use go 1.12

Signed-off-by: hongming <talonwan@yunify.com>

vendor/github.com/mholt/caddy/caddyhttp/httpserver/condition.go

@@ -0,0 +1,202 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"fmt"
+	"net/http"
+	"regexp"
+	"strings"
+
+	"github.com/mholt/caddy"
+)
+
+// SetupIfMatcher parses `if` or `if_op` in the current dispenser block.
+// It returns a RequestMatcher and an error if any.
+func SetupIfMatcher(controller *caddy.Controller) (RequestMatcher, error) {
+	var c = controller.Dispenser // copy the dispenser
+	var matcher IfMatcher
+	for c.NextBlock() {
+		switch c.Val() {
+		case "if":
+			args1 := c.RemainingArgs()
+			if len(args1) != 3 {
+				return matcher, c.ArgErr()
+			}
+			ifc, err := newIfCond(args1[0], args1[1], args1[2])
+			if err != nil {
+				return matcher, err
+			}
+			matcher.ifs = append(matcher.ifs, ifc)
+			matcher.Enabled = true
+		case "if_op":
+			if !c.NextArg() {
+				return matcher, c.ArgErr()
+			}
+			switch c.Val() {
+			case "and":
+				matcher.isOr = false
+			case "or":
+				matcher.isOr = true
+			default:
+				return matcher, c.ArgErr()
+			}
+		}
+	}
+	return matcher, nil
+}
+
+// operators
+const (
+	isOp         = "is"
+	notOp        = "not"
+	hasOp        = "has"
+	startsWithOp = "starts_with"
+	endsWithOp   = "ends_with"
+	matchOp      = "match"
+)
+
+// ifCondition is a 'if' condition.
+type ifFunc func(a, b string) bool
+
+// ifCond is statement for a IfMatcher condition.
+type ifCond struct {
+	a   string
+	op  string
+	b   string
+	neg bool
+	rex *regexp.Regexp
+	f   ifFunc
+}
+
+// newIfCond creates a new If condition.
+func newIfCond(a, op, b string) (ifCond, error) {
+	i := ifCond{a: a, op: op, b: b}
+	if strings.HasPrefix(op, "not_") {
+		i.neg = true
+		i.op = op[4:]
+	}
+
+	switch i.op {
+	case isOp:
+		// It checks for equality.
+		i.f = i.isFunc
+	case notOp:
+		// It checks for inequality.
+		i.f = i.notFunc
+	case hasOp:
+		// It checks if b is a substring of a.
+		i.f = strings.Contains
+	case startsWithOp:
+		// It checks if b is a prefix of a.
+		i.f = strings.HasPrefix
+	case endsWithOp:
+		// It checks if b is a suffix of a.
+		i.f = strings.HasSuffix
+	case matchOp:
+		// It does regexp matching of a against pattern in b and returns if they match.
+		var err error
+		if i.rex, err = regexp.Compile(i.b); err != nil {
+			return ifCond{}, fmt.Errorf("Invalid regular expression: '%s', %v", i.b, err)
+		}
+		i.f = i.matchFunc
+	default:
+		return ifCond{}, fmt.Errorf("Invalid operator %v", i.op)
+	}
+
+	return i, nil
+}
+
+// isFunc is condition for Is operator.
+func (i ifCond) isFunc(a, b string) bool {
+	return a == b
+}
+
+// notFunc is condition for Not operator.
+func (i ifCond) notFunc(a, b string) bool {
+	return a != b
+}
+
+// matchFunc is condition for Match operator.
+func (i ifCond) matchFunc(a, b string) bool {
+	return i.rex.MatchString(a)
+}
+
+// True returns true if the condition is true and false otherwise.
+// If r is not nil, it replaces placeholders before comparison.
+func (i ifCond) True(r *http.Request) bool {
+	if i.f != nil {
+		a, b := i.a, i.b
+		if r != nil {
+			replacer := NewReplacer(r, nil, "")
+			a = replacer.Replace(i.a)
+			if i.op != matchOp {
+				b = replacer.Replace(i.b)
+			}
+		}
+		if i.neg {
+			return !i.f(a, b)
+		}
+		return i.f(a, b)
+	}
+	return i.neg // false if not negated, true otherwise
+}
+
+// IfMatcher is a RequestMatcher for 'if' conditions.
+type IfMatcher struct {
+	Enabled bool     // if true, matcher has been configured; otherwise it's no-op
+	ifs     []ifCond // list of If
+	isOr    bool     // if true, conditions are 'or' instead of 'and'
+}
+
+// Match satisfies RequestMatcher interface.
+// It returns true if the conditions in m are true.
+func (m IfMatcher) Match(r *http.Request) bool {
+	if m.isOr {
+		return m.Or(r)
+	}
+	return m.And(r)
+}
+
+// And returns true if all conditions in m are true.
+func (m IfMatcher) And(r *http.Request) bool {
+	for _, i := range m.ifs {
+		if !i.True(r) {
+			return false
+		}
+	}
+	return true
+}
+
+// Or returns true if any of the conditions in m is true.
+func (m IfMatcher) Or(r *http.Request) bool {
+	for _, i := range m.ifs {
+		if i.True(r) {
+			return true
+		}
+	}
+	return false
+}
+
+// IfMatcherKeyword checks if the next value in the dispenser is a keyword for 'if' config block.
+// If true, remaining arguments in the dispenser are cleared to keep the dispenser valid for use.
+func IfMatcherKeyword(c *caddy.Controller) bool {
+	if c.Val() == "if" || c.Val() == "if_op" {
+		// clear remaining args
+		c.RemainingArgs()
+		return true
+	}
+	return false
+}

vendor/github.com/mholt/caddy/caddyhttp/httpserver/error.go

@@ -0,0 +1,70 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"fmt"
+)
+
+var (
+	_ error = NonHijackerError{}
+	_ error = NonFlusherError{}
+	_ error = NonCloseNotifierError{}
+	_ error = NonPusherError{}
+)
+
+// NonHijackerError is more descriptive error caused by a non hijacker
+type NonHijackerError struct {
+	// underlying type which doesn't implement Hijack
+	Underlying interface{}
+}
+
+// Implement Error
+func (h NonHijackerError) Error() string {
+	return fmt.Sprintf("%T is not a hijacker", h.Underlying)
+}
+
+// NonFlusherError is more descriptive error caused by a non flusher
+type NonFlusherError struct {
+	// underlying type which doesn't implement Flush
+	Underlying interface{}
+}
+
+// Implement Error
+func (f NonFlusherError) Error() string {
+	return fmt.Sprintf("%T is not a flusher", f.Underlying)
+}
+
+// NonCloseNotifierError is more descriptive error caused by a non closeNotifier
+type NonCloseNotifierError struct {
+	// underlying type which doesn't implement CloseNotify
+	Underlying interface{}
+}
+
+// Implement Error
+func (c NonCloseNotifierError) Error() string {
+	return fmt.Sprintf("%T is not a closeNotifier", c.Underlying)
+}
+
+// NonPusherError is more descriptive error caused by a non pusher
+type NonPusherError struct {
+	// underlying type which doesn't implement pusher
+	Underlying interface{}
+}
+
+// Implement Error
+func (c NonPusherError) Error() string {
+	return fmt.Sprintf("%T is not a pusher", c.Underlying)
+}

vendor/github.com/mholt/caddy/caddyhttp/httpserver/https.go

@@ -0,0 +1,223 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+
+	"github.com/mholt/caddy"
+	"github.com/mholt/caddy/caddytls"
+	"github.com/mholt/certmagic"
+)
+
+func activateHTTPS(cctx caddy.Context) error {
+	operatorPresent := !caddy.Started()
+
+	if !caddy.Quiet && operatorPresent {
+		fmt.Print("Activating privacy features... ")
+	}
+
+	ctx := cctx.(*httpContext)
+
+	// pre-screen each config and earmark the ones that qualify for managed TLS
+	markQualifiedForAutoHTTPS(ctx.siteConfigs)
+
+	// place certificates and keys on disk
+	for _, c := range ctx.siteConfigs {
+		if !c.TLS.Managed {
+			continue
+		}
+		if c.TLS.Manager.OnDemand != nil {
+			continue // obtain these certificates on-demand instead
+		}
+		err := c.TLS.Manager.ObtainCert(c.TLS.Hostname, operatorPresent)
+		if err != nil {
+			return err
+		}
+	}
+
+	// update TLS configurations
+	err := enableAutoHTTPS(ctx.siteConfigs, true)
+	if err != nil {
+		return err
+	}
+
+	// set up redirects
+	ctx.siteConfigs = makePlaintextRedirects(ctx.siteConfigs)
+
+	// renew all relevant certificates that need renewal. this is important
+	// to do right away so we guarantee that renewals aren't missed, and
+	// also the user can respond to any potential errors that occur.
+	// (skip if upgrading, because the parent process is likely already listening
+	// on the ports we'd need to do ACME before we finish starting; parent process
+	// already running renewal ticker, so renewal won't be missed anyway.)
+	if !caddy.IsUpgrade() {
+		ctx.instance.StorageMu.RLock()
+		certCache, ok := ctx.instance.Storage[caddytls.CertCacheInstStorageKey].(*certmagic.Cache)
+		ctx.instance.StorageMu.RUnlock()
+		if ok && certCache != nil {
+			err = certCache.RenewManagedCertificates(operatorPresent)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	if !caddy.Quiet && operatorPresent {
+		fmt.Println("done.")
+	}
+
+	return nil
+}
+
+// markQualifiedForAutoHTTPS scans each config and, if it
+// qualifies for managed TLS, it sets the Managed field of
+// the TLS config to true.
+func markQualifiedForAutoHTTPS(configs []*SiteConfig) {
+	for _, cfg := range configs {
+		if caddytls.QualifiesForManagedTLS(cfg) && cfg.Addr.Scheme != "http" {
+			cfg.TLS.Managed = true
+		}
+	}
+}
+
+// enableAutoHTTPS configures each config to use TLS according to default settings.
+// It will only change configs that are marked as managed but not on-demand, and
+// assumes that certificates and keys are already on disk. If loadCertificates is
+// true, the certificates will be loaded from disk into the cache for this process
+// to use. If false, TLS will still be enabled and configured with default settings,
+// but no certificates will be parsed loaded into the cache, and the returned error
+// value will always be nil.
+func enableAutoHTTPS(configs []*SiteConfig, loadCertificates bool) error {
+	for _, cfg := range configs {
+		if cfg == nil || cfg.TLS == nil || !cfg.TLS.Managed ||
+			cfg.TLS.Manager == nil || cfg.TLS.Manager.OnDemand != nil {
+			continue
+		}
+		cfg.TLS.Enabled = true
+		cfg.Addr.Scheme = "https"
+		if loadCertificates && certmagic.HostQualifies(cfg.TLS.Hostname) {
+			_, err := cfg.TLS.Manager.CacheManagedCertificate(cfg.TLS.Hostname)
+			if err != nil {
+				return err
+			}
+		}
+
+		// Make sure any config values not explicitly set are set to default
+		caddytls.SetDefaultTLSParams(cfg.TLS)
+
+		// Set default port of 443 if not explicitly set
+		if cfg.Addr.Port == "" &&
+			cfg.TLS.Enabled &&
+			(!cfg.TLS.Manual || cfg.TLS.Manager.OnDemand != nil) &&
+			cfg.Addr.Host != "localhost" {
+			cfg.Addr.Port = HTTPSPort
+		}
+	}
+	return nil
+}
+
+// makePlaintextRedirects sets up redirects from port 80 to the relevant HTTPS
+// hosts. You must pass in all configs, not just configs that qualify, since
+// we must know whether the same host already exists on port 80, and those would
+// not be in a list of configs that qualify for automatic HTTPS. This function will
+// only set up redirects for configs that qualify. It returns the updated list of
+// all configs.
+func makePlaintextRedirects(allConfigs []*SiteConfig) []*SiteConfig {
+	for i, cfg := range allConfigs {
+		if cfg.TLS.Managed &&
+			!hostHasOtherPort(allConfigs, i, HTTPPort) &&
+			(cfg.Addr.Port == HTTPSPort || !hostHasOtherPort(allConfigs, i, HTTPSPort)) {
+			allConfigs = append(allConfigs, redirPlaintextHost(cfg))
+		}
+	}
+	return allConfigs
+}
+
+// hostHasOtherPort returns true if there is another config in the list with the same
+// hostname that has port otherPort, or false otherwise. All the configs are checked
+// against the hostname of allConfigs[thisConfigIdx].
+func hostHasOtherPort(allConfigs []*SiteConfig, thisConfigIdx int, otherPort string) bool {
+	for i, otherCfg := range allConfigs {
+		if i == thisConfigIdx {
+			continue // has to be a config OTHER than the one we're comparing against
+		}
+		if otherCfg.Addr.Host == allConfigs[thisConfigIdx].Addr.Host &&
+			otherCfg.Addr.Port == otherPort {
+			return true
+		}
+	}
+	return false
+}
+
+// redirPlaintextHost returns a new plaintext HTTP configuration for
+// a virtualHost that simply redirects to cfg, which is assumed to
+// be the HTTPS configuration. The returned configuration is set
+// to listen on HTTPPort. The TLS field of cfg must not be nil.
+func redirPlaintextHost(cfg *SiteConfig) *SiteConfig {
+	redirPort := cfg.Addr.Port
+	if redirPort == HTTPSPort {
+		// By default, HTTPSPort should be DefaultHTTPSPort,
+		// which of course doesn't need to be explicitly stated
+		// in the Location header. Even if HTTPSPort is changed
+		// so that it is no longer DefaultHTTPSPort, we shouldn't
+		// append it to the URL in the Location because changing
+		// the HTTPS port is assumed to be an internal-only change
+		// (in other words, we assume port forwarding is going on);
+		// but redirects go back to a presumably-external client.
+		// (If redirect clients are also internal, that is more
+		// advanced, and the user should configure HTTP->HTTPS
+		// redirects themselves.)
+		redirPort = ""
+	}
+
+	redirMiddleware := func(next Handler) Handler {
+		return HandlerFunc(func(w http.ResponseWriter, r *http.Request) (int, error) {
+			// Construct the URL to which to redirect. Note that the Host in a
+			// request might contain a port, but we just need the hostname from
+			// it; and we'll set the port if needed.
+			toURL := "https://"
+			requestHost, _, err := net.SplitHostPort(r.Host)
+			if err != nil {
+				requestHost = r.Host // Host did not contain a port, so use the whole value
+			}
+			if redirPort == "" {
+				toURL += requestHost
+			} else {
+				toURL += net.JoinHostPort(requestHost, redirPort)
+			}
+
+			toURL += r.URL.RequestURI()
+
+			w.Header().Set("Connection", "close")
+			http.Redirect(w, r, toURL, http.StatusMovedPermanently)
+			return 0, nil
+		})
+	}
+
+	host := cfg.Addr.Host
+	port := HTTPPort
+	addr := net.JoinHostPort(host, port)
+
+	return &SiteConfig{
+		Addr:       Address{Original: addr, Host: host, Port: port},
+		ListenHost: cfg.ListenHost,
+		middleware: []Middleware{redirMiddleware},
+		TLS:        &caddytls.Config{Manager: cfg.TLS.Manager},
+		Timeouts:   cfg.Timeouts,
+	}
+}

vendor/github.com/mholt/caddy/caddyhttp/httpserver/logger.go

@@ -0,0 +1,196 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"bytes"
+	"io"
+	"log"
+	"net"
+	"os"
+	"strings"
+	"sync"
+
+	gsyslog "github.com/hashicorp/go-syslog"
+	"github.com/mholt/caddy"
+)
+
+var remoteSyslogPrefixes = map[string]string{
+	"syslog+tcp://": "tcp",
+	"syslog+udp://": "udp",
+	"syslog://":     "udp",
+}
+
+// Logger is shared between errors and log plugins and supports both logging to
+// a file (with an optional file roller), local and remote syslog servers.
+type Logger struct {
+	Output string
+	*log.Logger
+	Roller       *LogRoller
+	writer       io.Writer
+	fileMu       *sync.RWMutex
+	V4ipMask     net.IPMask
+	V6ipMask     net.IPMask
+	IPMaskExists bool
+	Exceptions   []string
+}
+
+// NewTestLogger creates logger suitable for testing purposes
+func NewTestLogger(buffer *bytes.Buffer) *Logger {
+	return &Logger{
+		Logger: log.New(buffer, "", 0),
+		fileMu: new(sync.RWMutex),
+	}
+}
+
+// Println wraps underlying logger with mutex
+func (l Logger) Println(args ...interface{}) {
+	l.fileMu.RLock()
+	l.Logger.Println(args...)
+	l.fileMu.RUnlock()
+}
+
+// Printf wraps underlying logger with mutex
+func (l Logger) Printf(format string, args ...interface{}) {
+	l.fileMu.RLock()
+	l.Logger.Printf(format, args...)
+	l.fileMu.RUnlock()
+}
+
+func (l Logger) MaskIP(ip string) string {
+	var reqIP net.IP
+	// If unable to parse, simply return IP as provided.
+	reqIP = net.ParseIP(ip)
+	if reqIP == nil {
+		return ip
+	}
+
+	if reqIP.To4() != nil {
+		return reqIP.Mask(l.V4ipMask).String()
+	} else {
+		return reqIP.Mask(l.V6ipMask).String()
+	}
+
+}
+
+// ShouldLog returns true if the path is not exempted from
+// being logged (i.e. it is not found in l.Exceptions).
+func (l Logger) ShouldLog(path string) bool {
+	for _, exc := range l.Exceptions {
+		if Path(path).Matches(exc) {
+			return false
+		}
+	}
+	return true
+}
+
+// Attach binds logger Start and Close functions to
+// controller's OnStartup and OnShutdown hooks.
+func (l *Logger) Attach(controller *caddy.Controller) {
+	if controller != nil {
+		// Opens file or connect to local/remote syslog
+		controller.OnStartup(l.Start)
+
+		// Closes file or disconnects from local/remote syslog
+		controller.OnShutdown(l.Close)
+	}
+}
+
+type syslogAddress struct {
+	network string
+	address string
+}
+
+func parseSyslogAddress(location string) *syslogAddress {
+	for prefix, network := range remoteSyslogPrefixes {
+		if strings.HasPrefix(location, prefix) {
+			return &syslogAddress{
+				network: network,
+				address: strings.TrimPrefix(location, prefix),
+			}
+		}
+	}
+
+	return nil
+}
+
+// Start initializes logger opening files or local/remote syslog connections
+func (l *Logger) Start() error {
+	// initialize mutex on start
+	l.fileMu = new(sync.RWMutex)
+
+	var err error
+
+selectwriter:
+	switch l.Output {
+	case "", "stderr":
+		l.writer = os.Stderr
+	case "stdout":
+		l.writer = os.Stdout
+	case "syslog":
+		l.writer, err = gsyslog.NewLogger(gsyslog.LOG_ERR, "LOCAL0", "caddy")
+		if err != nil {
+			return err
+		}
+	default:
+		if address := parseSyslogAddress(l.Output); address != nil {
+			l.writer, err = gsyslog.DialLogger(address.network, address.address, gsyslog.LOG_ERR, "LOCAL0", "caddy")
+
+			if err != nil {
+				return err
+			}
+
+			break selectwriter
+		}
+
+		var file *os.File
+
+		file, err = os.OpenFile(l.Output, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0644)
+		if err != nil {
+			return err
+		}
+
+		if l.Roller != nil && !l.Roller.Disabled {
+			file.Close()
+			l.Roller.Filename = l.Output
+			l.writer = l.Roller.GetLogWriter()
+		} else {
+			l.writer = file
+		}
+	}
+
+	l.Logger = log.New(l.writer, "", 0)
+
+	return nil
+
+}
+
+// Close closes open log files or connections to syslog.
+func (l *Logger) Close() error {
+	// don't close stdout or stderr
+	if l.writer == os.Stdout || l.writer == os.Stderr {
+		return nil
+	}
+
+	// Will close local/remote syslog connections too :)
+	if closer, ok := l.writer.(io.WriteCloser); ok {
+		l.fileMu.Lock()
+		err := closer.Close()
+		l.fileMu.Unlock()
+		return err
+	}
+
+	return nil
+}

vendor/github.com/mholt/caddy/caddyhttp/httpserver/middleware.go

@@ -0,0 +1,228 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"path"
+	"time"
+
+	"github.com/mholt/caddy"
+)
+
+func init() {
+	initCaseSettings()
+}
+
+type (
+	// Middleware is the middle layer which represents the traditional
+	// idea of middleware: it chains one Handler to the next by being
+	// passed the next Handler in the chain.
+	Middleware func(Handler) Handler
+
+	// ListenerMiddleware is similar to the Middleware type, except it
+	// chains one net.Listener to the next.
+	ListenerMiddleware func(caddy.Listener) caddy.Listener
+
+	// Handler is like http.Handler except ServeHTTP may return a status
+	// code and/or error.
+	//
+	// If ServeHTTP writes the response header, it should return a status
+	// code of 0. This signals to other handlers before it that the response
+	// is already handled, and that they should not write to it also. Keep
+	// in mind that writing to the response body writes the header, too.
+	//
+	// If ServeHTTP encounters an error, it should return the error value
+	// so it can be logged by designated error-handling middleware.
+	//
+	// If writing a response after calling the next ServeHTTP method, the
+	// returned status code SHOULD be used when writing the response.
+	//
+	// If handling errors after calling the next ServeHTTP method, the
+	// returned error value SHOULD be logged or handled accordingly.
+	//
+	// Otherwise, return values should be propagated down the middleware
+	// chain by returning them unchanged.
+	Handler interface {
+		ServeHTTP(http.ResponseWriter, *http.Request) (int, error)
+	}
+
+	// HandlerFunc is a convenience type like http.HandlerFunc, except
+	// ServeHTTP returns a status code and an error. See Handler
+	// documentation for more information.
+	HandlerFunc func(http.ResponseWriter, *http.Request) (int, error)
+
+	// RequestMatcher checks to see if current request should be handled
+	// by underlying handler.
+	RequestMatcher interface {
+		Match(r *http.Request) bool
+	}
+
+	// HandlerConfig is a middleware configuration.
+	// This makes it possible for middlewares to have a common
+	// configuration interface.
+	//
+	// TODO The long term plan is to get all middleware implement this
+	// interface for configurations.
+	HandlerConfig interface {
+		RequestMatcher
+		BasePath() string
+	}
+
+	// ConfigSelector selects a configuration.
+	ConfigSelector []HandlerConfig
+)
+
+// ServeHTTP implements the Handler interface.
+func (f HandlerFunc) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error) {
+	return f(w, r)
+}
+
+// Select selects a Config.
+// This chooses the config with the longest length.
+func (c ConfigSelector) Select(r *http.Request) (config HandlerConfig) {
+	for i := range c {
+		if !c[i].Match(r) {
+			continue
+		}
+		if config == nil || len(c[i].BasePath()) > len(config.BasePath()) {
+			config = c[i]
+		}
+	}
+	return config
+}
+
+// IndexFile looks for a file in /root/fpath/indexFile for each string
+// in indexFiles. If an index file is found, it returns the root-relative
+// path to the file and true. If no index file is found, empty string
+// and false is returned. fpath must end in a forward slash '/'
+// otherwise no index files will be tried (directory paths must end
+// in a forward slash according to HTTP).
+//
+// All paths passed into and returned from this function use '/' as the
+// path separator, just like URLs.  IndexFle handles path manipulation
+// internally for systems that use different path separators.
+func IndexFile(root http.FileSystem, fpath string, indexFiles []string) (string, bool) {
+	if fpath[len(fpath)-1] != '/' || root == nil {
+		return "", false
+	}
+	for _, indexFile := range indexFiles {
+		// func (http.FileSystem).Open wants all paths separated by "/",
+		// regardless of operating system convention, so use
+		// path.Join instead of filepath.Join
+		fp := path.Join(fpath, indexFile)
+		f, err := root.Open(fp)
+		if err == nil {
+			f.Close()
+			return fp, true
+		}
+	}
+	return "", false
+}
+
+// SetLastModifiedHeader checks if the provided modTime is valid and if it is sets it
+// as a Last-Modified header to the ResponseWriter. If the modTime is in the future
+// the current time is used instead.
+func SetLastModifiedHeader(w http.ResponseWriter, modTime time.Time) {
+	if modTime.IsZero() || modTime.Equal(time.Unix(0, 0)) {
+		// the time does not appear to be valid. Don't put it in the response
+		return
+	}
+
+	// RFC 2616 - Section 14.29 - Last-Modified:
+	// An origin server MUST NOT send a Last-Modified date which is later than the
+	// server's time of message origination. In such cases, where the resource's last
+	// modification would indicate some time in the future, the server MUST replace
+	// that date with the message origination date.
+	now := currentTime()
+	if modTime.After(now) {
+		modTime = now
+	}
+
+	w.Header().Set("Last-Modified", modTime.UTC().Format(http.TimeFormat))
+}
+
+// CaseSensitivePath determines if paths should be case sensitive.
+// This is configurable via CASE_SENSITIVE_PATH environment variable.
+var CaseSensitivePath = false
+
+const caseSensitivePathEnv = "CASE_SENSITIVE_PATH"
+
+// initCaseSettings loads case sensitivity config from environment variable.
+//
+// This could have been in init, but init cannot be called from tests.
+func initCaseSettings() {
+	switch os.Getenv(caseSensitivePathEnv) {
+	case "1", "true":
+		CaseSensitivePath = true
+	default:
+		CaseSensitivePath = false
+	}
+}
+
+// MergeRequestMatchers merges multiple RequestMatchers into one.
+// This allows a middleware to use multiple RequestMatchers.
+func MergeRequestMatchers(matchers ...RequestMatcher) RequestMatcher {
+	return requestMatchers(matchers)
+}
+
+type requestMatchers []RequestMatcher
+
+// Match satisfies RequestMatcher interface.
+func (m requestMatchers) Match(r *http.Request) bool {
+	for _, matcher := range m {
+		if !matcher.Match(r) {
+			return false
+		}
+	}
+	return true
+}
+
+// currentTime, as it is defined here, returns time.Now().
+// It's defined as a variable for mocking time in tests.
+var currentTime = func() time.Time { return time.Now() }
+
+// EmptyNext is a no-op function that can be passed into
+// Middleware functions so that the assignment to the
+// Next field of the Handler can be tested.
+//
+// Used primarily for testing but needs to be exported so
+// plugins can use this as a convenience.
+var EmptyNext = HandlerFunc(func(w http.ResponseWriter, r *http.Request) (int, error) { return 0, nil })
+
+// SameNext does a pointer comparison between next1 and next2.
+//
+// Used primarily for testing but needs to be exported so
+// plugins can use this as a convenience.
+func SameNext(next1, next2 Handler) bool {
+	return fmt.Sprintf("%v", next1) == fmt.Sprintf("%v", next2)
+}
+
+// Context key constants.
+const (
+	// ReplacerCtxKey is the context key for a per-request replacer.
+	ReplacerCtxKey caddy.CtxKey = "replacer"
+
+	// RemoteUserCtxKey is the key for the remote user of the request, if any (basicauth).
+	RemoteUserCtxKey caddy.CtxKey = "remote_user"
+
+	// MitmCtxKey is the key for the result of MITM detection
+	MitmCtxKey caddy.CtxKey = "mitm"
+
+	// RequestIDCtxKey is the key for the U4 UUID value
+	RequestIDCtxKey caddy.CtxKey = "request_id"
+)

vendor/github.com/mholt/caddy/caddyhttp/httpserver/mitm.go

@@ -0,0 +1,780 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"io"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/mholt/caddy/caddytls"
+	"github.com/mholt/caddy/telemetry"
+)
+
+// tlsHandler is a http.Handler that will inject a value
+// into the request context indicating if the TLS
+// connection is likely being intercepted.
+type tlsHandler struct {
+	next        http.Handler
+	listener    *tlsHelloListener
+	closeOnMITM bool // whether to close connection on MITM; TODO: expose through new directive
+}
+
+// ServeHTTP checks the User-Agent. For the four main browsers (Chrome,
+// Edge, Firefox, and Safari) indicated by the User-Agent, the properties
+// of the TLS Client Hello will be compared. The context value "mitm" will
+// be set to a value indicating if it is likely that the underlying TLS
+// connection is being intercepted.
+//
+// Note that due to Microsoft's decision to intentionally make IE/Edge
+// user agents obscure (and look like other browsers), this may offer
+// less accuracy for IE/Edge clients.
+//
+// This MITM detection capability is based on research done by Durumeric,
+// Halderman, et. al. in "The Security Impact of HTTPS Interception" (NDSS '17):
+// https://jhalderm.com/pub/papers/interception-ndss17.pdf
+func (h *tlsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// TODO: one request per connection, we should report UA in connection with
+	// handshake (reported in caddytls package) and our MITM assessment
+
+	if h.listener == nil {
+		h.next.ServeHTTP(w, r)
+		return
+	}
+
+	h.listener.helloInfosMu.RLock()
+	info := h.listener.helloInfos[r.RemoteAddr]
+	h.listener.helloInfosMu.RUnlock()
+
+	ua := r.Header.Get("User-Agent")
+	uaHash := telemetry.FastHash([]byte(ua))
+
+	// report this request's UA in connection with this ClientHello
+	go telemetry.AppendUnique("tls_client_hello_ua:"+caddytls.ClientHelloInfo(info).Key(), uaHash)
+
+	var checked, mitm bool
+	if r.Header.Get("X-BlueCoat-Via") != "" || // Blue Coat (masks User-Agent header to generic values)
+		r.Header.Get("X-FCCKV2") != "" || // Fortinet
+		info.advertisesHeartbeatSupport() { // no major browsers have ever implemented Heartbeat
+		// TODO: Move the heartbeat check into each "looksLike" function...
+		checked = true
+		mitm = true
+	} else if strings.Contains(ua, "Edge") || strings.Contains(ua, "MSIE") ||
+		strings.Contains(ua, "Trident") {
+		checked = true
+		mitm = !info.looksLikeEdge()
+	} else if strings.Contains(ua, "Chrome") {
+		checked = true
+		mitm = !info.looksLikeChrome()
+	} else if strings.Contains(ua, "CriOS") {
+		// Chrome on iOS sometimes uses iOS-provided TLS stack (which looks exactly like Safari)
+		// but for connections that don't render a web page (favicon, etc.) it uses its own...
+		checked = true
+		mitm = !info.looksLikeChrome() && !info.looksLikeSafari()
+	} else if strings.Contains(ua, "Firefox") {
+		checked = true
+		if strings.Contains(ua, "Windows") {
+			ver := getVersion(ua, "Firefox")
+			if ver == 45.0 || ver == 52.0 {
+				mitm = !info.looksLikeTor()
+			} else {
+				mitm = !info.looksLikeFirefox()
+			}
+		} else {
+			mitm = !info.looksLikeFirefox()
+		}
+	} else if strings.Contains(ua, "Safari") {
+		checked = true
+		mitm = !info.looksLikeSafari()
+	}
+
+	if checked {
+		r = r.WithContext(context.WithValue(r.Context(), MitmCtxKey, mitm))
+		if mitm {
+			go telemetry.AppendUnique("http_mitm", "likely")
+		} else {
+			go telemetry.AppendUnique("http_mitm", "unlikely")
+		}
+	} else {
+		go telemetry.AppendUnique("http_mitm", "unknown")
+	}
+
+	if mitm && h.closeOnMITM {
+		// TODO: This termination might need to happen later in the middleware
+		// chain in order to be picked up by the log directive, in case the site
+		// owner still wants to log this event. It'll probably require a new
+		// directive. If this feature is useful, we can finish implementing this.
+		r.Close = true
+		return
+	}
+
+	h.next.ServeHTTP(w, r)
+}
+
+// getVersion returns a (possibly simplified) representation of the version string
+// from a UserAgent string. It returns a float, so it can represent major and minor
+// versions; the rest of the version is just tacked on behind the decimal point.
+// The purpose of this is to stay simple while allowing for basic, fast comparisons.
+// If the version for softwareName is not found in ua, -1 is returned.
+func getVersion(ua, softwareName string) float64 {
+	search := softwareName + "/"
+	start := strings.Index(ua, search)
+	if start < 0 {
+		return -1
+	}
+	start += len(search)
+	end := strings.Index(ua[start:], " ")
+	if end < 0 {
+		end = len(ua)
+	} else {
+		end += start
+	}
+	strVer := strings.Replace(ua[start:end], "-", "", -1)
+	firstDot := strings.Index(strVer, ".")
+	if firstDot >= 0 {
+		strVer = strVer[:firstDot+1] + strings.Replace(strVer[firstDot+1:], ".", "", -1)
+	}
+	ver, err := strconv.ParseFloat(strVer, 64)
+	if err != nil {
+		return -1
+	}
+	return ver
+}
+
+// clientHelloConn reads the ClientHello
+// and stores it in the attached listener.
+type clientHelloConn struct {
+	net.Conn
+	listener  *tlsHelloListener
+	readHello bool // whether ClientHello has been read
+	buf       *bytes.Buffer
+}
+
+// Read reads from c.Conn (by letting the standard library
+// do the reading off the wire), with the exception of
+// getting a copy of the ClientHello so it can parse it.
+func (c *clientHelloConn) Read(b []byte) (n int, err error) {
+	// if we've already read the ClientHello, pass thru
+	if c.readHello {
+		return c.Conn.Read(b)
+	}
+
+	// we let the standard lib read off the wire for us, and
+	// tee that into our buffer so we can read the ClientHello
+	tee := io.TeeReader(c.Conn, c.buf)
+	n, err = tee.Read(b)
+	if err != nil {
+		return
+	}
+	if c.buf.Len() < 5 {
+		return // need to read more bytes for header
+	}
+
+	// read the header bytes
+	hdr := make([]byte, 5)
+	_, err = io.ReadFull(c.buf, hdr)
+	if err != nil {
+		return // this would be highly unusual and sad
+	}
+
+	// get length of the ClientHello message and read it
+	length := int(uint16(hdr[3])<<8 | uint16(hdr[4]))
+	if c.buf.Len() < length {
+		return // need to read more bytes
+	}
+	hello := make([]byte, length)
+	_, err = io.ReadFull(c.buf, hello)
+	if err != nil {
+		return
+	}
+	bufpool.Put(c.buf) // buffer no longer needed
+
+	// parse the ClientHello and store it in the map
+	rawParsed := parseRawClientHello(hello)
+	c.listener.helloInfosMu.Lock()
+	c.listener.helloInfos[c.Conn.RemoteAddr().String()] = rawParsed
+	c.listener.helloInfosMu.Unlock()
+
+	// report this ClientHello to telemetry
+	chKey := caddytls.ClientHelloInfo(rawParsed).Key()
+	go telemetry.SetNested("tls_client_hello", chKey, rawParsed)
+	go telemetry.AppendUnique("tls_client_hello_count", chKey)
+
+	c.readHello = true
+	return
+}
+
+// parseRawClientHello parses data which contains the raw
+// TLS Client Hello message. It extracts relevant information
+// into info. Any error reading the Client Hello (such as
+// insufficient length or invalid length values) results in
+// a silent error and an incomplete info struct, since there
+// is no good way to handle an error like this during Accept().
+// The data is expected to contain the whole ClientHello and
+// ONLY the ClientHello.
+//
+// The majority of this code is borrowed from the Go standard
+// library, which is (c) The Go Authors. It has been modified
+// to fit this use case.
+func parseRawClientHello(data []byte) (info rawHelloInfo) {
+	if len(data) < 42 {
+		return
+	}
+	info.Version = uint16(data[4])<<8 | uint16(data[5])
+	sessionIDLen := int(data[38])
+	if sessionIDLen > 32 || len(data) < 39+sessionIDLen {
+		return
+	}
+	data = data[39+sessionIDLen:]
+	if len(data) < 2 {
+		return
+	}
+	// cipherSuiteLen is the number of bytes of cipher suite numbers. Since
+	// they are uint16s, the number must be even.
+	cipherSuiteLen := int(data[0])<<8 | int(data[1])
+	if cipherSuiteLen%2 == 1 || len(data) < 2+cipherSuiteLen {
+		return
+	}
+	numCipherSuites := cipherSuiteLen / 2
+	// read in the cipher suites
+	info.CipherSuites = make([]uint16, numCipherSuites)
+	for i := 0; i < numCipherSuites; i++ {
+		info.CipherSuites[i] = uint16(data[2+2*i])<<8 | uint16(data[3+2*i])
+	}
+	data = data[2+cipherSuiteLen:]
+	if len(data) < 1 {
+		return
+	}
+	// read in the compression methods
+	compressionMethodsLen := int(data[0])
+	if len(data) < 1+compressionMethodsLen {
+		return
+	}
+	info.CompressionMethods = data[1 : 1+compressionMethodsLen]
+
+	data = data[1+compressionMethodsLen:]
+
+	// ClientHello is optionally followed by extension data
+	if len(data) < 2 {
+		return
+	}
+	extensionsLength := int(data[0])<<8 | int(data[1])
+	data = data[2:]
+	if extensionsLength != len(data) {
+		return
+	}
+
+	// read in each extension, and extract any relevant information
+	// from extensions we care about
+	for len(data) != 0 {
+		if len(data) < 4 {
+			return
+		}
+		extension := uint16(data[0])<<8 | uint16(data[1])
+		length := int(data[2])<<8 | int(data[3])
+		data = data[4:]
+		if len(data) < length {
+			return
+		}
+
+		// record that the client advertised support for this extension
+		info.Extensions = append(info.Extensions, extension)
+
+		switch extension {
+		case extensionSupportedCurves:
+			// http://tools.ietf.org/html/rfc4492#section-5.5.1
+			if length < 2 {
+				return
+			}
+			l := int(data[0])<<8 | int(data[1])
+			if l%2 == 1 || length != l+2 {
+				return
+			}
+			numCurves := l / 2
+			info.Curves = make([]tls.CurveID, numCurves)
+			d := data[2:]
+			for i := 0; i < numCurves; i++ {
+				info.Curves[i] = tls.CurveID(d[0])<<8 | tls.CurveID(d[1])
+				d = d[2:]
+			}
+		case extensionSupportedPoints:
+			// http://tools.ietf.org/html/rfc4492#section-5.5.2
+			if length < 1 {
+				return
+			}
+			l := int(data[0])
+			if length != l+1 {
+				return
+			}
+			info.Points = make([]uint8, l)
+			copy(info.Points, data[1:])
+		}
+
+		data = data[length:]
+	}
+
+	return
+}
+
+// newTLSListener returns a new tlsHelloListener that wraps ln.
+func newTLSListener(ln net.Listener, config *tls.Config) *tlsHelloListener {
+	return &tlsHelloListener{
+		Listener:   ln,
+		config:     config,
+		helloInfos: make(map[string]rawHelloInfo),
+	}
+}
+
+// tlsHelloListener is a TLS listener that is specially designed
+// to read the ClientHello manually so we can extract necessary
+// information from it. Each ClientHello message is mapped by
+// the remote address of the client, which must be removed when
+// the connection is closed (use ConnState).
+type tlsHelloListener struct {
+	net.Listener
+	config       *tls.Config
+	helloInfos   map[string]rawHelloInfo
+	helloInfosMu sync.RWMutex
+}
+
+// Accept waits for and returns the next connection to the listener.
+// After it accepts the underlying connection, it reads the
+// ClientHello message and stores the parsed data into a map on l.
+func (l *tlsHelloListener) Accept() (net.Conn, error) {
+	conn, err := l.Listener.Accept()
+	if err != nil {
+		return nil, err
+	}
+	buf := bufpool.Get().(*bytes.Buffer)
+	buf.Reset()
+	helloConn := &clientHelloConn{Conn: conn, listener: l, buf: buf}
+	return tls.Server(helloConn, l.config), nil
+}
+
+// rawHelloInfo contains the "raw" data parsed from the TLS
+// Client Hello. No interpretation is done on the raw data.
+//
+// The methods on this type implement heuristics described
+// by Durumeric, Halderman, et. al. in
+// "The Security Impact of HTTPS Interception":
+// https://jhalderm.com/pub/papers/interception-ndss17.pdf
+type rawHelloInfo caddytls.ClientHelloInfo
+
+// advertisesHeartbeatSupport returns true if info indicates
+// that the client supports the Heartbeat extension.
+func (info rawHelloInfo) advertisesHeartbeatSupport() bool {
+	for _, ext := range info.Extensions {
+		if ext == extensionHeartbeat {
+			return true
+		}
+	}
+	return false
+}
+
+// looksLikeFirefox returns true if info looks like a handshake
+// from a modern version of Firefox.
+func (info rawHelloInfo) looksLikeFirefox() bool {
+	// "To determine whether a Firefox session has been
+	// intercepted, we check for the presence and order
+	// of extensions, cipher suites, elliptic curves,
+	// EC point formats, and handshake compression methods." (early 2016)
+
+	// We check for the presence and order of the extensions.
+	// Note: Sometimes 0x15 (21, padding) is present, sometimes not.
+	// Note: Firefox 51+ does not advertise 0x3374 (13172, NPN).
+	// Note: Firefox doesn't advertise 0x0 (0, SNI) when connecting to IP addresses.
+	// Note: Firefox 55+ doesn't appear to advertise 0xFF03 (65283, short headers). It used to be between 5 and 13.
+	// Note: Firefox on Fedora (or RedHat) doesn't include ECC suites because of patent liability.
+	requiredExtensionsOrder := []uint16{23, 65281, 10, 11, 35, 16, 5, 13}
+	if !assertPresenceAndOrdering(requiredExtensionsOrder, info.Extensions, true) {
+		return false
+	}
+
+	// We check for both presence of curves and their ordering.
+	requiredCurves := []tls.CurveID{29, 23, 24, 25}
+	if len(info.Curves) < len(requiredCurves) {
+		return false
+	}
+	for i := range requiredCurves {
+		if info.Curves[i] != requiredCurves[i] {
+			return false
+		}
+	}
+	if len(info.Curves) > len(requiredCurves) {
+		// newer Firefox (55 Nightly?) may have additional curves at end of list
+		allowedCurves := []tls.CurveID{256, 257}
+		for i := range allowedCurves {
+			if info.Curves[len(requiredCurves)+i] != allowedCurves[i] {
+				return false
+			}
+		}
+	}
+
+	if hasGreaseCiphers(info.CipherSuites) {
+		return false
+	}
+
+	// We check for order of cipher suites but not presence, since
+	// according to the paper, cipher suites may be not be added
+	// or reordered by the user, but they may be disabled.
+	expectedCipherSuiteOrder := []uint16{
+		TLS_AES_128_GCM_SHA256,                      // 0x1301
+		TLS_CHACHA20_POLY1305_SHA256,                // 0x1303
+		TLS_AES_256_GCM_SHA384,                      // 0x1302
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, // 0xc02b
+		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,   // 0xc02f
+		tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,  // 0xcca9
+		tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,    // 0xcca8
+		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, // 0xc02c
+		tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,   // 0xc030
+		tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,    // 0xc00a
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,    // 0xc009
+		tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,      // 0xc013
+		tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,      // 0xc014
+		TLS_DHE_RSA_WITH_AES_128_CBC_SHA,            // 0x33
+		TLS_DHE_RSA_WITH_AES_256_CBC_SHA,            // 0x39
+		tls.TLS_RSA_WITH_AES_128_CBC_SHA,            // 0x2f
+		tls.TLS_RSA_WITH_AES_256_CBC_SHA,            // 0x35
+		tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,           // 0xa
+	}
+	return assertPresenceAndOrdering(expectedCipherSuiteOrder, info.CipherSuites, false)
+}
+
+// looksLikeChrome returns true if info looks like a handshake
+// from a modern version of Chrome.
+func (info rawHelloInfo) looksLikeChrome() bool {
+	// "We check for ciphers and extensions that Chrome is known
+	// to not support, but do not check for the inclusion of
+	// specific ciphers or extensions, nor do we validate their
+	// order. When appropriate, we check the presence and order
+	// of elliptic curves, compression methods, and EC point formats." (early 2016)
+
+	// Not in Chrome 56, but present in Safari 10 (Feb. 2017):
+	// TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024)
+	// TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
+	// TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
+	// TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
+	// TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
+	// TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
+	// TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d)
+	// TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c)
+
+	// Not in Chrome 56, but present in Firefox 51 (Feb. 2017):
+	// TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
+	// TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
+	// TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)
+	// TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39)
+
+	// Selected ciphers present in Chrome mobile (Feb. 2017):
+	// 0xc00a, 0xc014, 0xc009, 0x9c, 0x9d, 0x2f, 0x35, 0xa
+
+	chromeCipherExclusions := map[uint16]struct{}{
+		TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:     {}, // 0xc024
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: {}, // 0xc023
+		TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384:       {}, // 0xc028
+		tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:   {}, // 0xc027
+		TLS_RSA_WITH_AES_256_CBC_SHA256:             {}, // 0x3d
+		tls.TLS_RSA_WITH_AES_128_CBC_SHA256:         {}, // 0x3c
+		TLS_DHE_RSA_WITH_AES_128_CBC_SHA:            {}, // 0x33
+		TLS_DHE_RSA_WITH_AES_256_CBC_SHA:            {}, // 0x39
+	}
+	for _, ext := range info.CipherSuites {
+		if _, ok := chromeCipherExclusions[ext]; ok {
+			return false
+		}
+	}
+
+	// Chrome does not include curve 25 (CurveP521) (as of Chrome 56, Feb. 2017).
+	for _, curve := range info.Curves {
+		if curve == 25 {
+			return false
+		}
+	}
+
+	if !hasGreaseCiphers(info.CipherSuites) {
+		return false
+	}
+
+	return true
+}
+
+// looksLikeEdge returns true if info looks like a handshake
+// from a modern version of MS Edge.
+func (info rawHelloInfo) looksLikeEdge() bool {
+	// "SChannel connections can by uniquely identified because SChannel
+	// is the only TLS library we tested that includes the OCSP status
+	// request extension before the supported groups and EC point formats
+	// extensions." (early 2016)
+	//
+	// More specifically, the OCSP status request extension appears
+	// *directly* before the other two extensions, which occur in that
+	// order. (I contacted the authors for clarification and verified it.)
+	for i, ext := range info.Extensions {
+		if ext == extensionOCSPStatusRequest {
+			if len(info.Extensions) <= i+2 {
+				return false
+			}
+			if info.Extensions[i+1] != extensionSupportedCurves ||
+				info.Extensions[i+2] != extensionSupportedPoints {
+				return false
+			}
+		}
+	}
+
+	for _, cs := range info.CipherSuites {
+		// As of Feb. 2017, Edge does not have 0xff, but Avast adds it
+		if cs == scsvRenegotiation {
+			return false
+		}
+		// Edge and modern IE do not have 0x4 or 0x5, but Blue Coat does
+		if cs == TLS_RSA_WITH_RC4_128_MD5 || cs == tls.TLS_RSA_WITH_RC4_128_SHA {
+			return false
+		}
+	}
+
+	if hasGreaseCiphers(info.CipherSuites) {
+		return false
+	}
+
+	return true
+}
+
+// looksLikeSafari returns true if info looks like a handshake
+// from a modern version of MS Safari.
+func (info rawHelloInfo) looksLikeSafari() bool {
+	// "One unique aspect of Secure Transport is that it includes
+	// the TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0xff) cipher first,
+	// whereas the other libraries we investigated include the
+	// cipher last. Similar to Microsoft, Apple has changed
+	// TLS behavior in minor OS updates, which are not indicated
+	// in the HTTP User-Agent header. We allow for any of the
+	// updates when validating handshakes, and we check for the
+	// presence and ordering of ciphers, extensions, elliptic
+	// curves, and compression methods." (early 2016)
+
+	// Note that any C lib (e.g. curl) compiled on macOS
+	// will probably use Secure Transport which will also
+	// share the TLS handshake characteristics of Safari.
+
+	// We check for the presence and order of the extensions.
+	requiredExtensionsOrder := []uint16{10, 11, 13, 13172, 16, 5, 18, 23}
+	if !assertPresenceAndOrdering(requiredExtensionsOrder, info.Extensions, true) {
+		// Safari on iOS 11 (beta) uses different set/ordering of extensions
+		requiredExtensionsOrderiOS11 := []uint16{65281, 0, 23, 13, 5, 13172, 18, 16, 11, 10}
+		if !assertPresenceAndOrdering(requiredExtensionsOrderiOS11, info.Extensions, true) {
+			return false
+		}
+	} else {
+		// For these versions of Safari, expect TLS_EMPTY_RENEGOTIATION_INFO_SCSV first.
+		if len(info.CipherSuites) < 1 {
+			return false
+		}
+		if info.CipherSuites[0] != scsvRenegotiation {
+			return false
+		}
+	}
+
+	if hasGreaseCiphers(info.CipherSuites) {
+		return false
+	}
+
+	// We check for order and presence of cipher suites
+	expectedCipherSuiteOrder := []uint16{
+		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, // 0xc02c
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, // 0xc02b
+		TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,     // 0xc024
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, // 0xc023
+		tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,    // 0xc00a
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,    // 0xc009
+		tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,   // 0xc030
+		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,   // 0xc02f
+		TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,       // 0xc028
+		tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,   // 0xc027
+		tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,      // 0xc014
+		tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,      // 0xc013
+		tls.TLS_RSA_WITH_AES_256_GCM_SHA384,         // 0x9d
+		tls.TLS_RSA_WITH_AES_128_GCM_SHA256,         // 0x9c
+		TLS_RSA_WITH_AES_256_CBC_SHA256,             // 0x3d
+		tls.TLS_RSA_WITH_AES_128_CBC_SHA256,         // 0x3c
+		tls.TLS_RSA_WITH_AES_256_CBC_SHA,            // 0x35
+		tls.TLS_RSA_WITH_AES_128_CBC_SHA,            // 0x2f
+	}
+	return assertPresenceAndOrdering(expectedCipherSuiteOrder, info.CipherSuites, true)
+}
+
+// looksLikeTor returns true if the info looks like a ClientHello from Tor browser
+// (based on Firefox).
+func (info rawHelloInfo) looksLikeTor() bool {
+	requiredExtensionsOrder := []uint16{10, 11, 16, 5, 13}
+	if !assertPresenceAndOrdering(requiredExtensionsOrder, info.Extensions, true) {
+		return false
+	}
+
+	// check for session tickets support; Tor doesn't support them to prevent tracking
+	for _, ext := range info.Extensions {
+		if ext == 35 {
+			return false
+		}
+	}
+
+	// We check for both presence of curves and their ordering, including
+	// an optional curve at the beginning (for Tor based on Firefox 52)
+	infoCurves := info.Curves
+	if len(info.Curves) == 4 {
+		if info.Curves[0] != 29 {
+			return false
+		}
+		infoCurves = info.Curves[1:]
+	}
+	requiredCurves := []tls.CurveID{23, 24, 25}
+	if len(infoCurves) < len(requiredCurves) {
+		return false
+	}
+	for i := range requiredCurves {
+		if infoCurves[i] != requiredCurves[i] {
+			return false
+		}
+	}
+
+	if hasGreaseCiphers(info.CipherSuites) {
+		return false
+	}
+
+	// We check for order of cipher suites but not presence, since
+	// according to the paper, cipher suites may be not be added
+	// or reordered by the user, but they may be disabled.
+	expectedCipherSuiteOrder := []uint16{
+		TLS_AES_128_GCM_SHA256,                      // 0x1301
+		TLS_CHACHA20_POLY1305_SHA256,                // 0x1303
+		TLS_AES_256_GCM_SHA384,                      // 0x1302
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, // 0xc02b
+		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,   // 0xc02f
+		tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,  // 0xcca9
+		tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,    // 0xcca8
+		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, // 0xc02c
+		tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,   // 0xc030
+		tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,    // 0xc00a
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,    // 0xc009
+		tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,      // 0xc013
+		tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,      // 0xc014
+		TLS_DHE_RSA_WITH_AES_128_CBC_SHA,            // 0x33
+		TLS_DHE_RSA_WITH_AES_256_CBC_SHA,            // 0x39
+		tls.TLS_RSA_WITH_AES_128_CBC_SHA,            // 0x2f
+		tls.TLS_RSA_WITH_AES_256_CBC_SHA,            // 0x35
+		tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,           // 0xa
+	}
+	return assertPresenceAndOrdering(expectedCipherSuiteOrder, info.CipherSuites, false)
+}
+
+// assertPresenceAndOrdering will return true if candidateList contains
+// the items in requiredItems in the same order as requiredItems.
+//
+// If requiredIsSubset is true, then all items in requiredItems must be
+// present in candidateList. If requiredIsSubset is false, then requiredItems
+// may contain items that are not in candidateList.
+//
+// In all cases, the order of requiredItems is enforced.
+func assertPresenceAndOrdering(requiredItems, candidateList []uint16, requiredIsSubset bool) bool {
+	superset := requiredItems
+	subset := candidateList
+	if requiredIsSubset {
+		superset = candidateList
+		subset = requiredItems
+	}
+
+	var j int
+	for _, item := range subset {
+		var found bool
+		for j < len(superset) {
+			if superset[j] == item {
+				found = true
+				break
+			}
+			j++
+		}
+		if j == len(superset) && !found {
+			return false
+		}
+	}
+	return true
+}
+
+func hasGreaseCiphers(cipherSuites []uint16) bool {
+	for _, cipher := range cipherSuites {
+		if _, ok := greaseCiphers[cipher]; ok {
+			return true
+		}
+	}
+	return false
+}
+
+// pool buffers so we can reuse allocations over time
+var bufpool = sync.Pool{
+	New: func() interface{} {
+		return new(bytes.Buffer)
+	},
+}
+
+var greaseCiphers = map[uint16]struct{}{
+	0x0A0A: {},
+	0x1A1A: {},
+	0x2A2A: {},
+	0x3A3A: {},
+	0x4A4A: {},
+	0x5A5A: {},
+	0x6A6A: {},
+	0x7A7A: {},
+	0x8A8A: {},
+	0x9A9A: {},
+	0xAAAA: {},
+	0xBABA: {},
+	0xCACA: {},
+	0xDADA: {},
+	0xEAEA: {},
+	0xFAFA: {},
+}
+
+// Define variables used for TLS communication
+const (
+	extensionOCSPStatusRequest = 5
+	extensionSupportedCurves   = 10 // also called "SupportedGroups"
+	extensionSupportedPoints   = 11
+	extensionHeartbeat         = 15
+
+	scsvRenegotiation = 0xff
+
+	// cipher suites missing from the crypto/tls package,
+	// in no particular order here
+	TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 = 0xc024
+	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384   = 0xc028
+	TLS_RSA_WITH_AES_256_CBC_SHA256         = 0x3d
+	TLS_DHE_RSA_WITH_AES_128_CBC_SHA        = 0x33
+	TLS_DHE_RSA_WITH_AES_256_CBC_SHA        = 0x39
+	TLS_RSA_WITH_RC4_128_MD5                = 0x4
+
+	// new PSK ciphers introduced by TLS 1.3, not (yet) in crypto/tls
+	// https://tlswg.github.io/tls13-spec/#rfc.appendix.A.4)
+	TLS_AES_128_GCM_SHA256       = 0x1301
+	TLS_AES_256_GCM_SHA384       = 0x1302
+	TLS_CHACHA20_POLY1305_SHA256 = 0x1303
+	TLS_AES_128_CCM_SHA256       = 0x1304
+	TLS_AES_128_CCM_8_SHA256     = 0x1305
+)

vendor/github.com/mholt/caddy/caddyhttp/httpserver/path.go

@@ -0,0 +1,67 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"net/http"
+	"path"
+	"strings"
+)
+
+// Path represents a URI path. It should usually be
+// set to the value of a request path.
+type Path string
+
+// Matches checks to see if base matches p. The correct
+// usage of this method sets p as the request path, and
+// base as a Caddyfile (user-defined) rule path.
+//
+// Path matching will probably not always be a direct
+// comparison; this method assures that paths can be
+// easily and consistently matched.
+//
+// Multiple slashes are collapsed/merged. See issue #1859.
+func (p Path) Matches(base string) bool {
+	if base == "/" || base == "" {
+		return true
+	}
+
+	// sanitize the paths for comparison, very important
+	// (slightly lossy if the base path requires multiple
+	// consecutive forward slashes, since those will be merged)
+	pHasTrailingSlash := strings.HasSuffix(string(p), "/")
+	baseHasTrailingSlash := strings.HasSuffix(base, "/")
+	p = Path(path.Clean(string(p)))
+	base = path.Clean(base)
+	if pHasTrailingSlash {
+		p += "/"
+	}
+	if baseHasTrailingSlash {
+		base += "/"
+	}
+
+	if CaseSensitivePath {
+		return strings.HasPrefix(string(p), base)
+	}
+	return strings.HasPrefix(strings.ToLower(string(p)), strings.ToLower(base))
+}
+
+// PathMatcher is a Path RequestMatcher.
+type PathMatcher string
+
+// Match satisfies RequestMatcher.
+func (p PathMatcher) Match(r *http.Request) bool {
+	return Path(r.URL.Path).Matches(string(p))
+}

vendor/github.com/mholt/caddy/caddyhttp/httpserver/plugin.go

@@ -0,0 +1,729 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"crypto/tls"
+	"flag"
+	"fmt"
+	"log"
+	"net"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/mholt/caddy"
+	"github.com/mholt/caddy/caddyfile"
+	"github.com/mholt/caddy/caddyhttp/staticfiles"
+	"github.com/mholt/caddy/caddytls"
+	"github.com/mholt/caddy/telemetry"
+	"github.com/mholt/certmagic"
+)
+
+const serverType = "http"
+
+func init() {
+	flag.StringVar(&HTTPPort, "http-port", HTTPPort, "Default port to use for HTTP")
+	flag.StringVar(&HTTPSPort, "https-port", HTTPSPort, "Default port to use for HTTPS")
+	flag.StringVar(&Host, "host", DefaultHost, "Default host")
+	flag.StringVar(&Port, "port", DefaultPort, "Default port")
+	flag.StringVar(&Root, "root", DefaultRoot, "Root path of default site")
+	flag.DurationVar(&GracefulTimeout, "grace", 5*time.Second, "Maximum duration of graceful shutdown")
+	flag.BoolVar(&HTTP2, "http2", true, "Use HTTP/2")
+	flag.BoolVar(&QUIC, "quic", false, "Use experimental QUIC")
+
+	caddy.RegisterServerType(serverType, caddy.ServerType{
+		Directives: func() []string { return directives },
+		DefaultInput: func() caddy.Input {
+			if Port == DefaultPort && Host != "" {
+				// by leaving the port blank in this case we give auto HTTPS
+				// a chance to set the port to 443 for us
+				return caddy.CaddyfileInput{
+					Contents:       []byte(fmt.Sprintf("%s\nroot %s", Host, Root)),
+					ServerTypeName: serverType,
+				}
+			}
+			return caddy.CaddyfileInput{
+				Contents:       []byte(fmt.Sprintf("%s:%s\nroot %s", Host, Port, Root)),
+				ServerTypeName: serverType,
+			}
+		},
+		NewContext: newContext,
+	})
+	caddy.RegisterCaddyfileLoader("short", caddy.LoaderFunc(shortCaddyfileLoader))
+	caddy.RegisterParsingCallback(serverType, "root", hideCaddyfile)
+	caddy.RegisterParsingCallback(serverType, "tls", activateHTTPS)
+	caddytls.RegisterConfigGetter(serverType, func(c *caddy.Controller) *caddytls.Config { return GetConfig(c).TLS })
+
+	// disable the caddytls package reporting ClientHellos
+	// to telemetry, since our MITM detector does this but
+	// with more information than the standard lib provides
+	// (as of May 2018)
+	caddytls.ClientHelloTelemetry = false
+}
+
+// hideCaddyfile hides the source/origin Caddyfile if it is within the
+// site root. This function should be run after parsing the root directive.
+func hideCaddyfile(cctx caddy.Context) error {
+	ctx := cctx.(*httpContext)
+	for _, cfg := range ctx.siteConfigs {
+		// if no Caddyfile exists exit.
+		if cfg.originCaddyfile == "" {
+			return nil
+		}
+		absRoot, err := filepath.Abs(cfg.Root)
+		if err != nil {
+			return err
+		}
+		absOriginCaddyfile, err := filepath.Abs(cfg.originCaddyfile)
+		if err != nil {
+			return err
+		}
+		if strings.HasPrefix(absOriginCaddyfile, absRoot) {
+			cfg.HiddenFiles = append(cfg.HiddenFiles, filepath.ToSlash(strings.TrimPrefix(absOriginCaddyfile, absRoot)))
+		}
+	}
+	return nil
+}
+
+func newContext(inst *caddy.Instance) caddy.Context {
+	return &httpContext{instance: inst, keysToSiteConfigs: make(map[string]*SiteConfig)}
+}
+
+type httpContext struct {
+	instance *caddy.Instance
+
+	// keysToSiteConfigs maps an address at the top of a
+	// server block (a "key") to its SiteConfig. Not all
+	// SiteConfigs will be represented here, only ones
+	// that appeared in the Caddyfile.
+	keysToSiteConfigs map[string]*SiteConfig
+
+	// siteConfigs is the master list of all site configs.
+	siteConfigs []*SiteConfig
+}
+
+func (h *httpContext) saveConfig(key string, cfg *SiteConfig) {
+	h.siteConfigs = append(h.siteConfigs, cfg)
+	h.keysToSiteConfigs[key] = cfg
+}
+
+// InspectServerBlocks make sure that everything checks out before
+// executing directives and otherwise prepares the directives to
+// be parsed and executed.
+func (h *httpContext) InspectServerBlocks(sourceFile string, serverBlocks []caddyfile.ServerBlock) ([]caddyfile.ServerBlock, error) {
+	siteAddrs := make(map[string]string)
+
+	// For each address in each server block, make a new config
+	for _, sb := range serverBlocks {
+		for _, key := range sb.Keys {
+			addr, err := standardizeAddress(key)
+			if err != nil {
+				return serverBlocks, err
+			}
+
+			addr = addr.Normalize()
+			key = addr.Key()
+			if _, dup := h.keysToSiteConfigs[key]; dup {
+				return serverBlocks, fmt.Errorf("duplicate site key: %s", key)
+			}
+
+			// Fill in address components from command line so that middleware
+			// have access to the correct information during setup
+			if addr.Host == "" && Host != DefaultHost {
+				addr.Host = Host
+			}
+			if addr.Port == "" && Port != DefaultPort {
+				addr.Port = Port
+			}
+
+			// Make sure the adjusted site address is distinct
+			addrCopy := addr // make copy so we don't disturb the original, carefully-parsed address struct
+			if addrCopy.Port == "" && Port == DefaultPort {
+				addrCopy.Port = Port
+			}
+			addrStr := addrCopy.String()
+			if otherSiteKey, dup := siteAddrs[addrStr]; dup {
+				err := fmt.Errorf("duplicate site address: %s", addrStr)
+				if (addrCopy.Host == Host && Host != DefaultHost) ||
+					(addrCopy.Port == Port && Port != DefaultPort) {
+					err = fmt.Errorf("site defined as %s is a duplicate of %s because of modified "+
+						"default host and/or port values (usually via -host or -port flags)", key, otherSiteKey)
+				}
+				return serverBlocks, err
+			}
+			siteAddrs[addrStr] = key
+
+			// If default HTTP or HTTPS ports have been customized,
+			// make sure the ACME challenge ports match
+			var altHTTPPort, altTLSALPNPort int
+			if HTTPPort != DefaultHTTPPort {
+				portInt, err := strconv.Atoi(HTTPPort)
+				if err != nil {
+					return nil, err
+				}
+				altHTTPPort = portInt
+			}
+			if HTTPSPort != DefaultHTTPSPort {
+				portInt, err := strconv.Atoi(HTTPSPort)
+				if err != nil {
+					return nil, err
+				}
+				altTLSALPNPort = portInt
+			}
+
+			// Make our caddytls.Config, which has a pointer to the
+			// instance's certificate cache and enough information
+			// to use automatic HTTPS when the time comes
+			caddytlsConfig, err := caddytls.NewConfig(h.instance)
+			if err != nil {
+				return nil, fmt.Errorf("creating new caddytls configuration: %v", err)
+			}
+			caddytlsConfig.Hostname = addr.Host
+			caddytlsConfig.Manager.AltHTTPPort = altHTTPPort
+			caddytlsConfig.Manager.AltTLSALPNPort = altTLSALPNPort
+
+			// Save the config to our master list, and key it for lookups
+			cfg := &SiteConfig{
+				Addr:            addr,
+				Root:            Root,
+				TLS:             caddytlsConfig,
+				originCaddyfile: sourceFile,
+				IndexPages:      staticfiles.DefaultIndexPages,
+			}
+			h.saveConfig(key, cfg)
+		}
+	}
+
+	// For sites that have gzip (which gets chained in
+	// before the error handler) we should ensure that the
+	// errors directive also appears so error pages aren't
+	// written after the gzip writer is closed. See #616.
+	for _, sb := range serverBlocks {
+		_, hasGzip := sb.Tokens["gzip"]
+		_, hasErrors := sb.Tokens["errors"]
+		if hasGzip && !hasErrors {
+			sb.Tokens["errors"] = []caddyfile.Token{{Text: "errors"}}
+		}
+	}
+
+	return serverBlocks, nil
+}
+
+// MakeServers uses the newly-created siteConfigs to
+// create and return a list of server instances.
+func (h *httpContext) MakeServers() ([]caddy.Server, error) {
+	// make a rough estimate as to whether we're in a "production
+	// environment/system" - start by assuming that most production
+	// servers will set their default CA endpoint to a public,
+	// trusted CA (obviously not a perfect heuristic)
+	var looksLikeProductionCA bool
+	for _, publicCAEndpoint := range caddytls.KnownACMECAs {
+		if strings.Contains(certmagic.CA, publicCAEndpoint) {
+			looksLikeProductionCA = true
+			break
+		}
+	}
+
+	// Iterate each site configuration and make sure that:
+	// 1) TLS is disabled for explicitly-HTTP sites (necessary
+	//    when an HTTP address shares a block containing tls)
+	// 2) if QUIC is enabled, TLS ClientAuth is not, because
+	//    currently, QUIC does not support ClientAuth (TODO:
+	//    revisit this when our QUIC implementation supports it)
+	// 3) if TLS ClientAuth is used, StrictHostMatching is on
+	var atLeastOneSiteLooksLikeProduction bool
+	for _, cfg := range h.siteConfigs {
+		// see if all the addresses (both sites and
+		// listeners) are loopback to help us determine
+		// if this is a "production" instance or not
+		if !atLeastOneSiteLooksLikeProduction {
+			if !caddy.IsLoopback(cfg.Addr.Host) &&
+				!caddy.IsLoopback(cfg.ListenHost) &&
+				(caddytls.QualifiesForManagedTLS(cfg) ||
+					certmagic.HostQualifies(cfg.Addr.Host)) {
+				atLeastOneSiteLooksLikeProduction = true
+			}
+		}
+
+		// make sure TLS is disabled for explicitly-HTTP sites
+		// (necessary when HTTP address shares a block containing tls)
+		if !cfg.TLS.Enabled {
+			continue
+		}
+		if cfg.Addr.Port == HTTPPort || cfg.Addr.Scheme == "http" {
+			cfg.TLS.Enabled = false
+			log.Printf("[WARNING] TLS disabled for %s", cfg.Addr)
+		} else if cfg.Addr.Scheme == "" {
+			// set scheme to https ourselves, since TLS is enabled
+			// and it was not explicitly set to something else. this
+			// makes it appear as "https" when we print the list of
+			// running sites; otherwise "http" would be assumed which
+			// is incorrect for this site.
+			cfg.Addr.Scheme = "https"
+		}
+		if cfg.Addr.Port == "" && ((!cfg.TLS.Manual && !cfg.TLS.SelfSigned) || cfg.TLS.Manager.OnDemand != nil) {
+			// this is vital, otherwise the function call below that
+			// sets the listener address will use the default port
+			// instead of 443 because it doesn't know about TLS.
+			cfg.Addr.Port = HTTPSPort
+		}
+		if cfg.TLS.ClientAuth != tls.NoClientCert {
+			if QUIC {
+				return nil, fmt.Errorf("cannot enable TLS client authentication with QUIC, because QUIC does not yet support it")
+			}
+			// this must be enabled so that a client cannot connect
+			// using SNI for another site on this listener that
+			// does NOT require ClientAuth, and then send HTTP
+			// requests with the Host header of this site which DOES
+			// require client auth, thus bypassing it...
+			cfg.StrictHostMatching = true
+		}
+	}
+
+	// we must map (group) each config to a bind address
+	groups, err := groupSiteConfigsByListenAddr(h.siteConfigs)
+	if err != nil {
+		return nil, err
+	}
+
+	// then we create a server for each group
+	var servers []caddy.Server
+	for addr, group := range groups {
+		s, err := NewServer(addr, group)
+		if err != nil {
+			return nil, err
+		}
+		servers = append(servers, s)
+	}
+
+	// NOTE: This value is only a "good guess". Quite often, development
+	// environments will use internal DNS or a local hosts file to serve
+	// real-looking domains in local development. We can't easily tell
+	// which without doing a DNS lookup, so this guess is definitely naive,
+	// and if we ever want a better guess, we will have to do DNS lookups.
+	deploymentGuess := "dev"
+	if looksLikeProductionCA && atLeastOneSiteLooksLikeProduction {
+		deploymentGuess = "prod"
+	}
+	telemetry.Set("http_deployment_guess", deploymentGuess)
+	telemetry.Set("http_num_sites", len(h.siteConfigs))
+
+	return servers, nil
+}
+
+// normalizedKey returns "normalized" key representation:
+//  scheme and host names are lowered, everything else stays the same
+func normalizedKey(key string) string {
+	addr, err := standardizeAddress(key)
+	if err != nil {
+		return key
+	}
+	return addr.Normalize().Key()
+}
+
+// GetConfig gets the SiteConfig that corresponds to c.
+// If none exist (should only happen in tests), then a
+// new, empty one will be created.
+func GetConfig(c *caddy.Controller) *SiteConfig {
+	ctx := c.Context().(*httpContext)
+	key := normalizedKey(c.Key)
+	if cfg, ok := ctx.keysToSiteConfigs[key]; ok {
+		return cfg
+	}
+	// we should only get here during tests because directive
+	// actions typically skip the server blocks where we make
+	// the configs
+	cfg := &SiteConfig{
+		Root:       Root,
+		TLS:        &caddytls.Config{Manager: certmagic.NewDefault()},
+		IndexPages: staticfiles.DefaultIndexPages,
+	}
+	ctx.saveConfig(key, cfg)
+	return cfg
+}
+
+// shortCaddyfileLoader loads a Caddyfile if positional arguments are
+// detected, or, in other words, if un-named arguments are provided to
+// the program. A "short Caddyfile" is one in which each argument
+// is a line of the Caddyfile. The default host and port are prepended
+// according to the Host and Port values.
+func shortCaddyfileLoader(serverType string) (caddy.Input, error) {
+	if flag.NArg() > 0 && serverType == "http" {
+		confBody := fmt.Sprintf("%s:%s\n%s", Host, Port, strings.Join(flag.Args(), "\n"))
+		return caddy.CaddyfileInput{
+			Contents:       []byte(confBody),
+			Filepath:       "args",
+			ServerTypeName: serverType,
+		}, nil
+	}
+	return nil, nil
+}
+
+// groupSiteConfigsByListenAddr groups site configs by their listen
+// (bind) address, so sites that use the same listener can be served
+// on the same server instance. The return value maps the listen
+// address (what you pass into net.Listen) to the list of site configs.
+// This function does NOT vet the configs to ensure they are compatible.
+func groupSiteConfigsByListenAddr(configs []*SiteConfig) (map[string][]*SiteConfig, error) {
+	groups := make(map[string][]*SiteConfig)
+
+	for _, conf := range configs {
+		// We would add a special case here so that localhost addresses
+		// bind to 127.0.0.1 if conf.ListenHost is not already set, which
+		// would prevent outsiders from even connecting; but that was problematic:
+		// https://caddy.community/t/wildcard-virtual-domains-with-wildcard-roots/221/5?u=matt
+
+		if conf.Addr.Port == "" {
+			conf.Addr.Port = Port
+		}
+		addr, err := net.ResolveTCPAddr("tcp", net.JoinHostPort(conf.ListenHost, conf.Addr.Port))
+		if err != nil {
+			return nil, err
+		}
+		addrstr := addr.String()
+		groups[addrstr] = append(groups[addrstr], conf)
+	}
+
+	return groups, nil
+}
+
+// Address represents a site address. It contains
+// the original input value, and the component
+// parts of an address. The component parts may be
+// updated to the correct values as setup proceeds,
+// but the original value should never be changed.
+//
+// The Host field must be in a normalized form.
+type Address struct {
+	Original, Scheme, Host, Port, Path string
+}
+
+// String returns a human-friendly print of the address.
+func (a Address) String() string {
+	if a.Host == "" && a.Port == "" {
+		return ""
+	}
+	scheme := a.Scheme
+	if scheme == "" {
+		if a.Port == HTTPSPort {
+			scheme = "https"
+		} else {
+			scheme = "http"
+		}
+	}
+	s := scheme
+	if s != "" {
+		s += "://"
+	}
+	if a.Port != "" &&
+		((scheme == "https" && a.Port != DefaultHTTPSPort) ||
+			(scheme == "http" && a.Port != DefaultHTTPPort)) {
+		s += net.JoinHostPort(a.Host, a.Port)
+	} else {
+		s += a.Host
+	}
+	if a.Path != "" {
+		s += a.Path
+	}
+	return s
+}
+
+// VHost returns a sensible concatenation of Host:Port/Path from a.
+// It's basically the a.Original but without the scheme.
+func (a Address) VHost() string {
+	if idx := strings.Index(a.Original, "://"); idx > -1 {
+		return a.Original[idx+3:]
+	}
+	return a.Original
+}
+
+// Normalize normalizes URL: turn scheme and host names into lower case
+func (a Address) Normalize() Address {
+	path := a.Path
+	if !CaseSensitivePath {
+		path = strings.ToLower(path)
+	}
+
+	// ensure host is normalized if it's an IP address
+	host := a.Host
+	if ip := net.ParseIP(host); ip != nil {
+		host = ip.String()
+	}
+
+	return Address{
+		Original: a.Original,
+		Scheme:   strings.ToLower(a.Scheme),
+		Host:     strings.ToLower(host),
+		Port:     a.Port,
+		Path:     path,
+	}
+}
+
+// Key is similar to String, just replaces scheme and host values with modified values.
+// Unlike String it doesn't add anything default (scheme, port, etc)
+func (a Address) Key() string {
+	res := ""
+	if a.Scheme != "" {
+		res += a.Scheme + "://"
+	}
+	if a.Host != "" {
+		res += a.Host
+	}
+	if a.Port != "" {
+		if strings.HasPrefix(a.Original[len(res):], ":"+a.Port) {
+			// insert port only if the original has its own explicit port
+			res += ":" + a.Port
+		}
+	}
+	if a.Path != "" {
+		res += a.Path
+	}
+	return res
+}
+
+// standardizeAddress parses an address string into a structured format with separate
+// scheme, host, port, and path portions, as well as the original input string.
+func standardizeAddress(str string) (Address, error) {
+	input := str
+
+	// Split input into components (prepend with // to assert host by default)
+	if !strings.Contains(str, "//") && !strings.HasPrefix(str, "/") {
+		str = "//" + str
+	}
+	u, err := url.Parse(str)
+	if err != nil {
+		return Address{}, err
+	}
+
+	// separate host and port
+	host, port, err := net.SplitHostPort(u.Host)
+	if err != nil {
+		host, port, err = net.SplitHostPort(u.Host + ":")
+		if err != nil {
+			host = u.Host
+		}
+	}
+
+	// see if we can set port based off scheme
+	if port == "" {
+		if u.Scheme == "http" {
+			port = HTTPPort
+		} else if u.Scheme == "https" {
+			port = HTTPSPort
+		}
+	}
+
+	// repeated or conflicting scheme is confusing, so error
+	if u.Scheme != "" && (port == "http" || port == "https") {
+		return Address{}, fmt.Errorf("[%s] scheme specified twice in address", input)
+	}
+
+	// error if scheme and port combination violate convention
+	if (u.Scheme == "http" && port == HTTPSPort) || (u.Scheme == "https" && port == HTTPPort) {
+		return Address{}, fmt.Errorf("[%s] scheme and port violate convention", input)
+	}
+
+	// standardize http and https ports to their respective port numbers
+	if port == "http" {
+		u.Scheme = "http"
+		port = HTTPPort
+	} else if port == "https" {
+		u.Scheme = "https"
+		port = HTTPSPort
+	}
+
+	return Address{Original: input, Scheme: u.Scheme, Host: host, Port: port, Path: u.Path}, err
+}
+
+// RegisterDevDirective splices name into the list of directives
+// immediately before another directive. This function is ONLY
+// for plugin development purposes! NEVER use it for a plugin
+// that you are not currently building. If before is empty,
+// the directive will be appended to the end of the list.
+//
+// It is imperative that directives execute in the proper
+// order, and hard-coding the list of directives guarantees
+// a correct, absolute order every time. This function is
+// convenient when developing a plugin, but it does not
+// guarantee absolute ordering. Multiple plugins registering
+// directives with this function will lead to non-
+// deterministic builds and buggy software.
+//
+// Directive names must be lower-cased and unique. Any errors
+// here are fatal, and even successful calls print a message
+// to stdout as a reminder to use it only in development.
+func RegisterDevDirective(name, before string) {
+	if name == "" {
+		fmt.Println("[FATAL] Cannot register empty directive name")
+		os.Exit(1)
+	}
+	if strings.ToLower(name) != name {
+		fmt.Printf("[FATAL] %s: directive name must be lowercase\n", name)
+		os.Exit(1)
+	}
+	for _, dir := range directives {
+		if dir == name {
+			fmt.Printf("[FATAL] %s: directive name already exists\n", name)
+			os.Exit(1)
+		}
+	}
+	if before == "" {
+		directives = append(directives, name)
+	} else {
+		var found bool
+		for i, dir := range directives {
+			if dir == before {
+				directives = append(directives[:i], append([]string{name}, directives[i:]...)...)
+				found = true
+				break
+			}
+		}
+		if !found {
+			fmt.Printf("[FATAL] %s: directive not found\n", before)
+			os.Exit(1)
+		}
+	}
+	msg := fmt.Sprintf("Registered directive '%s' ", name)
+	if before == "" {
+		msg += "at end of list"
+	} else {
+		msg += fmt.Sprintf("before '%s'", before)
+	}
+	fmt.Printf("[DEV NOTICE] %s\n", msg)
+}
+
+// directives is the list of all directives known to exist for the
+// http server type, including non-standard (3rd-party) directives.
+// The ordering of this list is important.
+var directives = []string{
+	// primitive actions that set up the fundamental vitals of each config
+	"root",
+	"index",
+	"bind",
+	"limits",
+	"timeouts",
+	"tls",
+
+	// services/utilities, or other directives that don't necessarily inject handlers
+	"startup",  // TODO: Deprecate this directive
+	"shutdown", // TODO: Deprecate this directive
+	"on",
+	"supervisor", // github.com/lucaslorentz/caddy-supervisor
+	"request_id",
+	"realip", // github.com/captncraig/caddy-realip
+	"git",    // github.com/abiosoft/caddy-git
+
+	// directives that add listener middleware to the stack
+	"proxyprotocol", // github.com/mastercactapus/caddy-proxyprotocol
+
+	// directives that add middleware to the stack
+	"locale", // github.com/simia-tech/caddy-locale
+	"log",
+	"cache", // github.com/nicolasazrak/caddy-cache
+	"rewrite",
+	"ext",
+	"minify", // github.com/hacdias/caddy-minify
+	"gzip",
+	"header",
+	"geoip", // github.com/kodnaplakal/caddy-geoip
+	"errors",
+	"authz",        // github.com/casbin/caddy-authz
+	"filter",       // github.com/echocat/caddy-filter
+	"ipfilter",     // github.com/pyed/ipfilter
+	"ratelimit",    // github.com/xuqingfeng/caddy-rate-limit
+	"expires",      // github.com/epicagency/caddy-expires
+	"forwardproxy", // github.com/caddyserver/forwardproxy
+	"basicauth",
+	"redir",
+	"status",
+	"cors",      // github.com/captncraig/cors/caddy
+	"s3browser", // github.com/techknowlogick/caddy-s3browser
+	"nobots",    // github.com/Xumeiquer/nobots
+	"mime",
+	"login",     // github.com/tarent/loginsrv/caddy
+	"reauth",    // github.com/freman/caddy-reauth
+	"extauth",   // github.com/BTBurke/caddy-extauth
+	"jwt",       // github.com/BTBurke/caddy-jwt
+	"jsonp",     // github.com/pschlump/caddy-jsonp
+	"upload",    // blitznote.com/src/caddy.upload
+	"multipass", // github.com/namsral/multipass/caddy
+	"internal",
+	"pprof",
+	"expvar",
+	"push",
+	"datadog",    // github.com/payintech/caddy-datadog
+	"prometheus", // github.com/miekg/caddy-prometheus
+	"templates",
+	"proxy",
+	"fastcgi",
+	"cgi", // github.com/jung-kurt/caddy-cgi
+	"websocket",
+	"filebrowser", // github.com/filebrowser/caddy
+	"webdav",      // github.com/hacdias/caddy-webdav
+	"markdown",
+	"browse",
+	"mailout",   // github.com/SchumacherFM/mailout
+	"awses",     // github.com/miquella/caddy-awses
+	"awslambda", // github.com/coopernurse/caddy-awslambda
+	"grpc",      // github.com/pieterlouw/caddy-grpc
+	"gopkg",     // github.com/zikes/gopkg
+	"restic",    // github.com/restic/caddy
+	"wkd",       // github.com/emersion/caddy-wkd
+}
+
+const (
+	// DefaultHost is the default host.
+	DefaultHost = ""
+	// DefaultPort is the default port.
+	DefaultPort = "2015"
+	// DefaultRoot is the default root folder.
+	DefaultRoot = "."
+	// DefaultHTTPPort is the default port for HTTP.
+	DefaultHTTPPort = "80"
+	// DefaultHTTPSPort is the default port for HTTPS.
+	DefaultHTTPSPort = "443"
+)
+
+// These "soft defaults" are configurable by
+// command line flags, etc.
+var (
+	// Root is the site root
+	Root = DefaultRoot
+
+	// Host is the site host
+	Host = DefaultHost
+
+	// Port is the site port
+	Port = DefaultPort
+
+	// GracefulTimeout is the maximum duration of a graceful shutdown.
+	GracefulTimeout time.Duration
+
+	// HTTP2 indicates whether HTTP2 is enabled or not.
+	HTTP2 bool
+
+	// QUIC indicates whether QUIC is enabled or not.
+	QUIC bool
+
+	// HTTPPort is the port to use for HTTP.
+	HTTPPort = DefaultHTTPPort
+
+	// HTTPSPort is the port to use for HTTPS.
+	HTTPSPort = DefaultHTTPSPort
+)

vendor/github.com/mholt/caddy/caddyhttp/httpserver/recorder.go

@@ -0,0 +1,261 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"sync"
+	"time"
+)
+
+// ResponseRecorder is a type of http.ResponseWriter that captures
+// the status code written to it and also the size of the body
+// written in the response. A status code does not have
+// to be written, however, in which case 200 must be assumed.
+// It is best to have the constructor initialize this type
+// with that default status code.
+//
+// Setting the Replacer field allows middlewares to type-assert
+// the http.ResponseWriter to ResponseRecorder and set their own
+// placeholder values for logging utilities to use.
+//
+// Beware when accessing the Replacer value; it may be nil!
+type ResponseRecorder struct {
+	*ResponseWriterWrapper
+	Replacer Replacer
+	status   int
+	size     int
+	start    time.Time
+}
+
+// NewResponseRecorder makes and returns a new ResponseRecorder.
+// Because a status is not set unless WriteHeader is called
+// explicitly, this constructor initializes with a status code
+// of 200 to cover the default case.
+func NewResponseRecorder(w http.ResponseWriter) *ResponseRecorder {
+	return &ResponseRecorder{
+		ResponseWriterWrapper: &ResponseWriterWrapper{ResponseWriter: w},
+		status:                http.StatusOK,
+		start:                 time.Now(),
+	}
+}
+
+// WriteHeader records the status code and calls the
+// underlying ResponseWriter's WriteHeader method.
+func (r *ResponseRecorder) WriteHeader(status int) {
+	r.status = status
+	r.ResponseWriterWrapper.WriteHeader(status)
+}
+
+// Write is a wrapper that records the size of the body
+// that gets written.
+func (r *ResponseRecorder) Write(buf []byte) (int, error) {
+	n, err := r.ResponseWriterWrapper.Write(buf)
+	if err == nil {
+		r.size += n
+	}
+	return n, err
+}
+
+// Size returns the size of the recorded response body.
+func (r *ResponseRecorder) Size() int {
+	return r.size
+}
+
+// Status returns the recorded response status code.
+func (r *ResponseRecorder) Status() int {
+	return r.status
+}
+
+// ResponseBuffer is a type that conditionally buffers the
+// response in memory. It implements http.ResponseWriter so
+// that it can stream the response if it is not buffering.
+// Whether it buffers is decided by a func passed into the
+// constructor, NewResponseBuffer.
+//
+// This type implements http.ResponseWriter, so you can pass
+// this to the Next() middleware in the chain and record its
+// response. However, since the entire response body will be
+// buffered in memory, only use this when explicitly configured
+// and required for some specific reason. For example, the
+// text/template package only parses templates out of []byte
+// and not io.Reader, so the templates directive uses this
+// type to obtain the entire template text, but only on certain
+// requests that match the right Content-Type, etc.
+//
+// ResponseBuffer also implements io.ReaderFrom for performance
+// reasons. The standard lib's http.response type (unexported)
+// uses io.Copy to write the body. io.Copy makes an allocation
+// if the destination does not have a ReadFrom method (or if
+// the source does not have a WriteTo method, but that's
+// irrelevant here). Our ReadFrom is smart: if buffering, it
+// calls the buffer's ReadFrom, which makes no allocs because
+// it is already a buffer! If we're streaming the response
+// instead, ReadFrom uses io.CopyBuffer with a pooled buffer
+// that is managed within this package.
+type ResponseBuffer struct {
+	*ResponseWriterWrapper
+	Buffer       *bytes.Buffer
+	header       http.Header
+	status       int
+	shouldBuffer func(status int, header http.Header) bool
+	stream       bool
+	rw           http.ResponseWriter
+	wroteHeader  bool
+}
+
+// NewResponseBuffer returns a new ResponseBuffer that will
+// use buf to store the full body of the response if shouldBuffer
+// returns true. If shouldBuffer returns false, then the response
+// body will be streamed directly to rw.
+//
+// shouldBuffer will be passed the status code and header fields of
+// the response. With that information, the function should decide
+// whether to buffer the response in memory. For example: the templates
+// directive uses this to determine whether the response is the
+// right Content-Type (according to user config) for a template.
+//
+// For performance, the buf you pass in should probably be obtained
+// from a sync.Pool in order to reuse allocated space.
+func NewResponseBuffer(buf *bytes.Buffer, rw http.ResponseWriter,
+	shouldBuffer func(status int, header http.Header) bool) *ResponseBuffer {
+	rb := &ResponseBuffer{
+		Buffer:       buf,
+		header:       make(http.Header),
+		status:       http.StatusOK, // default status code
+		shouldBuffer: shouldBuffer,
+		rw:           rw,
+	}
+	rb.ResponseWriterWrapper = &ResponseWriterWrapper{ResponseWriter: rw}
+	return rb
+}
+
+// Header returns the response header map.
+func (rb *ResponseBuffer) Header() http.Header {
+	return rb.header
+}
+
+// WriteHeader calls shouldBuffer to decide whether the
+// upcoming body should be buffered, and then writes
+// the header to the response.
+func (rb *ResponseBuffer) WriteHeader(status int) {
+	if rb.wroteHeader {
+		return
+	}
+	rb.wroteHeader = true
+
+	rb.status = status
+	rb.stream = !rb.shouldBuffer(status, rb.header)
+	if rb.stream {
+		rb.CopyHeader()
+		rb.ResponseWriterWrapper.WriteHeader(status)
+	}
+}
+
+// Write writes buf to rb.Buffer if buffering, otherwise
+// to the ResponseWriter directly if streaming.
+func (rb *ResponseBuffer) Write(buf []byte) (int, error) {
+	if !rb.wroteHeader {
+		rb.WriteHeader(http.StatusOK)
+	}
+
+	if rb.stream {
+		return rb.ResponseWriterWrapper.Write(buf)
+	}
+	return rb.Buffer.Write(buf)
+}
+
+// Buffered returns whether rb has decided to buffer the response.
+func (rb *ResponseBuffer) Buffered() bool {
+	return !rb.stream
+}
+
+// CopyHeader copies the buffered header in rb to the ResponseWriter,
+// but it does not write the header out.
+func (rb *ResponseBuffer) CopyHeader() {
+	for field, val := range rb.header {
+		rb.ResponseWriterWrapper.Header()[field] = val
+	}
+}
+
+// ReadFrom avoids allocations when writing to the buffer (if buffering),
+// and reduces allocations when writing to the ResponseWriter directly
+// (if streaming).
+//
+// In local testing with the templates directive, req/sec were improved
+// from ~8,200 to ~9,600 on templated files by ensuring that this type
+// implements io.ReaderFrom.
+func (rb *ResponseBuffer) ReadFrom(src io.Reader) (int64, error) {
+	if !rb.wroteHeader {
+		rb.WriteHeader(http.StatusOK)
+	}
+
+	if rb.stream {
+		// first see if we can avoid any allocations at all
+		if wt, ok := src.(io.WriterTo); ok {
+			return wt.WriteTo(rb.ResponseWriterWrapper)
+		}
+		// if not, use a pooled copy buffer to reduce allocs
+		// (this improved req/sec from ~25,300 to ~27,000 on
+		// static files served directly with the fileserver,
+		// but results fluctuated a little on each run).
+		// a note of caution:
+		// https://go-review.googlesource.com/c/22134#message-ff351762308fe05f6b72a487d6842e3988916486
+		buf := respBufPool.Get().([]byte)
+		n, err := io.CopyBuffer(rb.ResponseWriterWrapper, src, buf)
+		respBufPool.Put(buf) // deferring this slowed down benchmarks a smidgin, I think
+		return n, err
+	}
+	return rb.Buffer.ReadFrom(src)
+}
+
+// StatusCodeWriter returns an http.ResponseWriter that always
+// writes the status code stored in rb from when a response
+// was buffered to it.
+func (rb *ResponseBuffer) StatusCodeWriter(w http.ResponseWriter) http.ResponseWriter {
+	return forcedStatusCodeWriter{w, rb}
+}
+
+// forcedStatusCodeWriter is used to force a status code when
+// writing the header. It uses the status code saved on rb.
+// This is useful if passing a http.ResponseWriter into
+// http.ServeContent because ServeContent hard-codes 2xx status
+// codes. If we buffered the response, we force that status code
+// instead.
+type forcedStatusCodeWriter struct {
+	http.ResponseWriter
+	rb *ResponseBuffer
+}
+
+func (fscw forcedStatusCodeWriter) WriteHeader(int) {
+	fscw.ResponseWriter.WriteHeader(fscw.rb.status)
+}
+
+// respBufPool is used for io.CopyBuffer when ResponseBuffer
+// is configured to stream a response.
+var respBufPool = &sync.Pool{
+	New: func() interface{} {
+		return make([]byte, 32*1024)
+	},
+}
+
+// Interface guards
+var (
+	_ HTTPInterfaces = (*ResponseRecorder)(nil)
+	_ HTTPInterfaces = (*ResponseBuffer)(nil)
+	_ io.ReaderFrom  = (*ResponseBuffer)(nil)
+)

vendor/github.com/mholt/caddy/caddyhttp/httpserver/replacer.go

@@ -0,0 +1,561 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/mholt/caddy"
+	"github.com/mholt/caddy/caddytls"
+)
+
+// requestReplacer is a strings.Replacer which is used to
+// encode literal \r and \n characters and keep everything
+// on one line
+var requestReplacer = strings.NewReplacer(
+	"\r", "\\r",
+	"\n", "\\n",
+)
+
+var now = time.Now
+
+// Replacer is a type which can replace placeholder
+// substrings in a string with actual values from a
+// http.Request and ResponseRecorder. Always use
+// NewReplacer to get one of these. Any placeholders
+// made with Set() should overwrite existing values if
+// the key is already used.
+type Replacer interface {
+	Replace(string) string
+	Set(key, value string)
+}
+
+// replacer implements Replacer. customReplacements
+// is used to store custom replacements created with
+// Set() until the time of replacement, at which point
+// they will be used to overwrite other replacements
+// if there is a name conflict.
+type replacer struct {
+	customReplacements map[string]string
+	emptyValue         string
+	responseRecorder   *ResponseRecorder
+	request            *http.Request
+	requestBody        *limitWriter
+}
+
+type limitWriter struct {
+	w      bytes.Buffer
+	remain int
+}
+
+func newLimitWriter(max int) *limitWriter {
+	return &limitWriter{
+		w:      bytes.Buffer{},
+		remain: max,
+	}
+}
+
+func (lw *limitWriter) Write(p []byte) (int, error) {
+	// skip if we are full
+	if lw.remain <= 0 {
+		return len(p), nil
+	}
+	if n := len(p); n > lw.remain {
+		p = p[:lw.remain]
+	}
+	n, err := lw.w.Write(p)
+	lw.remain -= n
+	return n, err
+}
+
+func (lw *limitWriter) String() string {
+	return lw.w.String()
+}
+
+// NewReplacer makes a new replacer based on r and rr which
+// are used for request and response placeholders, respectively.
+// Request placeholders are created immediately, whereas
+// response placeholders are not created until Replace()
+// is invoked. rr may be nil if it is not available.
+// emptyValue should be the string that is used in place
+// of empty string (can still be empty string).
+func NewReplacer(r *http.Request, rr *ResponseRecorder, emptyValue string) Replacer {
+	repl := &replacer{
+		request:          r,
+		responseRecorder: rr,
+		emptyValue:       emptyValue,
+	}
+
+	// extract customReplacements from a request replacer when present.
+	if existing, ok := r.Context().Value(ReplacerCtxKey).(*replacer); ok {
+		repl.requestBody = existing.requestBody
+		repl.customReplacements = existing.customReplacements
+	} else {
+		// if there is no existing replacer, build one from scratch.
+		rb := newLimitWriter(MaxLogBodySize)
+		if r.Body != nil {
+			r.Body = struct {
+				io.Reader
+				io.Closer
+			}{io.TeeReader(r.Body, rb), io.Closer(r.Body)}
+		}
+		repl.requestBody = rb
+		repl.customReplacements = make(map[string]string)
+	}
+
+	return repl
+}
+
+func canLogRequest(r *http.Request) bool {
+	if r.Method == "POST" || r.Method == "PUT" {
+		for _, cType := range r.Header[headerContentType] {
+			// the cType could have charset and other info
+			if strings.Contains(cType, contentTypeJSON) || strings.Contains(cType, contentTypeXML) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// unescapeBraces finds escaped braces in s and returns
+// a string with those braces unescaped.
+func unescapeBraces(s string) string {
+	s = strings.Replace(s, "\\{", "{", -1)
+	s = strings.Replace(s, "\\}", "}", -1)
+	return s
+}
+
+// Replace performs a replacement of values on s and returns
+// the string with the replaced values.
+func (r *replacer) Replace(s string) string {
+	// Do not attempt replacements if no placeholder is found.
+	if !strings.ContainsAny(s, "{}") {
+		return s
+	}
+
+	result := ""
+Placeholders: // process each placeholder in sequence
+	for {
+		var idxStart, idxEnd int
+
+		idxOffset := 0
+		for { // find first unescaped opening brace
+			searchSpace := s[idxOffset:]
+			idxStart = strings.Index(searchSpace, "{")
+			if idxStart == -1 {
+				// no more placeholders
+				break Placeholders
+			}
+			if idxStart == 0 || searchSpace[idxStart-1] != '\\' {
+				// preceding character is not an escape
+				idxStart += idxOffset
+				break
+			}
+			// the brace we found was escaped
+			// search the rest of the string next
+			idxOffset += idxStart + 1
+		}
+
+		idxOffset = 0
+		for { // find first unescaped closing brace
+			searchSpace := s[idxStart+idxOffset:]
+			idxEnd = strings.Index(searchSpace, "}")
+			if idxEnd == -1 {
+				// unpaired placeholder
+				break Placeholders
+			}
+			if idxEnd == 0 || searchSpace[idxEnd-1] != '\\' {
+				// preceding character is not an escape
+				idxEnd += idxOffset + idxStart
+				break
+			}
+			// the brace we found was escaped
+			// search the rest of the string next
+			idxOffset += idxEnd + 1
+		}
+
+		// get a replacement for the unescaped placeholder
+		placeholder := unescapeBraces(s[idxStart : idxEnd+1])
+		replacement := r.getSubstitution(placeholder)
+
+		// append unescaped prefix + replacement
+		result += strings.TrimPrefix(unescapeBraces(s[:idxStart]), "\\") + replacement
+
+		// strip out scanned parts
+		s = s[idxEnd+1:]
+	}
+
+	// append unscanned parts
+	return result + unescapeBraces(s)
+}
+
+func roundDuration(d time.Duration) time.Duration {
+	if d >= time.Millisecond {
+		return round(d, time.Millisecond)
+	} else if d >= time.Microsecond {
+		return round(d, time.Microsecond)
+	}
+
+	return d
+}
+
+// round rounds d to the nearest r
+func round(d, r time.Duration) time.Duration {
+	if r <= 0 {
+		return d
+	}
+	neg := d < 0
+	if neg {
+		d = -d
+	}
+	if m := d % r; m+m < r {
+		d = d - m
+	} else {
+		d = d + r - m
+	}
+	if neg {
+		return -d
+	}
+	return d
+}
+
+// getPeerCert returns peer certificate
+func (r *replacer) getPeerCert() *x509.Certificate {
+	if r.request.TLS != nil && len(r.request.TLS.PeerCertificates) > 0 {
+		return r.request.TLS.PeerCertificates[0]
+	}
+
+	return nil
+}
+
+// getSubstitution retrieves value from corresponding key
+func (r *replacer) getSubstitution(key string) string {
+	// search custom replacements first
+	if value, ok := r.customReplacements[key]; ok {
+		return value
+	}
+
+	// search request headers then
+	if key[1] == '>' {
+		want := key[2 : len(key)-1]
+		for key, values := range r.request.Header {
+			// Header placeholders (case-insensitive)
+			if strings.EqualFold(key, want) {
+				return strings.Join(values, ",")
+			}
+		}
+	}
+	// search response headers then
+	if r.responseRecorder != nil && key[1] == '<' {
+		want := key[2 : len(key)-1]
+		for key, values := range r.responseRecorder.Header() {
+			// Header placeholders (case-insensitive)
+			if strings.EqualFold(key, want) {
+				return strings.Join(values, ",")
+			}
+		}
+	}
+	// next check for cookies
+	if key[1] == '~' {
+		name := key[2 : len(key)-1]
+		if cookie, err := r.request.Cookie(name); err == nil {
+			return cookie.Value
+		}
+	}
+	// next check for query argument
+	if key[1] == '?' {
+		query := r.request.URL.Query()
+		name := key[2 : len(key)-1]
+		return query.Get(name)
+	}
+
+	// search default replacements in the end
+	switch key {
+	case "{method}":
+		return r.request.Method
+	case "{scheme}":
+		if r.request.TLS != nil {
+			return "https"
+		}
+		return "http"
+	case "{hostname}":
+		name, err := os.Hostname()
+		if err != nil {
+			return r.emptyValue
+		}
+		return name
+	case "{host}":
+		return r.request.Host
+	case "{hostonly}":
+		host, _, err := net.SplitHostPort(r.request.Host)
+		if err != nil {
+			return r.request.Host
+		}
+		return host
+	case "{path}":
+		u, _ := r.request.Context().Value(OriginalURLCtxKey).(url.URL)
+		return u.Path
+	case "{path_escaped}":
+		u, _ := r.request.Context().Value(OriginalURLCtxKey).(url.URL)
+		return url.QueryEscape(u.Path)
+	case "{request_id}":
+		reqid, _ := r.request.Context().Value(RequestIDCtxKey).(string)
+		return reqid
+	case "{rewrite_path}":
+		return r.request.URL.Path
+	case "{rewrite_path_escaped}":
+		return url.QueryEscape(r.request.URL.Path)
+	case "{query}":
+		u, _ := r.request.Context().Value(OriginalURLCtxKey).(url.URL)
+		return u.RawQuery
+	case "{query_escaped}":
+		u, _ := r.request.Context().Value(OriginalURLCtxKey).(url.URL)
+		return url.QueryEscape(u.RawQuery)
+	case "{fragment}":
+		u, _ := r.request.Context().Value(OriginalURLCtxKey).(url.URL)
+		return u.Fragment
+	case "{proto}":
+		return r.request.Proto
+	case "{remote}":
+		host, _, err := net.SplitHostPort(r.request.RemoteAddr)
+		if err != nil {
+			return r.request.RemoteAddr
+		}
+		return host
+	case "{port}":
+		_, port, err := net.SplitHostPort(r.request.RemoteAddr)
+		if err != nil {
+			return r.emptyValue
+		}
+		return port
+	case "{uri}":
+		u, _ := r.request.Context().Value(OriginalURLCtxKey).(url.URL)
+		return u.RequestURI()
+	case "{uri_escaped}":
+		u, _ := r.request.Context().Value(OriginalURLCtxKey).(url.URL)
+		return url.QueryEscape(u.RequestURI())
+	case "{rewrite_uri}":
+		return r.request.URL.RequestURI()
+	case "{rewrite_uri_escaped}":
+		return url.QueryEscape(r.request.URL.RequestURI())
+	case "{when}":
+		return now().Format(timeFormat)
+	case "{when_iso_local}":
+		return now().Format(timeFormatISO)
+	case "{when_iso}":
+		return now().UTC().Format(timeFormatISOUTC)
+	case "{when_unix}":
+		return strconv.FormatInt(now().Unix(), 10)
+	case "{when_unix_ms}":
+		return strconv.FormatInt(nanoToMilliseconds(now().UnixNano()), 10)
+	case "{file}":
+		_, file := path.Split(r.request.URL.Path)
+		return file
+	case "{dir}":
+		dir, _ := path.Split(r.request.URL.Path)
+		return dir
+	case "{request}":
+		dump, err := httputil.DumpRequest(r.request, false)
+		if err != nil {
+			return r.emptyValue
+		}
+		return requestReplacer.Replace(string(dump))
+	case "{request_body}":
+		if !canLogRequest(r.request) {
+			return r.emptyValue
+		}
+		_, err := ioutil.ReadAll(r.request.Body)
+		if err != nil {
+			if err == ErrMaxBytesExceeded {
+				return r.emptyValue
+			}
+		}
+		return requestReplacer.Replace(r.requestBody.String())
+	case "{mitm}":
+		if val, ok := r.request.Context().Value(caddy.CtxKey("mitm")).(bool); ok {
+			if val {
+				return "likely"
+			}
+			return "unlikely"
+		}
+		return "unknown"
+	case "{status}":
+		if r.responseRecorder == nil {
+			return r.emptyValue
+		}
+		return strconv.Itoa(r.responseRecorder.status)
+	case "{size}":
+		if r.responseRecorder == nil {
+			return r.emptyValue
+		}
+		return strconv.Itoa(r.responseRecorder.size)
+	case "{latency}":
+		if r.responseRecorder == nil {
+			return r.emptyValue
+		}
+		return roundDuration(time.Since(r.responseRecorder.start)).String()
+	case "{latency_ms}":
+		if r.responseRecorder == nil {
+			return r.emptyValue
+		}
+		elapsedDuration := time.Since(r.responseRecorder.start)
+		return strconv.FormatInt(convertToMilliseconds(elapsedDuration), 10)
+	case "{tls_protocol}":
+		if r.request.TLS != nil {
+			if name, err := caddytls.GetSupportedProtocolName(r.request.TLS.Version); err == nil {
+				return name
+			} else {
+				return "tls" // this should never happen, but guard in case
+			}
+		}
+		return r.emptyValue // because not using a secure channel
+	case "{tls_cipher}":
+		if r.request.TLS != nil {
+			if name, err := caddytls.GetSupportedCipherName(r.request.TLS.CipherSuite); err == nil {
+				return name
+			} else {
+				return "UNKNOWN" // this should never happen, but guard in case
+			}
+		}
+		return r.emptyValue
+	case "{tls_client_escaped_cert}":
+		cert := r.getPeerCert()
+		if cert != nil {
+			pemBlock := pem.Block{
+				Type:  "CERTIFICATE",
+				Bytes: cert.Raw,
+			}
+			return url.QueryEscape(string(pem.EncodeToMemory(&pemBlock)))
+		}
+		return r.emptyValue
+	case "{tls_client_fingerprint}":
+		cert := r.getPeerCert()
+		if cert != nil {
+			return fmt.Sprintf("%x", sha256.Sum256(cert.Raw))
+		}
+		return r.emptyValue
+	case "{tls_client_i_dn}":
+		cert := r.getPeerCert()
+		if cert != nil {
+			return cert.Issuer.String()
+		}
+		return r.emptyValue
+	case "{tls_client_raw_cert}":
+		cert := r.getPeerCert()
+		if cert != nil {
+			return string(cert.Raw)
+		}
+		return r.emptyValue
+	case "{tls_client_s_dn}":
+		cert := r.getPeerCert()
+		if cert != nil {
+			return cert.Subject.String()
+		}
+		return r.emptyValue
+	case "{tls_client_serial}":
+		cert := r.getPeerCert()
+		if cert != nil {
+			return fmt.Sprintf("%x", cert.SerialNumber)
+		}
+		return r.emptyValue
+	case "{tls_client_v_end}":
+		cert := r.getPeerCert()
+		if cert != nil {
+			return cert.NotAfter.In(time.UTC).Format("Jan 02 15:04:05 2006 MST")
+		}
+		return r.emptyValue
+	case "{tls_client_v_remain}":
+		cert := r.getPeerCert()
+		if cert != nil {
+			now := time.Now().In(time.UTC)
+			days := int64(cert.NotAfter.Sub(now).Seconds() / 86400)
+			return strconv.FormatInt(days, 10)
+		}
+		return r.emptyValue
+	case "{tls_client_v_start}":
+		cert := r.getPeerCert()
+		if cert != nil {
+			return cert.NotBefore.Format("Jan 02 15:04:05 2006 MST")
+		}
+		return r.emptyValue
+	case "{server_port}":
+		_, port, err := net.SplitHostPort(r.request.Host)
+		if err != nil {
+			if r.request.TLS != nil {
+				return "443"
+			} else {
+				return "80"
+			}
+		}
+		return port
+	default:
+		// {labelN}
+		if strings.HasPrefix(key, "{label") {
+			nStr := key[6 : len(key)-1] // get the integer N in "{labelN}"
+			n, err := strconv.Atoi(nStr)
+			if err != nil || n < 1 {
+				return r.emptyValue
+			}
+			labels := strings.Split(r.request.Host, ".")
+			if n > len(labels) {
+				return r.emptyValue
+			}
+			return labels[n-1]
+		}
+	}
+
+	return r.emptyValue
+}
+
+func nanoToMilliseconds(d int64) int64 {
+	return d / 1e6
+}
+
+// convertToMilliseconds returns the number of milliseconds in the given duration
+func convertToMilliseconds(d time.Duration) int64 {
+	return nanoToMilliseconds(d.Nanoseconds())
+}
+
+// Set sets key to value in the r.customReplacements map.
+func (r *replacer) Set(key, value string) {
+	r.customReplacements["{"+key+"}"] = value
+}
+
+const (
+	timeFormat        = "02/Jan/2006:15:04:05 -0700"
+	timeFormatISO     = "2006-01-02T15:04:05"  // ISO 8601 with timezone to be assumed as local
+	timeFormatISOUTC  = "2006-01-02T15:04:05Z" // ISO 8601 with timezone to be assumed as UTC
+	headerContentType = "Content-Type"
+	contentTypeJSON   = "application/json"
+	contentTypeXML    = "application/xml"
+	// MaxLogBodySize limits the size of logged request's body
+	MaxLogBodySize = 100 * 1024
+)

vendor/github.com/mholt/caddy/caddyhttp/httpserver/responsewriterwrapper.go

@@ -0,0 +1,79 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"bufio"
+	"net"
+	"net/http"
+)
+
+// ResponseWriterWrapper wrappers underlying ResponseWriter
+// and inherits its Hijacker/Pusher/CloseNotifier/Flusher as well.
+type ResponseWriterWrapper struct {
+	http.ResponseWriter
+}
+
+// Hijack implements http.Hijacker. It simply wraps the underlying
+// ResponseWriter's Hijack method if there is one, or returns an error.
+func (rww *ResponseWriterWrapper) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	if hj, ok := rww.ResponseWriter.(http.Hijacker); ok {
+		return hj.Hijack()
+	}
+	return nil, nil, NonHijackerError{Underlying: rww.ResponseWriter}
+}
+
+// Flush implements http.Flusher. It simply wraps the underlying
+// ResponseWriter's Flush method if there is one, or panics.
+func (rww *ResponseWriterWrapper) Flush() {
+	if f, ok := rww.ResponseWriter.(http.Flusher); ok {
+		f.Flush()
+	} else {
+		panic(NonFlusherError{Underlying: rww.ResponseWriter})
+	}
+}
+
+// CloseNotify implements http.CloseNotifier.
+// It just inherits the underlying ResponseWriter's CloseNotify method.
+// It panics if the underlying ResponseWriter is not a CloseNotifier.
+func (rww *ResponseWriterWrapper) CloseNotify() <-chan bool {
+	if cn, ok := rww.ResponseWriter.(http.CloseNotifier); ok {
+		return cn.CloseNotify()
+	}
+	panic(NonCloseNotifierError{Underlying: rww.ResponseWriter})
+}
+
+// Push implements http.Pusher.
+// It just inherits the underlying ResponseWriter's Push method.
+// It panics if the underlying ResponseWriter is not a Pusher.
+func (rww *ResponseWriterWrapper) Push(target string, opts *http.PushOptions) error {
+	if pusher, hasPusher := rww.ResponseWriter.(http.Pusher); hasPusher {
+		return pusher.Push(target, opts)
+	}
+
+	return NonPusherError{Underlying: rww.ResponseWriter}
+}
+
+// HTTPInterfaces mix all the interfaces that middleware ResponseWriters need to support.
+type HTTPInterfaces interface {
+	http.ResponseWriter
+	http.Pusher
+	http.Flusher
+	http.CloseNotifier
+	http.Hijacker
+}
+
+// Interface guards
+var _ HTTPInterfaces = (*ResponseWriterWrapper)(nil)

vendor/github.com/mholt/caddy/caddyhttp/httpserver/roller.go

@@ -0,0 +1,143 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"errors"
+	"io"
+	"path/filepath"
+	"strconv"
+
+	lumberjack "gopkg.in/natefinch/lumberjack.v2"
+)
+
+// LogRoller implements a type that provides a rolling logger.
+type LogRoller struct {
+	Disabled   bool
+	Filename   string
+	MaxSize    int
+	MaxAge     int
+	MaxBackups int
+	Compress   bool
+	LocalTime  bool
+}
+
+// GetLogWriter returns an io.Writer that writes to a rolling logger.
+// This should be called only from the main goroutine (like during
+// server setup) because this method is not thread-safe; it is careful
+// to create only one log writer per log file, even if the log file
+// is shared by different sites or middlewares. This ensures that
+// rolling is synchronized, since a process (or multiple processes)
+// should not create more than one roller on the same file at the
+// same time. See issue #1363.
+func (l LogRoller) GetLogWriter() io.Writer {
+	absPath, err := filepath.Abs(l.Filename)
+	if err != nil {
+		absPath = l.Filename // oh well, hopefully they're consistent in how they specify the filename
+	}
+	lj, has := lumberjacks[absPath]
+	if !has {
+		lj = &lumberjack.Logger{
+			Filename:   l.Filename,
+			MaxSize:    l.MaxSize,
+			MaxAge:     l.MaxAge,
+			MaxBackups: l.MaxBackups,
+			Compress:   l.Compress,
+			LocalTime:  l.LocalTime,
+		}
+		lumberjacks[absPath] = lj
+	}
+	return lj
+}
+
+// IsLogRollerSubdirective is true if the subdirective is for the log roller.
+func IsLogRollerSubdirective(subdir string) bool {
+	return subdir == directiveRotateSize ||
+		subdir == directiveRotateAge ||
+		subdir == directiveRotateKeep ||
+		subdir == directiveRotateCompress ||
+		subdir == directiveRotateDisable
+}
+
+var errInvalidRollParameter = errors.New("invalid roller parameter")
+
+// ParseRoller parses roller contents out of c.
+func ParseRoller(l *LogRoller, what string, where ...string) error {
+	if l == nil {
+		l = DefaultLogRoller()
+	}
+
+	// rotate_compress doesn't accept any parameters.
+	// others only accept one parameter
+	if ((what == directiveRotateCompress || what == directiveRotateDisable) && len(where) != 0) ||
+		((what != directiveRotateCompress && what != directiveRotateDisable) && len(where) != 1) {
+		return errInvalidRollParameter
+	}
+
+	var (
+		value int
+		err   error
+	)
+	if what != directiveRotateCompress && what != directiveRotateDisable {
+		value, err = strconv.Atoi(where[0])
+		if err != nil {
+			return err
+		}
+	}
+
+	switch what {
+	case directiveRotateDisable:
+		l.Disabled = true
+	case directiveRotateSize:
+		l.MaxSize = value
+	case directiveRotateAge:
+		l.MaxAge = value
+	case directiveRotateKeep:
+		l.MaxBackups = value
+	case directiveRotateCompress:
+		l.Compress = true
+	}
+	return nil
+}
+
+// DefaultLogRoller will roll logs by default.
+func DefaultLogRoller() *LogRoller {
+	return &LogRoller{
+		MaxSize:    defaultRotateSize,
+		MaxAge:     defaultRotateAge,
+		MaxBackups: defaultRotateKeep,
+		Compress:   false,
+		LocalTime:  true,
+	}
+}
+
+const (
+	// defaultRotateSize is 100 MB.
+	defaultRotateSize = 100
+	// defaultRotateAge is 14 days.
+	defaultRotateAge = 14
+	// defaultRotateKeep is 10 files.
+	defaultRotateKeep = 10
+
+	directiveRotateDisable  = "rotate_disable"
+	directiveRotateSize     = "rotate_size"
+	directiveRotateAge      = "rotate_age"
+	directiveRotateKeep     = "rotate_keep"
+	directiveRotateCompress = "rotate_compress"
+)
+
+// lumberjacks maps log filenames to the logger
+// that is being used to keep them rolled/maintained.
+var lumberjacks = make(map[string]io.Writer)

vendor/github.com/mholt/caddy/caddyhttp/httpserver/server.go

@@ -0,0 +1,619 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package httpserver implements an HTTP server on top of Caddy.
+package httpserver
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/h2quic"
+	"github.com/mholt/caddy"
+	"github.com/mholt/caddy/caddyhttp/staticfiles"
+	"github.com/mholt/caddy/caddytls"
+	"github.com/mholt/caddy/telemetry"
+)
+
+// Server is the HTTP server implementation.
+type Server struct {
+	Server      *http.Server
+	quicServer  *h2quic.Server
+	listener    net.Listener
+	listenerMu  sync.Mutex
+	sites       []*SiteConfig
+	connTimeout time.Duration // max time to wait for a connection before force stop
+	tlsGovChan  chan struct{} // close to stop the TLS maintenance goroutine
+	vhosts      *vhostTrie
+}
+
+// ensure it satisfies the interface
+var _ caddy.GracefulServer = new(Server)
+
+var defaultALPN = []string{"h2", "http/1.1"}
+
+// makeTLSConfig extracts TLS settings from each site config to
+// build a tls.Config usable in Caddy HTTP servers. The returned
+// config will be nil if TLS is disabled for these sites.
+func makeTLSConfig(group []*SiteConfig) (*tls.Config, error) {
+	var tlsConfigs []*caddytls.Config
+	for i := range group {
+		if HTTP2 && len(group[i].TLS.ALPN) == 0 {
+			// if no application-level protocol was configured up to now,
+			// default to HTTP/2, then HTTP/1.1 if necessary
+			group[i].TLS.ALPN = defaultALPN
+		}
+		tlsConfigs = append(tlsConfigs, group[i].TLS)
+	}
+	return caddytls.MakeTLSConfig(tlsConfigs)
+}
+
+func getFallbacks(sites []*SiteConfig) []string {
+	fallbacks := []string{}
+	for _, sc := range sites {
+		if sc.FallbackSite {
+			fallbacks = append(fallbacks, sc.Addr.Host)
+		}
+	}
+	return fallbacks
+}
+
+// NewServer creates a new Server instance that will listen on addr
+// and will serve the sites configured in group.
+func NewServer(addr string, group []*SiteConfig) (*Server, error) {
+	s := &Server{
+		Server:      makeHTTPServerWithTimeouts(addr, group),
+		vhosts:      newVHostTrie(),
+		sites:       group,
+		connTimeout: GracefulTimeout,
+	}
+	s.vhosts.fallbackHosts = append(s.vhosts.fallbackHosts, getFallbacks(group)...)
+	s.Server = makeHTTPServerWithHeaderLimit(s.Server, group)
+	s.Server.Handler = s // this is weird, but whatever
+
+	// extract TLS settings from each site config to build
+	// a tls.Config, which will not be nil if TLS is enabled
+	tlsConfig, err := makeTLSConfig(group)
+	if err != nil {
+		return nil, err
+	}
+	s.Server.TLSConfig = tlsConfig
+
+	// if TLS is enabled, make sure we prepare the Server accordingly
+	if s.Server.TLSConfig != nil {
+		// enable QUIC if desired (requires HTTP/2)
+		if HTTP2 && QUIC {
+			s.quicServer = &h2quic.Server{Server: s.Server}
+			s.Server.Handler = s.wrapWithSvcHeaders(s.Server.Handler)
+		}
+
+		// wrap the HTTP handler with a handler that does MITM detection
+		tlsh := &tlsHandler{next: s.Server.Handler}
+		s.Server.Handler = tlsh // this needs to be the "outer" handler when Serve() is called, for type assertion
+
+		// when Serve() creates the TLS listener later, that listener should
+		// be adding a reference the ClientHello info to a map; this callback
+		// will be sure to clear out that entry when the connection closes.
+		s.Server.ConnState = func(c net.Conn, cs http.ConnState) {
+			// when a connection closes or is hijacked, delete its entry
+			// in the map, because we are done with it.
+			if tlsh.listener != nil {
+				if cs == http.StateHijacked || cs == http.StateClosed {
+					tlsh.listener.helloInfosMu.Lock()
+					delete(tlsh.listener.helloInfos, c.RemoteAddr().String())
+					tlsh.listener.helloInfosMu.Unlock()
+				}
+			}
+		}
+
+		// As of Go 1.7, if the Server's TLSConfig is not nil, HTTP/2 is enabled only
+		// if TLSConfig.NextProtos includes the string "h2"
+		if HTTP2 && len(s.Server.TLSConfig.NextProtos) == 0 {
+			// some experimenting shows that this NextProtos must have at least
+			// one value that overlaps with the NextProtos of any other tls.Config
+			// that is returned from GetConfigForClient; if there is no overlap,
+			// the connection will fail (as of Go 1.8, Feb. 2017).
+			s.Server.TLSConfig.NextProtos = defaultALPN
+		}
+	}
+
+	// Compile custom middleware for every site (enables virtual hosting)
+	for _, site := range group {
+		stack := Handler(staticfiles.FileServer{Root: http.Dir(site.Root), Hide: site.HiddenFiles, IndexPages: site.IndexPages})
+		for i := len(site.middleware) - 1; i >= 0; i-- {
+			stack = site.middleware[i](stack)
+		}
+		site.middlewareChain = stack
+		s.vhosts.Insert(site.Addr.VHost(), site)
+	}
+
+	return s, nil
+}
+
+// makeHTTPServerWithHeaderLimit apply minimum header limit within a group to given http.Server
+func makeHTTPServerWithHeaderLimit(s *http.Server, group []*SiteConfig) *http.Server {
+	var min int64
+	for _, cfg := range group {
+		limit := cfg.Limits.MaxRequestHeaderSize
+		if limit == 0 {
+			continue
+		}
+
+		// not set yet
+		if min == 0 {
+			min = limit
+		}
+
+		// find a better one
+		if limit < min {
+			min = limit
+		}
+	}
+
+	if min > 0 {
+		s.MaxHeaderBytes = int(min)
+	}
+	return s
+}
+
+// makeHTTPServerWithTimeouts makes an http.Server from the group of
+// configs in a way that configures timeouts (or, if not set, it uses
+// the default timeouts) by combining the configuration of each
+// SiteConfig in the group. (Timeouts are important for mitigating
+// slowloris attacks.)
+func makeHTTPServerWithTimeouts(addr string, group []*SiteConfig) *http.Server {
+	// find the minimum duration configured for each timeout
+	var min Timeouts
+	for _, cfg := range group {
+		if cfg.Timeouts.ReadTimeoutSet &&
+			(!min.ReadTimeoutSet || cfg.Timeouts.ReadTimeout < min.ReadTimeout) {
+			min.ReadTimeoutSet = true
+			min.ReadTimeout = cfg.Timeouts.ReadTimeout
+		}
+		if cfg.Timeouts.ReadHeaderTimeoutSet &&
+			(!min.ReadHeaderTimeoutSet || cfg.Timeouts.ReadHeaderTimeout < min.ReadHeaderTimeout) {
+			min.ReadHeaderTimeoutSet = true
+			min.ReadHeaderTimeout = cfg.Timeouts.ReadHeaderTimeout
+		}
+		if cfg.Timeouts.WriteTimeoutSet &&
+			(!min.WriteTimeoutSet || cfg.Timeouts.WriteTimeout < min.WriteTimeout) {
+			min.WriteTimeoutSet = true
+			min.WriteTimeout = cfg.Timeouts.WriteTimeout
+		}
+		if cfg.Timeouts.IdleTimeoutSet &&
+			(!min.IdleTimeoutSet || cfg.Timeouts.IdleTimeout < min.IdleTimeout) {
+			min.IdleTimeoutSet = true
+			min.IdleTimeout = cfg.Timeouts.IdleTimeout
+		}
+	}
+
+	// for the values that were not set, use defaults
+	if !min.ReadTimeoutSet {
+		min.ReadTimeout = defaultTimeouts.ReadTimeout
+	}
+	if !min.ReadHeaderTimeoutSet {
+		min.ReadHeaderTimeout = defaultTimeouts.ReadHeaderTimeout
+	}
+	if !min.WriteTimeoutSet {
+		min.WriteTimeout = defaultTimeouts.WriteTimeout
+	}
+	if !min.IdleTimeoutSet {
+		min.IdleTimeout = defaultTimeouts.IdleTimeout
+	}
+
+	// set the final values on the server and return it
+	return &http.Server{
+		Addr:              addr,
+		ReadTimeout:       min.ReadTimeout,
+		ReadHeaderTimeout: min.ReadHeaderTimeout,
+		WriteTimeout:      min.WriteTimeout,
+		IdleTimeout:       min.IdleTimeout,
+	}
+}
+
+func (s *Server) wrapWithSvcHeaders(previousHandler http.Handler) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		s.quicServer.SetQuicHeaders(w.Header())
+		previousHandler.ServeHTTP(w, r)
+	}
+}
+
+// Listen creates an active listener for s that can be
+// used to serve requests.
+func (s *Server) Listen() (net.Listener, error) {
+	if s.Server == nil {
+		return nil, fmt.Errorf("Server field is nil")
+	}
+
+	ln, err := net.Listen("tcp", s.Server.Addr)
+	if err != nil {
+		var succeeded bool
+		if runtime.GOOS == "windows" {
+			// Windows has been known to keep sockets open even after closing the listeners.
+			// Tests reveal this error case easily because they call Start() then Stop()
+			// in succession. TODO: Better way to handle this? And why limit this to Windows?
+			for i := 0; i < 20; i++ {
+				time.Sleep(100 * time.Millisecond)
+				ln, err = net.Listen("tcp", s.Server.Addr)
+				if err == nil {
+					succeeded = true
+					break
+				}
+			}
+		}
+		if !succeeded {
+			return nil, err
+		}
+	}
+
+	if tcpLn, ok := ln.(*net.TCPListener); ok {
+		ln = tcpKeepAliveListener{TCPListener: tcpLn}
+	}
+
+	cln := s.WrapListener(ln)
+
+	// Very important to return a concrete caddy.Listener
+	// implementation for graceful restarts.
+	return cln.(caddy.Listener), nil
+}
+
+// WrapListener wraps ln in the listener middlewares configured
+// for this server.
+func (s *Server) WrapListener(ln net.Listener) net.Listener {
+	if ln == nil {
+		return nil
+	}
+	cln := ln.(caddy.Listener)
+	for _, site := range s.sites {
+		for _, m := range site.listenerMiddleware {
+			cln = m(cln)
+		}
+	}
+	return cln
+}
+
+// ListenPacket creates udp connection for QUIC if it is enabled,
+func (s *Server) ListenPacket() (net.PacketConn, error) {
+	if QUIC {
+		udpAddr, err := net.ResolveUDPAddr("udp", s.Server.Addr)
+		if err != nil {
+			return nil, err
+		}
+		return net.ListenUDP("udp", udpAddr)
+	}
+	return nil, nil
+}
+
+// Serve serves requests on ln. It blocks until ln is closed.
+func (s *Server) Serve(ln net.Listener) error {
+	s.listenerMu.Lock()
+	s.listener = ln
+	s.listenerMu.Unlock()
+
+	if s.Server.TLSConfig != nil {
+		// Create TLS listener - note that we do not replace s.listener
+		// with this TLS listener; tls.listener is unexported and does
+		// not implement the File() method we need for graceful restarts
+		// on POSIX systems.
+		// TODO: Is this ^ still relevant anymore? Maybe we can now that it's a net.Listener...
+		ln = newTLSListener(ln, s.Server.TLSConfig)
+		if handler, ok := s.Server.Handler.(*tlsHandler); ok {
+			handler.listener = ln.(*tlsHelloListener)
+		}
+
+		// Rotate TLS session ticket keys
+		s.tlsGovChan = caddytls.RotateSessionTicketKeys(s.Server.TLSConfig)
+	}
+
+	err := s.Server.Serve(ln)
+	if err == http.ErrServerClosed {
+		err = nil // not an error worth reporting since closing a server is intentional
+	}
+	if s.quicServer != nil {
+		s.quicServer.Close()
+	}
+	return err
+}
+
+// ServePacket serves QUIC requests on pc until it is closed.
+func (s *Server) ServePacket(pc net.PacketConn) error {
+	if s.quicServer != nil {
+		err := s.quicServer.Serve(pc.(*net.UDPConn))
+		return fmt.Errorf("serving QUIC connections: %v", err)
+	}
+	return nil
+}
+
+// ServeHTTP is the entry point of all HTTP requests.
+func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	defer func() {
+		// We absolutely need to be sure we stay alive up here,
+		// even though, in theory, the errors middleware does this.
+		if rec := recover(); rec != nil {
+			log.Printf("[PANIC] %v", rec)
+			DefaultErrorFunc(w, r, http.StatusInternalServerError)
+		}
+	}()
+
+	// record the User-Agent string (with a cap on its length to mitigate attacks)
+	ua := r.Header.Get("User-Agent")
+	if len(ua) > 512 {
+		ua = ua[:512]
+	}
+	uaHash := telemetry.FastHash([]byte(ua)) // this is a normalized field
+	go telemetry.SetNested("http_user_agent", uaHash, ua)
+	go telemetry.AppendUnique("http_user_agent_count", uaHash)
+	go telemetry.Increment("http_request_count")
+
+	// copy the original, unchanged URL into the context
+	// so it can be referenced by middlewares
+	urlCopy := *r.URL
+	if r.URL.User != nil {
+		userInfo := new(url.Userinfo)
+		*userInfo = *r.URL.User
+		urlCopy.User = userInfo
+	}
+	c := context.WithValue(r.Context(), OriginalURLCtxKey, urlCopy)
+	r = r.WithContext(c)
+
+	// Setup a replacer for the request that keeps track of placeholder
+	// values across plugins.
+	replacer := NewReplacer(r, nil, "")
+	c = context.WithValue(r.Context(), ReplacerCtxKey, replacer)
+	r = r.WithContext(c)
+
+	w.Header().Set("Server", caddy.AppName)
+
+	status, _ := s.serveHTTP(w, r)
+
+	// Fallback error response in case error handling wasn't chained in
+	if status >= 400 {
+		DefaultErrorFunc(w, r, status)
+	}
+}
+
+func (s *Server) serveHTTP(w http.ResponseWriter, r *http.Request) (int, error) {
+	// strip out the port because it's not used in virtual
+	// hosting; the port is irrelevant because each listener
+	// is on a different port.
+	hostname, _, err := net.SplitHostPort(r.Host)
+	if err != nil {
+		hostname = r.Host
+	}
+
+	// look up the virtualhost; if no match, serve error
+	vhost, pathPrefix := s.vhosts.Match(hostname + r.URL.Path)
+	c := context.WithValue(r.Context(), caddy.CtxKey("path_prefix"), pathPrefix)
+	r = r.WithContext(c)
+
+	if vhost == nil {
+		// check for ACME challenge even if vhost is nil;
+		// could be a new host coming online soon - choose any
+		// vhost's cert manager configuration, I guess
+		if len(s.sites) > 0 && s.sites[0].TLS.Manager.HandleHTTPChallenge(w, r) {
+			return 0, nil
+		}
+
+		// otherwise, log the error and write a message to the client
+		remoteHost, _, err := net.SplitHostPort(r.RemoteAddr)
+		if err != nil {
+			remoteHost = r.RemoteAddr
+		}
+		WriteSiteNotFound(w, r) // don't add headers outside of this function (http.forwardproxy)
+		log.Printf("[INFO] %s - No such site at %s (Remote: %s, Referer: %s)",
+			hostname, s.Server.Addr, remoteHost, r.Header.Get("Referer"))
+		return 0, nil
+	}
+
+	// we still check for ACME challenge if the vhost exists,
+	// because the HTTP challenge might be disabled by its config
+	if vhost.TLS.Manager.HandleHTTPChallenge(w, r) {
+		return 0, nil
+	}
+
+	// trim the path portion of the site address from the beginning of
+	// the URL path, so a request to example.com/foo/blog on the site
+	// defined as example.com/foo appears as /blog instead of /foo/blog.
+	if pathPrefix != "/" {
+		r.URL = trimPathPrefix(r.URL, pathPrefix)
+	}
+
+	// enforce strict host matching, which ensures that the SNI
+	// value (if any), matches the Host header; essential for
+	// sites that rely on TLS ClientAuth sharing a port with
+	// sites that do not - if mismatched, close the connection
+	if vhost.StrictHostMatching && r.TLS != nil &&
+		strings.ToLower(r.TLS.ServerName) != strings.ToLower(hostname) {
+		r.Close = true
+		log.Printf("[ERROR] %s - strict host matching: SNI (%s) and HTTP Host (%s) values differ",
+			vhost.Addr, r.TLS.ServerName, hostname)
+		return http.StatusForbidden, nil
+	}
+
+	return vhost.middlewareChain.ServeHTTP(w, r)
+}
+
+func trimPathPrefix(u *url.URL, prefix string) *url.URL {
+	// We need to use URL.EscapedPath() when trimming the pathPrefix as
+	// URL.Path is ambiguous about / or %2f - see docs. See #1927
+	trimmedPath := strings.TrimPrefix(u.EscapedPath(), prefix)
+	if !strings.HasPrefix(trimmedPath, "/") {
+		trimmedPath = "/" + trimmedPath
+	}
+	// After trimming path reconstruct uri string with Query before parsing
+	trimmedURI := trimmedPath
+	if u.RawQuery != "" || u.ForceQuery == true {
+		trimmedURI = trimmedPath + "?" + u.RawQuery
+	}
+	if u.Fragment != "" {
+		trimmedURI = trimmedURI + "#" + u.Fragment
+	}
+	trimmedURL, err := url.Parse(trimmedURI)
+	if err != nil {
+		log.Printf("[ERROR] Unable to parse trimmed URL %s: %v", trimmedURI, err)
+		return u
+	}
+	return trimmedURL
+}
+
+// Address returns the address s was assigned to listen on.
+func (s *Server) Address() string {
+	return s.Server.Addr
+}
+
+// Stop stops s gracefully (or forcefully after timeout) and
+// closes its listener.
+func (s *Server) Stop() error {
+	ctx, cancel := context.WithTimeout(context.Background(), s.connTimeout)
+	defer cancel()
+
+	err := s.Server.Shutdown(ctx)
+	if err != nil {
+		return err
+	}
+
+	// signal any TLS governor goroutines to exit
+	if s.tlsGovChan != nil {
+		close(s.tlsGovChan)
+	}
+
+	return nil
+}
+
+// OnStartupComplete lists the sites served by this server
+// and any relevant information, assuming caddy.Quiet == false.
+func (s *Server) OnStartupComplete() {
+	if !caddy.Quiet {
+		firstSite := s.sites[0]
+		scheme := "HTTP"
+		if firstSite.TLS.Enabled {
+			scheme = "HTTPS"
+		}
+
+		fmt.Println("")
+		fmt.Printf("Serving %s on port "+firstSite.Port()+" \n", scheme)
+		s.outputSiteInfo(false)
+		fmt.Println("")
+	}
+
+	// Print out process log without header comment
+	s.outputSiteInfo(true)
+}
+
+func (s *Server) outputSiteInfo(isProcessLog bool) {
+	for _, site := range s.sites {
+		output := site.Addr.String()
+		if caddy.IsLoopback(s.Address()) && !caddy.IsLoopback(site.Addr.Host) {
+			output += " (only accessible on this machine)"
+		}
+		if isProcessLog {
+			log.Printf("[INFO] Serving %s \n", output)
+		} else {
+			fmt.Println(output)
+		}
+	}
+}
+
+// defaultTimeouts stores the default timeout values to use
+// if left unset by user configuration. NOTE: Most default
+// timeouts are disabled (see issues #1464 and #1733).
+var defaultTimeouts = Timeouts{IdleTimeout: 5 * time.Minute}
+
+// tcpKeepAliveListener sets TCP keep-alive timeouts on accepted
+// connections. It's used by ListenAndServe and ListenAndServeTLS so
+// dead TCP connections (e.g. closing laptop mid-download) eventually
+// go away.
+//
+// Borrowed from the Go standard library.
+type tcpKeepAliveListener struct {
+	*net.TCPListener
+}
+
+// Accept accepts the connection with a keep-alive enabled.
+func (ln tcpKeepAliveListener) Accept() (c net.Conn, err error) {
+	tc, err := ln.AcceptTCP()
+	if err != nil {
+		return
+	}
+	tc.SetKeepAlive(true)
+	tc.SetKeepAlivePeriod(3 * time.Minute)
+	return tc, nil
+}
+
+// File implements caddy.Listener; it returns the underlying file of the listener.
+func (ln tcpKeepAliveListener) File() (*os.File, error) {
+	return ln.TCPListener.File()
+}
+
+// ErrMaxBytesExceeded is the error returned by MaxBytesReader
+// when the request body exceeds the limit imposed
+var ErrMaxBytesExceeded = errors.New("http: request body too large")
+
+// DefaultErrorFunc responds to an HTTP request with a simple description
+// of the specified HTTP status code.
+func DefaultErrorFunc(w http.ResponseWriter, r *http.Request, status int) {
+	WriteTextResponse(w, status, fmt.Sprintf("%d %s\n", status, http.StatusText(status)))
+}
+
+const httpStatusMisdirectedRequest = 421 // RFC 7540, 9.1.2
+
+// WriteSiteNotFound writes appropriate error code to w, signaling that
+// requested host is not served by Caddy on a given port.
+func WriteSiteNotFound(w http.ResponseWriter, r *http.Request) {
+	status := http.StatusNotFound
+	if r.ProtoMajor >= 2 {
+		// TODO: use http.StatusMisdirectedRequest when it gets defined
+		status = httpStatusMisdirectedRequest
+	}
+	WriteTextResponse(w, status, fmt.Sprintf("%d Site %s is not served on this interface\n", status, r.Host))
+}
+
+// WriteTextResponse writes body with code status to w. The body will
+// be interpreted as plain text.
+func WriteTextResponse(w http.ResponseWriter, status int, body string) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.WriteHeader(status)
+	w.Write([]byte(body))
+}
+
+// SafePath joins siteRoot and reqPath and converts it to a path that can
+// be used to access a path on the local disk. It ensures the path does
+// not traverse outside of the site root.
+//
+// If opening a file, use http.Dir instead.
+func SafePath(siteRoot, reqPath string) string {
+	reqPath = filepath.ToSlash(reqPath)
+	reqPath = strings.Replace(reqPath, "\x00", "", -1) // NOTE: Go 1.9 checks for null bytes in the syscall package
+	if siteRoot == "" {
+		siteRoot = "."
+	}
+	return filepath.Join(siteRoot, filepath.FromSlash(path.Clean("/"+reqPath)))
+}
+
+// OriginalURLCtxKey is the key for accessing the original, incoming URL on an HTTP request.
+const OriginalURLCtxKey = caddy.CtxKey("original_url")

vendor/github.com/mholt/caddy/caddyhttp/httpserver/siteconfig.go

@@ -0,0 +1,151 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"time"
+
+	"github.com/mholt/caddy/caddytls"
+)
+
+// SiteConfig contains information about a site
+// (also known as a virtual host).
+type SiteConfig struct {
+	// The address of the site
+	Addr Address
+
+	// The list of viable index page names of the site
+	IndexPages []string
+
+	// The hostname to bind listener to;
+	// defaults to Addr.Host
+	ListenHost string
+
+	// TLS configuration
+	TLS *caddytls.Config
+
+	// If true, the Host header in the HTTP request must
+	// match the SNI value in the TLS handshake (if any).
+	// This should be enabled whenever a site relies on
+	// TLS client authentication, for example; or any time
+	// you want to enforce that THIS site's TLS config
+	// is used and not the TLS config of any other site
+	// on the same listener. TODO: Check how relevant this
+	// is with TLS 1.3.
+	StrictHostMatching bool
+
+	// Uncompiled middleware stack
+	middleware []Middleware
+
+	// Compiled middleware stack
+	middlewareChain Handler
+
+	// listener middleware stack
+	listenerMiddleware []ListenerMiddleware
+
+	// Directory from which to serve files
+	Root string
+
+	// A list of files to hide (for example, the
+	// source Caddyfile). TODO: Enforcing this
+	// should be centralized, for example, a
+	// standardized way of loading files from disk
+	// for a request.
+	HiddenFiles []string
+
+	// Max request's header/body size
+	Limits Limits
+
+	// The path to the Caddyfile used to generate this site config
+	originCaddyfile string
+
+	// These timeout values are used, in conjunction with other
+	// site configs on the same server instance, to set the
+	// respective timeout values on the http.Server that
+	// is created. Sensible values will mitigate slowloris
+	// attacks and overcome faulty networks, while still
+	// preserving functionality needed for proxying,
+	// websockets, etc.
+	Timeouts Timeouts
+
+	// If true, any requests not matching other site definitions
+	// may be served by this site.
+	FallbackSite bool
+}
+
+// Timeouts specify various timeouts for a server to use.
+// If the associated bool field is true, then the duration
+// value should be treated literally (i.e. a zero-value
+// duration would mean "no timeout"). If false, the duration
+// was left unset, so a zero-value duration would mean to
+// use a default value (even if default is non-zero).
+type Timeouts struct {
+	ReadTimeout          time.Duration
+	ReadTimeoutSet       bool
+	ReadHeaderTimeout    time.Duration
+	ReadHeaderTimeoutSet bool
+	WriteTimeout         time.Duration
+	WriteTimeoutSet      bool
+	IdleTimeout          time.Duration
+	IdleTimeoutSet       bool
+}
+
+// Limits specify size limit of request's header and body.
+type Limits struct {
+	MaxRequestHeaderSize int64
+	MaxRequestBodySizes  []PathLimit
+}
+
+// PathLimit is a mapping from a site's path to its corresponding
+// maximum request body size (in bytes)
+type PathLimit struct {
+	Path  string
+	Limit int64
+}
+
+// AddMiddleware adds a middleware to a site's middleware stack.
+func (s *SiteConfig) AddMiddleware(m Middleware) {
+	s.middleware = append(s.middleware, m)
+}
+
+// AddListenerMiddleware adds a listener middleware to a site's listenerMiddleware stack.
+func (s *SiteConfig) AddListenerMiddleware(l ListenerMiddleware) {
+	s.listenerMiddleware = append(s.listenerMiddleware, l)
+}
+
+// TLSConfig returns s.TLS.
+func (s SiteConfig) TLSConfig() *caddytls.Config {
+	return s.TLS
+}
+
+// Host returns s.Addr.Host.
+func (s SiteConfig) Host() string {
+	return s.Addr.Host
+}
+
+// Port returns s.Addr.Port.
+func (s SiteConfig) Port() string {
+	return s.Addr.Port
+}
+
+// Middleware returns s.middleware (useful for tests).
+func (s SiteConfig) Middleware() []Middleware {
+	return s.middleware
+}
+
+// ListenerMiddleware returns s.listenerMiddleware
+func (s SiteConfig) ListenerMiddleware() []ListenerMiddleware {
+	return s.listenerMiddleware
+}

vendor/github.com/mholt/caddy/caddyhttp/httpserver/tplcontext.go

@@ -0,0 +1,470 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"bytes"
+	"crypto/rand"
+	"fmt"
+	"io/ioutil"
+	mathrand "math/rand"
+	"net"
+	"net/http"
+	"net/url"
+	"path"
+	"strings"
+	"sync"
+	"text/template"
+	"time"
+
+	"os"
+
+	"github.com/mholt/caddy/caddytls"
+	"github.com/russross/blackfriday"
+)
+
+// This file contains the context and functions available for
+// use in the templates.
+
+// Context is the context with which Caddy templates are executed.
+type Context struct {
+	Root http.FileSystem
+	Req  *http.Request
+	URL  *url.URL
+	Args []interface{} // defined by arguments to .Include
+
+	// just used for adding preload links for server push
+	responseHeader http.Header
+}
+
+// NewContextWithHeader creates a context with given response header.
+//
+// To plugin developer:
+// The returned context's exported fileds remain empty,
+// you should then initialize them if you want.
+func NewContextWithHeader(rh http.Header) Context {
+	return Context{
+		responseHeader: rh,
+	}
+}
+
+// Include returns the contents of filename relative to the site root.
+func (c Context) Include(filename string, args ...interface{}) (string, error) {
+	c.Args = args
+	return ContextInclude(filename, c, c.Root)
+}
+
+// Now returns the current timestamp in the specified format.
+func (c Context) Now(format string) string {
+	return time.Now().Format(format)
+}
+
+// NowDate returns the current date/time that can be used
+// in other time functions.
+func (c Context) NowDate() time.Time {
+	return time.Now()
+}
+
+// Cookie gets the value of a cookie with name name.
+func (c Context) Cookie(name string) string {
+	cookies := c.Req.Cookies()
+	for _, cookie := range cookies {
+		if cookie.Name == name {
+			return cookie.Value
+		}
+	}
+	return ""
+}
+
+// Header gets the value of a request header with field name.
+func (c Context) Header(name string) string {
+	return c.Req.Header.Get(name)
+}
+
+// Hostname gets the (remote) hostname of the client making the request.
+func (c Context) Hostname() string {
+	ip := c.IP()
+
+	hostnameList, err := net.LookupAddr(ip)
+	if err != nil || len(hostnameList) == 0 {
+		return c.Req.RemoteAddr
+	}
+
+	return hostnameList[0]
+}
+
+// Env gets a map of the environment variables.
+func (c Context) Env() map[string]string {
+	osEnv := os.Environ()
+	envVars := make(map[string]string, len(osEnv))
+	for _, env := range osEnv {
+		data := strings.SplitN(env, "=", 2)
+		if len(data) == 2 && len(data[0]) > 0 {
+			envVars[data[0]] = data[1]
+		}
+	}
+	return envVars
+}
+
+// IP gets the (remote) IP address of the client making the request.
+func (c Context) IP() string {
+	ip, _, err := net.SplitHostPort(c.Req.RemoteAddr)
+	if err != nil {
+		return c.Req.RemoteAddr
+	}
+	return ip
+}
+
+// To mock the net.InterfaceAddrs from the test.
+var networkInterfacesFn = net.InterfaceAddrs
+
+// ServerIP gets the (local) IP address of the server.
+// TODO: The bind directive should be honored in this method (see PR #1474).
+func (c Context) ServerIP() string {
+	addrs, err := networkInterfacesFn()
+	if err != nil {
+		return ""
+	}
+
+	for _, address := range addrs {
+		// Validate the address and check if it's not a loopback
+		if ipnet, ok := address.(*net.IPNet); ok && !ipnet.IP.IsLoopback() {
+			if ipnet.IP.To4() != nil || ipnet.IP.To16() != nil {
+				return ipnet.IP.String()
+			}
+		}
+	}
+
+	return ""
+}
+
+// URI returns the raw, unprocessed request URI (including query
+// string and hash) obtained directly from the Request-Line of
+// the HTTP request.
+func (c Context) URI() string {
+	return c.Req.RequestURI
+}
+
+// Host returns the hostname portion of the Host header
+// from the HTTP request.
+func (c Context) Host() (string, error) {
+	host, _, err := net.SplitHostPort(c.Req.Host)
+	if err != nil {
+		if !strings.Contains(c.Req.Host, ":") {
+			// common with sites served on the default port 80
+			return c.Req.Host, nil
+		}
+		return "", err
+	}
+	return host, nil
+}
+
+// Port returns the port portion of the Host header if specified.
+func (c Context) Port() (string, error) {
+	_, port, err := net.SplitHostPort(c.Req.Host)
+	if err != nil {
+		if !strings.Contains(c.Req.Host, ":") {
+			// common with sites served on the default port 80
+			return HTTPPort, nil
+		}
+		return "", err
+	}
+	return port, nil
+}
+
+// Method returns the method (GET, POST, etc.) of the request.
+func (c Context) Method() string {
+	return c.Req.Method
+}
+
+// PathMatches returns true if the path portion of the request
+// URL matches pattern.
+func (c Context) PathMatches(pattern string) bool {
+	return Path(c.Req.URL.Path).Matches(pattern)
+}
+
+// Truncate truncates the input string to the given length.
+// If length is negative, it returns that many characters
+// starting from the end of the string. If the absolute value
+// of length is greater than len(input), the whole input is
+// returned.
+func (c Context) Truncate(input string, length int) string {
+	if length < 0 && len(input)+length > 0 {
+		return input[len(input)+length:]
+	}
+	if length >= 0 && len(input) > length {
+		return input[:length]
+	}
+	return input
+}
+
+// StripHTML returns s without HTML tags. It is fairly naive
+// but works with most valid HTML inputs.
+func (c Context) StripHTML(s string) string {
+	var buf bytes.Buffer
+	var inTag, inQuotes bool
+	var tagStart int
+	for i, ch := range s {
+		if inTag {
+			if ch == '>' && !inQuotes {
+				inTag = false
+			} else if ch == '<' && !inQuotes {
+				// false start
+				buf.WriteString(s[tagStart:i])
+				tagStart = i
+			} else if ch == '"' {
+				inQuotes = !inQuotes
+			}
+			continue
+		}
+		if ch == '<' {
+			inTag = true
+			tagStart = i
+			continue
+		}
+		buf.WriteRune(ch)
+	}
+	if inTag {
+		// false start
+		buf.WriteString(s[tagStart:])
+	}
+	return buf.String()
+}
+
+// Ext returns the suffix beginning at the final dot in the final
+// slash-separated element of the pathStr (or in other words, the
+// file extension).
+func (c Context) Ext(pathStr string) string {
+	return path.Ext(pathStr)
+}
+
+// StripExt returns the input string without the extension,
+// which is the suffix starting with the final '.' character
+// but not before the final path separator ('/') character.
+// If there is no extension, the whole input is returned.
+func (c Context) StripExt(path string) string {
+	for i := len(path) - 1; i >= 0 && path[i] != '/'; i-- {
+		if path[i] == '.' {
+			return path[:i]
+		}
+	}
+	return path
+}
+
+// Replace replaces instances of find in input with replacement.
+func (c Context) Replace(input, find, replacement string) string {
+	return strings.Replace(input, find, replacement, -1)
+}
+
+// Markdown returns the HTML contents of the markdown contained in filename
+// (relative to the site root).
+func (c Context) Markdown(filename string) (string, error) {
+	body, err := c.Include(filename)
+	if err != nil {
+		return "", err
+	}
+	renderer := blackfriday.HtmlRenderer(0, "", "")
+	extns := 0
+	extns |= blackfriday.EXTENSION_TABLES
+	extns |= blackfriday.EXTENSION_FENCED_CODE
+	extns |= blackfriday.EXTENSION_STRIKETHROUGH
+	extns |= blackfriday.EXTENSION_DEFINITION_LISTS
+	markdown := blackfriday.Markdown([]byte(body), renderer, extns)
+
+	return string(markdown), nil
+}
+
+// ContextInclude opens filename using fs and executes a template with the context ctx.
+// This does the same thing that Context.Include() does, but with the ability to provide
+// your own context so that the included files can have access to additional fields your
+// type may provide. You can embed Context in your type, then override its Include method
+// to call this function with ctx being the instance of your type, and fs being Context.Root.
+func ContextInclude(filename string, ctx interface{}, fs http.FileSystem) (string, error) {
+	file, err := fs.Open(filename)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+
+	body, err := ioutil.ReadAll(file)
+	if err != nil {
+		return "", err
+	}
+
+	tpl, err := template.New(filename).Funcs(TemplateFuncs).Parse(string(body))
+	if err != nil {
+		return "", err
+	}
+
+	buf := includeBufs.Get().(*bytes.Buffer)
+	buf.Reset()
+	defer includeBufs.Put(buf)
+	err = tpl.Execute(buf, ctx)
+	if err != nil {
+		return "", err
+	}
+
+	return buf.String(), nil
+}
+
+// ToLower will convert the given string to lower case.
+func (c Context) ToLower(s string) string {
+	return strings.ToLower(s)
+}
+
+// ToUpper will convert the given string to upper case.
+func (c Context) ToUpper(s string) string {
+	return strings.ToUpper(s)
+}
+
+// Split is a pass-through to strings.Split. It will split the first argument at each instance of the separator and return a slice of strings.
+func (c Context) Split(s string, sep string) []string {
+	return strings.Split(s, sep)
+}
+
+// Join is a pass-through to strings.Join. It will join the first argument slice with the separator in the second argument and return the result.
+func (c Context) Join(a []string, sep string) string {
+	return strings.Join(a, sep)
+}
+
+// Slice will convert the given arguments into a slice.
+func (c Context) Slice(elems ...interface{}) []interface{} {
+	return elems
+}
+
+// Map will convert the arguments into a map. It expects alternating string keys and values. This is useful for building more complicated data structures
+// if you are using subtemplates or things like that.
+func (c Context) Map(values ...interface{}) (map[string]interface{}, error) {
+	if len(values)%2 != 0 {
+		return nil, fmt.Errorf("Map expects an even number of arguments")
+	}
+	dict := make(map[string]interface{}, len(values)/2)
+	for i := 0; i < len(values); i += 2 {
+		key, ok := values[i].(string)
+		if !ok {
+			return nil, fmt.Errorf("Map keys must be strings")
+		}
+		dict[key] = values[i+1]
+	}
+	return dict, nil
+}
+
+// Files reads and returns a slice of names from the given directory
+// relative to the root of Context c.
+func (c Context) Files(name string) ([]string, error) {
+	dir, err := c.Root.Open(path.Clean(name))
+	if err != nil {
+		return nil, err
+	}
+	defer dir.Close()
+
+	stat, err := dir.Stat()
+	if err != nil {
+		return nil, err
+	}
+	if !stat.IsDir() {
+		return nil, fmt.Errorf("%v is not a directory", name)
+	}
+
+	dirInfo, err := dir.Readdir(0)
+	if err != nil {
+		return nil, err
+	}
+
+	names := make([]string, len(dirInfo))
+	for i, fileInfo := range dirInfo {
+		names[i] = fileInfo.Name()
+	}
+
+	return names, nil
+}
+
+// IsMITM returns true if it seems likely that the TLS connection
+// is being intercepted.
+func (c Context) IsMITM() bool {
+	if val, ok := c.Req.Context().Value(MitmCtxKey).(bool); ok {
+		return val
+	}
+	return false
+}
+
+// RandomString generates a random string of random length given
+// length bounds. Thanks to http://stackoverflow.com/a/35615565/1048862
+// for the clever technique that is fairly fast, secure, and maintains
+// proper distributions over the dictionary.
+func (c Context) RandomString(minLen, maxLen int) string {
+	const (
+		letterBytes   = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+		letterIdxBits = 6                    // 6 bits to represent 64 possibilities (indexes)
+		letterIdxMask = 1<<letterIdxBits - 1 // all 1-bits, as many as letterIdxBits
+	)
+
+	if minLen < 0 || maxLen < 0 || maxLen < minLen {
+		return ""
+	}
+
+	n := mathrand.Intn(maxLen-minLen+1) + minLen // choose actual length
+
+	// secureRandomBytes returns a number of bytes using crypto/rand.
+	secureRandomBytes := func(numBytes int) []byte {
+		randomBytes := make([]byte, numBytes)
+		rand.Read(randomBytes)
+		return randomBytes
+	}
+
+	result := make([]byte, n)
+	bufferSize := int(float64(n) * 1.3)
+	for i, j, randomBytes := 0, 0, []byte{}; i < n; j++ {
+		if j%bufferSize == 0 {
+			randomBytes = secureRandomBytes(bufferSize)
+		}
+		if idx := int(randomBytes[j%n] & letterIdxMask); idx < len(letterBytes) {
+			result[i] = letterBytes[idx]
+			i++
+		}
+	}
+
+	return string(result)
+}
+
+// AddLink adds a link header in response
+// see https://www.w3.org/wiki/LinkHeader
+func (c Context) AddLink(link string) string {
+	if c.responseHeader == nil {
+		return ""
+	}
+	c.responseHeader.Add("Link", link)
+	return ""
+}
+
+// Returns either TLS protocol version if TLS used or empty string otherwise
+func (c Context) TLSVersion() (ret string) {
+	if c.Req.TLS != nil {
+		// Safe to ignore an error
+		ret, _ = caddytls.GetSupportedProtocolName(c.Req.TLS.Version)
+	}
+	return
+}
+
+// buffer pool for .Include context actions
+var includeBufs = sync.Pool{
+	New: func() interface{} {
+		return new(bytes.Buffer)
+	},
+}
+
+// TemplateFuncs contains user-defined functions
+// for execution in templates.
+var TemplateFuncs = template.FuncMap{}

vendor/github.com/mholt/caddy/caddyhttp/httpserver/vhosttrie.go

@@ -0,0 +1,180 @@
+// Copyright 2015 Light Code Labs, LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package httpserver
+
+import (
+	"net"
+	"strings"
+)
+
+// vhostTrie facilitates virtual hosting. It matches
+// requests first by hostname (with support for
+// wildcards as TLS certificates support them), then
+// by longest matching path.
+type vhostTrie struct {
+	fallbackHosts []string
+	edges         map[string]*vhostTrie
+	site          *SiteConfig // site to match on this node; also known as a virtual host
+	path          string      // the path portion of the key for the associated site
+}
+
+// newVHostTrie returns a new vhostTrie.
+func newVHostTrie() *vhostTrie {
+	// TODO: fallbackHosts doesn't discriminate between network interfaces;
+	// i.e. if there is a host "0.0.0.0", it could match a request coming
+	// in to "[::1]" (and vice-versa) even though the IP versions differ.
+	// This might be OK, or maybe it's not desirable. The 'bind' directive
+	// can be used to restrict what interface a listener binds to.
+	return &vhostTrie{edges: make(map[string]*vhostTrie), fallbackHosts: []string{"0.0.0.0", "[::]", ""}}
+}
+
+// Insert adds stack to t keyed by key. The key should be
+// a valid "host/path" combination (or just host).
+func (t *vhostTrie) Insert(key string, site *SiteConfig) {
+	host, path := t.splitHostPath(key)
+	if _, ok := t.edges[host]; !ok {
+		t.edges[host] = newVHostTrie()
+	}
+	t.edges[host].insertPath(path, path, site)
+}
+
+// insertPath expects t to be a host node (not a root node),
+// and inserts site into the t according to remainingPath.
+func (t *vhostTrie) insertPath(remainingPath, originalPath string, site *SiteConfig) {
+	if remainingPath == "" {
+		t.site = site
+		t.path = originalPath
+		return
+	}
+	ch := string(remainingPath[0])
+	if _, ok := t.edges[ch]; !ok {
+		t.edges[ch] = newVHostTrie()
+	}
+	t.edges[ch].insertPath(remainingPath[1:], originalPath, site)
+}
+
+// Match returns the virtual host (site) in v with
+// the closest match to key. If there was a match,
+// it returns the SiteConfig and the path portion of
+// the key used to make the match. The matched path
+// would be a prefix of the path portion of the
+// key, if not the whole path portion of the key.
+// If there is no match, nil and empty string will
+// be returned.
+//
+// A typical key will be in the form "host" or "host/path".
+func (t *vhostTrie) Match(key string) (*SiteConfig, string) {
+	host, path := t.splitHostPath(key)
+	// try the given host, then, if no match, try fallback hosts
+	branch := t.matchHost(host)
+	for _, h := range t.fallbackHosts {
+		if branch != nil {
+			break
+		}
+		branch = t.matchHost(h)
+	}
+	if branch == nil {
+		return nil, ""
+	}
+	node := branch.matchPath(path)
+	if node == nil {
+		return nil, ""
+	}
+	return node.site, node.path
+}
+
+// matchHost returns the vhostTrie matching host. The matching
+// algorithm is the same as used to match certificates to host
+// with SNI during TLS handshakes. In other words, it supports,
+// to some degree, the use of wildcard (*) characters.
+func (t *vhostTrie) matchHost(host string) *vhostTrie {
+	// try exact match
+	if subtree, ok := t.edges[host]; ok {
+		return subtree
+	}
+
+	// then try replacing labels in the host
+	// with wildcards until we get a match
+	labels := strings.Split(host, ".")
+	for i := range labels {
+		labels[i] = "*"
+		candidate := strings.Join(labels, ".")
+		if subtree, ok := t.edges[candidate]; ok {
+			return subtree
+		}
+	}
+
+	return nil
+}
+
+// matchPath traverses t until it finds the longest key matching
+// remainingPath, and returns its node.
+func (t *vhostTrie) matchPath(remainingPath string) *vhostTrie {
+	var longestMatch *vhostTrie
+	for len(remainingPath) > 0 {
+		ch := string(remainingPath[0])
+		next, ok := t.edges[ch]
+		if !ok {
+			break
+		}
+		if next.site != nil {
+			longestMatch = next
+		}
+		t = next
+		remainingPath = remainingPath[1:]
+	}
+	return longestMatch
+}
+
+// splitHostPath separates host from path in key.
+func (t *vhostTrie) splitHostPath(key string) (host, path string) {
+	parts := strings.SplitN(key, "/", 2)
+	host, path = strings.ToLower(parts[0]), "/"
+	if len(parts) > 1 {
+		path += parts[1]
+	}
+	// strip out the port (if present) from the host, since
+	// each port has its own socket, and each socket has its
+	// own listener, and each listener has its own server
+	// instance, and each server instance has its own vhosts.
+	// removing the port is a simple way to standardize so
+	// when requests come in, we can be sure to get a match.
+	hostname, _, err := net.SplitHostPort(host)
+	if err == nil {
+		host = hostname
+	}
+	return
+}
+
+// String returns a list of all the entries in t; assumes that
+// t is a root node.
+func (t *vhostTrie) String() string {
+	var s string
+	for host, edge := range t.edges {
+		s += edge.str(host)
+	}
+	return s
+}
+
+func (t *vhostTrie) str(prefix string) string {
+	var s string
+	for key, edge := range t.edges {
+		if edge.site != nil {
+			s += prefix + key + "\n"
+		}
+		s += edge.str(prefix + key)
+	}
+	return s
+}