Skip to content

Commit

Permalink
httpcaddyfile: Empty tls policy for internal http localhost (#4398)
Browse files Browse the repository at this point in the history
* test: replicated empty tls automation policy issue

* fix: empty tls policy for an http:// endpoint running on a non-standard http port
  • Loading branch information
Easen authored Oct 26, 2021
1 parent 997e41d commit 012d235
Show file tree
Hide file tree
Showing 2 changed files with 99 additions and 1 deletion.
2 changes: 1 addition & 1 deletion caddyconfig/httpcaddyfile/directives.go
Original file line number Diff line number Diff line change
Expand Up @@ -485,7 +485,7 @@ func (sb serverBlock) hostsFromKeysNotHTTP(httpPort string) []string {
if addr.Host == "" {
continue
}
if addr.Scheme != "http" && addr.Port != httpPort {
if addr.Scheme != "http" || addr.Port != httpPort {
hostMap[addr.Host] = struct{}{}
}
}
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
# (this Caddyfile is contrived, but based on issues #4176 and #4198)

http://example.com {
}

https://example.com {
tls abc@example.com
}

http://localhost:8081 {
}

----------
{
"apps": {
"http": {
"servers": {
"srv0": {
"listen": [
":443"
],
"routes": [
{
"match": [
{
"host": [
"example.com"
]
}
],
"terminal": true
}
]
},
"srv1": {
"listen": [
":80"
],
"routes": [
{
"match": [
{
"host": [
"example.com"
]
}
],
"terminal": true
}
]
},
"srv2": {
"listen": [
":8081"
],
"routes": [
{
"match": [
{
"host": [
"localhost"
]
}
],
"terminal": true
}
],
"automatic_https": {
"skip": [
"localhost"
]
}
}
}
},
"tls": {
"automation": {
"policies": [
{
"subjects": [
"example.com"
],
"issuers": [
{
"email": "abc@example.com",
"module": "acme"
},
{
"email": "abc@example.com",
"module": "zerossl"
}
]
}
]
}
}
}
}

0 comments on commit 012d235

Please sign in to comment.