249 Commits

Author	SHA1	Message	Date
Matthew Holt	105eee671c	caddytls: Set local_ip, not remote_ip (#6952) ... Follow-up on 35c8c2d92d26208642cea0d1549c77a00124e154 where I was a dum-dum	2025-04-21 18:32:51 -06:00
Mohammed Al Sahaf	737936c06b	reverseproxy: reference correct field name in LoadModule (#6978) ... Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-04-21 08:43:27 -06:00
Matthew Holt	fb22a26b1a	caddytls: Allow missing ECH meta file	2025-04-18 12:20:21 -06:00
Matt Holt	1bfa111552	caddytls: Prefer managed wildcard certs over individual subdomain certs (#6959) ... * caddytls: Prefer managed wildcard certs over individual subdomain certs * Repurpose force_automate as no_wildcard * Fix a couple bugs * Restore force_automate and use automate loader as wildcard override	2025-04-18 11:44:23 -06:00
Matthew Holt	35c8c2d92d	caddytls: Add remote_ip to HTTP cert manager (close #6952)	2025-04-17 16:43:06 -06:00
Matthew Holt	9becf61a9f	go.mod: Upgrade to libdns 1.0 beta APIs (requires upgraded DNS providers) ... This is the only way we can properly, reliably support ECH.	2025-04-07 12:43:11 -06:00
Matthew Holt	ea77a9ab67	caddytls: Temporarily treat "" and "@" as equivalent for DNS publication ... Fixes https://github.com/caddyserver/caddy/issues/6895#issuecomment-2750111096	2025-03-25 16:24:16 -06:00
Matthew Holt	782a3c7ac6	caddytls: Don't publish HTTPS record for CNAME'd domain (fix #6922)	2025-03-24 09:55:26 -06:00
Mohammed Al Sahaf	173573035c	core: add modular network_proxy support (#6399) ... * core: add modular `network_proxy` support Co-authored-by: @ImpostorKeanu Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * move modules around Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * add caddyfile implementation Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * address feedbcak * Apply suggestions from code review Co-authored-by: Francis Lavoie <lavofr@gmail.com> * adapt ForwardProxyURL to use the NetworkProxyRaw Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * remove redundant `url` in log Co-authored-by: Matt Holt <mholt@users.noreply.github.com> * code review Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * remove `.source` from the module ID Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> Co-authored-by: Francis Lavoie <lavofr@gmail.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-03-21 17:06:15 +00:00
Matthew Holt	e276994174	caddytls: Initialize permission module earlier (fix #6901) ... Bug introduced in 4ebcfed9c942c59f473f12f8108e1d0fa92e0855	2025-03-17 12:02:23 -06:00
Matthew Holt	55c89ccf2a	caddytls: Convert AP subjects to punycode ... Fixes bugs related to TLS automation	2025-03-14 15:44:20 -06:00
Matthew Holt	1f8dab572c	caddytls: Don't publish ECH configs if other records don't exist ... Publishing a DNS record for a name that doesn't have any could make wildcards ineffective, which would be surprising for site owners and could lead to downtime.	2025-03-12 16:33:14 -06:00
Matthew Holt	39262f8663	caddytls: Minor fixes for ECH	2025-03-11 08:12:48 -06:00
jjiang-stripe	49f9af9a4a	caddytls: Fix TrustedCACerts backwards compatibility (#6889) ... * add failing test * fix ca pool provisioning * remove unused param	2025-03-10 12:50:47 -06:00
Matthew Holt	d57ab215a2	caddytls: Pointer receiver (fix #6885)	2025-03-08 14:19:06 -07:00
Steffen Busch	f4432a306a	caddyfile: add error handling for unrecognized subdirective/options in various modules (#6884)	2025-03-08 23:45:05 +03:00
Matthew Holt	4ebcfed9c9	caddytls: Reorder provisioning steps (fix #6877) ... Also add a quick check to allow users to load their own certs for ECH (outer) domains.	2025-03-07 11:18:00 -07:00
Matthew Holt	adbe7f87e6	caddytls: Only make DNS solver if not already set (fix #6880)	2025-03-07 09:46:43 -07:00
Matthew Holt	bc3d497739	caddytls: Fix broken refactor ... Not sure how that happened...	2025-03-06 08:54:40 -07:00
Matthew Holt	a807fe0659	caddytls: Enhance ECH documentation	2025-03-06 08:52:52 -07:00
Matt Holt	d7764dfdbb	caddytls: Encrypted ClientHello (ECH) (#6862) ... * caddytls: Initial commit of Encrypted ClientHello (ECH) * WIP Caddyfile * Fill out Caddyfile support * Enhance godoc comments * Augment, don't overwrite, HTTPS records * WIP * WIP: publication history * Fix republication logic * Apply global DNS module to ACME challenges This allows DNS challenges to be enabled without locally-configured DNS modules * Ignore false positive from prealloc linter * ci: Use only latest Go version (1.24 currently) We no longer support older Go versions, for security benefits. * Remove old commented code Static ECH keys for now * Implement SendAsRetry	2025-03-05 17:04:10 -07:00
Matthew Holt	ca37c0b05f	Fix typo in TLS group x25519mlkem768	2025-03-03 10:26:42 -07:00
Matthew Holt	172136a0a0	caddytls: Support post-quantum key exchange mechanism X25519MLKEM768 ... Also bump minimum Go version to 1.24.	2025-02-11 22:43:54 -07:00
vnxme	d7872c3bfa	caddytls: Refactor sni matcher (#6812)	2025-01-27 11:42:09 -07:00
vnxme	7b8f3505e3	caddytls: Fix sni_regexp matcher to obtain layer4 contexts (#6804) ... * caddytls: Fix sni_regexp matcher * caddytls: Refactor sni_regexp matcher	2025-01-25 07:45:41 -07:00
Matthew Holt	2c4295ee48	caddytls: Initial support for ACME profiles ... Still very experimental; only deployed to LE staging so far.	2025-01-09 13:57:00 -07:00
Matthew Holt	ed1c594cdb	go.mod: Upgrade ACMEz to v3; and upgrade CertMagic	2024-12-19 12:17:07 -07:00
Francis Lavoie	315715e90f	core: Implement FastAbs to avoid repeated os.Getwd calls (#6687) ... * core: Implement FastAbs to avoid repeated os.Getwd calls * Lint * Rename files	2024-11-13 03:55:51 -05:00
Francis Lavoie	5c8dc34418	caddytls: Allow disabling storage cleaning, avoids writing two files (#6593)	2024-11-05 10:47:41 -07:00
Francis Lavoie	09b2cbcf4d	caddyhttp: Add MatchWithError to replace SetVar hack (#6596) ... * caddyhttp: Add `MatchWithError` to replace SetVar hack * Error in IP matchers on TLS handshake not complete * Use MatchWithError everywhere possible * Move implementations to MatchWithError versions * Looser interface checking to allow fallback * CEL factories can return RequestMatcherWithError * Clarifying comment since it's subtle that an err is returned * Return 425 Too Early status in IP matchers * Keep AnyMatch signature the same for now * Apparently Deprecated can't be all-uppercase to get IDE linting * Linter	2024-11-04 23:18:50 +00:00
Francis Lavoie	d7564d632f	caddytls: Drop rate_limit and burst, has been deprecated (#6611)	2024-10-07 17:39:47 -04:00
Matt Holt	c8adb1b553	cmd: Better error handling when reloading (#6601) ... * caddyhttp: Limit auto-HTTPS error logs to 100 domains * Improve error message and increase error size limit	2024-10-01 20:31:30 -06:00
Matt Holt	9b4acc2449	caddytls: Support new tls.context module (#6369) ... * caddytls: Support new tls.context module This allows modules to manipulate the context passed into CertMagic's GetCertificate function, which can be useful for tracing/metrics, or other custom logic. This is experimental and may resolve the request of a sponsor, so we'll see how it goes! * Derpy derp	2024-10-01 17:18:17 -06:00
Mohammed Al Sahaf	1a345b4fa6	doc: remove docs of deprecated directives (#6566) ... Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2024-09-29 09:12:52 +00:00
Francis Lavoie	2faeac0a10	chore: Use slices package where possible (#6585) ... * chore: Use slices package where possible * More, mostly using ContainsFunc * Even more slice operations	2024-09-25 14:30:56 -06:00
Francis Lavoie	9dda8fbf84	caddytls: Give a better error message when given encrypted private keys (#6591)	2024-09-25 06:00:48 -06:00
Kévin Dunglas	f4bf4e0097	perf: use zap's Check() to prevent useless allocs (#6560) ... * perf: use zap's Check() to prevent useless allocs * fix * fix * fix * fix * restore previous replacer behavior * fix linter	2024-09-13 11:16:37 -06:00
vnxme	2d12fb7ac6	caddytls: Add sni_regexp matcher (#6569)	2024-09-11 20:51:59 -06:00
Bas Westerbaan	dcbf38d0b3	tls: use Go default kex for the moment that include PQC (#6542) ... By default Go 1.23 enables X25519Kyber768, a post-quantum key agreement method that is enabled by default on Chrome. Go 1.23 does not expose the CurveID, so we cannot add it by specifying it in CurvePreferences. The reason is that X25519Kyber768 is a preliminary key agreement that will be supplanted by X25519MLKEM768. For the moment there is value in enabling it. A consequence of this is that by default Caddy will enable support for P-384 and P-521. This PR also removes the special code to add support for X25519Kyber768 via the Cloudflare Go branch. Cf #6540	2024-08-27 17:08:16 -06:00
vnxme	7cf8376e63	matchers: fix a regression in #6480 (#6510) ... The context may have no replacer	2024-08-12 10:01:09 +03:00
vnxme	59cbb2c83a	caddytls,caddyhttp: Placeholders for some TLS and HTTP matchers (#6480) ... * Runtime placeholders for caddytls matchers (1/3): - remove IPs validation in UnmarshalCaddyfile * Runtime placeholders for caddytls matchers (2/3): - add placeholder replacement for IPs in Provision * Runtime placeholders for caddytls matchers (3/3): - add placeholder replacement for other strings * Runtime placeholders for caddyhttp matchers (1/1): - add placeholder replacement for IPs in Provision * Runtime placeholders for caddyhttp/caddytls matchers: - move PrivateRandesCIDR under internal	2024-08-07 11:02:23 -06:00
vnxme	3579815a6c	caddytls: Caddyfile support for TLS conn and cert sel policies (#6462) ... * Caddyfile support for TLS custom certificate selection policy * Caddyfile support for TLS connection policy	2024-07-24 11:01:06 -06:00
vnxme	61fe152c60	caddytls: Caddyfile support for TLS handshake matchers (#6461) ... * Caddyfile support for TLS handshake matchers: - caddytls.MatchLocalIP - caddytls.MatchRemoteIP - caddytls.MatchServerName * Caddyfile support for TLS handshake matchers: - fix imports order Co-authored-by: Francis Lavoie <lavofr@gmail.com> --------- Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2024-07-24 09:26:09 -06:00
Andreas Kohn	e7ecc7ede2	Make it possible to configure the DisableStorageCheck setting for certmagic (#6368) ... See discussion about this setting in https://github.com/caddyserver/certmagic/issues/201	2024-06-04 07:00:15 -06:00
Matthew Holt	01308b4bae	I'm so tired of typos	2024-06-01 20:43:35 -06:00
Matthew Holt	b7280e6949	caddytls: Implement certmagic.RenewalInfoGetter ... Fixes ARI errors reported here: https://caddy.community/t/error-in-logs-with-updating-ari-after-upgrading-to-caddy-v2-8-1/24320	2024-06-01 18:02:49 -06:00
Francis Lavoie	a6a45ff6c5	context: AppIfConfigured returns error; consider not-yet-provisioned modules (#6292) ... * context: Add new `AppStrict()` method to avoid instantiating empty apps * Rename AppStrict -> AppIfConfigured --------- Co-authored-by: Matthew Holt <mholt@users.noreply.github.com>	2024-05-20 11:14:58 -06:00
Matthew Holt	73e094e1dd	Fix lint error about deprecated method in smallstep/certificates/authority	2024-05-20 10:56:25 -06:00
Will Norris	db3e19b7b5	caddytls: fix permission requirement with AutomationPolicy (#6328) ... Certificate automation has permission modules that are designed to prevent inappropriate issuance of unbounded or wildcard certificates. When an explicit cert manager is used, no additional permission should be necessary. For example, this should be a valid caddyfile: https:// { tls { get_certificate tailscale } respond OK } This is accomplished when provisioning an AutomationPolicy by tracking whether there were explicit managers configured directly on the policy (in the ManagersRaw field). Only when a number of potentially unsafe conditions are present AND no explicit cert managers are configured is an error returned. The problem arises from the fact that ctx.LoadModule deletes the raw bytes after loading in order to save memory. The first time an AutomationPolicy is provisioned, the ManagersRaw field is populated, and everything is fine. An AutomationPolicy with no subjects is treated as a special "catch-all" policy. App.createAutomationPolicies ensures that this catch-all policy has an ACME issuer, and then calls its Provision method again because it may have changed. This second time Provision is called, ManagesRaw is no longer populated, and the permission check fails because it appears as though the policy has no explicit managers. Address this by storing a new boolean on AutomationPolicy recording whether it had explicit cert managers configured on it. Also fix an inverted boolean check on this value when setting failClosed. Updates #6060 Updates #6229 Updates #6327 Signed-off-by: Will Norris <will@tailscale.com>	2024-05-20 09:48:59 -06:00
Will Norris	1fc151faec	caddytls: remove ClientHelloSNICtxKey (#6326)	2024-05-18 22:47:46 -04:00