Skip to content

Commit 59cbb2c

Browse files
vnxmevnxme
authored
caddytls,caddyhttp: Placeholders for some TLS and HTTP matchers (#6480)
* Runtime placeholders for caddytls matchers (1/3): - remove IPs validation in UnmarshalCaddyfile * Runtime placeholders for caddytls matchers (2/3): - add placeholder replacement for IPs in Provision * Runtime placeholders for caddytls matchers (3/3): - add placeholder replacement for other strings * Runtime placeholders for caddyhttp matchers (1/1): - add placeholder replacement for IPs in Provision * Runtime placeholders for caddyhttp/caddytls matchers: - move PrivateRandesCIDR under internal
1 parent a8b0dfa commit 59cbb2c

File tree

5 files changed

+57
-41
lines changed

5 files changed

+57
-41
lines changed

‎internal/ranges.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package internal
2+
3+
// PrivateRangesCIDR returns a list of private CIDR range
4+
// strings, which can be used as a configuration shortcut.
5+
func PrivateRangesCIDR() []string {
6+
return []string{
7+
"192.168.0.0/16",
8+
"172.16.0.0/12",
9+
"10.0.0.0/8",
10+
"127.0.0.1/8",
11+
"fd00::/8",
12+
"::1",
13+
}
14+
}

‎modules/caddyhttp/ip_matchers.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ import (
2929

3030
"github.com/caddyserver/caddy/v2"
3131
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
32+
"github.com/caddyserver/caddy/v2/internal"
3233
)
3334

3435
// MatchRemoteIP matches requests by the remote IP address,
@@ -79,7 +80,7 @@ func (m *MatchRemoteIP) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
7980
return d.Err("the 'forwarded' option is no longer supported; use the 'client_ip' matcher instead")
8081
}
8182
if d.Val() == "private_ranges" {
82-
m.Ranges = append(m.Ranges, PrivateRangesCIDR()...)
83+
m.Ranges = append(m.Ranges, internal.PrivateRangesCIDR()...)
8384
continue
8485
}
8586
m.Ranges = append(m.Ranges, d.Val())
@@ -173,7 +174,7 @@ func (m *MatchClientIP) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
173174
for d.Next() {
174175
for d.NextArg() {
175176
if d.Val() == "private_ranges" {
176-
m.Ranges = append(m.Ranges, PrivateRangesCIDR()...)
177+
m.Ranges = append(m.Ranges, internal.PrivateRangesCIDR()...)
177178
continue
178179
}
179180
m.Ranges = append(m.Ranges, d.Val())
@@ -250,7 +251,9 @@ func (m MatchClientIP) Match(r *http.Request) bool {
250251
func provisionCidrsZonesFromRanges(ranges []string) ([]*netip.Prefix, []string, error) {
251252
cidrs := []*netip.Prefix{}
252253
zones := []string{}
254+
repl := caddy.NewReplacer()
253255
for _, str := range ranges {
256+
str = repl.ReplaceAll(str, "")
254257
// Exclude the zone_id from the IP
255258
if strings.Contains(str, "%") {
256259
split := strings.Split(str, "%")

‎modules/caddyhttp/ip_range.go‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222

2323
"github.com/caddyserver/caddy/v2"
2424
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
25+
"github.com/caddyserver/caddy/v2/internal"
2526
)
2627

2728
func init() {
@@ -92,7 +93,7 @@ func (m *StaticIPRange) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
9293
}
9394
for d.NextArg() {
9495
if d.Val() == "private_ranges" {
95-
m.Ranges = append(m.Ranges, PrivateRangesCIDR()...)
96+
m.Ranges = append(m.Ranges, internal.PrivateRangesCIDR()...)
9697
continue
9798
}
9899
m.Ranges = append(m.Ranges, d.Val())
@@ -121,19 +122,6 @@ func CIDRExpressionToPrefix(expr string) (netip.Prefix, error) {
121122
return prefix, nil
122123
}
123124

124-
// PrivateRangesCIDR returns a list of private CIDR range
125-
// strings, which can be used as a configuration shortcut.
126-
func PrivateRangesCIDR() []string {
127-
return []string{
128-
"192.168.0.0/16",
129-
"172.16.0.0/12",
130-
"10.0.0.0/8",
131-
"127.0.0.1/8",
132-
"fd00::/8",
133-
"::1",
134-
}
135-
}
136-
137125
// Interface guards
138126
var (
139127
_ caddy.Provisioner = (*StaticIPRange)(nil)

‎modules/caddyhttp/reverseproxy/caddyfile.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import (
2828
"github.com/caddyserver/caddy/v2/caddyconfig"
2929
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
3030
"github.com/caddyserver/caddy/v2/caddyconfig/httpcaddyfile"
31+
"github.com/caddyserver/caddy/v2/internal"
3132
"github.com/caddyserver/caddy/v2/modules/caddyhttp"
3233
"github.com/caddyserver/caddy/v2/modules/caddyhttp/headers"
3334
"github.com/caddyserver/caddy/v2/modules/caddyhttp/rewrite"
@@ -688,7 +689,7 @@ func (h *Handler) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
688689
case "trusted_proxies":
689690
for d.NextArg() {
690691
if d.Val() == "private_ranges" {
691-
h.TrustedProxies = append(h.TrustedProxies, caddyhttp.PrivateRangesCIDR()...)
692+
h.TrustedProxies = append(h.TrustedProxies, internal.PrivateRangesCIDR()...)
692693
continue
693694
}
694695
h.TrustedProxies = append(h.TrustedProxies, d.Val())

‎modules/caddytls/matchers.go‎

Lines changed: 34 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ import (
2626

2727
"github.com/caddyserver/caddy/v2"
2828
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
29+
"github.com/caddyserver/caddy/v2/internal"
2930
)
3031

3132
func init() {
@@ -49,8 +50,17 @@ func (MatchServerName) CaddyModule() caddy.ModuleInfo {
4950

5051
// Match matches hello based on SNI.
5152
func (m MatchServerName) Match(hello *tls.ClientHelloInfo) bool {
53+
// caddytls.TestServerNameMatcher calls this function without any context
54+
var repl *caddy.Replacer
55+
if ctx := hello.Context(); ctx != nil {
56+
repl = ctx.Value(caddy.ReplacerCtxKey).(*caddy.Replacer)
57+
} else {
58+
repl = caddy.NewReplacer()
59+
}
60+
5261
for _, name := range m {
53-
if certmagic.MatchWildcard(hello.ServerName, name) {
62+
rs := repl.ReplaceAll(name, "")
63+
if certmagic.MatchWildcard(hello.ServerName, rs) {
5464
return true
5565
}
5666
}
@@ -107,16 +117,19 @@ func (MatchRemoteIP) CaddyModule() caddy.ModuleInfo {
107117

108118
// Provision parses m's IP ranges, either from IP or CIDR expressions.
109119
func (m *MatchRemoteIP) Provision(ctx caddy.Context) error {
120+
repl := caddy.NewReplacer()
110121
m.logger = ctx.Logger()
111122
for _, str := range m.Ranges {
112-
cidrs, err := m.parseIPRange(str)
123+
rs := repl.ReplaceAll(str, "")
124+
cidrs, err := m.parseIPRange(rs)
113125
if err != nil {
114126
return err
115127
}
116128
m.cidrs = append(m.cidrs, cidrs...)
117129
}
118130
for _, str := range m.NotRanges {
119-
cidrs, err := m.parseIPRange(str)
131+
rs := repl.ReplaceAll(str, "")
132+
cidrs, err := m.parseIPRange(rs)
120133
if err != nil {
121134
return err
122135
}
@@ -185,22 +198,18 @@ func (m *MatchRemoteIP) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
185198

186199
for d.NextArg() {
187200
val := d.Val()
201+
var exclamation bool
188202
if len(val) > 1 && val[0] == '!' {
189-
prefixes, err := m.parseIPRange(val[1:])
190-
if err != nil {
191-
return err
192-
}
193-
for _, prefix := range prefixes {
194-
m.NotRanges = append(m.NotRanges, prefix.String())
195-
}
203+
exclamation, val = true, val[1:]
204+
}
205+
ranges := []string{val}
206+
if val == "private_ranges" {
207+
ranges = internal.PrivateRangesCIDR()
208+
}
209+
if exclamation {
210+
m.NotRanges = append(m.NotRanges, ranges...)
196211
} else {
197-
prefixes, err := m.parseIPRange(val)
198-
if err != nil {
199-
return err
200-
}
201-
for _, prefix := range prefixes {
202-
m.Ranges = append(m.Ranges, prefix.String())
203-
}
212+
m.Ranges = append(m.Ranges, ranges...)
204213
}
205214
}
206215

@@ -233,9 +242,11 @@ func (MatchLocalIP) CaddyModule() caddy.ModuleInfo {
233242

234243
// Provision parses m's IP ranges, either from IP or CIDR expressions.
235244
func (m *MatchLocalIP) Provision(ctx caddy.Context) error {
245+
repl := caddy.NewReplacer()
236246
m.logger = ctx.Logger()
237247
for _, str := range m.Ranges {
238-
cidrs, err := m.parseIPRange(str)
248+
rs := repl.ReplaceAll(str, "")
249+
cidrs, err := m.parseIPRange(rs)
239250
if err != nil {
240251
return err
241252
}
@@ -300,13 +311,12 @@ func (m *MatchLocalIP) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
300311
}
301312

302313
for d.NextArg() {
303-
prefixes, err := m.parseIPRange(d.Val())
304-
if err != nil {
305-
return err
306-
}
307-
for _, prefix := range prefixes {
308-
m.Ranges = append(m.Ranges, prefix.String())
314+
val := d.Val()
315+
if val == "private_ranges" {
316+
m.Ranges = append(m.Ranges, internal.PrivateRangesCIDR()...)
317+
continue
309318
}
319+
m.Ranges = append(m.Ranges, val)
310320
}
311321

312322
// No blocks are supported

0 commit comments

Comments
 (0)