-
Notifications
You must be signed in to change notification settings - Fork 170
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into pathrouting-fix
- Loading branch information
Showing
19 changed files
with
728 additions
and
18 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| # Upstream Mutual TLS policy | ||
|
|
||
| This policy enables the Mutual TLS policy per API, so connection to the upstream | ||
| API will use the certificates defined in this policy. | ||
|
|
||
| ## Configuration | ||
|
|
||
| ### Path configuration | ||
|
|
||
| Using certificates Path, both for Openshift and Kubernetes secrets. | ||
|
|
||
| ``` | ||
| { | ||
| "name": "apicast.policy.upstream_mtls", | ||
| "configuration": { | ||
| "certificate": "/secrets/client.cer", | ||
| "certificate_type": "path", | ||
| "certificate_key": "/secrets/client.key", | ||
| "certificate_key_type": "path" | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ### Embedded configuration | ||
|
|
||
| When using http forms and file upload | ||
|
|
||
| ``` | ||
| { | ||
| "name": "apicast.policy.upstream_mtls", | ||
| "configuration": { | ||
| "certificate_type": "embedded", | ||
| "certificate_key_type": "embedded", | ||
| "certificate": "data:application/pkix-cert;name=client.cer;base64,XXXXXXXXXxx", | ||
| "certificate_key": "data:application/x-iwork-keynote-sffkey;name=client.key;base64,XXXXXXXX" | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ## Additional considerations | ||
|
|
||
| This policy overwrites `APICAST_PROXY_HTTPS_CERTIFICATE_KEY` and | ||
| `APICAST_PROXY_HTTPS_CERTIFICATE` values and it uses the certificates set by | ||
| the policy, so those environment variables will have no effect. |
92 changes: 92 additions & 0 deletions
92
gateway/src/apicast/policy/upstream_mtls/apicast-policy.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,92 @@ | ||
| { | ||
| "$schema": "http://apicast.io/policy-v1.1/schema#manifest#", | ||
| "name": "Upstream Mutual TLS", | ||
| "summary": "Certificates to be used with the upstream API", | ||
| "description": "With this policy a new TLS connection with the upstream API will be used with the certificates set in the config", | ||
| "version": "builtin", | ||
| "configuration": { | ||
| "title": "Upstream MTLS", | ||
| "description": "Built-in Upstream MTLS APIcast policy", | ||
| "type": "object", | ||
| "required": [ | ||
| "certificate_type", | ||
| "certificate_key_type" | ||
| ], | ||
| "properties": { | ||
| "certificate_type": { | ||
| "title": "Certificate type", | ||
| "type": "string", | ||
| "enum": [ | ||
| "path", | ||
| "embedded" | ||
| ], | ||
| "default": "path" | ||
| }, | ||
| "certificate_key_type": { | ||
| "title": "Certificate key type", | ||
| "type": "string", | ||
| "enum": [ | ||
| "path", | ||
| "embedded" | ||
| ], | ||
| "default": "path" | ||
| } | ||
| }, | ||
| "dependencies": { | ||
| "certificate_type": { | ||
| "oneOf": [ | ||
| { | ||
| "properties": { | ||
| "certificate_type": { | ||
| "const": "embedded" | ||
| }, | ||
| "certificate": { | ||
| "title": "Certificate", | ||
| "format": "data-url", | ||
| "type": "string" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "properties": { | ||
| "certificate_type": { | ||
| "const": "path" | ||
| }, | ||
| "certificate": { | ||
| "title": "Certificate", | ||
| "type": "string" | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| }, | ||
| "certificate_key_type": { | ||
| "oneOf": [ | ||
| { | ||
| "properties": { | ||
| "certificate_key_type": { | ||
| "const": "embedded" | ||
| }, | ||
| "certificate_key": { | ||
| "title": "Certificate Key", | ||
| "format": "data-url", | ||
| "type": "string" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "properties": { | ||
| "certificate_key_type": { | ||
| "const": "path" | ||
| }, | ||
| "certificate_key": { | ||
| "title": "Certificate Key", | ||
| "type": "string" | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| return require("upstream_mtls") |
123 changes: 123 additions & 0 deletions
123
gateway/src/apicast/policy/upstream_mtls/upstream_mtls.lua
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,123 @@ | ||
| -- This policy enables MTLS with the upstream API endpoint | ||
|
|
||
| local ssl = require('ngx.ssl') | ||
| local ffi = require "ffi" | ||
| local base = require "resty.core.base" | ||
| local data_url = require('resty.data_url') | ||
|
|
||
| local C = ffi.C | ||
| local get_request = base.get_request | ||
| local open = io.open | ||
|
|
||
|
|
||
| ffi.cdef([[ | ||
| int ngx_http_apicast_ffi_set_proxy_cert_key( | ||
| ngx_http_request_t *r, void *cdata_chain, void *cdata_key); | ||
| ]]) | ||
|
|
||
|
|
||
| local policy = require('apicast.policy') | ||
| local _M = policy.new('mtls', "builtin") | ||
|
|
||
| local path_type = "path" | ||
| local embedded_type = "embedded" | ||
|
|
||
| local new = _M.new | ||
|
|
||
|
|
||
| local function read_file(path) | ||
| ngx.log(ngx.DEBUG, "reading path:", path) | ||
|
|
||
| local file = open(path, "rb") | ||
| if not file then | ||
| ngx.log(ngx.ERR, "Cannot read path: ", path) | ||
| return nil | ||
| end | ||
|
|
||
| local content = file:read("*a") | ||
| file:close() | ||
| return content | ||
| end | ||
|
|
||
|
|
||
| local function get_cert(value, value_type) | ||
| if value_type == path_type then | ||
| return read_file(value) | ||
| end | ||
|
|
||
| if value_type == embedded_type then | ||
| local parsed_data, err = data_url.parse(value) | ||
| if err then | ||
| ngx.log(ngx.ERR, "Cannot parse certificate content: ", err) | ||
| return nil | ||
| end | ||
| return parsed_data.data | ||
| end | ||
| end | ||
|
|
||
| local function read_certificate(value, value_type) | ||
| local data = get_cert(value, value_type) | ||
| if data == nil then | ||
| ngx.log(ngx.ERR, "Certificate value is invalid") | ||
| return | ||
| end | ||
| return ssl.parse_pem_cert(data) | ||
| end | ||
|
|
||
| local function read_certificate_key(value, value_type) | ||
|
|
||
| local data = get_cert(value, value_type) | ||
|
|
||
| if data == nil then | ||
| ngx.log(ngx.ERR, "Certificate value is invalid") | ||
| return | ||
| end | ||
|
|
||
| if data == nil then | ||
| ngx.log(ngx.ERR, "Certificate key value is invalid") | ||
| return | ||
| end | ||
|
|
||
| return ssl.parse_pem_priv_key(data) | ||
|
|
||
| end | ||
|
|
||
| function _M.new(config) | ||
| local self = new(config) | ||
| if config == nil then | ||
| config = {} | ||
| end | ||
|
|
||
| self.cert = read_certificate( | ||
| config.certificate, | ||
| config.certificate_type or path_type) | ||
| self.cert_key = read_certificate_key( | ||
| config.certificate_key, | ||
| config.certificate_key_type or path_type) | ||
| return self | ||
| end | ||
|
|
||
|
|
||
| -- Set the certs for the upstream connection. Need to receive the pointers from | ||
| -- parse_* functions. | ||
| --- Public function to be able to unittest this. | ||
| function _M.set_certs(cert, key) | ||
| local r = get_request() | ||
| if not r then | ||
| ngx.log(ngx.ERR, "Invalid request") | ||
| return | ||
| end | ||
|
|
||
| local val = C.ngx_http_apicast_ffi_set_proxy_cert_key(r, cert, key) | ||
| if val ~= ngx.OK then | ||
| ngx.log(ngx.ERR, "Certificate cannot be set correctly") | ||
| end | ||
| end | ||
|
|
||
| function _M:balancer(context) | ||
| if self.cert and self.cert_key then | ||
| self.set_certs(self.cert, self.cert_key) | ||
| end | ||
| end | ||
|
|
||
| return _M |
Oops, something went wrong.