Infrastructure/caddy
1
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2024-12-16 21:56:40 -05:00
Code Issues Activity

Improve security warnings

Browse source
This commit is contained in:
Matthew Holt 2021-02-16 13:31:53 -07:00
parent bafb562991
commit fbd00e4b53
No known key found for this signature in database
GPG key ID: 2A349DD577D586A5
2 changed files with 14 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
modules/caddyhttp/app.go
View file

@ -176,8 +176,8 @@ func (app *App) Provision(ctx caddy.Context) error {
// domain fronting is desired and access is not restricted
// based on hostname
if srv.StrictSNIHost == nil && srv.hasTLSClientAuth() {
app.logger.Info("enabling strict SNI-Host matching because TLS client auth is configured",
zap.String("server_name", srvName),
app.logger.Warn("enabling strict SNI-Host enforcement because TLS client auth is configured",
zap.String("server_id", srvName),
)
trueBool := true
srv.StrictSNIHost = &trueBool
@ -283,7 +283,6 @@ func (app *App) Validate() error {
}
}
}
return nil
}

12
modules/caddytls/tls.go
View file

@ -236,6 +236,18 @@ func (t *TLS) Validate() error {
// Start activates the TLS module.
func (t *TLS) Start() error {
// warn if on-demand TLS is enabled but no restrictions are in place
if t.Automation.OnDemand == nil ||
(t.Automation.OnDemand.Ask == "" && t.Automation.OnDemand.RateLimit == nil) {
for _, ap := range t.Automation.Policies {
if ap.OnDemand {
t.logger.Warn("YOUR SERVER MAY BE VULNERABLE TO ABUSE: on-demand TLS is enabled, but no protections are in place",
zap.String("docs", "https://caddyserver.com/docs/automatic-https#on-demand-tls"))
break
}
}
}
// now that we are running, and all manual certificates have
// been loaded, time to load the automated/managed certificates
err := t.Manage(t.automateNames)