Browse Source
* httpcaddyfile: Revise automation policy generation This should fix a frustrating edge case where wildcard subjects are used, which potentially get shadowed by more specific versions of themselves; see the new tests for an example. This change is motivated by an actual customer requirement. Although all the tests pass, this logic is incredibly complex and nuanced, and I'm worried it is not correct. But it took me about 4 days to get this far on a solution. I did my best. * Fix typomaster
Matt Holt
4 years ago
committed by
GitHub
3 changed files with 301 additions and 130 deletions
@ -0,0 +1,56 @@ |
|||
package httpcaddyfile |
|||
|
|||
import ( |
|||
"testing" |
|||
|
|||
"github.com/caddyserver/caddy/v2/modules/caddytls" |
|||
) |
|||
|
|||
func TestAutomationPolicyIsSubset(t *testing.T) { |
|||
for i, test := range []struct { |
|||
a, b []string |
|||
expect bool |
|||
}{ |
|||
{ |
|||
a: []string{"example.com"}, |
|||
b: []string{}, |
|||
expect: true, |
|||
}, |
|||
{ |
|||
a: []string{}, |
|||
b: []string{"example.com"}, |
|||
expect: false, |
|||
}, |
|||
{ |
|||
a: []string{"foo.example.com"}, |
|||
b: []string{"*.example.com"}, |
|||
expect: true, |
|||
}, |
|||
{ |
|||
a: []string{"foo.example.com"}, |
|||
b: []string{"foo.example.com"}, |
|||
expect: true, |
|||
}, |
|||
{ |
|||
a: []string{"foo.example.com"}, |
|||
b: []string{"example.com"}, |
|||
expect: false, |
|||
}, |
|||
{ |
|||
a: []string{"example.com", "foo.example.com"}, |
|||
b: []string{"*.com", "*.*.com"}, |
|||
expect: true, |
|||
}, |
|||
{ |
|||
a: []string{"example.com", "foo.example.com"}, |
|||
b: []string{"*.com"}, |
|||
expect: false, |
|||
}, |
|||
} { |
|||
apA := &caddytls.AutomationPolicy{Subjects: test.a} |
|||
apB := &caddytls.AutomationPolicy{Subjects: test.b} |
|||
if actual := automationPolicyIsSubset(apA, apB); actual != test.expect { |
|||
t.Errorf("Test %d: Expected %t but got %t (A: %v B: %v)", i, test.expect, actual, test.a, test.b) |
|||
} |
|||
} |
|||
} |
@ -0,0 +1,80 @@ |
|||
{ |
|||
local_certs |
|||
} |
|||
|
|||
*.tld, *.*.tld { |
|||
tls { |
|||
on_demand |
|||
} |
|||
} |
|||
|
|||
foo.tld, www.foo.tld { |
|||
} |
|||
---------- |
|||
{ |
|||
"apps": { |
|||
"http": { |
|||
"servers": { |
|||
"srv0": { |
|||
"listen": [ |
|||
":443" |
|||
], |
|||
"routes": [ |
|||
{ |
|||
"match": [ |
|||
{ |
|||
"host": [ |
|||
"foo.tld", |
|||
"www.foo.tld" |
|||
] |
|||
} |
|||
], |
|||
"terminal": true |
|||
}, |
|||
{ |
|||
"match": [ |
|||
{ |
|||
"host": [ |
|||
"*.tld", |
|||
"*.*.tld" |
|||
] |
|||
} |
|||
], |
|||
"terminal": true |
|||
} |
|||
] |
|||
} |
|||
} |
|||
}, |
|||
"tls": { |
|||
"automation": { |
|||
"policies": [ |
|||
{ |
|||
"subjects": [ |
|||
"foo.tld", |
|||
"www.foo.tld" |
|||
], |
|||
"issuer": { |
|||
"module": "internal" |
|||
} |
|||
}, |
|||
{ |
|||
"subjects": [ |
|||
"*.*.tld", |
|||
"*.tld" |
|||
], |
|||
"issuer": { |
|||
"module": "internal" |
|||
}, |
|||
"on_demand": true |
|||
}, |
|||
{ |
|||
"issuer": { |
|||
"module": "internal" |
|||
} |
|||
} |
|||
] |
|||
} |
|||
} |
|||
} |
|||
} |
Loading…
Reference in new issue