| Age | Commit message (Collapse) | Author |
|---|
|
Using URLs seems a little cleaner and more correct
cf: https://caddy.community/t/protect-admin-endpoint/15114
(This used to work. Something must have changed recently.)
|
|
|
|
|
|
Including crucial CertMagic upgrade
|
|
For auto-replace certificate on revocation for on-demand mode,
until a proper release is made.
|
|
metrics: Enforce smaller set of method labels
|
|
Signed-off-by: Dave Henderson <dhenderson@gmail.com>
|
|
|
|
Signed-off-by: Dave Henderson <dhenderson@gmail.com>
|
|
Signed-off-by: Dave Henderson <dhenderson@gmail.com>
|
|
The TestFileListing test in tplcontext_test has one test that verifies
if directory traversal is not happening. The context root is set to
'/tmp' and then it tries to open '../../../../../etc', which gets
normalized to '/tmp/etc'.
The test then expects an error to be returned, assuming that '/tmp/etc'
does not exist on the system. When it does exist, it results in a test
failure:
```
--- FAIL: TestFileListing (0.00s)
tplcontext_test.go:422: Test 4: Expected error but had none
FAIL
FAIL
github.com/caddyserver/caddy/v2/modules/caddyhttp/templates 0.042s
```
Instead of using '/tmp' as root, use a dedicated directory created with
`os.MkdirTemp()` instead. That way, we know that the directory is empty.
|
|
* caddyhttp: Reject absurdly long methods
* Limit method to 32 chars and truncate
* Just reject the request and debug-log it
* Log remote address
|
|
|
|
* explain cryptic unix socket listener error related to process kill
https://github.com/caddyserver/caddy/pull/4533
* less ambiguous wording: clean up -> delete
* shorten error message explanation
* link back to pull request in comment for later archeaology
|
|
|
|
|
|
|
|
|
|
|
|
The `net.JoinHostPort()` function has some naiive logic for handling IPv6, it just checks if the host part has a `:` and if so it wraps the host part with `[ ]` but this causes our network type prefix to get wrapped as well, which is invalid for `caddy.NetworkAddress`. Instead, we can just concatenate the host and port manually here to avoid this side-effect.
|
|
|
|
|
|
|
|
Potential fix for #4017 although the consensus is unclear.
Made change to return status code 421 instead of 403 when StrictSNIHost matching is on.
|
|
|
|
When this listener code was first written, UsagePool didn't exist. We
can simplify much of the wrapped listener logic by utilizing UsagePool.
This also fixes a bug where new servers were able to clear deadlines
set by old servers, even if the old server didn't get booted out of its
Accept() call yet. And with the deadline cleared, they never would.
(Sometimes. Based on reports and difficulty of reproducing the bug,
this behavior was extremely rare.) I don't know why that happened
exactly, maybe some polling mechanism in the kernel and if the timings
worked out just wrong it would expose the bug.
Anyway, now we ensure that only the closer that set the deadline is the
same one that clears it, ensuring that old servers always return out of
Accept(), because the deadline doesn't get cleared until they do.
Of course, all this hinges on the hope that my suspicions in the middle
of the night are correct and that kernels work the way I think they do
in my head.
Also minor enhancement to UsagePool where if a value errors upon
construction (a very real possibility with listeners), it is removed from
the pool. Not 100% sure the sync logic is correct there, or maybe we
don't have to even put it in the pool until after construction, but it's
subtle either way and I think this is safe... right?
|
|
Best guess for https://caddy.community/t/on-fly-certificate-generation-based-on-sni/14639/4
|
|
|
|
* caddyhttp: Redirect HTTP requests on the HTTPS port to https://
* Apply suggestions from code review
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
|
|
|
|
Close caddyserver/website#91
|
|
|
|
|
|
|
|
This is a followup to #4407, in response to a report on the forums: https://caddy.community/t/php-fastcgi-phishing-redirection/14542
Turns out that doing `TrimRight` to remove trailing dots, _before_ cleaning the path, will cause double-dots at the end of the path to not be cleaned away as they should. We should instead remove the dots _after_ cleaning.
|
|
Fixes #4481
|
|
|
|
|
|
* caddyhttp: Enhance vars matcher
Enable "or" logic for multiple values.
Fall back to checking placeholders if not a var name.
* Fix tests (thanks @mohammed90 !)
|
|
* pki: Avoid provisioning the `local` CA when not necessary
* pki: Refactor CA loading to keep the logic in the PKI app
|
|
|
|
|
|
|
|
|
|
Co-authored-by: Francis Lavoie <lavofr@gmail.com>
|
|
|
|
* logging: add support for hashing data
* Update modules/logging/filters.go
Co-authored-by: wiese <wiese@users.noreply.github.com>
* Update modules/logging/filters.go
Co-authored-by: wiese <wiese@users.noreply.github.com>
Co-authored-by: wiese <wiese@users.noreply.github.com>
|
|
|
|
* fastcgi: Fix a TODO, prevent zap using reflection for logging env
* Update modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go
Co-authored-by: Mohammed Al Sahaf <msaa1990@gmail.com>
Co-authored-by: Mohammed Al Sahaf <msaa1990@gmail.com>
|
|
|
