mirror of
https://github.com/caddyserver/caddy.git
synced 2026-05-25 16:22:36 -04:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Matthew Holt
|
780640d1e7 |
+7
-12
@@ -1,14 +1,15 @@
|
||||
# Security Policy
|
||||
|
||||
The Caddy project would like to make sure that it stays on top of all relevant and practically-exploitable vulnerabilities.
|
||||
The Caddy project would like to make sure that it stays on top of all practically-exploitable vulnerabilities.
|
||||
|
||||
|
||||
## Supported Versions
|
||||
|
||||
| Version | Supported |
|
||||
| ----------- | ----------|
|
||||
| 2.latest | ✔️ |
|
||||
| < 2.latest | :x: |
|
||||
| Version | Supported |
|
||||
| -------- | ----------|
|
||||
| 2.latest | ✔️ |
|
||||
| 1.x | :x: |
|
||||
| < 1.x | :x: |
|
||||
|
||||
|
||||
## Acceptable Scope
|
||||
@@ -17,7 +18,7 @@ A security report must demonstrate a security bug in the source code from this r
|
||||
|
||||
Some security problems are the result of interplay between different components of the Web, rather than a vulnerability in the web server itself. Please only report vulnerabilities in the web server itself, as we cannot coerce the rest of the Web to be fixed (for example, we do not consider IP spoofing, BGP hijacks, or missing/misconfigured HTTP headers a vulnerability in the Caddy web server).
|
||||
|
||||
Vulnerabilities caused by misconfigurations are out of scope. Yes, it is entirely possible to craft and use a configuration that is unsafe, just like with every other web server; we recommend against doing that. Similarly, external misconfigurations are out of scope. For example, an open or forwarded port from a public network to a Caddy instance intended to serve only internal clients is not a vulnerability in Caddy.
|
||||
Vulnerabilities caused by misconfigurations are out of scope. Yes, it is entirely possible to craft and use a configuration that is unsafe, just like with every other web server; we recommend against doing that.
|
||||
|
||||
We do not accept reports if the steps imply or require a compromised system or third-party software, as we cannot control those. We expect that users secure their own systems and keep all their software patched. For example, if untrusted users are able to upload/write/host arbitrary files in the web root directory, it is NOT a security bug in Caddy if those files get served to clients; however, it _would_ be a valid report if a bug in Caddy's source code unintentionally gave unauthorized users the ability to upload unsafe files or delete files without relying on an unpatched system or piece of software.
|
||||
|
||||
@@ -25,10 +26,6 @@ Client-side exploits are out of scope. In other words, it is not a bug in Caddy
|
||||
|
||||
Security bugs in code dependencies (including Go's standard library) are out of scope. Instead, if a dependency has patched a relevant security bug, please feel free to open a public issue or pull request to update that dependency in our code.
|
||||
|
||||
Many reports are not security bugs and can be addressed by updating the documentation.
|
||||
|
||||
We accept security reports and patches, but do not assign CVEs, for code that has not been released with a non-prerelease tag.
|
||||
|
||||
|
||||
## Reporting a Vulnerability
|
||||
|
||||
@@ -36,8 +33,6 @@ We get a lot of difficult reports that turn out to be invalid. Clear, obvious re
|
||||
|
||||
First please ensure your report falls within the accepted scope of security bugs (above).
|
||||
|
||||
:warning: **YOU MUST DISCLOSE WHETHER YOU USED LLMs ("AI") IN ANY WAY.** Whether you are using AI for discovery, as part of writing the report or its replies, and/or testing or validating proofs and changes, we require you to mention the extent of it. **FAILURE TO INCLUDE A DISCLOSURE EVEN IF YOU DO NOT USE AI MAY LEAD TO IMMEDIATE DISMISSAL OF YOUR REPORT AND POTENTIAL BLOCKLISTING.** We will not waste our time chatting with bots. But if you're a human, pull up a chair and we'll drink some chocolate milk.
|
||||
|
||||
We'll need enough information to verify the bug and make a patch. To speed things up, please include:
|
||||
|
||||
- Most minimal possible config (without redactions!)
|
||||
|
||||
@@ -16,8 +16,8 @@ jobs:
|
||||
models: read
|
||||
contents: read
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
|
||||
- uses: github/ai-moderator@81159c370785e295c97461ade67d7c33576e9319
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
|
||||
- uses: github/ai-moderator@6bcdb2a79c2e564db8d76d7d4439d91a044c4eb6
|
||||
with:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
spam-label: 'spam'
|
||||
|
||||
+15
-15
@@ -31,13 +31,13 @@ jobs:
|
||||
- mac
|
||||
- windows
|
||||
go:
|
||||
- '1.26'
|
||||
- '1.25'
|
||||
|
||||
include:
|
||||
# Set the minimum Go patch version for the given Go minor
|
||||
# Usable via ${{ matrix.GO_SEMVER }}
|
||||
- go: '1.26'
|
||||
GO_SEMVER: '~1.26.0'
|
||||
- go: '1.25'
|
||||
GO_SEMVER: '~1.25.0'
|
||||
|
||||
# Set some variables per OS, usable via ${{ matrix.VAR }}
|
||||
# OS_LABEL: the VM label from GitHub Actions (see https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#standard-github-hosted-runners-for-public-repositories)
|
||||
@@ -65,15 +65,15 @@ jobs:
|
||||
actions: write # to allow uploading artifacts and cache
|
||||
steps:
|
||||
- name: Harden the runner (Audit all outbound calls)
|
||||
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
|
||||
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
||||
|
||||
- name: Install Go
|
||||
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
|
||||
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
|
||||
with:
|
||||
go-version: ${{ matrix.GO_SEMVER }}
|
||||
check-latest: true
|
||||
@@ -120,7 +120,7 @@ jobs:
|
||||
./caddy stop
|
||||
|
||||
- name: Publish Build Artifact
|
||||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||||
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
||||
with:
|
||||
name: caddy_${{ runner.os }}_go${{ matrix.go }}_${{ steps.vars.outputs.short_sha }}
|
||||
path: ${{ matrix.CADDY_BIN_PATH }}
|
||||
@@ -162,13 +162,13 @@ jobs:
|
||||
continue-on-error: true # August 2020: s390x VM is down due to weather and power issues
|
||||
steps:
|
||||
- name: Harden the runner (Audit all outbound calls)
|
||||
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
|
||||
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
|
||||
with:
|
||||
egress-policy: audit
|
||||
allowed-endpoints: ci-s390x.caddyserver.com:22
|
||||
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
||||
- name: Run Tests
|
||||
run: |
|
||||
set +e
|
||||
@@ -221,27 +221,27 @@ jobs:
|
||||
if: github.event.pull_request.head.repo.full_name == 'caddyserver/caddy' && github.actor != 'dependabot[bot]'
|
||||
steps:
|
||||
- name: Harden the runner (Audit all outbound calls)
|
||||
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
|
||||
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
||||
|
||||
- uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
|
||||
- uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
|
||||
with:
|
||||
version: latest
|
||||
args: check
|
||||
- name: Install Go
|
||||
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
|
||||
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
|
||||
with:
|
||||
go-version: "~1.26"
|
||||
go-version: "~1.25"
|
||||
check-latest: true
|
||||
- name: Install xcaddy
|
||||
run: |
|
||||
go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
|
||||
xcaddy version
|
||||
- uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
|
||||
- uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
|
||||
with:
|
||||
version: latest
|
||||
args: build --single-target --snapshot
|
||||
|
||||
@@ -36,13 +36,13 @@ jobs:
|
||||
- 'darwin'
|
||||
- 'netbsd'
|
||||
go:
|
||||
- '1.26'
|
||||
- '1.25'
|
||||
|
||||
include:
|
||||
# Set the minimum Go patch version for the given Go minor
|
||||
# Usable via ${{ matrix.GO_SEMVER }}
|
||||
- go: '1.26'
|
||||
GO_SEMVER: '~1.26.0'
|
||||
- go: '1.25'
|
||||
GO_SEMVER: '~1.25.0'
|
||||
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
@@ -51,15 +51,15 @@ jobs:
|
||||
continue-on-error: true
|
||||
steps:
|
||||
- name: Harden the runner (Audit all outbound calls)
|
||||
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
|
||||
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
||||
|
||||
- name: Install Go
|
||||
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
|
||||
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
|
||||
with:
|
||||
go-version: ${{ matrix.GO_SEMVER }}
|
||||
check-latest: true
|
||||
|
||||
+10
-10
@@ -45,18 +45,18 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Harden the runner (Audit all outbound calls)
|
||||
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
|
||||
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
||||
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
|
||||
with:
|
||||
go-version: '~1.26'
|
||||
go-version: '~1.25'
|
||||
check-latest: true
|
||||
|
||||
- name: golangci-lint
|
||||
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
|
||||
uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
|
||||
with:
|
||||
version: latest
|
||||
|
||||
@@ -73,14 +73,14 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Harden the runner (Audit all outbound calls)
|
||||
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
|
||||
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- name: govulncheck
|
||||
uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
|
||||
with:
|
||||
go-version-input: '~1.26.0'
|
||||
go-version-input: '~1.25.0'
|
||||
check-latest: true
|
||||
|
||||
dependency-review:
|
||||
@@ -90,14 +90,14 @@ jobs:
|
||||
pull-requests: write
|
||||
steps:
|
||||
- name: Harden the runner (Audit all outbound calls)
|
||||
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
|
||||
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- name: 'Checkout Repository'
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
||||
- name: 'Dependency Review'
|
||||
uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803 # v4.8.3
|
||||
uses: actions/dependency-review-action@56339e523c0409420f6c2c9a2f4292bbb3c07dd3 # v4.8.0
|
||||
with:
|
||||
comment-summary-in-pr: on-failure
|
||||
# https://github.com/actions/dependency-review-action/issues/430#issuecomment-1468975566
|
||||
|
||||
@@ -28,11 +28,11 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Harden the runner (Audit all outbound calls)
|
||||
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
|
||||
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
|
||||
with:
|
||||
egress-policy: audit
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
|
||||
@@ -28,7 +28,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
||||
with:
|
||||
fetch-depth: 0
|
||||
# Force fetch upstream tags -- because 65 minutes
|
||||
@@ -334,13 +334,13 @@ jobs:
|
||||
os:
|
||||
- ubuntu-latest
|
||||
go:
|
||||
- '1.26'
|
||||
- '1.25'
|
||||
|
||||
include:
|
||||
# Set the minimum Go patch version for the given Go minor
|
||||
# Usable via ${{ matrix.GO_SEMVER }}
|
||||
- go: '1.26'
|
||||
GO_SEMVER: '~1.26.0'
|
||||
- go: '1.25'
|
||||
GO_SEMVER: '~1.25.0'
|
||||
|
||||
runs-on: ${{ matrix.os }}
|
||||
# https://github.com/sigstore/cosign/issues/1258#issuecomment-1002251233
|
||||
@@ -355,23 +355,23 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Harden the runner (Audit all outbound calls)
|
||||
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
|
||||
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Install Go
|
||||
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
|
||||
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
|
||||
with:
|
||||
go-version: ${{ matrix.GO_SEMVER }}
|
||||
check-latest: true
|
||||
|
||||
# Force fetch upstream tags -- because 65 minutes
|
||||
# tl;dr: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2 runs this line:
|
||||
# tl;dr: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4.2.2 runs this line:
|
||||
# git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +ebc278ec98bb24f2852b61fde2a9bf2e3d83818b:refs/tags/
|
||||
# which makes its own local lightweight tag, losing all the annotations in the process. Our earlier script ran:
|
||||
# git fetch --prune --unshallow
|
||||
@@ -419,7 +419,7 @@ jobs:
|
||||
- name: Cosign version
|
||||
run: cosign version
|
||||
- name: Install Syft
|
||||
uses: anchore/sbom-action/download-syft@17ae1740179002c89186b61233e0f892c3118b11 # main
|
||||
uses: anchore/sbom-action/download-syft@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # main
|
||||
- name: Syft version
|
||||
run: syft version
|
||||
- name: Install xcaddy
|
||||
@@ -428,7 +428,7 @@ jobs:
|
||||
xcaddy version
|
||||
# GoReleaser will take care of publishing those artifacts into the release
|
||||
- name: Run GoReleaser
|
||||
uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
|
||||
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
|
||||
with:
|
||||
version: latest
|
||||
args: release --clean --timeout 60m
|
||||
|
||||
@@ -24,12 +24,12 @@ jobs:
|
||||
|
||||
# See https://github.com/peter-evans/repository-dispatch
|
||||
- name: Harden the runner (Audit all outbound calls)
|
||||
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
|
||||
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- name: Trigger event on caddyserver/dist
|
||||
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
|
||||
uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4.0.0
|
||||
with:
|
||||
token: ${{ secrets.REPO_DISPATCH_TOKEN }}
|
||||
repository: caddyserver/dist
|
||||
@@ -37,7 +37,7 @@ jobs:
|
||||
client-payload: '{"tag": "${{ github.event.release.tag_name }}"}'
|
||||
|
||||
- name: Trigger event on caddyserver/caddy-docker
|
||||
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
|
||||
uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4.0.0
|
||||
with:
|
||||
token: ${{ secrets.REPO_DISPATCH_TOKEN }}
|
||||
repository: caddyserver/caddy-docker
|
||||
|
||||
@@ -37,12 +37,12 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Harden the runner (Audit all outbound calls)
|
||||
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
|
||||
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
|
||||
with:
|
||||
egress-policy: audit
|
||||
|
||||
- name: "Checkout code"
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
@@ -72,7 +72,7 @@ jobs:
|
||||
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
|
||||
# format to the repository Actions tab.
|
||||
- name: "Upload artifact"
|
||||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||||
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
||||
with:
|
||||
name: SARIF file
|
||||
path: results.sarif
|
||||
@@ -81,6 +81,6 @@ jobs:
|
||||
# Upload the results to GitHub's code scanning dashboard (optional).
|
||||
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
|
||||
- name: "Upload to code-scanning"
|
||||
uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5
|
||||
uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.29.5
|
||||
with:
|
||||
sarif_file: results.sarif
|
||||
|
||||
@@ -32,7 +32,6 @@ linters:
|
||||
- importas
|
||||
- ineffassign
|
||||
- misspell
|
||||
- modernize
|
||||
- prealloc
|
||||
- promlinter
|
||||
- sloglint
|
||||
|
||||
+1
-3
@@ -13,7 +13,7 @@ before:
|
||||
- cp cmd/caddy/main.go caddy-build/main.go
|
||||
- /bin/sh -c 'cd ./caddy-build && go mod init caddy'
|
||||
# prepare syso files for windows embedding
|
||||
- /bin/sh -c 'for a in amd64 arm64; do XCADDY_SKIP_BUILD=1 GOOS=windows GOARCH=$a xcaddy build {{.Env.TAG}}; done'
|
||||
- /bin/sh -c 'for a in amd64 arm arm64; do XCADDY_SKIP_BUILD=1 GOOS=windows GOARCH=$a xcaddy build {{.Env.TAG}}; done'
|
||||
- /bin/sh -c 'mv /tmp/buildenv_*/*.syso caddy-build'
|
||||
# GoReleaser doesn't seem to offer {{.Tag}} at this stage, so we have to embed it into the env
|
||||
# so we run: TAG=$(git describe --abbrev=0) goreleaser release --rm-dist --skip-publish --skip-validate
|
||||
@@ -67,8 +67,6 @@ builds:
|
||||
goarch: s390x
|
||||
- goos: windows
|
||||
goarch: riscv64
|
||||
- goos: windows
|
||||
goarch: arm
|
||||
- goos: freebsd
|
||||
goarch: ppc64le
|
||||
- goos: freebsd
|
||||
|
||||
@@ -1,217 +0,0 @@
|
||||
# Caddy Project Guidelines
|
||||
|
||||
## Mission
|
||||
|
||||
**Every site on HTTPS.** Caddy is a security-first, modular, extensible server platform.
|
||||
|
||||
## Code Style
|
||||
|
||||
### Go Idioms
|
||||
|
||||
Follow [Go Code Review Comments](https://go.dev/wiki/CodeReviewComments):
|
||||
|
||||
- **Error flow**: Early return, indent error handling—not else blocks
|
||||
```go
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
// normal code
|
||||
```
|
||||
- **Naming**: initialisms (`URL`, `HTTP`, `ID`—not `Url`, `Http`, `Id`)
|
||||
- **Receiver names**: 1–2 letters reflecting type (`c` for `Client`, `h` for `Handler`)
|
||||
- **Error strings**: Lowercase, no trailing punctuation (`"something failed"` not `"Something failed."`)
|
||||
- **Doc comments**: Full sentences starting with the name being documented
|
||||
```go
|
||||
// Handler serves HTTP requests for the file server.
|
||||
type Handler struct { ... }
|
||||
```
|
||||
- **Empty slices**: `var t []string` (nil slice), not `t := []string{}` (non-nil zero-length)
|
||||
- **Don't panic**: Use error returns for normal error handling
|
||||
|
||||
### Caddy Patterns
|
||||
|
||||
**Module registration**:
|
||||
```go
|
||||
func init() {
|
||||
caddy.RegisterModule(MyModule{})
|
||||
}
|
||||
|
||||
func (MyModule) CaddyModule() caddy.ModuleInfo {
|
||||
return caddy.ModuleInfo{
|
||||
ID: "namespace.category.name",
|
||||
New: func() caddy.Module { return new(MyModule) },
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Module lifecycle**: `New()` → JSON unmarshal → `Provision()` → `Validate()` → use → `Cleanup()`
|
||||
|
||||
**Interface guards** — compile-time verification that modules implement required interfaces:
|
||||
```go
|
||||
var (
|
||||
_ caddy.Provisioner = (*MyModule)(nil)
|
||||
_ caddy.Validator = (*MyModule)(nil)
|
||||
_ caddyfile.Unmarshaler = (*MyModule)(nil)
|
||||
)
|
||||
```
|
||||
|
||||
**Structured logging** — use the module-scoped logger from context:
|
||||
```go
|
||||
func (m *MyModule) Provision(ctx caddy.Context) error {
|
||||
m.logger = ctx.Logger()
|
||||
m.logger.Debug("provisioning", zap.String("field", m.Field))
|
||||
return nil
|
||||
}
|
||||
```
|
||||
|
||||
**Caddyfile support** — implement `UnmarshalCaddyfile(*caddyfile.Dispenser)` using the `Dispenser` API:
|
||||
```go
|
||||
// UnmarshalCaddyfile sets up the module from Caddyfile tokens. Syntax:
|
||||
//
|
||||
// directive [arg1] [arg2] {
|
||||
// subdir value
|
||||
// }
|
||||
func (m *MyModule) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
d.Next() // consume directive name
|
||||
for d.NextArg() {
|
||||
// handle inline arguments
|
||||
}
|
||||
for nesting := d.Nesting(); d.NextBlock(nesting); {
|
||||
switch d.Val() {
|
||||
case "subdir":
|
||||
if !d.NextArg() {
|
||||
return d.ArgErr()
|
||||
}
|
||||
m.Field = d.Val()
|
||||
default:
|
||||
return d.Errf("unrecognized subdirective: %s", d.Val())
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
```
|
||||
|
||||
**Admin API**: Implement `caddy.AdminRouter` for custom endpoints.
|
||||
|
||||
**Context**: Use `caddy.Context` for accessing other apps/modules and logging—don't store contexts in structs.
|
||||
|
||||
## Architecture
|
||||
|
||||
Caddy is built around a **module system** where everything is a module registered via `caddy.RegisterModule()`:
|
||||
|
||||
- **Apps** (`caddy.App`): Top-level modules like `http`, `tls`, `pki` that Caddy loads and runs
|
||||
- **Modules** (`caddy.Module`): Extensible components with namespaced IDs (e.g., `http.handlers.file_server`)
|
||||
- **Configuration**: Native JSON with adapters (Caddyfile → JSON via `caddyconfig/httpcaddyfile`)
|
||||
|
||||
| Directory | Purpose |
|
||||
|-----------|---------|
|
||||
| `modules/` | All standard modules (HTTP, TLS, PKI, etc.) |
|
||||
| `modules/standard/imports.go` | Standard module registry |
|
||||
| `caddyconfig/httpcaddyfile/` | Caddyfile → JSON adapter for HTTP |
|
||||
| `caddytest/` | Test utilities and integration tests |
|
||||
| `cmd/caddy/` | CLI entry point with module imports |
|
||||
|
||||
### Critical Packages
|
||||
|
||||
`caddyhttp` and `caddytls` require **extra scrutiny** in code review—these are security-critical.
|
||||
|
||||
## Quality Gates
|
||||
|
||||
|
||||
**All required before PR is merge-ready:**
|
||||
|
||||
| Gate | Command | Notes |
|
||||
|------|---------|-------|
|
||||
| Tests pass | `go test -race -short ./...` | Race detection enabled |
|
||||
| Lint clean | `golangci-lint run --timeout 10m` | No warnings in changed files |
|
||||
| Builds | `go build ./...` | Must compile |
|
||||
| Benchmarks | `go test -bench=. -benchmem` | Required for optimizations |
|
||||
|
||||
CI runs tests on **Linux, macOS, and Windows**—ensure cross-platform compatibility.
|
||||
|
||||
### Build & Test
|
||||
|
||||
```bash
|
||||
# Build
|
||||
cd cmd/caddy && go build
|
||||
|
||||
# Tests with race detection (matches CI)
|
||||
go test -race -short ./...
|
||||
|
||||
# Integration tests
|
||||
go test ./caddytest/integration/...
|
||||
|
||||
# Lint (matches CI)
|
||||
golangci-lint run --timeout 10m
|
||||
```
|
||||
|
||||
## Testing Conventions
|
||||
|
||||
**Table-driven tests** (preferred pattern):
|
||||
```go
|
||||
func TestFeature(t *testing.T) {
|
||||
for i, tc := range []struct {
|
||||
input string
|
||||
expected string
|
||||
wantErr bool
|
||||
}{
|
||||
{input: "valid", expected: "result", wantErr: false},
|
||||
{input: "invalid", expected: "", wantErr: true},
|
||||
} {
|
||||
actual, err := Function(tc.input)
|
||||
if tc.wantErr && err == nil {
|
||||
t.Errorf("Test %d: expected error but got none", i)
|
||||
}
|
||||
if !tc.wantErr && err != nil {
|
||||
t.Errorf("Test %d: unexpected error: %v", i, err)
|
||||
}
|
||||
if actual != tc.expected {
|
||||
t.Errorf("Test %d: expected %q, got %q", i, tc.expected, actual)
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Integration tests** use `caddytest.Tester`:
|
||||
```go
|
||||
func TestHTTPFeature(t *testing.T) {
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(`
|
||||
{
|
||||
admin localhost:2999
|
||||
http_port 9080
|
||||
}
|
||||
localhost:9080 {
|
||||
respond "hello"
|
||||
}`, "caddyfile")
|
||||
|
||||
tester.AssertGetResponse("http://localhost:9080/", 200, "hello")
|
||||
}
|
||||
```
|
||||
|
||||
Use non-standard ports (9080, 9443, 2999) to avoid conflicts with running servers.
|
||||
|
||||
## AI Contribution Policy
|
||||
|
||||
Per [CONTRIBUTING.md](.github/CONTRIBUTING.md), AI-assisted code **MUST** be:
|
||||
|
||||
1. **Disclosed** — Tell reviewers when code was AI-generated or AI-assisted, mentioning which agent/model is used
|
||||
2. **Fully comprehended** — You must be able to explain every line
|
||||
3. **Tested** — Automated tests when feasible, thorough manual tests otherwise
|
||||
4. **Licensed** — Verify AI output doesn't include plagiarized or incompatibly-licensed code
|
||||
5. **Contributor License Agreement (CLA)** — The CLA must be signed by the human user
|
||||
|
||||
**Do NOT submit code you cannot fully explain.** Contributors are responsible for their submissions.
|
||||
|
||||
## Dependencies
|
||||
|
||||
- **Avoid new dependencies** — Justify any additions; tiny deps can be inlined
|
||||
- **No exported dependency types** — Caddy must not export types defined by external packages
|
||||
- Use Go modules; check with `go mod tidy`
|
||||
|
||||
## Further Reading
|
||||
|
||||
- [CONTRIBUTING.md](.github/CONTRIBUTING.md) — Full PR process and expectations
|
||||
- [Extending Caddy](https://caddyserver.com/docs/extending-caddy) — Module development guide
|
||||
- [JSON Config](https://caddyserver.com/docs/json/) — Native configuration reference
|
||||
- [Caddyfile](https://caddyserver.com/docs/caddyfile/concepts) — Caddyfile syntax guide
|
||||
@@ -220,6 +220,6 @@ Matthew Holt began developing Caddy in 2014 while studying computer science at B
|
||||
- _Project on X: [@caddyserver](https://x.com/caddyserver)_
|
||||
- _Author on X: [@mholt6](https://x.com/mholt6)_
|
||||
|
||||
Caddy is a project of [ZeroSSL](https://zerossl.com), an HID Global company.
|
||||
Caddy is a project of [ZeroSSL](https://zerossl.com), a Stack Holdings company.
|
||||
|
||||
Debian package repository hosting is graciously provided by [Cloudsmith](https://cloudsmith.com). Cloudsmith is the only fully hosted, cloud-native, universal package management solution, that enables your organization to create, store and share packages in any format, to any place, with total confidence.
|
||||
|
||||
@@ -45,16 +45,8 @@ import (
|
||||
"github.com/prometheus/client_golang/prometheus"
|
||||
"go.uber.org/zap"
|
||||
"go.uber.org/zap/zapcore"
|
||||
|
||||
"github.com/caddyserver/caddy/v2/internal"
|
||||
)
|
||||
|
||||
// testCertMagicStorageOverride is a package-level test hook. Tests may set
|
||||
// this variable to provide a temporary certmagic.Storage so that cert
|
||||
// management in tests does not hit the real default storage on disk.
|
||||
// This must NOT be set in production code.
|
||||
var testCertMagicStorageOverride certmagic.Storage
|
||||
|
||||
func init() {
|
||||
// The hard-coded default `DefaultAdminListen` can be overridden
|
||||
// by setting the `CADDY_ADMIN` environment variable.
|
||||
@@ -120,6 +112,10 @@ type AdminConfig struct {
|
||||
//
|
||||
// EXPERIMENTAL: This feature is subject to change.
|
||||
Remote *RemoteAdmin `json:"remote,omitempty"`
|
||||
|
||||
// Holds onto the routers so that we can later provision them
|
||||
// if they require provisioning.
|
||||
routers []AdminRouter
|
||||
}
|
||||
|
||||
// ConfigSettings configures the management of configuration.
|
||||
@@ -208,8 +204,8 @@ type AdminAccess struct {
|
||||
// AdminPermissions specifies what kinds of requests are allowed
|
||||
// to be made to the admin endpoint.
|
||||
type AdminPermissions struct {
|
||||
// The API paths allowed. A request path must either equal an
|
||||
// allowed path or be a subpath with a path-segment boundary.
|
||||
// The API paths allowed. Paths are simple prefix matches.
|
||||
// Any subpath of the specified paths will be allowed.
|
||||
Paths []string `json:"paths,omitempty"`
|
||||
|
||||
// The HTTP methods allowed for the given paths.
|
||||
@@ -218,7 +214,7 @@ type AdminPermissions struct {
|
||||
|
||||
// newAdminHandler reads admin's config and returns an http.Handler suitable
|
||||
// for use in an admin endpoint server, which will be listening on listenAddr.
|
||||
func (admin *AdminConfig) newAdminHandler(addr NetworkAddress, remote bool, ctx Context) (adminHandler, error) {
|
||||
func (admin *AdminConfig) newAdminHandler(addr NetworkAddress, remote bool, _ Context) adminHandler {
|
||||
muxWrap := adminHandler{mux: http.NewServeMux()}
|
||||
|
||||
// secure the local or remote endpoint respectively
|
||||
@@ -275,21 +271,34 @@ func (admin *AdminConfig) newAdminHandler(addr NetworkAddress, remote bool, ctx
|
||||
// register third-party module endpoints
|
||||
for _, m := range GetModules("admin.api") {
|
||||
router := m.New().(AdminRouter)
|
||||
|
||||
// provision the router before registering its routes, so
|
||||
// handlers have access to all provisioned state
|
||||
if provisioner, ok := router.(Provisioner); ok {
|
||||
if err := provisioner.Provision(ctx); err != nil {
|
||||
return adminHandler{}, fmt.Errorf("provisioning admin router module %s: %v", m.ID, err)
|
||||
}
|
||||
}
|
||||
|
||||
for _, route := range router.Routes() {
|
||||
addRoute(route.Pattern, handlerLabel, route.Handler)
|
||||
}
|
||||
admin.routers = append(admin.routers, router)
|
||||
}
|
||||
|
||||
return muxWrap, nil
|
||||
return muxWrap
|
||||
}
|
||||
|
||||
// provisionAdminRouters provisions all the router modules
|
||||
// in the admin.api namespace that need provisioning.
|
||||
func (admin *AdminConfig) provisionAdminRouters(ctx Context) error {
|
||||
for _, router := range admin.routers {
|
||||
provisioner, ok := router.(Provisioner)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
|
||||
err := provisioner.Provision(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
// We no longer need the routers once provisioned, allow for GC
|
||||
admin.routers = nil
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// allowedOrigins returns a list of origins that are allowed.
|
||||
@@ -413,7 +422,11 @@ func replaceLocalAdminServer(cfg *Config, ctx Context) error {
|
||||
return err
|
||||
}
|
||||
|
||||
handler, err := cfg.Admin.newAdminHandler(addr, false, ctx)
|
||||
handler := cfg.Admin.newAdminHandler(addr, false, ctx)
|
||||
|
||||
// run the provisioners for loaded modules to make sure local
|
||||
// state is properly re-initialized in the new admin server
|
||||
err = cfg.Admin.provisionAdminRouters(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -537,7 +550,11 @@ func replaceRemoteAdminServer(ctx Context, cfg *Config) error {
|
||||
|
||||
// make the HTTP handler but disable Host/Origin enforcement
|
||||
// because we are using TLS authentication instead
|
||||
handler, err := cfg.Admin.newAdminHandler(addr, true, ctx)
|
||||
handler := cfg.Admin.newAdminHandler(addr, true, ctx)
|
||||
|
||||
// run the provisioners for loaded modules to make sure local
|
||||
// state is properly re-initialized in the new admin server
|
||||
err = cfg.Admin.provisionAdminRouters(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -616,19 +633,8 @@ func (ident *IdentityConfig) certmagicConfig(logger *zap.Logger, makeCache bool)
|
||||
// certmagic config, although it'll be mostly useless for remote management
|
||||
ident = new(IdentityConfig)
|
||||
}
|
||||
// Choose storage: prefer the package-level test override when present,
|
||||
// otherwise use the configured DefaultStorage. Tests may set an override
|
||||
// to divert storage into a temporary location. Otherwise, in production
|
||||
// we use the DefaultStorage since we don't want to act as part of a
|
||||
// cluster; this storage is for the server's local identity only.
|
||||
var storage certmagic.Storage
|
||||
if testCertMagicStorageOverride != nil {
|
||||
storage = testCertMagicStorageOverride
|
||||
} else {
|
||||
storage = DefaultStorage
|
||||
}
|
||||
template := certmagic.Config{
|
||||
Storage: storage,
|
||||
Storage: DefaultStorage, // do not act as part of a cluster (this is for the server's local identity)
|
||||
Logger: logger,
|
||||
Issuers: ident.issuers,
|
||||
}
|
||||
@@ -693,7 +699,7 @@ func (remote RemoteAdmin) enforceAccessControls(r *http.Request) error {
|
||||
// verify path
|
||||
pathFound := accessPerm.Paths == nil
|
||||
for _, allowedPath := range accessPerm.Paths {
|
||||
if adminPathAllowed(r.URL.Path, allowedPath) {
|
||||
if strings.HasPrefix(r.URL.Path, allowedPath) {
|
||||
pathFound = true
|
||||
break
|
||||
}
|
||||
@@ -722,31 +728,14 @@ func (remote RemoteAdmin) enforceAccessControls(r *http.Request) error {
|
||||
}
|
||||
}
|
||||
|
||||
func adminPathAllowed(reqPath, allowedPath string) bool {
|
||||
if allowedPath == "" || allowedPath == "/" {
|
||||
return strings.HasPrefix(reqPath, allowedPath)
|
||||
}
|
||||
if reqPath == allowedPath {
|
||||
return true
|
||||
}
|
||||
if strings.HasSuffix(allowedPath, "/") {
|
||||
return strings.HasPrefix(reqPath, allowedPath)
|
||||
}
|
||||
return strings.HasPrefix(reqPath, allowedPath+"/")
|
||||
}
|
||||
|
||||
func stopAdminServer(srv *http.Server) error {
|
||||
if srv == nil {
|
||||
return fmt.Errorf("no admin server")
|
||||
}
|
||||
timeout := 10 * time.Second
|
||||
ctx, cancel := context.WithTimeoutCause(context.Background(), timeout, fmt.Errorf("stopping admin server: %ds timeout", int(timeout.Seconds())))
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
defer cancel()
|
||||
err := srv.Shutdown(ctx)
|
||||
if err != nil {
|
||||
if cause := context.Cause(ctx); cause != nil && errors.Is(err, context.DeadlineExceeded) {
|
||||
err = cause
|
||||
}
|
||||
return fmt.Errorf("shutting down admin server: %v", err)
|
||||
}
|
||||
Log().Named("admin").Info("stopped previous server", zap.String("address", srv.Addr))
|
||||
@@ -790,7 +779,7 @@ func (h adminHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
zap.String("uri", r.RequestURI),
|
||||
zap.String("remote_ip", ip),
|
||||
zap.String("remote_port", port),
|
||||
zap.Object("headers", internal.LoggableHTTPHeader{Header: r.Header}),
|
||||
zap.Reflect("headers", r.Header),
|
||||
)
|
||||
if r.TLS != nil {
|
||||
log = log.With(
|
||||
@@ -818,37 +807,11 @@ func (h adminHandler) serveHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
}
|
||||
|
||||
// common mitigations in browser contexts
|
||||
if strings.Contains(r.Header.Get("Upgrade"), "websocket") {
|
||||
// I've never been able demonstrate a vulnerability myself, but apparently
|
||||
// WebSocket connections originating from browsers aren't subject to CORS
|
||||
// restrictions, so we'll just be on the safe side
|
||||
h.handleError(w, r, APIError{
|
||||
HTTPStatus: http.StatusBadRequest,
|
||||
Err: errors.New("websocket connections aren't allowed"),
|
||||
Message: "WebSocket connections aren't allowed.",
|
||||
})
|
||||
return
|
||||
}
|
||||
if strings.Contains(r.Header.Get("Sec-Fetch-Mode"), "no-cors") {
|
||||
// turns out web pages can just disable the same-origin policy (!???!?)
|
||||
// but at least browsers let us know that's the case, holy heck
|
||||
h.handleError(w, r, APIError{
|
||||
HTTPStatus: http.StatusBadRequest,
|
||||
Err: errors.New("client attempted to make request by disabling same-origin policy using no-cors mode"),
|
||||
Message: "Disabling same-origin restrictions is not allowed.",
|
||||
})
|
||||
return
|
||||
}
|
||||
if r.Header.Get("Origin") == "null" {
|
||||
// bug in Firefox in certain cross-origin situations (yikes?)
|
||||
// (not strictly a security vuln on its own, but it's red flaggy,
|
||||
// since it seems to manifest in cross-origin contexts)
|
||||
h.handleError(w, r, APIError{
|
||||
HTTPStatus: http.StatusBadRequest,
|
||||
Err: errors.New("invalid origin 'null'"),
|
||||
Message: "Buggy browser is sending null Origin header.",
|
||||
})
|
||||
h.handleError(w, r, fmt.Errorf("websocket connections aren't allowed"))
|
||||
return
|
||||
}
|
||||
|
||||
@@ -861,9 +824,7 @@ func (h adminHandler) serveHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
}
|
||||
|
||||
_, hasOriginHeader := r.Header["Origin"]
|
||||
_, hasSecHeader := r.Header["Sec-Fetch-Mode"]
|
||||
if h.enforceOrigin || hasOriginHeader || hasSecHeader {
|
||||
if h.enforceOrigin {
|
||||
// cross-site mitigation
|
||||
origin, err := h.checkOrigin(r)
|
||||
if err != nil {
|
||||
@@ -1051,9 +1012,6 @@ func handleConfig(w http.ResponseWriter, r *http.Request) error {
|
||||
buf.Reset()
|
||||
defer bufPool.Put(buf)
|
||||
|
||||
const maxConfigSize = 100 * 1024 * 1024 // 100 MB
|
||||
r.Body = http.MaxBytesReader(w, r.Body, maxConfigSize)
|
||||
|
||||
_, err := io.Copy(buf, r.Body)
|
||||
if err != nil {
|
||||
return APIError{
|
||||
@@ -1136,20 +1094,6 @@ func handleStop(w http.ResponseWriter, r *http.Request) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func parseCanonicalArrayIndex(idx string) (int, error) {
|
||||
if idx == "" {
|
||||
return 0, fmt.Errorf("empty index")
|
||||
}
|
||||
i, err := strconv.Atoi(idx)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
if strconv.Itoa(i) != idx {
|
||||
return 0, fmt.Errorf("non-canonical array index")
|
||||
}
|
||||
return i, nil
|
||||
}
|
||||
|
||||
// unsyncedConfigAccess traverses into the current config and performs
|
||||
// the operation at path according to method, using body and out as
|
||||
// needed. This is a low-level, unsynchronized function; most callers
|
||||
@@ -1211,12 +1155,11 @@ traverseLoop:
|
||||
var idx int
|
||||
if method != http.MethodPost {
|
||||
idxStr := parts[len(parts)-1]
|
||||
idx, err = parseCanonicalArrayIndex(idxStr)
|
||||
idx, err = strconv.Atoi(idxStr)
|
||||
if err != nil {
|
||||
return fmt.Errorf("[%s] invalid array index '%s': %v",
|
||||
path, idxStr, err)
|
||||
}
|
||||
|
||||
if idx < 0 || (method != http.MethodPut && idx >= len(arr)) || idx > len(arr) {
|
||||
return fmt.Errorf("[%s] array index out of bounds: %s", path, idxStr)
|
||||
}
|
||||
@@ -1316,7 +1259,7 @@ traverseLoop:
|
||||
}
|
||||
|
||||
case []any:
|
||||
partInt, err := parseCanonicalArrayIndex(part)
|
||||
partInt, err := strconv.Atoi(part)
|
||||
if err != nil {
|
||||
return fmt.Errorf("[/%s] invalid array index '%s': %v",
|
||||
strings.Join(parts[:i+1], "/"), part, err)
|
||||
|
||||
+23
-243
@@ -15,28 +15,20 @@
|
||||
package caddy
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"maps"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"reflect"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/caddyserver/certmagic"
|
||||
"github.com/prometheus/client_golang/prometheus"
|
||||
dto "github.com/prometheus/client_model/go"
|
||||
"go.uber.org/zap"
|
||||
"go.uber.org/zap/zaptest/observer"
|
||||
)
|
||||
|
||||
var testCfg = []byte(`{
|
||||
@@ -57,13 +49,6 @@ var testCfg = []byte(`{
|
||||
}
|
||||
`)
|
||||
|
||||
type testAdminPublicKey string
|
||||
|
||||
func (k testAdminPublicKey) Equal(x crypto.PublicKey) bool {
|
||||
other, ok := x.(testAdminPublicKey)
|
||||
return ok && k == other
|
||||
}
|
||||
|
||||
func TestUnsyncedConfigAccess(t *testing.T) {
|
||||
// each test is performed in sequence, so
|
||||
// each change builds on the previous ones;
|
||||
@@ -255,51 +240,6 @@ func TestAdminHandlerErrorHandling(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestAdminHandlerServeHTTPRedactsSensitiveHeadersInLogs(t *testing.T) {
|
||||
core, logs := observer.New(zap.InfoLevel)
|
||||
|
||||
defaultLoggerMu.Lock()
|
||||
origLogger := defaultLogger.logger
|
||||
defaultLogger.logger = zap.New(core)
|
||||
defaultLoggerMu.Unlock()
|
||||
t.Cleanup(func() {
|
||||
defaultLoggerMu.Lock()
|
||||
defaultLogger.logger = origLogger
|
||||
defaultLoggerMu.Unlock()
|
||||
})
|
||||
|
||||
handler := adminHandler{
|
||||
mux: http.NewServeMux(),
|
||||
}
|
||||
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
||||
req.Header.Set("Authorization", "Bearer secret")
|
||||
req.Header.Set("Cookie", "session=secret")
|
||||
req.Header.Set("X-Test", "ok")
|
||||
rr := httptest.NewRecorder()
|
||||
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if logs.Len() == 0 {
|
||||
t.Fatal("expected request log entry")
|
||||
}
|
||||
|
||||
ctx := logs.All()[0].ContextMap()
|
||||
headers, ok := ctx["headers"].(map[string]any)
|
||||
if !ok {
|
||||
t.Fatalf("expected headers field in log context, got %T", ctx["headers"])
|
||||
}
|
||||
|
||||
if got := headers["Authorization"]; !reflect.DeepEqual(got, []any{"REDACTED"}) {
|
||||
t.Fatalf("expected redacted Authorization header, got %#v", got)
|
||||
}
|
||||
if got := headers["Cookie"]; !reflect.DeepEqual(got, []any{"REDACTED"}) {
|
||||
t.Fatalf("expected redacted Cookie header, got %#v", got)
|
||||
}
|
||||
if got := headers["X-Test"]; !reflect.DeepEqual(got, []any{"ok"}) {
|
||||
t.Fatalf("expected X-Test header to remain visible, got %#v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func initAdminMetrics() {
|
||||
if adminMetrics.requestErrors != nil {
|
||||
prometheus.Unregister(adminMetrics.requestErrors)
|
||||
@@ -335,15 +275,13 @@ func TestAdminHandlerBuiltinRouteErrors(t *testing.T) {
|
||||
},
|
||||
}
|
||||
|
||||
// Build the admin handler directly (no listener active)
|
||||
addr, err := ParseNetworkAddress("localhost:2019")
|
||||
err := replaceLocalAdminServer(cfg, Context{})
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to parse address: %v", err)
|
||||
}
|
||||
handler, err := cfg.Admin.newAdminHandler(addr, false, Context{})
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to create admin handler: %v", err)
|
||||
t.Fatalf("setting up admin server: %v", err)
|
||||
}
|
||||
defer func() {
|
||||
stopAdminServer(localAdminServer)
|
||||
}()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
@@ -376,7 +314,7 @@ func TestAdminHandlerBuiltinRouteErrors(t *testing.T) {
|
||||
req := httptest.NewRequest(test.method, fmt.Sprintf("http://localhost:2019%s", test.path), nil)
|
||||
rr := httptest.NewRecorder()
|
||||
|
||||
handler.ServeHTTP(rr, req)
|
||||
localAdminServer.Handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code != test.expectedStatus {
|
||||
t.Errorf("expected status %d but got %d", test.expectedStatus, rr.Code)
|
||||
@@ -464,10 +402,7 @@ func TestNewAdminHandlerRouterRegistration(t *testing.T) {
|
||||
admin := &AdminConfig{
|
||||
EnforceOrigin: false,
|
||||
}
|
||||
handler, err := admin.newAdminHandler(addr, false, Context{})
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to create admin handler: %v", err)
|
||||
}
|
||||
handler := admin.newAdminHandler(addr, false, Context{})
|
||||
|
||||
req := httptest.NewRequest("GET", "/mock", nil)
|
||||
req.Host = "localhost:2019"
|
||||
@@ -479,6 +414,10 @@ func TestNewAdminHandlerRouterRegistration(t *testing.T) {
|
||||
t.Errorf("Expected status code %d but got %d", http.StatusOK, rr.Code)
|
||||
t.Logf("Response body: %s", rr.Body.String())
|
||||
}
|
||||
|
||||
if len(admin.routers) != 1 {
|
||||
t.Errorf("Expected 1 router to be stored, got %d", len(admin.routers))
|
||||
}
|
||||
}
|
||||
|
||||
type mockProvisionableRouter struct {
|
||||
@@ -516,16 +455,19 @@ func TestAdminRouterProvisioning(t *testing.T) {
|
||||
name string
|
||||
provisionErr error
|
||||
wantErr bool
|
||||
routersAfter int // expected number of routers after provisioning
|
||||
}{
|
||||
{
|
||||
name: "successful provisioning",
|
||||
provisionErr: nil,
|
||||
wantErr: false,
|
||||
routersAfter: 0,
|
||||
},
|
||||
{
|
||||
name: "provisioning error",
|
||||
provisionErr: fmt.Errorf("provision failed"),
|
||||
wantErr: true,
|
||||
routersAfter: 1,
|
||||
},
|
||||
}
|
||||
|
||||
@@ -561,7 +503,8 @@ func TestAdminRouterProvisioning(t *testing.T) {
|
||||
t.Fatalf("Failed to parse address: %v", err)
|
||||
}
|
||||
|
||||
_, err = admin.newAdminHandler(addr, false, Context{})
|
||||
_ = admin.newAdminHandler(addr, false, Context{})
|
||||
err = admin.provisionAdminRouters(Context{})
|
||||
|
||||
if test.wantErr {
|
||||
if err == nil {
|
||||
@@ -572,6 +515,10 @@ func TestAdminRouterProvisioning(t *testing.T) {
|
||||
t.Errorf("Expected no error but got: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
if len(admin.routers) != test.routersAfter {
|
||||
t.Errorf("Expected %d routers after provisioning, got %d", test.routersAfter, len(admin.routers))
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -656,99 +603,6 @@ func TestAllowedOriginsUnixSocket(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestRemoteAdminAccessControlPathSegmentMatching(t *testing.T) {
|
||||
const authorizedKey testAdminPublicKey = "authorized"
|
||||
peerCert := &x509.Certificate{PublicKey: authorizedKey}
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
allowedPath string
|
||||
requestPath string
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "exact path",
|
||||
allowedPath: "/pki/ca/prod",
|
||||
requestPath: "/pki/ca/prod",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "subpath",
|
||||
allowedPath: "/pki/ca/prod",
|
||||
requestPath: "/pki/ca/prod/certificates",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "trailing slash subpath",
|
||||
allowedPath: "/pki/ca/prod/",
|
||||
requestPath: "/pki/ca/prod/certificates",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "sibling with shared prefix",
|
||||
allowedPath: "/pki/ca/prod",
|
||||
requestPath: "/pki/ca/prod-backup",
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "same segment plus digit",
|
||||
allowedPath: "/pki/ca/prod",
|
||||
requestPath: "/pki/ca/prod1",
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "root path",
|
||||
allowedPath: "/",
|
||||
requestPath: "/pki/ca/prod",
|
||||
wantErr: false,
|
||||
},
|
||||
}
|
||||
|
||||
for i, test := range tests {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
remote := RemoteAdmin{
|
||||
AccessControl: []*AdminAccess{
|
||||
{
|
||||
Permissions: []AdminPermissions{
|
||||
{
|
||||
Methods: []string{http.MethodGet},
|
||||
Paths: []string{test.allowedPath},
|
||||
},
|
||||
},
|
||||
publicKeys: []crypto.PublicKey{authorizedKey},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
req := httptest.NewRequest(http.MethodGet, "https://localhost:2021"+test.requestPath, nil)
|
||||
req.TLS = &tls.ConnectionState{
|
||||
VerifiedChains: [][]*x509.Certificate{{peerCert}},
|
||||
}
|
||||
|
||||
err := remote.enforceAccessControls(req)
|
||||
if test.wantErr {
|
||||
if err == nil {
|
||||
t.Errorf("test %d (%s): allowed path %q, request path %q: expected forbidden error, got nil", i, test.name, test.allowedPath, test.requestPath)
|
||||
return
|
||||
}
|
||||
var apiErr APIError
|
||||
if !errors.As(err, &apiErr) {
|
||||
t.Errorf("test %d (%s): allowed path %q, request path %q: expected APIError with HTTP status %d, got %T: %v", i, test.name, test.allowedPath, test.requestPath, http.StatusForbidden, err, err)
|
||||
return
|
||||
}
|
||||
if apiErr.HTTPStatus != http.StatusForbidden {
|
||||
t.Errorf("test %d (%s): allowed path %q, request path %q: expected HTTP status %d, got %d", i, test.name, test.allowedPath, test.requestPath, http.StatusForbidden, apiErr.HTTPStatus)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
t.Errorf("test %d (%s): allowed path %q, request path %q: expected no error, got %v", i, test.name, test.allowedPath, test.requestPath, err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestReplaceRemoteAdminServer(t *testing.T) {
|
||||
const testCert = `MIIDCTCCAfGgAwIBAgIUXsqJ1mY8pKlHQtI3HJ23x2eZPqwwDQYJKoZIhvcNAQEL
|
||||
BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTIzMDEwMTAwMDAwMFoXDTI0MDEw
|
||||
@@ -945,24 +799,8 @@ MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRS0LmTwUT0iwP
|
||||
...
|
||||
-----END PRIVATE KEY-----`)
|
||||
|
||||
tmpDir, err := os.MkdirTemp("", "TestManageIdentity-")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
testStorage := certmagic.FileStorage{Path: tmpDir}
|
||||
// Clean up the temp dir after the test finishes. Ensure any background
|
||||
// certificate maintenance is stopped first to avoid RemoveAll races.
|
||||
t.Cleanup(func() {
|
||||
if identityCertCache != nil {
|
||||
identityCertCache.Stop()
|
||||
identityCertCache = nil
|
||||
}
|
||||
// Give goroutines a moment to exit and release file handles.
|
||||
time.Sleep(50 * time.Millisecond)
|
||||
_ = os.RemoveAll(tmpDir)
|
||||
})
|
||||
|
||||
err = testStorage.Store(context.Background(), "localhost/localhost.crt", certPEM)
|
||||
testStorage := certmagic.FileStorage{Path: t.TempDir()}
|
||||
err := testStorage.Store(context.Background(), "localhost/localhost.crt", certPEM)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
@@ -1024,7 +862,7 @@ MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRS0LmTwUT0iwP
|
||||
},
|
||||
},
|
||||
},
|
||||
storage: &testStorage,
|
||||
storage: &certmagic.FileStorage{Path: "testdata"},
|
||||
},
|
||||
checkState: func(t *testing.T, cfg *Config) {
|
||||
if len(cfg.Admin.Identity.issuers) != 1 {
|
||||
@@ -1062,13 +900,6 @@ MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRS0LmTwUT0iwP
|
||||
identityCertCache.Stop()
|
||||
identityCertCache = nil
|
||||
}
|
||||
// Ensure any cache started by manageIdentity is stopped at the end
|
||||
defer func() {
|
||||
if identityCertCache != nil {
|
||||
identityCertCache.Stop()
|
||||
identityCertCache = nil
|
||||
}
|
||||
}()
|
||||
|
||||
ctx := Context{
|
||||
Context: context.Background(),
|
||||
@@ -1076,13 +907,6 @@ MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRS0LmTwUT0iwP
|
||||
moduleInstances: make(map[string][]Module),
|
||||
}
|
||||
|
||||
// If this test provided a FileStorage, set the package-level
|
||||
// testCertMagicStorageOverride so certmagicConfig will use it.
|
||||
if test.cfg != nil && test.cfg.storage != nil {
|
||||
testCertMagicStorageOverride = test.cfg.storage
|
||||
defer func() { testCertMagicStorageOverride = nil }()
|
||||
}
|
||||
|
||||
err := manageIdentity(ctx, test.cfg)
|
||||
|
||||
if test.wantErr {
|
||||
@@ -1101,47 +925,3 @@ MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRS0LmTwUT0iwP
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestUnsyncedConfigAccessCanonicalArrayIndices(t *testing.T) {
|
||||
rawCfg = map[string]any{
|
||||
rawConfigKey: map[string]any{
|
||||
"list": []any{"zero", "one", "two", "three", "four", "five", "six", "seven", "eight", "nine", "ten"},
|
||||
},
|
||||
}
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
path string
|
||||
wantOutput string
|
||||
wantErr bool
|
||||
}{
|
||||
{name: "allow zero", path: "/" + rawConfigKey + "/list/0", wantOutput: "\"zero\"\n"},
|
||||
{name: "allow one", path: "/" + rawConfigKey + "/list/1", wantOutput: "\"one\"\n"},
|
||||
{name: "allow ten", path: "/" + rawConfigKey + "/list/10", wantOutput: "\"ten\"\n"},
|
||||
{name: "reject leading zero", path: "/" + rawConfigKey + "/list/01", wantErr: true},
|
||||
{name: "reject multiple leading zeros", path: "/" + rawConfigKey + "/list/002", wantErr: true},
|
||||
{name: "reject plus sign", path: "/" + rawConfigKey + "/list/+1", wantErr: true},
|
||||
{name: "reject negative zero", path: "/" + rawConfigKey + "/list/-0", wantErr: true},
|
||||
}
|
||||
|
||||
for i, tc := range tests {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
var gotOutput bytes.Buffer
|
||||
err := unsyncedConfigAccess(http.MethodGet, tc.path, nil, &gotOutput)
|
||||
|
||||
if tc.wantErr {
|
||||
if err == nil {
|
||||
t.Errorf("test %d (%s): input path %q: expected error, got nil with output %q", i, tc.name, tc.path, gotOutput.String())
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
t.Errorf("test %d (%s): input path %q: expected no error with output %q, got error %v with output %q", i, tc.name, tc.path, tc.wantOutput, err, gotOutput.String())
|
||||
}
|
||||
if gotOutput.String() != tc.wantOutput {
|
||||
t.Errorf("test %d (%s): input path %q: expected output %q, got %q", i, tc.name, tc.path, tc.wantOutput, gotOutput.String())
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -88,7 +88,7 @@ type Config struct {
|
||||
storage certmagic.Storage
|
||||
eventEmitter eventEmitter
|
||||
|
||||
cancelFunc context.CancelCauseFunc
|
||||
cancelFunc context.CancelFunc
|
||||
|
||||
// fileSystems is a dict of fileSystems that will later be loaded from and added to.
|
||||
fileSystems FileSystems
|
||||
@@ -127,9 +127,10 @@ func Load(cfgJSON []byte, forceReload bool) error {
|
||||
zap.Error(notifyErr),
|
||||
zap.String("reload_err", err.Error()))
|
||||
}
|
||||
return
|
||||
}
|
||||
if notifyErr := notify.Ready(); notifyErr != nil {
|
||||
Log().Error("unable to notify to service manager of ready state", zap.Error(notifyErr))
|
||||
if err := notify.Ready(); err != nil {
|
||||
Log().Error("unable to notify to service manager of ready state", zap.Error(err))
|
||||
}
|
||||
}()
|
||||
|
||||
@@ -146,8 +147,8 @@ func Load(cfgJSON []byte, forceReload bool) error {
|
||||
// the new value (if applicable; i.e. "DELETE" doesn't have an input).
|
||||
// If the resulting config is the same as the previous, no reload will
|
||||
// occur unless forceReload is true. If the config is unchanged and not
|
||||
// forcefully reloaded, then errConfigUnchanged is returned. This function
|
||||
// is safe for concurrent use.
|
||||
// forcefully reloaded, then errConfigUnchanged This function is safe for
|
||||
// concurrent use.
|
||||
// The ifMatchHeader can optionally be given a string of the format:
|
||||
//
|
||||
// "<path> <hash>"
|
||||
@@ -226,18 +227,8 @@ func changeConfig(method, path string, input []byte, ifMatchHeader string, force
|
||||
idx := make(map[string]string)
|
||||
err = indexConfigObjects(rawCfg[rawConfigKey], "/"+rawConfigKey, idx)
|
||||
if err != nil {
|
||||
if len(rawCfgJSON) > 0 {
|
||||
var oldCfg any
|
||||
err2 := json.Unmarshal(rawCfgJSON, &oldCfg)
|
||||
if err2 != nil {
|
||||
err = fmt.Errorf("%v; additionally, restoring old config: %v", err, err2)
|
||||
}
|
||||
rawCfg[rawConfigKey] = oldCfg
|
||||
} else {
|
||||
rawCfg[rawConfigKey] = nil
|
||||
}
|
||||
return APIError{
|
||||
HTTPStatus: http.StatusBadRequest,
|
||||
HTTPStatus: http.StatusInternalServerError,
|
||||
Err: fmt.Errorf("indexing config: %v", err),
|
||||
}
|
||||
}
|
||||
@@ -257,8 +248,6 @@ func changeConfig(method, path string, input []byte, ifMatchHeader string, force
|
||||
err = fmt.Errorf("%v; additionally, restoring old config: %v", err, err2)
|
||||
}
|
||||
rawCfg[rawConfigKey] = oldCfg
|
||||
} else {
|
||||
rawCfg[rawConfigKey] = nil
|
||||
}
|
||||
|
||||
return fmt.Errorf("loading new config: %v", err)
|
||||
@@ -292,19 +281,14 @@ func indexConfigObjects(ptr any, configPath string, index map[string]string) err
|
||||
case map[string]any:
|
||||
for k, v := range val {
|
||||
if k == idKey {
|
||||
var idStr string
|
||||
switch idVal := v.(type) {
|
||||
case string:
|
||||
idStr = idVal
|
||||
index[idVal] = configPath
|
||||
case float64: // all JSON numbers decode as float64
|
||||
idStr = fmt.Sprintf("%v", idVal)
|
||||
index[fmt.Sprintf("%v", idVal)] = configPath
|
||||
default:
|
||||
return fmt.Errorf("%s: %s field must be a string or number", configPath, idKey)
|
||||
}
|
||||
if existingPath, ok := index[idStr]; ok {
|
||||
return fmt.Errorf("duplicate ID '%s' found at %s and %s", idStr, existingPath, configPath)
|
||||
}
|
||||
index[idStr] = configPath
|
||||
continue
|
||||
}
|
||||
// traverse this object property recursively
|
||||
@@ -432,7 +416,7 @@ func run(newCfg *Config, start bool) (Context, error) {
|
||||
// partially copied from provisionContext
|
||||
if err != nil {
|
||||
globalMetrics.configSuccess.Set(0)
|
||||
ctx.cfg.cancelFunc(fmt.Errorf("configuration start error: %w", err))
|
||||
ctx.cfg.cancelFunc()
|
||||
|
||||
if currentCtx.cfg != nil {
|
||||
certmagic.Default.Storage = currentCtx.cfg.storage
|
||||
@@ -440,6 +424,13 @@ func run(newCfg *Config, start bool) (Context, error) {
|
||||
}
|
||||
}()
|
||||
|
||||
// Provision any admin routers which may need to access
|
||||
// some of the other apps at runtime
|
||||
err = ctx.cfg.Admin.provisionAdminRouters(ctx)
|
||||
if err != nil {
|
||||
return ctx, err
|
||||
}
|
||||
|
||||
// Start
|
||||
err = func() error {
|
||||
started := make([]string, 0, len(ctx.cfg.apps))
|
||||
@@ -501,7 +492,7 @@ func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error)
|
||||
// cleanup occurs when we return if there
|
||||
// was an error; if no error, it will get
|
||||
// cleaned up on next config cycle
|
||||
ctx, cancelCause := NewContextWithCause(Context{Context: context.Background(), cfg: newCfg})
|
||||
ctx, cancel := NewContext(Context{Context: context.Background(), cfg: newCfg})
|
||||
defer func() {
|
||||
if err != nil {
|
||||
globalMetrics.configSuccess.Set(0)
|
||||
@@ -510,7 +501,7 @@ func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error)
|
||||
// since the associated config won't be used;
|
||||
// this will cause all modules that were newly
|
||||
// provisioned to clean themselves up
|
||||
cancelCause(fmt.Errorf("configuration error: %w", err))
|
||||
cancel()
|
||||
|
||||
// also undo any other state changes we made
|
||||
if currentCtx.cfg != nil {
|
||||
@@ -518,7 +509,7 @@ func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error)
|
||||
}
|
||||
}
|
||||
}()
|
||||
newCfg.cancelFunc = cancelCause // clean up later
|
||||
newCfg.cancelFunc = cancel // clean up later
|
||||
|
||||
// set up logging before anything bad happens
|
||||
if newCfg.Logging == nil {
|
||||
@@ -738,7 +729,7 @@ func unsyncedStop(ctx Context) {
|
||||
}
|
||||
|
||||
// clean up all modules
|
||||
ctx.cfg.cancelFunc(fmt.Errorf("stopping apps"))
|
||||
ctx.cfg.cancelFunc()
|
||||
}
|
||||
|
||||
// Validate loads, provisions, and validates
|
||||
@@ -746,7 +737,7 @@ func unsyncedStop(ctx Context) {
|
||||
func Validate(cfg *Config) error {
|
||||
_, err := run(cfg, false)
|
||||
if err == nil {
|
||||
cfg.cancelFunc(fmt.Errorf("validation complete")) // call Cleanup on all modules
|
||||
cfg.cancelFunc() // call Cleanup on all modules
|
||||
}
|
||||
return err
|
||||
}
|
||||
@@ -759,7 +750,7 @@ func Validate(cfg *Config) error {
|
||||
// code is emitted.
|
||||
func exitProcess(ctx context.Context, logger *zap.Logger) {
|
||||
// let the rest of the program know we're quitting; only do it once
|
||||
if !exiting.CompareAndSwap(false, true) {
|
||||
if !atomic.CompareAndSwapInt32(exiting, 0, 1) {
|
||||
return
|
||||
}
|
||||
|
||||
@@ -838,11 +829,11 @@ func exitProcess(ctx context.Context, logger *zap.Logger) {
|
||||
}()
|
||||
}
|
||||
|
||||
var exiting atomic.Bool
|
||||
var exiting = new(int32) // accessed atomically
|
||||
|
||||
// Exiting returns true if the process is exiting.
|
||||
// EXPERIMENTAL API: subject to change or removal.
|
||||
func Exiting() bool { return exiting.Load() }
|
||||
func Exiting() bool { return atomic.LoadInt32(exiting) == 1 }
|
||||
|
||||
// OnExit registers a callback to invoke during process exit.
|
||||
// This registration is PROCESS-GLOBAL, meaning that each
|
||||
@@ -954,34 +945,6 @@ func InstanceID() (uuid.UUID, error) {
|
||||
// for example.
|
||||
var CustomVersion string
|
||||
|
||||
// CustomBinaryName is an optional string that overrides the root
|
||||
// command name from the default of "caddy". This is useful for
|
||||
// downstream projects that embed Caddy but use a different binary
|
||||
// name. Shell completions and help text will use this name instead
|
||||
// of "caddy".
|
||||
//
|
||||
// Set this variable during `go build` with `-ldflags`:
|
||||
//
|
||||
// -ldflags '-X github.com/caddyserver/caddy/v2.CustomBinaryName=my_custom_caddy'
|
||||
//
|
||||
// for example.
|
||||
var CustomBinaryName string
|
||||
|
||||
// CustomLongDescription is an optional string that overrides the
|
||||
// long description of the root Cobra command. This is useful for
|
||||
// downstream projects that embed Caddy but want different help
|
||||
// output.
|
||||
//
|
||||
// Set this variable in an init() function of a package that is
|
||||
// imported by your main:
|
||||
//
|
||||
// func init() {
|
||||
// caddy.CustomLongDescription = "My custom server based on Caddy..."
|
||||
// }
|
||||
//
|
||||
// for example.
|
||||
var CustomLongDescription string
|
||||
|
||||
// Version returns the Caddy version in a simple/short form, and
|
||||
// a full version string. The short form will not have spaces and
|
||||
// is intended for User-Agent strings and similar, but may be
|
||||
@@ -1129,7 +1092,7 @@ type Event struct {
|
||||
}
|
||||
|
||||
// NewEvent creates a new event, but does not emit the event. To emit an
|
||||
// event, call Emit() on the current instance of the caddyevents app instead.
|
||||
// event, call Emit() on the current instance of the caddyevents app insteaad.
|
||||
//
|
||||
// EXPERIMENTAL: Subject to change.
|
||||
func NewEvent(ctx Context, name string, data map[string]any) (Event, error) {
|
||||
@@ -1287,10 +1250,10 @@ func getLastConfig() (file, adapter string, fn reloadFromSourceFunc) {
|
||||
|
||||
// lastConfigMatches returns true if the provided source file and/or adapter
|
||||
// matches the recorded last-config. Matching rules (in priority order):
|
||||
// 1. If srcAdapter is provided and differs from the recorded adapter, no match.
|
||||
// 2. If srcFile exactly equals the recorded file, match.
|
||||
// 3. If both sides can be made absolute and equal, match.
|
||||
// 4. If basenames are equal, match.
|
||||
// 1. If srcAdapter is provided and differs from the recorded adapter, no match.
|
||||
// 2. If srcFile exactly equals the recorded file, match.
|
||||
// 3. If both sides can be made absolute and equal, match.
|
||||
// 4. If basenames are equal, match.
|
||||
func lastConfigMatches(srcFile, srcAdapter string) bool {
|
||||
lf, la, _ := getLastConfig()
|
||||
|
||||
|
||||
@@ -270,7 +270,7 @@ func (d *Dispenser) File() string {
|
||||
// targets are left unchanged. If all the targets are filled,
|
||||
// then true is returned.
|
||||
func (d *Dispenser) Args(targets ...*string) bool {
|
||||
for i := range targets {
|
||||
for i := 0; i < len(targets); i++ {
|
||||
if !d.NextArg() {
|
||||
return false
|
||||
}
|
||||
|
||||
@@ -63,33 +63,8 @@ func Format(input []byte) []byte {
|
||||
heredocClosingMarker []rune
|
||||
|
||||
nesting int // indentation level
|
||||
|
||||
currentToken strings.Builder
|
||||
currentLineFirstToken string
|
||||
previousLineWasTopLevelImport bool
|
||||
openBraceOwnLine bool
|
||||
)
|
||||
|
||||
finishToken := func() {
|
||||
if currentToken.Len() == 0 {
|
||||
return
|
||||
}
|
||||
if currentLineFirstToken == "" {
|
||||
currentLineFirstToken = currentToken.String()
|
||||
}
|
||||
currentToken.Reset()
|
||||
}
|
||||
|
||||
finishLine := func() {
|
||||
finishToken()
|
||||
if currentLineFirstToken != "" {
|
||||
previousLineWasTopLevelImport = nesting == 0 && currentLineFirstToken == "import"
|
||||
} else if !openBrace || !openBraceOwnLine || openBraceWritten {
|
||||
previousLineWasTopLevelImport = false
|
||||
}
|
||||
currentLineFirstToken = ""
|
||||
}
|
||||
|
||||
write := func(ch rune) {
|
||||
out.WriteRune(ch)
|
||||
last = ch
|
||||
@@ -245,11 +220,9 @@ func Format(input []byte) []byte {
|
||||
}
|
||||
|
||||
if unicode.IsSpace(ch) {
|
||||
finishToken()
|
||||
space = true
|
||||
heredocEscaped = false
|
||||
if ch == '\n' {
|
||||
finishLine()
|
||||
newLines++
|
||||
}
|
||||
continue
|
||||
@@ -276,19 +249,13 @@ func Format(input []byte) []byte {
|
||||
}
|
||||
|
||||
openBrace = false
|
||||
if openBraceOwnLine && previousLineWasTopLevelImport {
|
||||
if last != '\n' {
|
||||
nextLine()
|
||||
}
|
||||
indent()
|
||||
} else if beginningOfLine {
|
||||
if beginningOfLine {
|
||||
indent()
|
||||
} else if !openBraceSpace || !unicode.IsSpace(last) {
|
||||
write(' ')
|
||||
}
|
||||
write('{')
|
||||
openBraceWritten = true
|
||||
openBraceOwnLine = false
|
||||
nextLine()
|
||||
newLines = 0
|
||||
// prevent infinite nesting from ridiculous inputs (issue #4169)
|
||||
@@ -299,10 +266,8 @@ func Format(input []byte) []byte {
|
||||
|
||||
switch {
|
||||
case ch == '{':
|
||||
finishToken()
|
||||
openBrace = true
|
||||
openBraceSpace = spacePrior && !beginningOfLine
|
||||
openBraceOwnLine = newLines > 0
|
||||
if openBraceSpace && newLines == 0 {
|
||||
write(' ')
|
||||
}
|
||||
@@ -310,13 +275,11 @@ func Format(input []byte) []byte {
|
||||
if quotes == "`" {
|
||||
write('{')
|
||||
openBraceWritten = true
|
||||
openBraceOwnLine = false
|
||||
continue
|
||||
}
|
||||
continue
|
||||
|
||||
case ch == '}' && (spacePrior || !openBrace):
|
||||
finishToken()
|
||||
if quotes == "`" {
|
||||
write('}')
|
||||
continue
|
||||
@@ -361,7 +324,6 @@ func Format(input []byte) []byte {
|
||||
space = true
|
||||
}
|
||||
|
||||
currentToken.WriteRune(ch)
|
||||
write(ch)
|
||||
|
||||
beginningOfLine = false
|
||||
|
||||
@@ -475,21 +475,6 @@ Hope this helps.` + "`" + `
|
||||
}`,
|
||||
expect: "https://localhost:8953 {\n\trespond `Here are some random numbers:\n\n{{randNumeric 16}}\n\nHope this helps.`\n}",
|
||||
},
|
||||
{
|
||||
description: "imports before global options block keep standalone brace",
|
||||
input: `import ./conf.d/matcher_my_subnet.caddy
|
||||
import ./conf.d/matcher_not_my_subnet.caddy
|
||||
{
|
||||
order crowdsec first
|
||||
order appsec after crowdsec
|
||||
}`,
|
||||
expect: `import ./conf.d/matcher_my_subnet.caddy
|
||||
import ./conf.d/matcher_not_my_subnet.caddy
|
||||
{
|
||||
order crowdsec first
|
||||
order appsec after crowdsec
|
||||
}`,
|
||||
},
|
||||
} {
|
||||
// the formatter should output a trailing newline,
|
||||
// even if the tests aren't written to expect that
|
||||
|
||||
@@ -507,7 +507,7 @@ func (p *parser) doImport(nesting int) error {
|
||||
// format, won't check for nesting correctness or any other error, that's what parser does.
|
||||
if !maybeSnippet && nesting == 0 {
|
||||
// first of the line
|
||||
if i == 0 || isNextOnNewLine(tokensCopy[len(tokensCopy)-1], token) {
|
||||
if i == 0 || isNextOnNewLine(tokensCopy[i-1], token) {
|
||||
index = 0
|
||||
} else {
|
||||
index++
|
||||
@@ -550,11 +550,7 @@ func (p *parser) doImport(nesting int) error {
|
||||
}
|
||||
|
||||
if foundBlockDirective {
|
||||
if maybeSnippet {
|
||||
tokensCopy = append(tokensCopy, token)
|
||||
} else {
|
||||
tokensCopy = append(tokensCopy, tokensToAdd...)
|
||||
}
|
||||
tokensCopy = append(tokensCopy, tokensToAdd...)
|
||||
continue
|
||||
}
|
||||
|
||||
@@ -620,7 +616,7 @@ func (p *parser) doSingleImport(importFile string) ([]Token, error) {
|
||||
if err != nil {
|
||||
return nil, p.Errf("Failed to get absolute path of file: %s: %v", importFile, err)
|
||||
}
|
||||
for i := range importedTokens {
|
||||
for i := 0; i < len(importedTokens); i++ {
|
||||
importedTokens[i].File = filename
|
||||
}
|
||||
|
||||
@@ -686,28 +682,11 @@ func (p *parser) directive() error {
|
||||
// a opening curly brace. It does NOT advance the token.
|
||||
func (p *parser) openCurlyBrace() error {
|
||||
if p.Val() != "{" {
|
||||
if p.valLooksLikeGlobalOptionsAfterImportedSnippets() {
|
||||
return p.Err("global options block must appear before import directives; move the global options block to the top of the Caddyfile")
|
||||
}
|
||||
return p.SyntaxErr("{")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (p *parser) valLooksLikeGlobalOptionsAfterImportedSnippets() bool {
|
||||
if p.Val() != "import" || len(p.block.Keys) == 0 {
|
||||
return false
|
||||
}
|
||||
|
||||
for _, key := range p.block.Keys {
|
||||
if !strings.HasPrefix(key.Text, "(") || !strings.HasSuffix(key.Text, ")") {
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
// closeCurlyBrace expects the current token to be
|
||||
// a closing curly brace. This acts like an assertion
|
||||
// because it returns an error if the token is not
|
||||
|
||||
@@ -930,107 +930,6 @@ func TestAcceptSiteImportWithBraces(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestGlobalOptionsAfterImportedSnippetsGivesHelpfulError(t *testing.T) {
|
||||
tempDir := t.TempDir()
|
||||
importFile1 := filepath.Join(tempDir, "matcher_snippet_1.caddy")
|
||||
importFile2 := filepath.Join(tempDir, "matcher_snippet_2.caddy")
|
||||
|
||||
err := os.WriteFile(importFile1, []byte(`(matcher1)`), 0o644)
|
||||
if err != nil {
|
||||
t.Fatalf("writing first import file: %v", err)
|
||||
}
|
||||
|
||||
err = os.WriteFile(importFile2, []byte(`(matcher2)`), 0o644)
|
||||
if err != nil {
|
||||
t.Fatalf("writing second import file: %v", err)
|
||||
}
|
||||
|
||||
_, err = Parse("Testfile", []byte(`import `+importFile1+`
|
||||
import `+importFile2+`
|
||||
{
|
||||
debug
|
||||
}`))
|
||||
if err == nil {
|
||||
t.Fatal("Expected an error, but got nil")
|
||||
}
|
||||
|
||||
expected := "global options block must appear before import directives; move the global options block to the top of the Caddyfile"
|
||||
if !strings.HasPrefix(err.Error(), expected) {
|
||||
t.Errorf("Expected error to start with '%s' but got '%v'", expected, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestImportedSnippetDefinitionRetainsBlockPlaceholder(t *testing.T) {
|
||||
tempDir := t.TempDir()
|
||||
importFile := filepath.Join(tempDir, "snippets.caddy")
|
||||
|
||||
err := os.WriteFile(importFile, []byte(`
|
||||
(site) {
|
||||
http://{args[0]} {
|
||||
respond "before"
|
||||
{block}
|
||||
respond "after"
|
||||
}
|
||||
}
|
||||
`), 0o644)
|
||||
if err != nil {
|
||||
t.Fatalf("writing imported snippet file: %v", err)
|
||||
}
|
||||
|
||||
for _, tc := range []struct {
|
||||
name string
|
||||
input string
|
||||
expectedDirectives []string
|
||||
}{
|
||||
{
|
||||
name: "with nested block",
|
||||
input: `
|
||||
import ` + importFile + `
|
||||
|
||||
import site example.com {
|
||||
redir https://example.net
|
||||
}
|
||||
`,
|
||||
expectedDirectives: []string{"respond", "redir", "respond"},
|
||||
},
|
||||
{
|
||||
name: "without nested block",
|
||||
input: `
|
||||
import ` + importFile + `
|
||||
|
||||
import site example.com
|
||||
`,
|
||||
expectedDirectives: []string{"respond", "respond"},
|
||||
},
|
||||
} {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
p := testParser(tc.input)
|
||||
blocks, err := p.parseAll()
|
||||
if err != nil {
|
||||
t.Fatalf("parseAll: %v", err)
|
||||
}
|
||||
|
||||
if len(blocks) != 1 {
|
||||
t.Fatalf("expected exactly one server block, got %d", len(blocks))
|
||||
}
|
||||
|
||||
if actual := blocks[0].GetKeysText(); len(actual) != 1 || actual[0] != "http://example.com" {
|
||||
t.Fatalf("expected server block key http://example.com, got %v", actual)
|
||||
}
|
||||
|
||||
if len(blocks[0].Segments) != len(tc.expectedDirectives) {
|
||||
t.Fatalf("expected %d segments, got %d", len(tc.expectedDirectives), len(blocks[0].Segments))
|
||||
}
|
||||
|
||||
for i, directive := range tc.expectedDirectives {
|
||||
if actual := blocks[0].Segments[i].Directive(); actual != directive {
|
||||
t.Fatalf("segment %d: expected directive %q, got %q", i, directive, actual)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func testParser(input string) parser {
|
||||
return parser{Dispenser: NewTestDispenser(input)}
|
||||
}
|
||||
|
||||
@@ -113,7 +113,6 @@ func parseBind(h Helper) ([]ConfigValue, error) {
|
||||
// issuer <module_name> [...]
|
||||
// get_certificate <module_name> [...]
|
||||
// insecure_secrets_log <log_file>
|
||||
// renewal_window_ratio <ratio>
|
||||
// }
|
||||
func parseTLS(h Helper) ([]ConfigValue, error) {
|
||||
h.Next() // consume directive name
|
||||
@@ -130,7 +129,6 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
|
||||
var onDemand bool
|
||||
var reusePrivateKeys bool
|
||||
var forceAutomate bool
|
||||
var renewalWindowRatio float64
|
||||
|
||||
// Track which DNS challenge options are set
|
||||
var dnsOptionsSet []string
|
||||
@@ -475,20 +473,6 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
|
||||
}
|
||||
cp.InsecureSecretsLog = h.Val()
|
||||
|
||||
case "renewal_window_ratio":
|
||||
arg := h.RemainingArgs()
|
||||
if len(arg) != 1 {
|
||||
return nil, h.ArgErr()
|
||||
}
|
||||
ratio, err := strconv.ParseFloat(arg[0], 64)
|
||||
if err != nil {
|
||||
return nil, h.Errf("parsing renewal_window_ratio: %v", err)
|
||||
}
|
||||
if ratio <= 0 || ratio >= 1 {
|
||||
return nil, h.Errf("renewal_window_ratio must be between 0 and 1 (exclusive)")
|
||||
}
|
||||
renewalWindowRatio = ratio
|
||||
|
||||
default:
|
||||
return nil, h.Errf("unknown subdirective: %s", h.Val())
|
||||
}
|
||||
@@ -550,11 +534,26 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
|
||||
}
|
||||
|
||||
case acmeIssuer != nil:
|
||||
// implicit ACME issuers (from various subdirectives) should inherit from
|
||||
// any globally-configured ACME issuer templates, then apply the local
|
||||
// shortcut settings as overrides.
|
||||
defaultIssuers := implicitACMEIssuers(h, acmeIssuer)
|
||||
// implicit ACME issuers (from various subdirectives) - use defaults; there might be more than one
|
||||
defaultIssuers := caddytls.DefaultIssuers(acmeIssuer.Email)
|
||||
|
||||
// if an ACME CA endpoint was set, the user expects to use that specific one,
|
||||
// not any others that may be defaults, so replace all defaults with that ACME CA
|
||||
if acmeIssuer.CA != "" {
|
||||
defaultIssuers = []certmagic.Issuer{acmeIssuer}
|
||||
}
|
||||
|
||||
for _, issuer := range defaultIssuers {
|
||||
// apply settings from the implicitly-configured ACMEIssuer to any
|
||||
// default ACMEIssuers, but preserve each default issuer's CA endpoint,
|
||||
// because, for example, if you configure the DNS challenge, it should
|
||||
// apply to any of the default ACMEIssuers, but you don't want to trample
|
||||
// out their unique CA endpoints
|
||||
if iss, ok := issuer.(*caddytls.ACMEIssuer); ok && iss != nil {
|
||||
acmeCopy := *acmeIssuer
|
||||
acmeCopy.CA = iss.CA
|
||||
issuer = &acmeCopy
|
||||
}
|
||||
configVals = append(configVals, ConfigValue{
|
||||
Class: "tls.cert_issuer",
|
||||
Value: issuer,
|
||||
@@ -598,14 +597,6 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
|
||||
})
|
||||
}
|
||||
|
||||
// renewal window ratio
|
||||
if renewalWindowRatio > 0 {
|
||||
configVals = append(configVals, ConfigValue{
|
||||
Class: "tls.renewal_window_ratio",
|
||||
Value: renewalWindowRatio,
|
||||
})
|
||||
}
|
||||
|
||||
// if enabled, the names in the site addresses will be
|
||||
// added to the automation policies
|
||||
if forceAutomate {
|
||||
@@ -653,8 +644,6 @@ func parseRoot(h Helper) ([]ConfigValue, error) {
|
||||
if !h.NextArg() {
|
||||
return nil, h.ArgErr()
|
||||
}
|
||||
// store the unmatched root in block state so sibling directives can access it
|
||||
h.BlockState["root"] = h.Val()
|
||||
return h.NewRoute(nil, caddyhttp.VarsMiddleware{"root": h.Val()}), nil
|
||||
}
|
||||
|
||||
@@ -669,10 +658,6 @@ func parseRoot(h Helper) ([]ConfigValue, error) {
|
||||
if !h.NextArg() {
|
||||
return nil, h.ArgErr()
|
||||
}
|
||||
// store the unmatched root in state so sibling/child directives can access it
|
||||
if userMatcherSet == nil {
|
||||
h.BlockState["root"] = h.Val()
|
||||
}
|
||||
// make the route with the matcher
|
||||
return h.NewRoute(userMatcherSet, caddyhttp.VarsMiddleware{"root": h.Val()}), nil
|
||||
}
|
||||
@@ -1053,7 +1038,7 @@ func parseLogHelper(h Helper, globalLogNames map[string]struct{}) ([]ConfigValue
|
||||
if !d.NextArg() {
|
||||
return nil, d.ArgErr()
|
||||
}
|
||||
interval, err := caddy.ParseDuration(d.Val())
|
||||
interval, err := time.ParseDuration(d.Val() + "ns")
|
||||
if err != nil {
|
||||
return nil, d.Errf("failed to parse interval: %v", err)
|
||||
}
|
||||
|
||||
@@ -66,14 +66,14 @@ func TestLogDirectiveSyntax(t *testing.T) {
|
||||
input: `:8080 {
|
||||
log {
|
||||
sampling {
|
||||
interval 2s
|
||||
interval 2
|
||||
first 3
|
||||
thereafter 4
|
||||
}
|
||||
}
|
||||
}
|
||||
`,
|
||||
output: `{"logging":{"logs":{"default":{"exclude":["http.log.access.log0"]},"log0":{"sampling":{"interval":2000000000,"first":3,"thereafter":4},"include":["http.log.access.log0"]}}},"apps":{"http":{"servers":{"srv0":{"listen":[":8080"],"logs":{"default_logger_name":"log0"}}}}}}`,
|
||||
output: `{"logging":{"logs":{"default":{"exclude":["http.log.access.log0"]},"log0":{"sampling":{"interval":2,"first":3,"thereafter":4},"include":["http.log.access.log0"]}}},"apps":{"http":{"servers":{"srv0":{"listen":[":8080"],"logs":{"default_logger_name":"log0"}}}}}}`,
|
||||
expectError: false,
|
||||
},
|
||||
} {
|
||||
|
||||
@@ -202,10 +202,7 @@ func RegisterGlobalOption(opt string, setupFunc UnmarshalGlobalFunc) {
|
||||
type Helper struct {
|
||||
*caddyfile.Dispenser
|
||||
// State stores intermediate variables during caddyfile adaptation.
|
||||
State map[string]any
|
||||
// BlockState stores intermediate variables scoped to the current block.
|
||||
// It propagates down, but unlike state not back up from child to parent.
|
||||
BlockState map[string]any
|
||||
State map[string]any
|
||||
options map[string]any
|
||||
warnings *[]caddyconfig.Warning
|
||||
matcherDefs map[string]caddy.ModuleMap
|
||||
@@ -388,11 +385,6 @@ func parseSegmentAsConfig(h Helper) ([]ConfigValue, error) {
|
||||
}
|
||||
}
|
||||
|
||||
// clone BlockState once for the entire block so sibling directives
|
||||
// can share state, but changes don't leak to the parent scope
|
||||
subBlockState := make(map[string]any, len(h.BlockState))
|
||||
maps.Copy(subBlockState, h.BlockState)
|
||||
|
||||
// with matchers ready to go, evaluate each directive's segment
|
||||
for _, seg := range segments {
|
||||
dir := seg.Directive()
|
||||
@@ -404,7 +396,6 @@ func parseSegmentAsConfig(h Helper) ([]ConfigValue, error) {
|
||||
subHelper := h
|
||||
subHelper.Dispenser = caddyfile.NewDispenser(seg)
|
||||
subHelper.matcherDefs = matcherDefs
|
||||
subHelper.BlockState = subBlockState
|
||||
|
||||
results, err := dirFunc(subHelper)
|
||||
if err != nil {
|
||||
|
||||
@@ -143,7 +143,6 @@ func (st ServerType) Setup(
|
||||
parentBlock: sb.block,
|
||||
groupCounter: gc,
|
||||
State: state,
|
||||
BlockState: state,
|
||||
}
|
||||
|
||||
results, err := dirFunc(h)
|
||||
@@ -505,7 +504,6 @@ func (ServerType) extractNamedRoutes(
|
||||
parentBlock: sb.block,
|
||||
groupCounter: gc,
|
||||
State: state,
|
||||
BlockState: state,
|
||||
}
|
||||
|
||||
handler, err := ParseSegmentAsSubroute(h)
|
||||
@@ -824,7 +822,7 @@ func (st *ServerType) serversFromPairings(
|
||||
// https://caddy.community/t/making-sense-of-auto-https-and-why-disabling-it-still-serves-https-instead-of-http/9761
|
||||
createdTLSConnPolicies, ok := sblock.pile["tls.connection_policy"]
|
||||
hasTLSEnabled := (ok && len(createdTLSConnPolicies) > 0) ||
|
||||
(addr.Host != "" && (srv.AutoHTTPS == nil || !slices.Contains(srv.AutoHTTPS.Skip, addr.Host)))
|
||||
(addr.Host != "" && srv.AutoHTTPS != nil && !slices.Contains(srv.AutoHTTPS.Skip, addr.Host))
|
||||
|
||||
// we'll need to remember if the address qualifies for auto-HTTPS, so we
|
||||
// can add a TLS conn policy if necessary
|
||||
|
||||
@@ -1,11 +1,9 @@
|
||||
package httpcaddyfile
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"testing"
|
||||
|
||||
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
|
||||
"github.com/caddyserver/caddy/v2/modules/caddyhttp"
|
||||
)
|
||||
|
||||
func TestMatcherSyntax(t *testing.T) {
|
||||
@@ -211,53 +209,3 @@ func TestGlobalOptions(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestDefaultSNIWithoutHTTPS(t *testing.T) {
|
||||
caddyfileStr := `{
|
||||
default_sni my-sni.com
|
||||
}
|
||||
example.com {
|
||||
}`
|
||||
|
||||
adapter := caddyfile.Adapter{
|
||||
ServerType: ServerType{},
|
||||
}
|
||||
|
||||
result, _, err := adapter.Adapt([]byte(caddyfileStr), nil)
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to adapt Caddyfile: %v", err)
|
||||
}
|
||||
|
||||
var config struct {
|
||||
Apps struct {
|
||||
HTTP struct {
|
||||
Servers map[string]*caddyhttp.Server `json:"servers"`
|
||||
} `json:"http"`
|
||||
} `json:"apps"`
|
||||
}
|
||||
|
||||
if err := json.Unmarshal(result, &config); err != nil {
|
||||
t.Fatalf("Failed to unmarshal JSON config: %v", err)
|
||||
}
|
||||
|
||||
server, ok := config.Apps.HTTP.Servers["srv0"]
|
||||
if !ok {
|
||||
t.Fatalf("Expected server 'srv0' to be created")
|
||||
}
|
||||
|
||||
if len(server.TLSConnPolicies) == 0 {
|
||||
t.Fatalf("Expected TLS connection policies to be generated, got none")
|
||||
}
|
||||
|
||||
found := false
|
||||
for _, policy := range server.TLSConnPolicies {
|
||||
if policy.DefaultSNI == "my-sni.com" {
|
||||
found = true
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if !found {
|
||||
t.Errorf("Expected default_sni 'my-sni.com' in TLS connection policies, but it was missing. Generated JSON: %s", string(result))
|
||||
}
|
||||
}
|
||||
|
||||
@@ -64,9 +64,7 @@ func init() {
|
||||
RegisterGlobalOption("preferred_chains", parseOptPreferredChains)
|
||||
RegisterGlobalOption("persist_config", parseOptPersistConfig)
|
||||
RegisterGlobalOption("dns", parseOptDNS)
|
||||
RegisterGlobalOption("tls_resolvers", parseOptTLSResolvers)
|
||||
RegisterGlobalOption("ech", parseOptECH)
|
||||
RegisterGlobalOption("renewal_window_ratio", parseOptRenewalWindowRatio)
|
||||
}
|
||||
|
||||
func parseOptTrue(d *caddyfile.Dispenser, _ any) (any, error) { return true, nil }
|
||||
@@ -307,15 +305,6 @@ func parseOptSingleString(d *caddyfile.Dispenser, _ any) (any, error) {
|
||||
return val, nil
|
||||
}
|
||||
|
||||
func parseOptTLSResolvers(d *caddyfile.Dispenser, _ any) (any, error) {
|
||||
d.Next() // consume option name
|
||||
resolvers := d.RemainingArgs()
|
||||
if len(resolvers) == 0 {
|
||||
return nil, d.ArgErr()
|
||||
}
|
||||
return resolvers, nil
|
||||
}
|
||||
|
||||
func parseOptDefaultBind(d *caddyfile.Dispenser, _ any) (any, error) {
|
||||
d.Next() // consume option name
|
||||
|
||||
@@ -468,8 +457,9 @@ func parseOptAutoHTTPS(d *caddyfile.Dispenser, _ any) (any, error) {
|
||||
case "disable_redirects":
|
||||
case "disable_certs":
|
||||
case "ignore_loaded_certs":
|
||||
case "prefer_wildcard":
|
||||
default:
|
||||
return "", d.Errf("auto_https must be one of 'off', 'disable_redirects', 'disable_certs', or 'ignore_loaded_certs'")
|
||||
return "", d.Errf("auto_https must be one of 'off', 'disable_redirects', 'disable_certs', 'ignore_loaded_certs', or 'prefer_wildcard'")
|
||||
}
|
||||
}
|
||||
return val, nil
|
||||
@@ -484,8 +474,6 @@ func unmarshalCaddyfileMetricsOptions(d *caddyfile.Dispenser) (any, error) {
|
||||
metrics.PerHost = true
|
||||
case "observe_catchall_hosts":
|
||||
metrics.ObserveCatchallHosts = true
|
||||
case "otlp":
|
||||
metrics.OTLP = true
|
||||
default:
|
||||
return nil, d.Errf("unrecognized servers option '%s'", d.Val())
|
||||
}
|
||||
@@ -637,22 +625,3 @@ func parseOptECH(d *caddyfile.Dispenser, _ any) (any, error) {
|
||||
|
||||
return ech, nil
|
||||
}
|
||||
|
||||
func parseOptRenewalWindowRatio(d *caddyfile.Dispenser, _ any) (any, error) {
|
||||
d.Next() // consume option name
|
||||
if !d.Next() {
|
||||
return 0, d.ArgErr()
|
||||
}
|
||||
val := d.Val()
|
||||
ratio, err := strconv.ParseFloat(val, 64)
|
||||
if err != nil {
|
||||
return 0, d.Errf("parsing renewal_window_ratio: %v", err)
|
||||
}
|
||||
if ratio <= 0 || ratio >= 1 {
|
||||
return 0, d.Errf("renewal_window_ratio must be between 0 and 1 (exclusive)")
|
||||
}
|
||||
if d.Next() {
|
||||
return 0, d.ArgErr()
|
||||
}
|
||||
return ratio, nil
|
||||
}
|
||||
|
||||
@@ -1,13 +1,9 @@
|
||||
package httpcaddyfile
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/caddyserver/caddy/v2"
|
||||
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
|
||||
"github.com/caddyserver/caddy/v2/modules/caddytls"
|
||||
_ "github.com/caddyserver/caddy/v2/modules/logging"
|
||||
)
|
||||
|
||||
@@ -66,228 +62,3 @@ func TestGlobalLogOptionSyntax(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestGlobalResolversOption(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
input string
|
||||
expectResolvers []string
|
||||
expectError bool
|
||||
}{
|
||||
{
|
||||
name: "single resolver",
|
||||
input: `{
|
||||
tls_resolvers 1.1.1.1
|
||||
}
|
||||
example.com {
|
||||
}`,
|
||||
expectResolvers: []string{"1.1.1.1"},
|
||||
expectError: false,
|
||||
},
|
||||
{
|
||||
name: "two resolvers",
|
||||
input: `{
|
||||
tls_resolvers 1.1.1.1 8.8.8.8
|
||||
}
|
||||
example.com {
|
||||
}`,
|
||||
expectResolvers: []string{"1.1.1.1", "8.8.8.8"},
|
||||
expectError: false,
|
||||
},
|
||||
{
|
||||
name: "multiple resolvers",
|
||||
input: `{
|
||||
tls_resolvers 1.1.1.1 8.8.8.8 9.9.9.9
|
||||
}
|
||||
example.com {
|
||||
}`,
|
||||
expectResolvers: []string{"1.1.1.1", "8.8.8.8", "9.9.9.9"},
|
||||
expectError: false,
|
||||
},
|
||||
{
|
||||
name: "no resolvers specified",
|
||||
input: `{
|
||||
}
|
||||
example.com {
|
||||
}`,
|
||||
expectResolvers: nil,
|
||||
expectError: false,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range tests {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
adapter := caddyfile.Adapter{
|
||||
ServerType: ServerType{},
|
||||
}
|
||||
|
||||
out, _, err := adapter.Adapt([]byte(tc.input), nil)
|
||||
|
||||
if (err != nil) != tc.expectError {
|
||||
t.Errorf("error expectation failed. Expected error: %v, got: %v", tc.expectError, err)
|
||||
return
|
||||
}
|
||||
|
||||
if tc.expectError {
|
||||
return
|
||||
}
|
||||
|
||||
// Parse the output JSON to check resolvers
|
||||
var config struct {
|
||||
Apps struct {
|
||||
TLS *caddytls.TLS `json:"tls"`
|
||||
} `json:"apps"`
|
||||
}
|
||||
|
||||
if err := json.Unmarshal(out, &config); err != nil {
|
||||
t.Errorf("failed to unmarshal output: %v", err)
|
||||
return
|
||||
}
|
||||
|
||||
// Check if resolvers match expected
|
||||
if config.Apps.TLS == nil {
|
||||
if tc.expectResolvers != nil {
|
||||
t.Errorf("Expected TLS config with resolvers %v, but TLS config is nil", tc.expectResolvers)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
actualResolvers := config.Apps.TLS.Resolvers
|
||||
if len(tc.expectResolvers) == 0 && len(actualResolvers) == 0 {
|
||||
return // Both empty, ok
|
||||
}
|
||||
if len(actualResolvers) != len(tc.expectResolvers) {
|
||||
t.Errorf("Expected %d resolvers, got %d. Expected: %v, got: %v", len(tc.expectResolvers), len(actualResolvers), tc.expectResolvers, actualResolvers)
|
||||
return
|
||||
}
|
||||
for j, expected := range tc.expectResolvers {
|
||||
if actualResolvers[j] != expected {
|
||||
t.Errorf("Resolver %d mismatch. Expected: %s, got: %s", j, expected, actualResolvers[j])
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestGlobalCertIssuerAppliesToImplicitACMEIssuer(t *testing.T) {
|
||||
adapter := caddyfile.Adapter{
|
||||
ServerType: ServerType{},
|
||||
}
|
||||
|
||||
input := `{
|
||||
cert_issuer acme {
|
||||
disable_tlsalpn_challenge
|
||||
}
|
||||
}
|
||||
report.company.intern {
|
||||
tls {
|
||||
ca https://deglacme01.company.intern/acme/acme/directory
|
||||
ca_root /etc/certs/company_root2.crt
|
||||
}
|
||||
respond "ok"
|
||||
}`
|
||||
|
||||
out, _, err := adapter.Adapt([]byte(input), nil)
|
||||
if err != nil {
|
||||
t.Fatalf("adapting caddyfile: %v", err)
|
||||
}
|
||||
|
||||
var config struct {
|
||||
Apps struct {
|
||||
TLS *caddytls.TLS `json:"tls"`
|
||||
} `json:"apps"`
|
||||
}
|
||||
if err := json.Unmarshal(out, &config); err != nil {
|
||||
t.Fatalf("unmarshaling adapted config: %v", err)
|
||||
}
|
||||
if config.Apps.TLS == nil || config.Apps.TLS.Automation == nil {
|
||||
t.Fatal("expected tls automation config")
|
||||
}
|
||||
|
||||
var subjectPolicy *caddytls.AutomationPolicy
|
||||
for _, ap := range config.Apps.TLS.Automation.Policies {
|
||||
if len(ap.SubjectsRaw) == 1 && ap.SubjectsRaw[0] == "report.company.intern" {
|
||||
subjectPolicy = ap
|
||||
break
|
||||
}
|
||||
}
|
||||
if subjectPolicy == nil {
|
||||
t.Fatal("expected subject-specific automation policy")
|
||||
}
|
||||
if len(subjectPolicy.IssuersRaw) != 1 {
|
||||
t.Fatalf("expected one issuer for subject-specific policy, got %d", len(subjectPolicy.IssuersRaw))
|
||||
}
|
||||
|
||||
var issuer caddytls.ACMEIssuer
|
||||
if err := json.Unmarshal(subjectPolicy.IssuersRaw[0], &issuer); err != nil {
|
||||
t.Fatalf("unmarshaling issuer: %v", err)
|
||||
}
|
||||
if issuer.CA != "https://deglacme01.company.intern/acme/acme/directory" {
|
||||
t.Fatalf("expected custom ACME CA, got %q", issuer.CA)
|
||||
}
|
||||
if len(issuer.TrustedRootsPEMFiles) != 1 || issuer.TrustedRootsPEMFiles[0] != "/etc/certs/company_root2.crt" {
|
||||
t.Fatalf("expected trusted roots to include site CA root, got %v", issuer.TrustedRootsPEMFiles)
|
||||
}
|
||||
if issuer.Challenges == nil || issuer.Challenges.TLSALPN == nil || !issuer.Challenges.TLSALPN.Disabled {
|
||||
t.Fatalf("expected tls-alpn challenge to be disabled, got %#v", issuer.Challenges)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMergeACMEIssuers(t *testing.T) {
|
||||
base := &caddytls.ACMEIssuer{
|
||||
Email: "ops@example.com",
|
||||
Challenges: &caddytls.ChallengesConfig{
|
||||
HTTP: &caddytls.HTTPChallengeConfig{
|
||||
AlternatePort: 8080,
|
||||
},
|
||||
TLSALPN: &caddytls.TLSALPNChallengeConfig{
|
||||
Disabled: true,
|
||||
AlternatePort: 8443,
|
||||
},
|
||||
DNS: &caddytls.DNSChallengeConfig{
|
||||
Resolvers: []string{"1.1.1.1"},
|
||||
OverrideDomain: "_acme-challenge.example.net",
|
||||
},
|
||||
},
|
||||
TrustedRootsPEMFiles: []string{"global.pem"},
|
||||
}
|
||||
overrides := &caddytls.ACMEIssuer{
|
||||
CA: "https://deglacme01.company.intern/acme/acme/directory",
|
||||
Challenges: &caddytls.ChallengesConfig{
|
||||
HTTP: &caddytls.HTTPChallengeConfig{
|
||||
Disabled: true,
|
||||
},
|
||||
DNS: &caddytls.DNSChallengeConfig{
|
||||
PropagationTimeout: caddy.Duration(time.Minute),
|
||||
},
|
||||
},
|
||||
TrustedRootsPEMFiles: []string{"site.pem"},
|
||||
}
|
||||
|
||||
merged := mergeACMEIssuers(base, overrides)
|
||||
if merged.CA != overrides.CA {
|
||||
t.Fatalf("expected merged CA %q, got %q", overrides.CA, merged.CA)
|
||||
}
|
||||
if merged.Email != base.Email {
|
||||
t.Fatalf("expected merged email %q, got %q", base.Email, merged.Email)
|
||||
}
|
||||
if len(merged.TrustedRootsPEMFiles) != 2 || merged.TrustedRootsPEMFiles[0] != "global.pem" || merged.TrustedRootsPEMFiles[1] != "site.pem" {
|
||||
t.Fatalf("expected merged roots [global.pem site.pem], got %v", merged.TrustedRootsPEMFiles)
|
||||
}
|
||||
if merged.Challenges == nil || merged.Challenges.HTTP == nil || !merged.Challenges.HTTP.Disabled || merged.Challenges.HTTP.AlternatePort != 8080 {
|
||||
t.Fatalf("expected merged HTTP challenge config to preserve alternate port and apply disable flag, got %#v", merged.Challenges)
|
||||
}
|
||||
if merged.Challenges.TLSALPN == nil || !merged.Challenges.TLSALPN.Disabled || merged.Challenges.TLSALPN.AlternatePort != 8443 {
|
||||
t.Fatalf("expected merged TLS-ALPN challenge config to preserve global settings, got %#v", merged.Challenges)
|
||||
}
|
||||
if merged.Challenges.DNS == nil || merged.Challenges.DNS.PropagationTimeout != caddy.Duration(time.Minute) || len(merged.Challenges.DNS.Resolvers) != 1 || merged.Challenges.DNS.Resolvers[0] != "1.1.1.1" || merged.Challenges.DNS.OverrideDomain != "_acme-challenge.example.net" {
|
||||
t.Fatalf("expected merged DNS challenge config to preserve global values and apply overrides, got %#v", merged.Challenges)
|
||||
}
|
||||
|
||||
if base.CA != "" {
|
||||
t.Fatalf("expected base issuer to remain unchanged, got CA %q", base.CA)
|
||||
}
|
||||
if len(base.TrustedRootsPEMFiles) != 1 || base.TrustedRootsPEMFiles[0] != "global.pem" {
|
||||
t.Fatalf("expected base roots to remain unchanged, got %v", base.TrustedRootsPEMFiles)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -16,7 +16,6 @@ package httpcaddyfile
|
||||
|
||||
import (
|
||||
"slices"
|
||||
"strconv"
|
||||
|
||||
"github.com/caddyserver/caddy/v2"
|
||||
"github.com/caddyserver/caddy/v2/caddyconfig"
|
||||
@@ -28,16 +27,14 @@ func init() {
|
||||
RegisterGlobalOption("pki", parsePKIApp)
|
||||
}
|
||||
|
||||
// parsePKIApp parses the global pki option. Syntax:
|
||||
// parsePKIApp parses the global log option. Syntax:
|
||||
//
|
||||
// pki {
|
||||
// ca [<id>] {
|
||||
// name <name>
|
||||
// root_cn <name>
|
||||
// intermediate_cn <name>
|
||||
// intermediate_lifetime <duration>
|
||||
// maintenance_interval <duration>
|
||||
// renewal_window_ratio <ratio>
|
||||
// name <name>
|
||||
// root_cn <name>
|
||||
// intermediate_cn <name>
|
||||
// intermediate_lifetime <duration>
|
||||
// root {
|
||||
// cert <path>
|
||||
// key <path>
|
||||
@@ -102,26 +99,6 @@ func parsePKIApp(d *caddyfile.Dispenser, existingVal any) (any, error) {
|
||||
}
|
||||
pkiCa.IntermediateLifetime = caddy.Duration(dur)
|
||||
|
||||
case "maintenance_interval":
|
||||
if !d.NextArg() {
|
||||
return nil, d.ArgErr()
|
||||
}
|
||||
dur, err := caddy.ParseDuration(d.Val())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
pkiCa.MaintenanceInterval = caddy.Duration(dur)
|
||||
|
||||
case "renewal_window_ratio":
|
||||
if !d.NextArg() {
|
||||
return nil, d.ArgErr()
|
||||
}
|
||||
ratio, err := strconv.ParseFloat(d.Val(), 64)
|
||||
if err != nil || ratio <= 0 || ratio > 1 {
|
||||
return nil, d.Errf("renewal_window_ratio must be a number in (0, 1], got %s", d.Val())
|
||||
}
|
||||
pkiCa.RenewalWindowRatio = ratio
|
||||
|
||||
case "root":
|
||||
if pkiCa.Root == nil {
|
||||
pkiCa.Root = new(caddypki.KeyPair)
|
||||
|
||||
@@ -1,86 +0,0 @@
|
||||
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package httpcaddyfile
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
|
||||
)
|
||||
|
||||
func TestParsePKIApp_maintenanceIntervalAndRenewalWindowRatio(t *testing.T) {
|
||||
input := `{
|
||||
pki {
|
||||
ca local {
|
||||
maintenance_interval 5m
|
||||
renewal_window_ratio 0.15
|
||||
}
|
||||
}
|
||||
}
|
||||
:8080 {
|
||||
}
|
||||
`
|
||||
adapter := caddyfile.Adapter{ServerType: ServerType{}}
|
||||
out, _, err := adapter.Adapt([]byte(input), nil)
|
||||
if err != nil {
|
||||
t.Fatalf("Adapt failed: %v", err)
|
||||
}
|
||||
|
||||
var cfg struct {
|
||||
Apps struct {
|
||||
PKI struct {
|
||||
CertificateAuthorities map[string]struct {
|
||||
MaintenanceInterval int64 `json:"maintenance_interval,omitempty"`
|
||||
RenewalWindowRatio float64 `json:"renewal_window_ratio,omitempty"`
|
||||
} `json:"certificate_authorities,omitempty"`
|
||||
} `json:"pki,omitempty"`
|
||||
} `json:"apps"`
|
||||
}
|
||||
if err := json.Unmarshal(out, &cfg); err != nil {
|
||||
t.Fatalf("unmarshal config: %v", err)
|
||||
}
|
||||
|
||||
ca, ok := cfg.Apps.PKI.CertificateAuthorities["local"]
|
||||
if !ok {
|
||||
t.Fatal("expected certificate_authorities.local to exist")
|
||||
}
|
||||
wantInterval := 5 * time.Minute.Nanoseconds()
|
||||
if ca.MaintenanceInterval != wantInterval {
|
||||
t.Errorf("maintenance_interval = %d, want %d (5m)", ca.MaintenanceInterval, wantInterval)
|
||||
}
|
||||
if ca.RenewalWindowRatio != 0.15 {
|
||||
t.Errorf("renewal_window_ratio = %v, want 0.15", ca.RenewalWindowRatio)
|
||||
}
|
||||
}
|
||||
|
||||
func TestParsePKIApp_renewalWindowRatioInvalid(t *testing.T) {
|
||||
input := `{
|
||||
pki {
|
||||
ca local {
|
||||
renewal_window_ratio 1.5
|
||||
}
|
||||
}
|
||||
}
|
||||
:8080 {
|
||||
}
|
||||
`
|
||||
adapter := caddyfile.Adapter{ServerType: ServerType{}}
|
||||
_, _, err := adapter.Adapt([]byte(input), nil)
|
||||
if err == nil {
|
||||
t.Error("expected error for renewal_window_ratio > 1")
|
||||
}
|
||||
}
|
||||
@@ -57,9 +57,6 @@ type serverOptions struct {
|
||||
ShouldLogCredentials bool
|
||||
Metrics *caddyhttp.Metrics
|
||||
Trace bool // TODO: EXPERIMENTAL
|
||||
// If set, overrides whether QUIC listeners allow 0-RTT (early data).
|
||||
// If nil, the default behavior is used (currently allowed).
|
||||
Allow0RTT *bool
|
||||
}
|
||||
|
||||
func unmarshalCaddyfileServerOptions(d *caddyfile.Dispenser) (any, error) {
|
||||
@@ -312,17 +309,6 @@ func unmarshalCaddyfileServerOptions(d *caddyfile.Dispenser) (any, error) {
|
||||
}
|
||||
serverOpts.Trace = true
|
||||
|
||||
case "0rtt":
|
||||
// only supports "off" for now
|
||||
if !d.NextArg() {
|
||||
return nil, d.ArgErr()
|
||||
}
|
||||
if d.Val() != "off" {
|
||||
return nil, d.Errf("unsupported 0rtt argument '%s' (only 'off' is supported)", d.Val())
|
||||
}
|
||||
boolVal := false
|
||||
serverOpts.Allow0RTT = &boolVal
|
||||
|
||||
default:
|
||||
return nil, d.Errf("unrecognized servers option '%s'", d.Val())
|
||||
}
|
||||
@@ -387,7 +373,6 @@ func applyServerOptions(
|
||||
server.TrustedProxiesStrict = opts.TrustedProxiesStrict
|
||||
server.TrustedProxiesUnix = opts.TrustedProxiesUnix
|
||||
server.Metrics = opts.Metrics
|
||||
server.Allow0RTT = opts.Allow0RTT
|
||||
if opts.ShouldLogCredentials {
|
||||
if server.Logs == nil {
|
||||
server.Logs = new(caddyhttp.ServerLogConfig)
|
||||
|
||||
@@ -92,8 +92,26 @@ func (st ServerType) buildTLSApp(
|
||||
tlsApp.Automation.Policies = append(tlsApp.Automation.Policies, catchAllAP)
|
||||
}
|
||||
|
||||
var wildcardHosts []string // collect all hosts that have a wildcard in them, and aren't HTTP
|
||||
forcedAutomatedNames := make(map[string]struct{}) // explicitly configured to be automated, even if covered by a wildcard
|
||||
|
||||
for _, p := range pairings {
|
||||
var addresses []string
|
||||
for _, addressWithProtocols := range p.addressesWithProtocols {
|
||||
addresses = append(addresses, addressWithProtocols.address)
|
||||
}
|
||||
if !listenersUseAnyPortOtherThan(addresses, httpPort) {
|
||||
continue
|
||||
}
|
||||
for _, sblock := range p.serverBlocks {
|
||||
for _, addr := range sblock.parsedKeys {
|
||||
if strings.HasPrefix(addr.Host, "*.") {
|
||||
wildcardHosts = append(wildcardHosts, addr.Host[2:])
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
for _, p := range pairings {
|
||||
// avoid setting up TLS automation policies for a server that is HTTP-only
|
||||
var addresses []string
|
||||
@@ -117,6 +135,12 @@ func (st ServerType) buildTLSApp(
|
||||
return nil, warnings, err
|
||||
}
|
||||
|
||||
// make a plain copy so we can compare whether we made any changes
|
||||
apCopy, err := newBaseAutomationPolicy(options, warnings, true)
|
||||
if err != nil {
|
||||
return nil, warnings, err
|
||||
}
|
||||
|
||||
sblockHosts := sblock.hostsFromKeys(false)
|
||||
if len(sblockHosts) == 0 && catchAllAP != nil {
|
||||
ap = catchAllAP
|
||||
@@ -143,12 +167,6 @@ func (st ServerType) buildTLSApp(
|
||||
ap.KeyType = keyTypeVals[0].Value.(string)
|
||||
}
|
||||
|
||||
if renewalWindowRatioVals, ok := sblock.pile["tls.renewal_window_ratio"]; ok {
|
||||
ap.RenewalWindowRatio = renewalWindowRatioVals[0].Value.(float64)
|
||||
} else if globalRenewalWindowRatio, ok := options["renewal_window_ratio"]; ok {
|
||||
ap.RenewalWindowRatio = globalRenewalWindowRatio.(float64)
|
||||
}
|
||||
|
||||
// certificate issuers
|
||||
if issuerVals, ok := sblock.pile["tls.cert_issuer"]; ok {
|
||||
var issuers []certmagic.Issuer
|
||||
@@ -235,6 +253,16 @@ func (st ServerType) buildTLSApp(
|
||||
hostsNotHTTP := sblock.hostsFromKeysNotHTTP(httpPort)
|
||||
sort.Strings(hostsNotHTTP) // solely for deterministic test results
|
||||
|
||||
// if the we prefer wildcards and the AP is unchanged,
|
||||
// then we can skip this AP because it should be covered
|
||||
// by an AP with a wildcard
|
||||
if slices.Contains(autoHTTPS, "prefer_wildcard") {
|
||||
if hostsCoveredByWildcard(hostsNotHTTP, wildcardHosts) &&
|
||||
reflect.DeepEqual(ap, apCopy) {
|
||||
continue
|
||||
}
|
||||
}
|
||||
|
||||
// associate our new automation policy with this server block's hosts
|
||||
ap.SubjectsRaw = hostsNotHTTP
|
||||
|
||||
@@ -334,11 +362,6 @@ func (st ServerType) buildTLSApp(
|
||||
tlsApp.DNSRaw = caddyconfig.JSONModuleObject(globalDNS, "name", globalDNS.(caddy.Module).CaddyModule().ID.Name(), nil)
|
||||
}
|
||||
|
||||
// set up "global" (to the TLS app) DNS resolvers config
|
||||
if globalResolvers, ok := options["tls_resolvers"]; ok && globalResolvers != nil {
|
||||
tlsApp.Resolvers = globalResolvers.([]string)
|
||||
}
|
||||
|
||||
// set up ECH from Caddyfile options
|
||||
if ech, ok := options["ech"].(*caddytls.ECH); ok {
|
||||
tlsApp.EncryptedClientHello = ech
|
||||
@@ -553,8 +576,9 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
|
||||
if acmeIssuer.Challenges.DNS == nil {
|
||||
acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
|
||||
}
|
||||
if globalACMEDNS != nil && acmeIssuer.Challenges.DNS.ProviderRaw == nil {
|
||||
// Set a global DNS provider if `acme_dns` is set
|
||||
// If global `dns` is set, do NOT set provider in issuer, just set empty dns config
|
||||
if globalDNS == nil && acmeIssuer.Challenges.DNS.ProviderRaw == nil {
|
||||
// Set a global DNS provider if `acme_dns` is set and `dns` is NOT set
|
||||
acmeIssuer.Challenges.DNS.ProviderRaw = caddyconfig.JSONModuleObject(globalACMEDNS, "name", globalACMEDNS.(caddy.Module).CaddyModule().ID.Name(), nil)
|
||||
}
|
||||
}
|
||||
@@ -600,301 +624,9 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
|
||||
if globalCertLifetime != nil && acmeIssuer.CertificateLifetime == 0 {
|
||||
acmeIssuer.CertificateLifetime = globalCertLifetime.(caddy.Duration)
|
||||
}
|
||||
// apply global resolvers if DNS challenge is configured and resolvers are not already set
|
||||
globalResolvers := options["tls_resolvers"]
|
||||
if globalResolvers != nil && acmeIssuer.Challenges != nil && acmeIssuer.Challenges.DNS != nil {
|
||||
// Check if DNS challenge is actually configured
|
||||
hasDNSChallenge := globalACMEDNSok || acmeIssuer.Challenges.DNS.ProviderRaw != nil
|
||||
if hasDNSChallenge && len(acmeIssuer.Challenges.DNS.Resolvers) == 0 {
|
||||
acmeIssuer.Challenges.DNS.Resolvers = globalResolvers.([]string)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// implicitACMEIssuers returns the issuers to use for ACME-related tls
|
||||
// shortcuts such as ca, ca_root, and dns. If any global cert_issuer options
|
||||
// configure ACME issuers, those become the templates for the local shortcut
|
||||
// configuration; otherwise, default ACME issuers are used.
|
||||
func implicitACMEIssuers(h Helper, acmeIssuer *caddytls.ACMEIssuer) []certmagic.Issuer {
|
||||
globalIssuers, _ := h.Option("cert_issuer").([]certmagic.Issuer)
|
||||
|
||||
var implicitIssuers []certmagic.Issuer
|
||||
for _, issuer := range globalIssuers {
|
||||
acmeWrapper, ok := issuer.(acmeCapable)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
baseIssuer := acmeWrapper.GetACMEIssuer()
|
||||
if baseIssuer == nil {
|
||||
continue
|
||||
}
|
||||
implicitIssuers = append(implicitIssuers, mergeACMEIssuers(baseIssuer, acmeIssuer))
|
||||
}
|
||||
if len(implicitIssuers) > 0 {
|
||||
return implicitIssuers
|
||||
}
|
||||
|
||||
// If an ACME CA endpoint was set locally, the user expects to use only that
|
||||
// CA rather than the usual default fallback issuers.
|
||||
defaultIssuers := caddytls.DefaultIssuers(acmeIssuer.Email)
|
||||
if acmeIssuer.CA != "" {
|
||||
defaultIssuers = []certmagic.Issuer{new(caddytls.ACMEIssuer)}
|
||||
}
|
||||
|
||||
implicitIssuers = make([]certmagic.Issuer, 0, len(defaultIssuers))
|
||||
for _, issuer := range defaultIssuers {
|
||||
acmeWrapper, ok := issuer.(acmeCapable)
|
||||
if !ok {
|
||||
implicitIssuers = append(implicitIssuers, issuer)
|
||||
continue
|
||||
}
|
||||
baseIssuer := acmeWrapper.GetACMEIssuer()
|
||||
if baseIssuer == nil {
|
||||
implicitIssuers = append(implicitIssuers, issuer)
|
||||
continue
|
||||
}
|
||||
implicitIssuers = append(implicitIssuers, mergeACMEIssuers(baseIssuer, acmeIssuer))
|
||||
}
|
||||
return implicitIssuers
|
||||
}
|
||||
|
||||
func mergeACMEIssuers(base, overrides *caddytls.ACMEIssuer) *caddytls.ACMEIssuer {
|
||||
if base == nil {
|
||||
return cloneACMEIssuer(overrides)
|
||||
}
|
||||
|
||||
merged := cloneACMEIssuer(base)
|
||||
if overrides == nil {
|
||||
return merged
|
||||
}
|
||||
|
||||
if overrides.CA != "" {
|
||||
merged.CA = overrides.CA
|
||||
}
|
||||
if overrides.TestCA != "" {
|
||||
merged.TestCA = overrides.TestCA
|
||||
}
|
||||
if overrides.Email != "" {
|
||||
merged.Email = overrides.Email
|
||||
}
|
||||
if overrides.Profile != "" {
|
||||
merged.Profile = overrides.Profile
|
||||
}
|
||||
if overrides.AccountKey != "" {
|
||||
merged.AccountKey = overrides.AccountKey
|
||||
}
|
||||
if overrides.ExternalAccount != nil {
|
||||
merged.ExternalAccount = cloneACMEEAB(overrides.ExternalAccount)
|
||||
}
|
||||
if overrides.ACMETimeout != 0 {
|
||||
merged.ACMETimeout = overrides.ACMETimeout
|
||||
}
|
||||
if len(overrides.TrustedRootsPEMFiles) > 0 {
|
||||
merged.TrustedRootsPEMFiles = appendUniqueStrings(merged.TrustedRootsPEMFiles, overrides.TrustedRootsPEMFiles...)
|
||||
}
|
||||
if overrides.PreferredChains != nil {
|
||||
merged.PreferredChains = cloneChainPreference(overrides.PreferredChains)
|
||||
}
|
||||
if overrides.CertificateLifetime != 0 {
|
||||
merged.CertificateLifetime = overrides.CertificateLifetime
|
||||
}
|
||||
if len(overrides.NetworkProxyRaw) > 0 {
|
||||
merged.NetworkProxyRaw = slices.Clone(overrides.NetworkProxyRaw)
|
||||
}
|
||||
merged.Challenges = mergeChallengesConfig(merged.Challenges, overrides.Challenges)
|
||||
|
||||
return merged
|
||||
}
|
||||
|
||||
func mergeChallengesConfig(base, overrides *caddytls.ChallengesConfig) *caddytls.ChallengesConfig {
|
||||
if base == nil {
|
||||
return cloneChallengesConfig(overrides)
|
||||
}
|
||||
merged := cloneChallengesConfig(base)
|
||||
if overrides == nil {
|
||||
return merged
|
||||
}
|
||||
|
||||
merged.HTTP = mergeHTTPChallengeConfig(merged.HTTP, overrides.HTTP)
|
||||
merged.TLSALPN = mergeTLSALPNChallengeConfig(merged.TLSALPN, overrides.TLSALPN)
|
||||
merged.DNS = mergeDNSChallengeConfig(merged.DNS, overrides.DNS)
|
||||
if overrides.BindHost != "" {
|
||||
merged.BindHost = overrides.BindHost
|
||||
}
|
||||
if overrides.Distributed != nil {
|
||||
value := *overrides.Distributed
|
||||
merged.Distributed = &value
|
||||
}
|
||||
|
||||
return merged
|
||||
}
|
||||
|
||||
func mergeHTTPChallengeConfig(base, overrides *caddytls.HTTPChallengeConfig) *caddytls.HTTPChallengeConfig {
|
||||
if base == nil {
|
||||
return cloneHTTPChallengeConfig(overrides)
|
||||
}
|
||||
merged := cloneHTTPChallengeConfig(base)
|
||||
if overrides == nil {
|
||||
return merged
|
||||
}
|
||||
|
||||
if overrides.Disabled {
|
||||
merged.Disabled = true
|
||||
}
|
||||
if overrides.AlternatePort != 0 {
|
||||
merged.AlternatePort = overrides.AlternatePort
|
||||
}
|
||||
|
||||
return merged
|
||||
}
|
||||
|
||||
func mergeTLSALPNChallengeConfig(base, overrides *caddytls.TLSALPNChallengeConfig) *caddytls.TLSALPNChallengeConfig {
|
||||
if base == nil {
|
||||
return cloneTLSALPNChallengeConfig(overrides)
|
||||
}
|
||||
merged := cloneTLSALPNChallengeConfig(base)
|
||||
if overrides == nil {
|
||||
return merged
|
||||
}
|
||||
|
||||
if overrides.Disabled {
|
||||
merged.Disabled = true
|
||||
}
|
||||
if overrides.AlternatePort != 0 {
|
||||
merged.AlternatePort = overrides.AlternatePort
|
||||
}
|
||||
|
||||
return merged
|
||||
}
|
||||
|
||||
func mergeDNSChallengeConfig(base, overrides *caddytls.DNSChallengeConfig) *caddytls.DNSChallengeConfig {
|
||||
if base == nil {
|
||||
return cloneDNSChallengeConfig(overrides)
|
||||
}
|
||||
merged := cloneDNSChallengeConfig(base)
|
||||
if overrides == nil {
|
||||
return merged
|
||||
}
|
||||
|
||||
if len(overrides.ProviderRaw) > 0 {
|
||||
merged.ProviderRaw = slices.Clone(overrides.ProviderRaw)
|
||||
}
|
||||
if overrides.PropagationDelay != 0 {
|
||||
merged.PropagationDelay = overrides.PropagationDelay
|
||||
}
|
||||
if overrides.PropagationTimeout != 0 {
|
||||
merged.PropagationTimeout = overrides.PropagationTimeout
|
||||
}
|
||||
if overrides.Resolvers != nil {
|
||||
merged.Resolvers = slices.Clone(overrides.Resolvers)
|
||||
}
|
||||
if overrides.OverrideDomain != "" {
|
||||
merged.OverrideDomain = overrides.OverrideDomain
|
||||
}
|
||||
if overrides.TTL != 0 {
|
||||
merged.TTL = overrides.TTL
|
||||
}
|
||||
|
||||
return merged
|
||||
}
|
||||
|
||||
func cloneACMEIssuer(iss *caddytls.ACMEIssuer) *caddytls.ACMEIssuer {
|
||||
if iss == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
cloned := *iss
|
||||
cloned.Challenges = cloneChallengesConfig(iss.Challenges)
|
||||
cloned.ExternalAccount = cloneACMEEAB(iss.ExternalAccount)
|
||||
cloned.TrustedRootsPEMFiles = slices.Clone(iss.TrustedRootsPEMFiles)
|
||||
cloned.PreferredChains = cloneChainPreference(iss.PreferredChains)
|
||||
cloned.NetworkProxyRaw = slices.Clone(iss.NetworkProxyRaw)
|
||||
|
||||
return &cloned
|
||||
}
|
||||
|
||||
func cloneChallengesConfig(cfg *caddytls.ChallengesConfig) *caddytls.ChallengesConfig {
|
||||
if cfg == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
cloned := *cfg
|
||||
cloned.HTTP = cloneHTTPChallengeConfig(cfg.HTTP)
|
||||
cloned.TLSALPN = cloneTLSALPNChallengeConfig(cfg.TLSALPN)
|
||||
cloned.DNS = cloneDNSChallengeConfig(cfg.DNS)
|
||||
if cfg.Distributed != nil {
|
||||
value := *cfg.Distributed
|
||||
cloned.Distributed = &value
|
||||
}
|
||||
|
||||
return &cloned
|
||||
}
|
||||
|
||||
func cloneHTTPChallengeConfig(cfg *caddytls.HTTPChallengeConfig) *caddytls.HTTPChallengeConfig {
|
||||
if cfg == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
cloned := *cfg
|
||||
return &cloned
|
||||
}
|
||||
|
||||
func cloneTLSALPNChallengeConfig(cfg *caddytls.TLSALPNChallengeConfig) *caddytls.TLSALPNChallengeConfig {
|
||||
if cfg == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
cloned := *cfg
|
||||
return &cloned
|
||||
}
|
||||
|
||||
func cloneDNSChallengeConfig(cfg *caddytls.DNSChallengeConfig) *caddytls.DNSChallengeConfig {
|
||||
if cfg == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
cloned := *cfg
|
||||
cloned.ProviderRaw = slices.Clone(cfg.ProviderRaw)
|
||||
cloned.Resolvers = slices.Clone(cfg.Resolvers)
|
||||
|
||||
return &cloned
|
||||
}
|
||||
|
||||
func cloneACMEEAB(eab *acme.EAB) *acme.EAB {
|
||||
if eab == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
cloned := *eab
|
||||
return &cloned
|
||||
}
|
||||
|
||||
func cloneChainPreference(pref *caddytls.ChainPreference) *caddytls.ChainPreference {
|
||||
if pref == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
cloned := *pref
|
||||
cloned.RootCommonName = slices.Clone(pref.RootCommonName)
|
||||
cloned.AnyCommonName = slices.Clone(pref.AnyCommonName)
|
||||
if pref.Smallest != nil {
|
||||
value := *pref.Smallest
|
||||
cloned.Smallest = &value
|
||||
}
|
||||
|
||||
return &cloned
|
||||
}
|
||||
|
||||
func appendUniqueStrings(existing []string, additions ...string) []string {
|
||||
for _, value := range additions {
|
||||
if !slices.Contains(existing, value) {
|
||||
existing = append(existing, value)
|
||||
}
|
||||
}
|
||||
return existing
|
||||
}
|
||||
|
||||
// newBaseAutomationPolicy returns a new TLS automation policy that gets
|
||||
// its values from the global options map. It should be used as the base
|
||||
// for any other automation policies. A nil policy (and no error) will be
|
||||
@@ -909,8 +641,7 @@ func newBaseAutomationPolicy(
|
||||
_, hasLocalCerts := options["local_certs"]
|
||||
keyType, hasKeyType := options["key_type"]
|
||||
ocspStapling, hasOCSPStapling := options["ocsp_stapling"]
|
||||
renewalWindowRatio, hasRenewalWindowRatio := options["renewal_window_ratio"]
|
||||
hasGlobalAutomationOpts := hasIssuers || hasLocalCerts || hasKeyType || hasOCSPStapling || hasRenewalWindowRatio
|
||||
hasGlobalAutomationOpts := hasIssuers || hasLocalCerts || hasKeyType || hasOCSPStapling
|
||||
|
||||
globalACMECA := options["acme_ca"]
|
||||
globalACMECARoot := options["acme_ca_root"]
|
||||
@@ -957,10 +688,6 @@ func newBaseAutomationPolicy(
|
||||
ap.OCSPOverrides = ocspConfig.ResponderOverrides
|
||||
}
|
||||
|
||||
if hasRenewalWindowRatio {
|
||||
ap.RenewalWindowRatio = renewalWindowRatio.(float64)
|
||||
}
|
||||
|
||||
return ap, nil
|
||||
}
|
||||
|
||||
@@ -981,31 +708,14 @@ func consolidateAutomationPolicies(aps []*caddytls.AutomationPolicy) []*caddytls
|
||||
emptyAPCount := 0
|
||||
origLenAPs := len(aps)
|
||||
// compute the number of empty policies (disregarding subjects) - see #4128
|
||||
// while we're at it,
|
||||
emptyAP := new(caddytls.AutomationPolicy)
|
||||
for i := 0; i < len(aps); i++ {
|
||||
emptyAP.SubjectsRaw = aps[i].SubjectsRaw
|
||||
emptyAP.ManagersRaw = nil
|
||||
if reflect.DeepEqual(aps[i], emptyAP) {
|
||||
// AP is empty
|
||||
emptyAPCount++
|
||||
|
||||
// see if this AP shadows something later
|
||||
shadowIdx := automationPolicyShadows(i, aps)
|
||||
emptyAP.SubjectsRaw = nil
|
||||
if shadowIdx >= 0 {
|
||||
emptyAP.SubjectsRaw = aps[shadowIdx].SubjectsRaw
|
||||
// allow the later policy, which is likely for a wildcard, to have cert
|
||||
// managers ("get_certificate"), since wildcards now cover specific
|
||||
// subdomains by default, when configured (see discussion in #7559)
|
||||
emptyAP.ManagersRaw = aps[shadowIdx].ManagersRaw
|
||||
}
|
||||
|
||||
// if this is the last AP, we can delete it, since auto-https should
|
||||
// pick it up; if it shadows something later that is also empty, we
|
||||
// can similarly delete this; but if it shadows something that is NOT
|
||||
// empty, we must not delete it since the shadowing has a purpose
|
||||
if i == len(aps)-1 || (shadowIdx >= 0 && reflect.DeepEqual(aps[shadowIdx], emptyAP)) {
|
||||
if !automationPolicyHasAllPublicNames(aps[i]) {
|
||||
// if this automation policy has internal names, we might as well remove it
|
||||
// so auto-https can implicitly use the internal issuer
|
||||
aps = slices.Delete(aps, i, i+1)
|
||||
i--
|
||||
}
|
||||
@@ -1139,3 +849,20 @@ func automationPolicyHasAllPublicNames(ap *caddytls.AutomationPolicy) bool {
|
||||
func isTailscaleDomain(name string) bool {
|
||||
return strings.HasSuffix(strings.ToLower(name), ".ts.net")
|
||||
}
|
||||
|
||||
func hostsCoveredByWildcard(hosts []string, wildcards []string) bool {
|
||||
if len(hosts) == 0 || len(wildcards) == 0 {
|
||||
return false
|
||||
}
|
||||
for _, host := range hosts {
|
||||
for _, wildcard := range wildcards {
|
||||
if strings.HasPrefix(host, "*.") {
|
||||
continue
|
||||
}
|
||||
if certmagic.MatchWildcard(host, "*."+wildcard) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
@@ -136,7 +136,7 @@ func (hl HTTPLoader) LoadConfig(ctx caddy.Context) ([]byte, error) {
|
||||
}
|
||||
|
||||
func attemptHttpCall(client *http.Client, request *http.Request) (*http.Response, error) {
|
||||
resp, err := client.Do(request) //nolint:gosec // no SSRF; comes from trusted config
|
||||
resp, err := client.Do(request)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("problem calling http loader url: %v", err)
|
||||
} else if resp.StatusCode < 200 || resp.StatusCode > 499 {
|
||||
@@ -151,7 +151,7 @@ func doHttpCallWithRetries(ctx caddy.Context, client *http.Client, request *http
|
||||
var err error
|
||||
const maxAttempts = 10
|
||||
|
||||
for i := range maxAttempts {
|
||||
for i := 0; i < maxAttempts; i++ {
|
||||
resp, err = attemptHttpCall(client, request)
|
||||
if err != nil && i < maxAttempts-1 {
|
||||
select {
|
||||
|
||||
+1
-1
@@ -106,7 +106,7 @@ func (adminLoad) handleLoad(w http.ResponseWriter, r *http.Request) error {
|
||||
if err != nil {
|
||||
caddy.Log().Named("admin.api.load").Error(err.Error())
|
||||
}
|
||||
_, _ = w.Write(respBody) //nolint:gosec // false positive: no XSS here
|
||||
_, _ = w.Write(respBody)
|
||||
}
|
||||
body = result
|
||||
}
|
||||
|
||||
@@ -187,7 +187,7 @@ func (tc *Tester) initServer(rawConfig string, configType string) error {
|
||||
req.Header.Add("Content-Type", "text/"+configType)
|
||||
}
|
||||
|
||||
res, err := client.Do(req) //nolint:gosec // no SSRF because URL is hard-coded to localhost, and port comes from config
|
||||
res, err := client.Do(req)
|
||||
if err != nil {
|
||||
tc.t.Errorf("unable to contact caddy server. %s", err)
|
||||
return err
|
||||
@@ -279,7 +279,7 @@ func validateTestPrerequisites(tc *Tester) error {
|
||||
return err
|
||||
}
|
||||
tc.t.Cleanup(func() {
|
||||
os.Remove(f.Name()) //nolint:gosec // false positive, filename comes from std lib, no path traversal
|
||||
os.Remove(f.Name())
|
||||
})
|
||||
if _, err := fmt.Fprintf(f, initConfig, tc.config.AdminPort); err != nil {
|
||||
return err
|
||||
@@ -506,7 +506,7 @@ func applyHeaders(t testing.TB, req *http.Request, requestHeaders []string) {
|
||||
func (tc *Tester) AssertResponseCode(req *http.Request, expectedStatusCode int) *http.Response {
|
||||
tc.t.Helper()
|
||||
|
||||
resp, err := tc.Client.Do(req) //nolint:gosec // no SSRFs demonstrated
|
||||
resp, err := tc.Client.Do(req)
|
||||
if err != nil {
|
||||
tc.t.Fatalf("failed to call server %s", err)
|
||||
}
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
package caddytest
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"net/http"
|
||||
"strings"
|
||||
"testing"
|
||||
@@ -127,118 +126,3 @@ func TestLoadUnorderedJSON(t *testing.T) {
|
||||
}
|
||||
tester.AssertResponseCode(req, 200)
|
||||
}
|
||||
|
||||
func TestCheckID(t *testing.T) {
|
||||
tester := NewTester(t)
|
||||
tester.InitServer(`{
|
||||
"admin": {
|
||||
"listen": "localhost:2999"
|
||||
},
|
||||
"apps": {
|
||||
"http": {
|
||||
"http_port": 9080,
|
||||
"servers": {
|
||||
"s_server": {
|
||||
"@id": "s_server",
|
||||
"listen": [
|
||||
":9080"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "static_response",
|
||||
"body": "Hello"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`, "json")
|
||||
headers := []string{"Content-Type:application/json"}
|
||||
sServer1 := []byte(`{"@id":"s_server","listen":[":9080"],"routes":[{"@id":"route1","handle":[{"handler":"static_response","body":"Hello 2"}]}]}`)
|
||||
|
||||
// PUT to an existing ID should fail with a 409 conflict
|
||||
tester.AssertPutResponseBody(
|
||||
"http://localhost:2999/id/s_server",
|
||||
headers,
|
||||
bytes.NewBuffer(sServer1),
|
||||
409,
|
||||
`{"error":"[/config/apps/http/servers/s_server] key already exists: s_server"}`+"\n")
|
||||
|
||||
// POST replaces the object fully
|
||||
tester.AssertPostResponseBody(
|
||||
"http://localhost:2999/id/s_server",
|
||||
headers,
|
||||
bytes.NewBuffer(sServer1),
|
||||
200,
|
||||
"")
|
||||
|
||||
// Verify the server is running the new route
|
||||
tester.AssertGetResponse(
|
||||
"http://localhost:9080/",
|
||||
200,
|
||||
"Hello 2")
|
||||
|
||||
// Update the existing route to ensure IDs are handled correctly when replaced
|
||||
tester.AssertPostResponseBody(
|
||||
"http://localhost:2999/id/s_server",
|
||||
headers,
|
||||
bytes.NewBuffer([]byte(`{"@id":"s_server","listen":[":9080"],"routes":[{"@id":"route1","handle":[{"handler":"static_response","body":"Hello2"}],"match":[{"path":["/route_1/*"]}]}]}`)),
|
||||
200,
|
||||
"")
|
||||
|
||||
sServer2 := []byte(`{"@id":"s_server","listen":[":9080"],"routes":[{"@id":"route1","handle":[{"handler":"static_response","body":"Hello2"}],"match":[{"path":["/route_1/*"]}]}]}`)
|
||||
|
||||
// Identical patch should succeed and return 200 (config is unchanged branch)
|
||||
tester.AssertPatchResponseBody(
|
||||
"http://localhost:2999/id/s_server",
|
||||
headers,
|
||||
bytes.NewBuffer(sServer2),
|
||||
200,
|
||||
"")
|
||||
|
||||
route2 := []byte(`{"@id":"route2","handle": [{"handler": "static_response","body": "route2"}],"match":[{"path":["/route_2/*"]}]}`)
|
||||
|
||||
// Put a new route2 object before the route1 object due to the path of /id/route1
|
||||
// Being translated to: /config/apps/http/servers/s_server/routes/0
|
||||
tester.AssertPutResponseBody(
|
||||
"http://localhost:2999/id/route1",
|
||||
headers,
|
||||
bytes.NewBuffer(route2),
|
||||
200,
|
||||
"")
|
||||
|
||||
// Verify that the whole config looks correct, now containing both route1 and route2
|
||||
tester.AssertGetResponse(
|
||||
"http://localhost:2999/config/",
|
||||
200,
|
||||
`{"admin":{"listen":"localhost:2999"},"apps":{"http":{"http_port":9080,"servers":{"s_server":{"@id":"s_server","listen":[":9080"],"routes":[{"@id":"route2","handle":[{"body":"route2","handler":"static_response"}],"match":[{"path":["/route_2/*"]}]},{"@id":"route1","handle":[{"body":"Hello2","handler":"static_response"}],"match":[{"path":["/route_1/*"]}]}]}}}}}`+"\n")
|
||||
|
||||
// Try to add another copy of route2 using POST to test duplicate ID handling
|
||||
// Since the first route2 ended up at array index 0, and we are appending to the array, the index for the new element would be 2
|
||||
tester.AssertPostResponseBody(
|
||||
"http://localhost:2999/id/route2",
|
||||
headers,
|
||||
bytes.NewBuffer(route2),
|
||||
400,
|
||||
`{"error":"indexing config: duplicate ID 'route2' found at /config/apps/http/servers/s_server/routes/0 and /config/apps/http/servers/s_server/routes/2"}`+"\n")
|
||||
|
||||
// Use PATCH to modify an existing object successfully
|
||||
tester.AssertPatchResponseBody(
|
||||
"http://localhost:2999/id/route1",
|
||||
headers,
|
||||
bytes.NewBuffer([]byte(`{"@id":"route1","handle":[{"handler":"static_response","body":"route1"}],"match":[{"path":["/route_1/*"]}]}`)),
|
||||
200,
|
||||
"")
|
||||
|
||||
// Verify the PATCH updated the server state
|
||||
tester.AssertGetResponse(
|
||||
"http://localhost:9080/route_1/",
|
||||
200,
|
||||
"route1")
|
||||
}
|
||||
|
||||
@@ -51,7 +51,7 @@ func TestACMEServerWithDefaults(t *testing.T) {
|
||||
Client: &acme.Client{
|
||||
Directory: "https://acme.localhost:9443/acme/local/directory",
|
||||
HTTPClient: tester.Client,
|
||||
Logger: slog.New(zapslog.NewHandler(logger.Core(), zapslog.WithName("acmez"))),
|
||||
Logger: slog.New(zapslog.NewHandler(logger.Core())),
|
||||
},
|
||||
ChallengeSolvers: map[string]acmez.Solver{
|
||||
acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
|
||||
@@ -120,7 +120,7 @@ func TestACMEServerWithMismatchedChallenges(t *testing.T) {
|
||||
Client: &acme.Client{
|
||||
Directory: "https://acme.localhost:9443/acme/local/directory",
|
||||
HTTPClient: tester.Client,
|
||||
Logger: slog.New(zapslog.NewHandler(logger.Core(), zapslog.WithName("acmez"))),
|
||||
Logger: slog.New(zapslog.NewHandler(logger.Core())),
|
||||
},
|
||||
ChallengeSolvers: map[string]acmez.Solver{
|
||||
acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
|
||||
|
||||
@@ -127,7 +127,7 @@ func TestACMEServerAllowPolicy(t *testing.T) {
|
||||
_, err := client.ObtainCertificateForSANs(ctx, account, certPrivateKey, []string{"not-matching.localhost"})
|
||||
if err == nil {
|
||||
t.Errorf("obtaining certificate for 'not-matching.localhost' domain")
|
||||
} else if !strings.Contains(err.Error(), "urn:ietf:params:acme:error:rejectedIdentifier") {
|
||||
} else if err != nil && !strings.Contains(err.Error(), "urn:ietf:params:acme:error:rejectedIdentifier") {
|
||||
t.Logf("unexpected error: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -200,7 +200,7 @@ func TestACMEServerDenyPolicy(t *testing.T) {
|
||||
_, err := client.ObtainCertificateForSANs(ctx, account, certPrivateKey, []string{"deny.localhost"})
|
||||
if err == nil {
|
||||
t.Errorf("obtaining certificate for 'deny.localhost' domain")
|
||||
} else if !strings.Contains(err.Error(), "urn:ietf:params:acme:error:rejectedIdentifier") {
|
||||
} else if err != nil && !strings.Contains(err.Error(), "urn:ietf:params:acme:error:rejectedIdentifier") {
|
||||
t.Logf("unexpected error: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -55,28 +55,6 @@ func TestAutoHTTPtoHTTPSRedirectsExplicitPortDifferentFromHTTPSPort(t *testing.T
|
||||
tester.AssertRedirect("http://localhost:9080/", "https://localhost:1234/", http.StatusPermanentRedirect)
|
||||
}
|
||||
|
||||
func TestAutoHTTPtoHTTPSRedirectsPreferHTTPSPortOverAlternatePort(t *testing.T) {
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(`
|
||||
{
|
||||
skip_install_trust
|
||||
admin localhost:2999
|
||||
http_port 9080
|
||||
https_port 9443
|
||||
local_certs
|
||||
}
|
||||
localhost {
|
||||
respond "Canonical"
|
||||
}
|
||||
|
||||
localhost:10443 {
|
||||
respond "Alternate"
|
||||
}
|
||||
`, "caddyfile")
|
||||
|
||||
tester.AssertRedirect("http://localhost:9080/", "https://localhost/", http.StatusPermanentRedirect)
|
||||
}
|
||||
|
||||
func TestAutoHTTPRedirectsWithHTTPListenerFirstInAddresses(t *testing.T) {
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(`
|
||||
@@ -165,26 +143,3 @@ func TestAutoHTTPRedirectsInsertedBeforeUserDefinedCatchAllWithNoExplicitHTTPSit
|
||||
tester.AssertGetResponse("http://foo.localhost:9080/", 200, "Foo")
|
||||
tester.AssertGetResponse("http://baz.localhost:9080/", 200, "Foo")
|
||||
}
|
||||
|
||||
func TestAutoHTTPSRedirectSortingExactMatchOverWildcard(t *testing.T) {
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(`
|
||||
{
|
||||
skip_install_trust
|
||||
admin localhost:2999
|
||||
http_port 9080
|
||||
https_port 9443
|
||||
local_certs
|
||||
}
|
||||
*.localhost:10443 {
|
||||
respond "Wildcard"
|
||||
}
|
||||
dev.localhost {
|
||||
respond "Exact"
|
||||
}
|
||||
`, "caddyfile")
|
||||
|
||||
tester.AssertRedirect("http://dev.localhost:9080/", "https://dev.localhost/", http.StatusPermanentRedirect)
|
||||
|
||||
tester.AssertRedirect("http://foo.localhost:9080/", "https://foo.localhost:10443/", http.StatusPermanentRedirect)
|
||||
}
|
||||
|
||||
@@ -18,9 +18,7 @@ encode gzip zstd {
|
||||
|
||||
# Long way with a block for each encoding
|
||||
encode {
|
||||
zstd {
|
||||
disable_checksum
|
||||
}
|
||||
zstd
|
||||
gzip 5
|
||||
}
|
||||
|
||||
@@ -73,9 +71,7 @@ encode
|
||||
"gzip": {
|
||||
"level": 5
|
||||
},
|
||||
"zstd": {
|
||||
"checksum": false
|
||||
}
|
||||
"zstd": {}
|
||||
},
|
||||
"handler": "encode",
|
||||
"prefer": [
|
||||
|
||||
@@ -46,18 +46,6 @@ app.example.com {
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"delete": [
|
||||
"Remote-Email"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
@@ -85,18 +73,6 @@ app.example.com {
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"delete": [
|
||||
"Remote-Groups"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
@@ -124,18 +100,6 @@ app.example.com {
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"delete": [
|
||||
"Remote-Name"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
@@ -163,18 +127,6 @@ app.example.com {
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"delete": [
|
||||
"Remote-User"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
@@ -248,4 +200,4 @@ app.example.com {
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,146 +0,0 @@
|
||||
:8080
|
||||
|
||||
forward_auth 127.0.0.1:9091 {
|
||||
uri /
|
||||
copy_headers X-User-Id X-User-Role
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":8080"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handle_response": [
|
||||
{
|
||||
"match": {
|
||||
"status_code": [
|
||||
2
|
||||
]
|
||||
},
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "vars"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"delete": [
|
||||
"X-User-Id"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"set": {
|
||||
"X-User-Id": [
|
||||
"{http.reverse_proxy.header.X-User-Id}"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"match": [
|
||||
{
|
||||
"not": [
|
||||
{
|
||||
"vars": {
|
||||
"{http.reverse_proxy.header.X-User-Id}": [
|
||||
""
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"delete": [
|
||||
"X-User-Role"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"set": {
|
||||
"X-User-Role": [
|
||||
"{http.reverse_proxy.header.X-User-Role}"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"match": [
|
||||
{
|
||||
"not": [
|
||||
{
|
||||
"vars": {
|
||||
"{http.reverse_proxy.header.X-User-Role}": [
|
||||
""
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"handler": "reverse_proxy",
|
||||
"headers": {
|
||||
"request": {
|
||||
"set": {
|
||||
"X-Forwarded-Method": [
|
||||
"{http.request.method}"
|
||||
],
|
||||
"X-Forwarded-Uri": [
|
||||
"{http.request.uri}"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"rewrite": {
|
||||
"method": "GET",
|
||||
"uri": "/"
|
||||
},
|
||||
"upstreams": [
|
||||
{
|
||||
"dial": "127.0.0.1:9091"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -35,18 +35,6 @@ forward_auth localhost:9000 {
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"delete": [
|
||||
"1"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
@@ -74,18 +62,6 @@ forward_auth localhost:9000 {
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"delete": [
|
||||
"B"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
@@ -113,18 +89,6 @@ forward_auth localhost:9000 {
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"delete": [
|
||||
"3"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
@@ -152,18 +116,6 @@ forward_auth localhost:9000 {
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"delete": [
|
||||
"D"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
@@ -191,18 +143,6 @@ forward_auth localhost:9000 {
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"request": {
|
||||
"delete": [
|
||||
"5"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
@@ -263,4 +203,4 @@ forward_auth localhost:9000 {
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
log {
|
||||
sampling {
|
||||
interval 5m
|
||||
interval 300
|
||||
first 50
|
||||
thereafter 40
|
||||
}
|
||||
@@ -13,7 +13,7 @@
|
||||
"logs": {
|
||||
"default": {
|
||||
"sampling": {
|
||||
"interval": 300000000000,
|
||||
"interval": 300,
|
||||
"first": 50,
|
||||
"thereafter": 40
|
||||
}
|
||||
|
||||
@@ -1,77 +0,0 @@
|
||||
{
|
||||
email test@example.com
|
||||
dns mock
|
||||
tls_resolvers 1.1.1.1 8.8.8.8
|
||||
acme_dns
|
||||
}
|
||||
|
||||
example.com {
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"automation": {
|
||||
"policies": [
|
||||
{
|
||||
"issuers": [
|
||||
{
|
||||
"challenges": {
|
||||
"dns": {
|
||||
"resolvers": [
|
||||
"1.1.1.1",
|
||||
"8.8.8.8"
|
||||
]
|
||||
}
|
||||
},
|
||||
"email": "test@example.com",
|
||||
"module": "acme"
|
||||
},
|
||||
{
|
||||
"ca": "https://acme.zerossl.com/v2/DV90",
|
||||
"challenges": {
|
||||
"dns": {
|
||||
"resolvers": [
|
||||
"1.1.1.1",
|
||||
"8.8.8.8"
|
||||
]
|
||||
}
|
||||
},
|
||||
"email": "test@example.com",
|
||||
"module": "acme"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"dns": {
|
||||
"name": "mock"
|
||||
},
|
||||
"resolvers": [
|
||||
"1.1.1.1",
|
||||
"8.8.8.8"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
-38
@@ -1,38 +0,0 @@
|
||||
{
|
||||
tls_resolvers 1.1.1.1 8.8.8.8
|
||||
}
|
||||
|
||||
example.com {
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"resolvers": [
|
||||
"1.1.1.1",
|
||||
"8.8.8.8"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
-72
@@ -1,72 +0,0 @@
|
||||
{
|
||||
email test@example.com
|
||||
dns mock
|
||||
tls_resolvers 1.1.1.1 8.8.8.8
|
||||
}
|
||||
|
||||
example.com {
|
||||
tls {
|
||||
dns mock
|
||||
}
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"automation": {
|
||||
"policies": [
|
||||
{
|
||||
"subjects": [
|
||||
"example.com"
|
||||
],
|
||||
"issuers": [
|
||||
{
|
||||
"challenges": {
|
||||
"dns": {
|
||||
"provider": {
|
||||
"name": "mock"
|
||||
},
|
||||
"resolvers": [
|
||||
"1.1.1.1",
|
||||
"8.8.8.8"
|
||||
]
|
||||
}
|
||||
},
|
||||
"email": "test@example.com",
|
||||
"module": "acme"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"dns": {
|
||||
"name": "mock"
|
||||
},
|
||||
"resolvers": [
|
||||
"1.1.1.1",
|
||||
"8.8.8.8"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
-98
@@ -1,98 +0,0 @@
|
||||
{
|
||||
email test@example.com
|
||||
dns mock
|
||||
tls_resolvers 1.1.1.1 8.8.8.8
|
||||
acme_dns
|
||||
}
|
||||
|
||||
example.com {
|
||||
tls {
|
||||
resolvers 9.9.9.9
|
||||
}
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"automation": {
|
||||
"policies": [
|
||||
{
|
||||
"subjects": [
|
||||
"example.com"
|
||||
],
|
||||
"issuers": [
|
||||
{
|
||||
"challenges": {
|
||||
"dns": {
|
||||
"resolvers": [
|
||||
"9.9.9.9"
|
||||
]
|
||||
}
|
||||
},
|
||||
"email": "test@example.com",
|
||||
"module": "acme"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"issuers": [
|
||||
{
|
||||
"challenges": {
|
||||
"dns": {
|
||||
"resolvers": [
|
||||
"1.1.1.1",
|
||||
"8.8.8.8"
|
||||
]
|
||||
}
|
||||
},
|
||||
"email": "test@example.com",
|
||||
"module": "acme"
|
||||
},
|
||||
{
|
||||
"ca": "https://acme.zerossl.com/v2/DV90",
|
||||
"challenges": {
|
||||
"dns": {
|
||||
"resolvers": [
|
||||
"1.1.1.1",
|
||||
"8.8.8.8"
|
||||
]
|
||||
}
|
||||
},
|
||||
"email": "test@example.com",
|
||||
"module": "acme"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"dns": {
|
||||
"name": "mock"
|
||||
},
|
||||
"resolvers": [
|
||||
"1.1.1.1",
|
||||
"8.8.8.8"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,112 +0,0 @@
|
||||
{
|
||||
email test@example.com
|
||||
dns mock
|
||||
tls_resolvers 1.1.1.1 8.8.8.8
|
||||
acme_dns
|
||||
}
|
||||
|
||||
site1.example.com {
|
||||
}
|
||||
|
||||
site2.example.com {
|
||||
tls {
|
||||
resolvers 9.9.9.9 8.8.4.4
|
||||
}
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"site1.example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
},
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"site2.example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"automation": {
|
||||
"policies": [
|
||||
{
|
||||
"subjects": [
|
||||
"site2.example.com"
|
||||
],
|
||||
"issuers": [
|
||||
{
|
||||
"challenges": {
|
||||
"dns": {
|
||||
"resolvers": [
|
||||
"9.9.9.9",
|
||||
"8.8.4.4"
|
||||
]
|
||||
}
|
||||
},
|
||||
"email": "test@example.com",
|
||||
"module": "acme"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"issuers": [
|
||||
{
|
||||
"challenges": {
|
||||
"dns": {
|
||||
"resolvers": [
|
||||
"1.1.1.1",
|
||||
"8.8.8.8"
|
||||
]
|
||||
}
|
||||
},
|
||||
"email": "test@example.com",
|
||||
"module": "acme"
|
||||
},
|
||||
{
|
||||
"ca": "https://acme.zerossl.com/v2/DV90",
|
||||
"challenges": {
|
||||
"dns": {
|
||||
"resolvers": [
|
||||
"1.1.1.1",
|
||||
"8.8.8.8"
|
||||
]
|
||||
}
|
||||
},
|
||||
"email": "test@example.com",
|
||||
"module": "acme"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"dns": {
|
||||
"name": "mock"
|
||||
},
|
||||
"resolvers": [
|
||||
"1.1.1.1",
|
||||
"8.8.8.8"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -21,7 +21,6 @@
|
||||
keepalive_interval 20s
|
||||
keepalive_idle 20s
|
||||
keepalive_count 10
|
||||
0rtt off
|
||||
}
|
||||
}
|
||||
|
||||
@@ -91,8 +90,7 @@ foo.com {
|
||||
"h2",
|
||||
"h2c",
|
||||
"h3"
|
||||
],
|
||||
"allow_0rtt": false
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
-15
@@ -1,15 +0,0 @@
|
||||
{
|
||||
admin off
|
||||
auto_https off
|
||||
}
|
||||
|
||||
import testdata/issue_7557_invalid_subdirective_snippet.conf
|
||||
|
||||
:8080 {
|
||||
import test {
|
||||
this_is_nonsense
|
||||
}
|
||||
}
|
||||
|
||||
----------
|
||||
parsing caddyfile tokens for 'reverse_proxy': unrecognized subdirective this_is_nonsense
|
||||
-52
@@ -1,52 +0,0 @@
|
||||
import testdata/issue_7518_unused_block_panic_snippets.conf
|
||||
|
||||
example.com {
|
||||
import snippet
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "headers",
|
||||
"response": {
|
||||
"set": {
|
||||
"Reverse_proxy": [
|
||||
"localhost:3000"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,47 +0,0 @@
|
||||
{
|
||||
log {
|
||||
format journald {
|
||||
wrap console
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
:80 {
|
||||
respond "Hello, World!"
|
||||
}
|
||||
----------
|
||||
{
|
||||
"logging": {
|
||||
"logs": {
|
||||
"default": {
|
||||
"encoder": {
|
||||
"format": "journald",
|
||||
"wrap": {
|
||||
"format": "console"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":80"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "Hello, World!",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,47 +1,27 @@
|
||||
:80
|
||||
|
||||
log one {
|
||||
log {
|
||||
output file /var/log/access.log {
|
||||
mode 0644
|
||||
dir_mode 0755
|
||||
roll_size 1gb
|
||||
roll_uncompressed
|
||||
roll_compression none
|
||||
roll_local_time
|
||||
roll_keep 5
|
||||
roll_keep_for 90d
|
||||
}
|
||||
}
|
||||
log two {
|
||||
output file /var/log/access-2.log {
|
||||
mode 0777
|
||||
dir_mode from_file
|
||||
roll_size 1gib
|
||||
roll_compression zstd
|
||||
roll_interval 12h
|
||||
roll_at 00:00 06:00 12:00,18:00
|
||||
roll_minutes 10 40 45,46
|
||||
roll_keep 10
|
||||
roll_keep_for 90d
|
||||
}
|
||||
}
|
||||
----------
|
||||
{
|
||||
"logging": {
|
||||
"logs": {
|
||||
"default": {
|
||||
"exclude": [
|
||||
"http.log.access.one",
|
||||
"http.log.access.two"
|
||||
"http.log.access.log0"
|
||||
]
|
||||
},
|
||||
"one": {
|
||||
"log0": {
|
||||
"writer": {
|
||||
"dir_mode": "0755",
|
||||
"filename": "/var/log/access.log",
|
||||
"mode": "0644",
|
||||
"output": "file",
|
||||
"roll_compression": "none",
|
||||
"roll_gzip": false,
|
||||
"roll_keep": 5,
|
||||
"roll_keep_days": 90,
|
||||
@@ -49,35 +29,7 @@ log two {
|
||||
"roll_size_mb": 954
|
||||
},
|
||||
"include": [
|
||||
"http.log.access.one"
|
||||
]
|
||||
},
|
||||
"two": {
|
||||
"writer": {
|
||||
"dir_mode": "from_file",
|
||||
"filename": "/var/log/access-2.log",
|
||||
"mode": "0777",
|
||||
"output": "file",
|
||||
"roll_at": [
|
||||
"00:00",
|
||||
"06:00",
|
||||
"12:00",
|
||||
"18:00"
|
||||
],
|
||||
"roll_compression": "zstd",
|
||||
"roll_interval": 43200000000000,
|
||||
"roll_keep": 10,
|
||||
"roll_keep_days": 90,
|
||||
"roll_minutes": [
|
||||
10,
|
||||
40,
|
||||
45,
|
||||
46
|
||||
],
|
||||
"roll_size_mb": 1024
|
||||
},
|
||||
"include": [
|
||||
"http.log.access.two"
|
||||
"http.log.access.log0"
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -90,7 +42,7 @@ log two {
|
||||
":80"
|
||||
],
|
||||
"logs": {
|
||||
"default_logger_name": "two"
|
||||
"default_logger_name": "log0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
:80 {
|
||||
log {
|
||||
sampling {
|
||||
interval 5m
|
||||
interval 300
|
||||
first 50
|
||||
thereafter 40
|
||||
}
|
||||
@@ -18,7 +18,7 @@
|
||||
},
|
||||
"log0": {
|
||||
"sampling": {
|
||||
"interval": 300000000000,
|
||||
"interval": 300,
|
||||
"first": 50,
|
||||
"thereafter": 40
|
||||
},
|
||||
|
||||
@@ -1,35 +0,0 @@
|
||||
{
|
||||
metrics {
|
||||
otlp
|
||||
}
|
||||
}
|
||||
:80 {
|
||||
respond "Hello"
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":80"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "Hello",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"metrics": {
|
||||
"otlp": true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,41 +0,0 @@
|
||||
{
|
||||
renewal_window_ratio 0.1666
|
||||
}
|
||||
|
||||
example.com {
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"automation": {
|
||||
"policies": [
|
||||
{
|
||||
"renewal_window_ratio": 0.1666
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
-63
@@ -1,63 +0,0 @@
|
||||
{
|
||||
renewal_window_ratio 0.1666
|
||||
}
|
||||
|
||||
a.example.com {
|
||||
tls {
|
||||
renewal_window_ratio 0.25
|
||||
}
|
||||
}
|
||||
|
||||
b.example.com {
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"a.example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
},
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"b.example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"automation": {
|
||||
"policies": [
|
||||
{
|
||||
"subjects": [
|
||||
"a.example.com"
|
||||
],
|
||||
"renewal_window_ratio": 0.25
|
||||
},
|
||||
{
|
||||
"renewal_window_ratio": 0.1666
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,58 +0,0 @@
|
||||
:8884
|
||||
|
||||
reverse_proxy 127.0.0.1:65535 {
|
||||
lb_retries 3
|
||||
lb_retry_match expression `{rp.status_code} in [502, 503]`
|
||||
lb_retry_match expression `{rp.is_transport_error} || {rp.status_code} == 502`
|
||||
lb_retry_match expression `method('POST') && {rp.status_code} == 503`
|
||||
lb_retry_match `{rp.status_code} == 504`
|
||||
lb_retry_match `{rp.is_transport_error} && method('PUT')`
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":8884"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "reverse_proxy",
|
||||
"load_balancing": {
|
||||
"retries": 3,
|
||||
"retry_match": [
|
||||
{
|
||||
"expression": "{http.reverse_proxy.status_code} in [502, 503]"
|
||||
},
|
||||
{
|
||||
"expression": "{http.reverse_proxy.is_transport_error} || {http.reverse_proxy.status_code} == 502"
|
||||
},
|
||||
{
|
||||
"expression": "method('POST') \u0026\u0026 {http.reverse_proxy.status_code} == 503"
|
||||
},
|
||||
{
|
||||
"expression": "{http.reverse_proxy.status_code} == 504"
|
||||
},
|
||||
{
|
||||
"expression": "{http.reverse_proxy.is_transport_error} \u0026\u0026 method('PUT')"
|
||||
}
|
||||
]
|
||||
},
|
||||
"upstreams": [
|
||||
{
|
||||
"dial": "127.0.0.1:65535"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
-147
@@ -1,147 +0,0 @@
|
||||
:8884
|
||||
|
||||
reverse_proxy 127.0.0.1:65535 {
|
||||
lb_retries 5
|
||||
|
||||
# request matchers (backward-compatible, non-expression)
|
||||
lb_retry_match {
|
||||
method POST PUT
|
||||
}
|
||||
lb_retry_match {
|
||||
path /foo*
|
||||
}
|
||||
lb_retry_match {
|
||||
header X-Idempotency-Key *
|
||||
}
|
||||
|
||||
# response status code via expression
|
||||
lb_retry_match {
|
||||
expression `{rp.status_code} in [502, 503, 504]`
|
||||
}
|
||||
|
||||
# response header via expression
|
||||
lb_retry_match {
|
||||
expression `{rp.header.X-Retry} == "true"`
|
||||
}
|
||||
|
||||
# CEL request functions combined with response placeholders
|
||||
lb_retry_match {
|
||||
expression `method('POST') && {rp.status_code} >= 500`
|
||||
}
|
||||
lb_retry_match {
|
||||
expression `path('/api*') && {rp.status_code} in [502, 503]`
|
||||
}
|
||||
lb_retry_match {
|
||||
expression `host('example.com') && {rp.status_code} == 503`
|
||||
}
|
||||
lb_retry_match {
|
||||
expression `query({'retry': 'true'}) && {rp.status_code} >= 500`
|
||||
}
|
||||
lb_retry_match {
|
||||
expression `header({'X-Idempotency-Key': '*'}) && {rp.status_code} in [502, 503]`
|
||||
}
|
||||
lb_retry_match {
|
||||
expression `protocol('https') && {rp.status_code} == 502`
|
||||
}
|
||||
lb_retry_match {
|
||||
expression `path_regexp('^/api/v[0-9]+/') && {rp.status_code} >= 500`
|
||||
}
|
||||
lb_retry_match {
|
||||
expression `header_regexp('Content-Type', '^application/json') && {rp.status_code} == 502`
|
||||
}
|
||||
|
||||
# transport error handling via placeholder
|
||||
lb_retry_match {
|
||||
expression `{rp.is_transport_error} || {rp.status_code} in [502, 503]`
|
||||
}
|
||||
lb_retry_match {
|
||||
expression `{rp.is_transport_error} && method('POST')`
|
||||
}
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":8884"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "reverse_proxy",
|
||||
"load_balancing": {
|
||||
"retries": 5,
|
||||
"retry_match": [
|
||||
{
|
||||
"method": [
|
||||
"POST",
|
||||
"PUT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"path": [
|
||||
"/foo*"
|
||||
]
|
||||
},
|
||||
{
|
||||
"header": {
|
||||
"X-Idempotency-Key": [
|
||||
"*"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"expression": "{http.reverse_proxy.status_code} in [502, 503, 504]"
|
||||
},
|
||||
{
|
||||
"expression": "{http.reverse_proxy.header.X-Retry} == \"true\""
|
||||
},
|
||||
{
|
||||
"expression": "method('POST') \u0026\u0026 {http.reverse_proxy.status_code} \u003e= 500"
|
||||
},
|
||||
{
|
||||
"expression": "path('/api*') \u0026\u0026 {http.reverse_proxy.status_code} in [502, 503]"
|
||||
},
|
||||
{
|
||||
"expression": "host('example.com') \u0026\u0026 {http.reverse_proxy.status_code} == 503"
|
||||
},
|
||||
{
|
||||
"expression": "query({'retry': 'true'}) \u0026\u0026 {http.reverse_proxy.status_code} \u003e= 500"
|
||||
},
|
||||
{
|
||||
"expression": "header({'X-Idempotency-Key': '*'}) \u0026\u0026 {http.reverse_proxy.status_code} in [502, 503]"
|
||||
},
|
||||
{
|
||||
"expression": "protocol('https') \u0026\u0026 {http.reverse_proxy.status_code} == 502"
|
||||
},
|
||||
{
|
||||
"expression": "path_regexp('^/api/v[0-9]+/') \u0026\u0026 {http.reverse_proxy.status_code} \u003e= 500"
|
||||
},
|
||||
{
|
||||
"expression": "header_regexp('Content-Type', '^application/json') \u0026\u0026 {http.reverse_proxy.status_code} == 502"
|
||||
},
|
||||
{
|
||||
"expression": "{http.reverse_proxy.is_transport_error} || {http.reverse_proxy.status_code} in [502, 503]"
|
||||
},
|
||||
{
|
||||
"expression": "{http.reverse_proxy.is_transport_error} \u0026\u0026 method('POST')"
|
||||
}
|
||||
]
|
||||
},
|
||||
"upstreams": [
|
||||
{
|
||||
"dial": "127.0.0.1:65535"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,56 +0,0 @@
|
||||
https://example.com {
|
||||
reverse_proxy https://localhost:54321 {
|
||||
stream_buffer_size 8KB
|
||||
}
|
||||
}
|
||||
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"example.com"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "reverse_proxy",
|
||||
"stream_buffer_size": 8000,
|
||||
"transport": {
|
||||
"protocol": "http",
|
||||
"tls": {}
|
||||
},
|
||||
"upstreams": [
|
||||
{
|
||||
"dial": "localhost:54321"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,83 +0,0 @@
|
||||
{
|
||||
dns mock foo
|
||||
acme_dns mock bar
|
||||
}
|
||||
|
||||
localhost {
|
||||
tls {
|
||||
resolvers 8.8.8.8 8.8.4.4
|
||||
}
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"localhost"
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"automation": {
|
||||
"policies": [
|
||||
{
|
||||
"subjects": [
|
||||
"localhost"
|
||||
],
|
||||
"issuers": [
|
||||
{
|
||||
"challenges": {
|
||||
"dns": {
|
||||
"provider": {
|
||||
"argument": "bar",
|
||||
"name": "mock"
|
||||
},
|
||||
"resolvers": [
|
||||
"8.8.8.8",
|
||||
"8.8.4.4"
|
||||
]
|
||||
}
|
||||
},
|
||||
"module": "acme"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"issuers": [
|
||||
{
|
||||
"challenges": {
|
||||
"dns": {
|
||||
"provider": {
|
||||
"argument": "bar",
|
||||
"name": "mock"
|
||||
}
|
||||
}
|
||||
},
|
||||
"module": "acme"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"dns": {
|
||||
"argument": "foo",
|
||||
"name": "mock"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -54,6 +54,11 @@ b.com {
|
||||
"via": "http"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"subjects": [
|
||||
"b.com"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -1,96 +0,0 @@
|
||||
# example from https://github.com/caddyserver/caddy/issues/7559
|
||||
*.test.local {
|
||||
tls {
|
||||
get_certificate http http://cert-server:9000/certs
|
||||
}
|
||||
respond "wildcard"
|
||||
}
|
||||
|
||||
# certificate for this subdomain is covered by wildcard above
|
||||
subdomain.test.local {
|
||||
respond "subdomain"
|
||||
}
|
||||
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"subdomain.test.local"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "subdomain",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
},
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"*.test.local"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "wildcard",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"automation": {
|
||||
"policies": [
|
||||
{
|
||||
"subjects": [
|
||||
"*.test.local"
|
||||
],
|
||||
"get_certificate": [
|
||||
{
|
||||
"url": "http://cert-server:9000/certs",
|
||||
"via": "http"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
-87
@@ -1,87 +0,0 @@
|
||||
localhost
|
||||
|
||||
respond "hello from localhost"
|
||||
tls {
|
||||
client_auth {
|
||||
mode request
|
||||
trust_pool combined {
|
||||
source inline {
|
||||
trust_der MIIDSzCCAjOgAwIBAgIUfIRObjWNUA4jxQ/0x8BOCvE2Vw4wDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMTkwODI4MTYyNTU5WhcNMjkwODI1MTYyNTU5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5m5elxhQfMp/3aVJ4JnpN9PUSz6LlP6LePAPFU7gqohVVFVtDkChJAG3FNkNQNlieVTja/bgH9IcC6oKbROwdY1h0MvNV8AHHigvl03WuJD8g2ReVFXXwsnrPmKXCFzQyMI6TYk3m2gYrXsZOU1GLnfMRC3KAMRgE2F45twOs9hqG169YJ6mM2eQjzjCHWI6S2/iUYvYxRkCOlYUbLsMD/AhgAf1plzg6LPqNxtdlwxZnA0ytgkmhK67HtzJu0+ovUCsMv0RwcMhsEo9T8nyFAGt9XLZ63X5WpBCTUApaAUhnG0XnerjmUWb6eUWw4zev54sEfY5F3x002iQaW6cECAwEAAaOBkDCBjTAdBgNVHQ4EFgQU4CBUbZsS2GaNIkGRz/cBsD5ivjswUQYDVR0jBEowSIAU4CBUbZsS2GaNIkGRz/cBsD5ivjuhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8hE5uNY1QDiPFD/THwE4K8TZXDjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAKB3V4HIzoiO/Ch6WMj9bLJ2FGbpkMrcb/Eq01hT5zcfKD66lVS1MlK+cRL446Z2b2KDP1oFyVs+qmrmtdwrWgD+nfe2sBmmIHo9m9KygMkEOfG3MghGTEcS+0cTKEcoHYWYyOqQh6jnedXY8Cdm4GM1hAc9MiL3/sqV8YCVSLNnkoNysmr06/rZ0MCUZPGUtRmfd0heWhrfzAKw2HLgX+RAmpOE2MZqWcjvqKGyaRiaZks4nJkP6521aC2Lgp0HhCz1j8/uQ5ldoDszCnu/iro0NAsNtudTMD+YoLQxLqdleIh6CW+illc2VdXwj7mn6J04yns9jfE2jRjW/yTLFuQ==
|
||||
}
|
||||
source file {
|
||||
pem_file ../caddy.ca.cer
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"localhost"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "hello from localhost",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
],
|
||||
"tls_connection_policies": [
|
||||
{
|
||||
"match": {
|
||||
"sni": [
|
||||
"localhost"
|
||||
]
|
||||
},
|
||||
"client_authentication": {
|
||||
"ca": {
|
||||
"provider": "combined",
|
||||
"sources": [
|
||||
{
|
||||
"provider": "inline",
|
||||
"trusted_ca_certs": [
|
||||
"MIIDSzCCAjOgAwIBAgIUfIRObjWNUA4jxQ/0x8BOCvE2Vw4wDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMTkwODI4MTYyNTU5WhcNMjkwODI1MTYyNTU5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5m5elxhQfMp/3aVJ4JnpN9PUSz6LlP6LePAPFU7gqohVVFVtDkChJAG3FNkNQNlieVTja/bgH9IcC6oKbROwdY1h0MvNV8AHHigvl03WuJD8g2ReVFXXwsnrPmKXCFzQyMI6TYk3m2gYrXsZOU1GLnfMRC3KAMRgE2F45twOs9hqG169YJ6mM2eQjzjCHWI6S2/iUYvYxRkCOlYUbLsMD/AhgAf1plzg6LPqNxtdlwxZnA0ytgkmhK67HtzJu0+ovUCsMv0RwcMhsEo9T8nyFAGt9XLZ63X5WpBCTUApaAUhnG0XnerjmUWb6eUWw4zev54sEfY5F3x002iQaW6cECAwEAAaOBkDCBjTAdBgNVHQ4EFgQU4CBUbZsS2GaNIkGRz/cBsD5ivjswUQYDVR0jBEowSIAU4CBUbZsS2GaNIkGRz/cBsD5ivjuhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8hE5uNY1QDiPFD/THwE4K8TZXDjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAKB3V4HIzoiO/Ch6WMj9bLJ2FGbpkMrcb/Eq01hT5zcfKD66lVS1MlK+cRL446Z2b2KDP1oFyVs+qmrmtdwrWgD+nfe2sBmmIHo9m9KygMkEOfG3MghGTEcS+0cTKEcoHYWYyOqQh6jnedXY8Cdm4GM1hAc9MiL3/sqV8YCVSLNnkoNysmr06/rZ0MCUZPGUtRmfd0heWhrfzAKw2HLgX+RAmpOE2MZqWcjvqKGyaRiaZks4nJkP6521aC2Lgp0HhCz1j8/uQ5ldoDszCnu/iro0NAsNtudTMD+YoLQxLqdleIh6CW+illc2VdXwj7mn6J04yns9jfE2jRjW/yTLFuQ=="
|
||||
]
|
||||
},
|
||||
{
|
||||
"pem_files": [
|
||||
"../caddy.ca.cer"
|
||||
],
|
||||
"provider": "file"
|
||||
}
|
||||
]
|
||||
},
|
||||
"mode": "request"
|
||||
}
|
||||
},
|
||||
{}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
-87
@@ -1,87 +0,0 @@
|
||||
localhost
|
||||
|
||||
respond "hello from localhost"
|
||||
tls {
|
||||
client_auth {
|
||||
mode require_and_verify
|
||||
trust_pool combined {
|
||||
source inline {
|
||||
trust_der MIIDSzCCAjOgAwIBAgIUfIRObjWNUA4jxQ/0x8BOCvE2Vw4wDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMTkwODI4MTYyNTU5WhcNMjkwODI1MTYyNTU5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5m5elxhQfMp/3aVJ4JnpN9PUSz6LlP6LePAPFU7gqohVVFVtDkChJAG3FNkNQNlieVTja/bgH9IcC6oKbROwdY1h0MvNV8AHHigvl03WuJD8g2ReVFXXwsnrPmKXCFzQyMI6TYk3m2gYrXsZOU1GLnfMRC3KAMRgE2F45twOs9hqG169YJ6mM2eQjzjCHWI6S2/iUYvYxRkCOlYUbLsMD/AhgAf1plzg6LPqNxtdlwxZnA0ytgkmhK67HtzJu0+ovUCsMv0RwcMhsEo9T8nyFAGt9XLZ63X5WpBCTUApaAUhnG0XnerjmUWb6eUWw4zev54sEfY5F3x002iQaW6cECAwEAAaOBkDCBjTAdBgNVHQ4EFgQU4CBUbZsS2GaNIkGRz/cBsD5ivjswUQYDVR0jBEowSIAU4CBUbZsS2GaNIkGRz/cBsD5ivjuhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8hE5uNY1QDiPFD/THwE4K8TZXDjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAKB3V4HIzoiO/Ch6WMj9bLJ2FGbpkMrcb/Eq01hT5zcfKD66lVS1MlK+cRL446Z2b2KDP1oFyVs+qmrmtdwrWgD+nfe2sBmmIHo9m9KygMkEOfG3MghGTEcS+0cTKEcoHYWYyOqQh6jnedXY8Cdm4GM1hAc9MiL3/sqV8YCVSLNnkoNysmr06/rZ0MCUZPGUtRmfd0heWhrfzAKw2HLgX+RAmpOE2MZqWcjvqKGyaRiaZks4nJkP6521aC2Lgp0HhCz1j8/uQ5ldoDszCnu/iro0NAsNtudTMD+YoLQxLqdleIh6CW+illc2VdXwj7mn6J04yns9jfE2jRjW/yTLFuQ==
|
||||
}
|
||||
source pki_root {
|
||||
authority local
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"localhost"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "hello from localhost",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
],
|
||||
"tls_connection_policies": [
|
||||
{
|
||||
"match": {
|
||||
"sni": [
|
||||
"localhost"
|
||||
]
|
||||
},
|
||||
"client_authentication": {
|
||||
"ca": {
|
||||
"provider": "combined",
|
||||
"sources": [
|
||||
{
|
||||
"provider": "inline",
|
||||
"trusted_ca_certs": [
|
||||
"MIIDSzCCAjOgAwIBAgIUfIRObjWNUA4jxQ/0x8BOCvE2Vw4wDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMTkwODI4MTYyNTU5WhcNMjkwODI1MTYyNTU5WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK5m5elxhQfMp/3aVJ4JnpN9PUSz6LlP6LePAPFU7gqohVVFVtDkChJAG3FNkNQNlieVTja/bgH9IcC6oKbROwdY1h0MvNV8AHHigvl03WuJD8g2ReVFXXwsnrPmKXCFzQyMI6TYk3m2gYrXsZOU1GLnfMRC3KAMRgE2F45twOs9hqG169YJ6mM2eQjzjCHWI6S2/iUYvYxRkCOlYUbLsMD/AhgAf1plzg6LPqNxtdlwxZnA0ytgkmhK67HtzJu0+ovUCsMv0RwcMhsEo9T8nyFAGt9XLZ63X5WpBCTUApaAUhnG0XnerjmUWb6eUWw4zev54sEfY5F3x002iQaW6cECAwEAAaOBkDCBjTAdBgNVHQ4EFgQU4CBUbZsS2GaNIkGRz/cBsD5ivjswUQYDVR0jBEowSIAU4CBUbZsS2GaNIkGRz/cBsD5ivjuhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8hE5uNY1QDiPFD/THwE4K8TZXDjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAKB3V4HIzoiO/Ch6WMj9bLJ2FGbpkMrcb/Eq01hT5zcfKD66lVS1MlK+cRL446Z2b2KDP1oFyVs+qmrmtdwrWgD+nfe2sBmmIHo9m9KygMkEOfG3MghGTEcS+0cTKEcoHYWYyOqQh6jnedXY8Cdm4GM1hAc9MiL3/sqV8YCVSLNnkoNysmr06/rZ0MCUZPGUtRmfd0heWhrfzAKw2HLgX+RAmpOE2MZqWcjvqKGyaRiaZks4nJkP6521aC2Lgp0HhCz1j8/uQ5ldoDszCnu/iro0NAsNtudTMD+YoLQxLqdleIh6CW+illc2VdXwj7mn6J04yns9jfE2jRjW/yTLFuQ=="
|
||||
]
|
||||
},
|
||||
{
|
||||
"authority": [
|
||||
"local"
|
||||
],
|
||||
"provider": "pki_root"
|
||||
}
|
||||
]
|
||||
},
|
||||
"mode": "require_and_verify"
|
||||
}
|
||||
},
|
||||
{}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,66 +0,0 @@
|
||||
localhost
|
||||
|
||||
respond "hello from localhost"
|
||||
tls {
|
||||
client_auth {
|
||||
mode request
|
||||
trust_pool system
|
||||
}
|
||||
}
|
||||
----------
|
||||
{
|
||||
"apps": {
|
||||
"http": {
|
||||
"servers": {
|
||||
"srv0": {
|
||||
"listen": [
|
||||
":443"
|
||||
],
|
||||
"routes": [
|
||||
{
|
||||
"match": [
|
||||
{
|
||||
"host": [
|
||||
"localhost"
|
||||
]
|
||||
}
|
||||
],
|
||||
"handle": [
|
||||
{
|
||||
"handler": "subroute",
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"body": "hello from localhost",
|
||||
"handler": "static_response"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"terminal": true
|
||||
}
|
||||
],
|
||||
"tls_connection_policies": [
|
||||
{
|
||||
"match": {
|
||||
"sni": [
|
||||
"localhost"
|
||||
]
|
||||
},
|
||||
"client_authentication": {
|
||||
"ca": {
|
||||
"provider": "system"
|
||||
},
|
||||
"mode": "request"
|
||||
}
|
||||
},
|
||||
{}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,206 +0,0 @@
|
||||
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"github.com/caddyserver/caddy/v2/caddytest"
|
||||
)
|
||||
|
||||
// TestForwardAuthCopyHeadersStripsClientHeaders is a regression test for the
|
||||
// header injection vulnerability in forward_auth copy_headers.
|
||||
//
|
||||
// When the auth service returns 200 OK without one of the copy_headers headers,
|
||||
// the MatchNot guard skips the Set operation. Before this fix, the original
|
||||
// client-supplied header survived unchanged into the backend request, allowing
|
||||
// privilege escalation with only a valid (non-privileged) bearer token. After
|
||||
// the fix, an unconditional delete route runs first, so the backend always
|
||||
// sees an absent header rather than the attacker-supplied value.
|
||||
func TestForwardAuthCopyHeadersStripsClientHeaders(t *testing.T) {
|
||||
// Mock auth service: accepts any Bearer token, returns 200 OK with NO
|
||||
// identity headers. This is the stateless JWT validator pattern that
|
||||
// triggers the vulnerability.
|
||||
authSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if strings.HasPrefix(r.Header.Get("Authorization"), "Bearer ") {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusUnauthorized)
|
||||
}))
|
||||
defer authSrv.Close()
|
||||
|
||||
// Mock backend: records the identity headers it receives. A real application
|
||||
// would use X-User-Id / X-User-Role to make authorization decisions.
|
||||
type received struct{ userID, userRole string }
|
||||
var (
|
||||
mu sync.Mutex
|
||||
last received
|
||||
)
|
||||
backendSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
mu.Lock()
|
||||
last = received{
|
||||
userID: r.Header.Get("X-User-Id"),
|
||||
userRole: r.Header.Get("X-User-Role"),
|
||||
}
|
||||
mu.Unlock()
|
||||
w.WriteHeader(http.StatusOK)
|
||||
fmt.Fprint(w, "ok")
|
||||
}))
|
||||
defer backendSrv.Close()
|
||||
|
||||
authAddr := strings.TrimPrefix(authSrv.URL, "http://")
|
||||
backendAddr := strings.TrimPrefix(backendSrv.URL, "http://")
|
||||
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(fmt.Sprintf(`
|
||||
{
|
||||
skip_install_trust
|
||||
admin localhost:2999
|
||||
http_port 9080
|
||||
https_port 9443
|
||||
grace_period 1ns
|
||||
}
|
||||
http://localhost:9080 {
|
||||
forward_auth %s {
|
||||
uri /
|
||||
copy_headers X-User-Id X-User-Role
|
||||
}
|
||||
reverse_proxy %s
|
||||
}
|
||||
`, authAddr, backendAddr), "caddyfile")
|
||||
|
||||
// Case 1: no token. Auth must still reject the request even when the client
|
||||
// includes identity headers. This confirms the auth check is not bypassed.
|
||||
req, _ := http.NewRequest(http.MethodGet, "http://localhost:9080/", nil)
|
||||
req.Header.Set("X-User-Id", "injected")
|
||||
req.Header.Set("X-User-Role", "injected")
|
||||
resp := tester.AssertResponseCode(req, http.StatusUnauthorized)
|
||||
resp.Body.Close()
|
||||
|
||||
// Case 2: valid token, no injected headers. The backend should see absent
|
||||
// identity headers (the auth service never returns them).
|
||||
req, _ = http.NewRequest(http.MethodGet, "http://localhost:9080/", nil)
|
||||
req.Header.Set("Authorization", "Bearer token123")
|
||||
tester.AssertResponse(req, http.StatusOK, "ok")
|
||||
mu.Lock()
|
||||
gotID, gotRole := last.userID, last.userRole
|
||||
mu.Unlock()
|
||||
if gotID != "" {
|
||||
t.Errorf("baseline: X-User-Id should be absent, got %q", gotID)
|
||||
}
|
||||
if gotRole != "" {
|
||||
t.Errorf("baseline: X-User-Role should be absent, got %q", gotRole)
|
||||
}
|
||||
|
||||
// Case 3 (the security regression): valid token plus forged identity headers.
|
||||
// The fix must strip those values so the backend never sees them.
|
||||
req, _ = http.NewRequest(http.MethodGet, "http://localhost:9080/", nil)
|
||||
req.Header.Set("Authorization", "Bearer token123")
|
||||
req.Header.Set("X-User-Id", "admin") // forged
|
||||
req.Header.Set("X-User-Role", "superadmin") // forged
|
||||
tester.AssertResponse(req, http.StatusOK, "ok")
|
||||
mu.Lock()
|
||||
gotID, gotRole = last.userID, last.userRole
|
||||
mu.Unlock()
|
||||
if gotID != "" {
|
||||
t.Errorf("injection: X-User-Id must be stripped, got %q", gotID)
|
||||
}
|
||||
if gotRole != "" {
|
||||
t.Errorf("injection: X-User-Role must be stripped, got %q", gotRole)
|
||||
}
|
||||
}
|
||||
|
||||
// TestForwardAuthCopyHeadersAuthResponseWins verifies that when the auth
|
||||
// service does include a copy_headers header in its response, that value
|
||||
// is forwarded to the backend and takes precedence over any client-supplied
|
||||
// value for the same header.
|
||||
func TestForwardAuthCopyHeadersAuthResponseWins(t *testing.T) {
|
||||
const wantUserID = "service-user-42"
|
||||
const wantUserRole = "editor"
|
||||
|
||||
// Auth service: accepts bearer token and sets identity headers.
|
||||
authSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if strings.HasPrefix(r.Header.Get("Authorization"), "Bearer ") {
|
||||
w.Header().Set("X-User-Id", wantUserID)
|
||||
w.Header().Set("X-User-Role", wantUserRole)
|
||||
w.WriteHeader(http.StatusOK)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusUnauthorized)
|
||||
}))
|
||||
defer authSrv.Close()
|
||||
|
||||
type received struct{ userID, userRole string }
|
||||
var (
|
||||
mu sync.Mutex
|
||||
last received
|
||||
)
|
||||
backendSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
mu.Lock()
|
||||
last = received{
|
||||
userID: r.Header.Get("X-User-Id"),
|
||||
userRole: r.Header.Get("X-User-Role"),
|
||||
}
|
||||
mu.Unlock()
|
||||
w.WriteHeader(http.StatusOK)
|
||||
fmt.Fprint(w, "ok")
|
||||
}))
|
||||
defer backendSrv.Close()
|
||||
|
||||
authAddr := strings.TrimPrefix(authSrv.URL, "http://")
|
||||
backendAddr := strings.TrimPrefix(backendSrv.URL, "http://")
|
||||
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(fmt.Sprintf(`
|
||||
{
|
||||
skip_install_trust
|
||||
admin localhost:2999
|
||||
http_port 9080
|
||||
https_port 9443
|
||||
grace_period 1ns
|
||||
}
|
||||
http://localhost:9080 {
|
||||
forward_auth %s {
|
||||
uri /
|
||||
copy_headers X-User-Id X-User-Role
|
||||
}
|
||||
reverse_proxy %s
|
||||
}
|
||||
`, authAddr, backendAddr), "caddyfile")
|
||||
|
||||
// The client sends forged headers; the auth service overrides them with
|
||||
// its own values. The backend must receive the auth service values.
|
||||
req, _ := http.NewRequest(http.MethodGet, "http://localhost:9080/", nil)
|
||||
req.Header.Set("Authorization", "Bearer token123")
|
||||
req.Header.Set("X-User-Id", "forged-id") // must be overwritten
|
||||
req.Header.Set("X-User-Role", "forged-role") // must be overwritten
|
||||
tester.AssertResponse(req, http.StatusOK, "ok")
|
||||
|
||||
mu.Lock()
|
||||
gotID, gotRole := last.userID, last.userRole
|
||||
mu.Unlock()
|
||||
if gotID != wantUserID {
|
||||
t.Errorf("X-User-Id: want %q, got %q", wantUserID, gotID)
|
||||
}
|
||||
if gotRole != wantUserRole {
|
||||
t.Errorf("X-User-Role: want %q, got %q", wantUserRole, gotRole)
|
||||
}
|
||||
}
|
||||
@@ -3,7 +3,7 @@ package integration
|
||||
import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"math/rand/v2"
|
||||
"math/rand"
|
||||
"net"
|
||||
"net/http"
|
||||
"strings"
|
||||
@@ -54,7 +54,7 @@ func TestHTTPRedirectWrapperWithLargeUpload(t *testing.T) {
|
||||
const uploadSize = (1024 * 1024) + 1 // 1 MB + 1 byte
|
||||
// 1 more than an MB
|
||||
body := make([]byte, uploadSize)
|
||||
rand.NewChaCha8([32]byte{}).Read(body)
|
||||
rand.New(rand.NewSource(0)).Read(body)
|
||||
|
||||
tester := setupListenerWrapperTest(t, func(writer http.ResponseWriter, request *http.Request) {
|
||||
buf := new(bytes.Buffer)
|
||||
|
||||
@@ -53,7 +53,7 @@ func TestLeafCertLifetimeLessThanIntermediate(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
`, "json", "should be less than intermediate certificate lifetime")
|
||||
`, "json", "certificate lifetime (168h0m0s) should be less than intermediate certificate lifetime (168h0m0s)")
|
||||
}
|
||||
|
||||
func TestIntermediateLifetimeLessThanRoot(t *testing.T) {
|
||||
@@ -103,5 +103,5 @@ func TestIntermediateLifetimeLessThanRoot(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
`, "json", "intermediate certificate lifetime must be less than actual root certificate lifetime")
|
||||
`, "json", "intermediate certificate lifetime must be less than root certificate lifetime (86400h0m0s)")
|
||||
}
|
||||
|
||||
@@ -1,595 +0,0 @@
|
||||
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
// Integration tests for Caddy's PROXY protocol support, covering two distinct
|
||||
// roles that Caddy can play:
|
||||
//
|
||||
// 1. As a PROXY protocol *sender* (reverse proxy outbound transport):
|
||||
// Caddy receives an inbound request from a test client and the
|
||||
// reverse_proxy handler forwards it to an upstream with a PROXY protocol
|
||||
// header (v1 or v2) prepended to the connection. A lightweight backend
|
||||
// built with go-proxyproto validates that the header was received and
|
||||
// carries the correct client address.
|
||||
//
|
||||
// Transport versions tested:
|
||||
// - "1.1" -> plain HTTP/1.1 to the upstream
|
||||
// - "h2c" -> HTTP/2 cleartext (h2c) to the upstream (regression for #7529)
|
||||
// - "2" -> HTTP/2 over TLS (h2) to the upstream
|
||||
//
|
||||
// For each transport version both PROXY protocol v1 and v2 are exercised.
|
||||
//
|
||||
// HTTP/3 (h3) is not included because it uses QUIC/UDP and therefore
|
||||
// bypasses the TCP-level dialContext that injects PROXY protocol headers;
|
||||
// there is no meaningful h3 + proxy protocol sender combination to test.
|
||||
//
|
||||
// 2. As a PROXY protocol *receiver* (server-side listener wrapper):
|
||||
// A raw TCP client dials Caddy directly, injects a PROXY v2 header
|
||||
// spoofing a source address, and sends a normal HTTP/1.1 request. The
|
||||
// Caddy server is configured with the proxy_protocol listener wrapper and
|
||||
// is expected to surface the spoofed address via the
|
||||
// {http.request.remote.host} placeholder.
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"slices"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
goproxy "github.com/pires/go-proxyproto"
|
||||
"golang.org/x/net/http2"
|
||||
"golang.org/x/net/http2/h2c"
|
||||
|
||||
"github.com/caddyserver/caddy/v2/caddytest"
|
||||
)
|
||||
|
||||
// proxyProtoBackend is a minimal HTTP server that sits behind a
|
||||
// go-proxyproto listener and records the source address that was
|
||||
// delivered in the PROXY header for each request.
|
||||
type proxyProtoBackend struct {
|
||||
mu sync.Mutex
|
||||
headerAddrs []string // host:port strings extracted from each PROXY header
|
||||
|
||||
ln net.Listener
|
||||
srv *http.Server
|
||||
}
|
||||
|
||||
// newProxyProtoBackend starts a TCP listener wrapped with go-proxyproto on a
|
||||
// random local port and serves requests with a simple "OK" body. The PROXY
|
||||
// header source addresses are accumulated in headerAddrs so tests can
|
||||
// inspect them.
|
||||
func newProxyProtoBackend(t *testing.T) *proxyProtoBackend {
|
||||
t.Helper()
|
||||
|
||||
b := &proxyProtoBackend{}
|
||||
|
||||
rawLn, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("backend: listen: %v", err)
|
||||
}
|
||||
|
||||
// Wrap with go-proxyproto so the PROXY header is stripped and parsed
|
||||
// before the HTTP server sees the connection. We use REQUIRE so that a
|
||||
// missing header returns an error instead of silently passing through.
|
||||
pLn := &goproxy.Listener{
|
||||
Listener: rawLn,
|
||||
Policy: func(_ net.Addr) (goproxy.Policy, error) {
|
||||
return goproxy.REQUIRE, nil
|
||||
},
|
||||
}
|
||||
b.ln = pLn
|
||||
|
||||
// Wrap the handler with h2c support so the backend can speak HTTP/2
|
||||
// cleartext (h2c) as well as plain HTTP/1.1. Without this, Caddy's
|
||||
// reverse proxy would receive a 'frame too large' error when the
|
||||
// upstream transport is configured to use h2c.
|
||||
h2Server := &http2.Server{}
|
||||
handlerFn := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
// go-proxyproto has already updated the net.Conn's remote
|
||||
// address to the value from the PROXY header; the HTTP server
|
||||
// surfaces it in r.RemoteAddr.
|
||||
b.mu.Lock()
|
||||
b.headerAddrs = append(b.headerAddrs, r.RemoteAddr)
|
||||
b.mu.Unlock()
|
||||
w.WriteHeader(http.StatusOK)
|
||||
_, _ = fmt.Fprint(w, "OK")
|
||||
})
|
||||
|
||||
b.srv = &http.Server{
|
||||
Handler: h2c.NewHandler(handlerFn, h2Server),
|
||||
}
|
||||
|
||||
go b.srv.Serve(pLn) //nolint:errcheck
|
||||
t.Cleanup(func() {
|
||||
_ = b.srv.Close()
|
||||
_ = rawLn.Close()
|
||||
})
|
||||
|
||||
return b
|
||||
}
|
||||
|
||||
// addr returns the listening address (host:port) of the backend.
|
||||
func (b *proxyProtoBackend) addr() string {
|
||||
return b.ln.Addr().String()
|
||||
}
|
||||
|
||||
// recordedAddrs returns a snapshot of all PROXY-header source addresses seen
|
||||
// so far.
|
||||
func (b *proxyProtoBackend) recordedAddrs() []string {
|
||||
b.mu.Lock()
|
||||
defer b.mu.Unlock()
|
||||
cp := make([]string, len(b.headerAddrs))
|
||||
copy(cp, b.headerAddrs)
|
||||
return cp
|
||||
}
|
||||
|
||||
// tlsProxyProtoBackend is a TLS-enabled backend that sits behind a
|
||||
// go-proxyproto listener. The PROXY header is stripped before the TLS
|
||||
// handshake so the layer order on a connection is:
|
||||
//
|
||||
// raw TCP → go-proxyproto (strips PROXY header) → TLS handshake → HTTP/2
|
||||
type tlsProxyProtoBackend struct {
|
||||
mu sync.Mutex
|
||||
headerAddrs []string
|
||||
|
||||
srv *httptest.Server
|
||||
}
|
||||
|
||||
// newTLSProxyProtoBackend starts a TLS listener that first reads and strips
|
||||
// PROXY protocol headers (go-proxyproto, REQUIRE policy) and then performs a
|
||||
// TLS handshake. The backend speaks HTTP/2 over TLS (h2).
|
||||
//
|
||||
// The certificate is the standard self-signed certificate generated by
|
||||
// httptest.Server; the Caddy transport must be configured with
|
||||
// insecure_skip_verify: true to trust it.
|
||||
func newTLSProxyProtoBackend(t *testing.T) *tlsProxyProtoBackend {
|
||||
t.Helper()
|
||||
|
||||
b := &tlsProxyProtoBackend{}
|
||||
|
||||
handlerFn := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
b.mu.Lock()
|
||||
b.headerAddrs = append(b.headerAddrs, r.RemoteAddr)
|
||||
b.mu.Unlock()
|
||||
w.WriteHeader(http.StatusOK)
|
||||
_, _ = fmt.Fprint(w, "OK")
|
||||
})
|
||||
|
||||
rawLn, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("tlsBackend: listen: %v", err)
|
||||
}
|
||||
|
||||
// Wrap with go-proxyproto so the PROXY header is consumed before TLS.
|
||||
pLn := &goproxy.Listener{
|
||||
Listener: rawLn,
|
||||
Policy: func(_ net.Addr) (goproxy.Policy, error) {
|
||||
return goproxy.REQUIRE, nil
|
||||
},
|
||||
}
|
||||
|
||||
// httptest.NewUnstartedServer lets us replace the listener before
|
||||
// calling StartTLS(), which wraps our proxyproto listener with
|
||||
// tls.NewListener. This gives us the right layer order.
|
||||
b.srv = httptest.NewUnstartedServer(handlerFn)
|
||||
b.srv.Listener = pLn
|
||||
|
||||
// StartTLS enables HTTP/2 on the server automatically.
|
||||
b.srv.StartTLS()
|
||||
|
||||
t.Cleanup(func() {
|
||||
b.srv.Close()
|
||||
})
|
||||
|
||||
return b
|
||||
}
|
||||
|
||||
// addr returns the listening address (host:port) of the TLS backend.
|
||||
func (b *tlsProxyProtoBackend) addr() string {
|
||||
return b.srv.Listener.Addr().String()
|
||||
}
|
||||
|
||||
// tlsConfig returns the *tls.Config used by the backend server.
|
||||
// Tests can use it to verify cert details if needed.
|
||||
func (b *tlsProxyProtoBackend) tlsConfig() *tls.Config {
|
||||
return b.srv.TLS
|
||||
}
|
||||
|
||||
// recordedAddrs returns a snapshot of all PROXY-header source addresses.
|
||||
func (b *tlsProxyProtoBackend) recordedAddrs() []string {
|
||||
b.mu.Lock()
|
||||
defer b.mu.Unlock()
|
||||
cp := make([]string, len(b.headerAddrs))
|
||||
copy(cp, b.headerAddrs)
|
||||
return cp
|
||||
}
|
||||
|
||||
// proxyProtoTLSConfig builds a Caddy JSON configuration that proxies to a TLS
|
||||
// upstream with PROXY protocol. The transport uses insecure_skip_verify so
|
||||
// the self-signed certificate generated by httptest.Server is accepted.
|
||||
func proxyProtoTLSConfig(listenPort int, backendAddr, ppVersion string, transportVersions []string) string {
|
||||
versionsJSON, _ := json.Marshal(transportVersions)
|
||||
return fmt.Sprintf(`{
|
||||
"admin": {
|
||||
"listen": "localhost:2999"
|
||||
},
|
||||
"apps": {
|
||||
"pki": {
|
||||
"certificate_authorities": {
|
||||
"local": {
|
||||
"install_trust": false
|
||||
}
|
||||
}
|
||||
},
|
||||
"http": {
|
||||
"grace_period": 1,
|
||||
"servers": {
|
||||
"proxy": {
|
||||
"listen": [":%d"],
|
||||
"automatic_https": {
|
||||
"disable": true
|
||||
},
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "reverse_proxy",
|
||||
"upstreams": [{"dial": "%s"}],
|
||||
"transport": {
|
||||
"protocol": "http",
|
||||
"proxy_protocol": "%s",
|
||||
"versions": %s,
|
||||
"tls": {
|
||||
"insecure_skip_verify": true
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}`, listenPort, backendAddr, ppVersion, string(versionsJSON))
|
||||
}
|
||||
|
||||
// testTLSProxyProtocolMatrix is the shared implementation for TLS-based proxy
|
||||
// protocol tests. It mirrors testProxyProtocolMatrix but uses a TLS backend.
|
||||
func testTLSProxyProtocolMatrix(t *testing.T, ppVersion string, transportVersions []string, numRequests int) {
|
||||
t.Helper()
|
||||
|
||||
backend := newTLSProxyProtoBackend(t)
|
||||
listenPort := freePort(t)
|
||||
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.WithDefaultOverrides(caddytest.Config{
|
||||
AdminPort: 2999,
|
||||
})
|
||||
cfg := proxyProtoTLSConfig(listenPort, backend.addr(), ppVersion, transportVersions)
|
||||
tester.InitServer(cfg, "json")
|
||||
|
||||
proxyURL := fmt.Sprintf("http://127.0.0.1:%d/", listenPort)
|
||||
|
||||
for i := 0; i < numRequests; i++ {
|
||||
resp, err := tester.Client.Get(proxyURL)
|
||||
if err != nil {
|
||||
t.Fatalf("request %d/%d: GET %s: %v", i+1, numRequests, proxyURL, err)
|
||||
}
|
||||
resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Errorf("request %d/%d: expected status 200, got %d", i+1, numRequests, resp.StatusCode)
|
||||
}
|
||||
}
|
||||
|
||||
addrs := backend.recordedAddrs()
|
||||
if len(addrs) == 0 {
|
||||
t.Fatalf("backend recorded no PROXY protocol addresses (expected at least 1)")
|
||||
}
|
||||
|
||||
for i, addr := range addrs {
|
||||
host, _, err := net.SplitHostPort(addr)
|
||||
if err != nil {
|
||||
t.Errorf("addr[%d] %q: SplitHostPort: %v", i, addr, err)
|
||||
continue
|
||||
}
|
||||
if host != "127.0.0.1" {
|
||||
t.Errorf("addr[%d]: expected source 127.0.0.1, got %q", i, host)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// proxyProtoConfig builds a Caddy JSON configuration that:
|
||||
// - listens on listenPort for inbound HTTP requests
|
||||
// - proxies them to backendAddr with PROXY protocol ppVersion ("v1"/"v2")
|
||||
// - uses the given transport versions (e.g. ["1.1"] or ["h2c"])
|
||||
func proxyProtoConfig(listenPort int, backendAddr, ppVersion string, transportVersions []string) string {
|
||||
versionsJSON, _ := json.Marshal(transportVersions)
|
||||
return fmt.Sprintf(`{
|
||||
"admin": {
|
||||
"listen": "localhost:2999"
|
||||
},
|
||||
"apps": {
|
||||
"pki": {
|
||||
"certificate_authorities": {
|
||||
"local": {
|
||||
"install_trust": false
|
||||
}
|
||||
}
|
||||
},
|
||||
"http": {
|
||||
"grace_period": 1,
|
||||
"servers": {
|
||||
"proxy": {
|
||||
"listen": [":%d"],
|
||||
"automatic_https": {
|
||||
"disable": true
|
||||
},
|
||||
"routes": [
|
||||
{
|
||||
"handle": [
|
||||
{
|
||||
"handler": "reverse_proxy",
|
||||
"upstreams": [{"dial": "%s"}],
|
||||
"transport": {
|
||||
"protocol": "http",
|
||||
"proxy_protocol": "%s",
|
||||
"versions": %s
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}`, listenPort, backendAddr, ppVersion, string(versionsJSON))
|
||||
}
|
||||
|
||||
// freePort returns a free local TCP port by binding briefly and releasing it.
|
||||
func freePort(t *testing.T) int {
|
||||
t.Helper()
|
||||
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("freePort: %v", err)
|
||||
}
|
||||
port := ln.Addr().(*net.TCPAddr).Port
|
||||
_ = ln.Close()
|
||||
return port
|
||||
}
|
||||
|
||||
// TestProxyProtocolV1WithH1 verifies that PROXY protocol v1 headers are sent
|
||||
// correctly when the transport uses HTTP/1.1 to the upstream.
|
||||
func TestProxyProtocolV1WithH1(t *testing.T) {
|
||||
testProxyProtocolMatrix(t, "v1", []string{"1.1"}, 1)
|
||||
}
|
||||
|
||||
// TestProxyProtocolV2WithH1 verifies that PROXY protocol v2 headers are sent
|
||||
// correctly when the transport uses HTTP/1.1 to the upstream.
|
||||
func TestProxyProtocolV2WithH1(t *testing.T) {
|
||||
testProxyProtocolMatrix(t, "v2", []string{"1.1"}, 1)
|
||||
}
|
||||
|
||||
// TestProxyProtocolV1WithH2C verifies that PROXY protocol v1 headers are sent
|
||||
// correctly when the transport uses h2c (HTTP/2 cleartext) to the upstream.
|
||||
func TestProxyProtocolV1WithH2C(t *testing.T) {
|
||||
testProxyProtocolMatrix(t, "v1", []string{"h2c"}, 1)
|
||||
}
|
||||
|
||||
// TestProxyProtocolV2WithH2C verifies that PROXY protocol v2 headers are sent
|
||||
// correctly when the transport uses h2c (HTTP/2 cleartext) to the upstream.
|
||||
// This is the primary regression test for github.com/caddyserver/caddy/issues/7529:
|
||||
// before the fix, the h2 transport opened a new TCP connection per request
|
||||
// (because req.URL.Host was mangled differently for each request due to the
|
||||
// varying client port), which caused file-descriptor exhaustion under load.
|
||||
func TestProxyProtocolV2WithH2C(t *testing.T) {
|
||||
testProxyProtocolMatrix(t, "v2", []string{"h2c"}, 1)
|
||||
}
|
||||
|
||||
// TestProxyProtocolV2WithH2CMultipleRequests sends several sequential requests
|
||||
// through the h2c + PROXY-protocol path and confirms that:
|
||||
// 1. Every request receives a 200 response (no connection exhaustion).
|
||||
// 2. The backend received at least one PROXY header (connection was reused).
|
||||
//
|
||||
// This is the core regression guard for issue #7529: without the fix, a new
|
||||
// TCP connection was opened per request, quickly exhausting file descriptors.
|
||||
func TestProxyProtocolV2WithH2CMultipleRequests(t *testing.T) {
|
||||
testProxyProtocolMatrix(t, "v2", []string{"h2c"}, 5)
|
||||
}
|
||||
|
||||
// TestProxyProtocolV1WithH2 verifies that PROXY protocol v1 headers are sent
|
||||
// correctly when the transport uses HTTP/2 over TLS (h2) to the upstream.
|
||||
func TestProxyProtocolV1WithH2(t *testing.T) {
|
||||
testTLSProxyProtocolMatrix(t, "v1", []string{"2"}, 1)
|
||||
}
|
||||
|
||||
// TestProxyProtocolV2WithH2 verifies that PROXY protocol v2 headers are sent
|
||||
// correctly when the transport uses HTTP/2 over TLS (h2) to the upstream.
|
||||
func TestProxyProtocolV2WithH2(t *testing.T) {
|
||||
testTLSProxyProtocolMatrix(t, "v2", []string{"2"}, 1)
|
||||
}
|
||||
|
||||
// TestProxyProtocolServerAndProxy is an end-to-end matrix test that exercises
|
||||
// all combinations of PROXY protocol version x transport version.
|
||||
func TestProxyProtocolServerAndProxy(t *testing.T) {
|
||||
plainTests := []struct {
|
||||
name string
|
||||
ppVersion string
|
||||
transportVersions []string
|
||||
numRequests int
|
||||
}{
|
||||
{"h1-v1", "v1", []string{"1.1"}, 3},
|
||||
{"h1-v2", "v2", []string{"1.1"}, 3},
|
||||
{"h2c-v1", "v1", []string{"h2c"}, 3},
|
||||
{"h2c-v2", "v2", []string{"h2c"}, 3},
|
||||
}
|
||||
for _, tc := range plainTests {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
testProxyProtocolMatrix(t, tc.ppVersion, tc.transportVersions, tc.numRequests)
|
||||
})
|
||||
}
|
||||
|
||||
tlsTests := []struct {
|
||||
name string
|
||||
ppVersion string
|
||||
transportVersions []string
|
||||
numRequests int
|
||||
}{
|
||||
{"h2-v1", "v1", []string{"2"}, 3},
|
||||
{"h2-v2", "v2", []string{"2"}, 3},
|
||||
}
|
||||
for _, tc := range tlsTests {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
testTLSProxyProtocolMatrix(t, tc.ppVersion, tc.transportVersions, tc.numRequests)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// testProxyProtocolMatrix is the shared implementation for the proxy protocol
|
||||
// tests. It:
|
||||
// 1. Starts a go-proxyproto-wrapped backend.
|
||||
// 2. Configures Caddy as a reverse proxy with the given PROXY protocol
|
||||
// version and transport versions.
|
||||
// 3. Sends numRequests GET requests through Caddy and asserts 200 OK each time.
|
||||
// 4. Asserts the backend recorded at least one PROXY header whose source host
|
||||
// is 127.0.0.1 (the loopback address used by the test client).
|
||||
func testProxyProtocolMatrix(t *testing.T, ppVersion string, transportVersions []string, numRequests int) {
|
||||
t.Helper()
|
||||
|
||||
backend := newProxyProtoBackend(t)
|
||||
listenPort := freePort(t)
|
||||
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.WithDefaultOverrides(caddytest.Config{
|
||||
AdminPort: 2999,
|
||||
})
|
||||
cfg := proxyProtoConfig(listenPort, backend.addr(), ppVersion, transportVersions)
|
||||
tester.InitServer(cfg, "json")
|
||||
|
||||
// If the test is h2c-only (no "1.1" in versions), reconfigure the test
|
||||
// client transport to use unencrypted HTTP/2 so we actually exercise the
|
||||
// h2c code path through Caddy.
|
||||
if slices.Contains(transportVersions, "h2c") && !slices.Contains(transportVersions, "1.1") {
|
||||
tr, ok := tester.Client.Transport.(*http.Transport)
|
||||
if ok {
|
||||
tr.Protocols = new(http.Protocols)
|
||||
tr.Protocols.SetHTTP1(false)
|
||||
tr.Protocols.SetUnencryptedHTTP2(true)
|
||||
}
|
||||
}
|
||||
|
||||
proxyURL := fmt.Sprintf("http://127.0.0.1:%d/", listenPort)
|
||||
|
||||
for i := 0; i < numRequests; i++ {
|
||||
resp, err := tester.Client.Get(proxyURL)
|
||||
if err != nil {
|
||||
t.Fatalf("request %d/%d: GET %s: %v", i+1, numRequests, proxyURL, err)
|
||||
}
|
||||
resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Errorf("request %d/%d: expected status 200, got %d", i+1, numRequests, resp.StatusCode)
|
||||
}
|
||||
}
|
||||
|
||||
// The backend must have seen at least one PROXY header. For h1, there is
|
||||
// one per request; for h2c, requests share the same connection so only one
|
||||
// header is written at connection establishment.
|
||||
addrs := backend.recordedAddrs()
|
||||
if len(addrs) == 0 {
|
||||
t.Fatalf("backend recorded no PROXY protocol addresses (expected at least 1)")
|
||||
}
|
||||
|
||||
// Every PROXY-decoded source address must be the loopback address since
|
||||
// the test client always connects from 127.0.0.1.
|
||||
for i, addr := range addrs {
|
||||
host, _, err := net.SplitHostPort(addr)
|
||||
if err != nil {
|
||||
t.Errorf("addr[%d] %q: SplitHostPort: %v", i, addr, err)
|
||||
continue
|
||||
}
|
||||
if host != "127.0.0.1" {
|
||||
t.Errorf("addr[%d]: expected source 127.0.0.1, got %q", i, host)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestProxyProtocolListenerWrapper verifies that Caddy's
|
||||
// caddy.listeners.proxy_protocol listener wrapper can successfully parse
|
||||
// incoming PROXY protocol headers.
|
||||
//
|
||||
// The test dials Caddy's listening port directly, injects a raw PROXY v2
|
||||
// header spoofing source address 10.0.0.1:1234, then sends a normal
|
||||
// HTTP/1.1 GET request. The Caddy server is configured to echo back the
|
||||
// remote address ({http.request.remote.host}). The test asserts that the
|
||||
// echoed address is the spoofed 10.0.0.1.
|
||||
func TestProxyProtocolListenerWrapper(t *testing.T) {
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(`{
|
||||
skip_install_trust
|
||||
admin localhost:2999
|
||||
http_port 9080
|
||||
https_port 9443
|
||||
grace_period 1ns
|
||||
servers :9080 {
|
||||
listener_wrappers {
|
||||
proxy_protocol {
|
||||
timeout 5s
|
||||
allow 127.0.0.0/8
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
http://localhost:9080 {
|
||||
respond "{http.request.remote.host}"
|
||||
}`, "caddyfile")
|
||||
|
||||
// Dial the Caddy listener directly and inject a PROXY v2 header that
|
||||
// claims the connection originates from 10.0.0.1:1234.
|
||||
conn, err := net.Dial("tcp", "127.0.0.1:9080")
|
||||
if err != nil {
|
||||
t.Fatalf("dial: %v", err)
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
spoofedSrc := &net.TCPAddr{IP: net.ParseIP("10.0.0.1"), Port: 1234}
|
||||
spoofedDst := &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 9080}
|
||||
hdr := goproxy.HeaderProxyFromAddrs(2, spoofedSrc, spoofedDst)
|
||||
if _, err := hdr.WriteTo(conn); err != nil {
|
||||
t.Fatalf("write proxy header: %v", err)
|
||||
}
|
||||
|
||||
// Write a minimal HTTP/1.1 GET request.
|
||||
_, err = fmt.Fprintf(conn,
|
||||
"GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
|
||||
if err != nil {
|
||||
t.Fatalf("write HTTP request: %v", err)
|
||||
}
|
||||
|
||||
// Read the raw response and look for the spoofed address in the body.
|
||||
buf := make([]byte, 4096)
|
||||
n, _ := conn.Read(buf)
|
||||
raw := string(buf[:n])
|
||||
|
||||
if !strings.Contains(raw, "10.0.0.1") {
|
||||
t.Errorf("expected spoofed address 10.0.0.1 in response body; full response:\n%s", raw)
|
||||
}
|
||||
}
|
||||
@@ -7,8 +7,8 @@ import (
|
||||
"os"
|
||||
"runtime"
|
||||
"strings"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/caddyserver/caddy/v2/caddytest"
|
||||
)
|
||||
@@ -327,41 +327,6 @@ func TestReverseProxyWithPlaceholderTCPDialAddress(t *testing.T) {
|
||||
}
|
||||
|
||||
func TestReverseProxyHealthCheck(t *testing.T) {
|
||||
// Start lightweight backend servers so they're ready before Caddy's
|
||||
// active health checker runs; this avoids a startup race where the
|
||||
// health checker probes backends that haven't yet begun accepting
|
||||
// connections and marks them unhealthy.
|
||||
//
|
||||
// This mirrors how health checks are typically used in practice (to a separate
|
||||
// backend service) and avoids probing the same Caddy instance while it's still
|
||||
// provisioning and not ready to accept connections.
|
||||
|
||||
// backend server that responds to proxied requests
|
||||
helloSrv := &http.Server{
|
||||
Handler: http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
|
||||
_, _ = w.Write([]byte("Hello, World!"))
|
||||
}),
|
||||
}
|
||||
ln0, err := net.Listen("tcp", "127.0.0.1:2020")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to listen on 127.0.0.1:2020: %v", err)
|
||||
}
|
||||
go helloSrv.Serve(ln0)
|
||||
t.Cleanup(func() { helloSrv.Close(); ln0.Close() })
|
||||
|
||||
// backend server that serves health checks
|
||||
healthSrv := &http.Server{
|
||||
Handler: http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
|
||||
_, _ = w.Write([]byte("ok"))
|
||||
}),
|
||||
}
|
||||
ln1, err := net.Listen("tcp", "127.0.0.1:2021")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to listen on 127.0.0.1:2021: %v", err)
|
||||
}
|
||||
go healthSrv.Serve(ln1)
|
||||
t.Cleanup(func() { healthSrv.Close(); ln1.Close() })
|
||||
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(`
|
||||
{
|
||||
@@ -371,6 +336,12 @@ func TestReverseProxyHealthCheck(t *testing.T) {
|
||||
https_port 9443
|
||||
grace_period 1ns
|
||||
}
|
||||
http://localhost:2020 {
|
||||
respond "Hello, World!"
|
||||
}
|
||||
http://localhost:2021 {
|
||||
respond "ok"
|
||||
}
|
||||
http://localhost:9080 {
|
||||
reverse_proxy {
|
||||
to localhost:2020
|
||||
@@ -384,68 +355,8 @@ func TestReverseProxyHealthCheck(t *testing.T) {
|
||||
}
|
||||
}
|
||||
`, "caddyfile")
|
||||
tester.AssertGetResponse("http://localhost:9080/", 200, "Hello, World!")
|
||||
}
|
||||
|
||||
// TestReverseProxyHealthCheckPortUsed verifies that health_port is actually
|
||||
// used for active health checks and not the upstream's main port. This is a
|
||||
// regression test for https://github.com/caddyserver/caddy/issues/7524.
|
||||
func TestReverseProxyHealthCheckPortUsed(t *testing.T) {
|
||||
// upstream server: serves proxied requests normally, but returns 503 for
|
||||
// /health so that if health checks mistakenly hit this port the upstream
|
||||
// gets marked unhealthy and the proxy returns 503.
|
||||
upstreamSrv := &http.Server{
|
||||
Handler: http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
|
||||
if req.URL.Path == "/health" {
|
||||
w.WriteHeader(http.StatusServiceUnavailable)
|
||||
return
|
||||
}
|
||||
_, _ = w.Write([]byte("Hello, World!"))
|
||||
}),
|
||||
}
|
||||
ln0, err := net.Listen("tcp", "127.0.0.1:2022")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to listen on 127.0.0.1:2022: %v", err)
|
||||
}
|
||||
go upstreamSrv.Serve(ln0)
|
||||
t.Cleanup(func() { upstreamSrv.Close(); ln0.Close() })
|
||||
|
||||
// separate health check server on the configured health_port: returns 200
|
||||
// so the upstream is marked healthy only if health checks go to this port.
|
||||
healthSrv := &http.Server{
|
||||
Handler: http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
|
||||
_, _ = w.Write([]byte("ok"))
|
||||
}),
|
||||
}
|
||||
ln1, err := net.Listen("tcp", "127.0.0.1:2023")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to listen on 127.0.0.1:2023: %v", err)
|
||||
}
|
||||
go healthSrv.Serve(ln1)
|
||||
t.Cleanup(func() { healthSrv.Close(); ln1.Close() })
|
||||
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(`
|
||||
{
|
||||
skip_install_trust
|
||||
admin localhost:2999
|
||||
http_port 9080
|
||||
https_port 9443
|
||||
grace_period 1ns
|
||||
}
|
||||
http://localhost:9080 {
|
||||
reverse_proxy {
|
||||
to localhost:2022
|
||||
|
||||
health_uri /health
|
||||
health_port 2023
|
||||
health_interval 10ms
|
||||
health_timeout 100ms
|
||||
health_passes 1
|
||||
health_fails 1
|
||||
}
|
||||
}
|
||||
`, "caddyfile")
|
||||
time.Sleep(100 * time.Millisecond) // TODO: for some reason this test seems particularly flaky, getting 503 when it should be 200, unless we wait
|
||||
tester.AssertGetResponse("http://localhost:9080/", 200, "Hello, World!")
|
||||
}
|
||||
|
||||
@@ -563,233 +474,3 @@ func TestReverseProxyHealthCheckUnixSocketWithoutPort(t *testing.T) {
|
||||
|
||||
tester.AssertGetResponse("http://localhost:9080/", 200, "Hello, World!")
|
||||
}
|
||||
|
||||
// TestReverseProxyRetryMatchStatusCode verifies that lb_retry_match with a
|
||||
// CEL expression matching on {rp.status_code} causes the request to be
|
||||
// retried on the next upstream when the first upstream returns a matching
|
||||
// status code
|
||||
func TestReverseProxyRetryMatchStatusCode(t *testing.T) {
|
||||
// Bad upstream: returns 502
|
||||
badSrv := &http.Server{
|
||||
Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusBadGateway)
|
||||
}),
|
||||
}
|
||||
badLn, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to listen: %v", err)
|
||||
}
|
||||
go badSrv.Serve(badLn)
|
||||
t.Cleanup(func() { badSrv.Close(); badLn.Close() })
|
||||
|
||||
// Good upstream: returns 200
|
||||
goodSrv := &http.Server{
|
||||
Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Write([]byte("ok"))
|
||||
}),
|
||||
}
|
||||
goodLn, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to listen: %v", err)
|
||||
}
|
||||
go goodSrv.Serve(goodLn)
|
||||
t.Cleanup(func() { goodSrv.Close(); goodLn.Close() })
|
||||
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(fmt.Sprintf(`
|
||||
{
|
||||
skip_install_trust
|
||||
admin localhost:2999
|
||||
http_port 9080
|
||||
https_port 9443
|
||||
grace_period 1ns
|
||||
}
|
||||
http://localhost:9080 {
|
||||
reverse_proxy %s %s {
|
||||
lb_policy round_robin
|
||||
lb_retries 1
|
||||
lb_retry_match {
|
||||
expression `+"`{rp.status_code} in [502, 503]`"+`
|
||||
}
|
||||
}
|
||||
}
|
||||
`, goodLn.Addr().String(), badLn.Addr().String()), "caddyfile")
|
||||
|
||||
tester.AssertGetResponse("http://localhost:9080/", 200, "ok")
|
||||
}
|
||||
|
||||
// TestReverseProxyRetryMatchHeader verifies that lb_retry_match with a CEL
|
||||
// expression matching on {rp.header.*} causes the request to be retried when
|
||||
// the upstream sets a matching response header
|
||||
func TestReverseProxyRetryMatchHeader(t *testing.T) {
|
||||
var badHits atomic.Int32
|
||||
|
||||
// Bad upstream: returns 200 but signals retry via header
|
||||
badSrv := &http.Server{
|
||||
Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
badHits.Add(1)
|
||||
w.Header().Set("X-Upstream-Retry", "true")
|
||||
w.Write([]byte("bad"))
|
||||
}),
|
||||
}
|
||||
badLn, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to listen: %v", err)
|
||||
}
|
||||
go badSrv.Serve(badLn)
|
||||
t.Cleanup(func() { badSrv.Close(); badLn.Close() })
|
||||
|
||||
// Good upstream: returns 200 without retry header
|
||||
goodSrv := &http.Server{
|
||||
Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Write([]byte("good"))
|
||||
}),
|
||||
}
|
||||
goodLn, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to listen: %v", err)
|
||||
}
|
||||
go goodSrv.Serve(goodLn)
|
||||
t.Cleanup(func() { goodSrv.Close(); goodLn.Close() })
|
||||
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(fmt.Sprintf(`
|
||||
{
|
||||
skip_install_trust
|
||||
admin localhost:2999
|
||||
http_port 9080
|
||||
https_port 9443
|
||||
grace_period 1ns
|
||||
}
|
||||
http://localhost:9080 {
|
||||
reverse_proxy %s %s {
|
||||
lb_policy round_robin
|
||||
lb_retries 1
|
||||
lb_retry_match {
|
||||
expression `+"`{rp.header.X-Upstream-Retry} == \"true\"`"+`
|
||||
}
|
||||
}
|
||||
}
|
||||
`, goodLn.Addr().String(), badLn.Addr().String()), "caddyfile")
|
||||
|
||||
tester.AssertGetResponse("http://localhost:9080/", 200, "good")
|
||||
|
||||
if badHits.Load() != 1 {
|
||||
t.Errorf("bad upstream hits: got %d, want 1", badHits.Load())
|
||||
}
|
||||
}
|
||||
|
||||
// TestReverseProxyRetryMatchCombined verifies that a CEL expression combining
|
||||
// request path matching with response status code matching works correctly -
|
||||
// only retrying when both conditions are met
|
||||
func TestReverseProxyRetryMatchCombined(t *testing.T) {
|
||||
// Upstream: returns 502 for all requests
|
||||
srv := &http.Server{
|
||||
Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusBadGateway)
|
||||
}),
|
||||
}
|
||||
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to listen: %v", err)
|
||||
}
|
||||
go srv.Serve(ln)
|
||||
t.Cleanup(func() { srv.Close(); ln.Close() })
|
||||
|
||||
// Good upstream
|
||||
goodSrv := &http.Server{
|
||||
Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Write([]byte("ok"))
|
||||
}),
|
||||
}
|
||||
goodLn, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to listen: %v", err)
|
||||
}
|
||||
go goodSrv.Serve(goodLn)
|
||||
t.Cleanup(func() { goodSrv.Close(); goodLn.Close() })
|
||||
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(fmt.Sprintf(`
|
||||
{
|
||||
skip_install_trust
|
||||
admin localhost:2999
|
||||
http_port 9080
|
||||
https_port 9443
|
||||
grace_period 1ns
|
||||
}
|
||||
http://localhost:9080 {
|
||||
reverse_proxy %s %s {
|
||||
lb_policy round_robin
|
||||
lb_retries 1
|
||||
lb_retry_match {
|
||||
expression `+"`path('/retry*') && {rp.status_code} in [502, 503]`"+`
|
||||
}
|
||||
}
|
||||
}
|
||||
`, goodLn.Addr().String(), ln.Addr().String()), "caddyfile")
|
||||
|
||||
// /retry path matches the expression - should retry to good upstream
|
||||
tester.AssertGetResponse("http://localhost:9080/retry", 200, "ok")
|
||||
|
||||
// /other path does NOT match - should return the 502
|
||||
req, _ := http.NewRequest(http.MethodGet, "http://localhost:9080/other", nil)
|
||||
tester.AssertResponse(req, 502, "")
|
||||
}
|
||||
|
||||
// TestReverseProxyRetryMatchIsTransportError verifies that the
|
||||
// {rp.is_transport_error} == true CEL function correctly identifies transport errors
|
||||
// and allows retrying them alongside response-based matching
|
||||
func TestReverseProxyRetryMatchIsTransportError(t *testing.T) {
|
||||
// Good upstream: returns 200
|
||||
goodSrv := &http.Server{
|
||||
Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Write([]byte("ok"))
|
||||
}),
|
||||
}
|
||||
goodLn, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to listen: %v", err)
|
||||
}
|
||||
go goodSrv.Serve(goodLn)
|
||||
t.Cleanup(func() { goodSrv.Close(); goodLn.Close() })
|
||||
|
||||
// Broken upstream: accepts connections but closes immediately
|
||||
brokenLn, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("failed to listen: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { brokenLn.Close() })
|
||||
go func() {
|
||||
for {
|
||||
conn, err := brokenLn.Accept()
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
conn.Close()
|
||||
}
|
||||
}()
|
||||
|
||||
tester := caddytest.NewTester(t)
|
||||
tester.InitServer(fmt.Sprintf(`
|
||||
{
|
||||
skip_install_trust
|
||||
admin localhost:2999
|
||||
http_port 9080
|
||||
https_port 9443
|
||||
grace_period 1ns
|
||||
}
|
||||
http://localhost:9080 {
|
||||
reverse_proxy %s %s {
|
||||
lb_policy round_robin
|
||||
lb_retries 1
|
||||
lb_retry_match {
|
||||
expression `+"`{rp.is_transport_error} || {rp.status_code} in [502, 503]`"+`
|
||||
}
|
||||
}
|
||||
}
|
||||
`, goodLn.Addr().String(), brokenLn.Addr().String()), "caddyfile")
|
||||
|
||||
// Transport error on broken upstream should be retried to good upstream
|
||||
tester.AssertGetResponse("http://localhost:9080/", 200, "ok")
|
||||
}
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
# Used by import_block_snippet_non_replaced_block_from_separate_file.caddyfiletest
|
||||
|
||||
(snippet) {
|
||||
header {
|
||||
reverse_proxy localhost:3000
|
||||
{block}
|
||||
}
|
||||
}
|
||||
|
||||
# This snippet being unused by the test Caddyfile is intentional.
|
||||
# This is to test that a panic runtime error triggered by an out-of-range slice index access
|
||||
# will not happen again, please see issue #7518 and pull request #7543 for more information
|
||||
(unused_snippet) {
|
||||
header SomeHeader SomeValue
|
||||
}
|
||||
@@ -1,7 +0,0 @@
|
||||
# Used by import_block_snippet_invalid_subdirective.caddyfiletest
|
||||
|
||||
(test) {
|
||||
reverse_proxy {
|
||||
{block}
|
||||
}
|
||||
}
|
||||
+4
-14
@@ -9,14 +9,9 @@ import (
|
||||
)
|
||||
|
||||
var defaultFactory = newRootCommandFactory(func() *cobra.Command {
|
||||
bin := caddy.CustomBinaryName
|
||||
if bin == "" {
|
||||
bin = "caddy"
|
||||
}
|
||||
|
||||
long := caddy.CustomLongDescription
|
||||
if long == "" {
|
||||
long = `Caddy is an extensible server platform written in Go.
|
||||
return &cobra.Command{
|
||||
Use: "caddy",
|
||||
Long: `Caddy is an extensible server platform written in Go.
|
||||
|
||||
At its core, Caddy merely manages configuration. Modules are plugged
|
||||
in statically at compile-time to provide useful functionality. Caddy's
|
||||
@@ -96,12 +91,7 @@ package installers: https://caddyserver.com/docs/install
|
||||
|
||||
Instructions for running Caddy in production are also available:
|
||||
https://caddyserver.com/docs/running
|
||||
`
|
||||
}
|
||||
|
||||
return &cobra.Command{
|
||||
Use: bin,
|
||||
Long: long,
|
||||
`,
|
||||
Example: ` $ caddy run
|
||||
$ caddy run --config caddy.json
|
||||
$ caddy reload --config caddy.json
|
||||
|
||||
+4
-4
@@ -74,7 +74,7 @@ func cmdStart(fl Flags) (int, error) {
|
||||
// ensure it's the process we're expecting - we can be
|
||||
// sure by giving it some random bytes and having it echo
|
||||
// them back to us)
|
||||
cmd := exec.Command(os.Args[0], "run", "--pingback", ln.Addr().String()) //nolint:gosec // no command injection that I can determine...
|
||||
cmd := exec.Command(os.Args[0], "run", "--pingback", ln.Addr().String())
|
||||
// we should be able to run caddy in relative paths
|
||||
if errors.Is(cmd.Err, exec.ErrDot) {
|
||||
cmd.Err = nil
|
||||
@@ -372,7 +372,7 @@ func cmdReload(fl Flags) (int, error) {
|
||||
return caddy.ExitCodeFailedStartup, fmt.Errorf("no config file to load")
|
||||
}
|
||||
|
||||
adminAddr, err := DetermineAdminAPIAddress(addressFlag, config, configFile, configAdapterFlag)
|
||||
adminAddr, err := DetermineAdminAPIAddress(addressFlag, config, configFlag, configAdapterFlag)
|
||||
if err != nil {
|
||||
return caddy.ExitCodeFailedStartup, fmt.Errorf("couldn't determine admin API address: %v", err)
|
||||
}
|
||||
@@ -697,7 +697,7 @@ func cmdFmt(fl Flags) (int, error) {
|
||||
output := caddyfile.Format(input)
|
||||
|
||||
if fl.Bool("overwrite") {
|
||||
if err := os.WriteFile(configFile, output, 0o600); err != nil { //nolint:gosec // path traversal is not really a thing here, this is either "Caddyfile" or admin-controlled
|
||||
if err := os.WriteFile(configFile, output, 0o600); err != nil {
|
||||
return caddy.ExitCodeFailedStartup, fmt.Errorf("overwriting formatted file: %v", err)
|
||||
}
|
||||
return caddy.ExitCodeSuccess, nil
|
||||
@@ -820,7 +820,7 @@ func AdminAPIRequest(adminAddr, method, uri string, headers http.Header, body io
|
||||
},
|
||||
}
|
||||
|
||||
resp, err := client.Do(req) //nolint:gosec // the only SSRF here would be self-sabatoge I think
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("performing request: %v", err)
|
||||
}
|
||||
|
||||
+1
-7
@@ -484,13 +484,7 @@ func setResourceLimits(logger *zap.Logger) func() {
|
||||
// See https://pkg.go.dev/runtime/debug#SetMemoryLimit
|
||||
_, _ = memlimit.SetGoMemLimitWithOpts(
|
||||
memlimit.WithLogger(
|
||||
slog.New(zapslog.NewHandler(
|
||||
logger.Core(),
|
||||
zapslog.WithName("memlimit"),
|
||||
// the default enables traces at ERROR level, this disables
|
||||
// them by setting it to a level higher than any other level
|
||||
zapslog.AddStacktraceAt(slog.Level(127)),
|
||||
)),
|
||||
slog.New(zapslog.NewHandler(logger.Core())),
|
||||
),
|
||||
memlimit.WithProvider(
|
||||
memlimit.ApplyFallback(
|
||||
|
||||
@@ -234,7 +234,7 @@ func getModules() (standard, nonstandard, unknown []moduleInfo, err error) {
|
||||
// not sure why), and since New() should return a pointer
|
||||
// value, we need to dereference it first
|
||||
iface := any(modInfo.New())
|
||||
if rv := reflect.ValueOf(iface); rv.Kind() == reflect.Pointer {
|
||||
if rv := reflect.ValueOf(iface); rv.Kind() == reflect.Ptr {
|
||||
iface = reflect.New(reflect.TypeOf(iface).Elem()).Elem().Interface()
|
||||
}
|
||||
modPkgPath := reflect.TypeOf(iface).PkgPath()
|
||||
|
||||
+7
-19
@@ -63,17 +63,10 @@ type Context struct {
|
||||
// modules which are loaded will be properly unloaded.
|
||||
// See standard library context package's documentation.
|
||||
func NewContext(ctx Context) (Context, context.CancelFunc) {
|
||||
newCtx, cancelCause := NewContextWithCause(ctx)
|
||||
return newCtx, func() { cancelCause(nil) }
|
||||
}
|
||||
|
||||
// NewContextWithCause is like NewContext but returns a context.CancelCauseFunc.
|
||||
// EXPERIMENTAL: This API is subject to change.
|
||||
func NewContextWithCause(ctx Context) (Context, context.CancelCauseFunc) {
|
||||
newCtx := Context{moduleInstances: make(map[string][]Module), cfg: ctx.cfg, metricsRegistry: prometheus.NewPedanticRegistry()}
|
||||
c, cancel := context.WithCancelCause(ctx.Context)
|
||||
wrappedCancel := func(cause error) {
|
||||
cancel(cause)
|
||||
c, cancel := context.WithCancel(ctx.Context)
|
||||
wrappedCancel := func() {
|
||||
cancel()
|
||||
|
||||
for _, f := range ctx.cleanupFuncs {
|
||||
f()
|
||||
@@ -378,7 +371,7 @@ func (ctx Context) LoadModuleByID(id string, rawMsg json.RawMessage) (any, error
|
||||
// value must be a pointer for unmarshaling into concrete type, even if
|
||||
// the module's concrete type is a slice or map; New() *should* return
|
||||
// a pointer, otherwise unmarshaling errors or panics will occur
|
||||
if rv := reflect.ValueOf(val); rv.Kind() != reflect.Pointer {
|
||||
if rv := reflect.ValueOf(val); rv.Kind() != reflect.Ptr {
|
||||
log.Printf("[WARNING] ModuleInfo.New() for module '%s' did not return a pointer,"+
|
||||
" so we are using reflection to make a pointer instead; please fix this by"+
|
||||
" using new(Type) or &Type notation in your module's New() function.", id)
|
||||
@@ -615,11 +608,6 @@ func (ctx Context) Slogger() *slog.Logger {
|
||||
core zapcore.Core
|
||||
moduleID string
|
||||
)
|
||||
|
||||
// the default enables traces at ERROR level, this disables
|
||||
// them by setting it to a level higher than any other level
|
||||
tracesOpt := zapslog.AddStacktraceAt(slog.Level(127))
|
||||
|
||||
if ctx.cfg == nil {
|
||||
// often the case in tests; just use a dev logger
|
||||
l, err := zap.NewDevelopment()
|
||||
@@ -628,16 +616,16 @@ func (ctx Context) Slogger() *slog.Logger {
|
||||
}
|
||||
|
||||
core = l.Core()
|
||||
handler = zapslog.NewHandler(core, tracesOpt)
|
||||
handler = zapslog.NewHandler(core)
|
||||
} else {
|
||||
mod := ctx.Module()
|
||||
if mod == nil {
|
||||
core = Log().Core()
|
||||
handler = zapslog.NewHandler(core, tracesOpt)
|
||||
handler = zapslog.NewHandler(core)
|
||||
} else {
|
||||
moduleID = string(mod.CaddyModule().ID)
|
||||
core = ctx.cfg.Logging.Logger(mod).Core()
|
||||
handler = zapslog.NewHandler(core, zapslog.WithName(moduleID), tracesOpt)
|
||||
handler = zapslog.NewHandler(core, zapslog.WithName(moduleID))
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,79 +1,76 @@
|
||||
module github.com/caddyserver/caddy/v2
|
||||
|
||||
go 1.25.0
|
||||
go 1.25
|
||||
|
||||
require (
|
||||
github.com/BurntSushi/toml v1.6.0
|
||||
github.com/DeRuina/timberjack v1.4.2
|
||||
github.com/DeRuina/timberjack v1.3.9
|
||||
github.com/KimMachineGun/automemlimit v0.7.5
|
||||
github.com/Masterminds/sprig/v3 v3.3.0
|
||||
github.com/alecthomas/chroma/v2 v2.23.1
|
||||
github.com/alecthomas/chroma/v2 v2.21.1
|
||||
github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b
|
||||
github.com/caddyserver/certmagic v0.25.3
|
||||
github.com/caddyserver/zerossl v0.1.5
|
||||
github.com/cloudflare/circl v1.6.3
|
||||
github.com/caddyserver/certmagic v0.25.1
|
||||
github.com/caddyserver/zerossl v0.1.4
|
||||
github.com/cloudflare/circl v1.6.2
|
||||
github.com/dustin/go-humanize v1.0.1
|
||||
github.com/go-chi/chi/v5 v5.2.5
|
||||
github.com/google/cel-go v0.28.0
|
||||
github.com/go-chi/chi/v5 v5.2.3
|
||||
github.com/google/cel-go v0.26.1
|
||||
github.com/google/uuid v1.6.0
|
||||
github.com/klauspost/compress v1.18.5
|
||||
github.com/klauspost/compress v1.18.2
|
||||
github.com/klauspost/cpuid/v2 v2.3.0
|
||||
github.com/mholt/acmez/v3 v3.1.6
|
||||
github.com/mholt/acmez/v3 v3.1.4
|
||||
github.com/prometheus/client_golang v1.23.2
|
||||
github.com/quic-go/quic-go v0.59.1
|
||||
github.com/smallstep/certificates v0.30.2
|
||||
github.com/smallstep/nosql v0.8.0
|
||||
github.com/quic-go/quic-go v0.59.0
|
||||
github.com/smallstep/certificates v0.29.0
|
||||
github.com/smallstep/nosql v0.7.0
|
||||
github.com/smallstep/truststore v0.13.0
|
||||
github.com/spf13/cobra v1.10.2
|
||||
github.com/spf13/pflag v1.0.10
|
||||
github.com/stretchr/testify v1.11.1
|
||||
github.com/tailscale/tscert v0.0.0-20251216020129-aea342f6d747
|
||||
github.com/yuin/goldmark v1.8.2
|
||||
github.com/yuin/goldmark v1.7.15
|
||||
github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
|
||||
go.opentelemetry.io/contrib/bridges/prometheus v0.68.0
|
||||
go.opentelemetry.io/contrib/exporters/autoexport v0.65.0
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0
|
||||
go.opentelemetry.io/contrib/propagators/autoprop v0.65.0
|
||||
go.opentelemetry.io/otel v1.43.0
|
||||
go.opentelemetry.io/otel/sdk v1.43.0
|
||||
go.opentelemetry.io/otel/sdk/metric v1.43.0
|
||||
go.step.sm/crypto v0.77.1
|
||||
go.opentelemetry.io/contrib/exporters/autoexport v0.64.0
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0
|
||||
go.opentelemetry.io/contrib/propagators/autoprop v0.64.0
|
||||
go.opentelemetry.io/otel v1.39.0
|
||||
go.opentelemetry.io/otel/sdk v1.39.0
|
||||
go.step.sm/crypto v0.75.0
|
||||
go.uber.org/automaxprocs v1.6.0
|
||||
go.uber.org/zap v1.27.1
|
||||
go.uber.org/zap/exp v0.3.0
|
||||
golang.org/x/crypto v0.50.0
|
||||
golang.org/x/crypto/x509roots/fallback v0.0.0-20260213171211-a408498e5541
|
||||
golang.org/x/net v0.53.0
|
||||
golang.org/x/sync v0.20.0
|
||||
golang.org/x/term v0.42.0
|
||||
golang.org/x/time v0.15.0
|
||||
golang.org/x/crypto v0.46.0
|
||||
golang.org/x/crypto/x509roots/fallback v0.0.0-20250927194341-2beaa59a3c99
|
||||
golang.org/x/net v0.48.0
|
||||
golang.org/x/sync v0.19.0
|
||||
golang.org/x/term v0.38.0
|
||||
golang.org/x/time v0.14.0
|
||||
gopkg.in/yaml.v3 v3.0.1
|
||||
)
|
||||
|
||||
require (
|
||||
cel.dev/expr v0.25.1 // indirect
|
||||
cloud.google.com/go/auth v0.18.2 // indirect
|
||||
cel.dev/expr v0.24.0 // indirect
|
||||
cloud.google.com/go/auth v0.17.0 // indirect
|
||||
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
|
||||
cloud.google.com/go/compute/metadata v0.9.0 // indirect
|
||||
dario.cat/mergo v1.0.2 // indirect
|
||||
filippo.io/bigmod v0.1.0 // indirect
|
||||
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
|
||||
dario.cat/mergo v1.0.1 // indirect
|
||||
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
|
||||
github.com/ccoveille/go-safecast/v2 v2.0.0 // indirect
|
||||
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
||||
github.com/coreos/go-oidc/v3 v3.17.0 // indirect
|
||||
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
|
||||
github.com/go-jose/go-jose/v3 v3.0.5 // indirect
|
||||
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
|
||||
github.com/go-jose/go-jose/v3 v3.0.4 // indirect
|
||||
github.com/go-jose/go-jose/v4 v4.1.3 // indirect
|
||||
github.com/google/certificate-transparency-go v1.1.8-0.20240110162603-74a5dd331745 // indirect
|
||||
github.com/google/go-tpm v0.9.8 // indirect
|
||||
github.com/google/go-tpm v0.9.7 // indirect
|
||||
github.com/google/go-tspi v0.3.0 // indirect
|
||||
github.com/google/s2a-go v0.1.9 // indirect
|
||||
github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
|
||||
github.com/googleapis/gax-go/v2 v2.18.0 // indirect
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
|
||||
github.com/jackc/pgx/v5 v5.9.2 // indirect
|
||||
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
||||
github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
|
||||
github.com/googleapis/gax-go/v2 v2.15.0 // indirect
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
|
||||
github.com/jackc/pgx/v5 v5.6.0 // indirect
|
||||
github.com/jackc/puddle/v2 v2.2.1 // indirect
|
||||
github.com/kylelemons/godebug v1.1.0 // indirect
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
||||
github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
|
||||
@@ -89,37 +86,39 @@ require (
|
||||
github.com/x448/float16 v0.8.4 // indirect
|
||||
github.com/zeebo/blake3 v0.2.4 // indirect
|
||||
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
||||
go.opentelemetry.io/contrib/propagators/aws v1.43.0 // indirect
|
||||
go.opentelemetry.io/contrib/propagators/b3 v1.43.0 // indirect
|
||||
go.opentelemetry.io/contrib/propagators/jaeger v1.43.0 // indirect
|
||||
go.opentelemetry.io/contrib/propagators/ot v1.43.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/prometheus v0.65.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 // indirect
|
||||
go.opentelemetry.io/otel/log v0.19.0 // indirect
|
||||
go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect
|
||||
go.yaml.in/yaml/v2 v2.4.4 // indirect
|
||||
go.opentelemetry.io/contrib/bridges/prometheus v0.64.0 // indirect
|
||||
go.opentelemetry.io/contrib/propagators/aws v1.39.0 // indirect
|
||||
go.opentelemetry.io/contrib/propagators/b3 v1.39.0 // indirect
|
||||
go.opentelemetry.io/contrib/propagators/jaeger v1.39.0 // indirect
|
||||
go.opentelemetry.io/contrib/propagators/ot v1.39.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.15.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.15.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.39.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.39.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/prometheus v0.61.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.15.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.39.0 // indirect
|
||||
go.opentelemetry.io/otel/log v0.15.0 // indirect
|
||||
go.opentelemetry.io/otel/sdk/log v0.15.0 // indirect
|
||||
go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect
|
||||
go.yaml.in/yaml/v2 v2.4.3 // indirect
|
||||
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
||||
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
|
||||
golang.org/x/oauth2 v0.36.0 // indirect
|
||||
google.golang.org/api v0.271.0 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
|
||||
golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 // indirect
|
||||
golang.org/x/oauth2 v0.33.0 // indirect
|
||||
google.golang.org/api v0.256.0 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
|
||||
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
|
||||
)
|
||||
|
||||
require (
|
||||
filippo.io/edwards25519 v1.2.0 // indirect
|
||||
filippo.io/edwards25519 v1.1.0 // indirect
|
||||
github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 // indirect
|
||||
github.com/Masterminds/goutils v1.1.1 // indirect
|
||||
github.com/Masterminds/semver/v3 v3.4.0 // indirect
|
||||
github.com/Masterminds/semver/v3 v3.3.1 // indirect
|
||||
github.com/beorn7/perks v1.0.1 // indirect
|
||||
github.com/cespare/xxhash v1.1.0 // indirect
|
||||
github.com/cespare/xxhash/v2 v2.3.0
|
||||
@@ -133,46 +132,47 @@ require (
|
||||
github.com/felixge/httpsnoop v1.0.4 // indirect
|
||||
github.com/go-logr/logr v1.4.3 // indirect
|
||||
github.com/go-logr/stdr v1.2.2 // indirect
|
||||
github.com/go-sql-driver/mysql v1.9.3 // indirect
|
||||
github.com/go-sql-driver/mysql v1.8.1 // indirect
|
||||
github.com/golang/protobuf v1.5.4 // indirect
|
||||
github.com/golang/snappy v0.0.4 // indirect
|
||||
github.com/huandu/xstrings v1.5.0 // indirect
|
||||
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
||||
github.com/jackc/pgpassfile v1.0.0 // indirect
|
||||
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
||||
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
|
||||
github.com/libdns/libdns v1.1.1
|
||||
github.com/manifoldco/promptui v0.9.0 // indirect
|
||||
github.com/mattn/go-colorable v0.1.14 // indirect
|
||||
github.com/mattn/go-isatty v0.0.20 // indirect
|
||||
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
|
||||
github.com/miekg/dns v1.1.72 // indirect
|
||||
github.com/miekg/dns v1.1.69 // indirect
|
||||
github.com/mitchellh/copystructure v1.2.0 // indirect
|
||||
github.com/mitchellh/go-ps v1.0.0 // indirect
|
||||
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
||||
github.com/pires/go-proxyproto v0.11.0
|
||||
github.com/pires/go-proxyproto v0.8.1
|
||||
github.com/pkg/errors v0.9.1 // indirect
|
||||
github.com/prometheus/client_model v0.6.2
|
||||
github.com/prometheus/common v0.67.5 // indirect
|
||||
github.com/prometheus/procfs v0.20.1 // indirect
|
||||
github.com/prometheus/common v0.67.4 // indirect
|
||||
github.com/prometheus/procfs v0.19.2 // indirect
|
||||
github.com/rs/xid v1.6.0 // indirect
|
||||
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
||||
github.com/shopspring/decimal v1.4.0 // indirect
|
||||
github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
|
||||
github.com/sirupsen/logrus v1.9.4 // indirect
|
||||
github.com/slackhq/nebula v1.10.3 // indirect
|
||||
github.com/sirupsen/logrus v1.9.3 // indirect
|
||||
github.com/slackhq/nebula v1.9.7 // indirect
|
||||
github.com/spf13/cast v1.7.0 // indirect
|
||||
github.com/stoewer/go-strcase v1.2.0 // indirect
|
||||
github.com/urfave/cli v1.22.17 // indirect
|
||||
go.etcd.io/bbolt v1.4.3 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
|
||||
go.opentelemetry.io/otel/metric v1.43.0 // indirect
|
||||
go.opentelemetry.io/otel/trace v1.43.0
|
||||
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
|
||||
go.etcd.io/bbolt v1.3.10 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0 // indirect
|
||||
go.opentelemetry.io/otel/metric v1.39.0 // indirect
|
||||
go.opentelemetry.io/otel/trace v1.39.0
|
||||
go.opentelemetry.io/proto/otlp v1.9.0 // indirect
|
||||
go.uber.org/multierr v1.11.0 // indirect
|
||||
golang.org/x/mod v0.35.0 // indirect
|
||||
golang.org/x/sys v0.43.0
|
||||
golang.org/x/text v0.36.0 // indirect
|
||||
golang.org/x/tools v0.44.0 // indirect
|
||||
google.golang.org/grpc v1.80.0 // indirect
|
||||
google.golang.org/protobuf v1.36.11 // indirect
|
||||
golang.org/x/mod v0.30.0 // indirect
|
||||
golang.org/x/sys v0.39.0
|
||||
golang.org/x/text v0.32.0 // indirect
|
||||
golang.org/x/tools v0.39.0 // indirect
|
||||
google.golang.org/grpc v1.77.0 // indirect
|
||||
google.golang.org/protobuf v1.36.10 // indirect
|
||||
howett.net/plist v1.0.0 // indirect
|
||||
)
|
||||
|
||||
@@ -1,41 +1,37 @@
|
||||
cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
|
||||
cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
|
||||
cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
|
||||
cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
|
||||
cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
|
||||
cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
|
||||
cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
|
||||
cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
|
||||
cloud.google.com/go v0.121.6 h1:waZiuajrI28iAf40cWgycWNgaXPO06dupuS+sgibK6c=
|
||||
cloud.google.com/go v0.121.6/go.mod h1:coChdst4Ea5vUpiALcYKXEpR1S9ZgXbhEzzMcMR66vI=
|
||||
cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4=
|
||||
cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ=
|
||||
cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
|
||||
cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
|
||||
cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
|
||||
cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
|
||||
cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=
|
||||
cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU=
|
||||
cloud.google.com/go/kms v1.26.0 h1:cK9mN2cf+9V63D3H1f6koxTatWy39aTI/hCjz1I+adU=
|
||||
cloud.google.com/go/kms v1.26.0/go.mod h1:pHKOdFJm63hxBsiPkYtowZPltu9dW0MWvBa6IA4HM58=
|
||||
cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8=
|
||||
cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
|
||||
code.pfad.fr/check v1.1.0 h1:GWvjdzhSEgHvEHe2uJujDcpmZoySKuHQNrZMfzfO0bE=
|
||||
code.pfad.fr/check v1.1.0/go.mod h1:NiUH13DtYsb7xp5wll0U4SXx7KhXQVCtRgdC96IPfoM=
|
||||
dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
|
||||
dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
|
||||
filippo.io/bigmod v0.1.0 h1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=
|
||||
filippo.io/bigmod v0.1.0/go.mod h1:OjOXDNlClLblvXdwgFFOQFJEocLhhtai8vGLy0JCZlI=
|
||||
filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
|
||||
filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
|
||||
cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8=
|
||||
cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE=
|
||||
cloud.google.com/go/kms v1.23.2 h1:4IYDQL5hG4L+HzJBhzejUySoUOheh3Lk5YT4PCyyW6k=
|
||||
cloud.google.com/go/kms v1.23.2/go.mod h1:rZ5kK0I7Kn9W4erhYVoIRPtpizjunlrfU4fUkumUp8g=
|
||||
cloud.google.com/go/longrunning v0.7.0 h1:FV0+SYF1RIj59gyoWDRi45GiYUMM3K1qO51qoboQT1E=
|
||||
cloud.google.com/go/longrunning v0.7.0/go.mod h1:ySn2yXmjbK9Ba0zsQqunhDkYi0+9rlXIwnoAf+h+TPY=
|
||||
dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
|
||||
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
|
||||
filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
|
||||
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
|
||||
github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 h1:cTp8I5+VIoKjsnZuH8vjyaysT/ses3EvZeaV/1UkF2M=
|
||||
github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96/go.mod h1:bOvUY6CB00SOBii9/FifXqc0awNKxLFCL/+pkDPuyl8=
|
||||
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
|
||||
github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
|
||||
github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
|
||||
github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
|
||||
github.com/DeRuina/timberjack v1.4.2 h1:4bKlzhKdsR+2oNkgef9mqb4n11ICow8VK88RfzJPzN8=
|
||||
github.com/DeRuina/timberjack v1.4.2/go.mod h1:RLoeQrwrCGIEF8gO5nV5b/gMD0QIy7bzQhBUgpp1EqE=
|
||||
github.com/DeRuina/timberjack v1.3.9 h1:6UXZ1I7ExPGTX/1UNYawR58LlOJUHKBPiYC7WQ91eBo=
|
||||
github.com/DeRuina/timberjack v1.3.9/go.mod h1:RLoeQrwrCGIEF8gO5nV5b/gMD0QIy7bzQhBUgpp1EqE=
|
||||
github.com/KimMachineGun/automemlimit v0.7.5 h1:RkbaC0MwhjL1ZuBKunGDjE/ggwAX43DwZrJqVwyveTk=
|
||||
github.com/KimMachineGun/automemlimit v0.7.5/go.mod h1:QZxpHaGOQoYvFhv/r4u3U0JTC2ZcOwbSr11UZF46UBM=
|
||||
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
|
||||
github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
|
||||
github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
|
||||
github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
|
||||
github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
|
||||
github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
|
||||
github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
|
||||
github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
|
||||
github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
|
||||
@@ -43,52 +39,52 @@ github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAE
|
||||
github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
|
||||
github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
|
||||
github.com/alecthomas/chroma/v2 v2.2.0/go.mod h1:vf4zrexSH54oEjJ7EdB65tGNHmH3pGZmVkgTP5RHvAs=
|
||||
github.com/alecthomas/chroma/v2 v2.23.1 h1:nv2AVZdTyClGbVQkIzlDm/rnhk1E9bU9nXwmZ/Vk/iY=
|
||||
github.com/alecthomas/chroma/v2 v2.23.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
|
||||
github.com/alecthomas/chroma/v2 v2.21.1 h1:FaSDrp6N+3pphkNKU6HPCiYLgm8dbe5UXIXcoBhZSWA=
|
||||
github.com/alecthomas/chroma/v2 v2.21.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
|
||||
github.com/alecthomas/repr v0.0.0-20220113201626-b1b626ac65ae/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
|
||||
github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
|
||||
github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
|
||||
github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
|
||||
github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
|
||||
github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
|
||||
github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
|
||||
github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
|
||||
github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b h1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=
|
||||
github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b/go.mod h1:DAHtR1m6lCRdSC2Tm3DSWRPvIPr6xNKyeHdqDQSQT+A=
|
||||
github.com/aws/aws-sdk-go-v2 v1.41.4 h1:10f50G7WyU02T56ox1wWXq+zTX9I1zxG46HYuG1hH/k=
|
||||
github.com/aws/aws-sdk-go-v2 v1.41.4/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
|
||||
github.com/aws/aws-sdk-go-v2/config v1.32.12 h1:O3csC7HUGn2895eNrLytOJQdoL2xyJy0iYXhoZ1OmP0=
|
||||
github.com/aws/aws-sdk-go-v2/config v1.32.12/go.mod h1:96zTvoOFR4FURjI+/5wY1vc1ABceROO4lWgWJuxgy0g=
|
||||
github.com/aws/aws-sdk-go-v2/credentials v1.19.12 h1:oqtA6v+y5fZg//tcTWahyN9PEn5eDU/Wpvc2+kJ4aY8=
|
||||
github.com/aws/aws-sdk-go-v2/credentials v1.19.12/go.mod h1:U3R1RtSHx6NB0DvEQFGyf/0sbrpJrluENHdPy1j/3TE=
|
||||
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 h1:zOgq3uezl5nznfoK3ODuqbhVg1JzAGDUhXOsU0IDCAo=
|
||||
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20/go.mod h1:z/MVwUARehy6GAg/yQ1GO2IMl0k++cu1ohP9zo887wE=
|
||||
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 h1:CNXO7mvgThFGqOFgbNAP2nol2qAWBOGfqR/7tQlvLmc=
|
||||
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20/go.mod h1:oydPDJKcfMhgfcgBUZaG+toBbwy8yPWubJXBVERtI4o=
|
||||
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 h1:tN6W/hg+pkM+tf9XDkWUbDEjGLb+raoBMFsTodcoYKw=
|
||||
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20/go.mod h1:YJ898MhD067hSHA6xYCx5ts/jEd8BSOLtQDL3iZsvbc=
|
||||
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
|
||||
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 h1:2HvVAIq+YqgGotK6EkMf+KIEqTISmTYh5zLpYyeTo1Y=
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20/go.mod h1:V4X406Y666khGa8ghKmphma/7C0DAtEQYhkq9z4vpbk=
|
||||
github.com/aws/aws-sdk-go-v2/service/kms v1.50.3 h1:s/zDSG/a/Su9aX+v0Ld9cimUCdkr5FWPmBV8owaEbZY=
|
||||
github.com/aws/aws-sdk-go-v2/service/kms v1.50.3/go.mod h1:/iSgiUor15ZuxFGQSTf3lA2FmKxFsQoc2tADOarQBSw=
|
||||
github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 h1:0GFOLzEbOyZABS3PhYfBIx2rNBACYcKty+XGkTgw1ow=
|
||||
github.com/aws/aws-sdk-go-v2/service/signin v1.0.8/go.mod h1:LXypKvk85AROkKhOG6/YEcHFPoX+prKTowKnVdcaIxE=
|
||||
github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 h1:kiIDLZ005EcKomYYITtfsjn7dtOwHDOFy7IbPXKek2o=
|
||||
github.com/aws/aws-sdk-go-v2/service/sso v1.30.13/go.mod h1:2h/xGEowcW/g38g06g3KpRWDlT+OTfxxI0o1KqayAB8=
|
||||
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 h1:jzKAXIlhZhJbnYwHbvUQZEB8KfgAEuG0dc08Bkda7NU=
|
||||
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17/go.mod h1:Al9fFsXjv4KfbzQHGe6V4NZSZQXecFcvaIF4e70FoRA=
|
||||
github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 h1:Cng+OOwCHmFljXIxpEVXAGMnBia8MSU6Ch5i9PgBkcU=
|
||||
github.com/aws/aws-sdk-go-v2/service/sts v1.41.9/go.mod h1:LrlIndBDdjA/EeXeyNBle+gyCwTlizzW5ycgWnvIxkk=
|
||||
github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
|
||||
github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
|
||||
github.com/aws/aws-sdk-go-v2 v1.40.0 h1:/WMUA0kjhZExjOQN2z3oLALDREea1A7TobfuiBrKlwc=
|
||||
github.com/aws/aws-sdk-go-v2 v1.40.0/go.mod h1:c9pm7VwuW0UPxAEYGyTmyurVcNrbF6Rt/wixFqDhcjE=
|
||||
github.com/aws/aws-sdk-go-v2/config v1.32.1 h1:iODUDLgk3q8/flEC7ymhmxjfoAnBDwEEYEVyKZ9mzjU=
|
||||
github.com/aws/aws-sdk-go-v2/config v1.32.1/go.mod h1:xoAgo17AGrPpJBSLg81W+ikM0cpOZG8ad04T2r+d5P0=
|
||||
github.com/aws/aws-sdk-go-v2/credentials v1.19.1 h1:JeW+EwmtTE0yXFK8SmklrFh/cGTTXsQJumgMZNlbxfM=
|
||||
github.com/aws/aws-sdk-go-v2/credentials v1.19.1/go.mod h1:BOoXiStwTF+fT2XufhO0Efssbi1CNIO/ZXpZu87N0pw=
|
||||
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14 h1:WZVR5DbDgxzA0BJeudId89Kmgy6DIU4ORpxwsVHz0qA=
|
||||
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14/go.mod h1:Dadl9QO0kHgbrH1GRqGiZdYtW5w+IXXaBNCHTIaheM4=
|
||||
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.14 h1:PZHqQACxYb8mYgms4RZbhZG0a7dPW06xOjmaH0EJC/I=
|
||||
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.14/go.mod h1:VymhrMJUWs69D8u0/lZ7jSB6WgaG/NqHi3gX0aYf6U0=
|
||||
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.14 h1:bOS19y6zlJwagBfHxs0ESzr1XCOU2KXJCWcq3E2vfjY=
|
||||
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.14/go.mod h1:1ipeGBMAxZ0xcTm6y6paC2C/J6f6OO7LBODV9afuAyM=
|
||||
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
|
||||
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.3 h1:x2Ibm/Af8Fi+BH+Hsn9TXGdT+hKbDd5XOTZxTMxDk7o=
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.3/go.mod h1:IW1jwyrQgMdhisceG8fQLmQIydcT/jWY21rFhzgaKwo=
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.14 h1:FIouAnCE46kyYqyhs0XEBDFFSREtdnr8HQuLPQPLCrY=
|
||||
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.14/go.mod h1:UTwDc5COa5+guonQU8qBikJo1ZJ4ln2r1MkF7Dqag1E=
|
||||
github.com/aws/aws-sdk-go-v2/service/kms v1.48.0 h1:pQgVxqqNOacqb19+xaoih/wNLil4d8tgi+FxtBi/qQY=
|
||||
github.com/aws/aws-sdk-go-v2/service/kms v1.48.0/go.mod h1:VJcNH6BLr+3VJwinRKdotLOMglHO8mIKlD3ea5c7hbw=
|
||||
github.com/aws/aws-sdk-go-v2/service/signin v1.0.1 h1:BDgIUYGEo5TkayOWv/oBLPphWwNm/A91AebUjAu5L5g=
|
||||
github.com/aws/aws-sdk-go-v2/service/signin v1.0.1/go.mod h1:iS6EPmNeqCsGo+xQmXv0jIMjyYtQfnwg36zl2FwEouk=
|
||||
github.com/aws/aws-sdk-go-v2/service/sso v1.30.4 h1:U//SlnkE1wOQiIImxzdY5PXat4Wq+8rlfVEw4Y7J8as=
|
||||
github.com/aws/aws-sdk-go-v2/service/sso v1.30.4/go.mod h1:av+ArJpoYf3pgyrj6tcehSFW+y9/QvAY8kMooR9bZCw=
|
||||
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.9 h1:LU8S9W/mPDAU9q0FjCLi0TrCheLMGwzbRpvUMwYspcA=
|
||||
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.9/go.mod h1:/j67Z5XBVDx8nZVp9EuFM9/BS5dvBznbqILGuu73hug=
|
||||
github.com/aws/aws-sdk-go-v2/service/sts v1.41.1 h1:GdGmKtG+/Krag7VfyOXV17xjTCz0i9NT+JnqLTOI5nA=
|
||||
github.com/aws/aws-sdk-go-v2/service/sts v1.41.1/go.mod h1:6TxbXoDSgBQ225Qd8Q+MbxUxUh6TtNKwbRt/EPS9xso=
|
||||
github.com/aws/smithy-go v1.23.2 h1:Crv0eatJUQhaManss33hS5r40CG3ZFH+21XSkqMrIUM=
|
||||
github.com/aws/smithy-go v1.23.2/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
|
||||
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
|
||||
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
|
||||
github.com/caddyserver/certmagic v0.25.3 h1:mGf5ba8F7xA4c5jfDZZbK2buY1VEkbnwpMDixaju94A=
|
||||
github.com/caddyserver/certmagic v0.25.3/go.mod h1:YVs43D5+H/Dckt4bTga1KSO/xYfFBfVZainGDywYPAA=
|
||||
github.com/caddyserver/zerossl v0.1.5 h1:dkvOjBAEEtY6LIGAHei7sw2UgqSD6TrWweXpV7lvEvE=
|
||||
github.com/caddyserver/zerossl v0.1.5/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
|
||||
github.com/caddyserver/certmagic v0.25.1 h1:4sIKKbOt5pg6+sL7tEwymE1x2bj6CHr80da1CRRIPbY=
|
||||
github.com/caddyserver/certmagic v0.25.1/go.mod h1:VhyvndxtVton/Fo/wKhRoC46Rbw1fmjvQ3GjHYSQTEY=
|
||||
github.com/caddyserver/zerossl v0.1.4 h1:CVJOE3MZeFisCERZjkxIcsqIH4fnFdlYWnPYeFtBHRw=
|
||||
github.com/caddyserver/zerossl v0.1.4/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
|
||||
github.com/ccoveille/go-safecast/v2 v2.0.0 h1:+5eyITXAUj3wMjad6cRVJKGnC7vDS55zk0INzJagub0=
|
||||
github.com/ccoveille/go-safecast/v2 v2.0.0/go.mod h1:JIYA4CAR33blIDuE6fSwCp2sz1oOBahXnvmdBhOAABs=
|
||||
github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
|
||||
@@ -106,8 +102,8 @@ github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObk
|
||||
github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
|
||||
github.com/chzyer/test v1.0.0 h1:p3BQDXSxOhOG0P9z6/hGnII4LGiEPOYBhs8asl/fC04=
|
||||
github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
|
||||
github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
|
||||
github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
|
||||
github.com/cloudflare/circl v1.6.2 h1:hL7VBpHHKzrV5WTfHCaBsgx/HGbBYlgrwvNXEVDYYsQ=
|
||||
github.com/cloudflare/circl v1.6.2/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
|
||||
github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
|
||||
github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
|
||||
github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
|
||||
@@ -147,19 +143,19 @@ github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z
|
||||
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
|
||||
github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
|
||||
github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
|
||||
github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
|
||||
github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
|
||||
github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
|
||||
github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
|
||||
github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
|
||||
github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-chi/chi/v5 v5.2.3 h1:WQIt9uxdsAbgIYgid+BpYc+liqQZGMHRaUwp0JUcvdE=
|
||||
github.com/go-chi/chi/v5 v5.2.3/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
|
||||
github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
|
||||
github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
|
||||
github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
|
||||
github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
|
||||
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
|
||||
github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
|
||||
github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
|
||||
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
|
||||
github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
|
||||
github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
|
||||
github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
|
||||
github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
|
||||
github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
|
||||
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
|
||||
@@ -168,8 +164,8 @@ github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
|
||||
github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
|
||||
github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
|
||||
github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
|
||||
github.com/google/cel-go v0.28.0 h1:KjSWstCpz/MN5t4a8gnGJNIYUsJRpdi/r97xWDphIQc=
|
||||
github.com/google/cel-go v0.28.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
|
||||
github.com/google/cel-go v0.26.1 h1:iPbVVEdkhTX++hpe3lzSk7D3G3QSYqLGoHOcEio+UXQ=
|
||||
github.com/google/cel-go v0.26.1/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
|
||||
github.com/google/certificate-transparency-go v1.0.21/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
|
||||
github.com/google/certificate-transparency-go v1.1.8-0.20240110162603-74a5dd331745 h1:heyoXNxkRT155x4jTAiSv5BVSVkueifPUm+Q8LUXMRo=
|
||||
github.com/google/certificate-transparency-go v1.1.8-0.20240110162603-74a5dd331745/go.mod h1:zN0wUQgV9LjwLZeFHnrAbQi8hzMVvEWePyk+MhPOk7k=
|
||||
@@ -177,8 +173,8 @@ github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
|
||||
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
|
||||
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
|
||||
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
|
||||
github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
|
||||
github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
|
||||
github.com/google/go-tpm v0.9.7 h1:u89J4tUUeDTlH8xxC3CTW7OHZjbjKoHdQ9W7gCUhtxA=
|
||||
github.com/google/go-tpm v0.9.7/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
|
||||
github.com/google/go-tpm-tools v0.4.7 h1:J3ycC8umYxM9A4eF73EofRZu4BxY0jjQnUnkhIBbvws=
|
||||
github.com/google/go-tpm-tools v0.4.7/go.mod h1:gSyXTZHe3fgbzb6WEGd90QucmsnT1SRdlye82gH8QjQ=
|
||||
github.com/google/go-tspi v0.3.0 h1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=
|
||||
@@ -187,12 +183,12 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
|
||||
github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
|
||||
github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
|
||||
github.com/googleapis/gax-go/v2 v2.18.0 h1:jxP5Uuo3bxm3M6gGtV94P4lliVetoCB4Wk2x8QA86LI=
|
||||
github.com/googleapis/gax-go/v2 v2.18.0/go.mod h1:uSzZN4a356eRG985CzJ3WfbFSpqkLTjsnhWGJR6EwrE=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
|
||||
github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAVrGgAa0f2/R35S4DJwfFaUPFQ=
|
||||
github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
|
||||
github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
|
||||
github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 h1:NmZ1PKzSTQbuGHw9DGPFomqkkLWMC+vZCkfs+FHv1Vg=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3/go.mod h1:zQrxl1YP88HQlA6i9c63DSVPFklWpGX4OWAc9bFuaH4=
|
||||
github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
|
||||
github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
|
||||
github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
|
||||
@@ -203,16 +199,16 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
|
||||
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
|
||||
github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
|
||||
github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
|
||||
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
|
||||
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
|
||||
github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
|
||||
github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
|
||||
github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
|
||||
github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
|
||||
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
|
||||
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
|
||||
github.com/jackc/pgx/v5 v5.6.0 h1:SWJzexBzPL5jb0GEsrPMLIsi/3jOo7RHlzTjcAeDrPY=
|
||||
github.com/jackc/pgx/v5 v5.6.0/go.mod h1:DNZ/vlrUnhWCoFGxHAG8U2ljioxukquj7utPDgtQdTw=
|
||||
github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
|
||||
github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
|
||||
github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
|
||||
github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
|
||||
github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
|
||||
github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
|
||||
github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
|
||||
github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
|
||||
github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
|
||||
github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
|
||||
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
|
||||
@@ -225,10 +221,6 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
|
||||
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
|
||||
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
|
||||
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
|
||||
github.com/letsencrypt/challtestsrv v1.4.2 h1:0ON3ldMhZyWlfVNYYpFuWRTmZNnyfiL9Hh5YzC3JVwU=
|
||||
github.com/letsencrypt/challtestsrv v1.4.2/go.mod h1:GhqMqcSoeGpYd5zX5TgwA6er/1MbWzx/o7yuuVya+Wk=
|
||||
github.com/letsencrypt/pebble/v2 v2.10.0 h1:Wq6gYXlsY6ubqI3hhxsTzdyotvfdjFBxuwYqCLCnj/U=
|
||||
github.com/letsencrypt/pebble/v2 v2.10.0/go.mod h1:Sk8cmUIPcIdv2nINo+9PB4L+ZBhzY+F9A1a/h/xmWiQ=
|
||||
github.com/libdns/libdns v1.1.1 h1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS/P/U=
|
||||
github.com/libdns/libdns v1.1.1/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
|
||||
github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
|
||||
@@ -240,10 +232,10 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
|
||||
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
|
||||
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
|
||||
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
|
||||
github.com/mholt/acmez/v3 v3.1.6 h1:eGVQNObP0pBN4sxqrXeg7MYqTOWyoiYpQqITVWlrevk=
|
||||
github.com/mholt/acmez/v3 v3.1.6/go.mod h1:5nTPosTGosLxF3+LU4ygbgMRFDhbAVpqMI4+a4aHLBY=
|
||||
github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
|
||||
github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
|
||||
github.com/mholt/acmez/v3 v3.1.4 h1:DyzZe/RnAzT3rpZj/2Ii5xZpiEvvYk3cQEN/RmqxwFQ=
|
||||
github.com/mholt/acmez/v3 v3.1.4/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
|
||||
github.com/miekg/dns v1.1.69 h1:Kb7Y/1Jo+SG+a2GtfoFUfDkG//csdRPwRLkCsxDG9Sc=
|
||||
github.com/miekg/dns v1.1.69/go.mod h1:7OyjD9nEba5OkqQ/hB4fy3PIoxafSZJtducccIelz3g=
|
||||
github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
|
||||
github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
|
||||
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
|
||||
@@ -259,8 +251,8 @@ github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58/go.mod h1:DXv8WO4yhM
|
||||
github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
|
||||
github.com/peterbourgon/diskv/v3 v3.0.1 h1:x06SQA46+PKIUftmEujdwSEpIx8kR+M9eLYsUxeYveU=
|
||||
github.com/peterbourgon/diskv/v3 v3.0.1/go.mod h1:kJ5Ny7vLdARGU3WUuy6uzO6T0nb/2gWcT1JiBvRmb5o=
|
||||
github.com/pires/go-proxyproto v0.11.0 h1:gUQpS85X/VJMdUsYyEgyn59uLJvGqPhJV5YvG68wXH4=
|
||||
github.com/pires/go-proxyproto v0.11.0/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
|
||||
github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
|
||||
github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
|
||||
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
|
||||
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
@@ -272,16 +264,16 @@ github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h
|
||||
github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
|
||||
github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
|
||||
github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
|
||||
github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
|
||||
github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
|
||||
github.com/prometheus/common v0.67.4 h1:yR3NqWO1/UyO1w2PhUvXlGQs/PtFmoveVO0KZ4+Lvsc=
|
||||
github.com/prometheus/common v0.67.4/go.mod h1:gP0fq6YjjNCLssJCQp0yk4M8W6ikLURwkdd/YKtTbyI=
|
||||
github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=
|
||||
github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
|
||||
github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
|
||||
github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
|
||||
github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
|
||||
github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
|
||||
github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
|
||||
github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
|
||||
github.com/quic-go/quic-go v0.59.1 h1:0Gmua0HW1Tv7ANR7hUYwRyD0MG5OJfgvYSZasGZzBic=
|
||||
github.com/quic-go/quic-go v0.59.1/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
|
||||
github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
|
||||
github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
|
||||
github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
|
||||
github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
|
||||
github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
|
||||
@@ -295,22 +287,22 @@ github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp
|
||||
github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
|
||||
github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
|
||||
github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
|
||||
github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
|
||||
github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
|
||||
github.com/slackhq/nebula v1.10.3 h1:EstYj8ODEcv6T0R9X5BVq1zgWZnyU5gtPzk99QF1PMU=
|
||||
github.com/slackhq/nebula v1.10.3/go.mod h1:IL5TUQm4x9IFx2kCKPYm1gP47pwd5b8QGnnBH2RHnvs=
|
||||
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
|
||||
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
|
||||
github.com/slackhq/nebula v1.9.7 h1:v5u46efIyYHGdfjFnozQbRRhMdaB9Ma1SSTcUcE2lfE=
|
||||
github.com/slackhq/nebula v1.9.7/go.mod h1:1+4q4wd3dDAjO8rKCttSb9JIVbklQhuJiBp5I0lbIsQ=
|
||||
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262 h1:unQFBIznI+VYD1/1fApl1A+9VcBk+9dcqGfnePY87LY=
|
||||
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262/go.mod h1:MyOHs9Po2fbM1LHej6sBUT8ozbxmMOFG+E+rx/GSGuc=
|
||||
github.com/smallstep/certificates v0.30.2 h1:1G3xBi8sJ740iA1mMPW2Svv7EIZKJ4Zf/iQtA5QlN0Y=
|
||||
github.com/smallstep/certificates v0.30.2/go.mod h1:oyaE/aEYUGDr+YiCZLAxxP22bOQqcSHTeDgp8Vv2rlY=
|
||||
github.com/smallstep/certificates v0.29.0 h1:f90szTKYTW62bmCc+qE5doGqIGPVxTQb8Ba37e/K8Zs=
|
||||
github.com/smallstep/certificates v0.29.0/go.mod h1:27WI0od6gu84mvE4mYQ/QZGyYwHXvhsiSRNC+y3t+mo=
|
||||
github.com/smallstep/cli-utils v0.12.2 h1:lGzM9PJrH/qawbzMC/s2SvgLdJPKDWKwKzx9doCVO+k=
|
||||
github.com/smallstep/cli-utils v0.12.2/go.mod h1:uCPqefO29goHLGqFnwk0i8W7XJu18X3WHQFRtOm/00Y=
|
||||
github.com/smallstep/go-attestation v0.4.4-0.20241119153605-2306d5b464ca h1:VX8L0r8vybH0bPeaIxh4NQzafKQiqvlOn8pmOXbFLO4=
|
||||
github.com/smallstep/go-attestation v0.4.4-0.20241119153605-2306d5b464ca/go.mod h1:vNAduivU014fubg6ewygkAvQC0IQVXqdc8vaGl/0er4=
|
||||
github.com/smallstep/linkedca v0.25.0 h1:txT9QHGbCsJq0MhAghBq7qhurGY727tQuqUi+n4BVBo=
|
||||
github.com/smallstep/linkedca v0.25.0/go.mod h1:Q3jVAauFKNlF86W5/RFtgQeyDKz98GL/KN3KG4mJOvc=
|
||||
github.com/smallstep/nosql v0.8.0 h1:FBTCUfKPmWYbrozW+RBKu+fnvbn+zr5rVli/XB4Jp4A=
|
||||
github.com/smallstep/nosql v0.8.0/go.mod h1:5dUpNotHLHhOUapP0PLBVVfp3tG1DFC31VRccg+Cqwo=
|
||||
github.com/smallstep/nosql v0.7.0 h1:YiWC9ZAHcrLCrayfaF+QJUv16I2bZ7KdLC3RpJcnAnE=
|
||||
github.com/smallstep/nosql v0.7.0/go.mod h1:H5VnKMCbeq9QA6SRY5iqPylfxLfYcLwvUff3onQ8+HU=
|
||||
github.com/smallstep/pkcs7 v0.2.1 h1:6Kfzr/QizdIuB6LSv8y1LJdZ3aPSfTNhTLqAx9CTLfA=
|
||||
github.com/smallstep/pkcs7 v0.2.1/go.mod h1:RcXHsMfL+BzH8tRhmrF1NkkpebKpq3JEM66cOFxanf0=
|
||||
github.com/smallstep/scep v0.0.0-20250318231241-a25cabb69492 h1:k23+s51sgYix4Zgbvpmy+1ZgXLjr4ZTkBTqXmpnImwA=
|
||||
@@ -333,6 +325,8 @@ github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An
|
||||
github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
|
||||
github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
|
||||
github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
|
||||
github.com/stoewer/go-strcase v1.2.0 h1:Z2iHWqGXH00XYgqDmNgQbIBxf3wrNq0F3feEy0ainaU=
|
||||
github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
|
||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
|
||||
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
|
||||
@@ -340,6 +334,7 @@ github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/
|
||||
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
|
||||
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
|
||||
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
|
||||
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||
@@ -359,8 +354,8 @@ github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcY
|
||||
github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
|
||||
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
|
||||
github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
|
||||
github.com/yuin/goldmark v1.8.2 h1:kEGpgqJXdgbkhcOgBxkC0X0PmoPG1ZyoZ117rDVp4zE=
|
||||
github.com/yuin/goldmark v1.8.2/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
|
||||
github.com/yuin/goldmark v1.7.15 h1:xYJWgq3Qd8qsaZpj5pHKoEI4mosqVZi/qRpq/MdKyyk=
|
||||
github.com/yuin/goldmark v1.7.15/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
|
||||
github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
|
||||
github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc/go.mod h1:ovIvrum6DQJA4QsJSovrkC4saKHQVs7TvcaeO8AIl5I=
|
||||
github.com/zeebo/assert v1.1.0 h1:hU1L1vLTHsnO8x8c9KAR5GmM5QscxHg5RNU5z5qbUWY=
|
||||
@@ -369,70 +364,70 @@ github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
|
||||
github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
|
||||
github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
|
||||
github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
|
||||
go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
|
||||
go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
|
||||
go.etcd.io/bbolt v1.3.10 h1:+BqfJTcCzTItrop8mq/lbzL8wSGtj94UO/3U31shqG0=
|
||||
go.etcd.io/bbolt v1.3.10/go.mod h1:bK3UQLPJZly7IlNmV7uVHJDxfe5aK9Ll93e/74Y9oEQ=
|
||||
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
|
||||
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
|
||||
go.opentelemetry.io/contrib/bridges/prometheus v0.68.0 h1:w3zlHYETbDwXyWHZlyyR58ZC39XGi8rAhkBgUgJ9d5w=
|
||||
go.opentelemetry.io/contrib/bridges/prometheus v0.68.0/go.mod h1:GR/mClR2nn7vE8RLwxKjoBNg+QtgdDhRzxVa93koy5o=
|
||||
go.opentelemetry.io/contrib/exporters/autoexport v0.65.0 h1:2gApdml7SznX9szEKFjKjM4qGcGSvAybYLBY319XG3g=
|
||||
go.opentelemetry.io/contrib/exporters/autoexport v0.65.0/go.mod h1:0QqAGlbHXhmPYACG3n5hNzO5DnEqqtg4VcK5pr22RI0=
|
||||
go.opentelemetry.io/contrib/bridges/prometheus v0.64.0 h1:7TYhBCu6Xz6vDJGNtEslWZLuuX2IJ/aH50hBY4MVeUg=
|
||||
go.opentelemetry.io/contrib/bridges/prometheus v0.64.0/go.mod h1:tHQctZfAe7e4PBPGyt3kae6mQFXNpj+iiDJa3ithM50=
|
||||
go.opentelemetry.io/contrib/exporters/autoexport v0.64.0 h1:9pzPj3RFyKOxBAMkM2w84LpT+rdHam1XoFA+QhARiRw=
|
||||
go.opentelemetry.io/contrib/exporters/autoexport v0.64.0/go.mod h1:hlVZx1btWH0XTfXpuGX9dsquB50s+tc3fYFOO5elo2M=
|
||||
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
|
||||
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
|
||||
go.opentelemetry.io/contrib/propagators/autoprop v0.65.0 h1:kTaCycF9Xkm8VBBvH0rJ4wFeRjtIV55Erk3uuVsIs5s=
|
||||
go.opentelemetry.io/contrib/propagators/autoprop v0.65.0/go.mod h1:rooPzAbXfxMX9fsPJjmOBg2SN4RhFEV8D7cfGK+N3tE=
|
||||
go.opentelemetry.io/contrib/propagators/aws v1.43.0 h1:EwnsB3cXRLAh7/Nr/9rMuGw73nfb3z6uAvVDjRrbeUg=
|
||||
go.opentelemetry.io/contrib/propagators/aws v1.43.0/go.mod h1:CJjTym6F87tEdm61Qvnz5xrV8vKlH4C92djiqcn62k8=
|
||||
go.opentelemetry.io/contrib/propagators/b3 v1.43.0 h1:CETqV3QLLPTy5yNrqyMr41VnAOOD4lsRved7n4QG00A=
|
||||
go.opentelemetry.io/contrib/propagators/b3 v1.43.0/go.mod h1:Q4mCiCdziYzpNR0g+6UqVotAlCDZdzz6L8jwY4knOrw=
|
||||
go.opentelemetry.io/contrib/propagators/jaeger v1.43.0 h1:peiLMz1+aqJE+3L4mOVtR9wlmv+yh/JVYXCBjqmzJJE=
|
||||
go.opentelemetry.io/contrib/propagators/jaeger v1.43.0/go.mod h1:Agvif+4A8p/3UtZzJ0MCcDEuQwgtrzM71DueU41DCs8=
|
||||
go.opentelemetry.io/contrib/propagators/ot v1.43.0 h1:Hh1HahlGc81AOE7siqi1tVOlbanY/UxMMWedpb0d5oQ=
|
||||
go.opentelemetry.io/contrib/propagators/ot v1.43.0/go.mod h1:58MlyS7lghzYvAm5LN9gGmZpCMQEMB5vpZp9SRgOyE4=
|
||||
go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
|
||||
go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 h1:Dn8rkudDzY6KV9dr/D/bTUuWgqDf9xe0rr4G2elrn0Y=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0/go.mod h1:gMk9F0xDgyN9M/3Ed5Y1wKcx/9mlU91NXY2SNq7RQuU=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 h1:HIBTQ3VO5aupLKjC90JgMqpezVXwFuq6Ryjn0/izoag=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0/go.mod h1:ji9vId85hMxqfvICA0Jt8JqEdrXaAkcpkI9HPXya0ro=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 h1:8UQVDcZxOJLtX6gxtDt3vY2WTgvZqMQRzjsqiIHQdkc=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0/go.mod h1:2lmweYCiHYpEjQ/lSJBYhj9jP1zvCvQW4BqL9dnT7FQ=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
|
||||
go.opentelemetry.io/otel/exporters/prometheus v0.65.0 h1:jOveH/b4lU9HT7y+Gfamf18BqlOuz2PWEvs8yM7Q6XE=
|
||||
go.opentelemetry.io/otel/exporters/prometheus v0.65.0/go.mod h1:i1P8pcumauPtUI4YNopea1dhzEMuEqWP1xoUZDylLHo=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 h1:GJkybS+crDMdExT/BUNCEgfrmfboztcS6PhvSo88HKM=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0/go.mod h1:NuAyxRYIG2lKX3YQkB+83StTxM7s52PUUkRRiC0wnYI=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 h1:TC+BewnDpeiAmcscXbGMfxkO+mwYUwE/VySwvw88PfA=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0/go.mod h1:J/ZyF4vfPwsSr9xJSPyQ4LqtcTPULFR64KwTikGLe+A=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 h1:mS47AX77OtFfKG4vtp+84kuGSFZHTyxtXIN269vChY0=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0/go.mod h1:PJnsC41lAGncJlPUniSwM81gc80GkgWJWr3cu2nKEtU=
|
||||
go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4=
|
||||
go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk=
|
||||
go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
|
||||
go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
|
||||
go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
|
||||
go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
|
||||
go.opentelemetry.io/otel/sdk/log v0.19.0 h1:scYVLqT22D2gqXItnWiocLUKGH9yvkkeql5dBDiXyko=
|
||||
go.opentelemetry.io/otel/sdk/log v0.19.0/go.mod h1:vFBowwXGLlW9AvpuF7bMgnNI95LiW10szrOdvzBHlAg=
|
||||
go.opentelemetry.io/otel/sdk/log/logtest v0.19.0 h1:BEbF7ZBB6qQloV/Ub1+3NQoOUnVtcGkU3XX4Ws3GQfk=
|
||||
go.opentelemetry.io/otel/sdk/log/logtest v0.19.0/go.mod h1:Lua81/3yM0wOmoHTokLj9y9ADeA02v1naRrVrkAZuKk=
|
||||
go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
|
||||
go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
|
||||
go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
|
||||
go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
|
||||
go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
|
||||
go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
|
||||
go.step.sm/crypto v0.77.1 h1:4EEqfKdv0egQ1lqz2RhnU8Jv6QgXZfrgoxWMqJF9aDs=
|
||||
go.step.sm/crypto v0.77.1/go.mod h1:U/SsmEm80mNnfD5WIkbhuW/B1eFp3fgFvdXyDLpU1AQ=
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 h1:ssfIgGNANqpVFCndZvcuyKbl0g+UAVcbBcqGkG28H0Y=
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0/go.mod h1:GQ/474YrbE4Jx8gZ4q5I4hrhUzM6UPzyrqJYV2AqPoQ=
|
||||
go.opentelemetry.io/contrib/propagators/autoprop v0.64.0 h1:VVrb1ErDD0Tlh/0K0rUqjky1e8AekjspTFN9sU2ekaA=
|
||||
go.opentelemetry.io/contrib/propagators/autoprop v0.64.0/go.mod h1:QCsOQk+9Ep8Mkp4/aPtSzUT0dc8SaPYzBAE6o1jYuSE=
|
||||
go.opentelemetry.io/contrib/propagators/aws v1.39.0 h1:IvNR8pAVGpkK1CHMjU/YE6B6TlnAPGFvogkMWRWU6wo=
|
||||
go.opentelemetry.io/contrib/propagators/aws v1.39.0/go.mod h1:TUsFCERuGM4IGhJG9w+9l0nzmHUKHuaDYYNF6mtNgjY=
|
||||
go.opentelemetry.io/contrib/propagators/b3 v1.39.0 h1:PI7pt9pkSnimWcp5sQhUA9OzLbc3Ba4sL+VEUTNsxrk=
|
||||
go.opentelemetry.io/contrib/propagators/b3 v1.39.0/go.mod h1:5gV/EzPnfYIwjzj+6y8tbGW2PKWhcsz5e/7twptRVQY=
|
||||
go.opentelemetry.io/contrib/propagators/jaeger v1.39.0 h1:Gz3yKzfMSEFzF0Vy5eIpu9ndpo4DhXMCxsLMF0OOApo=
|
||||
go.opentelemetry.io/contrib/propagators/jaeger v1.39.0/go.mod h1:2D/cxxCqTlrday0rZrPujjg5aoAdqk1NaNyoXn8FJn8=
|
||||
go.opentelemetry.io/contrib/propagators/ot v1.39.0 h1:vKTve1W/WKPVp1fzJamhCDDECt+5upJJ65bPyWoddGg=
|
||||
go.opentelemetry.io/contrib/propagators/ot v1.39.0/go.mod h1:FH5VB2N19duNzh1Q8ks6CsZFyu3LFhNLiA9lPxyEkvU=
|
||||
go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
|
||||
go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.15.0 h1:W+m0g+/6v3pa5PgVf2xoFMi5YtNR06WtS7ve5pcvLtM=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.15.0/go.mod h1:JM31r0GGZ/GU94mX8hN4D8v6e40aFlUECSQ48HaLgHM=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.15.0 h1:EKpiGphOYq3CYnIe2eX9ftUkyU+Y8Dtte8OaWyHJ4+I=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.15.0/go.mod h1:nWFP7C+T8TygkTjJ7mAyEaFaE7wNfms3nV/vexZ6qt0=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.39.0 h1:cEf8jF6WbuGQWUVcqgyWtTR0kOOAWY1DYZ+UhvdmQPw=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.39.0/go.mod h1:k1lzV5n5U3HkGvTCJHraTAGJ7MqsgL1wrGwTj1Isfiw=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.39.0 h1:nKP4Z2ejtHn3yShBb+2KawiXgpn8In5cT7aO2wXuOTE=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.39.0/go.mod h1:NwjeBbNigsO4Aj9WgM0C+cKIrxsZUaRmZUO7A8I7u8o=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0 h1:f0cb2XPmrqn4XMy9PNliTgRKJgS5WcL/u0/WRYGz4t0=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0/go.mod h1:vnakAaFckOMiMtOIhFI2MNH4FYrZzXCYxmb1LlhoGz8=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 h1:in9O8ESIOlwJAEGTkkf34DesGRAc/Pn8qJ7k3r/42LM=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0/go.mod h1:Rp0EXBm5tfnv0WL+ARyO/PHBEaEAT8UUHQ6AGJcSq6c=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0 h1:Ckwye2FpXkYgiHX7fyVrN1uA/UYd9ounqqTuSNAv0k4=
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0/go.mod h1:teIFJh5pW2y+AN7riv6IBPX2DuesS3HgP39mwOspKwU=
|
||||
go.opentelemetry.io/otel/exporters/prometheus v0.61.0 h1:cCyZS4dr67d30uDyh8etKM2QyDsQ4zC9ds3bdbrVoD0=
|
||||
go.opentelemetry.io/otel/exporters/prometheus v0.61.0/go.mod h1:iivMuj3xpR2DkUrUya3TPS/Z9h3dz7h01GxU+fQBRNg=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.15.0 h1:0BSddrtQqLEylcErkeFrJBmwFzcqfQq9+/uxfTZq+HE=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.15.0/go.mod h1:87sjYuAPzaRCtdd09GU5gM1U9wQLrrcYrm77mh5EBoc=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0 h1:5gn2urDL/FBnK8OkCfD1j3/ER79rUuTYmCvlXBKeYL8=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0/go.mod h1:0fBG6ZJxhqByfFZDwSwpZGzJU671HkwpWaNe2t4VUPI=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.39.0 h1:8UPA4IbVZxpsD76ihGOQiFml99GPAEZLohDXvqHdi6U=
|
||||
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.39.0/go.mod h1:MZ1T/+51uIVKlRzGw1Fo46KEWThjlCBZKl2LzY5nv4g=
|
||||
go.opentelemetry.io/otel/log v0.15.0 h1:0VqVnc3MgyYd7QqNVIldC3dsLFKgazR6P3P3+ypkyDY=
|
||||
go.opentelemetry.io/otel/log v0.15.0/go.mod h1:9c/G1zbyZfgu1HmQD7Qj84QMmwTp2QCQsZH1aeoWDE4=
|
||||
go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
|
||||
go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
|
||||
go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
|
||||
go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
|
||||
go.opentelemetry.io/otel/sdk/log v0.15.0 h1:WgMEHOUt5gjJE93yqfqJOkRflApNif84kxoHWS9VVHE=
|
||||
go.opentelemetry.io/otel/sdk/log v0.15.0/go.mod h1:qDC/FlKQCXfH5hokGsNg9aUBGMJQsrUyeOiW5u+dKBQ=
|
||||
go.opentelemetry.io/otel/sdk/log/logtest v0.14.0 h1:Ijbtz+JKXl8T2MngiwqBlPaHqc4YCaP/i13Qrow6gAM=
|
||||
go.opentelemetry.io/otel/sdk/log/logtest v0.14.0/go.mod h1:dCU8aEL6q+L9cYTqcVOk8rM9Tp8WdnHOPLiBgp0SGOA=
|
||||
go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
|
||||
go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
|
||||
go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
|
||||
go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
|
||||
go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
|
||||
go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
|
||||
go.step.sm/crypto v0.75.0 h1:UAHYD6q6ggYyzLlIKHv1MCUVjZIesXRZpGTlRC/HSHw=
|
||||
go.step.sm/crypto v0.75.0/go.mod h1:wwQ57+ajmDype9mrI/2hRyrvJd7yja5xVgWYqpUN3PE=
|
||||
go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
|
||||
go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
|
||||
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
|
||||
@@ -445,8 +440,8 @@ go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
|
||||
go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
|
||||
go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
|
||||
go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
|
||||
go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
|
||||
go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
|
||||
go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
|
||||
go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
|
||||
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
|
||||
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
|
||||
golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
|
||||
@@ -456,19 +451,19 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
|
||||
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
|
||||
golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
|
||||
golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
|
||||
golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
|
||||
golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
|
||||
golang.org/x/crypto/x509roots/fallback v0.0.0-20260213171211-a408498e5541 h1:FmKxj9ocLKn45jiR2jQMwCVhDvaK7fKQFzfuT9GvyK8=
|
||||
golang.org/x/crypto/x509roots/fallback v0.0.0-20260213171211-a408498e5541/go.mod h1:+UoQFNBq2p2wO+Q6ddVtYc25GZ6VNdOMyyrd4nrqrKs=
|
||||
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
|
||||
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
|
||||
golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
|
||||
golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
|
||||
golang.org/x/crypto/x509roots/fallback v0.0.0-20250927194341-2beaa59a3c99 h1:CH0o4/bZX6KIUCjjgjmtNtfM/kXSkTYlzTOB9vZF45g=
|
||||
golang.org/x/crypto/x509roots/fallback v0.0.0-20250927194341-2beaa59a3c99/go.mod h1:MEIPiCnxvQEjA4astfaKItNwEVZA5Ki+3+nyGbJ5N18=
|
||||
golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 h1:SbTAbRFnd5kjQXbczszQ0hdk3ctwYf3qBNH9jIsGclE=
|
||||
golang.org/x/exp v0.0.0-20250813145105-42675adae3e6/go.mod h1:4QTo5u+SEIbbKW1RacMZq1YEfOBqeXa19JeshGi+zc4=
|
||||
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
|
||||
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
|
||||
golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
|
||||
golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
|
||||
golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
|
||||
golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
|
||||
golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
|
||||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
|
||||
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||
@@ -477,10 +472,10 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
|
||||
golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
|
||||
golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
|
||||
golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
|
||||
golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
|
||||
golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
|
||||
golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
|
||||
golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
|
||||
golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
|
||||
golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
|
||||
golang.org/x/oauth2 v0.33.0 h1:4Q+qn+E5z8gPRJfmRy7C2gGG3T4jIprK6aSYgTXGRpo=
|
||||
golang.org/x/oauth2 v0.33.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
@@ -488,8 +483,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
|
||||
golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
|
||||
golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
|
||||
golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
|
||||
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
|
||||
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
|
||||
golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
|
||||
golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
@@ -498,6 +493,7 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
|
||||
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
@@ -506,8 +502,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
|
||||
golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
|
||||
golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
|
||||
golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
@@ -517,8 +513,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
|
||||
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
|
||||
golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
|
||||
golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
|
||||
golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
|
||||
golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
|
||||
golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
|
||||
golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||
@@ -528,35 +524,35 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
|
||||
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
|
||||
golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
|
||||
golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
|
||||
golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
|
||||
golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
|
||||
golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
|
||||
golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
|
||||
golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
|
||||
golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
|
||||
golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
|
||||
golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
|
||||
golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
|
||||
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
|
||||
golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
|
||||
golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
|
||||
golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
|
||||
golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
|
||||
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
|
||||
google.golang.org/api v0.271.0 h1:cIPN4qcUc61jlh7oXu6pwOQqbJW2GqYh5PS6rB2C/JY=
|
||||
google.golang.org/api v0.271.0/go.mod h1:CGT29bhwkbF+i11qkRUJb2KMKqcJ1hdFceEIRd9u64Q=
|
||||
google.golang.org/genproto v0.0.0-20260217215200-42d3e9bedb6d h1:vsOm753cOAMkt76efriTCDKjpCbK18XGHMJHo0JUKhc=
|
||||
google.golang.org/genproto v0.0.0-20260217215200-42d3e9bedb6d/go.mod h1:0oz9d7g9QLSdv9/lgbIjowW1JoxMbxmBVNe8i6tORJI=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
|
||||
google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
|
||||
google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
|
||||
gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
|
||||
gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
|
||||
google.golang.org/api v0.256.0 h1:u6Khm8+F9sxbCTYNoBHg6/Hwv0N/i+V94MvkOSor6oI=
|
||||
google.golang.org/api v0.256.0/go.mod h1:KIgPhksXADEKJlnEoRa9qAII4rXcy40vfI8HRqcU964=
|
||||
google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
|
||||
google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
|
||||
google.golang.org/grpc v1.77.0 h1:wVVY6/8cGA6vvffn+wWK5ToddbgdU3d8MNENr4evgXM=
|
||||
google.golang.org/grpc v1.77.0/go.mod h1:z0BY1iVj0q8E1uSQCjL9cppRj+gnZjzDnzV0dHhrNig=
|
||||
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
|
||||
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
|
||||
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
|
||||
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
|
||||
google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
|
||||
google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
|
||||
|
||||
@@ -1,54 +0,0 @@
|
||||
package internal
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"go.uber.org/zap/zapcore"
|
||||
)
|
||||
|
||||
// LoggableHTTPHeader makes an HTTP header loggable with zap.Object().
|
||||
// Headers with potentially sensitive information (Cookie, Set-Cookie,
|
||||
// Authorization, and Proxy-Authorization) are logged with empty values.
|
||||
type LoggableHTTPHeader struct {
|
||||
http.Header
|
||||
|
||||
ShouldLogCredentials bool
|
||||
}
|
||||
|
||||
// MarshalLogObject satisfies the zapcore.ObjectMarshaler interface.
|
||||
func (h LoggableHTTPHeader) MarshalLogObject(enc zapcore.ObjectEncoder) error {
|
||||
if h.Header == nil {
|
||||
return nil
|
||||
}
|
||||
for key, val := range h.Header {
|
||||
if !h.ShouldLogCredentials {
|
||||
switch strings.ToLower(key) {
|
||||
case "cookie", "set-cookie", "authorization", "proxy-authorization":
|
||||
val = []string{"REDACTED"} // see #5669. I still think ▒▒▒▒ would be cool.
|
||||
}
|
||||
}
|
||||
enc.AddArray(key, LoggableStringArray(val))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// LoggableStringArray makes a slice of strings marshalable for logging.
|
||||
type LoggableStringArray []string
|
||||
|
||||
// MarshalLogArray satisfies the zapcore.ArrayMarshaler interface.
|
||||
func (sa LoggableStringArray) MarshalLogArray(enc zapcore.ArrayEncoder) error {
|
||||
if sa == nil {
|
||||
return nil
|
||||
}
|
||||
for _, s := range sa {
|
||||
enc.AppendString(s)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Interface guards
|
||||
var (
|
||||
_ zapcore.ObjectMarshaler = (*LoggableHTTPHeader)(nil)
|
||||
_ zapcore.ArrayMarshaler = (*LoggableStringArray)(nil)
|
||||
)
|
||||
@@ -30,6 +30,10 @@ import (
|
||||
"go.uber.org/zap"
|
||||
)
|
||||
|
||||
func reuseUnixSocket(_, _ string) (any, error) {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
func listenReusable(ctx context.Context, lnKey string, network, address string, config net.ListenConfig) (any, error) {
|
||||
var socketFile *os.File
|
||||
|
||||
@@ -116,8 +120,8 @@ func listenReusable(ctx context.Context, lnKey string, network, address string,
|
||||
// re-wrapped in a new fakeCloseListener each time the listener
|
||||
// is reused. This type is atomic and values must not be copied.
|
||||
type fakeCloseListener struct {
|
||||
closed atomic.Bool
|
||||
*sharedListener // embedded, so we also become a net.Listener
|
||||
closed int32 // accessed atomically; belongs to this struct only
|
||||
*sharedListener // embedded, so we also become a net.Listener
|
||||
keepAliveConfig net.KeepAliveConfig
|
||||
}
|
||||
|
||||
@@ -127,7 +131,7 @@ type canSetKeepAliveConfig interface {
|
||||
|
||||
func (fcl *fakeCloseListener) Accept() (net.Conn, error) {
|
||||
// if the listener is already "closed", return error
|
||||
if fcl.closed.Load() {
|
||||
if atomic.LoadInt32(&fcl.closed) == 1 {
|
||||
return nil, fakeClosedErr(fcl)
|
||||
}
|
||||
|
||||
@@ -151,7 +155,7 @@ func (fcl *fakeCloseListener) Accept() (net.Conn, error) {
|
||||
// that we set when Close() was called, and return a non-temporary and
|
||||
// non-timeout error value to the caller, masking the "true" error, so
|
||||
// that server loops / goroutines won't retry, linger, and leak
|
||||
if fcl.closed.Load() {
|
||||
if atomic.LoadInt32(&fcl.closed) == 1 {
|
||||
// we dereference the sharedListener explicitly even though it's embedded
|
||||
// so that it's clear in the code that side-effects are shared with other
|
||||
// users of this listener, not just our own reference to it; we also don't
|
||||
@@ -171,7 +175,7 @@ func (fcl *fakeCloseListener) Accept() (net.Conn, error) {
|
||||
// underlying listener. The underlying listener is only closed
|
||||
// if the caller is the last known user of the socket.
|
||||
func (fcl *fakeCloseListener) Close() error {
|
||||
if fcl.closed.CompareAndSwap(false, true) {
|
||||
if atomic.CompareAndSwapInt32(&fcl.closed, 0, 1) {
|
||||
// There are two ways I know of to get an Accept()
|
||||
// function to return to the server loop that called
|
||||
// it: close the listener, or set a deadline in the
|
||||
@@ -234,13 +238,13 @@ func (sl *sharedListener) Destruct() error {
|
||||
// fakeClosePacketConn is like fakeCloseListener, but for PacketConns,
|
||||
// or more specifically, *net.UDPConn
|
||||
type fakeClosePacketConn struct {
|
||||
closed atomic.Bool
|
||||
*sharedPacketConn // embedded, so we also become a net.PacketConn; its key is used in Close
|
||||
closed int32 // accessed atomically; belongs to this struct only
|
||||
*sharedPacketConn // embedded, so we also become a net.PacketConn; its key is used in Close
|
||||
}
|
||||
|
||||
func (fcpc *fakeClosePacketConn) ReadFrom(p []byte) (n int, addr net.Addr, err error) {
|
||||
// if the listener is already "closed", return error
|
||||
if fcpc.closed.Load() {
|
||||
if atomic.LoadInt32(&fcpc.closed) == 1 {
|
||||
return 0, nil, &net.OpError{
|
||||
Op: "readfrom",
|
||||
Net: fcpc.LocalAddr().Network(),
|
||||
@@ -254,7 +258,7 @@ func (fcpc *fakeClosePacketConn) ReadFrom(p []byte) (n int, addr net.Addr, err e
|
||||
if err != nil {
|
||||
// this server was stopped, so clear the deadline and let
|
||||
// any new server continue reading; but we will exit
|
||||
if fcpc.closed.Load() {
|
||||
if atomic.LoadInt32(&fcpc.closed) == 1 {
|
||||
if netErr, ok := err.(net.Error); ok && netErr.Timeout() {
|
||||
if err = fcpc.SetReadDeadline(time.Time{}); err != nil {
|
||||
return n, addr, err
|
||||
@@ -269,7 +273,7 @@ func (fcpc *fakeClosePacketConn) ReadFrom(p []byte) (n int, addr net.Addr, err e
|
||||
|
||||
// Close won't close the underlying socket unless there is no more reference, then listenerPool will close it.
|
||||
func (fcpc *fakeClosePacketConn) Close() error {
|
||||
if fcpc.closed.CompareAndSwap(false, true) {
|
||||
if atomic.CompareAndSwapInt32(&fcpc.closed, 0, 1) {
|
||||
_ = fcpc.SetReadDeadline(time.Now()) // unblock ReadFrom() calls to kick old servers out of their loops
|
||||
_, _ = listenerPool.Delete(fcpc.sharedPacketConn.key)
|
||||
}
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
//go:build (!unix || solaris) && !windows
|
||||
|
||||
package caddy
|
||||
|
||||
func reuseUnixSocket(_, _ string) (any, error) {
|
||||
return nil, nil
|
||||
}
|
||||
@@ -1,89 +0,0 @@
|
||||
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
//go:build windows
|
||||
|
||||
package caddy
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/fs"
|
||||
"net"
|
||||
"os"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
)
|
||||
|
||||
var errUnixSocketAlreadyInUse = errors.New("unix socket is already in use by another process")
|
||||
|
||||
func reuseUnixSocket(network, addr string) (any, error) {
|
||||
if !IsUnixNetwork(network) {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
// Note: This is here mainly for proper compatibility, because Unix sockets with abstract names are in an interesting limbo state on Windows:
|
||||
// Go already translates `@` characters to `\0` for Windows: https://github.com/golang/go/blob/65d5c5f6dd8aa7b221cff6ec3f5101ea2e5f3efa/src/syscall/syscall_windows.go#L910
|
||||
// ...but there still is an open issue about the fact that this is not properly supported: https://github.com/microsoft/WSL/issues/4240#issuecomment-620805115
|
||||
// The main issue is that the original announcement proclaimed support for this feature, but it was (apparently) never implemented: https://devblogs.microsoft.com/commandline/af_unix-comes-to-windows/
|
||||
isAbstractUnixSocket := strings.HasPrefix(addr, "@")
|
||||
|
||||
if isAbstractUnixSocket {
|
||||
// Abstract Unix sockets do not require us to remove stale socket files.
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
// On Windows, we're using the `fakeCloseListener` wrappers around a single, ever-living listener.
|
||||
// So, if there's an active listener entry in the pool, we're the current owner of the Unix socket file.
|
||||
_, socketBelongsToCurrentProcess := listenerPool.References(listenerKey(network, addr))
|
||||
|
||||
if socketBelongsToCurrentProcess {
|
||||
// Reuse/cleanup is entirely handled by the refcounting mechanism in `listenerPool`.
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
// If the socket file does not exist or has no backing server process, this will fail instantly.
|
||||
connection, err := net.DialTimeout("unix", addr, 10*time.Millisecond)
|
||||
|
||||
if err == nil {
|
||||
connection.Close()
|
||||
return nil, fmt.Errorf("cannot reuse socket %v: %w", addr, errUnixSocketAlreadyInUse)
|
||||
}
|
||||
|
||||
// Windows returns this error code both if the socket file does not exist and if it isn't backed by a server process anymore.
|
||||
// See: https://learn.microsoft.com/en-us/windows/win32/winsock/windows-sockets-error-codes-2#wsaeconnrefused
|
||||
const WSAECONNREFUSED syscall.Errno = 10061
|
||||
|
||||
var errno syscall.Errno
|
||||
hasNoListeningServerProcess := errors.As(err, &errno) && errno == WSAECONNREFUSED
|
||||
|
||||
if !hasNoListeningServerProcess {
|
||||
return nil, fmt.Errorf("cannot reuse socket %v: %w", addr, errUnixSocketAlreadyInUse)
|
||||
}
|
||||
|
||||
// If the socket file exists, it hasn't been created by our process, and it seemingly
|
||||
// isn't backed by a server process anymore. Try to delete it so we can bind to it later.
|
||||
err = os.Remove(addr)
|
||||
|
||||
if err == nil {
|
||||
return nil, nil
|
||||
} else if errors.Is(err, fs.ErrNotExist) {
|
||||
// Either the file didn't exist in the first place, or it was deleted before we were able to.
|
||||
return nil, nil
|
||||
} else {
|
||||
// We failed to delete the file. Likely, it belongs to another (active) process.
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
+10
-12
@@ -63,7 +63,7 @@ func reuseUnixSocket(network, addr string) (any, error) {
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
unixSocket.count.Add(1)
|
||||
atomic.AddInt32(unixSocket.count, 1)
|
||||
unixSockets[socketKey] = &unixListener{ln.(*net.UnixListener), socketKey, unixSocket.count}
|
||||
|
||||
case *unixConn:
|
||||
@@ -71,7 +71,7 @@ func reuseUnixSocket(network, addr string) (any, error) {
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
unixSocket.count.Add(1)
|
||||
atomic.AddInt32(unixSocket.count, 1)
|
||||
unixSockets[socketKey] = &unixConn{pc.(*net.UnixConn), socketKey, unixSocket.count}
|
||||
}
|
||||
|
||||
@@ -165,9 +165,8 @@ func listenReusable(ctx context.Context, lnKey string, network, address string,
|
||||
if !fd {
|
||||
// TODO: Not 100% sure this is necessary, but we do this for net.UnixListener, so...
|
||||
if unix, ok := ln.(*net.UnixConn); ok {
|
||||
cnt := new(atomic.Int32)
|
||||
cnt.Store(1)
|
||||
ln = &unixConn{unix, lnKey, cnt}
|
||||
one := int32(1)
|
||||
ln = &unixConn{unix, lnKey, &one}
|
||||
unixSockets[lnKey] = ln.(*unixConn)
|
||||
}
|
||||
}
|
||||
@@ -182,9 +181,8 @@ func listenReusable(ctx context.Context, lnKey string, network, address string,
|
||||
// (we do our own "unlink on close" -- not required, but more tidy)
|
||||
if unix, ok := ln.(*net.UnixListener); ok {
|
||||
unix.SetUnlinkOnClose(false)
|
||||
cnt := new(atomic.Int32)
|
||||
cnt.Store(1)
|
||||
ln = &unixListener{unix, lnKey, cnt}
|
||||
one := int32(1)
|
||||
ln = &unixListener{unix, lnKey, &one}
|
||||
unixSockets[lnKey] = ln.(*unixListener)
|
||||
}
|
||||
}
|
||||
@@ -218,11 +216,11 @@ func reusePort(network, address string, conn syscall.RawConn) error {
|
||||
type unixListener struct {
|
||||
*net.UnixListener
|
||||
mapKey string
|
||||
count *atomic.Int32
|
||||
count *int32 // accessed atomically
|
||||
}
|
||||
|
||||
func (uln *unixListener) Close() error {
|
||||
newCount := uln.count.Add(-1)
|
||||
newCount := atomic.AddInt32(uln.count, -1)
|
||||
if newCount == 0 {
|
||||
file, err := uln.File()
|
||||
var name string
|
||||
@@ -244,11 +242,11 @@ func (uln *unixListener) Close() error {
|
||||
type unixConn struct {
|
||||
*net.UnixConn
|
||||
mapKey string
|
||||
count *atomic.Int32
|
||||
count *int32 // accessed atomically
|
||||
}
|
||||
|
||||
func (uc *unixConn) Close() error {
|
||||
newCount := uc.count.Add(-1)
|
||||
newCount := atomic.AddInt32(uc.count, -1)
|
||||
if newCount == 0 {
|
||||
file, err := uc.File()
|
||||
var name string
|
||||
|
||||
+99
-36
@@ -38,6 +38,10 @@ import (
|
||||
"github.com/caddyserver/caddy/v2/internal"
|
||||
)
|
||||
|
||||
// listenFdsStart is the first file descriptor number for systemd socket activation.
|
||||
// File descriptors 0, 1, 2 are reserved for stdin, stdout, stderr.
|
||||
const listenFdsStart = 3
|
||||
|
||||
// NetworkAddress represents one or more network addresses.
|
||||
// It contains the individual components for a parsed network
|
||||
// address of the form accepted by ParseNetworkAddress().
|
||||
@@ -229,7 +233,7 @@ func (na NetworkAddress) JoinHostPort(offset uint) string {
|
||||
func (na NetworkAddress) Expand() []NetworkAddress {
|
||||
size := na.PortRangeSize()
|
||||
addrs := make([]NetworkAddress, size)
|
||||
for portOffset := range size {
|
||||
for portOffset := uint(0); portOffset < size; portOffset++ {
|
||||
addrs[portOffset] = na.At(portOffset)
|
||||
}
|
||||
return addrs
|
||||
@@ -305,6 +309,64 @@ func IsFdNetwork(netw string) bool {
|
||||
return strings.HasPrefix(netw, "fd")
|
||||
}
|
||||
|
||||
// getFdByName returns the file descriptor number for the given
|
||||
// socket name from systemd's LISTEN_FDNAMES environment variable.
|
||||
// Socket names are provided by systemd via socket activation.
|
||||
//
|
||||
// The name can optionally include an index to handle multiple sockets
|
||||
// with the same name: "web:0" for first, "web:1" for second, etc.
|
||||
// If no index is specified, defaults to index 0 (first occurrence).
|
||||
func getFdByName(nameWithIndex string) (int, error) {
|
||||
if nameWithIndex == "" {
|
||||
return 0, fmt.Errorf("socket name cannot be empty")
|
||||
}
|
||||
|
||||
fdNamesStr := os.Getenv("LISTEN_FDNAMES")
|
||||
if fdNamesStr == "" {
|
||||
return 0, fmt.Errorf("LISTEN_FDNAMES environment variable not set")
|
||||
}
|
||||
|
||||
// Parse name and optional index
|
||||
parts := strings.Split(nameWithIndex, ":")
|
||||
if len(parts) > 2 {
|
||||
return 0, fmt.Errorf("invalid socket name format '%s': too many colons", nameWithIndex)
|
||||
}
|
||||
|
||||
name := parts[0]
|
||||
targetIndex := 0
|
||||
|
||||
if len(parts) > 1 {
|
||||
var err error
|
||||
targetIndex, err = strconv.Atoi(parts[1])
|
||||
if err != nil {
|
||||
return 0, fmt.Errorf("invalid socket index '%s': %v", parts[1], err)
|
||||
}
|
||||
if targetIndex < 0 {
|
||||
return 0, fmt.Errorf("socket index cannot be negative: %d", targetIndex)
|
||||
}
|
||||
}
|
||||
|
||||
// Parse the socket names
|
||||
names := strings.Split(fdNamesStr, ":")
|
||||
|
||||
// Find the Nth occurrence of the requested name
|
||||
matchCount := 0
|
||||
for i, fdName := range names {
|
||||
if fdName == name {
|
||||
if matchCount == targetIndex {
|
||||
return listenFdsStart + i, nil
|
||||
}
|
||||
matchCount++
|
||||
}
|
||||
}
|
||||
|
||||
if matchCount == 0 {
|
||||
return 0, fmt.Errorf("socket name '%s' not found in LISTEN_FDNAMES", name)
|
||||
}
|
||||
|
||||
return 0, fmt.Errorf("socket name '%s' found %d times, but index %d requested", name, matchCount, targetIndex)
|
||||
}
|
||||
|
||||
// ParseNetworkAddress parses addr into its individual
|
||||
// components. The input string is expected to be of
|
||||
// the form "network/host:port-range" where any part is
|
||||
@@ -336,9 +398,27 @@ func ParseNetworkAddressWithDefaults(addr, defaultNetwork string, defaultPort ui
|
||||
}, err
|
||||
}
|
||||
if IsFdNetwork(network) {
|
||||
fdAddr := host
|
||||
|
||||
// Handle named socket activation (fdname/name, fdgramname/name)
|
||||
if strings.HasPrefix(network, "fdname") || strings.HasPrefix(network, "fdgramname") {
|
||||
fdNum, err := getFdByName(host)
|
||||
if err != nil {
|
||||
return NetworkAddress{}, fmt.Errorf("named socket activation: %v", err)
|
||||
}
|
||||
fdAddr = strconv.Itoa(fdNum)
|
||||
|
||||
// Normalize network to standard fd/fdgram
|
||||
if strings.HasPrefix(network, "fdname") {
|
||||
network = "fd"
|
||||
} else {
|
||||
network = "fdgram"
|
||||
}
|
||||
}
|
||||
|
||||
return NetworkAddress{
|
||||
Network: network,
|
||||
Host: host,
|
||||
Host: fdAddr,
|
||||
}, nil
|
||||
}
|
||||
var start, end uint64
|
||||
@@ -431,7 +511,7 @@ func JoinNetworkAddress(network, host, port string) string {
|
||||
//
|
||||
// NOTE: This API is EXPERIMENTAL and may be changed or removed.
|
||||
// NOTE: user should close the returned listener twice, once to stop accepting new connections, the second time to free up the packet conn.
|
||||
func (na NetworkAddress) ListenQUIC(ctx context.Context, portOffset uint, config net.ListenConfig, tlsConf *tls.Config, pcWrappers []PacketConnWrapper, allow0rttconf *bool) (http3.QUICListener, error) {
|
||||
func (na NetworkAddress) ListenQUIC(ctx context.Context, portOffset uint, config net.ListenConfig, tlsConf *tls.Config, pcWrappers []PacketConnWrapper) (http3.QUICListener, error) {
|
||||
lnKey := listenerKey("quic"+na.Network, na.JoinHostPort(portOffset))
|
||||
|
||||
sharedEarlyListener, _, err := listenerPool.LoadOrNew(lnKey, func() (Destructor, error) {
|
||||
@@ -462,10 +542,7 @@ func (na NetworkAddress) ListenQUIC(ctx context.Context, portOffset uint, config
|
||||
sqs := newSharedQUICState(tlsConf)
|
||||
// http3.ConfigureTLSConfig only uses this field and tls App sets this field as well
|
||||
//nolint:gosec
|
||||
quicTlsConfig := &tls.Config{
|
||||
GetConfigForClient: sqs.getConfigForClient,
|
||||
GetEncryptedClientHelloKeys: sqs.getEncryptedClientHelloKeys,
|
||||
}
|
||||
quicTlsConfig := &tls.Config{GetConfigForClient: sqs.getConfigForClient}
|
||||
// Require clients to verify their source address when we're handling more than 1000 handshakes per second.
|
||||
// TODO: make tunable?
|
||||
limiter := rate.NewLimiter(1000, 1000)
|
||||
@@ -473,14 +550,10 @@ func (na NetworkAddress) ListenQUIC(ctx context.Context, portOffset uint, config
|
||||
Conn: h3ln,
|
||||
VerifySourceAddress: func(addr net.Addr) bool { return !limiter.Allow() },
|
||||
}
|
||||
allow0rtt := true
|
||||
if allow0rttconf != nil {
|
||||
allow0rtt = *allow0rttconf
|
||||
}
|
||||
earlyLn, err := tr.ListenEarly(
|
||||
http3.ConfigureTLSConfig(quicTlsConfig),
|
||||
&quic.Config{
|
||||
Allow0RTT: allow0rtt,
|
||||
Allow0RTT: true,
|
||||
Tracer: h3qlog.DefaultConnectionTracer,
|
||||
},
|
||||
)
|
||||
@@ -515,7 +588,7 @@ func ListenerUsage(network, addr string) int {
|
||||
// contextAndCancelFunc groups context and its cancelFunc
|
||||
type contextAndCancelFunc struct {
|
||||
context.Context
|
||||
context.CancelCauseFunc
|
||||
context.CancelFunc
|
||||
}
|
||||
|
||||
// sharedQUICState manages GetConfigForClient
|
||||
@@ -543,29 +616,19 @@ func (sqs *sharedQUICState) getConfigForClient(ch *tls.ClientHelloInfo) (*tls.Co
|
||||
return sqs.activeTlsConf.GetConfigForClient(ch)
|
||||
}
|
||||
|
||||
// getEncryptedClientHelloKeys is used as tls.Config's GetEncryptedClientHelloKeys field.
|
||||
func (sqs *sharedQUICState) getEncryptedClientHelloKeys(ch *tls.ClientHelloInfo) ([]tls.EncryptedClientHelloKey, error) {
|
||||
sqs.rmu.RLock()
|
||||
defer sqs.rmu.RUnlock()
|
||||
if sqs.activeTlsConf.GetEncryptedClientHelloKeys == nil {
|
||||
return nil, nil
|
||||
}
|
||||
return sqs.activeTlsConf.GetEncryptedClientHelloKeys(ch)
|
||||
}
|
||||
|
||||
// addState adds tls.Config and activeRequests to the map if not present and returns the corresponding context and its cancelFunc
|
||||
// so that when cancelled, the active tls.Config will change
|
||||
func (sqs *sharedQUICState) addState(tlsConfig *tls.Config) (context.Context, context.CancelCauseFunc) {
|
||||
func (sqs *sharedQUICState) addState(tlsConfig *tls.Config) (context.Context, context.CancelFunc) {
|
||||
sqs.rmu.Lock()
|
||||
defer sqs.rmu.Unlock()
|
||||
|
||||
if cacc, ok := sqs.tlsConfs[tlsConfig]; ok {
|
||||
return cacc.Context, cacc.CancelCauseFunc
|
||||
return cacc.Context, cacc.CancelFunc
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithCancelCause(context.Background())
|
||||
wrappedCancel := func(cause error) {
|
||||
cancel(cause)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
wrappedCancel := func() {
|
||||
cancel()
|
||||
|
||||
sqs.rmu.Lock()
|
||||
defer sqs.rmu.Unlock()
|
||||
@@ -621,13 +684,13 @@ func fakeClosedErr(l interface{ Addr() net.Addr }) error {
|
||||
// indicating that it is pretending to be closed so that the
|
||||
// server using it can terminate, while the underlying
|
||||
// socket is actually left open.
|
||||
var errFakeClosed = fmt.Errorf("QUIC listener 'closed' 😉")
|
||||
var errFakeClosed = fmt.Errorf("listener 'closed' 😉")
|
||||
|
||||
type fakeCloseQuicListener struct {
|
||||
closed atomic.Int32
|
||||
*sharedQuicListener // embedded, so we also become a quic.EarlyListener
|
||||
closed int32 // accessed atomically; belongs to this struct only
|
||||
*sharedQuicListener // embedded, so we also become a quic.EarlyListener
|
||||
context context.Context
|
||||
contextCancel context.CancelCauseFunc
|
||||
contextCancel context.CancelFunc
|
||||
}
|
||||
|
||||
// Currently Accept ignores the passed context, however a situation where
|
||||
@@ -642,16 +705,16 @@ func (fcql *fakeCloseQuicListener) Accept(_ context.Context) (*quic.Conn, error)
|
||||
}
|
||||
|
||||
// if the listener is "closed", return a fake closed error instead
|
||||
if fcql.closed.Load() == 1 && errors.Is(err, context.Canceled) {
|
||||
if atomic.LoadInt32(&fcql.closed) == 1 && errors.Is(err, context.Canceled) {
|
||||
return nil, fakeClosedErr(fcql)
|
||||
}
|
||||
return nil, err
|
||||
}
|
||||
|
||||
func (fcql *fakeCloseQuicListener) Close() error {
|
||||
if fcql.closed.CompareAndSwap(0, 1) {
|
||||
fcql.contextCancel(errFakeClosed)
|
||||
} else if fcql.closed.CompareAndSwap(1, 2) {
|
||||
if atomic.CompareAndSwapInt32(&fcql.closed, 0, 1) {
|
||||
fcql.contextCancel()
|
||||
} else if atomic.CompareAndSwapInt32(&fcql.closed, 1, 2) {
|
||||
_, _ = listenerPool.Delete(fcql.sharedQuicListener.key)
|
||||
}
|
||||
return nil
|
||||
|
||||
+284
-58
@@ -15,7 +15,7 @@
|
||||
package caddy
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"os"
|
||||
"reflect"
|
||||
"testing"
|
||||
|
||||
@@ -176,63 +176,6 @@ func TestJoinNetworkAddress(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestSharedQUICStateGetEncryptedClientHelloKeys(t *testing.T) {
|
||||
hello := &tls.ClientHelloInfo{ServerName: "example.com"}
|
||||
initialKeys := []tls.EncryptedClientHelloKey{{Config: []byte("initial"), PrivateKey: []byte("initial-key")}}
|
||||
updatedKeys := []tls.EncryptedClientHelloKey{{Config: []byte("updated"), PrivateKey: []byte("updated-key")}}
|
||||
|
||||
initialConfig := &tls.Config{
|
||||
GetConfigForClient: func(*tls.ClientHelloInfo) (*tls.Config, error) {
|
||||
return nil, nil
|
||||
},
|
||||
GetEncryptedClientHelloKeys: func(*tls.ClientHelloInfo) ([]tls.EncryptedClientHelloKey, error) {
|
||||
return initialKeys, nil
|
||||
},
|
||||
}
|
||||
|
||||
sqs := newSharedQUICState(initialConfig)
|
||||
|
||||
keys, err := sqs.getEncryptedClientHelloKeys(hello)
|
||||
if err != nil {
|
||||
t.Fatalf("getting initial ECH keys: %v", err)
|
||||
}
|
||||
if !reflect.DeepEqual(keys, initialKeys) {
|
||||
t.Fatalf("unexpected initial ECH keys: got %#v, want %#v", keys, initialKeys)
|
||||
}
|
||||
|
||||
updatedConfig := &tls.Config{
|
||||
GetConfigForClient: func(*tls.ClientHelloInfo) (*tls.Config, error) {
|
||||
return nil, nil
|
||||
},
|
||||
GetEncryptedClientHelloKeys: func(*tls.ClientHelloInfo) ([]tls.EncryptedClientHelloKey, error) {
|
||||
return updatedKeys, nil
|
||||
},
|
||||
}
|
||||
|
||||
_, cancel := sqs.addState(updatedConfig)
|
||||
sqs.rmu.Lock()
|
||||
sqs.activeTlsConf = updatedConfig
|
||||
sqs.rmu.Unlock()
|
||||
|
||||
keys, err = sqs.getEncryptedClientHelloKeys(hello)
|
||||
if err != nil {
|
||||
t.Fatalf("getting updated ECH keys: %v", err)
|
||||
}
|
||||
if !reflect.DeepEqual(keys, updatedKeys) {
|
||||
t.Fatalf("unexpected updated ECH keys: got %#v, want %#v", keys, updatedKeys)
|
||||
}
|
||||
|
||||
cancel(nil)
|
||||
|
||||
keys, err = sqs.getEncryptedClientHelloKeys(hello)
|
||||
if err != nil {
|
||||
t.Fatalf("getting restored ECH keys: %v", err)
|
||||
}
|
||||
if !reflect.DeepEqual(keys, initialKeys) {
|
||||
t.Fatalf("unexpected restored ECH keys: got %#v, want %#v", keys, initialKeys)
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseNetworkAddress(t *testing.T) {
|
||||
for i, tc := range []struct {
|
||||
input string
|
||||
@@ -710,3 +653,286 @@ func TestSplitUnixSocketPermissionsBits(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestGetFdByName tests the getFdByName function for systemd socket activation.
|
||||
func TestGetFdByName(t *testing.T) {
|
||||
// Save original environment
|
||||
originalFdNames := os.Getenv("LISTEN_FDNAMES")
|
||||
|
||||
// Restore environment after test
|
||||
defer func() {
|
||||
if originalFdNames != "" {
|
||||
os.Setenv("LISTEN_FDNAMES", originalFdNames)
|
||||
} else {
|
||||
os.Unsetenv("LISTEN_FDNAMES")
|
||||
}
|
||||
}()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
fdNames string
|
||||
socketName string
|
||||
expectedFd int
|
||||
expectError bool
|
||||
}{
|
||||
{
|
||||
name: "simple http socket",
|
||||
fdNames: "http",
|
||||
socketName: "http",
|
||||
expectedFd: 3,
|
||||
},
|
||||
{
|
||||
name: "multiple different sockets - first",
|
||||
fdNames: "http:https:dns",
|
||||
socketName: "http",
|
||||
expectedFd: 3,
|
||||
},
|
||||
{
|
||||
name: "multiple different sockets - second",
|
||||
fdNames: "http:https:dns",
|
||||
socketName: "https",
|
||||
expectedFd: 4,
|
||||
},
|
||||
{
|
||||
name: "multiple different sockets - third",
|
||||
fdNames: "http:https:dns",
|
||||
socketName: "dns",
|
||||
expectedFd: 5,
|
||||
},
|
||||
{
|
||||
name: "duplicate names - first occurrence (no index)",
|
||||
fdNames: "web:web:api",
|
||||
socketName: "web",
|
||||
expectedFd: 3,
|
||||
},
|
||||
{
|
||||
name: "duplicate names - first occurrence (explicit index 0)",
|
||||
fdNames: "web:web:api",
|
||||
socketName: "web:0",
|
||||
expectedFd: 3,
|
||||
},
|
||||
{
|
||||
name: "duplicate names - second occurrence (index 1)",
|
||||
fdNames: "web:web:api",
|
||||
socketName: "web:1",
|
||||
expectedFd: 4,
|
||||
},
|
||||
{
|
||||
name: "complex duplicates - first api",
|
||||
fdNames: "web:api:web:api:dns",
|
||||
socketName: "api:0",
|
||||
expectedFd: 4,
|
||||
},
|
||||
{
|
||||
name: "complex duplicates - second api",
|
||||
fdNames: "web:api:web:api:dns",
|
||||
socketName: "api:1",
|
||||
expectedFd: 6,
|
||||
},
|
||||
{
|
||||
name: "complex duplicates - first web",
|
||||
fdNames: "web:api:web:api:dns",
|
||||
socketName: "web:0",
|
||||
expectedFd: 3,
|
||||
},
|
||||
{
|
||||
name: "complex duplicates - second web",
|
||||
fdNames: "web:api:web:api:dns",
|
||||
socketName: "web:1",
|
||||
expectedFd: 5,
|
||||
},
|
||||
{
|
||||
name: "socket not found",
|
||||
fdNames: "http:https",
|
||||
socketName: "missing",
|
||||
expectError: true,
|
||||
},
|
||||
{
|
||||
name: "empty socket name",
|
||||
fdNames: "http",
|
||||
socketName: "",
|
||||
expectError: true,
|
||||
},
|
||||
{
|
||||
name: "missing LISTEN_FDNAMES",
|
||||
fdNames: "",
|
||||
socketName: "http",
|
||||
expectError: true,
|
||||
},
|
||||
{
|
||||
name: "index out of range",
|
||||
fdNames: "web:web",
|
||||
socketName: "web:2",
|
||||
expectError: true,
|
||||
},
|
||||
{
|
||||
name: "negative index",
|
||||
fdNames: "web",
|
||||
socketName: "web:-1",
|
||||
expectError: true,
|
||||
},
|
||||
{
|
||||
name: "invalid index format",
|
||||
fdNames: "web",
|
||||
socketName: "web:abc",
|
||||
expectError: true,
|
||||
},
|
||||
{
|
||||
name: "too many colons",
|
||||
fdNames: "web",
|
||||
socketName: "web:0:extra",
|
||||
expectError: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range tests {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
// Set up environment
|
||||
if tc.fdNames != "" {
|
||||
os.Setenv("LISTEN_FDNAMES", tc.fdNames)
|
||||
} else {
|
||||
os.Unsetenv("LISTEN_FDNAMES")
|
||||
}
|
||||
|
||||
// Test the function
|
||||
fd, err := getFdByName(tc.socketName)
|
||||
|
||||
if tc.expectError {
|
||||
if err == nil {
|
||||
t.Errorf("Expected error but got none")
|
||||
}
|
||||
} else {
|
||||
if err != nil {
|
||||
t.Errorf("Expected no error but got: %v", err)
|
||||
}
|
||||
if fd != tc.expectedFd {
|
||||
t.Errorf("Expected FD %d but got %d", tc.expectedFd, fd)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestParseNetworkAddressFdName tests parsing of fdname and fdgramname addresses.
|
||||
func TestParseNetworkAddressFdName(t *testing.T) {
|
||||
// Save and restore environment
|
||||
originalFdNames := os.Getenv("LISTEN_FDNAMES")
|
||||
defer func() {
|
||||
if originalFdNames != "" {
|
||||
os.Setenv("LISTEN_FDNAMES", originalFdNames)
|
||||
} else {
|
||||
os.Unsetenv("LISTEN_FDNAMES")
|
||||
}
|
||||
}()
|
||||
|
||||
// Set up test environment
|
||||
os.Setenv("LISTEN_FDNAMES", "http:https:dns")
|
||||
|
||||
tests := []struct {
|
||||
input string
|
||||
expectAddr NetworkAddress
|
||||
expectErr bool
|
||||
}{
|
||||
{
|
||||
input: "fdname/http",
|
||||
expectAddr: NetworkAddress{
|
||||
Network: "fd",
|
||||
Host: "3",
|
||||
},
|
||||
},
|
||||
{
|
||||
input: "fdname/https",
|
||||
expectAddr: NetworkAddress{
|
||||
Network: "fd",
|
||||
Host: "4",
|
||||
},
|
||||
},
|
||||
{
|
||||
input: "fdname/dns",
|
||||
expectAddr: NetworkAddress{
|
||||
Network: "fd",
|
||||
Host: "5",
|
||||
},
|
||||
},
|
||||
{
|
||||
input: "fdname/http:0",
|
||||
expectAddr: NetworkAddress{
|
||||
Network: "fd",
|
||||
Host: "3",
|
||||
},
|
||||
},
|
||||
{
|
||||
input: "fdname/https:0",
|
||||
expectAddr: NetworkAddress{
|
||||
Network: "fd",
|
||||
Host: "4",
|
||||
},
|
||||
},
|
||||
{
|
||||
input: "fdgramname/http",
|
||||
expectAddr: NetworkAddress{
|
||||
Network: "fdgram",
|
||||
Host: "3",
|
||||
},
|
||||
},
|
||||
{
|
||||
input: "fdgramname/https",
|
||||
expectAddr: NetworkAddress{
|
||||
Network: "fdgram",
|
||||
Host: "4",
|
||||
},
|
||||
},
|
||||
{
|
||||
input: "fdgramname/http:0",
|
||||
expectAddr: NetworkAddress{
|
||||
Network: "fdgram",
|
||||
Host: "3",
|
||||
},
|
||||
},
|
||||
{
|
||||
input: "fdname/nonexistent",
|
||||
expectErr: true,
|
||||
},
|
||||
{
|
||||
input: "fdgramname/nonexistent",
|
||||
expectErr: true,
|
||||
},
|
||||
{
|
||||
input: "fdname/http:99",
|
||||
expectErr: true,
|
||||
},
|
||||
{
|
||||
input: "fdname/invalid:abc",
|
||||
expectErr: true,
|
||||
},
|
||||
// Test that old fd/N syntax still works
|
||||
{
|
||||
input: "fd/7",
|
||||
expectAddr: NetworkAddress{
|
||||
Network: "fd",
|
||||
Host: "7",
|
||||
},
|
||||
},
|
||||
{
|
||||
input: "fdgram/8",
|
||||
expectAddr: NetworkAddress{
|
||||
Network: "fdgram",
|
||||
Host: "8",
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for i, tc := range tests {
|
||||
actualAddr, err := ParseNetworkAddress(tc.input)
|
||||
|
||||
if tc.expectErr && err == nil {
|
||||
t.Errorf("Test %d (%s): Expected error but got none", i, tc.input)
|
||||
}
|
||||
if !tc.expectErr && err != nil {
|
||||
t.Errorf("Test %d (%s): Expected no error but got: %v", i, tc.input, err)
|
||||
}
|
||||
if !tc.expectErr && !reflect.DeepEqual(tc.expectAddr, actualAddr) {
|
||||
t.Errorf("Test %d (%s): Expected %+v but got %+v", i, tc.input, tc.expectAddr, actualAddr)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+39
-27
@@ -18,8 +18,8 @@ import (
|
||||
"cmp"
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"errors"
|
||||
"fmt"
|
||||
"maps"
|
||||
"net"
|
||||
"net/http"
|
||||
"strconv"
|
||||
@@ -68,7 +68,6 @@ func init() {
|
||||
// `{http.request.orig_uri.path.dir}` | The request's original directory
|
||||
// `{http.request.orig_uri.path.file}` | The request's original filename
|
||||
// `{http.request.orig_uri.query}` | The request's original query string (without `?`)
|
||||
// `{http.request.orig_uri.prefixed_query}` | The request's original query string with a `?` prefix, if non-empty
|
||||
// `{http.request.port}` | The port part of the request's Host header
|
||||
// `{http.request.proto}` | The protocol of the request
|
||||
// `{http.request.local.host}` | The host (IP) part of the local address the connection arrived on
|
||||
@@ -98,15 +97,11 @@ func init() {
|
||||
// `{http.request.tls.client.san.ips.*}` | SAN IP addresses (index optional)
|
||||
// `{http.request.tls.client.san.uris.*}` | SAN URIs (index optional)
|
||||
// `{http.request.uri}` | The full request URI
|
||||
// `{http.request.uri_escaped}` | The full request URI with query-style URL encoding applied (using url.QueryEscape)
|
||||
// `{http.request.uri.path}` | The path component of the request URI
|
||||
// `{http.request.uri.path_escaped}` | The path component of the request URI with query-style URL encoding applied (using url.QueryEscape)
|
||||
// `{http.request.uri.path.*}` | Parts of the path, split by `/` (0-based from left)
|
||||
// `{http.request.uri.path.dir}` | The directory, excluding leaf filename
|
||||
// `{http.request.uri.path.file}` | The filename of the path, excluding directory
|
||||
// `{http.request.uri.query}` | The query string (without `?`)
|
||||
// `{http.request.uri.query_escaped}` | The query string with query-style URL encoding applied (using url.QueryEscape)
|
||||
// `{http.request.uri.prefixed_query}` | The query string with a `?` prefix, if non-empty
|
||||
// `{http.request.uri.query.*}` | Individual query string value
|
||||
// `{http.response.header.*}` | Specific response header field
|
||||
// `{http.vars.*}` | Custom variables in the HTTP handler chain
|
||||
@@ -207,9 +202,6 @@ func (app *App) Provision(ctx caddy.Context) error {
|
||||
app.Metrics.httpMetrics = &httpMetrics{}
|
||||
// Scan config for allowed hosts to prevent cardinality explosion
|
||||
app.Metrics.scanConfigForHosts(app)
|
||||
if err := app.Metrics.provisionOTLP(ctx); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
// prepare each server
|
||||
oldContext := ctx.Context
|
||||
@@ -221,6 +213,8 @@ func (app *App) Provision(ctx caddy.Context) error {
|
||||
srv.ctx = ctx
|
||||
srv.logger = app.logger.Named("log")
|
||||
srv.errorLogger = app.logger.Named("log.error")
|
||||
srv.shutdownAtMu = new(sync.RWMutex)
|
||||
|
||||
if srv.Metrics != nil {
|
||||
srv.logger.Warn("per-server 'metrics' is deprecated; use 'metrics' in the root 'http' app instead")
|
||||
app.Metrics = cmp.Or(app.Metrics, &Metrics{
|
||||
@@ -240,7 +234,12 @@ func (app *App) Provision(ctx caddy.Context) error {
|
||||
|
||||
// if no protocols configured explicitly, enable all except h2c
|
||||
if len(srv.Protocols) == 0 {
|
||||
srv.Protocols = srv.protocolsWithDefaults()
|
||||
srv.Protocols = []string{"h1", "h2", "h3"}
|
||||
}
|
||||
|
||||
srvProtocolsUnique := map[string]struct{}{}
|
||||
for _, srvProtocol := range srv.Protocols {
|
||||
srvProtocolsUnique[srvProtocol] = struct{}{}
|
||||
}
|
||||
|
||||
if srv.ListenProtocols != nil {
|
||||
@@ -251,7 +250,31 @@ func (app *App) Provision(ctx caddy.Context) error {
|
||||
|
||||
for i, lnProtocols := range srv.ListenProtocols {
|
||||
if lnProtocols != nil {
|
||||
srv.ListenProtocols[i] = srv.listenerProtocolsWithDefaults(lnProtocols)
|
||||
// populate empty listen protocols with server protocols
|
||||
lnProtocolsDefault := false
|
||||
var lnProtocolsInclude []string
|
||||
srvProtocolsInclude := maps.Clone(srvProtocolsUnique)
|
||||
|
||||
// keep existing listener protocols unless they are empty
|
||||
for _, lnProtocol := range lnProtocols {
|
||||
if lnProtocol == "" {
|
||||
lnProtocolsDefault = true
|
||||
} else {
|
||||
lnProtocolsInclude = append(lnProtocolsInclude, lnProtocol)
|
||||
delete(srvProtocolsInclude, lnProtocol)
|
||||
}
|
||||
}
|
||||
|
||||
// append server protocols to listener protocols if any listener protocols were empty
|
||||
if lnProtocolsDefault {
|
||||
for _, srvProtocol := range srv.Protocols {
|
||||
if _, ok := srvProtocolsInclude[srvProtocol]; ok {
|
||||
lnProtocolsInclude = append(lnProtocolsInclude, srvProtocol)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
srv.ListenProtocols[i] = lnProtocolsInclude
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -665,7 +688,9 @@ func (app *App) Stop() error {
|
||||
for _, addr := range na.Expand() {
|
||||
if caddy.ListenerUsage(addr.Network, addr.JoinHostPort(0)) < 2 {
|
||||
app.logger.Debug("listener closing and shutdown delay is configured", zap.String("address", addr.String()))
|
||||
server.shutdownAt.Store(&scheduledTime)
|
||||
server.shutdownAtMu.Lock()
|
||||
server.shutdownAt = scheduledTime
|
||||
server.shutdownAtMu.Unlock()
|
||||
delay = true
|
||||
} else {
|
||||
app.logger.Debug("shutdown delay configured but listener will remain open", zap.String("address", addr.String()))
|
||||
@@ -686,10 +711,9 @@ func (app *App) Stop() error {
|
||||
// enforce grace period if configured
|
||||
if app.GracePeriod > 0 {
|
||||
var cancel context.CancelFunc
|
||||
timeout := time.Duration(app.GracePeriod)
|
||||
ctx, cancel = context.WithTimeoutCause(ctx, timeout, fmt.Errorf("server graceful shutdown %ds timeout", int(timeout.Seconds())))
|
||||
ctx, cancel = context.WithTimeout(ctx, time.Duration(app.GracePeriod))
|
||||
defer cancel()
|
||||
app.logger.Info("servers shutting down; grace period initiated", zap.Duration("duration", timeout))
|
||||
app.logger.Info("servers shutting down; grace period initiated", zap.Duration("duration", time.Duration(app.GracePeriod)))
|
||||
} else {
|
||||
app.logger.Info("servers shutting down with eternal grace period")
|
||||
}
|
||||
@@ -715,9 +739,6 @@ func (app *App) Stop() error {
|
||||
}
|
||||
|
||||
if err := server.server.Shutdown(ctx); err != nil {
|
||||
if cause := context.Cause(ctx); cause != nil && errors.Is(err, context.DeadlineExceeded) {
|
||||
err = cause
|
||||
}
|
||||
app.logger.Error("server shutdown",
|
||||
zap.Error(err),
|
||||
zap.Strings("addresses", server.Listen))
|
||||
@@ -741,9 +762,6 @@ func (app *App) Stop() error {
|
||||
}
|
||||
|
||||
if err := server.h3server.Shutdown(ctx); err != nil {
|
||||
if cause := context.Cause(ctx); cause != nil && errors.Is(err, context.DeadlineExceeded) {
|
||||
err = cause
|
||||
}
|
||||
app.logger.Error("HTTP/3 server shutdown",
|
||||
zap.Error(err),
|
||||
zap.Strings("addresses", server.Listen))
|
||||
@@ -790,12 +808,6 @@ func (app *App) Stop() error {
|
||||
}
|
||||
}
|
||||
|
||||
// flush and shut down the OTLP metrics exporter (if configured) so any
|
||||
// last data point reaches the collector before the process exits
|
||||
if err := app.Metrics.shutdown(ctx); err != nil {
|
||||
app.logger.Error("shutting down OTLP metrics", zap.Error(err))
|
||||
}
|
||||
|
||||
app.stopped = true
|
||||
return nil
|
||||
}
|
||||
|
||||
+10
-125
@@ -173,7 +173,7 @@ func (app *App) automaticHTTPSPhase1(ctx caddy.Context, repl *caddy.Replacer) er
|
||||
for d := range serverDomainSet {
|
||||
echDomains = append(echDomains, d)
|
||||
}
|
||||
app.tlsApp.RegisterServerNames(echDomains, httpsRRALPNs(srv))
|
||||
app.tlsApp.RegisterServerNames(echDomains)
|
||||
|
||||
// nothing more to do here if there are no domains that qualify for
|
||||
// automatic HTTPS and there are no explicit TLS connection policies:
|
||||
@@ -258,13 +258,18 @@ func (app *App) automaticHTTPSPhase1(ctx caddy.Context, repl *caddy.Replacer) er
|
||||
// an empty string to indicate a catch-all, which we have to
|
||||
// treat special later
|
||||
if len(serverDomainSet) == 0 {
|
||||
app.recordAutoHTTPSRedirectAddress(redirDomains, "", addr)
|
||||
redirDomains[""] = append(redirDomains[""], addr)
|
||||
continue
|
||||
}
|
||||
|
||||
// ...and associate it with each domain in this server
|
||||
for d := range serverDomainSet {
|
||||
app.recordAutoHTTPSRedirectAddress(redirDomains, d, addr)
|
||||
// if this domain is used on more than one HTTPS-enabled
|
||||
// port, we'll have to choose one, so prefer the HTTPS port
|
||||
if _, ok := redirDomains[d]; !ok ||
|
||||
addr.StartPort == uint(app.httpsPort()) {
|
||||
redirDomains[d] = append(redirDomains[d], addr)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -419,40 +424,6 @@ redirServersLoop:
|
||||
// we'll create a new server for all the listener addresses
|
||||
// that are unused and serve the remaining redirects from it
|
||||
|
||||
// Sort redirect routes by host specificity to ensure exact matches
|
||||
// take precedence over wildcards, preventing ambiguous routing.
|
||||
slices.SortFunc(routes, func(a, b Route) int {
|
||||
hostA := getFirstHostFromRoute(a)
|
||||
hostB := getFirstHostFromRoute(b)
|
||||
|
||||
// Catch-all routes (empty host) have the lowest priority
|
||||
if hostA == "" && hostB != "" {
|
||||
return 1
|
||||
}
|
||||
if hostB == "" && hostA != "" {
|
||||
return -1
|
||||
}
|
||||
|
||||
hasWildcardA := strings.Contains(hostA, "*")
|
||||
hasWildcardB := strings.Contains(hostB, "*")
|
||||
|
||||
// Exact domains take precedence over wildcards
|
||||
if !hasWildcardA && hasWildcardB {
|
||||
return -1
|
||||
}
|
||||
if hasWildcardA && !hasWildcardB {
|
||||
return 1
|
||||
}
|
||||
|
||||
// If both are exact or both are wildcards, the longer one is more specific
|
||||
if len(hostA) != len(hostB) {
|
||||
return len(hostB) - len(hostA)
|
||||
}
|
||||
|
||||
// Tie-breaker: alphabetical order to ensure determinism
|
||||
return strings.Compare(hostA, hostB)
|
||||
})
|
||||
|
||||
// Use the sorted srvNames to consistently find the target server
|
||||
for _, srvName := range srvNames {
|
||||
srv := app.Servers[srvName]
|
||||
@@ -512,35 +483,6 @@ redirServersLoop:
|
||||
return nil
|
||||
}
|
||||
|
||||
// recordAutoHTTPSRedirectAddress stores redirect destinations for one domain
|
||||
// using a single winning port while keeping all bind addresses on that port.
|
||||
//
|
||||
// This is needed to avoid two opposite regressions in auto-HTTPS redirects:
|
||||
// preserve all listener addresses when a site binds multiple addresses on the
|
||||
// same HTTPS port, but do not mix in alternate HTTPS ports when the canonical
|
||||
// app HTTPS port is also available.
|
||||
func (app *App) recordAutoHTTPSRedirectAddress(redirDomains map[string][]caddy.NetworkAddress, domain string, addr caddy.NetworkAddress) {
|
||||
existing := redirDomains[domain]
|
||||
if len(existing) == 0 {
|
||||
redirDomains[domain] = []caddy.NetworkAddress{addr}
|
||||
return
|
||||
}
|
||||
|
||||
existingPort := existing[0].StartPort
|
||||
if addr.StartPort != existingPort {
|
||||
if addr.StartPort == uint(app.httpsPort()) && existingPort != uint(app.httpsPort()) {
|
||||
redirDomains[domain] = []caddy.NetworkAddress{addr}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
if slices.Contains(existing, addr) {
|
||||
return
|
||||
}
|
||||
|
||||
redirDomains[domain] = append(existing, addr)
|
||||
}
|
||||
|
||||
func (app *App) makeRedirRoute(redirToPort uint, matcherSet MatcherSet) Route {
|
||||
redirTo := "https://{http.request.host}"
|
||||
|
||||
@@ -555,7 +497,8 @@ func (app *App) makeRedirRoute(redirToPort uint, matcherSet MatcherSet) Route {
|
||||
if redirToPort != uint(app.httpPort()) &&
|
||||
redirToPort != uint(app.httpsPort()) &&
|
||||
redirToPort != DefaultHTTPPort &&
|
||||
redirToPort != DefaultHTTPSPort {
|
||||
redirToPort != DefaultHTTPSPort &&
|
||||
redirToPort > 0 {
|
||||
redirTo += ":" + strconv.Itoa(int(redirToPort))
|
||||
}
|
||||
|
||||
@@ -574,20 +517,6 @@ func (app *App) makeRedirRoute(redirToPort uint, matcherSet MatcherSet) Route {
|
||||
}
|
||||
}
|
||||
|
||||
func httpsRRALPNs(srv *Server) []string {
|
||||
alpn := make(map[string]struct{}, 3)
|
||||
if srv.protocol("h3") {
|
||||
alpn["h3"] = struct{}{}
|
||||
}
|
||||
if srv.protocol("h2") {
|
||||
alpn["h2"] = struct{}{}
|
||||
}
|
||||
if srv.protocol("h1") {
|
||||
alpn["http/1.1"] = struct{}{}
|
||||
}
|
||||
return caddytls.OrderedHTTPSRRALPN(alpn)
|
||||
}
|
||||
|
||||
// createAutomationPolicies ensures that automated certificates for this
|
||||
// app are managed properly. This adds up to two automation policies:
|
||||
// one for the public names, and one for the internal names. If a catch-all
|
||||
@@ -652,27 +581,6 @@ func (app *App) createAutomationPolicies(ctx caddy.Context, internalNames, tails
|
||||
}
|
||||
}
|
||||
|
||||
// Ensure automation policies' CertMagic configs are rebuilt when
|
||||
// ACME issuer templates may have been modified above (for example,
|
||||
// alternate ports filled in by the HTTP app). If a policy is already
|
||||
// provisioned, perform a lightweight rebuild of the CertMagic config
|
||||
// so issuers receive SetConfig with the updated templates; otherwise
|
||||
// run a normal Provision to initialize the policy.
|
||||
for i, ap := range app.tlsApp.Automation.Policies {
|
||||
// If the policy is already provisioned, rebuild only the CertMagic
|
||||
// config so issuers get SetConfig with updated templates. Otherwise
|
||||
// provision the policy normally (which may load modules).
|
||||
if ap.IsProvisioned() {
|
||||
if err := ap.RebuildCertMagic(app.tlsApp); err != nil {
|
||||
return fmt.Errorf("rebuilding certmagic config for automation policy %d: %v", i, err)
|
||||
}
|
||||
} else {
|
||||
if err := ap.Provision(app.tlsApp); err != nil {
|
||||
return fmt.Errorf("provisioning automation policy %d after auto-HTTPS defaults: %v", i, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if basePolicy == nil {
|
||||
// no base policy found; we will make one
|
||||
basePolicy = new(caddytls.AutomationPolicy)
|
||||
@@ -886,26 +794,3 @@ func isTailscaleDomain(name string) bool {
|
||||
}
|
||||
|
||||
type acmeCapable interface{ GetACMEIssuer() *caddytls.ACMEIssuer }
|
||||
|
||||
// getFirstHostFromRoute traverses a route's matchers to find the Host rule.
|
||||
// Since we are dealing with internally generated redirect routes, the host
|
||||
// is typically the first string within the MatchHost.
|
||||
func getFirstHostFromRoute(r Route) string {
|
||||
for _, matcherSet := range r.MatcherSets {
|
||||
for _, m := range matcherSet {
|
||||
// Check if the matcher is of type MatchHost (value or pointer)
|
||||
switch hm := m.(type) {
|
||||
case MatchHost:
|
||||
if len(hm) > 0 {
|
||||
return hm[0]
|
||||
}
|
||||
case *MatchHost:
|
||||
if len(*hm) > 0 {
|
||||
return (*hm)[0]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// Return an empty string if it's a catch-all route (no specific host)
|
||||
return ""
|
||||
}
|
||||
|
||||
@@ -1,47 +0,0 @@
|
||||
package caddyhttp
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestHTTPSRRALPNsDefaultProtocols(t *testing.T) {
|
||||
srv := &Server{}
|
||||
|
||||
got := httpsRRALPNs(srv)
|
||||
want := []string{"h3", "h2", "http/1.1"}
|
||||
|
||||
if !reflect.DeepEqual(got, want) {
|
||||
t.Fatalf("unexpected ALPN values: got %v want %v", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestHTTPSRRALPNsListenProtocolOverrides(t *testing.T) {
|
||||
srv := &Server{
|
||||
Protocols: []string{"h1", "h2"},
|
||||
ListenProtocols: [][]string{
|
||||
{"h1"},
|
||||
nil,
|
||||
{},
|
||||
{"h3", ""},
|
||||
},
|
||||
}
|
||||
|
||||
got := httpsRRALPNs(srv)
|
||||
want := []string{"h3", "h2", "http/1.1"}
|
||||
|
||||
if !reflect.DeepEqual(got, want) {
|
||||
t.Fatalf("unexpected ALPN values: got %v want %v", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestHTTPSRRALPNsIgnoresH2COnly(t *testing.T) {
|
||||
srv := &Server{
|
||||
Protocols: []string{"h2c"},
|
||||
}
|
||||
|
||||
got := httpsRRALPNs(srv)
|
||||
if len(got) != 0 {
|
||||
t.Fatalf("unexpected ALPN values: got %v want none", got)
|
||||
}
|
||||
}
|
||||
@@ -19,7 +19,7 @@ import (
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
weakrand "math/rand/v2"
|
||||
weakrand "math/rand"
|
||||
"net/http"
|
||||
"strings"
|
||||
"sync"
|
||||
@@ -244,7 +244,7 @@ func (c *Cache) makeRoom() {
|
||||
// strategy; generating random numbers is cheap and
|
||||
// ensures a much better distribution.
|
||||
//nolint:gosec
|
||||
rnd := weakrand.IntN(len(c.cache))
|
||||
rnd := weakrand.Intn(len(c.cache))
|
||||
i := 0
|
||||
for key := range c.cache {
|
||||
if i == rnd {
|
||||
@@ -287,7 +287,7 @@ type Account struct {
|
||||
|
||||
// The user's hashed password, in Modular Crypt Format (with `$` prefix)
|
||||
// or base64-encoded.
|
||||
Password string `json:"password"` //nolint:gosec // false positive, this is a hashed password
|
||||
Password string `json:"password"`
|
||||
|
||||
password []byte
|
||||
}
|
||||
|
||||
@@ -412,12 +412,10 @@ func CELMatcherImpl(macroName, funcName string, matcherDataTypes []*cel.Type, fa
|
||||
return nil, fmt.Errorf("unsupported matcher data type: %s, %s", matcherDataTypes[0], matcherDataTypes[1])
|
||||
}
|
||||
case 3:
|
||||
// nolint:gosec // false positive, impossible to be out of bounds; see: https://github.com/securego/gosec/issues/1525
|
||||
if matcherDataTypes[0] == cel.StringType && matcherDataTypes[1] == cel.StringType && matcherDataTypes[2] == cel.StringType {
|
||||
macro = parser.NewGlobalMacro(macroName, 3, celMatcherStringListMacroExpander(funcName))
|
||||
matcherDataTypes = []*cel.Type{cel.ListType(cel.StringType)}
|
||||
} else {
|
||||
// nolint:gosec // false positive, impossible to be out of bounds; see: https://github.com/securego/gosec/issues/1525
|
||||
return nil, fmt.Errorf("unsupported matcher data type: %s, %s, %s", matcherDataTypes[0], matcherDataTypes[1], matcherDataTypes[2])
|
||||
}
|
||||
}
|
||||
@@ -667,29 +665,12 @@ func celMatcherJSONMacroExpander(funcName string) parser.MacroExpander {
|
||||
// map literals containing heterogeneous values, in this case string and list
|
||||
// of string.
|
||||
func CELValueToMapStrList(data ref.Val) (map[string][]string, error) {
|
||||
// Prefer map[string]any, but newer cel-go versions may return map[any]any
|
||||
mapStrType := reflect.TypeFor[map[string]any]()
|
||||
mapStrRaw, err := data.ConvertToNative(mapStrType)
|
||||
var mapStrIface map[string]any
|
||||
if err != nil {
|
||||
// Try map[any]any and convert keys to strings
|
||||
mapAnyType := reflect.TypeFor[map[any]any]()
|
||||
mapAnyRaw, err2 := data.ConvertToNative(mapAnyType)
|
||||
if err2 != nil {
|
||||
return nil, err
|
||||
}
|
||||
mapAnyIface := mapAnyRaw.(map[any]any)
|
||||
mapStrIface = make(map[string]any, len(mapAnyIface))
|
||||
for k, v := range mapAnyIface {
|
||||
ks, ok := k.(string)
|
||||
if !ok {
|
||||
return nil, fmt.Errorf("unsupported map key type in header match: %T", k)
|
||||
}
|
||||
mapStrIface[ks] = v
|
||||
}
|
||||
} else {
|
||||
mapStrIface = mapStrRaw.(map[string]any)
|
||||
return nil, err
|
||||
}
|
||||
mapStrIface := mapStrRaw.(map[string]any)
|
||||
mapStrListStr := make(map[string][]string, len(mapStrIface))
|
||||
for k, v := range mapStrIface {
|
||||
switch val := v.(type) {
|
||||
@@ -704,26 +685,13 @@ func CELValueToMapStrList(data ref.Val) (map[string][]string, error) {
|
||||
for i, elem := range val {
|
||||
strVal, ok := elem.(types.String)
|
||||
if !ok {
|
||||
return nil, fmt.Errorf("unsupported value type in matcher input: %T", val)
|
||||
return nil, fmt.Errorf("unsupported value type in header match: %T", val)
|
||||
}
|
||||
convVals[i] = string(strVal)
|
||||
}
|
||||
mapStrListStr[k] = convVals
|
||||
case []any:
|
||||
convVals := make([]string, len(val))
|
||||
for i, elem := range val {
|
||||
switch e := elem.(type) {
|
||||
case string:
|
||||
convVals[i] = e
|
||||
case types.String:
|
||||
convVals[i] = string(e)
|
||||
default:
|
||||
return nil, fmt.Errorf("unsupported element type in matcher input list: %T", elem)
|
||||
}
|
||||
}
|
||||
mapStrListStr[k] = convVals
|
||||
default:
|
||||
return nil, fmt.Errorf("unsupported value type in matcher input: %T", val)
|
||||
return nil, fmt.Errorf("unsupported value type in header match: %T", val)
|
||||
}
|
||||
}
|
||||
return mapStrListStr, nil
|
||||
|
||||
@@ -41,10 +41,7 @@ func parseCaddyfile(h httpcaddyfile.Helper) (caddyhttp.MiddlewareHandler, error)
|
||||
//
|
||||
// encode [<matcher>] <formats...> {
|
||||
// gzip [<level>]
|
||||
// zstd [<level>] {
|
||||
// level <level>
|
||||
// disable_checksum
|
||||
// }
|
||||
// zstd
|
||||
// minimum_length <length>
|
||||
// # response matcher block
|
||||
// match {
|
||||
|
||||
@@ -33,10 +33,6 @@ type Zstd struct {
|
||||
// The compression level. Accepted values: fastest, better, best, default.
|
||||
Level string `json:"level,omitempty"`
|
||||
|
||||
// Whether to include the optional 4-byte zstd frame checksum trailer.
|
||||
// If unset, the upstream zstd library default is preserved.
|
||||
Checksum *bool `json:"checksum,omitempty"`
|
||||
|
||||
// Compression level refer to type constants value from zstd.SpeedFastest to zstd.SpeedBestCompression
|
||||
level zstd.EncoderLevel
|
||||
}
|
||||
@@ -52,48 +48,19 @@ func (Zstd) CaddyModule() caddy.ModuleInfo {
|
||||
// UnmarshalCaddyfile sets up the handler from Caddyfile tokens.
|
||||
func (z *Zstd) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
|
||||
d.Next() // consume option name
|
||||
args := d.RemainingArgs()
|
||||
switch len(args) {
|
||||
case 0:
|
||||
case 1:
|
||||
if _, err := parseEncoderLevel(args[0]); err != nil {
|
||||
return d.Err(err.Error())
|
||||
}
|
||||
z.Level = args[0]
|
||||
default:
|
||||
return d.ArgErr()
|
||||
if !d.NextArg() {
|
||||
return nil
|
||||
}
|
||||
|
||||
for nesting := d.Nesting(); d.NextBlock(nesting); {
|
||||
switch d.Val() {
|
||||
case "level":
|
||||
args := d.RemainingArgs()
|
||||
if len(args) != 1 {
|
||||
return d.ArgErr()
|
||||
}
|
||||
if z.Level != "" {
|
||||
return d.Err("compression level already specified")
|
||||
}
|
||||
if _, err := parseEncoderLevel(args[0]); err != nil {
|
||||
return d.Err(err.Error())
|
||||
}
|
||||
z.Level = args[0]
|
||||
|
||||
case "disable_checksum":
|
||||
if d.NextArg() {
|
||||
return d.ArgErr()
|
||||
}
|
||||
if z.Checksum != nil {
|
||||
return d.Err("checksum already specified")
|
||||
}
|
||||
disabled := false
|
||||
z.Checksum = &disabled
|
||||
|
||||
default:
|
||||
return d.Errf("unknown subdirective '%s'", d.Val())
|
||||
}
|
||||
levelStr := d.Val()
|
||||
if ok, _ := zstd.EncoderLevelFromString(levelStr); !ok {
|
||||
return d.Errf("unexpected compression level, use one of '%s', '%s', '%s', '%s'",
|
||||
zstd.SpeedFastest,
|
||||
zstd.SpeedBetterCompression,
|
||||
zstd.SpeedBestCompression,
|
||||
zstd.SpeedDefault,
|
||||
)
|
||||
}
|
||||
|
||||
z.Level = levelStr
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -102,11 +69,15 @@ func (z *Zstd) Provision(ctx caddy.Context) error {
|
||||
if z.Level == "" {
|
||||
z.Level = zstd.SpeedDefault.String()
|
||||
}
|
||||
level, err := parseEncoderLevel(z.Level)
|
||||
if err != nil {
|
||||
return err
|
||||
var ok bool
|
||||
if ok, z.level = zstd.EncoderLevelFromString(z.Level); !ok {
|
||||
return fmt.Errorf("unexpected compression level, use one of '%s', '%s', '%s', '%s'",
|
||||
zstd.SpeedFastest,
|
||||
zstd.SpeedDefault,
|
||||
zstd.SpeedBetterCompression,
|
||||
zstd.SpeedBestCompression,
|
||||
)
|
||||
}
|
||||
z.level = level
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -119,45 +90,14 @@ func (z Zstd) NewEncoder() encode.Encoder {
|
||||
// The default of 8MB for the window is
|
||||
// too large for many clients, so we limit
|
||||
// it to 128K to lighten their load.
|
||||
writer, _ := zstd.NewWriter(nil, z.writerOptions(128<<10)...)
|
||||
return writer
|
||||
}
|
||||
|
||||
func (z Zstd) writerOptions(windowSize int) []zstd.EOption {
|
||||
opts := []zstd.EOption{
|
||||
zstd.WithWindowSize(windowSize),
|
||||
writer, _ := zstd.NewWriter(
|
||||
nil,
|
||||
zstd.WithWindowSize(128<<10),
|
||||
zstd.WithEncoderConcurrency(1),
|
||||
zstd.WithZeroFrames(true),
|
||||
zstd.WithEncoderLevel(z.encoderLevel()),
|
||||
}
|
||||
if z.Checksum != nil {
|
||||
opts = append(opts, zstd.WithEncoderCRC(*z.Checksum))
|
||||
}
|
||||
return opts
|
||||
}
|
||||
|
||||
func (z Zstd) encoderLevel() zstd.EncoderLevel {
|
||||
if z.level != 0 {
|
||||
return z.level
|
||||
}
|
||||
if z.Level != "" {
|
||||
if level, err := parseEncoderLevel(z.Level); err == nil {
|
||||
return level
|
||||
}
|
||||
}
|
||||
return zstd.SpeedDefault
|
||||
}
|
||||
|
||||
func parseEncoderLevel(level string) (zstd.EncoderLevel, error) {
|
||||
if ok, encLevel := zstd.EncoderLevelFromString(level); ok {
|
||||
return encLevel, nil
|
||||
}
|
||||
return 0, fmt.Errorf("unexpected compression level, use one of '%s', '%s', '%s', '%s'",
|
||||
zstd.SpeedFastest,
|
||||
zstd.SpeedBetterCompression,
|
||||
zstd.SpeedBestCompression,
|
||||
zstd.SpeedDefault,
|
||||
zstd.WithEncoderLevel(z.level),
|
||||
)
|
||||
return writer
|
||||
}
|
||||
|
||||
// Interface guards
|
||||
|
||||
@@ -17,7 +17,7 @@ package caddyhttp
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
weakrand "math/rand/v2"
|
||||
weakrand "math/rand"
|
||||
"path"
|
||||
"runtime"
|
||||
"strings"
|
||||
@@ -98,7 +98,7 @@ func randString(n int, sameCase bool) string {
|
||||
b := make([]byte, n)
|
||||
for i := range b {
|
||||
//nolint:gosec
|
||||
b[i] = dict[weakrand.IntN(len(dict))]
|
||||
b[i] = dict[weakrand.Int63()%int64(len(dict))]
|
||||
}
|
||||
return string(b)
|
||||
}
|
||||
|
||||
@@ -169,7 +169,6 @@ func (fsrv *FileServer) serveBrowse(fileSystem fs.FS, root, dirPath string, w ht
|
||||
|
||||
// Actual files
|
||||
for _, item := range listing.Items {
|
||||
//nolint:gosec // not sure how this could be XSS unless you lose control of the file system (like aren't sanitizing) and client ignores Content-Type of text/plain
|
||||
if _, err := fmt.Fprintf(writer, "%s\t%s\t%s\n",
|
||||
item.Name, item.HumanSize(), item.HumanModTime("January 2, 2006 at 15:04:05"),
|
||||
); err != nil {
|
||||
@@ -281,13 +280,7 @@ func (fsrv *FileServer) browseApplyQueryParams(w http.ResponseWriter, r *http.Re
|
||||
sortParam = sortCookie.Value
|
||||
}
|
||||
case sortByName, sortByNameDirFirst, sortBySize, sortByTime:
|
||||
http.SetCookie(w, &http.Cookie{ //nolint:gosec // Secure depends on whether the request itself used TLS
|
||||
Name: "sort",
|
||||
Value: sortParam,
|
||||
Secure: r.TLS != nil,
|
||||
HttpOnly: true,
|
||||
SameSite: http.SameSiteLaxMode,
|
||||
})
|
||||
http.SetCookie(w, &http.Cookie{Name: "sort", Value: sortParam, Secure: r.TLS != nil})
|
||||
}
|
||||
|
||||
// then figure out the order
|
||||
@@ -298,13 +291,7 @@ func (fsrv *FileServer) browseApplyQueryParams(w http.ResponseWriter, r *http.Re
|
||||
orderParam = orderCookie.Value
|
||||
}
|
||||
case sortOrderAsc, sortOrderDesc:
|
||||
http.SetCookie(w, &http.Cookie{ //nolint:gosec // Secure depends on whether the request itself used TLS
|
||||
Name: "order",
|
||||
Value: orderParam,
|
||||
Secure: r.TLS != nil,
|
||||
HttpOnly: true,
|
||||
SameSite: http.SameSiteLaxMode,
|
||||
})
|
||||
http.SetCookie(w, &http.Cookie{Name: "order", Value: orderParam, Secure: r.TLS != nil})
|
||||
}
|
||||
|
||||
// finally, apply the sorting and limiting
|
||||
|
||||
@@ -20,6 +20,7 @@ import (
|
||||
"net/url"
|
||||
"os"
|
||||
"path"
|
||||
"path/filepath"
|
||||
"slices"
|
||||
"sort"
|
||||
"strconv"
|
||||
@@ -99,7 +100,7 @@ func (fsrv *FileServer) directoryListing(ctx context.Context, fileSystem fs.FS,
|
||||
}
|
||||
|
||||
if fsrv.Browse.RevealSymlinks {
|
||||
symLinkTarget, err := os.Readlink(path)
|
||||
symLinkTarget, err := filepath.EvalSymlinks(path)
|
||||
if err == nil {
|
||||
symlinkPath = symLinkTarget
|
||||
}
|
||||
|
||||
@@ -720,7 +720,6 @@ var globSafeRepl = strings.NewReplacer(
|
||||
"*", "\\*",
|
||||
"[", "\\[",
|
||||
"?", "\\?",
|
||||
"\\", "\\\\",
|
||||
)
|
||||
|
||||
const (
|
||||
|
||||
@@ -20,24 +20,14 @@ import (
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/caddyserver/caddy/v2"
|
||||
"github.com/caddyserver/caddy/v2/internal/filesystems"
|
||||
"github.com/caddyserver/caddy/v2/modules/caddyhttp"
|
||||
"github.com/caddyserver/caddy/v2/modules/caddyhttp/rewrite"
|
||||
)
|
||||
|
||||
type testCase struct {
|
||||
path string
|
||||
expectedPath string
|
||||
expectedType string
|
||||
matched bool
|
||||
}
|
||||
|
||||
func TestFileMatcher(t *testing.T) {
|
||||
// Windows doesn't like colons in files names
|
||||
isWindows := runtime.GOOS == "windows"
|
||||
@@ -55,7 +45,12 @@ func TestFileMatcher(t *testing.T) {
|
||||
f.Close()
|
||||
}
|
||||
|
||||
for i, tc := range []testCase{
|
||||
for i, tc := range []struct {
|
||||
path string
|
||||
expectedPath string
|
||||
expectedType string
|
||||
matched bool
|
||||
}{
|
||||
{
|
||||
path: "/foo.txt",
|
||||
expectedPath: "/foo.txt",
|
||||
@@ -121,170 +116,44 @@ func TestFileMatcher(t *testing.T) {
|
||||
matched: !isWindows,
|
||||
},
|
||||
} {
|
||||
fileMatcherTest(t, i, tc)
|
||||
}
|
||||
}
|
||||
m := &MatchFile{
|
||||
fsmap: &filesystems.FileSystemMap{},
|
||||
Root: "./testdata",
|
||||
TryFiles: []string{"{http.request.uri.path}", "{http.request.uri.path}/"},
|
||||
}
|
||||
|
||||
func TestFileMatcherNonWindows(t *testing.T) {
|
||||
if runtime.GOOS == "windows" {
|
||||
return
|
||||
}
|
||||
u, err := url.Parse(tc.path)
|
||||
if err != nil {
|
||||
t.Errorf("Test %d: parsing path: %v", i, err)
|
||||
}
|
||||
|
||||
// this is impossible to test on Windows, but tests a security patch for other platforms
|
||||
tc := testCase{
|
||||
path: "/foodir/secr%5Cet.txt",
|
||||
expectedPath: "/foodir/secr\\et.txt",
|
||||
expectedType: "file",
|
||||
matched: true,
|
||||
}
|
||||
req := &http.Request{URL: u}
|
||||
repl := caddyhttp.NewTestReplacer(req)
|
||||
|
||||
f, err := os.Create(filepath.Join("testdata", strings.TrimPrefix(tc.expectedPath, "/")))
|
||||
if err != nil {
|
||||
t.Fatalf("could not create test file: %v", err)
|
||||
}
|
||||
defer f.Close()
|
||||
defer os.Remove(f.Name())
|
||||
result, err := m.MatchWithError(req)
|
||||
if err != nil {
|
||||
t.Errorf("Test %d: unexpected error: %v", i, err)
|
||||
}
|
||||
if result != tc.matched {
|
||||
t.Errorf("Test %d: expected match=%t, got %t", i, tc.matched, result)
|
||||
}
|
||||
|
||||
fileMatcherTest(t, 0, tc)
|
||||
}
|
||||
rel, ok := repl.Get("http.matchers.file.relative")
|
||||
if !ok && result {
|
||||
t.Errorf("Test %d: expected replacer value", i)
|
||||
}
|
||||
if !result {
|
||||
continue
|
||||
}
|
||||
|
||||
func fileMatcherTest(t *testing.T, i int, tc testCase) {
|
||||
m := &MatchFile{
|
||||
fsmap: &filesystems.FileSystemMap{},
|
||||
Root: "./testdata",
|
||||
TryFiles: []string{"{http.request.uri.path}", "{http.request.uri.path}/"},
|
||||
}
|
||||
if rel != tc.expectedPath {
|
||||
t.Errorf("Test %d: actual path: %v, expected: %v", i, rel, tc.expectedPath)
|
||||
}
|
||||
|
||||
u, err := url.Parse(tc.path)
|
||||
if err != nil {
|
||||
t.Errorf("Test %d: parsing path: %v", i, err)
|
||||
}
|
||||
|
||||
req := &http.Request{URL: u}
|
||||
repl := caddyhttp.NewTestReplacer(req)
|
||||
|
||||
result, err := m.MatchWithError(req)
|
||||
if err != nil {
|
||||
t.Errorf("Test %d: unexpected error: %v", i, err)
|
||||
}
|
||||
if result != tc.matched {
|
||||
t.Errorf("Test %d: expected match=%t, got %t", i, tc.matched, result)
|
||||
}
|
||||
|
||||
rel, ok := repl.Get("http.matchers.file.relative")
|
||||
if !ok && result {
|
||||
t.Errorf("Test %d: expected replacer value", i)
|
||||
}
|
||||
if !result {
|
||||
return
|
||||
}
|
||||
|
||||
if rel != tc.expectedPath {
|
||||
t.Errorf("Test %d: actual path: %v, expected: %v", i, rel, tc.expectedPath)
|
||||
}
|
||||
|
||||
fileType, _ := repl.Get("http.matchers.file.type")
|
||||
if fileType != tc.expectedType {
|
||||
t.Errorf("Test %d: actual file type: %v, expected: %v", i, fileType, tc.expectedType)
|
||||
}
|
||||
}
|
||||
|
||||
func TestTryFilesRewriteEscapesMatchedPath(t *testing.T) {
|
||||
root := t.TempDir()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
requestTarget string
|
||||
filename string
|
||||
extraFiles []string
|
||||
wantPath string
|
||||
wantRequestURI string
|
||||
skipWindows bool
|
||||
}{
|
||||
{
|
||||
name: "question mark in path",
|
||||
requestTarget: "/%3F.html",
|
||||
filename: "?.html",
|
||||
wantPath: "/?.html",
|
||||
wantRequestURI: "/%3F.html",
|
||||
skipWindows: true,
|
||||
},
|
||||
{
|
||||
name: "percent in path",
|
||||
requestTarget: "/%25.html",
|
||||
filename: "%.html",
|
||||
wantPath: "/%.html",
|
||||
wantRequestURI: "/%25.html",
|
||||
},
|
||||
{
|
||||
name: "encoded question mark remains percent-encoded",
|
||||
requestTarget: "/%253F.html",
|
||||
filename: "%3F.html",
|
||||
wantPath: "/%3F.html",
|
||||
wantRequestURI: "/%253F.html",
|
||||
},
|
||||
{
|
||||
name: "question mark in nested path",
|
||||
requestTarget: "/nested/%3F.html",
|
||||
filename: filepath.Join("nested", "?.html"),
|
||||
wantPath: "/nested/?.html",
|
||||
wantRequestURI: "/nested/%3F.html",
|
||||
skipWindows: true,
|
||||
},
|
||||
{
|
||||
name: "encoded slash in filename does not conflict with nesting",
|
||||
requestTarget: "/nested%252Ffile.html",
|
||||
filename: "nested%2Ffile.html",
|
||||
extraFiles: []string{filepath.Join("nested", "file.html")},
|
||||
wantPath: "/nested%2Ffile.html",
|
||||
wantRequestURI: "/nested%252Ffile.html",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range tests {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
if tc.skipWindows && runtime.GOOS == "windows" {
|
||||
t.Skip("Windows file names cannot contain question marks")
|
||||
}
|
||||
|
||||
for _, name := range append([]string{tc.filename}, tc.extraFiles...) {
|
||||
filename := filepath.Join(root, name)
|
||||
if err := os.MkdirAll(filepath.Dir(filename), 0o700); err != nil {
|
||||
t.Fatalf("creating test file parent directory: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(filename, []byte(name), 0o600); err != nil {
|
||||
t.Fatalf("writing test file: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
m := &MatchFile{
|
||||
fsmap: &filesystems.FileSystemMap{},
|
||||
Root: root,
|
||||
TryFiles: []string{"{http.request.uri.path}"},
|
||||
}
|
||||
req := httptest.NewRequest(http.MethodGet, "http://example.com"+tc.requestTarget, nil)
|
||||
repl := caddyhttp.NewTestReplacer(req)
|
||||
|
||||
matched, err := m.MatchWithError(req)
|
||||
if err != nil {
|
||||
t.Fatalf("matching file: %v", err)
|
||||
}
|
||||
if !matched {
|
||||
t.Fatalf("expected request %s to match %s", tc.requestTarget, tc.filename)
|
||||
}
|
||||
|
||||
rewrite.Rewrite{URI: "{http.matchers.file.relative}"}.Rewrite(req, repl)
|
||||
|
||||
if req.URL.Path != tc.wantPath {
|
||||
t.Errorf("rewritten path = %q, want %q", req.URL.Path, tc.wantPath)
|
||||
}
|
||||
if req.RequestURI != tc.wantRequestURI {
|
||||
t.Errorf("rewritten request URI = %q, want %q", req.RequestURI, tc.wantRequestURI)
|
||||
}
|
||||
if req.URL.RawQuery != "" {
|
||||
t.Errorf("rewritten raw query = %q, want empty", req.URL.RawQuery)
|
||||
}
|
||||
})
|
||||
fileType, _ := repl.Get("http.matchers.file.type")
|
||||
if fileType != tc.expectedType {
|
||||
t.Errorf("Test %d: actual file type: %v, expected: %v", i, fileType, tc.expectedType)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user