Skip to content

Commit 44d078b

Browse files
mohammed90mohammed90
authored
acme_server: fix policy parsing in caddyfile (#7006)
Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
1 parent 051e73a commit 44d078b

File tree

4 files changed

+245
-26
lines changed

4 files changed

+245
-26
lines changed

‎caddytest/integration/caddyfile_adapt/acme_server_policy-allow.caddyfiletest‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
pki {
3+
ca custom-ca {
4+
name "Custom CA"
5+
}
6+
}
7+
}
8+
9+
acme.example.com {
10+
acme_server {
11+
ca custom-ca
12+
allow {
13+
domains host-1.internal.example.com host-2.internal.example.com
14+
}
15+
}
16+
}
17+
----------
18+
{
19+
"apps": {
20+
"http": {
21+
"servers": {
22+
"srv0": {
23+
"listen": [
24+
":443"
25+
],
26+
"routes": [
27+
{
28+
"match": [
29+
{
30+
"host": [
31+
"acme.example.com"
32+
]
33+
}
34+
],
35+
"handle": [
36+
{
37+
"handler": "subroute",
38+
"routes": [
39+
{
40+
"handle": [
41+
{
42+
"ca": "custom-ca",
43+
"handler": "acme_server",
44+
"policy": {
45+
"allow": {
46+
"domains": [
47+
"host-1.internal.example.com",
48+
"host-2.internal.example.com"
49+
]
50+
}
51+
}
52+
}
53+
]
54+
}
55+
]
56+
}
57+
],
58+
"terminal": true
59+
}
60+
]
61+
}
62+
}
63+
},
64+
"pki": {
65+
"certificate_authorities": {
66+
"custom-ca": {
67+
"name": "Custom CA"
68+
}
69+
}
70+
}
71+
}
72+
}

‎caddytest/integration/caddyfile_adapt/acme_server_policy-both.caddyfiletest‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
pki {
3+
ca custom-ca {
4+
name "Custom CA"
5+
}
6+
}
7+
}
8+
9+
acme.example.com {
10+
acme_server {
11+
ca custom-ca
12+
allow {
13+
domains host-1.internal.example.com host-2.internal.example.com
14+
}
15+
deny {
16+
domains dc.internal.example.com
17+
}
18+
}
19+
}
20+
----------
21+
{
22+
"apps": {
23+
"http": {
24+
"servers": {
25+
"srv0": {
26+
"listen": [
27+
":443"
28+
],
29+
"routes": [
30+
{
31+
"match": [
32+
{
33+
"host": [
34+
"acme.example.com"
35+
]
36+
}
37+
],
38+
"handle": [
39+
{
40+
"handler": "subroute",
41+
"routes": [
42+
{
43+
"handle": [
44+
{
45+
"ca": "custom-ca",
46+
"handler": "acme_server",
47+
"policy": {
48+
"allow": {
49+
"domains": [
50+
"host-1.internal.example.com",
51+
"host-2.internal.example.com"
52+
]
53+
},
54+
"deny": {
55+
"domains": [
56+
"dc.internal.example.com"
57+
]
58+
}
59+
}
60+
}
61+
]
62+
}
63+
]
64+
}
65+
],
66+
"terminal": true
67+
}
68+
]
69+
}
70+
}
71+
},
72+
"pki": {
73+
"certificate_authorities": {
74+
"custom-ca": {
75+
"name": "Custom CA"
76+
}
77+
}
78+
}
79+
}
80+
}

‎caddytest/integration/caddyfile_adapt/acme_server_policy-deny.caddyfiletest‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{
2+
pki {
3+
ca custom-ca {
4+
name "Custom CA"
5+
}
6+
}
7+
}
8+
9+
acme.example.com {
10+
acme_server {
11+
ca custom-ca
12+
deny {
13+
domains dc.internal.example.com
14+
}
15+
}
16+
}
17+
----------
18+
{
19+
"apps": {
20+
"http": {
21+
"servers": {
22+
"srv0": {
23+
"listen": [
24+
":443"
25+
],
26+
"routes": [
27+
{
28+
"match": [
29+
{
30+
"host": [
31+
"acme.example.com"
32+
]
33+
}
34+
],
35+
"handle": [
36+
{
37+
"handler": "subroute",
38+
"routes": [
39+
{
40+
"handle": [
41+
{
42+
"ca": "custom-ca",
43+
"handler": "acme_server",
44+
"policy": {
45+
"deny": {
46+
"domains": [
47+
"dc.internal.example.com"
48+
]
49+
}
50+
}
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"terminal": true
58+
}
59+
]
60+
}
61+
}
62+
},
63+
"pki": {
64+
"certificate_authorities": {
65+
"custom-ca": {
66+
"name": "Custom CA"
67+
}
68+
}
69+
}
70+
}
71+
}

‎modules/caddypki/acmeserver/caddyfile.go‎

Lines changed: 22 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -91,19 +91,17 @@ func parseACMEServer(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error
9191
acmeServer.Policy.AllowWildcardNames = true
9292
case "allow":
9393
r := &RuleSet{}
94-
for h.Next() {
95-
for h.NextBlock(h.Nesting() - 1) {
96-
if h.CountRemainingArgs() == 0 {
97-
return nil, h.ArgErr() // TODO:
98-
}
99-
switch h.Val() {
100-
case "domains":
101-
r.Domains = append(r.Domains, h.RemainingArgs()...)
102-
case "ip_ranges":
103-
r.IPRanges = append(r.IPRanges, h.RemainingArgs()...)
104-
default:
105-
return nil, h.Errf("unrecognized 'allow' subdirective: %s", h.Val())
106-
}
94+
for nesting := h.Nesting(); h.NextBlock(nesting); {
95+
if h.CountRemainingArgs() == 0 {
96+
return nil, h.ArgErr() // TODO:
97+
}
98+
switch h.Val() {
99+
case "domains":
100+
r.Domains = append(r.Domains, h.RemainingArgs()...)
101+
case "ip_ranges":
102+
r.IPRanges = append(r.IPRanges, h.RemainingArgs()...)
103+
default:
104+
return nil, h.Errf("unrecognized 'allow' subdirective: %s", h.Val())
107105
}
108106
}
109107
if acmeServer.Policy == nil {
@@ -112,19 +110,17 @@ func parseACMEServer(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error
112110
acmeServer.Policy.Allow = r
113111
case "deny":
114112
r := &RuleSet{}
115-
for h.Next() {
116-
for h.NextBlock(h.Nesting() - 1) {
117-
if h.CountRemainingArgs() == 0 {
118-
return nil, h.ArgErr() // TODO:
119-
}
120-
switch h.Val() {
121-
case "domains":
122-
r.Domains = append(r.Domains, h.RemainingArgs()...)
123-
case "ip_ranges":
124-
r.IPRanges = append(r.IPRanges, h.RemainingArgs()...)
125-
default:
126-
return nil, h.Errf("unrecognized 'deny' subdirective: %s", h.Val())
127-
}
113+
for nesting := h.Nesting(); h.NextBlock(nesting); {
114+
if h.CountRemainingArgs() == 0 {
115+
return nil, h.ArgErr() // TODO:
116+
}
117+
switch h.Val() {
118+
case "domains":
119+
r.Domains = append(r.Domains, h.RemainingArgs()...)
120+
case "ip_ranges":
121+
r.IPRanges = append(r.IPRanges, h.RemainingArgs()...)
122+
default:
123+
return nil, h.Errf("unrecognized 'deny' subdirective: %s", h.Val())
128124
}
129125
}
130126
if acmeServer.Policy == nil {

0 commit comments

Comments
 (0)