summaryrefslogtreecommitdiff
path: root/modules
AgeCommit message (Collapse)Author
2020-06-12Merge branch 'eab-fix'Matthew Holt
2020-06-12fastcgi: Make sure splitPos handles empty SplitPath correctly (#3491)Wynn Wolf Arbor
In commit f2ce81c, support for multiple path splitters was added. The type of SplitPath changed from string to []string, and splitPos was changed to loop through all values in SplitPath. Before that commit, if SplitPath was empty, strings.Index returned 0 and PATH_INFO was set correctly in buildEnv. Currently, however, splitPos returns -1 for empty values of SplitPath, behaving as if a split position could not be found at all. PATH_INFO is then never set in buildEnv and remains empty. Restore the old behaviour by explicitly checking whether SplitPath is empty and returning 0 in splitPos. Closes #3490
2020-06-11caddyhttp: Add client cert SAN placeholdersMatthew Holt
2020-06-11caddytls: Don't decode HMACMatthew Holt
https://caddy.community/t/trouble-with-external-account-hmac/8600?u=matt
2020-06-11reverseproxy: Close websocket conn if req context cancelsMatthew Holt
This is a recent patch in the Go standard library
2020-06-08reverseproxy: Add Caddyfile support for ClientCertificateAutomateMatthew Holt
2020-06-05httpcaddyfile: Add client_auth options to tls directive (#3335)NWHirschfeld
* reading client certificate config from Caddyfile Signed-off-by: NWHirschfeld <Niclas@NWHirschfeld.de> * Update caddyconfig/httpcaddyfile/builtins.go Co-authored-by: Francis Lavoie <lavofr@gmail.com> * added adapt test for parsing client certificate configuration from Caddyfile Signed-off-by: NWHirschfeld <Niclas@NWHirschfeld.de> * read client ca and leaf certificates from file https://github.com/caddyserver/caddy/pull/3335#discussion_r421633844 Signed-off-by: NWHirschfeld <Niclas@NWHirschfeld.de> * Update modules/caddytls/connpolicy.go * Make review adjustments Co-authored-by: Francis Lavoie <lavofr@gmail.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2020-06-05caddytls: Configurable cache size limitMatthew Holt
2020-06-04reverseproxy: Enable changing only the status code (close #2920)Matthew Holt
2020-06-04caddyhttp: Default to error status if found in contextMatthew Holt
This is just a convenience if using a static_response handler in an error route, by setting the default status code to the same one as the error status.
2020-06-03caddyhttp: Auto-redirects from all bind addresses (fix #3443)Matthew Holt
2020-06-03caddypki: Add 'acme_server' Caddyfile directiveMatthew Holt
2020-06-02caddytls: Actually use configured test CAMatthew Holt
2020-06-01caddyauth: Cache basicauth results (fixes #3462) (#3465)Matt Holt
Cache capacity is currently hard-coded at 1000 with random eviction. It is enabled by default from Caddyfile configurations because I assume this is the most common preference.
2020-06-01go.mod: Update dependenciesMatthew Holt
2020-05-29caddyconfig: Minor internal and godoc tweaksMatthew Holt
2020-05-28logging: Net writer redials if write fails (#3453)Matt Holt
* logging: Net writer redials if write fails https://caddy.community/t/v2-log-output-net-does-not-reconnect-after-lost-connection/8386?u=matt * Only replace connection if redial succeeds * Fix error handling
2020-05-27reverseproxy: Pool copy buffers (minor optimization)Matthew Holt
2020-05-27reverseproxy: Enable response interception (#1447, #2920)Matthew Holt
It's a raw, low-level implementation for now, but it's very flexible. More sugar-coating can be added after error handling is more developed.
2020-05-26caddyhttp: Refactor header matchingMatthew Holt
This allows response matchers to benefit from the same matching logic as the request header matchers (mainly prefix/suffix wildcards).
2020-05-26caddyhttp: Add client.public_key(_sha256) placeholdersMatthew Holt
2020-05-26httpcaddyfile: New `handle_path` directive (#3281)Francis Lavoie
* caddyconfig: WIP implementation of handle_path * caddyconfig: Complete the implementation - h.NewRoute was key * caddyconfig: Add handle_path integration test * caddyhttp: Use the path matcher as-is, strip the trailing *, update test
2020-05-26cmd: file-server: add --access-log flag (#3454)Rui Lopes
2020-05-26reverseproxy: Improve error message when using scheme+placeholder (#3393)Francis Lavoie
* reverseproxy: Improve error message when using scheme+placeholder * reverseproxy: Simplify error message Co-authored-by: Matt Holt <mholt@users.noreply.github.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2020-05-26reverseproxy: Fix https active health checks #3450 (#3451)AndyBan
2020-05-25chore: forego the use of deprecated cel func NewIdent in favor of NewVar (#3444)Mohammed Al Sahaf
2020-05-21caddyhttp: Add time.now placeholder and update cel-go (closes #2594)Matthew Holt
2020-05-21cmd: hash-password: Fix broken terminal state on SIGINT (#3416)Francis Lavoie
* caddyauth: Fix hash-password broken terminal state on SIGINT * caddycmd: Move TrapSignals calls to only subcommands that run long
2020-05-20reverseproxy: Don't overwrite existing X-Forwarded-Proto headerMatthew Holt
Correct behavior is not well defined because this is a non-standard header field. This could be a "hop-by-hop" field much like X-Forwarded-For is, but even our X-Forwarded-For implementation preserves prior entries. Or, it could be best to preserve the original value from the first hop, representing the protocol as facing the client. Let's try it the other way for a bit and see how it goes. See https://caddy.community/t/caddy2-w-wordpress-behind-nginx-reverse-proxy/8174/3?u=matt
2020-05-18reverseproxy: Make debug log safe if error occursMatthew Holt
2020-05-18reverseproxy: Emit debug log before checking error (#3425)Matthew Holt
This way the upstream request will always be available even if it failed
2020-05-18pki: Add docs to some struct fieldsMatthew Holt
2020-05-18templates: trim windows whitespace in SplitFrontMatter; fix #3386 (#3387)Thorkild Gregersen
* add test case for SplitFrontMatter showing issue with windows newline * fix issue with windows newline when using SplitFrontMatter * Update modules/caddyhttp/templates/frontmatter.go Co-authored-by: Francis Lavoie <lavofr@gmail.com> * make it mere explicit what is trimmed from firstLine * Update modules/caddyhttp/templates/frontmatter.go Co-authored-by: Francis Lavoie <lavofr@gmail.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2020-05-18caddyauth: Add realm to basicauth Caddyfile directive (#3315)Francis Lavoie
2020-05-18fastcgi: `php_fastcgi` subdirectives to override shortcut behaviour (#3255)Francis Lavoie
* fastcgi: Add new php_fastcgi subdirectives to override the shortcut * fastcgi: Support "index off" to disable redir and try_files * fastcgi: Remove whitespace to satisfy linter * fastcgi: Run gofmt * fastcgi: Make a new dispenser instead of using rewind * fastcgi: Some fmt * fastcgi: Add a couple adapt tests * fastcgi: Clean up for loops * fastcgi: Move adapt tests to separate files
2020-05-13docs: link to CEL standard definitions (#3407)Mohammed Al Sahaf
* docs: link to CEL standard definitions * Rephrase the anchor to CEL standard definitions Co-authored-by: Matt Holt <mholt@users.noreply.github.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2020-05-13reverseproxy: Apply response header ops before copying it (fix #3382) (#3401)Matt Holt
2020-05-12all: Recover from panics in goroutinesMatthew Holt
2020-05-12cmd: reverse-proxy: add --insecure flag (with warning) (#3389)linquize
2020-05-11core: Add support for `d` duration unit (#3323)Francis Lavoie
* caddy: Add support for `d` duration unit * Improvements to ParseDuration; add unit tests Co-authored-by: Matthew Holt <mholt@users.noreply.github.com>
2020-05-11caddyhttp: Fix merging of Caddyfile matchers in not blocks (#3379)Francis Lavoie
2020-05-11caddyhttp: Match hostnames with wildcards to loggers (#3378)Gregory Dosh
* adding wildcard matching of logger names * reordering precedence for more specific loggers to match first * removing dependence on certmagic and extra loop Co-authored-by: GregoryDosh <GregoryDosh@users.noreply.github.com>
2020-05-11cmd: hash-password: Support reading from stdin (#3373)Andrew Zhou
Closes #3365 * http: Add support in hash-password for reading from terminals/stdin * FIXUP: Run gofmt -s * FIXUP * FIXUP: Apply suggestions from code review Co-authored-by: Matt Holt <mholt@users.noreply.github.com> * FIXUP Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2020-05-11caddyhttp: Minor refactoring for preparing requestsMatthew Holt
While building a layer4 app for Caddy, I discovered that we need the ability to fill a request's context just like the HTTP server does, hence this exported function PrepareRequest().
2020-05-07log: improve rounding logic for log rolling directives (#3367)Jeremy Lin
* For `roll_size` and `roll_keep_for` directives, round up instead of down. For example, if a user wants to be able to look back on 36 hours of logs, but you must round to a 24-hour multiple, then it's better to round up to 48 hours (which includes the desired 36 hours) instead of down to 24 hours. * `roll_size` had an off-by-one error that caused the size to be as much as 1 MB larger than requested. For example, requests of `1MB` and `1.1MB` both became 2 MB. Now `1MB` means 1 MB, and `1.1MB` is rounded up to 2 MB.
2020-05-06Update dependencies and get rid of placeholder hacks in CA codeMatthew Holt
With the latest commit on smallstep/certificates, placeholders in config are no longer needed.
2020-05-06reverseproxy: Allow using TLS for port 80 upstreams (see #3361)Matthew Holt
An upstream like https://localhost:80 is still forbidden, but an addr of localhost:80 can be used while explicitly enabling TLS as an override; we just don't allow the implicit behavior to be ambiguous.
2020-05-06tls/client auth: verify first certificates in client request (#3344)Karol Będkowski
When client certificate is enabled Caddy check only last certificate from request. When this cert is not in list of trusted leaf certificates, connection is rejected. According to RFC TLS1.x the sender's certificate must come first in the list. Each following certificate must directly certify the one preceding it. This patch fix this problem - first certificate is checked instead of last.
2020-05-05reverseproxy: Add tls_server_name option to Caddyfile (#3322)Francis Lavoie
2020-05-05httpcaddyfile: Only append TLS conn policy if it's non-empty (#3319)Matt Holt
This can lead to nicer, smaller JSON output for Caddyfiles like this: a { tls internal } b { tls foo@bar.com } i.e. where the tls directive only configures automation policies, and is merely meant to enable TLS on a server block (if it wasn't implied). This helps keeps implicit config implicit. Needs a little more testing to ensure it doesn't break anything important.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-03 16:21:42 +0000