Skip to content

Commit

Permalink
add temporary feature flag ha_proxy.legacy_xfcc_header_mapping to dis…
Browse files Browse the repository at this point in the history 
…able base64 encoding of XFCC headers
  • Loading branch information
@peterellisjones
peterellisjones committed Oct 19, 2021
1 parent 16a116a commit c51125f
Show file tree
Hide file tree
Showing 5 changed files with 72 additions and 1 deletion.
2 changes: 1 addition & 1 deletion .rubocop.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ RSpec/MultipleMemoizedHelpers:
Enabled: false

RSpec/NestedGroups:
Max: 4
Max: 5

RSpec/MultipleExpectations:
Enabled: false
Expand Down
3 changes: 3 additions & 0 deletions jobs/haproxy/spec
View file
Original file line number Diff line number Diff line change
Expand Up @@ -411,6 +411,9 @@ properties:
This option is only secure if Gorouter is deployed behind Haproxy to validate that X-Cf-Proxy-Signature is coming from a route service.
default: sanitize_set

ha_proxy.legacy_xfcc_header_mapping:
default: false

ha_proxy.client_ca_file:
description: "path for CA certs to validate client certificate"
example: |
Expand Down
12 changes: 12 additions & 0 deletions jobs/haproxy/templates/haproxy.config.erb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -433,9 +433,15 @@ frontend https-in
http-request set-header X-SSL-Client-Verify %[ssl_c_verify] if { ssl_c_used }
http-request set-header X-SSL-Client-NotBefore %{+Q}[ssl_c_notbefore] if { ssl_c_used }
http-request set-header X-SSL-Client-NotAfter %{+Q}[ssl_c_notafter] if { ssl_c_used }
<%- if p("ha_proxy.legacy_xfcc_header_mapping") %>
http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn] if { ssl_c_used }
http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn)] if { ssl_c_used }
http-request set-header X-SSL-Client-Issuer-DN %{+Q}[ssl_c_i_dn] if { ssl_c_used }
<%- else %>
http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn,base64] if { ssl_c_used }
http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn),base64] if { ssl_c_used }
http-request set-header X-SSL-Client-Issuer-DN %{+Q}[ssl_c_i_dn,base64] if { ssl_c_used }
<%- end %>
<%- end -%>

<%- if p("ha_proxy.hsts_enable") -%>
Expand Down Expand Up @@ -561,9 +567,15 @@ frontend wss-in
http-request set-header X-SSL-Client-Verify %[ssl_c_verify] if { ssl_c_used }
http-request set-header X-SSL-Client-NotBefore %{+Q}[ssl_c_notbefore] if { ssl_c_used }
http-request set-header X-SSL-Client-NotAfter %{+Q}[ssl_c_notafter] if { ssl_c_used }
<%- if p("ha_proxy.legacy_xfcc_header_mapping") %>
http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn] if { ssl_c_used }
http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn)] if { ssl_c_used }
http-request set-header X-SSL-Client-Issuer-DN %{+Q}[ssl_c_i_dn] if { ssl_c_used }
<%- else %>
http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn,base64] if { ssl_c_used }
http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn),base64] if { ssl_c_used }
http-request set-header X-SSL-Client-Issuer-DN %{+Q}[ssl_c_i_dn,base64] if { ssl_c_used }
<%- end %>
<%- end -%>

<%- if p("ha_proxy.hsts_enable") -%>
Expand Down
28 changes: 28 additions & 0 deletions spec/haproxy/templates/haproxy_config/frontend_https_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -301,6 +301,18 @@
expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn),base64] if { ssl_c_used }')
expect(frontend_https).to include('http-request set-header X-SSL-Client-Issuer-DN %{+Q}[ssl_c_i_dn,base64] if { ssl_c_used }')
end

context 'when ha_proxy.legacy_xfcc_header_mapping is true' do
let(:properties) do
default_properties.merge({ 'client_cert' => true, 'legacy_xfcc_header_mapping' => true })
end

it 'writes mTLS headers without base64 encoding when mTLS is used' do
expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn] if { ssl_c_used }')
expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn)] if { ssl_c_used }')
expect(frontend_https).to include('http-request set-header X-SSL-Client-Issuer-DN %{+Q}[ssl_c_i_dn] if { ssl_c_used }')
end
end
end
end

Expand Down Expand Up @@ -359,6 +371,22 @@
expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn),base64] if { ssl_c_used }')
expect(frontend_https).to include('http-request set-header X-SSL-Client-Issuer-DN %{+Q}[ssl_c_i_dn,base64] if { ssl_c_used }')
end

context 'when ha_proxy.legacy_xfcc_header_mapping is true' do
let(:properties) do
default_properties.merge({
'client_cert' => true,
'forwarded_client_cert' => 'forward_only_if_route_service',
'legacy_xfcc_header_mapping' => true
})
end

it 'overwrites mTLS headers without base64-encoding when mTLS is used' do
expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn] if { ssl_c_used }')
expect(frontend_https).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn)] if { ssl_c_used }')
expect(frontend_https).to include('http-request set-header X-SSL-Client-Issuer-DN %{+Q}[ssl_c_i_dn] if { ssl_c_used }')
end
end
end
end
end
Expand Down
28 changes: 28 additions & 0 deletions spec/haproxy/templates/haproxy_config/frontend_wss_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -299,6 +299,18 @@
expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn),base64] if { ssl_c_used }')
expect(frontend_wss).to include('http-request set-header X-SSL-Client-Issuer-DN %{+Q}[ssl_c_i_dn,base64] if { ssl_c_used }')
end

context 'when ha_proxy.legacy_xfcc_header_mapping is true' do
let(:properties) do
default_properties.merge({ 'client_cert' => true, 'legacy_xfcc_header_mapping' => true })
end

it 'writes mTLS headers without base64 encoding when mTLS is used' do
expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn] if { ssl_c_used }')
expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn)] if { ssl_c_used }')
expect(frontend_wss).to include('http-request set-header X-SSL-Client-Issuer-DN %{+Q}[ssl_c_i_dn] if { ssl_c_used }')
end
end
end
end

Expand Down Expand Up @@ -357,6 +369,22 @@
expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn),base64] if { ssl_c_used }')
expect(frontend_wss).to include('http-request set-header X-SSL-Client-Issuer-DN %{+Q}[ssl_c_i_dn,base64] if { ssl_c_used }')
end

context 'when ha_proxy.legacy_xfcc_header_mapping is true' do
let(:properties) do
default_properties.merge({
'client_cert' => true,
'forwarded_client_cert' => 'forward_only_if_route_service',
'legacy_xfcc_header_mapping' => true
})
end

it 'overwrites mTLS headers without base64 encoding when mTLS is used' do
expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-DN %{+Q}[ssl_c_s_dn] if { ssl_c_used }')
expect(frontend_wss).to include('http-request set-header X-SSL-Client-Subject-CN %{+Q}[ssl_c_s_dn(cn)] if { ssl_c_used }')
expect(frontend_wss).to include('http-request set-header X-SSL-Client-Issuer-DN %{+Q}[ssl_c_i_dn] if { ssl_c_used }')
end
end
end
end
end
Expand Down

0 comments on commit c51125f

Please sign in to comment.