|
||||
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
|
||||
github.com/miekg/dns v1.1.62 // indirect
|
||||
github.com/miekg/dns v1.1.63 // indirect
|
||||
github.com/mitchellh/copystructure v1.2.0 // indirect
|
||||
github.com/mitchellh/go-ps v1.0.0 // indirect
|
||||
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
||||
github.com/pires/go-proxyproto v0.7.1-0.20240628150027-b718e7ce4964
|
||||
github.com/pkg/errors v0.9.1 // indirect
|
||||
github.com/prometheus/client_model v0.5.0 // indirect
|
||||
github.com/prometheus/client_model v0.5.0
|
||||
github.com/prometheus/common v0.48.0 // indirect
|
||||
github.com/prometheus/procfs v0.12.0 // indirect
|
||||
github.com/rs/xid v1.5.0 // indirect
|
||||
@ -147,10 +148,10 @@ require (
|
||||
go.step.sm/crypto v0.45.0
|
||||
go.step.sm/linkedca v0.20.1 // indirect
|
||||
go.uber.org/multierr v1.11.0 // indirect
|
||||
golang.org/x/mod v0.18.0 // indirect
|
||||
golang.org/x/sys v0.28.0
|
||||
golang.org/x/text v0.21.0 // indirect
|
||||
golang.org/x/tools v0.22.0 // indirect
|
||||
golang.org/x/mod v0.24.0 // indirect
|
||||
golang.org/x/sys v0.31.0
|
||||
golang.org/x/text v0.23.0 // indirect
|
||||
golang.org/x/tools v0.31.0 // indirect
|
||||
google.golang.org/grpc v1.67.1 // indirect
|
||||
google.golang.org/protobuf v1.35.1 // indirect
|
||||
howett.net/plist v1.0.0 // indirect
|
||||
|
||||
128
go.sum
128
go.sum
@ -1,3 +1,5 @@
|
||||
cel.dev/expr v0.19.1 h1:NciYrtDRIR0lNCnH1LFJegdjspNx9fI59O7TWcua/W4=
|
||||
cel.dev/expr v0.19.1/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
|
||||
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
|
||||
cloud.google.com/go v0.31.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
|
||||
cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
|
||||
@ -31,6 +33,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
|
||||
github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
|
||||
github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
|
||||
github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
|
||||
github.com/KimMachineGun/automemlimit v0.7.1 h1:QcG/0iCOLChjfUweIMC3YL5Xy9C3VBeNmCZHrZfJMBw=
|
||||
github.com/KimMachineGun/automemlimit v0.7.1/go.mod h1:QZxpHaGOQoYvFhv/r4u3U0JTC2ZcOwbSr11UZF46UBM=
|
||||
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
|
||||
github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
|
||||
github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
|
||||
@ -42,11 +46,11 @@ github.com/Microsoft/go-winio v0.6.0 h1:slsWYD/zyx7lCXoZVlvQrj0hPTM1HI4+v1sIda2y
|
||||
github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
|
||||
github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
|
||||
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
|
||||
github.com/alecthomas/assert/v2 v2.7.0 h1:QtqSACNS3tF7oasA8CU6A6sXZSBDqnm7RfpLl9bZqbE=
|
||||
github.com/alecthomas/assert/v2 v2.7.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
|
||||
github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
|
||||
github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
|
||||
github.com/alecthomas/chroma/v2 v2.2.0/go.mod h1:vf4zrexSH54oEjJ7EdB65tGNHmH3pGZmVkgTP5RHvAs=
|
||||
github.com/alecthomas/chroma/v2 v2.14.0 h1:R3+wzpnUArGcQz7fCETQBzO5n9IMNi13iIs46aU4V9E=
|
||||
github.com/alecthomas/chroma/v2 v2.14.0/go.mod h1:QolEbTfmUHIMVpBqxeDnNBj2uoeI4EbYP4i6n68SG4I=
|
||||
github.com/alecthomas/chroma/v2 v2.15.0 h1:LxXTQHFoYrstG2nnV9y2X5O94sOBzf0CIUpSTbpxvMc=
|
||||
github.com/alecthomas/chroma/v2 v2.15.0/go.mod h1:gUhVLrPDXPtp/f+L1jo9xepo9gL4eLwRuGAunSZMkio=
|
||||
github.com/alecthomas/repr v0.0.0-20220113201626-b1b626ac65ae/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
|
||||
github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
|
||||
github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
|
||||
@ -89,15 +93,14 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
|
||||
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
|
||||
github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
|
||||
github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
|
||||
github.com/caddyserver/certmagic v0.21.5-0.20241105180249-4293198e094d h1:+zOduGxxC4WBAnlDf5Uf0TXbWXRqjUXkJKevDZZa79A=
|
||||
github.com/caddyserver/certmagic v0.21.5-0.20241105180249-4293198e094d/go.mod h1:swUXjQ1T9ZtMv95qj7/InJvWLXURU85r+CfG0T+ZbDE=
|
||||
github.com/caddyserver/certmagic v0.22.0 h1:hi2skv2jouUw9uQUEyYSTTmqPZPHgf61dOANSIVCLOw=
|
||||
github.com/caddyserver/certmagic v0.22.0/go.mod h1:Vc0msarAPhOagbDc/SU6M2zbzdwVuZ0lkTh2EqtH4vs=
|
||||
github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+YTAyA=
|
||||
github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
|
||||
github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
|
||||
github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
|
||||
github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
|
||||
github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
|
||||
github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
|
||||
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
|
||||
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
|
||||
github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
|
||||
@ -110,6 +113,8 @@ github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMn
|
||||
github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04=
|
||||
github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
|
||||
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
|
||||
github.com/cloudflare/circl v1.6.0 h1:cr5JKic4HI+LkINy2lg3W2jF8sHCVTBncJr5gIIq7qk=
|
||||
github.com/cloudflare/circl v1.6.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
|
||||
github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
|
||||
github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
|
||||
github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
|
||||
@ -120,8 +125,8 @@ github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7
|
||||
github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
|
||||
github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lVfRxZq4=
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
|
||||
github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
|
||||
github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||
@ -132,15 +137,15 @@ github.com/dgraph-io/badger/v2 v2.2007.4 h1:TRWBQg8UrlUhaFdco01nO2uXwzKS7zd+HVdw
|
||||
github.com/dgraph-io/badger/v2 v2.2007.4/go.mod h1:vSw/ax2qojzbN6eXHIx6KPKtCSHJN/Uz0X0VPruTIhk=
|
||||
github.com/dgraph-io/ristretto v0.0.2/go.mod h1:KPxhHT9ZxKefz+PCeOGsrHpl1qZ7i70dGTu2u+Ahh6E=
|
||||
github.com/dgraph-io/ristretto v0.0.3-0.20200630154024-f66de99634de/go.mod h1:KPxhHT9ZxKefz+PCeOGsrHpl1qZ7i70dGTu2u+Ahh6E=
|
||||
github.com/dgraph-io/ristretto v0.1.0 h1:Jv3CGQHp9OjuMBSne1485aDpUkTKEcUqF+jm/LuerPI=
|
||||
github.com/dgraph-io/ristretto v0.1.0/go.mod h1:fux0lOrBhrVCJd3lcTHsIJhq1T2rokOu6v9Vcb3Q9ug=
|
||||
github.com/dgraph-io/ristretto v0.2.0 h1:XAfl+7cmoUDWW/2Lx8TGZQjjxIQ2Ley9DSf52dru4WE=
|
||||
github.com/dgraph-io/ristretto v0.2.0/go.mod h1:8uBHCU/PBV4Ag0CJrP47b9Ofby5dqWNh4FicAdoqFNU=
|
||||
github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
|
||||
github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 h1:fAjc9m62+UWV/WAFKLNi6ZS0675eEUC9y3AlwSbQu1Y=
|
||||
github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
|
||||
github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
|
||||
github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
|
||||
github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
|
||||
github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
|
||||
github.com/dlclark/regexp2 v1.11.4 h1:rPYF9/LECdNymJufQKmri9gV604RvvABwgOA8un7yAo=
|
||||
github.com/dlclark/regexp2 v1.11.4/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
|
||||
github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
|
||||
github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
|
||||
github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
|
||||
@ -156,11 +161,11 @@ github.com/fxamacker/cbor/v2 v2.6.0 h1:sU6J2usfADwWlYDAFhZBQ6TnLFBHxgesMrQfQgk1t
|
||||
github.com/fxamacker/cbor/v2 v2.6.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
|
||||
github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
|
||||
github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
|
||||
github.com/go-chi/chi/v5 v5.0.12 h1:9euLV5sTrTNTRUU9POmDUvfxyj6LAABLUcEWO+JJb4s=
|
||||
github.com/go-chi/chi/v5 v5.0.12/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
|
||||
github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=
|
||||
github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
|
||||
github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
|
||||
github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7G7k=
|
||||
github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
|
||||
github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
|
||||
github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
|
||||
github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
|
||||
github.com/go-kit/kit v0.13.0 h1:OoneCcHKHQ03LfBpoQCUfCluwd2Vt3ohz+kvbJneZAU=
|
||||
github.com/go-kit/kit v0.13.0/go.mod h1:phqEHMMUbyrCFCTgH48JueqrM3md2HcAZ8N3XE4FKDg=
|
||||
@ -186,8 +191,6 @@ github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPh
|
||||
github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
|
||||
github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
|
||||
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
|
||||
github.com/golang/glog v1.2.2 h1:1+mZ9upx1Dh6FmUTFR1naJ77miKiXgALjWOZ3NVFPmY=
|
||||
github.com/golang/glog v1.2.2/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
|
||||
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
|
||||
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
|
||||
github.com/golang/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=
|
||||
@ -203,8 +206,8 @@ github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEW
|
||||
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
|
||||
github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
|
||||
github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
|
||||
github.com/google/cel-go v0.21.0 h1:cl6uW/gxN+Hy50tNYvI691+sXxioCnstFzLp2WO4GCI=
|
||||
github.com/google/cel-go v0.21.0/go.mod h1:rHUlWCcBKgyEk+eV03RPdZUekPp6YcJwV0FxuUksYxc=
|
||||
github.com/google/cel-go v0.24.1 h1:jsBCtxG8mM5wiUJDSGUqU0K7Mtr3w7Eyv00rw4DiZxI=
|
||||
github.com/google/cel-go v0.24.1/go.mod h1:Hdf9TqOaTNSFQA1ybQaRqATVoK7m/zcf7IMhGXP5zI8=
|
||||
github.com/google/certificate-transparency-go v1.0.21/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
|
||||
github.com/google/certificate-transparency-go v1.1.8-0.20240110162603-74a5dd331745 h1:heyoXNxkRT155x4jTAiSv5BVSVkueifPUm+Q8LUXMRo=
|
||||
github.com/google/certificate-transparency-go v1.1.8-0.20240110162603-74a5dd331745/go.mod h1:zN0wUQgV9LjwLZeFHnrAbQi8hzMVvEWePyk+MhPOk7k=
|
||||
@ -302,10 +305,10 @@ github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCV
|
||||
github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
|
||||
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||
github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
|
||||
github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
|
||||
github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
|
||||
github.com/klauspost/cpuid/v2 v2.2.8 h1:+StwCXwm9PdpiEkPyzBXIy+M9KUb4ODm0Zarf1kS5BM=
|
||||
github.com/klauspost/cpuid/v2 v2.2.8/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
|
||||
github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
|
||||
github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
|
||||
github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
|
||||
github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
|
||||
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
|
||||
@ -324,8 +327,8 @@ github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
|
||||
github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
|
||||
github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
|
||||
github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
|
||||
github.com/libdns/libdns v0.2.2 h1:O6ws7bAfRPaBsgAYt8MDe2HcNBGC29hkZ9MX2eUSX3s=
|
||||
github.com/libdns/libdns v0.2.2/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
|
||||
github.com/libdns/libdns v0.2.3 h1:ba30K4ObwMGB/QTmqUxf3H4/GmUrCAIkMWejeGl12v8=
|
||||
github.com/libdns/libdns v0.2.3/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
|
||||
github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
|
||||
github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
|
||||
github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
|
||||
@ -344,11 +347,11 @@ github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
|
||||
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
|
||||
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
|
||||
github.com/mholt/acmez/v2 v2.0.3 h1:CgDBlEwg3QBp6s45tPQmFIBrkRIkBT4rW4orMM6p4sw=
|
||||
github.com/mholt/acmez/v2 v2.0.3/go.mod h1:pQ1ysaDeGrIMvJ9dfJMk5kJNkn7L2sb3UhyrX6Q91cw=
|
||||
github.com/mholt/acmez/v3 v3.1.0 h1:RlOx2SSZ8dIAM5GfkMe8TdaxjjkiHTGorlMUt8GeMzg=
|
||||
github.com/mholt/acmez/v3 v3.1.0/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
|
||||
github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4=
|
||||
github.com/miekg/dns v1.1.62 h1:cN8OuEF1/x5Rq6Np+h1epln8OiyPWV+lROx9LxcGgIQ=
|
||||
github.com/miekg/dns v1.1.62/go.mod h1:mvDlcItzm+br7MToIKqkglaGhlFMHJ9DTNNWONWXbNQ=
|
||||
github.com/miekg/dns v1.1.63 h1:8M5aAw6OMZfFXTT7K5V0Eu5YiiL8l7nUAkyN6C9YwaY=
|
||||
github.com/miekg/dns v1.1.63/go.mod h1:6NGHfjhpmr5lt3XPLuyfDJi5AXbNIPM9PY6H6sF1Nfs=
|
||||
github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
|
||||
github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
|
||||
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
|
||||
@ -366,6 +369,8 @@ github.com/onsi/ginkgo/v2 v2.13.2/go.mod h1:XStQ8QcGwLyF4HdfcZB8SFOS/MWCgDuXMSBe
|
||||
github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
|
||||
github.com/onsi/gomega v1.29.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
|
||||
github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
|
||||
github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 h1:onHthvaw9LFnH4t2DcNVpwGmV9E1BkGknEliJkfwQj0=
|
||||
github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58/go.mod h1:DXv8WO4yhMYhSNPKjeNKa5WY9YCIEBRbNzFFPJbWO6Y=
|
||||
github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
|
||||
github.com/peterbourgon/diskv/v3 v3.0.1 h1:x06SQA46+PKIUftmEujdwSEpIx8kR+M9eLYsUxeYveU=
|
||||
github.com/peterbourgon/diskv/v3 v3.0.1/go.mod h1:kJ5Ny7vLdARGU3WUuy6uzO6T0nb/2gWcT1JiBvRmb5o=
|
||||
@ -392,8 +397,8 @@ github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k
|
||||
github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
|
||||
github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
|
||||
github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
|
||||
github.com/quic-go/quic-go v0.48.2 h1:wsKXZPeGWpMpCGSWqOcqpW2wZYic/8T3aqiOID0/KWE=
|
||||
github.com/quic-go/quic-go v0.48.2/go.mod h1:yBgs3rWBOADpga7F+jJsb6Ybg1LSYiQvwWlLX+/6HMs=
|
||||
github.com/quic-go/quic-go v0.50.0 h1:3H/ld1pa3CYhkcc20TPIyG1bNsdhn9qZBGN3b9/UyUo=
|
||||
github.com/quic-go/quic-go v0.50.0/go.mod h1:Vim6OmUvlYdwBhXP9ZVrtGmCMWa3wEqhq3NgYrI8b4E=
|
||||
github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
|
||||
github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
|
||||
github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
|
||||
@ -468,12 +473,12 @@ github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkU
|
||||
github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
|
||||
github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
|
||||
github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
|
||||
github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
|
||||
github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
|
||||
github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
|
||||
github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
|
||||
github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
|
||||
github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
|
||||
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
|
||||
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
|
||||
github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
|
||||
github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
|
||||
github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
|
||||
github.com/stoewer/go-strcase v1.2.0 h1:Z2iHWqGXH00XYgqDmNgQbIBxf3wrNq0F3feEy0ainaU=
|
||||
github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
|
||||
@ -491,8 +496,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
|
||||
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
|
||||
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
|
||||
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
|
||||
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
|
||||
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
|
||||
github.com/tailscale/tscert v0.0.0-20240608151842-d3f834017e53 h1:uxMgm0C+EjytfAqyfBG55ZONKQ7mvd7x4YYCWsf8QHQ=
|
||||
github.com/tailscale/tscert v0.0.0-20240608151842-d3f834017e53/go.mod h1:kNGUQ3VESx3VZwRwA9MSCUegIl6+saPL8Noq82ozCaU=
|
||||
github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA=
|
||||
@ -564,8 +569,8 @@ go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
|
||||
go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
|
||||
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
|
||||
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
|
||||
go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
|
||||
go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
|
||||
go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
|
||||
go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
|
||||
go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
|
||||
go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
|
||||
go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
|
||||
@ -595,10 +600,10 @@ golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5y
|
||||
golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
||||
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
|
||||
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
|
||||
golang.org/x/crypto v0.30.0 h1:RwoQn3GkWiMkzlX562cLB7OxWvjH1L8xutO2WoJcRoY=
|
||||
golang.org/x/crypto v0.30.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
|
||||
golang.org/x/crypto/x509roots/fallback v0.0.0-20241104001025-71ed71b4faf9 h1:4cEcP5+OjGppY79LCQ5Go2B1Boix2x0v6pvA01P3FoA=
|
||||
golang.org/x/crypto/x509roots/fallback v0.0.0-20241104001025-71ed71b4faf9/go.mod h1:kNa9WdvYnzFwC79zRpLRMJbdEFlhyM5RPFBBZp/wWH8=
|
||||
golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
|
||||
golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
|
||||
golang.org/x/crypto/x509roots/fallback v0.0.0-20250305170421-49bf5b80c810 h1:V5+zy0jmgNYmK1uW/sPpBw8ioFvalrhaUrYWmu1Fpe4=
|
||||
golang.org/x/crypto/x509roots/fallback v0.0.0-20250305170421-49bf5b80c810/go.mod h1:lxN5T34bK4Z/i6cMaU7frUU57VkDXFD4Kamfl/cp9oU=
|
||||
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
|
||||
golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
|
||||
@ -610,8 +615,8 @@ golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKG
|
||||
golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
|
||||
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.18.0 h1:5+9lSbEzPSdWkH32vYPBwEpX8KwDbM52Ud9xBUvNlb0=
|
||||
golang.org/x/mod v0.18.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
|
||||
golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
|
||||
golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
|
||||
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
@ -628,8 +633,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
|
||||
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
|
||||
golang.org/x/net v0.32.0 h1:ZqPmj8Kzc+Y6e0+skZsuACbx+wzMgo5MQsJh9Qd6aYI=
|
||||
golang.org/x/net v0.32.0/go.mod h1:CwU0IoeOlnQQWJ6ioyFrfRuomB8GKF6KbYXZVyeXNfs=
|
||||
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
|
||||
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
|
||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
@ -644,8 +649,8 @@ golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJ
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
|
||||
golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
|
||||
golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
|
||||
golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
|
||||
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
@ -663,7 +668,6 @@ golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7w
|
||||
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
@ -675,16 +679,16 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
|
||||
golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
|
||||
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
|
||||
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
|
||||
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
|
||||
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
|
||||
golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
|
||||
golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
|
||||
golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
|
||||
golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
|
||||
@ -695,12 +699,12 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
|
||||
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
|
||||
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
|
||||
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
|
||||
golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
|
||||
golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
|
||||
golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
|
||||
golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
|
||||
golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
|
||||
golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
|
||||
golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20181030000716-a0a13e073c7b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
@ -716,8 +720,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
|
||||
golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
|
||||
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
|
||||
golang.org/x/tools v0.22.0 h1:gqSGLZqv+AI9lIQzniJ0nZDRG5GBPsSi+DRNHWNz6yA=
|
||||
golang.org/x/tools v0.22.0/go.mod h1:aCwcsjqvq7Yqt6TNyX7QMU2enbQ/Gt0bo6krSeEri+c=
|
||||
golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
|
||||
golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
|
||||
golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
|
||||
@ -139,7 +139,7 @@ func (na NetworkAddress) Listen(ctx context.Context, portOffset uint, config net
|
||||
}
|
||||
|
||||
// check to see if plugin provides listener
|
||||
if ln, err := getListenerFromPlugin(ctx, na.Network, na.JoinHostPort(portOffset), config); ln != nil || err != nil {
|
||||
if ln, err := getListenerFromPlugin(ctx, na.Network, na.Host, na.port(), portOffset, config); ln != nil || err != nil {
|
||||
return ln, err
|
||||
}
|
||||
|
||||
@ -658,11 +658,11 @@ var unixSocketsMu sync.Mutex
|
||||
// getListenerFromPlugin returns a listener on the given network and address
|
||||
// if a plugin has registered the network name. It may return (nil, nil) if
|
||||
// no plugin can provide a listener.
|
||||
func getListenerFromPlugin(ctx context.Context, network, addr string, config net.ListenConfig) (any, error) {
|
||||
func getListenerFromPlugin(ctx context.Context, network, host, port string, portOffset uint, config net.ListenConfig) (any, error) {
|
||||
// get listener from plugin if network type is registered
|
||||
if getListener, ok := networkTypes[network]; ok {
|
||||
Log().Debug("getting listener from plugin", zap.String("network", network))
|
||||
return getListener(ctx, network, addr, config)
|
||||
return getListener(ctx, network, host, port, portOffset, config)
|
||||
}
|
||||
|
||||
return nil, nil
|
||||
@ -676,7 +676,7 @@ func listenerKey(network, addr string) string {
|
||||
// The listeners must be capable of overlapping: with Caddy, new configs are loaded
|
||||
// before old ones are unloaded, so listeners may overlap briefly if the configs
|
||||
// both need the same listener. EXPERIMENTAL and subject to change.
|
||||
type ListenerFunc func(ctx context.Context, network, addr string, cfg net.ListenConfig) (any, error)
|
||||
type ListenerFunc func(ctx context.Context, network, host, portRange string, portOffset uint, cfg net.ListenConfig) (any, error)
|
||||
|
||||
var networkTypes = map[string]ListenerFunc{}
|
||||
|
||||
|
||||
@ -207,7 +207,7 @@ func (app *App) Provision(ctx caddy.Context) error {
|
||||
|
||||
if srv.Metrics != nil {
|
||||
srv.logger.Warn("per-server 'metrics' is deprecated; use 'metrics' in the root 'http' app instead")
|
||||
app.Metrics = cmp.Or[*Metrics](app.Metrics, &Metrics{
|
||||
app.Metrics = cmp.Or(app.Metrics, &Metrics{
|
||||
init: sync.Once{},
|
||||
httpMetrics: &httpMetrics{},
|
||||
})
|
||||
@ -529,21 +529,6 @@ func (app *App) Start() error {
|
||||
// enable TLS if there is a policy and if this is not the HTTP port
|
||||
useTLS := len(srv.TLSConnPolicies) > 0 && int(listenAddr.StartPort+portOffset) != app.httpPort()
|
||||
|
||||
// enable HTTP/3 if configured
|
||||
if h3ok && useTLS {
|
||||
app.logger.Info("enabling HTTP/3 listener", zap.String("addr", hostport))
|
||||
if err := srv.serveHTTP3(listenAddr.At(portOffset), tlsCfg); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if h3ok && !useTLS {
|
||||
// Can only serve h3 with TLS enabled
|
||||
app.logger.Warn("HTTP/3 skipped because it requires TLS",
|
||||
zap.String("network", listenAddr.Network),
|
||||
zap.String("addr", hostport))
|
||||
}
|
||||
|
||||
if h1ok || h2ok && useTLS || h2cok {
|
||||
// create the listener for this socket
|
||||
lnAny, err := listenAddr.Listen(app.ctx, portOffset, net.ListenConfig{KeepAlive: time.Duration(srv.KeepAliveInterval)})
|
||||
@ -614,6 +599,33 @@ func (app *App) Start() error {
|
||||
zap.String("network", listenAddr.Network),
|
||||
zap.String("addr", hostport))
|
||||
}
|
||||
|
||||
if h3ok {
|
||||
// Can't serve HTTP/3 on the same socket as HTTP/1 and 2 because it uses
|
||||
// a different transport mechanism... which is fine, but the OS doesn't
|
||||
// differentiate between a SOCK_STREAM file and a SOCK_DGRAM file; they
|
||||
// are still one file on the system. So even though "unixpacket" and
|
||||
// "unixgram" are different network types just as "tcp" and "udp" are,
|
||||
// the OS will not let us use the same file as both STREAM and DGRAM.
|
||||
if listenAddr.IsUnixNetwork() {
|
||||
app.logger.Warn("HTTP/3 disabled because Unix can't multiplex STREAM and DGRAM on same socket",
|
||||
zap.String("file", hostport))
|
||||
continue
|
||||
}
|
||||
|
||||
if useTLS {
|
||||
// enable HTTP/3 if configured
|
||||
app.logger.Info("enabling HTTP/3 listener", zap.String("addr", hostport))
|
||||
if err := srv.serveHTTP3(listenAddr.At(portOffset), tlsCfg); err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
// Can only serve h3 with TLS enabled
|
||||
app.logger.Warn("HTTP/3 skipped because it requires TLS",
|
||||
zap.String("network", listenAddr.Network),
|
||||
zap.String("addr", hostport))
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@ -205,6 +205,7 @@ func (app *App) automaticHTTPSPhase1(ctx caddy.Context, repl *caddy.Replacer) er
|
||||
// for all the hostnames we found, filter them so we have
|
||||
// a deduplicated list of names for which to obtain certs
|
||||
// (only if cert management not disabled for this server)
|
||||
var echDomains []string
|
||||
if srv.AutoHTTPS.DisableCerts {
|
||||
logger.Warn("skipping automated certificate management for server because it is disabled", zap.String("server_name", srvName))
|
||||
} else {
|
||||
@ -231,10 +232,14 @@ func (app *App) automaticHTTPSPhase1(ctx caddy.Context, repl *caddy.Replacer) er
|
||||
}
|
||||
|
||||
uniqueDomainsForCerts[d] = struct{}{}
|
||||
echDomains = append(echDomains, d)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// let the TLS server know we have some hostnames that could be protected behind ECH
|
||||
app.tlsApp.RegisterServerNames(echDomains)
|
||||
|
||||
// tell the server to use TLS if it is not already doing so
|
||||
if srv.TLSConnPolicies == nil {
|
||||
srv.TLSConnPolicies = caddytls.ConnectionPolicies{new(caddytls.ConnectionPolicy)}
|
||||
|
||||
@ -57,21 +57,7 @@ func (enc *Encode) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
d.Next() // consume directive name
|
||||
|
||||
prefer := []string{}
|
||||
for _, arg := range d.RemainingArgs() {
|
||||
mod, err := caddy.GetModule("http.encoders." + arg)
|
||||
if err != nil {
|
||||
return d.Errf("finding encoder module '%s': %v", mod, err)
|
||||
}
|
||||
encoding, ok := mod.New().(Encoding)
|
||||
if !ok {
|
||||
return d.Errf("module %s is not an HTTP encoding", mod)
|
||||
}
|
||||
if enc.EncodingsRaw == nil {
|
||||
enc.EncodingsRaw = make(caddy.ModuleMap)
|
||||
}
|
||||
enc.EncodingsRaw[arg] = caddyconfig.JSON(encoding, nil)
|
||||
prefer = append(prefer, arg)
|
||||
}
|
||||
remainingArgs := d.RemainingArgs()
|
||||
|
||||
responseMatchers := make(map[string]caddyhttp.ResponseMatcher)
|
||||
for d.NextBlock(0) {
|
||||
@ -111,6 +97,26 @@ func (enc *Encode) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
}
|
||||
}
|
||||
|
||||
if len(prefer) == 0 && len(remainingArgs) == 0 {
|
||||
remainingArgs = []string{"zstd", "gzip"}
|
||||
}
|
||||
|
||||
for _, arg := range remainingArgs {
|
||||
mod, err := caddy.GetModule("http.encoders." + arg)
|
||||
if err != nil {
|
||||
return d.Errf("finding encoder module '%s': %v", mod, err)
|
||||
}
|
||||
encoding, ok := mod.New().(Encoding)
|
||||
if !ok {
|
||||
return d.Errf("module %s is not an HTTP encoding", mod)
|
||||
}
|
||||
if enc.EncodingsRaw == nil {
|
||||
enc.EncodingsRaw = make(caddy.ModuleMap)
|
||||
}
|
||||
enc.EncodingsRaw[arg] = caddyconfig.JSON(encoding, nil)
|
||||
prefer = append(prefer, arg)
|
||||
}
|
||||
|
||||
// use the order in which the encoders were defined.
|
||||
enc.Prefer = prefer
|
||||
|
||||
|
||||
@ -156,7 +156,7 @@ func (enc *Encode) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyh
|
||||
if _, ok := enc.writerPools[encName]; !ok {
|
||||
continue // encoding not offered
|
||||
}
|
||||
w = enc.openResponseWriter(encName, w)
|
||||
w = enc.openResponseWriter(encName, w, r.Method == http.MethodConnect)
|
||||
defer w.(*responseWriter).Close()
|
||||
|
||||
// to comply with RFC 9110 section 8.8.3(.3), we modify the Etag when encoding
|
||||
@ -201,14 +201,14 @@ func (enc *Encode) addEncoding(e Encoding) error {
|
||||
// openResponseWriter creates a new response writer that may (or may not)
|
||||
// encode the response with encodingName. The returned response writer MUST
|
||||
// be closed after the handler completes.
|
||||
func (enc *Encode) openResponseWriter(encodingName string, w http.ResponseWriter) *responseWriter {
|
||||
func (enc *Encode) openResponseWriter(encodingName string, w http.ResponseWriter, isConnect bool) *responseWriter {
|
||||
var rw responseWriter
|
||||
return enc.initResponseWriter(&rw, encodingName, w)
|
||||
return enc.initResponseWriter(&rw, encodingName, w, isConnect)
|
||||
}
|
||||
|
||||
// initResponseWriter initializes the responseWriter instance
|
||||
// allocated in openResponseWriter, enabling mid-stack inlining.
|
||||
func (enc *Encode) initResponseWriter(rw *responseWriter, encodingName string, wrappedRW http.ResponseWriter) *responseWriter {
|
||||
func (enc *Encode) initResponseWriter(rw *responseWriter, encodingName string, wrappedRW http.ResponseWriter, isConnect bool) *responseWriter {
|
||||
if rww, ok := wrappedRW.(*caddyhttp.ResponseWriterWrapper); ok {
|
||||
rw.ResponseWriter = rww
|
||||
} else {
|
||||
@ -216,6 +216,7 @@ func (enc *Encode) initResponseWriter(rw *responseWriter, encodingName string, w
|
||||
}
|
||||
rw.encodingName = encodingName
|
||||
rw.config = enc
|
||||
rw.isConnect = isConnect
|
||||
|
||||
return rw
|
||||
}
|
||||
@ -230,6 +231,7 @@ type responseWriter struct {
|
||||
config *Encode
|
||||
statusCode int
|
||||
wroteHeader bool
|
||||
isConnect bool
|
||||
}
|
||||
|
||||
// WriteHeader stores the status to write when the time comes
|
||||
@ -245,6 +247,14 @@ func (rw *responseWriter) WriteHeader(status int) {
|
||||
rw.Header().Add("Vary", "Accept-Encoding")
|
||||
}
|
||||
|
||||
// write status immediately if status is 2xx and the request is CONNECT
|
||||
// since it means the response is successful.
|
||||
// see: https://github.com/caddyserver/caddy/issues/6733#issuecomment-2525058845
|
||||
if rw.isConnect && 200 <= status && status <= 299 {
|
||||
rw.ResponseWriter.WriteHeader(status)
|
||||
rw.wroteHeader = true
|
||||
}
|
||||
|
||||
// write status immediately when status code is informational
|
||||
// see: https://caddy.community/t/disappear-103-early-hints-response-with-encode-enable-caddy-v2-7-6/23081/5
|
||||
if 100 <= status && status <= 199 {
|
||||
@ -260,6 +270,12 @@ func (enc *Encode) Match(rw *responseWriter) bool {
|
||||
// FlushError is an alternative Flush returning an error. It delays the actual Flush of the underlying
|
||||
// ResponseWriterWrapper until headers were written.
|
||||
func (rw *responseWriter) FlushError() error {
|
||||
// WriteHeader wasn't called and is a CONNECT request, treat it as a success.
|
||||
// otherwise, wait until header is written.
|
||||
if rw.isConnect && !rw.wroteHeader && rw.statusCode == 0 {
|
||||
rw.WriteHeader(http.StatusOK)
|
||||
}
|
||||
|
||||
if !rw.wroteHeader {
|
||||
// flushing the underlying ResponseWriter will write header and status code,
|
||||
// but we need to delay that until we can determine if we must encode and
|
||||
@ -288,6 +304,12 @@ func (rw *responseWriter) Write(p []byte) (int, error) {
|
||||
return 0, nil
|
||||
}
|
||||
|
||||
// WriteHeader wasn't called and is a CONNECT request, treat it as a success.
|
||||
// otherwise, determine if the response should be compressed.
|
||||
if rw.isConnect && !rw.wroteHeader && rw.statusCode == 0 {
|
||||
rw.WriteHeader(http.StatusOK)
|
||||
}
|
||||
|
||||
// sniff content-type and determine content-length
|
||||
if !rw.wroteHeader && rw.config.MinLength > 0 {
|
||||
var gtMinLength bool
|
||||
@ -325,6 +347,49 @@ func (rw *responseWriter) Write(p []byte) (int, error) {
|
||||
}
|
||||
}
|
||||
|
||||
// used to mask ReadFrom method
|
||||
type writerOnly struct {
|
||||
io.Writer
|
||||
}
|
||||
|
||||
// copied from stdlib
|
||||
const sniffLen = 512
|
||||
|
||||
// ReadFrom will try to use sendfile to copy from the reader to the response writer.
|
||||
// It's only used if the response writer implements io.ReaderFrom and the data can't be compressed.
|
||||
// It's based on stdlin http1.1 response writer implementation.
|
||||
// https://github.com/golang/go/blob/f4e3ec3dbe3b8e04a058d266adf8e048bab563f2/src/net/http/server.go#L586
|
||||
func (rw *responseWriter) ReadFrom(r io.Reader) (int64, error) {
|
||||
rf, ok := rw.ResponseWriter.(io.ReaderFrom)
|
||||
// sendfile can't be used anyway
|
||||
if !ok {
|
||||
// mask ReadFrom to avoid infinite recursion
|
||||
return io.Copy(writerOnly{rw}, r)
|
||||
}
|
||||
|
||||
var ns int64
|
||||
// try to sniff the content type and determine if the response should be compressed
|
||||
if !rw.wroteHeader && rw.config.MinLength > 0 {
|
||||
var (
|
||||
err error
|
||||
buf [sniffLen]byte
|
||||
)
|
||||
// mask ReadFrom to let Write determine if the response should be compressed
|
||||
ns, err = io.CopyBuffer(writerOnly{rw}, io.LimitReader(r, sniffLen), buf[:])
|
||||
if err != nil || ns < sniffLen {
|
||||
return ns, err
|
||||
}
|
||||
}
|
||||
|
||||
// the response will be compressed, no sendfile support
|
||||
if rw.w != nil {
|
||||
nr, err := io.Copy(rw.w, r)
|
||||
return nr + ns, err
|
||||
}
|
||||
nr, err := rf.ReadFrom(r)
|
||||
return nr + ns, err
|
||||
}
|
||||
|
||||
// Close writes any remaining buffered response and
|
||||
// deallocates any active resources.
|
||||
func (rw *responseWriter) Close() error {
|
||||
|
||||
@ -9,7 +9,7 @@ import (
|
||||
func BenchmarkOpenResponseWriter(b *testing.B) {
|
||||
enc := new(Encode)
|
||||
for n := 0; n < b.N; n++ {
|
||||
enc.openResponseWriter("test", nil)
|
||||
enc.openResponseWriter("test", nil, false)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@ -130,9 +130,9 @@ func (fsrv *FileServer) serveBrowse(fileSystem fs.FS, root, dirPath string, w ht
|
||||
|
||||
// speed up browser/client experience and caching by supporting If-Modified-Since
|
||||
if ifModSinceStr := r.Header.Get("If-Modified-Since"); ifModSinceStr != "" {
|
||||
ifModSince, err := time.ParseInLocation(http.TimeFormat, ifModSinceStr, time.Local)
|
||||
lastModTrunc := listing.lastModified.Truncate(time.Second)
|
||||
if err == nil && (lastModTrunc.Equal(ifModSince) || lastModTrunc.Before(ifModSince)) {
|
||||
// basically a copy of stdlib file server's handling of If-Modified-Since
|
||||
ifModSince, err := http.ParseTime(ifModSinceStr)
|
||||
if err == nil && listing.lastModified.Truncate(time.Second).Compare(ifModSince) <= 0 {
|
||||
w.WriteHeader(http.StatusNotModified)
|
||||
return nil
|
||||
}
|
||||
@ -213,6 +213,11 @@ func (fsrv *FileServer) serveBrowse(fileSystem fs.FS, root, dirPath string, w ht
|
||||
}
|
||||
|
||||
func (fsrv *FileServer) loadDirectoryContents(ctx context.Context, fileSystem fs.FS, dir fs.ReadDirFile, root, urlPath string, repl *caddy.Replacer) (*browseTemplateContext, error) {
|
||||
// modTime for the directory itself
|
||||
stat, err := dir.Stat()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
dirLimit := defaultDirEntryLimit
|
||||
if fsrv.Browse.FileLimit != 0 {
|
||||
dirLimit = fsrv.Browse.FileLimit
|
||||
@ -225,7 +230,7 @@ func (fsrv *FileServer) loadDirectoryContents(ctx context.Context, fileSystem fs
|
||||
// user can presumably browse "up" to parent folder if path is longer than "/"
|
||||
canGoUp := len(urlPath) > 1
|
||||
|
||||
return fsrv.directoryListing(ctx, fileSystem, files, canGoUp, root, urlPath, repl), nil
|
||||
return fsrv.directoryListing(ctx, fileSystem, stat.ModTime(), files, canGoUp, root, urlPath, repl), nil
|
||||
}
|
||||
|
||||
// browseApplyQueryParams applies query parameters to the listing.
|
||||
|
||||
@ -35,15 +35,16 @@ import (
|
||||
"github.com/caddyserver/caddy/v2/modules/caddyhttp"
|
||||
)
|
||||
|
||||
func (fsrv *FileServer) directoryListing(ctx context.Context, fileSystem fs.FS, entries []fs.DirEntry, canGoUp bool, root, urlPath string, repl *caddy.Replacer) *browseTemplateContext {
|
||||
func (fsrv *FileServer) directoryListing(ctx context.Context, fileSystem fs.FS, parentModTime time.Time, entries []fs.DirEntry, canGoUp bool, root, urlPath string, repl *caddy.Replacer) *browseTemplateContext {
|
||||
filesToHide := fsrv.transformHidePaths(repl)
|
||||
|
||||
name, _ := url.PathUnescape(urlPath)
|
||||
|
||||
tplCtx := &browseTemplateContext{
|
||||
Name: path.Base(name),
|
||||
Path: urlPath,
|
||||
CanGoUp: canGoUp,
|
||||
Name: path.Base(name),
|
||||
Path: urlPath,
|
||||
CanGoUp: canGoUp,
|
||||
lastModified: parentModTime,
|
||||
}
|
||||
|
||||
for _, entry := range entries {
|
||||
@ -131,6 +132,10 @@ func (fsrv *FileServer) directoryListing(ctx context.Context, fileSystem fs.FS,
|
||||
})
|
||||
}
|
||||
|
||||
// this time is used for the Last-Modified header and comparing If-Modified-Since from client
|
||||
// both are expected to be in UTC, so we convert to UTC here
|
||||
// see: https://github.com/caddyserver/caddy/issues/6828
|
||||
tplCtx.lastModified = tplCtx.lastModified.UTC()
|
||||
return tplCtx
|
||||
}
|
||||
|
||||
|
||||
@ -146,9 +146,13 @@ func (fsrv *FileServer) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
}
|
||||
|
||||
case "precompressed":
|
||||
var order []string
|
||||
for d.NextArg() {
|
||||
modID := "http.precompressed." + d.Val()
|
||||
fsrv.PrecompressedOrder = d.RemainingArgs()
|
||||
if len(fsrv.PrecompressedOrder) == 0 {
|
||||
fsrv.PrecompressedOrder = []string{"br", "zstd", "gzip"}
|
||||
}
|
||||
|
||||
for _, format := range fsrv.PrecompressedOrder {
|
||||
modID := "http.precompressed." + format
|
||||
mod, err := caddy.GetModule(modID)
|
||||
if err != nil {
|
||||
return d.Errf("getting module named '%s': %v", modID, err)
|
||||
@ -161,10 +165,8 @@ func (fsrv *FileServer) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
if fsrv.PrecompressedRaw == nil {
|
||||
fsrv.PrecompressedRaw = make(caddy.ModuleMap)
|
||||
}
|
||||
fsrv.PrecompressedRaw[d.Val()] = caddyconfig.JSON(precompress, nil)
|
||||
order = append(order, d.Val())
|
||||
fsrv.PrecompressedRaw[format] = caddyconfig.JSON(precompress, nil)
|
||||
}
|
||||
fsrv.PrecompressedOrder = order
|
||||
|
||||
case "status":
|
||||
if !d.NextArg() {
|
||||
|
||||
@ -99,6 +99,16 @@ func parseCaddyfile(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error)
|
||||
handler.Response.Deferred = true
|
||||
continue
|
||||
}
|
||||
if field == "match" {
|
||||
responseMatchers := make(map[string]caddyhttp.ResponseMatcher)
|
||||
err := caddyhttp.ParseNamedResponseMatcher(h.NewFromNextSegment(), responseMatchers)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
matcher := responseMatchers["match"]
|
||||
handler.Response.Require = &matcher
|
||||
continue
|
||||
}
|
||||
if hasArgs {
|
||||
return nil, h.Err("cannot specify headers in both arguments and block") // because it would be weird
|
||||
}
|
||||
|
||||
@ -78,7 +78,7 @@ func (h Handler) Validate() error {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if h.Response != nil {
|
||||
if h.Response != nil && h.Response.HeaderOps != nil {
|
||||
err := h.Response.validate()
|
||||
if err != nil {
|
||||
return err
|
||||
@ -133,6 +133,9 @@ type HeaderOps struct {
|
||||
|
||||
// Provision sets up the header operations.
|
||||
func (ops *HeaderOps) Provision(_ caddy.Context) error {
|
||||
if ops == nil {
|
||||
return nil // it's possible no ops are configured; fix #6893
|
||||
}
|
||||
for fieldName, replacements := range ops.Replace {
|
||||
for i, r := range replacements {
|
||||
if r.SearchRegexp == "" {
|
||||
|
||||
@ -143,6 +143,28 @@ func TestHandler(t *testing.T) {
|
||||
"Cache-Control": []string{"no-cache"},
|
||||
},
|
||||
},
|
||||
{ // same as above, but checks that response headers are left alone when "Require" conditions are unmet
|
||||
handler: Handler{
|
||||
Response: &RespHeaderOps{
|
||||
Require: &caddyhttp.ResponseMatcher{
|
||||
Headers: http.Header{
|
||||
"Cache-Control": nil,
|
||||
},
|
||||
},
|
||||
HeaderOps: &HeaderOps{
|
||||
Add: http.Header{
|
||||
"Cache-Control": []string{"no-cache"},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
respHeader: http.Header{
|
||||
"Cache-Control": []string{"something"},
|
||||
},
|
||||
expectedRespHeader: http.Header{
|
||||
"Cache-Control": []string{"something"},
|
||||
},
|
||||
},
|
||||
{
|
||||
handler: Handler{
|
||||
Response: &RespHeaderOps{
|
||||
|
||||
@ -211,6 +211,11 @@ func errLogValues(err error) (status int, msg string, fields func() []zapcore.Fi
|
||||
}
|
||||
return
|
||||
}
|
||||
fields = func() []zapcore.Field {
|
||||
return []zapcore.Field{
|
||||
zap.Error(err),
|
||||
}
|
||||
}
|
||||
status = http.StatusInternalServerError
|
||||
msg = err.Error()
|
||||
return
|
||||
|
||||
@ -51,6 +51,9 @@ func (r LoggableHTTPRequest) MarshalLogObject(enc zapcore.ObjectEncoder) error {
|
||||
Header: r.Header,
|
||||
ShouldLogCredentials: r.ShouldLogCredentials,
|
||||
})
|
||||
if r.TransferEncoding != nil {
|
||||
enc.AddArray("transfer_encoding", LoggableStringArray(r.TransferEncoding))
|
||||
}
|
||||
if r.TLS != nil {
|
||||
enc.AddObject("tls", LoggableTLSConnState(*r.TLS))
|
||||
}
|
||||
|
||||
@ -978,7 +978,7 @@ func (m MatchHeader) Match(r *http.Request) bool {
|
||||
// MatchWithError returns true if r matches m.
|
||||
func (m MatchHeader) MatchWithError(r *http.Request) (bool, error) {
|
||||
repl := r.Context().Value(caddy.ReplacerCtxKey).(*caddy.Replacer)
|
||||
return matchHeaders(r.Header, http.Header(m), r.Host, repl), nil
|
||||
return matchHeaders(r.Header, http.Header(m), r.Host, r.TransferEncoding, repl), nil
|
||||
}
|
||||
|
||||
// CELLibrary produces options that expose this matcher for use in CEL
|
||||
@ -1004,22 +1004,26 @@ func (MatchHeader) CELLibrary(_ caddy.Context) (cel.Library, error) {
|
||||
}
|
||||
|
||||
// getHeaderFieldVals returns the field values for the given fieldName from input.
|
||||
// The host parameter should be obtained from the http.Request.Host field since
|
||||
// net/http removes it from the header map.
|
||||
func getHeaderFieldVals(input http.Header, fieldName, host string) []string {
|
||||
// The host parameter should be obtained from the http.Request.Host field, and the
|
||||
// transferEncoding from http.Request.TransferEncoding, since net/http removes them
|
||||
// from the header map.
|
||||
func getHeaderFieldVals(input http.Header, fieldName, host string, transferEncoding []string) []string {
|
||||
fieldName = textproto.CanonicalMIMEHeaderKey(fieldName)
|
||||
if fieldName == "Host" && host != "" {
|
||||
return []string{host}
|
||||
}
|
||||
if fieldName == "Transfer-Encoding" && input[fieldName] == nil {
|
||||
return transferEncoding
|
||||
}
|
||||
return input[fieldName]
|
||||
}
|
||||
|
||||
// matchHeaders returns true if input matches the criteria in against without regex.
|
||||
// The host parameter should be obtained from the http.Request.Host field since
|
||||
// net/http removes it from the header map.
|
||||
func matchHeaders(input, against http.Header, host string, repl *caddy.Replacer) bool {
|
||||
func matchHeaders(input, against http.Header, host string, transferEncoding []string, repl *caddy.Replacer) bool {
|
||||
for field, allowedFieldVals := range against {
|
||||
actualFieldVals := getHeaderFieldVals(input, field, host)
|
||||
actualFieldVals := getHeaderFieldVals(input, field, host, transferEncoding)
|
||||
if allowedFieldVals != nil && len(allowedFieldVals) == 0 && actualFieldVals != nil {
|
||||
// a non-nil but empty list of allowed values means
|
||||
// match if the header field exists at all
|
||||
@ -1119,7 +1123,7 @@ func (m MatchHeaderRE) Match(r *http.Request) bool {
|
||||
// MatchWithError returns true if r matches m.
|
||||
func (m MatchHeaderRE) MatchWithError(r *http.Request) (bool, error) {
|
||||
for field, rm := range m {
|
||||
actualFieldVals := getHeaderFieldVals(r.Header, field, r.Host)
|
||||
actualFieldVals := getHeaderFieldVals(r.Header, field, r.Host, r.TransferEncoding)
|
||||
match := false
|
||||
fieldVal:
|
||||
for _, actualFieldVal := range actualFieldVals {
|
||||
@ -1338,6 +1342,8 @@ func (m *MatchTLS) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
case "early_data":
|
||||
var false bool
|
||||
m.HandshakeComplete = &false
|
||||
default:
|
||||
return d.Errf("unrecognized option '%s'", d.Val())
|
||||
}
|
||||
}
|
||||
if d.NextArg() {
|
||||
|
||||
@ -41,7 +41,7 @@ func (rm ResponseMatcher) Match(statusCode int, hdr http.Header) bool {
|
||||
if !rm.matchStatusCode(statusCode) {
|
||||
return false
|
||||
}
|
||||
return matchHeaders(hdr, rm.Headers, "", nil)
|
||||
return matchHeaders(hdr, rm.Headers, "", []string{}, nil)
|
||||
}
|
||||
|
||||
func (rm ResponseMatcher) matchStatusCode(statusCode int) bool {
|
||||
|
||||
@ -154,16 +154,16 @@ func (rr *responseRecorder) WriteHeader(statusCode int) {
|
||||
// connections by manually setting headers and writing status 101
|
||||
rr.statusCode = statusCode
|
||||
|
||||
// decide whether we should buffer the response
|
||||
if rr.shouldBuffer == nil {
|
||||
rr.stream = true
|
||||
} else {
|
||||
rr.stream = !rr.shouldBuffer(rr.statusCode, rr.ResponseWriterWrapper.Header())
|
||||
}
|
||||
|
||||
// 1xx responses aren't final; just informational
|
||||
if statusCode < 100 || statusCode > 199 {
|
||||
rr.wroteHeader = true
|
||||
|
||||
// decide whether we should buffer the response
|
||||
if rr.shouldBuffer == nil {
|
||||
rr.stream = true
|
||||
} else {
|
||||
rr.stream = !rr.shouldBuffer(rr.statusCode, rr.ResponseWriterWrapper.Header())
|
||||
}
|
||||
}
|
||||
|
||||
// if informational or not buffered, immediately write header
|
||||
|
||||
84
modules/caddyhttp/reverseproxy/buffering_test.go
Normal file
84
modules/caddyhttp/reverseproxy/buffering_test.go
Normal file
@ -0,0 +1,84 @@
|
||||
package reverseproxy
|
||||
|
||||
import (
|
||||
"io"
|
||||
"testing"
|
||||
)
|
||||
|
||||
type zeroReader struct{}
|
||||
|
||||
func (zeroReader) Read(p []byte) (int, error) {
|
||||
for i := range p {
|
||||
p[i] = 0
|
||||
}
|
||||
return len(p), nil
|
||||
}
|
||||
|
||||
func TestBuffering(t *testing.T) {
|
||||
var (
|
||||
h Handler
|
||||
zr zeroReader
|
||||
)
|
||||
type args struct {
|
||||
body io.ReadCloser
|
||||
limit int64
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
args args
|
||||
resultCheck func(io.ReadCloser, int64, args) bool
|
||||
}{
|
||||
{
|
||||
name: "0 limit, body is returned as is",
|
||||
args: args{
|
||||
body: io.NopCloser(&zr),
|
||||
limit: 0,
|
||||
},
|
||||
resultCheck: func(res io.ReadCloser, read int64, args args) bool {
|
||||
return res == args.body && read == args.limit && read == 0
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "negative limit, body is read completely",
|
||||
args: args{
|
||||
body: io.NopCloser(io.LimitReader(&zr, 100)),
|
||||
limit: -1,
|
||||
},
|
||||
resultCheck: func(res io.ReadCloser, read int64, args args) bool {
|
||||
brc, ok := res.(bodyReadCloser)
|
||||
return ok && brc.body == nil && brc.buf.Len() == 100 && read == 100
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "positive limit, body is read partially",
|
||||
args: args{
|
||||
body: io.NopCloser(io.LimitReader(&zr, 100)),
|
||||
limit: 50,
|
||||
},
|
||||
resultCheck: func(res io.ReadCloser, read int64, args args) bool {
|
||||
brc, ok := res.(bodyReadCloser)
|
||||
return ok && brc.body != nil && brc.buf.Len() == 50 && read == 50
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "positive limit, body is read completely",
|
||||
args: args{
|
||||
body: io.NopCloser(io.LimitReader(&zr, 100)),
|
||||
limit: 101,
|
||||
},
|
||||
resultCheck: func(res io.ReadCloser, read int64, args args) bool {
|
||||
brc, ok := res.(bodyReadCloser)
|
||||
return ok && brc.body == nil && brc.buf.Len() == 100 && read == 100
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
res, read := h.bufferedBody(tt.args.body, tt.args.limit)
|
||||
if !tt.resultCheck(res, read, tt.args) {
|
||||
t.Error("Handler.bufferedBody() test failed")
|
||||
return
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@ -131,15 +131,18 @@ func (t *Transport) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
// is equivalent to a route consisting of:
|
||||
//
|
||||
// # Add trailing slash for directory requests
|
||||
// # This redirection is automatically disabled if "{http.request.uri.path}/index.php"
|
||||
// # doesn't appear in the try_files list
|
||||
// @canonicalPath {
|
||||
// file {path}/index.php
|
||||
// not path */
|
||||
// }
|
||||
// redir @canonicalPath {path}/ 308
|
||||
//
|
||||
// # If the requested file does not exist, try index files
|
||||
// # If the requested file does not exist, try index files and assume index.php always exists
|
||||
// @indexFiles file {
|
||||
// try_files {path} {path}/index.php index.php
|
||||
// try_policy first_exist_fallback
|
||||
// split_path .php
|
||||
// }
|
||||
// rewrite @indexFiles {http.matchers.file.relative}
|
||||
|
||||
@ -41,6 +41,8 @@ import (
|
||||
|
||||
"go.uber.org/zap"
|
||||
"go.uber.org/zap/zapcore"
|
||||
|
||||
"github.com/caddyserver/caddy/v2/modules/caddyhttp"
|
||||
)
|
||||
|
||||
// FCGIListenSockFileno describes listen socket file number.
|
||||
@ -136,6 +138,15 @@ type client struct {
|
||||
// Do made the request and returns a io.Reader that translates the data read
|
||||
// from fcgi responder out of fcgi packet before returning it.
|
||||
func (c *client) Do(p map[string]string, req io.Reader) (r io.Reader, err error) {
|
||||
// check for CONTENT_LENGTH, since the lack of it or wrong value will cause the backend to hang
|
||||
if clStr, ok := p["CONTENT_LENGTH"]; !ok {
|
||||
return nil, caddyhttp.Error(http.StatusLengthRequired, nil)
|
||||
} else if _, err := strconv.ParseUint(clStr, 10, 64); err != nil {
|
||||
// stdlib won't return a negative Content-Length, but we check just in case,
|
||||
// the most likely cause is from a missing content length, which is -1
|
||||
return nil, caddyhttp.Error(http.StatusLengthRequired, err)
|
||||
}
|
||||
|
||||
writer := &streamWriter{c: c}
|
||||
writer.buf = bufPool.Get().(*bytes.Buffer)
|
||||
writer.buf.Reset()
|
||||
|
||||
@ -1,32 +1,47 @@
|
||||
package reverseproxy
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"runtime/debug"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/prometheus/client_golang/prometheus"
|
||||
"github.com/prometheus/client_golang/prometheus/promauto"
|
||||
"go.uber.org/zap"
|
||||
"go.uber.org/zap/zapcore"
|
||||
|
||||
"github.com/caddyserver/caddy/v2"
|
||||
)
|
||||
|
||||
var reverseProxyMetrics = struct {
|
||||
init sync.Once
|
||||
once sync.Once
|
||||
upstreamsHealthy *prometheus.GaugeVec
|
||||
logger *zap.Logger
|
||||
}{}
|
||||
|
||||
func initReverseProxyMetrics(handler *Handler) {
|
||||
func initReverseProxyMetrics(handler *Handler, registry *prometheus.Registry) {
|
||||
const ns, sub = "caddy", "reverse_proxy"
|
||||
|
||||
upstreamsLabels := []string{"upstream"}
|
||||
reverseProxyMetrics.upstreamsHealthy = promauto.NewGaugeVec(prometheus.GaugeOpts{
|
||||
Namespace: ns,
|
||||
Subsystem: sub,
|
||||
Name: "upstreams_healthy",
|
||||
Help: "Health status of reverse proxy upstreams.",
|
||||
}, upstreamsLabels)
|
||||
reverseProxyMetrics.once.Do(func() {
|
||||
reverseProxyMetrics.upstreamsHealthy = prometheus.NewGaugeVec(prometheus.GaugeOpts{
|
||||
Namespace: ns,
|
||||
Subsystem: sub,
|
||||
Name: "upstreams_healthy",
|
||||
Help: "Health status of reverse proxy upstreams.",
|
||||
}, upstreamsLabels)
|
||||
})
|
||||
|
||||
// duplicate registration could happen if multiple sites with reverse proxy are configured; so ignore the error because
|
||||
// there's no good way to capture having multiple sites with reverse proxy. If this happens, the metrics will be
|
||||
// registered twice, but the second registration will be ignored.
|
||||
if err := registry.Register(reverseProxyMetrics.upstreamsHealthy); err != nil &&
|
||||
!errors.Is(err, prometheus.AlreadyRegisteredError{
|
||||
ExistingCollector: reverseProxyMetrics.upstreamsHealthy,
|
||||
NewCollector: reverseProxyMetrics.upstreamsHealthy,
|
||||
}) {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
reverseProxyMetrics.logger = handler.logger.Named("reverse_proxy.metrics")
|
||||
}
|
||||
@ -35,17 +50,14 @@ type metricsUpstreamsHealthyUpdater struct {
|
||||
handler *Handler
|
||||
}
|
||||
|
||||
func newMetricsUpstreamsHealthyUpdater(handler *Handler) *metricsUpstreamsHealthyUpdater {
|
||||
reverseProxyMetrics.init.Do(func() {
|
||||
initReverseProxyMetrics(handler)
|
||||
})
|
||||
|
||||
func newMetricsUpstreamsHealthyUpdater(handler *Handler, ctx caddy.Context) *metricsUpstreamsHealthyUpdater {
|
||||
initReverseProxyMetrics(handler, ctx.GetMetricsRegistry())
|
||||
reverseProxyMetrics.upstreamsHealthy.Reset()
|
||||
|
||||
return &metricsUpstreamsHealthyUpdater{handler}
|
||||
}
|
||||
|
||||
func (m *metricsUpstreamsHealthyUpdater) Init() {
|
||||
func (m *metricsUpstreamsHealthyUpdater) init() {
|
||||
go func() {
|
||||
defer func() {
|
||||
if err := recover(); err != nil {
|
||||
|
||||
@ -243,6 +243,19 @@ func (h *Handler) Provision(ctx caddy.Context) error {
|
||||
return fmt.Errorf("loading transport: %v", err)
|
||||
}
|
||||
h.Transport = mod.(http.RoundTripper)
|
||||
// enable request buffering for fastcgi if not configured
|
||||
// This is because most fastcgi servers are php-fpm that require the content length to be set to read the body, golang
|
||||
// std has fastcgi implementation that doesn't need this value to process the body, but we can safely assume that's
|
||||
// not used.
|
||||
// http3 requests have a negative content length for GET and HEAD requests, if that header is not sent.
|
||||
// see: https://github.com/caddyserver/caddy/issues/6678#issuecomment-2472224182
|
||||
// Though it appears even if CONTENT_LENGTH is invalid, php-fpm can handle just fine if the body is empty (no Stdin records sent).
|
||||
// php-fpm will hang if there is any data in the body though, https://github.com/caddyserver/caddy/issues/5420#issuecomment-2415943516
|
||||
|
||||
// TODO: better default buffering for fastcgi requests without content length, in theory a value of 1 should be enough, make it bigger anyway
|
||||
if module, ok := h.Transport.(caddy.Module); ok && module.CaddyModule().ID.Name() == "fastcgi" && h.RequestBuffers == 0 {
|
||||
h.RequestBuffers = 4096
|
||||
}
|
||||
}
|
||||
if h.LoadBalancing != nil && h.LoadBalancing.SelectionPolicyRaw != nil {
|
||||
mod, err := ctx.LoadModule(h.LoadBalancing, "SelectionPolicyRaw")
|
||||
@ -369,8 +382,8 @@ func (h *Handler) Provision(ctx caddy.Context) error {
|
||||
}
|
||||
}
|
||||
|
||||
upstreamHealthyUpdater := newMetricsUpstreamsHealthyUpdater(h)
|
||||
upstreamHealthyUpdater.Init()
|
||||
upstreamHealthyUpdater := newMetricsUpstreamsHealthyUpdater(h, ctx)
|
||||
upstreamHealthyUpdater.init()
|
||||
|
||||
return nil
|
||||
}
|
||||
@ -398,13 +411,13 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyht
|
||||
}
|
||||
// websocket over http2, assuming backend doesn't support this, the request will be modified to http1.1 upgrade
|
||||
// TODO: once we can reliably detect backend support this, it can be removed for those backends
|
||||
if r.ProtoMajor == 2 && r.Method == http.MethodConnect && r.Header.Get(":protocol") != "" {
|
||||
if r.ProtoMajor == 2 && r.Method == http.MethodConnect && r.Header.Get(":protocol") == "websocket" {
|
||||
clonedReq.Header.Del(":protocol")
|
||||
// keep the body for later use. http1.1 upgrade uses http.NoBody
|
||||
caddyhttp.SetVar(clonedReq.Context(), "h2_websocket_body", clonedReq.Body)
|
||||
clonedReq.Body = http.NoBody
|
||||
clonedReq.Method = http.MethodGet
|
||||
clonedReq.Header.Set("Upgrade", r.Header.Get(":protocol"))
|
||||
clonedReq.Header.Set("Upgrade", "websocket")
|
||||
clonedReq.Header.Set("Connection", "Upgrade")
|
||||
key := make([]byte, 16)
|
||||
_, randErr := rand.Read(key)
|
||||
@ -639,7 +652,8 @@ func (h Handler) prepareRequest(req *http.Request, repl *caddy.Replacer) (*http.
|
||||
if h.RequestBuffers != 0 && req.Body != nil {
|
||||
var readBytes int64
|
||||
req.Body, readBytes = h.bufferedBody(req.Body, h.RequestBuffers)
|
||||
if h.RequestBuffers == -1 {
|
||||
// set Content-Length when body is fully buffered
|
||||
if b, ok := req.Body.(bodyReadCloser); ok && b.body == nil {
|
||||
req.ContentLength = readBytes
|
||||
req.Header.Set("Content-Length", strconv.FormatInt(req.ContentLength, 10))
|
||||
}
|
||||
@ -669,7 +683,7 @@ func (h Handler) prepareRequest(req *http.Request, repl *caddy.Replacer) (*http.
|
||||
req.Header.Set("Early-Data", "1")
|
||||
}
|
||||
|
||||
reqUpType := upgradeType(req.Header)
|
||||
reqUpgradeType := upgradeType(req.Header)
|
||||
removeConnectionHeaders(req.Header)
|
||||
|
||||
// Remove hop-by-hop headers to the backend. Especially
|
||||
@ -690,9 +704,9 @@ func (h Handler) prepareRequest(req *http.Request, repl *caddy.Replacer) (*http.
|
||||
|
||||
// After stripping all the hop-by-hop connection headers above, add back any
|
||||
// necessary for protocol upgrades, such as for websockets.
|
||||
if reqUpType != "" {
|
||||
if reqUpgradeType != "" {
|
||||
req.Header.Set("Connection", "Upgrade")
|
||||
req.Header.Set("Upgrade", reqUpType)
|
||||
req.Header.Set("Upgrade", reqUpgradeType)
|
||||
normalizeWebsocketHeaders(req.Header)
|
||||
}
|
||||
|
||||
@ -718,6 +732,9 @@ func (h Handler) prepareRequest(req *http.Request, repl *caddy.Replacer) (*http.
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Via header(s)
|
||||
req.Header.Add("Via", fmt.Sprintf("%d.%d Caddy", req.ProtoMajor, req.ProtoMinor))
|
||||
|
||||
return req, nil
|
||||
}
|
||||
|
||||
@ -868,13 +885,15 @@ func (h *Handler) reverseProxy(rw http.ResponseWriter, req *http.Request, origRe
|
||||
}),
|
||||
)
|
||||
|
||||
const logMessage = "upstream roundtrip"
|
||||
|
||||
if err != nil {
|
||||
if c := logger.Check(zapcore.DebugLevel, "upstream roundtrip"); c != nil {
|
||||
if c := logger.Check(zapcore.DebugLevel, logMessage); c != nil {
|
||||
c.Write(zap.Error(err))
|
||||
}
|
||||
return err
|
||||
}
|
||||
if c := logger.Check(zapcore.DebugLevel, "upstream roundtrip"); c != nil {
|
||||
if c := logger.Check(zapcore.DebugLevel, logMessage); c != nil {
|
||||
c.Write(
|
||||
zap.Object("headers", caddyhttp.LoggableHTTPHeader{
|
||||
Header: res.Header,
|
||||
@ -1010,6 +1029,14 @@ func (h *Handler) finalizeResponse(
|
||||
res.Header.Del(h)
|
||||
}
|
||||
|
||||
// delete our Server header and use Via instead (see #6275)
|
||||
rw.Header().Del("Server")
|
||||
var protoPrefix string
|
||||
if !strings.HasPrefix(strings.ToUpper(res.Proto), "HTTP/") {
|
||||
protoPrefix = res.Proto[:strings.Index(res.Proto, "/")+1]
|
||||
}
|
||||
rw.Header().Add("Via", fmt.Sprintf("%s%d.%d Caddy", protoPrefix, res.ProtoMajor, res.ProtoMinor))
|
||||
|
||||
// apply any response header operations
|
||||
if h.Headers != nil && h.Headers.Response != nil {
|
||||
if h.Headers.Response.Require == nil ||
|
||||
@ -1207,6 +1234,10 @@ func (h Handler) provisionUpstream(upstream *Upstream) {
|
||||
// then returns a reader for the buffer along with how many bytes were buffered. Always close
|
||||
// the return value when done with it, just like if it was the original body! If limit is 0
|
||||
// (which it shouldn't be), this function returns its input; i.e. is a no-op, for safety.
|
||||
// Otherwise, it returns bodyReadCloser, the original body will be closed and body will be nil
|
||||
// if it's explicitly configured to buffer all or EOF is reached when reading.
|
||||
// TODO: the error during reading is discarded if the limit is negative, should the error be propagated
|
||||
// to upstream/downstream?
|
||||
func (h Handler) bufferedBody(originalBody io.ReadCloser, limit int64) (io.ReadCloser, int64) {
|
||||
if limit == 0 {
|
||||
return originalBody, 0
|
||||
@ -1215,13 +1246,14 @@ func (h Handler) bufferedBody(originalBody io.ReadCloser, limit int64) (io.ReadC
|
||||
buf := bufPool.Get().(*bytes.Buffer)
|
||||
buf.Reset()
|
||||
if limit > 0 {
|
||||
n, err := io.CopyN(buf, originalBody, limit)
|
||||
if (err != nil && err != io.EOF) || n == limit {
|
||||
var err error
|
||||
written, err = io.CopyN(buf, originalBody, limit)
|
||||
if (err != nil && err != io.EOF) || written == limit {
|
||||
return bodyReadCloser{
|
||||
Reader: io.MultiReader(buf, originalBody),
|
||||
buf: buf,
|
||||
body: originalBody,
|
||||
}, n
|
||||
}, written
|
||||
}
|
||||
} else {
|
||||
written, _ = io.Copy(buf, originalBody)
|
||||
|
||||
@ -408,7 +408,6 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
if fields == nil {
|
||||
fields = errFields()
|
||||
}
|
||||
|
||||
c.Write(fields...)
|
||||
}
|
||||
}
|
||||
|
||||
@ -15,8 +15,6 @@
|
||||
package acmeserver
|
||||
|
||||
import (
|
||||
"time"
|
||||
|
||||
"github.com/caddyserver/caddy/v2"
|
||||
"github.com/caddyserver/caddy/v2/caddyconfig/httpcaddyfile"
|
||||
"github.com/caddyserver/caddy/v2/modules/caddypki"
|
||||
@ -74,14 +72,10 @@ func parseACMEServer(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error
|
||||
if !h.NextArg() {
|
||||
return nil, h.ArgErr()
|
||||
}
|
||||
|
||||
dur, err := caddy.ParseDuration(h.Val())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if d := time.Duration(ca.IntermediateLifetime); d > 0 && dur > d {
|
||||
return nil, h.Errf("certificate lifetime (%s) exceeds intermediate certificate lifetime (%s)", dur, d)
|
||||
}
|
||||
acmeServer.Lifetime = caddy.Duration(dur)
|
||||
case "resolvers":
|
||||
acmeServer.Resolvers = h.RemainingArgs()
|
||||
|
||||
@ -28,7 +28,7 @@ import (
|
||||
|
||||
"github.com/caddyserver/certmagic"
|
||||
"github.com/caddyserver/zerossl"
|
||||
"github.com/mholt/acmez/v2/acme"
|
||||
"github.com/mholt/acmez/v3/acme"
|
||||
"go.uber.org/zap"
|
||||
"go.uber.org/zap/zapcore"
|
||||
|
||||
@ -60,6 +60,14 @@ type ACMEIssuer struct {
|
||||
// other than ACME transactions.
|
||||
Email string `json:"email,omitempty"`
|
||||
|
||||
// Optionally select an ACME profile to use for certificate
|
||||
// orders. Must be a profile name offered by the ACME server,
|
||||
// which are listed at its directory endpoint.
|
||||
//
|
||||
// EXPERIMENTAL: Subject to change.
|
||||
// See https://datatracker.ietf.org/doc/draft-aaron-acme-profiles/
|
||||
Profile string `json:"profile,omitempty"`
|
||||
|
||||
// If you have an existing account with the ACME server, put
|
||||
// the private key here in PEM format. The ACME client will
|
||||
// look up your account information with this key first before
|
||||
@ -138,15 +146,30 @@ func (iss *ACMEIssuer) Provision(ctx caddy.Context) error {
|
||||
iss.AccountKey = accountKey
|
||||
}
|
||||
|
||||
// DNS providers
|
||||
if iss.Challenges != nil && iss.Challenges.DNS != nil && iss.Challenges.DNS.ProviderRaw != nil {
|
||||
val, err := ctx.LoadModule(iss.Challenges.DNS, "ProviderRaw")
|
||||
if err != nil {
|
||||
return fmt.Errorf("loading DNS provider module: %v", err)
|
||||
// DNS challenge provider, if not already established
|
||||
if iss.Challenges != nil && iss.Challenges.DNS != nil && iss.Challenges.DNS.solver == nil {
|
||||
var prov certmagic.DNSProvider
|
||||
if iss.Challenges.DNS.ProviderRaw != nil {
|
||||
// a challenge provider has been locally configured - use it
|
||||
val, err := ctx.LoadModule(iss.Challenges.DNS, "ProviderRaw")
|
||||
if err != nil {
|
||||
return fmt.Errorf("loading DNS provider module: %v", err)
|
||||
}
|
||||
prov = val.(certmagic.DNSProvider)
|
||||
} else if tlsAppIface, err := ctx.AppIfConfigured("tls"); err == nil {
|
||||
// no locally configured DNS challenge provider, but if there is
|
||||
// a global DNS module configured with the TLS app, use that
|
||||
tlsApp := tlsAppIface.(*TLS)
|
||||
if tlsApp.dns != nil {
|
||||
prov = tlsApp.dns.(certmagic.DNSProvider)
|
||||
}
|
||||
}
|
||||
if prov == nil {
|
||||
return fmt.Errorf("DNS challenge enabled, but no DNS provider configured")
|
||||
}
|
||||
iss.Challenges.DNS.solver = &certmagic.DNS01Solver{
|
||||
DNSManager: certmagic.DNSManager{
|
||||
DNSProvider: val.(certmagic.DNSProvider),
|
||||
DNSProvider: prov,
|
||||
TTL: time.Duration(iss.Challenges.DNS.TTL),
|
||||
PropagationDelay: time.Duration(iss.Challenges.DNS.PropagationDelay),
|
||||
PropagationTimeout: time.Duration(iss.Challenges.DNS.PropagationTimeout),
|
||||
@ -184,6 +207,7 @@ func (iss *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEIssuer, error) {
|
||||
CA: iss.CA,
|
||||
TestCA: iss.TestCA,
|
||||
Email: iss.Email,
|
||||
Profile: iss.Profile,
|
||||
AccountKeyPEM: iss.AccountKey,
|
||||
CertObtainTimeout: time.Duration(iss.ACMETimeout),
|
||||
TrustedRoots: iss.rootPool,
|
||||
@ -338,6 +362,7 @@ func (iss *ACMEIssuer) generateZeroSSLEABCredentials(ctx context.Context, acct a
|
||||
// dir <directory_url>
|
||||
// test_dir <test_directory_url>
|
||||
// email <email>
|
||||
// profile <profile_name>
|
||||
// timeout <duration>
|
||||
// disable_http_challenge
|
||||
// disable_tlsalpn_challenge
|
||||
@ -400,6 +425,11 @@ func (iss *ACMEIssuer) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
return d.ArgErr()
|
||||
}
|
||||
|
||||
case "profile":
|
||||
if !d.AllArgs(&iss.Profile) {
|
||||
return d.ArgErr()
|
||||
}
|
||||
|
||||
case "timeout":
|
||||
var timeoutStr string
|
||||
if !d.AllArgs(&timeoutStr) {
|
||||
@ -477,21 +507,20 @@ func (iss *ACMEIssuer) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
iss.TrustedRootsPEMFiles = d.RemainingArgs()
|
||||
|
||||
case "dns":
|
||||
if !d.NextArg() {
|
||||
return d.ArgErr()
|
||||
}
|
||||
provName := d.Val()
|
||||
if iss.Challenges == nil {
|
||||
iss.Challenges = new(ChallengesConfig)
|
||||
}
|
||||
if iss.Challenges.DNS == nil {
|
||||
iss.Challenges.DNS = new(DNSChallengeConfig)
|
||||
}
|
||||
unm, err := caddyfile.UnmarshalModule(d, "dns.providers."+provName)
|
||||
if err != nil {
|
||||
return err
|
||||
if d.NextArg() {
|
||||
provName := d.Val()
|
||||
unm, err := caddyfile.UnmarshalModule(d, "dns.providers."+provName)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
iss.Challenges.DNS.ProviderRaw = caddyconfig.JSONModuleObject(unm, "name", provName, nil)
|
||||
}
|
||||
iss.Challenges.DNS.ProviderRaw = caddyconfig.JSONModuleObject(unm, "name", provName, nil)
|
||||
|
||||
case "propagation_delay":
|
||||
if !d.NextArg() {
|
||||
|
||||
@ -25,7 +25,7 @@ import (
|
||||
"strings"
|
||||
|
||||
"github.com/caddyserver/certmagic"
|
||||
"github.com/mholt/acmez/v2"
|
||||
"github.com/mholt/acmez/v3"
|
||||
"go.uber.org/zap"
|
||||
"go.uber.org/zap/zapcore"
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ import (
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/mholt/acmez/v2"
|
||||
"github.com/mholt/acmez/v3"
|
||||
"go.uber.org/zap"
|
||||
"go.uber.org/zap/zapcore"
|
||||
|
||||
@ -93,7 +93,7 @@ func (cp ConnectionPolicies) Provision(ctx caddy.Context) error {
|
||||
|
||||
// TLSConfig returns a standard-lib-compatible TLS configuration which
|
||||
// selects the first matching policy based on the ClientHello.
|
||||
func (cp ConnectionPolicies) TLSConfig(_ caddy.Context) *tls.Config {
|
||||
func (cp ConnectionPolicies) TLSConfig(ctx caddy.Context) *tls.Config {
|
||||
// using ServerName to match policies is extremely common, especially in configs
|
||||
// with lots and lots of different policies; we can fast-track those by indexing
|
||||
// them by SNI, so we don't have to iterate potentially thousands of policies
|
||||
@ -104,6 +104,7 @@ func (cp ConnectionPolicies) TLSConfig(_ caddy.Context) *tls.Config {
|
||||
for _, m := range p.matchers {
|
||||
if sni, ok := m.(MatchServerName); ok {
|
||||
for _, sniName := range sni {
|
||||
// index for fast lookups during handshakes
|
||||
indexedBySNI[sniName] = append(indexedBySNI[sniName], p)
|
||||
}
|
||||
}
|
||||
@ -111,32 +112,79 @@ func (cp ConnectionPolicies) TLSConfig(_ caddy.Context) *tls.Config {
|
||||
}
|
||||
}
|
||||
|
||||
return &tls.Config{
|
||||
MinVersion: tls.VersionTLS12,
|
||||
GetConfigForClient: func(hello *tls.ClientHelloInfo) (*tls.Config, error) {
|
||||
// filter policies by SNI first, if possible, to speed things up
|
||||
// when there may be lots of policies
|
||||
possiblePolicies := cp
|
||||
if indexedPolicies, ok := indexedBySNI[hello.ServerName]; ok {
|
||||
possiblePolicies = indexedPolicies
|
||||
}
|
||||
getConfigForClient := func(hello *tls.ClientHelloInfo) (*tls.Config, error) {
|
||||
// filter policies by SNI first, if possible, to speed things up
|
||||
// when there may be lots of policies
|
||||
possiblePolicies := cp
|
||||
if indexedPolicies, ok := indexedBySNI[hello.ServerName]; ok {
|
||||
possiblePolicies = indexedPolicies
|
||||
}
|
||||
|
||||
policyLoop:
|
||||
for _, pol := range possiblePolicies {
|
||||
for _, matcher := range pol.matchers {
|
||||
if !matcher.Match(hello) {
|
||||
continue policyLoop
|
||||
policyLoop:
|
||||
for _, pol := range possiblePolicies {
|
||||
for _, matcher := range pol.matchers {
|
||||
if !matcher.Match(hello) {
|
||||
continue policyLoop
|
||||
}
|
||||
}
|
||||
if pol.Drop {
|
||||
return nil, fmt.Errorf("dropping connection")
|
||||
}
|
||||
return pol.TLSConfig, nil
|
||||
}
|
||||
|
||||
return nil, fmt.Errorf("no server TLS configuration available for ClientHello: %+v", hello)
|
||||
}
|
||||
|
||||
tlsCfg := &tls.Config{
|
||||
MinVersion: tls.VersionTLS12,
|
||||
GetConfigForClient: getConfigForClient,
|
||||
}
|
||||
|
||||
// enable ECH, if configured
|
||||
if tlsAppIface, err := ctx.AppIfConfigured("tls"); err == nil {
|
||||
tlsApp := tlsAppIface.(*TLS)
|
||||
|
||||
if tlsApp.EncryptedClientHello != nil && len(tlsApp.EncryptedClientHello.configs) > 0 {
|
||||
// if no publication was configured, we apply ECH to all server names by default,
|
||||
// but the TLS app needs to know what they are in this case, since they don't appear
|
||||
// in its config (remember, TLS connection policies are used by *other* apps to
|
||||
// run TLS servers) -- we skip names with placeholders
|
||||
if tlsApp.EncryptedClientHello.Publication == nil {
|
||||
var echNames []string
|
||||
repl := caddy.NewReplacer()
|
||||
for _, p := range cp {
|
||||
for _, m := range p.matchers {
|
||||
if sni, ok := m.(MatchServerName); ok {
|
||||
for _, name := range sni {
|
||||
finalName := strings.ToLower(repl.ReplaceAll(name, ""))
|
||||
echNames = append(echNames, finalName)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if pol.Drop {
|
||||
return nil, fmt.Errorf("dropping connection")
|
||||
}
|
||||
return pol.TLSConfig, nil
|
||||
tlsApp.RegisterServerNames(echNames)
|
||||
}
|
||||
|
||||
return nil, fmt.Errorf("no server TLS configuration available for ClientHello: %+v", hello)
|
||||
},
|
||||
// TODO: Ideally, ECH keys should be rotated. However, as of Go 1.24, the std lib implementation
|
||||
// does not support safely modifying the tls.Config's EncryptedClientHelloKeys field.
|
||||
// So, we implement static ECH keys temporarily. See https://github.com/golang/go/issues/71920.
|
||||
// Revisit this after Go 1.25 is released and implement key rotation.
|
||||
var stdECHKeys []tls.EncryptedClientHelloKey
|
||||
for _, echConfigs := range tlsApp.EncryptedClientHello.configs {
|
||||
for _, c := range echConfigs {
|
||||
stdECHKeys = append(stdECHKeys, tls.EncryptedClientHelloKey{
|
||||
Config: c.configBin,
|
||||
PrivateKey: c.privKeyBin,
|
||||
SendAsRetry: c.sendAsRetry,
|
||||
})
|
||||
}
|
||||
}
|
||||
tlsCfg.EncryptedClientHelloKeys = stdECHKeys
|
||||
}
|
||||
}
|
||||
|
||||
return tlsCfg
|
||||
}
|
||||
|
||||
// ConnectionPolicy specifies the logic for handling a TLS handshake.
|
||||
@ -350,6 +398,20 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error {
|
||||
if err := p.ClientAuthentication.ConfigureTLSConfig(cfg); err != nil {
|
||||
return fmt.Errorf("configuring TLS client authentication: %v", err)
|
||||
}
|
||||
|
||||
// Prevent privilege escalation in case multiple vhosts are configured for
|
||||
// this TLS server; we could potentially figure out if that's the case, but
|
||||
// that might be complex to get right every time. Actually, two proper
|
||||
// solutions could leave tickets enabled, but I am not sure how to do them
|
||||
// properly without significant time investment; there may be new Go
|
||||
// APIs that alloaw this (Wrap/UnwrapSession?) but I do not know how to use
|
||||
// them at this time. TODO: one of these is a possible future enhancement:
|
||||
// A) Prevent resumptions across server identities (certificates): binding the ticket to the
|
||||
// certificate we would serve in a full handshake, or even bind a ticket to the exact SNI
|
||||
// it was issued under (though there are proposals for session resumption across hostnames).
|
||||
// B) Prevent resumptions falsely authenticating a client: include the realm in the ticket,
|
||||
// so that it can be validated upon resumption.
|
||||
cfg.SessionTicketsDisabled = true
|
||||
}
|
||||
|
||||
if p.InsecureSecretsLog != "" {
|
||||
@ -395,6 +457,7 @@ func (p ConnectionPolicy) SettingsEmpty() bool {
|
||||
p.ProtocolMax == "" &&
|
||||
p.ClientAuthentication == nil &&
|
||||
p.DefaultSNI == "" &&
|
||||
p.FallbackSNI == "" &&
|
||||
p.InsecureSecretsLog == ""
|
||||
}
|
||||
|
||||
@ -735,10 +798,14 @@ func (clientauth *ClientAuthentication) provision(ctx caddy.Context) error {
|
||||
|
||||
// if we have TrustedCACerts explicitly set, create an 'inline' CA and return
|
||||
if len(clientauth.TrustedCACerts) > 0 {
|
||||
clientauth.ca = InlineCAPool{
|
||||
caPool := InlineCAPool{
|
||||
TrustedCACerts: clientauth.TrustedCACerts,
|
||||
}
|
||||
return nil
|
||||
err := caPool.Provision(ctx)
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
clientauth.ca = caPool
|
||||
}
|
||||
|
||||
// if we don't have any CARaw set, there's not much work to do
|
||||
@ -870,22 +937,13 @@ func setDefaultTLSParams(cfg *tls.Config) {
|
||||
cfg.CipherSuites = append([]uint16{tls.TLS_FALLBACK_SCSV}, cfg.CipherSuites...)
|
||||
|
||||
if len(cfg.CurvePreferences) == 0 {
|
||||
// We would want to write
|
||||
//
|
||||
// cfg.CurvePreferences = defaultCurves
|
||||
//
|
||||
// but that would disable the post-quantum key agreement X25519Kyber768
|
||||
// supported in Go 1.23, for which the CurveID is not exported.
|
||||
// Instead, we'll set CurvePreferences to nil, which will enable PQC.
|
||||
// See https://github.com/caddyserver/caddy/issues/6540
|
||||
cfg.CurvePreferences = nil
|
||||
cfg.CurvePreferences = defaultCurves
|
||||
}
|
||||
|
||||
if cfg.MinVersion == 0 {
|
||||
cfg.MinVersion = tls.VersionTLS12
|
||||
}
|
||||
if cfg.MaxVersion == 0 {
|
||||
cfg.MaxVersion = tls.VersionTLS13
|
||||
// crypto/tls docs:
|
||||
// "If EncryptedClientHelloKeys is set, MinVersion, if set, must be VersionTLS13."
|
||||
if cfg.EncryptedClientHelloKeys != nil && cfg.MinVersion != 0 && cfg.MinVersion < tls.VersionTLS13 {
|
||||
cfg.MinVersion = tls.VersionTLS13
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@ -20,6 +20,7 @@ import (
|
||||
"reflect"
|
||||
"testing"
|
||||
|
||||
"github.com/caddyserver/caddy/v2"
|
||||
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
|
||||
)
|
||||
|
||||
@ -278,3 +279,49 @@ func TestClientAuthenticationUnmarshalCaddyfileWithDirectiveName(t *testing.T) {
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestClientAuthenticationProvision(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
ca ClientAuthentication
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "specifying both 'CARaw' and 'TrustedCACerts' produces an error",
|
||||
ca: ClientAuthentication{
|
||||
CARaw: json.RawMessage(`{"provider":"inline","trusted_ca_certs":["foo"]}`),
|
||||
TrustedCACerts: []string{"foo"},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "specifying both 'CARaw' and 'TrustedCACertPEMFiles' produces an error",
|
||||
ca: ClientAuthentication{
|
||||
CARaw: json.RawMessage(`{"provider":"inline","trusted_ca_certs":["foo"]}`),
|
||||
TrustedCACertPEMFiles: []string{"foo"},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "setting 'TrustedCACerts' provisions the cert pool",
|
||||
ca: ClientAuthentication{
|
||||
TrustedCACerts: []string{test_der_1},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
err := tt.ca.provision(caddy.Context{})
|
||||
if (err != nil) != tt.wantErr {
|
||||
t.Errorf("ClientAuthentication.provision() error = %v, wantErr %v", err, tt.wantErr)
|
||||
return
|
||||
}
|
||||
if !tt.wantErr {
|
||||
if tt.ca.ca.CertPool() == nil {
|
||||
t.Error("CertPool is nil, expected non-nil value")
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
1123
modules/caddytls/ech.go
Normal file
1123
modules/caddytls/ech.go
Normal file
File diff suppressed because it is too large
Load Diff
129
modules/caddytls/ech_test.go
Normal file
129
modules/caddytls/ech_test.go
Normal file
@ -0,0 +1,129 @@
|
||||
package caddytls
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestParseSvcParams(t *testing.T) {
|
||||
for i, test := range []struct {
|
||||
input string
|
||||
expect svcParams
|
||||
shouldErr bool
|
||||
}{
|
||||
{
|
||||
input: `alpn="h2,h3" no-default-alpn ipv6hint=2001:db8::1 port=443`,
|
||||
expect: svcParams{
|
||||
"alpn": {"h2", "h3"},
|
||||
"no-default-alpn": {},
|
||||
"ipv6hint": {"2001:db8::1"},
|
||||
"port": {"443"},
|
||||
},
|
||||
},
|
||||
{
|
||||
input: `key=value quoted="some string" flag`,
|
||||
expect: svcParams{
|
||||
"key": {"value"},
|
||||
"quoted": {"some string"},
|
||||
"flag": {},
|
||||
},
|
||||
},
|
||||
{
|
||||
input: `key="nested \"quoted\" value,foobar"`,
|
||||
expect: svcParams{
|
||||
"key": {`nested "quoted" value`, "foobar"},
|
||||
},
|
||||
},
|
||||
{
|
||||
input: `alpn=h3,h2 tls-supported-groups=29,23 no-default-alpn ech="foobar"`,
|
||||
expect: svcParams{
|
||||
"alpn": {"h3", "h2"},
|
||||
"tls-supported-groups": {"29", "23"},
|
||||
"no-default-alpn": {},
|
||||
"ech": {"foobar"},
|
||||
},
|
||||
},
|
||||
{
|
||||
input: `escape=\097`,
|
||||
expect: svcParams{
|
||||
"escape": {"a"},
|
||||
},
|
||||
},
|
||||
{
|
||||
input: `escapes=\097\098c`,
|
||||
expect: svcParams{
|
||||
"escapes": {"abc"},
|
||||
},
|
||||
},
|
||||
} {
|
||||
actual, err := parseSvcParams(test.input)
|
||||
if err != nil && !test.shouldErr {
|
||||
t.Errorf("Test %d: Expected no error, but got: %v (input=%q)", i, err, test.input)
|
||||
continue
|
||||
} else if err == nil && test.shouldErr {
|
||||
t.Errorf("Test %d: Expected an error, but got no error (input=%q)", i, test.input)
|
||||
continue
|
||||
}
|
||||
if !reflect.DeepEqual(test.expect, actual) {
|
||||
t.Errorf("Test %d: Expected %v, got %v (input=%q)", i, test.expect, actual, test.input)
|
||||
continue
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestSvcParamsString(t *testing.T) {
|
||||
// this test relies on the parser also working
|
||||
// because we can't just compare string outputs
|
||||
// since map iteration is unordered
|
||||
for i, test := range []svcParams{
|
||||
|
||||
{
|
||||
"alpn": {"h2", "h3"},
|
||||
"no-default-alpn": {},
|
||||
"ipv6hint": {"2001:db8::1"},
|
||||
"port": {"443"},
|
||||
},
|
||||
|
||||
{
|
||||
"key": {"value"},
|
||||
"quoted": {"some string"},
|
||||
"flag": {},
|
||||
},
|
||||
{
|
||||
"key": {`nested "quoted" value`, "foobar"},
|
||||
},
|
||||
{
|
||||
"alpn": {"h3", "h2"},
|
||||
"tls-supported-groups": {"29", "23"},
|
||||
"no-default-alpn": {},
|
||||
"ech": {"foobar"},
|
||||
},
|
||||
} {
|
||||
combined := test.String()
|
||||
parsed, err := parseSvcParams(combined)
|
||||
if err != nil {
|
||||
t.Errorf("Test %d: Expected no error, but got: %v (input=%q)", i, err, test)
|
||||
continue
|
||||
}
|
||||
if len(parsed) != len(test) {
|
||||
t.Errorf("Test %d: Expected %d keys, but got %d", i, len(test), len(parsed))
|
||||
continue
|
||||
}
|
||||
for key, expectedVals := range test {
|
||||
if expected, actual := len(expectedVals), len(parsed[key]); expected != actual {
|
||||
t.Errorf("Test %d: Expected key %s to have %d values, but had %d", i, key, expected, actual)
|
||||
continue
|
||||
}
|
||||
for j, expected := range expectedVals {
|
||||
if actual := parsed[key][j]; actual != expected {
|
||||
t.Errorf("Test %d key %q value %d: Expected '%s' but got '%s'", i, key, j, expected, actual)
|
||||
continue
|
||||
}
|
||||
}
|
||||
}
|
||||
if !reflect.DeepEqual(parsed, test) {
|
||||
t.Errorf("Test %d: Expected %#v, got %#v", i, test, combined)
|
||||
continue
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -178,6 +178,9 @@ func (iss *InternalIssuer) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
return d.ArgErr()
|
||||
}
|
||||
iss.SignWithRoot = true
|
||||
|
||||
default:
|
||||
return d.Errf("unrecognized subdirective '%s'", d.Val())
|
||||
}
|
||||
}
|
||||
return nil
|
||||
|
||||
@ -15,6 +15,7 @@
|
||||
package caddytls
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"fmt"
|
||||
"net"
|
||||
@ -55,7 +56,7 @@ func (MatchServerName) CaddyModule() caddy.ModuleInfo {
|
||||
|
||||
// Match matches hello based on SNI.
|
||||
func (m MatchServerName) Match(hello *tls.ClientHelloInfo) bool {
|
||||
repl := caddy.NewReplacer()
|
||||
var repl *caddy.Replacer
|
||||
// caddytls.TestServerNameMatcher calls this function without any context
|
||||
if ctx := hello.Context(); ctx != nil {
|
||||
// In some situations the existing context may have no replacer
|
||||
@ -64,6 +65,10 @@ func (m MatchServerName) Match(hello *tls.ClientHelloInfo) bool {
|
||||
}
|
||||
}
|
||||
|
||||
if repl == nil {
|
||||
repl = caddy.NewReplacer()
|
||||
}
|
||||
|
||||
for _, name := range m {
|
||||
rs := repl.ReplaceAll(name, "")
|
||||
if certmagic.MatchWildcard(hello.ServerName, rs) {
|
||||
@ -224,15 +229,28 @@ func (MatchServerNameRE) CaddyModule() caddy.ModuleInfo {
|
||||
|
||||
// Match matches hello based on SNI using a regular expression.
|
||||
func (m MatchServerNameRE) Match(hello *tls.ClientHelloInfo) bool {
|
||||
repl := caddy.NewReplacer()
|
||||
// caddytls.TestServerNameMatcher calls this function without any context
|
||||
if ctx := hello.Context(); ctx != nil {
|
||||
// Note: caddytls.TestServerNameMatcher calls this function without any context
|
||||
ctx := hello.Context()
|
||||
if ctx == nil {
|
||||
// layer4.Connection implements GetContext() to pass its context here,
|
||||
// since hello.Context() returns nil
|
||||
if mayHaveContext, ok := hello.Conn.(interface{ GetContext() context.Context }); ok {
|
||||
ctx = mayHaveContext.GetContext()
|
||||
}
|
||||
}
|
||||
|
||||
var repl *caddy.Replacer
|
||||
if ctx != nil {
|
||||
// In some situations the existing context may have no replacer
|
||||
if replAny := ctx.Value(caddy.ReplacerCtxKey); replAny != nil {
|
||||
repl = replAny.(*caddy.Replacer)
|
||||
}
|
||||
}
|
||||
|
||||
if repl == nil {
|
||||
repl = caddy.NewReplacer()
|
||||
}
|
||||
|
||||
return m.MatchRegexp.Match(hello.ServerName, repl)
|
||||
}
|
||||
|
||||
|
||||
@ -20,12 +20,15 @@ import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"log"
|
||||
"net"
|
||||
"net/http"
|
||||
"runtime/debug"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/caddyserver/certmagic"
|
||||
"github.com/libdns/libdns"
|
||||
"go.uber.org/zap"
|
||||
"go.uber.org/zap/zapcore"
|
||||
|
||||
@ -79,6 +82,7 @@ type TLS struct {
|
||||
// Disabling OCSP stapling puts clients at greater risk, reduces their
|
||||
// privacy, and usually lowers client performance. It is NOT recommended
|
||||
// to disable this unless you are able to justify the costs.
|
||||
//
|
||||
// EXPERIMENTAL. Subject to change.
|
||||
DisableOCSPStapling bool `json:"disable_ocsp_stapling,omitempty"`
|
||||
|
||||
@ -89,6 +93,7 @@ type TLS struct {
|
||||
//
|
||||
// Disabling these checks should only be done when the storage
|
||||
// can be trusted to have enough capacity and no other problems.
|
||||
//
|
||||
// EXPERIMENTAL. Subject to change.
|
||||
DisableStorageCheck bool `json:"disable_storage_check,omitempty"`
|
||||
|
||||
@ -100,9 +105,23 @@ type TLS struct {
|
||||
// The instance.uuid file is used to identify the instance of Caddy
|
||||
// in a cluster. The last_clean.json file is used to store the last
|
||||
// time the storage was cleaned.
|
||||
//
|
||||
// EXPERIMENTAL. Subject to change.
|
||||
DisableStorageClean bool `json:"disable_storage_clean,omitempty"`
|
||||
|
||||
// Enable Encrypted ClientHello (ECH). ECH protects the server name
|
||||
// (SNI) and other sensitive parameters of a normally-plaintext TLS
|
||||
// ClientHello during a handshake.
|
||||
//
|
||||
// EXPERIMENTAL: Subject to change.
|
||||
EncryptedClientHello *ECH `json:"encrypted_client_hello,omitempty"`
|
||||
|
||||
// The default DNS provider module to use when a DNS module is needed.
|
||||
//
|
||||
// EXPERIMENTAL: Subject to change.
|
||||
DNSRaw json.RawMessage `json:"dns,omitempty" caddy:"namespace=dns.providers inline_key=name"`
|
||||
dns any // technically, it should be any/all of the libdns interfaces (RecordSetter, RecordAppender, etc.)
|
||||
|
||||
certificateLoaders []CertificateLoader
|
||||
automateNames []string
|
||||
ctx caddy.Context
|
||||
@ -111,6 +130,9 @@ type TLS struct {
|
||||
logger *zap.Logger
|
||||
events *caddyevents.App
|
||||
|
||||
serverNames map[string]struct{}
|
||||
serverNamesMu *sync.Mutex
|
||||
|
||||
// set of subjects with managed certificates,
|
||||
// and hashes of manually-loaded certificates
|
||||
// (managing's value is an optional issuer key, for distinction)
|
||||
@ -136,6 +158,29 @@ func (t *TLS) Provision(ctx caddy.Context) error {
|
||||
t.logger = ctx.Logger()
|
||||
repl := caddy.NewReplacer()
|
||||
t.managing, t.loaded = make(map[string]string), make(map[string]string)
|
||||
t.serverNames = make(map[string]struct{})
|
||||
t.serverNamesMu = new(sync.Mutex)
|
||||
|
||||
// set up default DNS module, if any, and make sure it implements all the
|
||||
// common libdns interfaces, since it could be used for a variety of things
|
||||
// (do this before provisioning other modules, since they may rely on this)
|
||||
if len(t.DNSRaw) > 0 {
|
||||
dnsMod, err := ctx.LoadModule(t, "DNSRaw")
|
||||
if err != nil {
|
||||
return fmt.Errorf("loading overall DNS provider module: %v", err)
|
||||
}
|
||||
switch dnsMod.(type) {
|
||||
case interface {
|
||||
libdns.RecordAppender
|
||||
libdns.RecordDeleter
|
||||
libdns.RecordGetter
|
||||
libdns.RecordSetter
|
||||
}:
|
||||
default:
|
||||
return fmt.Errorf("DNS module does not implement the most common libdns interfaces: %T", dnsMod)
|
||||
}
|
||||
t.dns = dnsMod
|
||||
}
|
||||
|
||||
// set up a new certificate cache; this (re)loads all certificates
|
||||
cacheOpts := certmagic.CacheOptions{
|
||||
@ -178,7 +223,7 @@ func (t *TLS) Provision(ctx caddy.Context) error {
|
||||
for i, sub := range *automateNames {
|
||||
subjects[i] = repl.ReplaceAll(sub, "")
|
||||
}
|
||||
t.automateNames = subjects
|
||||
t.automateNames = append(t.automateNames, subjects...)
|
||||
} else {
|
||||
return fmt.Errorf("loading certificates with 'automate' requires array of strings, got: %T", modIface)
|
||||
}
|
||||
@ -187,31 +232,34 @@ func (t *TLS) Provision(ctx caddy.Context) error {
|
||||
t.certificateLoaders = append(t.certificateLoaders, modIface.(CertificateLoader))
|
||||
}
|
||||
|
||||
// on-demand permission module
|
||||
if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.PermissionRaw != nil {
|
||||
if t.Automation.OnDemand.Ask != "" {
|
||||
return fmt.Errorf("on-demand TLS config conflict: both 'ask' endpoint and a 'permission' module are specified; 'ask' is deprecated, so use only the permission module")
|
||||
}
|
||||
val, err := ctx.LoadModule(t.Automation.OnDemand, "PermissionRaw")
|
||||
// using the certificate loaders we just initialized, load
|
||||
// manual/static (unmanaged) certificates - we do this in
|
||||
// provision so that other apps (such as http) can know which
|
||||
// certificates have been manually loaded, and also so that
|
||||
// commands like validate can be a better test
|
||||
certCacheMu.RLock()
|
||||
magic := certmagic.New(certCache, certmagic.Config{
|
||||
Storage: ctx.Storage(),
|
||||
Logger: t.logger,
|
||||
OnEvent: t.onEvent,
|
||||
OCSP: certmagic.OCSPConfig{
|
||||
DisableStapling: t.DisableOCSPStapling,
|
||||
},
|
||||
DisableStorageCheck: t.DisableStorageCheck,
|
||||
})
|
||||
certCacheMu.RUnlock()
|
||||
for _, loader := range t.certificateLoaders {
|
||||
certs, err := loader.LoadCertificates()
|
||||
if err != nil {
|
||||
return fmt.Errorf("loading on-demand TLS permission module: %v", err)
|
||||
return fmt.Errorf("loading certificates: %v", err)
|
||||
}
|
||||
t.Automation.OnDemand.permission = val.(OnDemandPermission)
|
||||
}
|
||||
|
||||
// run replacer on ask URL (for environment variables) -- return errors to prevent surprises (#5036)
|
||||
if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.Ask != "" {
|
||||
t.Automation.OnDemand.Ask, err = repl.ReplaceOrErr(t.Automation.OnDemand.Ask, true, true)
|
||||
if err != nil {
|
||||
return fmt.Errorf("preparing 'ask' endpoint: %v", err)
|
||||
for _, cert := range certs {
|
||||
hash, err := magic.CacheUnmanagedTLSCertificate(ctx, cert.Certificate, cert.Tags)
|
||||
if err != nil {
|
||||
return fmt.Errorf("caching unmanaged certificate: %v", err)
|
||||
}
|
||||
t.loaded[hash] = ""
|
||||
}
|
||||
perm := PermissionByHTTP{
|
||||
Endpoint: t.Automation.OnDemand.Ask,
|
||||
}
|
||||
if err := perm.Provision(ctx); err != nil {
|
||||
return fmt.Errorf("provisioning 'ask' module: %v", err)
|
||||
}
|
||||
t.Automation.OnDemand.permission = perm
|
||||
}
|
||||
|
||||
// automation/management policies
|
||||
@ -246,6 +294,33 @@ func (t *TLS) Provision(ctx caddy.Context) error {
|
||||
}
|
||||
}
|
||||
|
||||
// on-demand permission module
|
||||
if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.PermissionRaw != nil {
|
||||
if t.Automation.OnDemand.Ask != "" {
|
||||
return fmt.Errorf("on-demand TLS config conflict: both 'ask' endpoint and a 'permission' module are specified; 'ask' is deprecated, so use only the permission module")
|
||||
}
|
||||
val, err := ctx.LoadModule(t.Automation.OnDemand, "PermissionRaw")
|
||||
if err != nil {
|
||||
return fmt.Errorf("loading on-demand TLS permission module: %v", err)
|
||||
}
|
||||
t.Automation.OnDemand.permission = val.(OnDemandPermission)
|
||||
}
|
||||
|
||||
// run replacer on ask URL (for environment variables) -- return errors to prevent surprises (#5036)
|
||||
if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.Ask != "" {
|
||||
t.Automation.OnDemand.Ask, err = repl.ReplaceOrErr(t.Automation.OnDemand.Ask, true, true)
|
||||
if err != nil {
|
||||
return fmt.Errorf("preparing 'ask' endpoint: %v", err)
|
||||
}
|
||||
perm := PermissionByHTTP{
|
||||
Endpoint: t.Automation.OnDemand.Ask,
|
||||
}
|
||||
if err := perm.Provision(ctx); err != nil {
|
||||
return fmt.Errorf("provisioning 'ask' module: %v", err)
|
||||
}
|
||||
t.Automation.OnDemand.permission = perm
|
||||
}
|
||||
|
||||
// session ticket ephemeral keys (STEK) service and provider
|
||||
if t.SessionTickets != nil {
|
||||
err := t.SessionTickets.provision(ctx)
|
||||
@ -254,32 +329,19 @@ func (t *TLS) Provision(ctx caddy.Context) error {
|
||||
}
|
||||
}
|
||||
|
||||
// load manual/static (unmanaged) certificates - we do this in
|
||||
// provision so that other apps (such as http) can know which
|
||||
// certificates have been manually loaded, and also so that
|
||||
// commands like validate can be a better test
|
||||
certCacheMu.RLock()
|
||||
magic := certmagic.New(certCache, certmagic.Config{
|
||||
Storage: ctx.Storage(),
|
||||
Logger: t.logger,
|
||||
OnEvent: t.onEvent,
|
||||
OCSP: certmagic.OCSPConfig{
|
||||
DisableStapling: t.DisableOCSPStapling,
|
||||
},
|
||||
DisableStorageCheck: t.DisableStorageCheck,
|
||||
})
|
||||
certCacheMu.RUnlock()
|
||||
for _, loader := range t.certificateLoaders {
|
||||
certs, err := loader.LoadCertificates()
|
||||
// ECH (Encrypted ClientHello) initialization
|
||||
if t.EncryptedClientHello != nil {
|
||||
t.EncryptedClientHello.configs = make(map[string][]echConfig)
|
||||
outerNames, err := t.EncryptedClientHello.Provision(ctx)
|
||||
if err != nil {
|
||||
return fmt.Errorf("loading certificates: %v", err)
|
||||
return fmt.Errorf("provisioning Encrypted ClientHello components: %v", err)
|
||||
}
|
||||
for _, cert := range certs {
|
||||
hash, err := magic.CacheUnmanagedTLSCertificate(ctx, cert.Certificate, cert.Tags)
|
||||
if err != nil {
|
||||
return fmt.Errorf("caching unmanaged certificate: %v", err)
|
||||
|
||||
// outer names should have certificates to reduce client brittleness
|
||||
for _, outerName := range outerNames {
|
||||
if !t.HasCertificateForSubject(outerName) {
|
||||
t.automateNames = append(t.automateNames, outerNames...)
|
||||
}
|
||||
t.loaded[hash] = ""
|
||||
}
|
||||
}
|
||||
|
||||
@ -339,6 +401,16 @@ func (t *TLS) Start() error {
|
||||
return fmt.Errorf("automate: managing %v: %v", t.automateNames, err)
|
||||
}
|
||||
|
||||
// publish ECH configs in the background; does not need to block
|
||||
// server startup, as it could take a while
|
||||
if t.EncryptedClientHello != nil {
|
||||
go func() {
|
||||
if err := t.publishECHConfigs(); err != nil {
|
||||
t.logger.Named("ech").Error("publication(s) failed", zap.Error(err))
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
if !t.DisableStorageClean {
|
||||
// start the storage cleaner goroutine and ticker,
|
||||
// which cleans out expired certificates and more
|
||||
@ -422,11 +494,16 @@ func (t *TLS) Cleanup() error {
|
||||
}
|
||||
}
|
||||
} else {
|
||||
// no more TLS app running, so delete in-memory cert cache
|
||||
certCache.Stop()
|
||||
certCacheMu.Lock()
|
||||
certCache = nil
|
||||
certCacheMu.Unlock()
|
||||
// no more TLS app running, so delete in-memory cert cache, if it was created yet
|
||||
certCacheMu.RLock()
|
||||
hasCache := certCache != nil
|
||||
certCacheMu.RUnlock()
|
||||
if hasCache {
|
||||
certCache.Stop()
|
||||
certCacheMu.Lock()
|
||||
certCache = nil
|
||||
certCacheMu.Unlock()
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
@ -478,6 +555,29 @@ func (t *TLS) Manage(names []string) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// RegisterServerNames registers the provided DNS names with the TLS app.
|
||||
// This is currently used to auto-publish Encrypted ClientHello (ECH)
|
||||
// configurations, if enabled. Use of this function by apps using the TLS
|
||||
// app removes the need for the user to redundantly specify domain names
|
||||
// in their configuration. This function separates hostname and port
|
||||
// (keeping only the hotsname) and filters IP addresses, which can't be
|
||||
// used with ECH.
|
||||
//
|
||||
// EXPERIMENTAL: This function and its behavior are subject to change.
|
||||
func (t *TLS) RegisterServerNames(dnsNames []string) {
|
||||
t.serverNamesMu.Lock()
|
||||
for _, name := range dnsNames {
|
||||
host, _, err := net.SplitHostPort(name)
|
||||
if err != nil {
|
||||
host = name
|
||||
}
|
||||
if strings.TrimSpace(host) != "" && !certmagic.SubjectIsIP(host) {
|
||||
t.serverNames[strings.ToLower(host)] = struct{}{}
|
||||
}
|
||||
}
|
||||
t.serverNamesMu.Unlock()
|
||||
}
|
||||
|
||||
// HandleHTTPChallenge ensures that the ACME HTTP challenge or ZeroSSL HTTP
|
||||
// validation request is handled for the certificate named by r.Host, if it
|
||||
// is an HTTP challenge request. It requires that the automation policy for
|
||||
|
||||
@ -81,13 +81,15 @@ func getOptimalDefaultCipherSuites() []uint16 {
|
||||
return defaultCipherSuitesWithoutAESNI
|
||||
}
|
||||
|
||||
// SupportedCurves is the unordered map of supported curves.
|
||||
// SupportedCurves is the unordered map of supported curves
|
||||
// or key exchange mechanisms ("curves" traditionally).
|
||||
// https://golang.org/pkg/crypto/tls/#CurveID
|
||||
var SupportedCurves = map[string]tls.CurveID{
|
||||
"x25519": tls.X25519,
|
||||
"secp256r1": tls.CurveP256,
|
||||
"secp384r1": tls.CurveP384,
|
||||
"secp521r1": tls.CurveP521,
|
||||
"x25519mlkem768": tls.X25519MLKEM768,
|
||||
"x25519": tls.X25519,
|
||||
"secp256r1": tls.CurveP256,
|
||||
"secp384r1": tls.CurveP384,
|
||||
"secp521r1": tls.CurveP521,
|
||||
}
|
||||
|
||||
// supportedCertKeyTypes is all the key types that are supported
|
||||
@ -100,20 +102,16 @@ var supportedCertKeyTypes = map[string]certmagic.KeyType{
|
||||
"ed25519": certmagic.ED25519,
|
||||
}
|
||||
|
||||
// defaultCurves is the list of only the curves we want to use
|
||||
// by default, in descending order of preference.
|
||||
// defaultCurves is the list of only the curves or key exchange
|
||||
// mechanisms we want to use by default. The order is irrelevant.
|
||||
//
|
||||
// This list should only include curves which are fast by design
|
||||
// (e.g. X25519) and those for which an optimized assembly
|
||||
// This list should only include mechanisms which are fast by
|
||||
// design (e.g. X25519) and those for which an optimized assembly
|
||||
// implementation exists (e.g. P256). The latter ones can be
|
||||
// found here:
|
||||
// https://github.com/golang/go/tree/master/src/crypto/elliptic
|
||||
//
|
||||
// Temporily we ignore these default, to take advantage of X25519Kyber768
|
||||
// in Go's defaults (X25519Kyber768, X25519, P-256, P-384, P-521), which
|
||||
// isn't exported. See https://github.com/caddyserver/caddy/issues/6540
|
||||
// nolint:unused
|
||||
var defaultCurves = []tls.CurveID{
|
||||
tls.X25519MLKEM768,
|
||||
tls.X25519,
|
||||
tls.CurveP256,
|
||||
}
|
||||
|
||||
@ -20,6 +20,7 @@ import (
|
||||
"io"
|
||||
"math"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
|
||||
"github.com/dustin/go-humanize"
|
||||
@ -146,51 +147,68 @@ func (fw FileWriter) WriterKey() string {
|
||||
|
||||
// OpenWriter opens a new file writer.
|
||||
func (fw FileWriter) OpenWriter() (io.WriteCloser, error) {
|
||||
if fw.Mode == 0 {
|
||||
fw.Mode = 0o600
|
||||
modeIfCreating := os.FileMode(fw.Mode)
|
||||
if modeIfCreating == 0 {
|
||||
modeIfCreating = 0o600
|
||||
}
|
||||
|
||||
// roll log files by default
|
||||
if fw.Roll == nil || *fw.Roll {
|
||||
if fw.RollSizeMB == 0 {
|
||||
fw.RollSizeMB = 100
|
||||
}
|
||||
if fw.RollCompress == nil {
|
||||
compress := true
|
||||
fw.RollCompress = &compress
|
||||
}
|
||||
if fw.RollKeep == 0 {
|
||||
fw.RollKeep = 10
|
||||
}
|
||||
if fw.RollKeepDays == 0 {
|
||||
fw.RollKeepDays = 90
|
||||
}
|
||||
// roll log files as a sensible default to avoid disk space exhaustion
|
||||
roll := fw.Roll == nil || *fw.Roll
|
||||
|
||||
// create the file if it does not exist with the right mode.
|
||||
// lumberjack will reuse the file mode across log rotation.
|
||||
f_tmp, err := os.OpenFile(fw.Filename, os.O_WRONLY|os.O_APPEND|os.O_CREATE, os.FileMode(fw.Mode))
|
||||
// create the file if it does not exist; create with the configured mode, or default
|
||||
// to restrictive if not set. (lumberjack will reuse the file mode across log rotation)
|
||||
if err := os.MkdirAll(filepath.Dir(fw.Filename), 0o700); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
file, err := os.OpenFile(fw.Filename, os.O_WRONLY|os.O_APPEND|os.O_CREATE, modeIfCreating)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
info, err := file.Stat()
|
||||
if roll {
|
||||
file.Close() // lumberjack will reopen it on its own
|
||||
}
|
||||
|
||||
// Ensure already existing files have the right mode, since OpenFile will not set the mode in such case.
|
||||
if configuredMode := os.FileMode(fw.Mode); configuredMode != 0 {
|
||||
if err != nil {
|
||||
return nil, err
|
||||
return nil, fmt.Errorf("unable to stat log file to see if we need to set permissions: %v", err)
|
||||
}
|
||||
f_tmp.Close()
|
||||
// ensure already existing files have the right mode,
|
||||
// since OpenFile will not set the mode in such case.
|
||||
if err = os.Chmod(fw.Filename, os.FileMode(fw.Mode)); err != nil {
|
||||
return nil, err
|
||||
// only chmod if the configured mode is different
|
||||
if info.Mode()&os.ModePerm != configuredMode&os.ModePerm {
|
||||
if err = os.Chmod(fw.Filename, configuredMode); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
return &lumberjack.Logger{
|
||||
Filename: fw.Filename,
|
||||
MaxSize: fw.RollSizeMB,
|
||||
MaxAge: fw.RollKeepDays,
|
||||
MaxBackups: fw.RollKeep,
|
||||
LocalTime: fw.RollLocalTime,
|
||||
Compress: *fw.RollCompress,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// otherwise just open a regular file
|
||||
return os.OpenFile(fw.Filename, os.O_WRONLY|os.O_APPEND|os.O_CREATE, os.FileMode(fw.Mode))
|
||||
// if not rolling, then the plain file handle is all we need
|
||||
if !roll {
|
||||
return file, nil
|
||||
}
|
||||
|
||||
// otherwise, return a rolling log
|
||||
if fw.RollSizeMB == 0 {
|
||||
fw.RollSizeMB = 100
|
||||
}
|
||||
if fw.RollCompress == nil {
|
||||
compress := true
|
||||
fw.RollCompress = &compress
|
||||
}
|
||||
if fw.RollKeep == 0 {
|
||||
fw.RollKeep = 10
|
||||
}
|
||||
if fw.RollKeepDays == 0 {
|
||||
fw.RollKeepDays = 90
|
||||
}
|
||||
return &lumberjack.Logger{
|
||||
Filename: fw.Filename,
|
||||
MaxSize: fw.RollSizeMB,
|
||||
MaxAge: fw.RollKeepDays,
|
||||
MaxBackups: fw.RollKeep,
|
||||
LocalTime: fw.RollLocalTime,
|
||||
Compress: *fw.RollCompress,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// UnmarshalCaddyfile sets up the module from Caddyfile tokens. Syntax:
|
||||
@ -295,6 +313,9 @@ func (fw *FileWriter) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
return d.Errf("negative roll_keep_for duration: %v", keepFor)
|
||||
}
|
||||
fw.RollKeepDays = int(math.Ceil(keepFor.Hours() / 24))
|
||||
|
||||
default:
|
||||
return d.Errf("unrecognized subdirective '%s'", d.Val())
|
||||
}
|
||||
}
|
||||
return nil
|
||||
|
||||
@ -20,6 +20,7 @@ import (
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path"
|
||||
"path/filepath"
|
||||
"syscall"
|
||||
"testing"
|
||||
|
||||
@ -77,7 +78,7 @@ func TestFileCreationMode(t *testing.T) {
|
||||
t.Fatalf("failed to create tempdir: %v", err)
|
||||
}
|
||||
defer os.RemoveAll(dir)
|
||||
fpath := path.Join(dir, "test.log")
|
||||
fpath := filepath.Join(dir, "test.log")
|
||||
tt.fw.Filename = fpath
|
||||
|
||||
logger, err := tt.fw.OpenWriter()
|
||||
@ -92,7 +93,7 @@ func TestFileCreationMode(t *testing.T) {
|
||||
}
|
||||
|
||||
if st.Mode() != tt.wantMode {
|
||||
t.Errorf("file mode is %v, want %v", st.Mode(), tt.wantMode)
|
||||
t.Errorf("%s: file mode is %v, want %v", tt.name, st.Mode(), tt.wantMode)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
@ -145,6 +145,9 @@ func (nw *NetWriter) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
return d.ArgErr()
|
||||
}
|
||||
nw.SoftStart = true
|
||||
|
||||
default:
|
||||
return d.Errf("unrecognized subdirective '%s'", d.Val())
|
||||
}
|
||||
}
|
||||
return nil
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user