1518 Commits

Author	SHA1	Message	Date
Francis Lavoie	6e5e08cf58	Wire up Cause for most context cancels (#7538)	2026-03-04 17:14:52 -07:00
Matthew Holt	fbfb8fc517	rewrite: Force recomputing path when escaped path matches rewrite target ... Thank you for the report by @MaherAzzouzi, and the suggested fix!	2026-03-04 16:18:33 -07:00
Oleh Konko | semantic verification for trust infra | LLM-augmented operations pipeline (precision-first, claim≤evidence, submit-human) | verify the payload, not the signer	566e710991	fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) (#7548)	2026-03-04 17:00:10 -05:00
Tom Paulus	a5e7c6e232	reverseproxy: prevent body close on dial-error retries (#7547)	2026-03-04 15:17:02 -05:00
Francis Lavoie	db2986028f	reverseproxy: Track dynamic upstreams, enable passive healthchecking (#7539) ... * reverseproxy: Track dynamic upstreams, enable passive healthchecking * Add tests for dynamic upstream tracking, admin endpoint, health checks	2026-03-04 15:05:26 -05:00
Sam.An	7e83775e3a	Merge commit from fork ... Only apply repl.ReplaceAll() on values from literal variable names (e.g. map outputs), not on values resolved from placeholder keys (e.g. {http.request.header.*}). The placeholder path already resolves the value via repl.Get(), so a second expansion allows user-controlled input containing {env.*} or {file.*} to be evaluated, leaking environment variables and file contents. Add regression test to verify placeholder-sourced values are not re-expanded.	2026-03-04 09:08:39 -07:00
newklei	2dbcdefbbe	forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545) ... When using copy_headers in a forward_auth block, client-supplied headers with the same names were not being removed before being forwarded to the backend. This happens because PR #6608 added a MatchNot guard that skips the Set operation when the auth service does not return a given header. That guard prevents setting headers to empty strings, which is the correct behavior, but it also means a client can send X-User-Id: admin in their request and if the auth service validates the token without returning X-User-Id, Caddy skips the Set and the client value passes through unchanged to the backend. The fix adds an unconditional delete route for each copy_headers entry, placed just before the existing conditional set route. The delete always runs regardless of what the auth service returns. The conditional set still only runs when the auth service provides that header. The end result is: - Client-supplied headers are always removed - When the auth service returns the header, the backend gets that value - When the auth service does not return the header, the backend sees nothing Existing behavior is unchanged for any deployment where the auth service returns all of the configured copy_headers entries. Fixes GHSA-7r4p-vjf4-gxv4	2026-03-03 23:30:49 -05:00
Varun Chawla	dc36082859	caddyhttp: Collect metrics once per route instead of per handler (#7492) ... * perf: collect metrics once per route instead of per handler (#4644) Move Prometheus metrics instrumentation from the per-handler level to the per-route level. Previously, every middleware handler in a route was individually wrapped with metricsInstrumentedHandler, causing metrics to be collected N times per request (once per handler in the chain). Since all handlers in a route see the same request, these per-handler metrics were redundant and added significant CPU overhead (73% of request handling time per the original profiling). The fix introduces metricsInstrumentedRoute which wraps the entire compiled handler chain once in wrapRoute, collecting metrics only when the route actually matches. The handler label uses the first handler's module name, which is the most meaningful identifier for the route. Benchmark results (5 handlers per route): Old (per-handler): ~4650 ns/op, 4400 B/op, 45 allocs/op New (per-route): ~940 ns/op, 816 B/op, 8 allocs/op Improvement: ~5x faster, ~5.4x less memory, ~5.6x fewer allocs Signed-off-by: Varun Chawla <varun_6april@hotmail.com> * Remove unused metricsInstrumentedHandler code Delete the metricsInstrumentedHandler type, its constructor, and ServeHTTP method since they are no longer used after switching to route-level metrics collection via metricsInstrumentedRoute. Also remove the unused metrics parameter from wrapMiddleware and the middlewareHandlerFunc test helper, and convert existing tests to use the new route-level API. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Address review feedback: restore comments, move function to bottom - Move computeApproximateRequestSize back to bottom of file to minimize diff - Restore all useful comments that were accidentally dropped - Old metricsInstrumentedHandler already removed in previous commit --------- Signed-off-by: Varun Chawla <varun_6april@hotmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 15:15:55 -07:00
Paulo Henrique	88616e86e6	api: Add all in-flight requests /reverse_proxy/upstreams (Fixes #7277) (#7517) ... This refactors the initial approach in PR #7281, replacing the UsagePool with a dedicated package-level sync.Map and atomic.Int64 to track in-flight requests without global lock contention. It also introduces a lookup map in the admin API to fix a potential O(n^2) iteration over upstreams, ensuring that draining upstreams are correctly exposed across config reloads without leaking memory. Co-authored-by: Y.Horie <u5.horie@gmail.com> reverseproxy: optimize in-flight tracking and admin API - Replaced sync.RWMutex with sync.Map and atomic.Int64 to avoid lock contention under high RPS. - Introduced a lookup map in the admin API to fix a potential O(n^2) iteration over upstreams.	2026-03-03 15:14:55 -07:00
Francis Lavoie	d935a6956c	autohttps: Ensure CertMagic config is recreated after autohttps runs (#7510)	2026-03-03 14:44:06 -07:00
Akın Demirci	11b56c6cfc	reverseproxy: Fix health_port being ignored in health checks (#7533)	2026-03-03 13:10:54 -05:00
WeidiDeng	2ab043b890	reverseproxy: query escape request urls when proxy protocol is enabled (#7537)	2026-03-02 02:04:06 -05:00
Pavel Siomachkin	f145bce553	tls: Add tls_resolvers global option for DNS challenge configuration (#7297) ... Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2026-03-01 15:32:04 -05:00
Matt Holt	174fa2ddb9	caddyhttp: Evaluate tls.client placeholders more accurately (fix #7530) (#7534)	2026-02-28 22:03:18 -07:00
Matthew Holt	06a05e383c	Revert "encode: Implement Flush for legacy compatibility" ... This reverts commit bdcdaf77ba6276b5ead20fa2518e00391150523d.	2026-02-27 14:14:19 -07:00
Matthew Holt	eac02ee98f	caddyhttp: Limit empty Host check to HTTP/1.1	2026-02-27 10:22:39 -07:00
Oleksandr Redko	72eaf2583a	chore: Enable modernize linter (#7519)	2026-02-26 14:01:35 -07:00
Fardjad Davari	9798f6964d	caddyhttp: Avoid nil pointer dereference in proxyWrapper (#7521)	2026-02-25 04:08:41 -05:00
Francis Lavoie	9873752978	logging: Support zstd roll compression (#7515)	2026-02-23 16:04:45 -07:00
Dean Ruina	294dfff443	logging: add DirMode options and propagate FileMode to rotations (#7335) ... Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2026-02-23 07:27:27 +00:00
Paulo Henrique	76b198f586	http: Sort auto-HTTPS redirect routes by host specificity (fixes #7390) (#7502)	2026-02-21 21:42:40 -05:00
Mohammed Al Sahaf	d7b21c6104	reverseproxy: fix tls dialing w/ proxy protocol (#7508)	2026-02-21 21:37:10 -05:00
Matthew Holt	cb436f0a0e	fileserver: Fix tests on Windows	2026-02-20 11:46:45 -07:00
Matt Holt	a1081194bf	Merge commit from fork ... Necessary as otherwise the early-bail in `until = strings.IndexByte(remaining, nextCh) ... if until == -1` can cause a case-insensitive mismatch Co-authored-by: Asim Viladi Oglu Manizada <manizada@users.noreply.github.com>	2026-02-20 10:54:50 -07:00
Asim Viladi Oglu Manizada	eec32a0bb5	Merge commit from fork ... Normalize exact hosts at provisioning and reqHost in the fast path so case-different Host variants can’t bypass host-gated routes. Co-authored-by: Asim Viladi Oglu Manizada <manizada@users.noreply.github.com>	2026-02-20 10:19:42 -07:00
Matthew Holt	a2825c5dd9	fileserver: Replace \ with \\ in file matcher paths	2026-02-19 13:18:14 -07:00
Matt Holt	95941a71e8	chore: Add nolints to work around haywire linters (#7493) ... * chore: Add nolints to work around haywire linters * More lint wrangling	2026-02-17 16:52:54 -07:00
Matthew Holt	bdcdaf77ba	encode: Implement Flush for legacy compatibility ... (By sponsor request)	2026-02-16 15:59:10 -07:00
Francis Lavoie	9fe694c79c	caddytls: Enable debug logging for DNSManager (#7491)	2026-02-16 15:38:56 -07:00
wangjingcun	b8b00d9160	chore: fix some comments to improve readability (#7395) ... Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2026-02-16 19:41:21 +00:00
zjumathcode	68d50020ee	refactor: use strings.Builder to improve performance (#7364) ... * refactor: use strings.Builder to improve performance Signed-off-by: zjumathcode <pai314159@2980.com> * refactor: small builder improvements per review (WriteByte / split writes) also revert builder change in client_test.go refactor(logging): build IP mask output via join of parts (more efficient) --------- Signed-off-by: zjumathcode <pai314159@2980.com> Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2026-02-16 19:30:44 +00:00
Mohammed Al Sahaf	23d07ac89d	dep: upgrade cel-go (#7478) ... * dep: upgrade cel-go Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * Try handling `map[any]any`, fix error messages --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2026-02-16 18:25:49 +00:00
Francis Lavoie	d64c7e67a4	caddyhttp: Option to disable 0-RTT (#7485)	2026-02-16 10:20:47 -07:00
Francis Lavoie	ff4f79aebe	chore: Remove obsolete comment in ech.go (#7487)	2026-02-16 10:17:01 -07:00
Amirhf	affbb99275	pki: add per-CA configurable maintenance_interval and renewal_window_ratio (#7479) ... * pki: add per-CA configurable maintenance_interval and renewal_window_ratio - Add MaintenanceInterval and RenewalWindowRatio to CA struct (JSON + Caddyfile). - Run one maintenance goroutine per CA using its own interval. - needsRenewal uses per-CA RenewalWindowRatio; invalid/zero ratio falls back to defaults. - Caddyfile: maintenance_interval duration, renewal_window_ratio <0-1>. - Tests: TestCA_needsRenewal, TestParsePKIApp for new options. Fixes #7475 * fix codestyle	2026-02-15 09:10:12 -05:00
moscowchill	d42d39b4bc	caddytls: Return errors instead of nil in client auth provisioning (#7464) ... Two error returns in ClientAuthentication.provision() were returning nil instead of the actual error, silently swallowing failures when converting PEM files to DER and when provisioning the CA pool. This could cause mTLS client authentication to silently fall back to the system trust store, accepting any client certificate signed by a public CA instead of restricting to the configured trust anchors.	2026-02-12 08:42:54 -07:00
Oleh Konko | trust infra security audit & contribution | deterministic ai-augmented pipeline · human-verified	0188ef2e62	acmeserver: warn when policy rules unset (#7469)	2026-02-11 11:54:51 -07:00
WeidiDeng	47f3e8f8dc	use math/rand/v2 instead of math/rand (#7413)	2026-02-11 09:15:51 -07:00
XYenon	03e6e439dd	reverseproxy: fix X-Forwarded-* headers for Unix socket requests (#7463) ... When a request arrives via a Unix domain socket (RemoteAddr == "@"), net.SplitHostPort fails, causing addForwardedHeaders to strip all X-Forwarded-* headers even when the connection is trusted via trusted_proxies_unix. Handle Unix socket connections before parsing RemoteAddr: if untrusted, strip headers for security; if trusted, let clientIP remain empty (no peer IP for a Unix socket hop) and fall through to the shared header logic, preserving the existing XFF chain without appending a spurious entry. Amp-Thread-ID: https://ampcode.com/threads/T-019c4225-a0ad-7283-ac56-e2c01eae1103 Co-authored-by: Amp <amp@ampcode.com>	2026-02-10 13:00:20 -07:00
Kévin Dunglas	7c28c0c07a	Merge commit from fork ... * fix: FastCGI split SCRIPT_NAME/PATH_INFO confusion * fix comment	2026-02-10 11:52:36 -07:00
Matthew Holt	1f43e8566b	caddyhttp: Use case-insensitive comparison for large Host lists	2026-02-09 14:18:55 -07:00
Matthew Holt	bd374ca9d7	caddyhttp: Lowercase comparison when matching with escape sequence	2026-02-09 13:12:00 -07:00
Francis Lavoie	2ae0f7af69	reverseproxy: Set Host to {upstream_hostport} automatically if TLS (#7454)	2026-02-09 13:06:19 -07:00
Matthew Holt	e0f8d9b204	caddytls: Check type assertion ... Fix https://github.com/mholt/caddy-l4/issues/378	2026-02-03 13:59:53 -07:00
Matthew Holt	3bb22672f9	reverseproxy: Customizable dial network for SRV upstreams ... By request of a sponsor	2026-02-02 11:25:51 -07:00
Matthew Holt	935b09de83	caddtls: Skip .ts.net domains for ECH (#6971) ... As it is also a special case in our automatic HTTPS.	2026-01-30 12:24:59 -07:00
Matthew Holt	7d24124430	caddyhttp: Reject invalid Host header (fix #7449)	2026-01-30 12:24:16 -07:00
Paulo Henrique	565c1c3054	autohttps: deterministic logic and strict bind checking on Linux (#7435) ... * http: fix non-deterministic auto-https and improve Linux bind matching * docs: restore historical context about Linux bind behavior	2026-01-16 08:51:23 -07:00
Mohammed Al Sahaf	e40bd019ff	caddyfile: add observe_catchall_hosts option (#7434) ... * caddyfile: add `observe_catchall_hosts` option Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * correct JSON field name and doc comment Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2026-01-14 00:06:16 +00:00
Paulo Henrique	62134d65af	reverseproxy: fix error when remote address is not an IP (#7429)	2026-01-13 19:52:56 +00:00