 Matthew Holt
					
					5 years ago
						Matthew Holt
					
					5 years ago
					
				 
				
			 
		 
		
			
				
					
					No known key found for this signature in database
					
						
							GPG Key ID: 2A349DD577D586A5
						
					
				
			
		
		
		
	
		
			
				 2 changed files with 
14 additions and 
3 deletions
			 
			
		 
		
			
				- 
					
					
					 
					modules/caddyhttp/app.go
				
- 
					
					
					 
					modules/caddytls/tls.go
				
				
				
					
						
							
								
									
	
		
			
				
					|  |  | @ -176,8 +176,8 @@ func (app *App) Provision(ctx caddy.Context) error { | 
			
		
	
		
			
				
					|  |  |  | 		// domain fronting is desired and access is not restricted
 | 
			
		
	
		
			
				
					|  |  |  | 		// based on hostname
 | 
			
		
	
		
			
				
					|  |  |  | 		if srv.StrictSNIHost == nil && srv.hasTLSClientAuth() { | 
			
		
	
		
			
				
					|  |  |  | 			app.logger.Info("enabling strict SNI-Host matching because TLS client auth is configured", | 
			
		
	
		
			
				
					|  |  |  | 				zap.String("server_name", srvName), | 
			
		
	
		
			
				
					|  |  |  | 			app.logger.Warn("enabling strict SNI-Host enforcement because TLS client auth is configured", | 
			
		
	
		
			
				
					|  |  |  | 				zap.String("server_id", srvName), | 
			
		
	
		
			
				
					|  |  |  | 			) | 
			
		
	
		
			
				
					|  |  |  | 			trueBool := true | 
			
		
	
		
			
				
					|  |  |  | 			srv.StrictSNIHost = &trueBool | 
			
		
	
	
		
			
				
					|  |  | @ -283,7 +283,6 @@ func (app *App) Validate() error { | 
			
		
	
		
			
				
					|  |  |  | 			} | 
			
		
	
		
			
				
					|  |  |  | 		} | 
			
		
	
		
			
				
					|  |  |  | 	} | 
			
		
	
		
			
				
					|  |  |  | 
 | 
			
		
	
		
			
				
					|  |  |  | 	return nil | 
			
		
	
		
			
				
					|  |  |  | } | 
			
		
	
		
			
				
					|  |  |  | 
 | 
			
		
	
	
		
			
				
					|  |  | 
 | 
			
		
	
								
							
						
					 
					
				 
			 
		
			
			
			
			
			
			
				
				
					
						
							
								
									
	
		
			
				
					|  |  | @ -236,6 +236,18 @@ func (t *TLS) Validate() error { | 
			
		
	
		
			
				
					|  |  |  | 
 | 
			
		
	
		
			
				
					|  |  |  | // Start activates the TLS module.
 | 
			
		
	
		
			
				
					|  |  |  | func (t *TLS) Start() error { | 
			
		
	
		
			
				
					|  |  |  | 	// warn if on-demand TLS is enabled but no restrictions are in place
 | 
			
		
	
		
			
				
					|  |  |  | 	if t.Automation.OnDemand == nil || | 
			
		
	
		
			
				
					|  |  |  | 		(t.Automation.OnDemand.Ask == "" && t.Automation.OnDemand.RateLimit == nil) { | 
			
		
	
		
			
				
					|  |  |  | 		for _, ap := range t.Automation.Policies { | 
			
		
	
		
			
				
					|  |  |  | 			if ap.OnDemand { | 
			
		
	
		
			
				
					|  |  |  | 				t.logger.Warn("YOUR SERVER MAY BE VULNERABLE TO ABUSE: on-demand TLS is enabled, but no protections are in place", | 
			
		
	
		
			
				
					|  |  |  | 					zap.String("docs", "https://caddyserver.com/docs/automatic-https#on-demand-tls")) | 
			
		
	
		
			
				
					|  |  |  | 				break | 
			
		
	
		
			
				
					|  |  |  | 			} | 
			
		
	
		
			
				
					|  |  |  | 		} | 
			
		
	
		
			
				
					|  |  |  | 	} | 
			
		
	
		
			
				
					|  |  |  | 
 | 
			
		
	
		
			
				
					|  |  |  | 	// now that we are running, and all manual certificates have
 | 
			
		
	
		
			
				
					|  |  |  | 	// been loaded, time to load the automated/managed certificates
 | 
			
		
	
		
			
				
					|  |  |  | 	err := t.Manage(t.automateNames) | 
			
		
	
	
		
			
				
					|  |  | 
 |