80 Commits

Author	SHA1	Message	Date
Francis Lavoie	6e5e08cf58	Wire up Cause for most context cancels (#7538)	2026-03-04 17:14:52 -07:00
Fardjad Davari	9798f6964d	caddyhttp: Avoid nil pointer dereference in proxyWrapper (#7521)	2026-02-25 04:08:41 -05:00
Mohammed Al Sahaf	d7b21c6104	reverseproxy: fix tls dialing w/ proxy protocol (#7508)	2026-02-21 21:37:10 -05:00
WeidiDeng	47f3e8f8dc	use math/rand/v2 instead of math/rand (#7413)	2026-02-11 09:15:51 -07:00
Francis Lavoie	2ae0f7af69	reverseproxy: Set Host to {upstream_hostport} automatically if TLS (#7454)	2026-02-09 13:06:19 -07:00
WeidiDeng	a6da1acdc8	reverse_proxy: use interfaces to modify the behaviors of the transports (#7353)	2025-11-17 09:51:37 -07:00
WeidiDeng	abe0acabb6	reverseproxy: set default values for keepalive if only some of them are set (#7318)	2025-10-25 05:15:55 -04:00
WeidiDeng	1e21b660c4	reverseproxy: use http.Protocols to handle h2c requests (#6990)	2025-10-21 16:05:43 +00:00
WeidiDeng	8aca108d2c	reverseproxy: do not disable keepalive if proxy protocol is used (#7300)	2025-10-21 05:09:37 +00:00
WeidiDeng	2ec28bca43	reverse_proxy: use http1 for outbound tls requests with placeholder that are likely websockets (#7296)	2025-10-09 10:36:49 -06:00
WeidiDeng	1c596e3c5a	reverse_proxy: use the new KeepAliveConfig to set probe interval (#7157) ... Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-08-21 14:36:54 -06:00
WeidiDeng	1209b5c566	reverseproxy: validate versions in http transport (#7112)	2025-07-09 14:13:27 -06:00
tongjicoder	5b2eb66418	Use slices.Contains to simplify code (#7039) ... Signed-off-by: tongjicoder <tongjicoder@icloud.com>	2025-05-31 12:03:06 -06:00
WeidiDeng	aa3d20be3e	reverseproxy: Use DialTLSContext if ServerName has placeholder (#6955) ... Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-04-28 09:14:09 -06:00
Mohammed Al Sahaf	737936c06b	reverseproxy: reference correct field name in LoadModule (#6978) ... Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-04-21 08:43:27 -06:00
Matt Holt	1bfa111552	caddytls: Prefer managed wildcard certs over individual subdomain certs (#6959) ... * caddytls: Prefer managed wildcard certs over individual subdomain certs * Repurpose force_automate as no_wildcard * Fix a couple bugs * Restore force_automate and use automate loader as wildcard override	2025-04-18 11:44:23 -06:00
Mohammed Al Sahaf	173573035c	core: add modular network_proxy support (#6399) ... * core: add modular `network_proxy` support Co-authored-by: @ImpostorKeanu Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * move modules around Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * add caddyfile implementation Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * address feedbcak * Apply suggestions from code review Co-authored-by: Francis Lavoie <lavofr@gmail.com> * adapt ForwardProxyURL to use the NetworkProxyRaw Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * remove redundant `url` in log Co-authored-by: Matt Holt <mholt@users.noreply.github.com> * code review Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * remove `.source` from the module ID Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> Co-authored-by: Francis Lavoie <lavofr@gmail.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-03-21 17:06:15 +00:00
Francis Lavoie	09b2cbcf4d	caddyhttp: Add MatchWithError to replace SetVar hack (#6596) ... * caddyhttp: Add `MatchWithError` to replace SetVar hack * Error in IP matchers on TLS handshake not complete * Use MatchWithError everywhere possible * Move implementations to MatchWithError versions * Looser interface checking to allow fallback * CEL factories can return RequestMatcherWithError * Clarifying comment since it's subtle that an err is returned * Return 425 Too Early status in IP matchers * Keep AnyMatch signature the same for now * Apparently Deprecated can't be all-uppercase to get IDE linting * Linter	2024-11-04 23:18:50 +00:00
Marten Seemann	a211c656f1	chore: update quic-go to v0.48.0 (#6627)	2024-10-15 09:38:10 -04:00
Francis Lavoie	2faeac0a10	chore: Use slices package where possible (#6585) ... * chore: Use slices package where possible * More, mostly using ContainsFunc * Even more slice operations	2024-09-25 14:30:56 -06:00
Kévin Dunglas	f4bf4e0097	perf: use zap's Check() to prevent useless allocs (#6560) ... * perf: use zap's Check() to prevent useless allocs * fix * fix * fix * fix * restore previous replacer behavior * fix linter	2024-09-13 11:16:37 -06:00
Mohammed Al Sahaf	4ade967005	reverseproxy: allow user to define source address (#6504) ... * reverseproxy: allow user to define source address Closes #6503 Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * reverse_proxy: caddyfile support for local_address Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2024-08-22 19:52:05 +00:00
WeidiDeng	21af88fefc	reverseproxy: Disable keep alive for h2c requests (#6343)	2024-08-08 06:53:30 -06:00
Matthew Holt	f8861ca16b	reverseproxy: Wire up TLS options for H3 transport	2024-06-28 12:15:41 -06:00
Matt Holt	5f6758dab5	reverseproxy: Support HTTP/3 transport to backend (#6312) ... Closes #5086	2024-05-20 13:06:43 -06:00
WeidiDeng	e60148ecc3	reverseproxy: Pointer to struct when loading modules; remove LazyCertPool (#6307) ... * use pointer when loading modules * change method to pointer type and remove LazyCertPool * remove lazy pool test * remove yet another lazy pool test	2024-05-08 19:13:37 -06:00
Mohammed Al Sahaf	d05d715a00	reverseproxy: HTTP transport: fix PROXY protocol initialization (#6301)	2024-05-06 20:02:12 -06:00
Aziz Rmadi	0b381eb766	reverseproxy: Implement modular CA provider for TLS transport (#6065) ... * added new modular ca providers to caddy tls HttpTransport * reverse-proxy, httptransport: added tests and caddyfile support for ca module --------- Co-authored-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2024-04-12 07:19:14 -06:00
Justin Angel	a9768d2fde	reverseproxy: Configurable forward proxy URL (#6114) ... Co-authored-by: WeidiDeng <weidi_deng@icloud.com>	2024-03-18 04:07:25 +00:00
Yolan Romailler	2fe69a828f	chore: enabling a few more linters (#5961) ... Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2024-01-25 15:24:58 +00:00
Bas Westerbaan	f658fd05ac	reverseproxy: Add tls_curves option to HTTP transport (#5851)	2024-01-13 20:56:23 +00:00
Mohammed Al Sahaf	dc12bd9743	proxyprotocol: use github.com/pires/go-proxyproto (#5915) ... * proxyprotocol: use github.com/pires/go-proxyproto * Fix typo: r/generelly/generally Co-authored-by: Francis Lavoie <lavofr@gmail.com> * add config options for `Deny` CIDR and fallback policy * use `netip` package & trust unix sockets --------- Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2023-12-13 09:07:43 -07:00
Matt Holt	b377208ede	chore: Appease gosec linter (#5777) ... These happen to be harmless memory aliasing but I guess the linter can't know that and we can't really prove it in general.	2023-08-23 20:47:54 -06:00
Jacob Gadikian	d6f86cccf5	ci: use gci linter (#5708) ... * use gofmput to format code * use gci to format imports * reconfigure gci * linter autofixes * rearrange imports a little * export GOOS=windows golangci-lint run ./... --fix	2023-08-14 09:41:15 -06:00
Matt Holt	0e2c7e1d35	caddytls: Reuse certificate cache through reloads (#5623) ... * caddytls: Don't purge cert cache on config reload * Update CertMagic This actually avoids reloading managed certs from storage when already in the cache, d'oh. * Fix bug; re-implement HasCertificateForSubject * Update go.mod: CertMagic tag	2023-07-11 19:10:58 +00:00
Corin Langosch	b6fe5d4b41	proxyprotocol: Add PROXY protocol support to reverse_proxy, add HTTP listener wrapper (#5424) ... Co-authored-by: WeidiDeng <weidi_deng@icloud.com> Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2023-03-31 17:44:53 -04:00
Mohammed Al Sahaf	e3909cc385	reverseproxy: refactor HTTP transport layer (#5369) ... Co-authored-by: Francis Lavoie <lavofr@gmail.com> Co-authored-by: Weidi Deng <weidi_deng@icloud.com>	2023-02-24 19:54:04 +00:00
Matthew Holt	e43b6d8178	core: Variadic Context.Logger(); soft deprecation ... Ideally I'd just remove the parameter to caddy.Context.Logger(), but this would break most Caddy plugins. Instead, I'm making it variadic and marking it as partially deprecated. In the future, I might completely remove the parameter once most plugins have updated.	2022-09-16 16:55:36 -06:00
Francis Lavoie	922d9f5c25	reverseproxy: Fix H2C dialer using new stdlib DialTLSContext (#4951)	2022-08-12 13:11:13 -06:00
Matt Holt	a379fa4c6c	reverseproxy: Implement read & write timeouts for HTTP transport (#4905)	2022-07-23 22:38:41 -06:00
Matthew Holt	c2bbe42fc3	reverseproxy: Export SetScheme() again ... Turns out the NTLM transport uses it. Oops.	2022-07-13 08:52:30 -06:00
Francis Lavoie	25f10511e7	reverseproxy: Fix panic when TLS is not configured (#4848) ... * reverseproxy: Fix panic when TLS is not configured * Refactor and simplify setScheme Co-authored-by: Matthew Holt <mholt@users.noreply.github.com>	2022-06-22 15:01:57 -04:00
Kiss Károly Pál	b6e96fa3c5	reverseproxy: Skip TLS for certain configured ports (#4843) ... * Make reverse proxy TLS server name replaceable for SNI upstreams. * Reverted previous TLS server name replacement, and implemented thread safe version. * Move TLS servername replacement into it's own function * Moved SNI servername replacement into httptransport. * Solve issue when dynamic upstreams use wrong protocol upstream. * Revert previous commit. Old commit was: Solve issue when dynamic upstreams use wrong protocol upstream. Id: 3c9806ccb6 * Added SkipTLSPorts option to http transport. * Fix typo in test config file. * Rename config option as suggested by Matt Co-authored-by: Matt Holt <mholt@users.noreply.github.com> * Update code to match renamed config option. * Fix typo in config option name. * Fix another typo that I missed. * Tests not completing because of apparent wrong ordering of options. Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2022-06-20 11:51:42 -06:00
Kiss Károly Pál	c82fe91104	reverseproxy: Dynamic ServerName for TLS upstreams (#4836) ... * Make reverse proxy TLS server name replaceable for SNI upstreams. * Reverted previous TLS server name replacement, and implemented thread safe version. * Move TLS servername replacement into it's own function * Moved SNI servername replacement into httptransport. * Solve issue when dynamic upstreams use wrong protocol upstream. * Revert previous commit. Old commit was: Solve issue when dynamic upstreams use wrong protocol upstream. Id: 3c9806ccb6 Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2022-06-14 21:53:05 -06:00
Matthew Holt	f9b42c3772	reverseproxy: Make TLS renegotiation optional	2022-06-14 09:05:25 -06:00
Yaacov Akiba Slama	aaf6794b31	reverseproxy: Add renegotiation param in TLS client (#4784) ... * Add renegotiation option in reverseproxy tls client * Update modules/caddyhttp/reverseproxy/httptransport.go Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2022-06-10 09:33:35 -06:00
Francis Lavoie	7f9b1f43c9	reverseproxy: Correct the tls_server_name docs (#4827) ... * reverseproxy: Correct the `tls_server_name` docs * Update modules/caddyhttp/reverseproxy/httptransport.go Co-authored-by: Matt Holt <mholt@users.noreply.github.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2022-06-06 12:37:09 -06:00
Matt Holt	57d27c1b58	reverseproxy: Support http1.1>h2c (close #4777) (#4778)	2022-05-10 17:25:58 -04:00
Matt Holt	ab0455922a	reverseproxy: Dynamic upstreams (with SRV and A/AAAA support) (#4470) ... * reverseproxy: Begin refactor to enable dynamic upstreams Streamed here: https://www.youtube.com/watch?v=hj7yzXb11jU * Implement SRV and A/AAA upstream sources Also get upstreams at every retry loop iteration instead of just once before the loop. See #4442. * Minor tweaks from review * Limit size of upstreams caches * Add doc notes deprecating LookupSRV * Provision dynamic upstreams Still WIP, preparing to preserve health checker functionality * Rejigger health checks Move active health check results into handler-specific Upstreams. Improve documentation regarding health checks and upstreams. * Deprecation notice * Add Caddyfile support, use `caddy.Duration` * Interface guards * Implement custom resolvers, add resolvers to http transport Caddyfile * SRV: fix Caddyfile `name` inline arg, remove proto condition * Use pointer receiver * Add debug logs Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2022-03-06 17:43:39 -07:00
Francis Lavoie	7557d1d922	reverseproxy: Avoid returning a nil error during GetClientCertificate (#4550)	2022-02-01 23:33:36 -07:00