Skip to content

Commit 0ee0a76

Browse files
vfarcicvfarcic
committed
[release]Indexable sslVerifyNone
Starting from this release, field can be indexed. Fixes #443.
1 parent ec57095 commit 0ee0a76

File tree

7 files changed

+45
-28
lines changed

7 files changed

+45
-28
lines changed

‎actions/reconfigure_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@ backend https-myService-be1234_32
280280
func (s ReconfigureTestSuite) Test_GetTemplates_AddSllVerifyNone_WhenSslVerifyNoneIsSet() {
281281
s.reconfigure.Service.ServiceDest[0].Port = "1234"
282282
s.reconfigure.Service.ServiceDest[0].Index = 6
283-
s.reconfigure.SslVerifyNone = true
283+
s.reconfigure.Service.ServiceDest[0].SslVerifyNone = true
284284
expected := `
285285
backend myService-be1234_6
286286
mode http

‎docs/usage.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ The following query parameters can be used to send a *reconfigure* request to *D
3838
|timeoutTunnel |The tunnel timeout in seconds.<br>**Default:** `3600`<br>**Example:** `3600`|
3939
|userDef |User defined value. This value is not used with current template. It is designed as a way to provide additional data that can be used with **custom templates**. The parameter must be prefixed with an index thus allowing definition of multiple destinations for a single service (e.g. `userDef.1`, `userDef.2`, and so on).|
4040

41-
Multiple destinations for a single service can be specified by adding index as a suffix to `servicePath`, `servicePathExclude`, `srcPort`, `port`, `userAgent`, `ignoreAuthorization`, `serviceDomain`, `allowedMethods`, `deniedMethods`, `denyHttp`, `httpsOnly`, `redirectFromDomain`, `reqMode`, `reqPathSearchReplace`, `outboundHostname`, or `userDef` parameters. In that case, `srcPort` is required.
41+
Multiple destinations for a single service can be specified by adding index as a suffix to `servicePath`, `servicePathExclude`, `srcPort`, `port`, `userAgent`, `ignoreAuthorization`, `serviceDomain`, `allowedMethods`, `deniedMethods`, `denyHttp`, `httpsOnly`, `redirectFromDomain`, `reqMode`, `reqPathSearchReplace`, `outboundHostname`, `sslVerifyNone`, or `userDef` parameters. In that case, `srcPort` is required.
4242

4343
### HTTP Mode Query Parameters
4444

@@ -64,7 +64,7 @@ The following query parameters can be used only when `reqMode` is set to `http`
6464
|servicePath |The URL path of the service. Multiple values should be separated with comma (`,`). The parameter can be prefixed with an index thus allowing definition of multiple destinations for a single service (e.g. `servicePath.1`, `servicePath.2`, and so on). This parameter **is mandatory** unless `serviceDomain` is specified.<br>**Example:** `/api/v1/books`|
6565
|servicePathExclude|The URL path that should be excluded from the rules. Multiple values should be separated with comma (`,`). The parameter can be prefixed with an index thus allowing definition of multiple destinations for a single service (e.g. `servicePathExclude.1`, `servicePathExclude.2`, and so on).<br>**Example:** `/metrics`|
6666
|sessionType |Determines the type of sticky sessions. If set to `sticky-server`, session cookie will be set by the proxy. Any other value means that sticky sessions are not used and load balancing is performed by Docker's Overlay network.<br>**Example:** `sticky-server`|
67-
|sslVerifyNone|If set to true, backend server certificates are not verified. This flag should be set for SSL enabled backend services.<br>**Example:** `true`<br>**Default Value:** `false`|
67+
|sslVerifyNone|If set to true, backend server certificates are not verified. This flag should be set for SSL enabled backend services. The parameter can be prefixed with an index thus allowing definition of multiple destinations for a single service (e.g. `sslVerifyNone.1`, `sslVerifyNone.2`, and so on).<br>**Example:** `true`<br>**Default Value:** `false`|
6868
|templateBePath|The path to the template representing a snippet of the backend configuration. If specified, the backend template will be loaded from the specified file. See the [Templates](#templates) section for more info.<br>**Example:** `/tmpl/be.tmpl`|
6969
|templateFePath|The path to the template representing a snippet of the frontend configuration. If specified, the frontend template will be loaded from the specified file. See the [Templates](#templates) section for more info.<br>**Example:** `/tmpl/fe.tmpl`|
7070
|userAgent |A comma-separated list of user agents. only requests with the same User-Agent will be forwarded to the backend. The parameter can be prefixed with an index thus allowing definition of multiple destinations for a single service (e.g. `userAgent.1`, `userAgent.2`, and so on). If the same service is used for multiple agents, it is recommended to use indexes with the last one being without `userAgent`. That way, if no match is found, the last indexed destination will be used as catch-all.<br>**Example:** `googlebot,iphone`|
@@ -73,7 +73,7 @@ The following query parameters can be used only when `reqMode` is set to `http`
7373
|usersPassEncrypted|Indicates whether passwords provided by `users` or `usersSecret` contain encrypted data. Passwords can be encrypted with the command `mkpasswd -m sha-512 password1`.<br>**Example:** `true`<br>**Default Value:** `false`|
7474
|verifyClientSsl|Whether to verify client SSL and, if it is not valid, deny request and return 403 Forbidden status code. SSL is validated against the `ca-file` specified through the environment variable `CA_FILE`.<br>**Example:** true<br>**Default Value:** `false`|
7575

76-
Multiple destinations for a single service can be specified by adding index as a suffix to `servicePath`, `servicePathExclude`, `srcPort`, `port`, `userAgent`, `ignoreAuthorization`, `serviceDomain`, `allowedMethods`, `deniedMethods`, `denyHttp`, `httpsOnly`, `redirectFromDomain`, `ReqMode`, `reqPathSearchReplace`, `outboundHostname`, or `userDef` parameters. In that case, `srcPort` is required.
76+
Multiple destinations for a single service can be specified by adding index as a suffix to `servicePath`, `servicePathExclude`, `srcPort`, `port`, `userAgent`, `ignoreAuthorization`, `serviceDomain`, `allowedMethods`, `deniedMethods`, `denyHttp`, `httpsOnly`, `redirectFromDomain`, `ReqMode`, `reqPathSearchReplace`, `outboundHostname`, `sslVerifyNone`, or `userDef` parameters. In that case, `srcPort` is required.
7777

7878
### TCP Mode HTTP Query Parameters
7979

‎proxy/template.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -172,10 +172,10 @@ backend {{$.AclName}}-be{{.Port}}_{{.Index}}
172172
cookie {{$.ServiceName}} insert indirect nocache
173173
{{- end}}
174174
{{- range $i, $t := $.Tasks}}
175-
server {{$.ServiceName}}_{{$i}} {{$t}}:{{$sd.Port}} check cookie {{$.ServiceName}}_{{$i}}{{if eq $.SslVerifyNone true}} ssl verify none{{end}}
175+
server {{$.ServiceName}}_{{$i}} {{$t}}:{{$sd.Port}} check cookie {{$.ServiceName}}_{{$i}}{{if eq $sd.SslVerifyNone true}} ssl verify none{{end}}
176176
{{- end}}
177177
{{- if not $.Tasks}}
178-
server {{$.ServiceName}} {{if eq $sd.OutboundHostname ""}}{{$.ServiceName}}{{end}}{{if ne $sd.OutboundHostname ""}}{{$sd.OutboundHostname}}{{end}}:{{$sd.Port}}{{if eq $.CheckResolvers true}} check resolvers docker{{end}}{{if eq $.SslVerifyNone true}} ssl verify none{{end}}
178+
server {{$.ServiceName}} {{if eq $sd.OutboundHostname ""}}{{$.ServiceName}}{{end}}{{if ne $sd.OutboundHostname ""}}{{$sd.OutboundHostname}}{{end}}:{{$sd.Port}}{{if eq $.CheckResolvers true}} check resolvers docker{{end}}{{if eq $sd.SslVerifyNone true}} ssl verify none{{end}}
179179
{{- end}}
180180
{{- if not .IgnoreAuthorization}}
181181
{{- if and ($.Users) (not .IgnoreAuthorization)}}
@@ -235,10 +235,10 @@ backend https-{{$.AclName}}-be{{.Port}}_{{.Index}}
235235
cookie {{$.ServiceName}} insert indirect nocache
236236
{{- end}}
237237
{{- range $i, $t := $.Tasks}}
238-
server {{$.ServiceName}}_{{$i}} {{$t}}:{{$.HttpsPort}} check cookie {{$.ServiceName}}_{{$i}}{{if eq $.SslVerifyNone true}} ssl verify none{{end}}
238+
server {{$.ServiceName}}_{{$i}} {{$t}}:{{$.HttpsPort}} check cookie {{$.ServiceName}}_{{$i}}{{if eq $sd.SslVerifyNone true}} ssl verify none{{end}}
239239
{{- end}}
240240
{{- if not $.Tasks}}
241-
server {{$.ServiceName}} {{if eq $sd.OutboundHostname ""}}{{$.ServiceName}}{{end}}{{if ne $sd.OutboundHostname ""}}{{$sd.OutboundHostname}}{{end}}:{{$.HttpsPort}}{{if eq $.CheckResolvers true}} check resolvers docker{{end}}{{if eq $.SslVerifyNone true}} ssl verify none{{end}}
241+
server {{$.ServiceName}} {{if eq $sd.OutboundHostname ""}}{{$.ServiceName}}{{end}}{{if ne $sd.OutboundHostname ""}}{{$sd.OutboundHostname}}{{end}}:{{$.HttpsPort}}{{if eq $.CheckResolvers true}} check resolvers docker{{end}}{{if eq $sd.SslVerifyNone true}} ssl verify none{{end}}
242242
{{- end}}
243243
{{- if not .IgnoreAuthorization}}
244244
{{- if $.Users}}

‎proxy/types.go‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ type ServiceDest struct {
5757
SrcPortAcl string
5858
// Internal use only. Do not modify.
5959
SrcPortAclName string
60+
// If set to true, server certificates are not verified. This flag should be set for SSL enabled backend services.
61+
SslVerifyNone bool
6062
// Whether to verify client SSL and deny request when it is invalid
6163
VerifyClientSsl bool
6264
// If specified, only requests with the same agent will be forwarded to the backend.
@@ -149,8 +151,6 @@ type Service struct {
149151
SetReqHeader []string `split_words:"true"`
150152
// Additional headers that will be set to the response before forwarding it to the client. If a specified header exists, it will be replaced with the new one.
151153
SetResHeader []string `split_words:"true"`
152-
// If set to true, server certificates are not verified. This flag should be set for SSL enabled backend services.
153-
SslVerifyNone bool `split_words:"true"`
154154
// The path to the template representing a snippet of the backend configuration.
155155
// If specified, the backend template will be loaded from the specified file.
156156
// If specified, `templateFePath` must be set as well.
@@ -325,7 +325,7 @@ func GetServiceFromProvider(provider ServiceParameterProvider) *Service {
325325
sr.ServiceName,
326326
provider.GetString("users"),
327327
provider.GetString("usersSecret"),
328-
getBoolParam(provider, "usersPassEncrypted"),
328+
getBoolParam(provider, "usersPassEncrypted", ""),
329329
globalUsersString,
330330
globalUsersEncrypted,
331331
)
@@ -430,10 +430,10 @@ func getServiceDest(sr *Service, provider ServiceParameterProvider, index int) S
430430
return ServiceDest{
431431
AllowedMethods: getSliceFromString(provider, fmt.Sprintf("allowedMethods%s", suffix)),
432432
DeniedMethods: getSliceFromString(provider, fmt.Sprintf("deniedMethods%s", suffix)),
433-
DenyHttp: getBoolParam(provider, fmt.Sprintf("denyHttp%s", suffix)),
434-
HttpsOnly: getBoolParam(provider, fmt.Sprintf("httpsOnly%s", suffix)),
433+
DenyHttp: getBoolParam(provider, "denyHttp", suffix),
434+
HttpsOnly: getBoolParam(provider, "httpsOnly", suffix),
435435
HttpsRedirectCode: provider.GetString(fmt.Sprintf("httpsRedirectCode%s", suffix)),
436-
IgnoreAuthorization: getBoolParam(provider, fmt.Sprintf("ignoreAuthorization%s", suffix)),
436+
IgnoreAuthorization: getBoolParam(provider, "ignoreAuthorization", suffix),
437437
OutboundHostname: outboundHostname,
438438
Port: provider.GetString(fmt.Sprintf("port%s", suffix)),
439439
RedirectFromDomain: getSliceFromString(provider, fmt.Sprintf("redirectFromDomain%s", suffix)),
@@ -445,7 +445,8 @@ func getServiceDest(sr *Service, provider ServiceParameterProvider, index int) S
445445
ServicePath: getSliceFromString(provider, fmt.Sprintf("servicePath%s", suffix)),
446446
ServicePathExclude: getSliceFromString(provider, fmt.Sprintf("servicePathExclude%s", suffix)),
447447
SrcPort: srcPort,
448-
VerifyClientSsl: getBoolParam(provider, fmt.Sprintf("verifyClientSsl%s", suffix)),
448+
SslVerifyNone: getBoolParam(provider, "sslVerifyNone", suffix),
449+
VerifyClientSsl: getBoolParam(provider, "verifyClientSsl", suffix),
449450
UserAgent: userAgent,
450451
UserDef: provider.GetString(fmt.Sprintf("userDef%s", suffix)),
451452
Index: sdIndex,
@@ -465,9 +466,12 @@ func isServiceDestValid(sd *ServiceDest) bool {
465466
return len(sd.ServicePath) > 0 || len(sd.Port) > 0
466467
}
467468

468-
func getBoolParam(req ServiceParameterProvider, param string) bool {
469+
func getBoolParam(req ServiceParameterProvider, param, index string) bool {
469470
value := false
470-
if len(req.GetString(param)) > 0 {
471+
key := fmt.Sprintf("%s%s", param, index)
472+
if len(req.GetString(key)) > 0 {
473+
value, _ = strconv.ParseBool(req.GetString(key))
474+
} else if len(req.GetString(param)) > 0 {
471475
value, _ = strconv.ParseBool(req.GetString(param))
472476
}
473477
return value

‎proxy/types_test.go‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,18 @@ func (s *TypesTestSuite) Test_GetServiceFromProvider_ReturnsProxyServiceWithInde
192192
s.Equal(expected, *actual)
193193
}
194194

195+
func (s *TypesTestSuite) Test_GetServiceFromProvider_UsesDefaultValues_WhenBoolIndexIsNotPresent() {
196+
expected := s.getExpectedService()
197+
serviceMap := s.getServiceMap(expected, ".1", ",")
198+
delete(serviceMap, "sslVerifyNone.1")
199+
serviceMap["sslVerifyNone"] = "true"
200+
provider := mapParameterProvider{&serviceMap}
201+
202+
actual := GetServiceFromProvider(&provider)
203+
204+
s.Equal(expected, *actual)
205+
}
206+
195207
func (s *TypesTestSuite) Test_GetServiceFromProvider_UsesSeparatorFromEnvVar() {
196208
separatorOrig := os.Getenv("SEPARATOR")
197209
defer func() { os.Setenv("SEPARATOR", separatorOrig) }()
@@ -374,7 +386,6 @@ func (s *TypesTestSuite) getServiceMap(expected Service, indexSuffix, separator
374386
"sessionType": expected.SessionType,
375387
"setReqHeader": strings.Join(expected.SetReqHeader, separator),
376388
"setResHeader": strings.Join(expected.SetResHeader, separator),
377-
"sslVerifyNone": strconv.FormatBool(expected.SslVerifyNone),
378389
"templateBePath": expected.TemplateBePath,
379390
"templateFePath": expected.TemplateFePath,
380391
"timeoutServer": expected.TimeoutServer,
@@ -396,6 +407,7 @@ func (s *TypesTestSuite) getServiceMap(expected Service, indexSuffix, separator
396407
"serviceDomain" + indexSuffix: strings.Join(expected.ServiceDest[0].ServiceDomain, separator),
397408
"serviceHeader" + indexSuffix: header,
398409
"servicePath" + indexSuffix: strings.Join(expected.ServiceDest[0].ServicePath, separator),
410+
"sslVerifyNone" + indexSuffix: strconv.FormatBool(expected.ServiceDest[0].SslVerifyNone),
399411
"userAgent" + indexSuffix: strings.Join(expected.ServiceDest[0].UserAgent.Value, separator),
400412
"userDef" + indexSuffix: expected.ServiceDest[0].UserDef,
401413
"verifyClientSsl" + indexSuffix: strconv.FormatBool(expected.ServiceDest[0].VerifyClientSsl),
@@ -429,13 +441,14 @@ func (s *TypesTestSuite) getExpectedService() Service {
429441
OutboundHostname: "outboundHostname",
430442
Port: "1234",
431443
RedirectFromDomain: []string{"sub.domain1", "sub.domain2"},
444+
ReqMode: "reqMode",
445+
ReqPathSearchReplace: "something,else:foo,bar",
446+
ReqPathSearchReplaceFormatted: []string{"reqPathSearch,reqPathReplace", "something,else", "foo,bar"},
432447
ServiceDomain: []string{"domain1", "domain2"},
433448
ServiceHeader: map[string]string{"X-Version": "3", "name": "Viktor"},
434449
ServicePath: []string{"/"},
435450
ServicePathExclude: []string{},
436-
ReqMode: "reqMode",
437-
ReqPathSearchReplace: "something,else:foo,bar",
438-
ReqPathSearchReplaceFormatted: []string{"reqPathSearch,reqPathReplace", "something,else", "foo,bar"},
451+
SslVerifyNone: true,
439452
UserAgent: UserAgent{Value: []string{"agent-1", "agent-2/replace-with_"}, AclName: "agent_1_agent_2_replace_with_"},
440453
UserDef: "userDef",
441454
VerifyClientSsl: true,
@@ -444,7 +457,6 @@ func (s *TypesTestSuite) getExpectedService() Service {
444457
ServiceName: "serviceName",
445458
SetReqHeader: []string{"set-header-1", "set-header-2"},
446459
SetResHeader: []string{"set-header-1", "set-header-2"},
447-
SslVerifyNone: true,
448460
TemplateBePath: "templateBePath",
449461
TemplateFePath: "templateFePath",
450462
TimeoutServer: "timeoutServer",

‎server/server.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,7 @@ func (m *serve) getServiceFromEnvVars(prefix string) (proxy.Service, error) {
270270
verifyClientSsl, _ := strconv.ParseBool(os.Getenv(prefix + "_VERIFY_CLIENT_SSL"))
271271
denyHTTP, _ := strconv.ParseBool(os.Getenv(prefix + "_DENY_HTTP"))
272272
ignoreAuthorization, _ := strconv.ParseBool(os.Getenv(prefix + "_IGNORE_AUTHORIZATION"))
273+
sslVerifyNone, _ := strconv.ParseBool(os.Getenv(prefix + "_SSL_VERIFY_NONE"))
273274

274275
if len(path) > 0 || len(port) > 0 {
275276
sd = append(
@@ -291,6 +292,7 @@ func (m *serve) getServiceFromEnvVars(prefix string) (proxy.Service, error) {
291292
ServicePath: path,
292293
ServicePathExclude: servicePathExclude,
293294
SrcPort: srcPort,
295+
SslVerifyNone: sslVerifyNone,
294296
VerifyClientSsl: verifyClientSsl,
295297
},
296298
)

‎server/server_test.go‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -547,12 +547,12 @@ func (s *ServerTestSuite) Test_GetServiceFromUrl_ReturnsProxyService() {
547547
ServiceHeader: map[string]string{"X-Version": "3", "name": "Viktor"},
548548
ServicePath: []string{"/"},
549549
ServicePathExclude: []string{"/excluded-path"},
550+
SslVerifyNone: true,
550551
}},
551552
ServiceDomainAlgo: "hdr_dom",
552553
ServiceName: "serviceName",
553554
SetReqHeader: []string{"set-header-1", "set-header-2"},
554555
SetResHeader: []string{"set-header-1", "set-header-2"},
555-
SslVerifyNone: true,
556556
TemplateBePath: "templateBePath",
557557
TemplateFePath: "templateFePath",
558558
TimeoutServer: "timeoutServer",
@@ -585,7 +585,7 @@ func (s *ServerTestSuite) Test_GetServiceFromUrl_ReturnsProxyService() {
585585
strings.Join(expected.ServiceDest[0].ServiceDomain, ","),
586586
strings.Join(expected.ServiceDest[0].RedirectFromDomain, ","),
587587
expected.Distribute,
588-
expected.SslVerifyNone,
588+
expected.ServiceDest[0].SslVerifyNone,
589589
expected.ServiceDomainAlgo,
590590
strings.Join(expected.AddReqHeader, ","),
591591
strings.Join(expected.AddResHeader, ","),
@@ -600,7 +600,6 @@ func (s *ServerTestSuite) Test_GetServiceFromUrl_ReturnsProxyService() {
600600
)
601601
req, _ := http.NewRequest("GET", addr, nil)
602602
srv := serve{}
603-
604603
actual := srv.GetServiceFromUrl(req)
605604

606605
s.Equal(expected, *actual)
@@ -679,7 +678,6 @@ func (s *ServerTestSuite) Test_GetServicesFromEnvVars_ReturnsServices() {
679678
ServiceName: "my-ServiceName",
680679
SetReqHeader: []string{"set-header-1", "set-header-2"},
681680
SetResHeader: []string{"set-header-1", "set-header-2"},
682-
SslVerifyNone: true,
683681
TemplateBePath: "my-TemplateBePath",
684682
TemplateFePath: "my-TemplateFePath",
685683
TimeoutServer: "my-TimeoutServer",
@@ -688,6 +686,7 @@ func (s *ServerTestSuite) Test_GetServicesFromEnvVars_ReturnsServices() {
688686
{
689687
HttpsOnly: true,
690688
HttpsRedirectCode: "302",
689+
IgnoreAuthorization: true,
691690
OutboundHostname: "my-OutboundHostname",
692691
Port: "1111",
693692
ReqPathSearchReplace: "/something,/else:/this,/that",
@@ -702,7 +701,7 @@ func (s *ServerTestSuite) Test_GetServicesFromEnvVars_ReturnsServices() {
702701
ServicePathExclude: []string{"some-path", "some-path2"},
703702
VerifyClientSsl: true,
704703
DenyHttp: true,
705-
IgnoreAuthorization: true,
704+
SslVerifyNone: true,
706705
},
707706
},
708707
}
@@ -734,7 +733,7 @@ func (s *ServerTestSuite) Test_GetServicesFromEnvVars_ReturnsServices() {
734733
os.Setenv("DFP_SERVICE_SERVICE_DOMAIN_ALGO", service.ServiceDomainAlgo)
735734
os.Setenv("DFP_SERVICE_SERVICE_NAME", service.ServiceName)
736735
os.Setenv("DFP_SERVICE_SERVICE_PATH_EXCLUDE", strings.Join(service.ServiceDest[0].ServicePathExclude, ","))
737-
os.Setenv("DFP_SERVICE_SSL_VERIFY_NONE", strconv.FormatBool(service.SslVerifyNone))
736+
os.Setenv("DFP_SERVICE_SSL_VERIFY_NONE", strconv.FormatBool(service.ServiceDest[0].SslVerifyNone))
738737
os.Setenv("DFP_SERVICE_TEMPLATE_BE_PATH", service.TemplateBePath)
739738
os.Setenv("DFP_SERVICE_TEMPLATE_FE_PATH", service.TemplateFePath)
740739
os.Setenv("DFP_SERVICE_TIMEOUT_SERVER", service.TimeoutServer)

0 commit comments

Comments
 (0)