diff --git a/caddyconfig/httpcaddyfile/addresses.go b/caddyconfig/httpcaddyfile/addresses.go index f5fd6b682..654558567 100644 --- a/caddyconfig/httpcaddyfile/addresses.go +++ b/caddyconfig/httpcaddyfile/addresses.go @@ -106,12 +106,22 @@ func (st *ServerType) mapAddressToServerBlocks(originalServerBlocks []serverBloc // server block are only the ones which use the address; but // the contents (tokens) are of course the same for addr, keys := range addrToKeys { + // parse keys so that we only have to do it once + parsedKeys := make([]Address, 0, len(keys)) + for _, key := range keys { + addr, err := ParseAddress(key) + if err != nil { + return nil, fmt.Errorf("parsing key '%s': %v", key, err) + } + parsedKeys = append(parsedKeys, addr.Normalize()) + } sbmap[addr] = append(sbmap[addr], serverBlock{ block: caddyfile.ServerBlock{ Keys: keys, Segments: sblock.block.Segments, }, pile: sblock.pile, + keys: parsedKeys, }) } } @@ -165,7 +175,7 @@ func (st *ServerType) listenerAddrsForServerBlockKey(sblock serverBlock, key str // figure out the HTTP and HTTPS ports; either // use defaults, or override with user config - httpPort, httpsPort := strconv.Itoa(certmagic.HTTPPort), strconv.Itoa(certmagic.HTTPSPort) + httpPort, httpsPort := strconv.Itoa(caddyhttp.DefaultHTTPPort), strconv.Itoa(caddyhttp.DefaultHTTPSPort) if hport, ok := options["http_port"]; ok { httpPort = strconv.Itoa(hport.(int)) } diff --git a/caddyconfig/httpcaddyfile/directives.go b/caddyconfig/httpcaddyfile/directives.go index 4c2b2d91b..8fa48cd07 100644 --- a/caddyconfig/httpcaddyfile/directives.go +++ b/caddyconfig/httpcaddyfile/directives.go @@ -16,7 +16,9 @@ package httpcaddyfile import ( "encoding/json" + "net" "sort" + "strconv" "strings" "github.com/caddyserver/caddy/v2" @@ -381,12 +383,49 @@ func parseSegmentAsSubroute(h Helper) (caddyhttp.MiddlewareHandler, error) { return buildSubroute(allResults, h.groupCounter) } -// serverBlock pairs a Caddyfile server block -// with a "pile" of config values, keyed by class -// name. +// serverBlock pairs a Caddyfile server block with +// a "pile" of config values, keyed by class name, +// as well as its parsed keys for convenience. type serverBlock struct { block caddyfile.ServerBlock pile map[string][]ConfigValue // config values obtained from directives + keys []Address +} + +// hostsFromKeys returns a list of all the non-empty hostnames found in +// the keys of the server block sb, unless allowEmpty is true, in which +// case a key with no host (e.g. ":443") will be added to the list as an +// empty string. Otherwise, if allowEmpty is false, and if sb has a key +// that omits the hostname (i.e. is a catch-all/empty host), then the returned +// list is empty, because the server block effectively matches ALL hosts. +// The list may not be in a consistent order. If includePorts is true, then +// any non-empty, non-standard ports will be included. +func (sb serverBlock) hostsFromKeys(allowEmpty, includePorts bool) []string { + // first get each unique hostname + hostMap := make(map[string]struct{}) + for _, addr := range sb.keys { + if addr.Host == "" && !allowEmpty { + // server block contains a key like ":443", i.e. the host portion + // is empty / catch-all, which means to match all hosts + return []string{} + } + if includePorts && + addr.Port != "" && + addr.Port != strconv.Itoa(caddyhttp.DefaultHTTPPort) && + addr.Port != strconv.Itoa(caddyhttp.DefaultHTTPSPort) { + hostMap[net.JoinHostPort(addr.Host, addr.Port)] = struct{}{} + } else { + hostMap[addr.Host] = struct{}{} + } + } + + // convert map to slice + sblockHosts := make([]string, 0, len(hostMap)) + for host := range hostMap { + sblockHosts = append(sblockHosts, host) + } + + return sblockHosts } type ( diff --git a/caddyconfig/httpcaddyfile/httptype.go b/caddyconfig/httpcaddyfile/httptype.go index 4df5421af..7fbf7247f 100644 --- a/caddyconfig/httpcaddyfile/httptype.go +++ b/caddyconfig/httpcaddyfile/httptype.go @@ -17,7 +17,6 @@ package httpcaddyfile import ( "encoding/json" "fmt" - "net" "reflect" "sort" "strconv" @@ -320,47 +319,6 @@ func (ServerType) evaluateGlobalOptionsBlock(serverBlocks []serverBlock, options return serverBlocks[1:], nil } -// hostsFromServerBlockKeys returns a list of all the non-empty hostnames -// found in the keys of the server block sb, unless allowEmpty is true, in -// which case a key with no host (e.g. ":443") will be added to the list as -// an empty string. Otherwise, if allowEmpty is false, and if sb has a key -// that omits the hostname (i.e. is a catch-all/empty host), then the returned -// list is empty, because the server block effectively matches ALL hosts. -// The list may not be in a consistent order. If includePorts is true, then -// any non-empty, non-standard ports will be included. -func (st *ServerType) hostsFromServerBlockKeys(sb caddyfile.ServerBlock, allowEmpty, includePorts bool) ([]string, error) { - // first get each unique hostname - hostMap := make(map[string]struct{}) - for _, sblockKey := range sb.Keys { - addr, err := ParseAddress(sblockKey) - if err != nil { - return nil, fmt.Errorf("parsing server block key: %v", err) - } - addr = addr.Normalize() - if addr.Host == "" && !allowEmpty { - // server block contains a key like ":443", i.e. the host portion - // is empty / catch-all, which means to match all hosts - return []string{}, nil - } - if includePorts && - addr.Port != "" && - addr.Port != strconv.Itoa(caddyhttp.DefaultHTTPPort) && - addr.Port != strconv.Itoa(caddyhttp.DefaultHTTPSPort) { - hostMap[net.JoinHostPort(addr.Host, addr.Port)] = struct{}{} - } else { - hostMap[addr.Host] = struct{}{} - } - } - - // convert map to slice - sblockHosts := make([]string, 0, len(hostMap)) - for host := range hostMap { - sblockHosts = append(sblockHosts, host) - } - - return sblockHosts, nil -} - // serversFromPairings creates the servers for each pairing of addresses // to server blocks. Each pairing is essentially a server definition. func (st *ServerType) serversFromPairings( @@ -384,11 +342,10 @@ func (st *ServerType) serversFromPairings( // descending sort by length of host then path sort.SliceStable(p.serverBlocks, func(i, j int) bool { // TODO: we could pre-process the specificities for efficiency, - // but I don't expect many blocks will have SO many keys... + // but I don't expect many blocks will have THAT many keys... var iLongestPath, jLongestPath string var iLongestHost, jLongestHost string - for _, key := range p.serverBlocks[i].block.Keys { - addr, _ := ParseAddress(key) + for _, addr := range p.serverBlocks[i].keys { if specificity(addr.Host) > specificity(iLongestHost) { iLongestHost = addr.Host } @@ -396,8 +353,7 @@ func (st *ServerType) serversFromPairings( iLongestPath = addr.Path } } - for _, key := range p.serverBlocks[j].block.Keys { - addr, _ := ParseAddress(key) + for _, addr := range p.serverBlocks[j].keys { if specificity(addr.Host) > specificity(jLongestHost) { jLongestHost = addr.Host } @@ -415,15 +371,12 @@ func (st *ServerType) serversFromPairings( // create a subroute for each site in the server block for _, sblock := range p.serverBlocks { - matcherSetsEnc, err := st.compileEncodedMatcherSets(sblock.block) + matcherSetsEnc, err := st.compileEncodedMatcherSets(sblock) if err != nil { return nil, fmt.Errorf("server block %v: compiling matcher sets: %v", sblock.block.Keys, err) } - hosts, err := st.hostsFromServerBlockKeys(sblock.block, false, false) - if err != nil { - return nil, err - } + hosts := sblock.hostsFromKeys(false, false) // tls: connection policies if cpVals, ok := sblock.pile["tls.connection_policy"]; ok { @@ -455,12 +408,7 @@ func (st *ServerType) serversFromPairings( // exclude any hosts that were defined explicitly with // "http://" in the key from automated cert management (issue #2998) - for _, key := range sblock.block.Keys { - addr, err := ParseAddress(key) - if err != nil { - return nil, err - } - addr = addr.Normalize() + for _, addr := range sblock.keys { if addr.Scheme == "http" && addr.Host != "" { if srv.AutoHTTPS == nil { srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig) @@ -500,16 +448,19 @@ func (st *ServerType) serversFromPairings( LoggerNames: make(map[string]string), } } - hosts, err := st.hostsFromServerBlockKeys(sblock.block, true, true) - if err != nil { - return nil, err - } - for _, h := range hosts { + for _, h := range sblock.hostsFromKeys(true, true) { srv.Logs.LoggerNames[h] = ncl.name } } } + // a server cannot (natively) serve both HTTP and HTTPS at the + // same time, so make sure the configuration isn't in conflict + err := detectConflictingSchemes(srv, p.serverBlocks, options) + if err != nil { + return nil, err + } + // a catch-all TLS conn policy is necessary to ensure TLS can // be offered to all hostnames of the server; even though only // one policy is needed to enable TLS for the server, that @@ -527,7 +478,6 @@ func (st *ServerType) serversFromPairings( } // tidy things up a bit - var err error srv.TLSConnPolicies, err = consolidateConnPolicies(srv.TLSConnPolicies) if err != nil { return nil, fmt.Errorf("consolidating TLS connection policies for server %d: %v", i, err) @@ -540,6 +490,64 @@ func (st *ServerType) serversFromPairings( return servers, nil } +func detectConflictingSchemes(srv *caddyhttp.Server, serverBlocks []serverBlock, options map[string]interface{}) error { + httpPort := strconv.Itoa(caddyhttp.DefaultHTTPPort) + if hp, ok := options["http_port"].(int); ok { + httpPort = strconv.Itoa(hp) + } + httpsPort := strconv.Itoa(caddyhttp.DefaultHTTPSPort) + if hsp, ok := options["https_port"].(int); ok { + httpsPort = strconv.Itoa(hsp) + } + + var httpOrHTTPS string + checkAndSetHTTP := func(addr Address) error { + if httpOrHTTPS == "HTTPS" { + errMsg := fmt.Errorf("server listening on %v is configured for HTTPS and cannot natively multiplex HTTP and HTTPS: %s", + srv.Listen, addr.Original) + if addr.Scheme == "" && addr.Host == "" { + errMsg = fmt.Errorf("%s (try specifying https:// in the address)", errMsg) + } + return errMsg + } + if len(srv.TLSConnPolicies) > 0 { + // any connection policies created for an HTTP server + // is a logical conflict, as it would enable HTTPS + return fmt.Errorf("server listening on %v is HTTP, but attempts to configure TLS connection policies", srv.Listen) + } + httpOrHTTPS = "HTTP" + return nil + } + checkAndSetHTTPS := func(addr Address) error { + if httpOrHTTPS == "HTTP" { + return fmt.Errorf("server listening on %v is configured for HTTP and cannot natively multiplex HTTP and HTTPS: %s", + srv.Listen, addr.Original) + } + httpOrHTTPS = "HTTPS" + return nil + } + + for _, sblock := range serverBlocks { + for _, addr := range sblock.keys { + if addr.Scheme == "http" || addr.Port == httpPort { + if err := checkAndSetHTTP(addr); err != nil { + return err + } + } else if addr.Scheme == "https" || addr.Port == httpsPort { + if err := checkAndSetHTTPS(addr); err != nil { + return err + } + } else if addr.Host == "" { + if err := checkAndSetHTTP(addr); err != nil { + return err + } + } + } + } + + return nil +} + // consolidateConnPolicies combines TLS connection policies that are the same, // for a cleaner overall output. func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.ConnectionPolicies, error) { @@ -664,18 +672,34 @@ func appendSubrouteToRouteList(routeList caddyhttp.RouteList, matcherSetsEnc []caddy.ModuleMap, p sbAddrAssociation, warnings *[]caddyconfig.Warning) caddyhttp.RouteList { + + // nothing to do if... there's nothing to do + if len(matcherSetsEnc) == 0 && len(subroute.Routes) == 0 && subroute.Errors == nil { + return routeList + } + if len(matcherSetsEnc) == 0 && len(p.serverBlocks) == 1 { // no need to wrap the handlers in a subroute if this is // the only server block and there is no matcher for it routeList = append(routeList, subroute.Routes...) } else { - routeList = append(routeList, caddyhttp.Route{ - MatcherSetsRaw: matcherSetsEnc, - HandlersRaw: []json.RawMessage{ + route := caddyhttp.Route{ + // the semantics of a site block in the Caddyfile dictate + // that only the first matching one is evaluated, since + // site blocks do not cascade nor inherit + Terminal: true, + } + if len(matcherSetsEnc) > 0 { + route.MatcherSetsRaw = matcherSetsEnc + } + if len(subroute.Routes) > 0 || subroute.Errors != nil { + route.HandlersRaw = []json.RawMessage{ caddyconfig.JSONModuleObject(subroute, "handler", "subroute", warnings), - }, - Terminal: true, // only first matching site block should be evaluated - }) + } + } + if len(route.MatcherSetsRaw) > 0 || len(route.HandlersRaw) > 0 { + routeList = append(routeList, route) + } } return routeList } @@ -822,7 +846,7 @@ func matcherSetFromMatcherToken( return nil, false, nil } -func (st *ServerType) compileEncodedMatcherSets(sblock caddyfile.ServerBlock) ([]caddy.ModuleMap, error) { +func (st *ServerType) compileEncodedMatcherSets(sblock serverBlock) ([]caddy.ModuleMap, error) { type hostPathPair struct { hostm caddyhttp.MatchHost pathm caddyhttp.MatchPath @@ -832,13 +856,7 @@ func (st *ServerType) compileEncodedMatcherSets(sblock caddyfile.ServerBlock) ([ var matcherPairs []*hostPathPair var catchAllHosts bool - for _, key := range sblock.Keys { - addr, err := ParseAddress(key) - if err != nil { - return nil, fmt.Errorf("server block %v: parsing and standardizing address '%s': %v", sblock.Keys, key, err) - } - addr = addr.Normalize() - + for _, addr := range sblock.keys { // choose a matcher pair that should be shared by this // server block; if none exists yet, create one var chosenMatcherPair *hostPathPair @@ -905,7 +923,7 @@ func (st *ServerType) compileEncodedMatcherSets(sblock caddyfile.ServerBlock) ([ for _, ms := range matcherSets { msEncoded, err := encodeMatcherSet(ms) if err != nil { - return nil, fmt.Errorf("server block %v: %v", sblock.Keys, err) + return nil, fmt.Errorf("server block %v: %v", sblock.block.Keys, err) } matcherSetsEnc = append(matcherSetsEnc, msEncoded) } diff --git a/caddyconfig/httpcaddyfile/tlsapp.go b/caddyconfig/httpcaddyfile/tlsapp.go index db3d13b82..6214d61d3 100644 --- a/caddyconfig/httpcaddyfile/tlsapp.go +++ b/caddyconfig/httpcaddyfile/tlsapp.go @@ -43,26 +43,16 @@ func (st ServerType) buildTLSApp( hostsSharedWithHostlessKey := make(map[string]struct{}) for _, pair := range pairings { for _, sb := range pair.serverBlocks { - for _, key := range sb.block.Keys { - addr, err := ParseAddress(key) - if err != nil { - return nil, warnings, err - } - addr = addr.Normalize() + for _, addr := range sb.keys { if addr.Host == "" { serverBlocksWithHostlessKey++ // this server block has a hostless key, now // go through and add all the hosts to the set - for _, otherKey := range sb.block.Keys { - if otherKey == key { + for _, otherAddr := range sb.keys { + if otherAddr.Original == addr.Original { continue } - addr, err := ParseAddress(otherKey) - if err != nil { - return nil, warnings, err - } - addr = addr.Normalize() - if addr.Host != "" { + if otherAddr.Host != "" { hostsSharedWithHostlessKey[addr.Host] = struct{}{} } } @@ -82,10 +72,7 @@ func (st ServerType) buildTLSApp( // get values that populate an automation policy for this block var ap *caddytls.AutomationPolicy - sblockHosts, err := st.hostsFromServerBlockKeys(sblock.block, false, false) - if err != nil { - return nil, warnings, err - } + sblockHosts := sblock.hostsFromKeys(false, false) if len(sblockHosts) == 0 { ap = catchAllAP }