summaryrefslogtreecommitdiff
path: root/modules
diff options
context:
space:
mode:
Diffstat (limited to 'modules')
-rw-r--r--modules/caddyhttp/caddyhttp.go30
-rw-r--r--modules/caddyhttp/fileserver/caddyfile.go2
-rw-r--r--modules/caddyhttp/fileserver/staticfiles.go44
-rw-r--r--modules/caddyhttp/replacer.go6
-rw-r--r--modules/caddyhttp/server.go28
-rw-r--r--modules/caddytls/connpolicy.go139
6 files changed, 223 insertions, 26 deletions
diff --git a/modules/caddyhttp/caddyhttp.go b/modules/caddyhttp/caddyhttp.go
index 174e316..9dfdf36 100644
--- a/modules/caddyhttp/caddyhttp.go
+++ b/modules/caddyhttp/caddyhttp.go
@@ -75,6 +75,15 @@ func (app *App) Provision(ctx caddy.Context) error {
srv.AutoHTTPS = new(AutoHTTPSConfig)
}
+ // disallow TLS client auth bypass which could
+ // otherwise be exploited by sending an unprotected
+ // SNI value during TLS handshake, then a protected
+ // Host header during HTTP request later on that
+ // connection
+ if srv.hasTLSClientAuth() {
+ srv.StrictSNIHost = true
+ }
+
// TODO: Test this function to ensure these replacements are performed
for i := range srv.Listen {
srv.Listen[i] = repl.ReplaceAll(srv.Listen[i], "")
@@ -159,8 +168,7 @@ func (app *App) Start() error {
return fmt.Errorf("%s: listening on %s: %v", network, addr, err)
}
- // enable HTTP/2 (and support for solving the
- // TLS-ALPN ACME challenge) by default
+ // enable HTTP/2 by default
for _, pol := range srv.TLSConnPolicies {
if len(pol.ALPN) == 0 {
pol.ALPN = append(pol.ALPN, defaultALPN...)
@@ -226,6 +234,8 @@ func (app *App) automaticHTTPS() error {
// skip if all listeners use the HTTP port
if !srv.listenersUseAnyPortOtherThan(app.HTTPPort) {
+ log.Printf("[INFO] Server %v is only listening on the HTTP port %d, so no automatic HTTPS will be applied to this server",
+ srv.Listen, app.HTTPPort)
continue
}
@@ -294,11 +304,11 @@ func (app *App) automaticHTTPS() error {
return fmt.Errorf("%s: managing certificate for %s: %s", srvName, domains, err)
}
- // tell the server to use TLS by specifying a TLS
- // connection policy (which supports HTTP/2 and the
- // TLS-ALPN ACME challenge as well)
- srv.TLSConnPolicies = caddytls.ConnectionPolicies{
- {ALPN: defaultALPN},
+ // tell the server to use TLS if it is not already doing so
+ if srv.TLSConnPolicies == nil {
+ srv.TLSConnPolicies = caddytls.ConnectionPolicies{
+ &caddytls.ConnectionPolicy{ALPN: defaultALPN},
+ }
}
if srv.AutoHTTPS.DisableRedir {
@@ -307,6 +317,12 @@ func (app *App) automaticHTTPS() error {
log.Printf("[INFO] Enabling automatic HTTP->HTTPS redirects for %v", domains)
+ // notify user if their config might override the HTTP->HTTPS redirects
+ if srv.listenersIncludePort(app.HTTPPort) {
+ log.Printf("[WARNING] Server %v is listening on HTTP port %d, so automatic HTTP->HTTPS redirects may be overridden by your own configuration",
+ srv.Listen, app.HTTPPort)
+ }
+
// create HTTP->HTTPS redirects
for _, addr := range srv.Listen {
netw, host, port, err := caddy.SplitNetworkAddress(addr)
diff --git a/modules/caddyhttp/fileserver/caddyfile.go b/modules/caddyhttp/fileserver/caddyfile.go
index 4622af2..b7cb311 100644
--- a/modules/caddyhttp/fileserver/caddyfile.go
+++ b/modules/caddyhttp/fileserver/caddyfile.go
@@ -94,7 +94,7 @@ func parseTryFiles(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error)
}
handler := rewrite.Rewrite{
- URI: "{http.matchers.file.relative}{http.request.uri.query}",
+ URI: "{http.matchers.file.relative}{http.request.uri.query_string}",
}
matcherSet := map[string]json.RawMessage{
diff --git a/modules/caddyhttp/fileserver/staticfiles.go b/modules/caddyhttp/fileserver/staticfiles.go
index cfb79f8..3e4cccc 100644
--- a/modules/caddyhttp/fileserver/staticfiles.go
+++ b/modules/caddyhttp/fileserver/staticfiles.go
@@ -41,10 +41,11 @@ func init() {
// FileServer implements a static file server responder for Caddy.
type FileServer struct {
- Root string `json:"root,omitempty"` // default is current directory
- Hide []string `json:"hide,omitempty"`
- IndexNames []string `json:"index_names,omitempty"`
- Browse *Browse `json:"browse,omitempty"`
+ Root string `json:"root,omitempty"` // default is current directory
+ Hide []string `json:"hide,omitempty"`
+ IndexNames []string `json:"index_names,omitempty"`
+ Browse *Browse `json:"browse,omitempty"`
+ CanonicalURIs *bool `json:"canonical_uris,omitempty"`
}
// CaddyModule returns the Caddy module information.
@@ -109,6 +110,7 @@ func (fsrv *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request, _ cadd
// if the request mapped to a directory, see if
// there is an index file we can serve
+ var implicitIndexFile bool
if info.IsDir() && len(fsrv.IndexNames) > 0 {
for _, indexPage := range fsrv.IndexNames {
indexPath := sanitizedPathJoin(filename, indexPage)
@@ -122,12 +124,17 @@ func (fsrv *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request, _ cadd
continue
}
- // we found an index file that might work,
- // so rewrite the request path
- r.URL.Path = path.Join(r.URL.Path, indexPage)
+ // don't rewrite the request path to append
+ // the index file, because we might need to
+ // do a canonical-URL redirect below based
+ // on the URL as-is
+ // we've chosen to use this index file,
+ // so replace the last file info and path
+ // with that of the index file
info = indexInfo
filename = indexPath
+ implicitIndexFile = true
break
}
}
@@ -149,10 +156,22 @@ func (fsrv *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request, _ cadd
return caddyhttp.Error(http.StatusNotFound, nil)
}
+ // if URL canonicalization is enabled, we need to enforce trailing
+ // slash convention: if a directory, trailing slash; if a file, no
+ // trailing slash - not enforcing this can break relative hrefs
+ // in HTML (see https://github.com/caddyserver/caddy/issues/2741)
+ if fsrv.CanonicalURIs == nil || *fsrv.CanonicalURIs {
+ if implicitIndexFile && !strings.HasSuffix(r.URL.Path, "/") {
+ return redirect(w, r, r.URL.Path+"/")
+ } else if !implicitIndexFile && strings.HasSuffix(r.URL.Path, "/") {
+ return redirect(w, r, r.URL.Path[:len(r.URL.Path)-1])
+ }
+ }
+
// open the file
file, err := fsrv.openFile(filename, w)
if err != nil {
- return err
+ return err // error is already structured
}
defer file.Close()
@@ -309,6 +328,15 @@ func calculateEtag(d os.FileInfo) string {
return `"` + t + s + `"`
}
+func redirect(w http.ResponseWriter, r *http.Request, to string) error {
+ for strings.HasPrefix(to, "//") {
+ // prevent path-based open redirects
+ to = strings.TrimPrefix(to, "/")
+ }
+ http.Redirect(w, r, to, http.StatusPermanentRedirect)
+ return nil
+}
+
var defaultIndexNames = []string{"index.html", "index.txt"}
var bufPool = sync.Pool{
diff --git a/modules/caddyhttp/replacer.go b/modules/caddyhttp/replacer.go
index f7f69a4..e003259 100644
--- a/modules/caddyhttp/replacer.go
+++ b/modules/caddyhttp/replacer.go
@@ -89,6 +89,12 @@ func addHTTPVarsToReplacer(repl caddy.Replacer, req *http.Request, w http.Respon
return dir, true
case "http.request.uri.query":
return req.URL.RawQuery, true
+ case "http.request.uri.query_string":
+ qs := req.URL.Query().Encode()
+ if qs != "" {
+ qs = "?" + qs
+ }
+ return qs, true
}
// hostname labels
diff --git a/modules/caddyhttp/server.go b/modules/caddyhttp/server.go
index 04935e6..42f7a5a 100644
--- a/modules/caddyhttp/server.go
+++ b/modules/caddyhttp/server.go
@@ -41,7 +41,7 @@ type Server struct {
TLSConnPolicies caddytls.ConnectionPolicies `json:"tls_connection_policies,omitempty"`
AutoHTTPS *AutoHTTPSConfig `json:"automatic_https,omitempty"`
MaxRehandles *int `json:"max_rehandles,omitempty"`
- StrictSNIHost bool `json:"strict_sni_host,omitempty"` // TODO: see if we can turn this on by default when clientauth is configured
+ StrictSNIHost bool `json:"strict_sni_host,omitempty"`
tlsApp *caddytls.TLS
}
@@ -183,6 +183,32 @@ func (s *Server) listenersUseAnyPortOtherThan(otherPort int) bool {
return false
}
+// listenersIncludePort returns true if there are any
+// listeners in s that use otherPort.
+func (s *Server) listenersIncludePort(otherPort int) bool {
+ for _, lnAddr := range s.Listen {
+ _, addrs, err := caddy.ParseListenAddr(lnAddr)
+ if err == nil {
+ for _, a := range addrs {
+ _, port, err := net.SplitHostPort(a)
+ if err == nil && port == strconv.Itoa(otherPort) {
+ return true
+ }
+ }
+ }
+ }
+ return false
+}
+
+func (s *Server) hasTLSClientAuth() bool {
+ for _, cp := range s.TLSConnPolicies {
+ if cp.ClientAuthentication != nil && cp.ClientAuthentication.Active() {
+ return true
+ }
+ }
+ return false
+}
+
// AutoHTTPSConfig is used to disable automatic HTTPS
// or certain aspects of it for a specific server.
type AutoHTTPSConfig struct {
diff --git a/modules/caddytls/connpolicy.go b/modules/caddytls/connpolicy.go
index e061281..16fd4f1 100644
--- a/modules/caddytls/connpolicy.go
+++ b/modules/caddytls/connpolicy.go
@@ -17,6 +17,7 @@ package caddytls
import (
"crypto/tls"
"crypto/x509"
+ "encoding/base64"
"encoding/json"
"fmt"
"strings"
@@ -111,13 +112,12 @@ type ConnectionPolicy struct {
Matchers map[string]json.RawMessage `json:"match,omitempty"`
CertSelection json.RawMessage `json:"certificate_selection,omitempty"`
- CipherSuites []string `json:"cipher_suites,omitempty"`
- Curves []string `json:"curves,omitempty"`
- ALPN []string `json:"alpn,omitempty"`
- ProtocolMin string `json:"protocol_min,omitempty"`
- ProtocolMax string `json:"protocol_max,omitempty"`
-
- // TODO: Client auth
+ CipherSuites []string `json:"cipher_suites,omitempty"`
+ Curves []string `json:"curves,omitempty"`
+ ALPN []string `json:"alpn,omitempty"`
+ ProtocolMin string `json:"protocol_min,omitempty"`
+ ProtocolMax string `json:"protocol_max,omitempty"`
+ ClientAuthentication *ClientAuthentication `json:"client_authentication,omitempty"`
matchers []ConnectionMatcher
certSelector certmagic.CertificateSelector
@@ -167,7 +167,7 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error {
tlsApp.SessionTickets.unregister(cfg)
})
- // TODO: Clean up active locks if app (or process) is being closed!
+ // TODO: Clean up session ticket active locks in storage if app (or process) is being closed!
// add all the cipher suites in order, without duplicates
cipherSuitesAdded := make(map[uint16]struct{})
@@ -212,7 +212,15 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error {
return fmt.Errorf("protocol min (%x) cannot be greater than protocol max (%x)", p.ProtocolMin, p.ProtocolMax)
}
- // TODO: client auth, and other fields
+ // client authentication
+ if p.ClientAuthentication != nil {
+ err := p.ClientAuthentication.ConfigureTLSConfig(cfg)
+ if err != nil {
+ return fmt.Errorf("configuring TLS client authentication: %v", err)
+ }
+ }
+
+ // TODO: other fields
setDefaultTLSParams(cfg)
@@ -221,6 +229,119 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error {
return nil
}
+// ClientAuthentication configures TLS client auth.
+type ClientAuthentication struct {
+ // A list of base64 DER-encoded CA certificates
+ // against which to validate client certificates.
+ // Client certs which are not signed by any of
+ // these CAs will be rejected.
+ TrustedCACerts []string `json:"trusted_ca_certs,omitempty"`
+
+ // A list of base64 DER-encoded client leaf certs
+ // to accept. If this list is not empty, client certs
+ // which are not in this list will be rejected.
+ TrustedLeafCerts []string `json:"trusted_leaf_certs,omitempty"`
+
+ // state established with the last call to ConfigureTLSConfig
+ trustedLeafCerts []*x509.Certificate
+ existingVerifyPeerCert func([][]byte, [][]*x509.Certificate) error
+}
+
+// Active returns true if clientauth has an actionable configuration.
+func (clientauth ClientAuthentication) Active() bool {
+ return len(clientauth.TrustedCACerts) > 0 || len(clientauth.TrustedLeafCerts) > 0
+}
+
+// ConfigureTLSConfig sets up cfg to enforce clientauth's configuration.
+func (clientauth *ClientAuthentication) ConfigureTLSConfig(cfg *tls.Config) error {
+ // if there's no actionable client auth, simply disable it
+ if !clientauth.Active() {
+ cfg.ClientAuth = tls.NoClientCert
+ return nil
+ }
+
+ // otherwise, at least require any client certificate
+ cfg.ClientAuth = tls.RequireAnyClientCert
+
+ // enforce CA verification by adding CA certs to the ClientCAs pool
+ if len(clientauth.TrustedCACerts) > 0 {
+ caPool := x509.NewCertPool()
+ for _, clientCAString := range clientauth.TrustedCACerts {
+ clientCA, err := decodeBase64DERCert(clientCAString)
+ if err != nil {
+ return fmt.Errorf("parsing certificate: %v", err)
+ }
+ caPool.AddCert(clientCA)
+ }
+ cfg.ClientCAs = caPool
+
+ // now ensure the standard lib will verify client certificates
+ cfg.ClientAuth = tls.RequireAndVerifyClientCert
+ }
+
+ // enforce leaf verification by writing our own verify function
+ if len(clientauth.TrustedLeafCerts) > 0 {
+ clientauth.trustedLeafCerts = []*x509.Certificate{}
+
+ for _, clientCertString := range clientauth.TrustedLeafCerts {
+ clientCert, err := decodeBase64DERCert(clientCertString)
+ if err != nil {
+ return fmt.Errorf("parsing certificate: %v", err)
+ }
+ clientauth.trustedLeafCerts = append(clientauth.trustedLeafCerts, clientCert)
+ }
+
+ // if a custom verification function already exists, wrap it
+ clientauth.existingVerifyPeerCert = cfg.VerifyPeerCertificate
+
+ cfg.VerifyPeerCertificate = clientauth.verifyPeerCertificate
+ }
+
+ return nil
+}
+
+// verifyPeerCertificate is for use as a tls.Config.VerifyPeerCertificate
+// callback to do custom client certificate verification. It is intended
+// for installation only by clientauth.ConfigureTLSConfig().
+func (clientauth ClientAuthentication) verifyPeerCertificate(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
+ // first use any pre-existing custom verification function
+ if clientauth.existingVerifyPeerCert != nil {
+ err := clientauth.existingVerifyPeerCert(rawCerts, verifiedChains)
+ if err != nil {
+ return err
+ }
+ }
+
+ if len(rawCerts) == 0 {
+ return fmt.Errorf("no client certificate provided")
+ }
+
+ remoteLeafCert, err := x509.ParseCertificate(rawCerts[len(rawCerts)-1])
+ if err != nil {
+ return fmt.Errorf("can't parse the given certificate: %s", err.Error())
+ }
+
+ for _, trustedLeafCert := range clientauth.trustedLeafCerts {
+ if remoteLeafCert.Equal(trustedLeafCert) {
+ return nil
+ }
+ }
+
+ return fmt.Errorf("client leaf certificate failed validation")
+}
+
+// decodeBase64DERCert base64-decodes, then DER-decodes, certStr.
+func decodeBase64DERCert(certStr string) (*x509.Certificate, error) {
+ // decode base64
+ derBytes, err := base64.StdEncoding.DecodeString(certStr)
+ if err != nil {
+ return nil, err
+ }
+
+ // parse the DER-encoded certificate
+ return x509.ParseCertificate(derBytes)
+}
+
// setDefaultTLSParams sets the default TLS cipher suites, protocol versions,
// and server preferences of cfg if they are not already set; it does not
// overwrite values, only fills in missing values.
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-25 17:11:01 +0000