1. 07 Mar, 2017 1 commit
    • Matthew Holt's avatar
      httpserver: Flags to customize HTTP and HTTPS ports (incl. for ACME) · e3f2d96a
      Matthew Holt authored
      This commit removes _almost_ all instances of hard-coded ports 80 and
      443 strings, and now allows the user to define what the HTTP and HTTPS
      ports are by the -http-port and -https-ports flags.
      
      (One instance of "80" is still hard-coded in tls.go because it cannot
      import httpserver to get access to the HTTP port variable. I don't
      suspect this will be a problem in practice, but one workaround would be
      to define an exported variable in the caddytls package and let the
      httpserver package set it as well as its own HTTPPort variable.)
      
      The port numbers required by the ACME challenges HTTP-01 and TLS-SNI-01
      are hard-coded into the spec as ports 80 and 443 for good reasons,
      but the big question is whether they necessarily need to be the HTTP
      and HTTPS ports. Although the answer is probably no, they chose those
      ports for convenience and widest compatibility/deployability. So this
      commit also assumes that the "HTTP port" is necessarily the same port
      on which to serve the HTTP-01 challenge, and the "HTTPS port" is
      necessarily the same one on which to serve the TLS-SNI-01 challenge. In
      other words, changing the HTTP and HTTPS ports also changes the ports
      the challenges will be served on.
      
      If you change the HTTP and HTTPS ports, you are responsible for
      configuring your system to forward ports 80 and 443 properly.
      
      Closes #918 and closes #1293. Also related: #468.
      e3f2d96a
  2. 28 Feb, 2017 2 commits
    • ericdreeves's avatar
      Use RequestURI when redirecting to canonical path. (#1331) · 0a0d2cc1
      ericdreeves authored
      * Use RequestURI when redirecting to canonical path.
      
      Caddy may trim a request's URL path when it starts with the path that's
      associated with the virtual host. This change uses the path from the request's
      RequestURI when performing a redirect.
      
      Fix issue #1327.
      
      * Rename redirurl to redirURL.
      
      * Redirect to the full URL.
      
      The scheme and host from the virtual host's site configuration is used
      in order to redirect to the full URL.
      
      * Add comment and remove redundant check.
      
      * Store the original URL path in request context.
      
      By storing the original URL path as a value in the request context,
      middlewares can access both it and the sanitized path. The default
      default FileServer handler will use the original URL on redirects.
      
      * Replace contextKey type with CtxKey.
      
      In addition to moving the CtxKey definition to the caddy package, this
      change updates the CtxKey references in the httpserver, fastcgi, and
      basicauth packages.
      
      * httpserver: Fix reference to CtxKey
      0a0d2cc1
    • Matthew Holt's avatar
  3. 22 Feb, 2017 3 commits
    • Matthew Holt's avatar
      06873175
    • Matthew Holt's avatar
      httpserver: Disable default timeouts (closes #1464) · f49e0c9b
      Matthew Holt authored
      Timeouts are important for mitigating slowloris, yes. But after a number
      of complaints and seeing that default timeouts are a sore point of
      confusion, we're disabling them now. However, the code that sets
      default timeouts remains intact; the defaults are just the zero value.
      
      While Caddy aims to be secure by default, Caddy also aims to serve a
      worldwide audience. Even my own internet here in Utah is poor at times,
      with bad WiFi signal, causing some connections to take over 10s to
      be established. Many use the Internet while commuting on slower
      connection speeds. Latency across country borders is another concern.
      
      As such, disabling default timeouts will serve a greater population of
      users than enabling them, as slowloris is easy to mitigate and does
      not seem to be reported often (I've only seen it once). It's also very
      difficult sometimes to distinguish slowloris from genuine slow networks.
      That decision is best left to the site owner for now.
      f49e0c9b
    • Matthew Holt's avatar
  4. 21 Feb, 2017 2 commits
  5. 20 Feb, 2017 3 commits
  6. 19 Feb, 2017 1 commit
  7. 18 Feb, 2017 4 commits
  8. 17 Feb, 2017 7 commits
    • Kurt Jung's avatar
      basicauth: Store name of authenticated user (#1426) · 977a3c32
      Kurt Jung authored
      * Store name of authenticated user in basicauth for use by upstream middleware such as fastcgi and cgi.
      
      * Use request context to transfer name of authorized user from basicauth to upstream middleware. Test retrieval of name from context.
      
      * Remove development code that was inadvertently left in place
      
      * Use keys of type httpserver.CtxKey to access Context values
      977a3c32
    • Matt Holt's avatar
      Detect HTTPS interception (#1430) · 82cbd7a9
      Matt Holt authored
      * WIP: Implement HTTPS interception detection by Durumeric, et. al.
      
      Special thanks to @FiloSottile for guidance with the custom listener.
      
      * Add {{.IsMITM}} context action and {mitm} placeholder
      
      * Improve MITM detection heuristics for Firefox and Edge
      
      * Add tests for MITM detection heuristics
      
      * Improve Safari heuristics for interception detection
      
      * Read ClientHello during first Read() instead of during Accept()
      
      As far as I can tell, reading the ClientHello during Accept() prevents
      new connections from being accepted during the read. Since Read() should
      be called in its own goroutine, this keeps Accept() non-blocking.
      
      * Clean up MITM detection handler; make possible to close connection
      
      * Use standard lib cipher suite values when possible
      
      * Improve Edge heuristics and test cases
      
      * Refactor MITM checking logic; add some debug statements for now
      
      * Fix bug in MITM heuristic tests and actual heuristic code
      
      * Fix gofmt
      
      * Remove debug statements; preparing for merge
      82cbd7a9
    • Mateusz Gajewski's avatar
      HTTP/2 push support (golang 1.8) (#1215) · cdf7cf5c
      Mateusz Gajewski authored
      * WIP
      
      * HTTP2/Push for golang 1.8
      
      * Push plugin completed for review
      
      * Correct build tag
      
      * Move push plugin position
      
      * Add build tags to tests
      
      * Gofmt that code
      
      * Add header/method validations
      
      * Load push plugin
      
      * Fixes for wrapping writers
      
      * Push after delivering file
      
      * Fixes, review changes
      
      * Remove build tags, support new syntax
      
      * Fix spelling
      
      * gofmt -s -w .
      
      * Gogland time
      
      * Add interface guards
      
      * gofmt
      
      * After review fixes
      cdf7cf5c
    • elcore's avatar
      Add support for ChaCha20-Poly1305 (#1443) · 57900782
      elcore authored
      57900782
    • Matt Holt's avatar
      Merge pull request #1378 from tw4452852/1362 · e50de809
      Matt Holt authored
      proxy: handle encoded path in URL
      e50de809
    • Tw's avatar
      proxy: handle encoded path in URL · c37481cc
      Tw authored
      fix issue #1362
      Signed-off-by: default avatarTw <tw19881113@gmail.com>
      c37481cc
    • elcore's avatar
      Implement curve X25519 (Golang 1.8) (#1376) · 91ff7343
      elcore authored
      * Implement curve X25519
      
      * caddytls: Added a default curves list
      
      * caddytls: Improve tests
      91ff7343
  9. 16 Feb, 2017 9 commits
  10. 15 Feb, 2017 1 commit
    • Augusto Roman's avatar
      Fix data race for max connection limiting in proxy directive. (#1438) · 463c9d9d
      Augusto Roman authored
      * Fix data race for max connection limiting in proxy directive.
      
      The Conns and Unhealthy fields are updated concurrently across all active
      requests.  Because of this, they must use atomic operations for reads and
      writes.
      
      Prior to this change, Conns was incremented atomically, but read unsafely.
      Unhealthly was updated & read unsafely.  The new test
      TestReverseProxyMaxConnLimit exposes this race when run with -race.
      
      Switching to atomic operations makes the race detector happy.
      
      * oops, remove leftover dead code.
      463c9d9d
  11. 14 Feb, 2017 4 commits
  12. 13 Feb, 2017 2 commits
  13. 11 Feb, 2017 1 commit