From 05656a60b3b089ce1735a1ebb02539cca9f68fb4 Mon Sep 17 00:00:00 2001 From: Matthew Holt Date: Wed, 9 Jun 2021 14:34:59 -0600 Subject: httpcaddyfile: Don't add HTTP hosts to TLS APs (fix #4176 and fix #4198) In the Caddyfile, hosts specified for HTTP sockets (either scheme is "http" or it is on the HTTP port) should not be used as subjects in TLS automation policies (APs). --- caddyconfig/httpcaddyfile/directives.go | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'caddyconfig/httpcaddyfile/directives.go') diff --git a/caddyconfig/httpcaddyfile/directives.go b/caddyconfig/httpcaddyfile/directives.go index 5e19474..75fd473 100644 --- a/caddyconfig/httpcaddyfile/directives.go +++ b/caddyconfig/httpcaddyfile/directives.go @@ -478,6 +478,27 @@ func (sb serverBlock) hostsFromKeys(loggerMode bool) []string { return sblockHosts } +func (sb serverBlock) hostsFromKeysNotHTTP(httpPort string) []string { + // ensure each entry in our list is unique + hostMap := make(map[string]struct{}) + for _, addr := range sb.keys { + if addr.Host == "" { + continue + } + if addr.Scheme != "http" && addr.Port != httpPort { + hostMap[addr.Host] = struct{}{} + } + } + + // convert map to slice + sblockHosts := make([]string, 0, len(hostMap)) + for host := range hostMap { + sblockHosts = append(sblockHosts, host) + } + + return sblockHosts +} + // hasHostCatchAllKey returns true if sb has a key that // omits a host portion, i.e. it "catches all" hosts. func (sb serverBlock) hasHostCatchAllKey() bool { -- cgit v1.2.3