Skip to content

Commit

Permalink
Reverted #435
Browse files Browse the repository at this point in the history
  • Loading branch information
@vfarcic
vfarcic committed Feb 24, 2018
1 parent fd9c1ae commit 6da0ae2
Show file tree
Hide file tree
Showing 3 changed files with 43 additions and 88 deletions.
4 changes: 2 additions & 2 deletions docs/usage.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ The following query parameters can be used to send a *reconfigure* request to *D
|timeoutTunnel |The tunnel timeout in seconds.<br>**Default:** `3600`<br>**Example:** `3600`|
|userDef |User defined value. This value is not used with current template. It is designed as a way to provide additional data that can be used with **custom templates**. The parameter must be prefixed with an index thus allowing definition of multiple destinations for a single service (e.g. `userDef.1`, `userDef.2`, and so on).|

Multiple destinations for a single service can be specified by adding index as a suffix to `servicePath`, `servicePathExclude`, `srcPort`, `port`, `userAgent`, `ignoreAuthorization`, `serviceDomain`, `allowedMethods`, `deniedMethods`, `denyHttp`, `httpsOnly`, `redirectFromDomain`, `reqMode`, `reqPathSearchReplace`, `outboundHostname`, or `userDef` parameters. In that case, `srcPort` is required. If an indexed field is not specified, it will inherit value of it's non-indexed equivalent.
Multiple destinations for a single service can be specified by adding index as a suffix to `servicePath`, `servicePathExclude`, `srcPort`, `port`, `userAgent`, `ignoreAuthorization`, `serviceDomain`, `allowedMethods`, `deniedMethods`, `denyHttp`, `httpsOnly`, `redirectFromDomain`, `reqMode`, `reqPathSearchReplace`, `outboundHostname`, or `userDef` parameters. In that case, `srcPort` is required.

### HTTP Mode Query Parameters

Expand Down Expand Up @@ -73,7 +73,7 @@ The following query parameters can be used only when `reqMode` is set to `http`
|usersPassEncrypted|Indicates whether passwords provided by `users` or `usersSecret` contain encrypted data. Passwords can be encrypted with the command `mkpasswd -m sha-512 password1`.<br>**Example:** `true`<br>**Default Value:** `false`|
|verifyClientSsl|Whether to verify client SSL and, if it is not valid, deny request and return 403 Forbidden status code. SSL is validated against the `ca-file` specified through the environment variable `CA_FILE`.<br>**Example:** true<br>**Default Value:** `false`|

Multiple destinations for a single service can be specified by adding index as a suffix to `servicePath`, `servicePathExclude`, `srcPort`, `port`, `userAgent`, `ignoreAuthorization`, `serviceDomain`, `allowedMethods`, `deniedMethods`, `denyHttp`, `httpsOnly`, `redirectFromDomain`, `ReqMode`, `reqPathSearchReplace`, `outboundHostname`, or `userDef` parameters. In that case, `srcPort` is required. If an indexed field is not specified, it will inherit value of it's non-indexed equivalent.
Multiple destinations for a single service can be specified by adding index as a suffix to `servicePath`, `servicePathExclude`, `srcPort`, `port`, `userAgent`, `ignoreAuthorization`, `serviceDomain`, `allowedMethods`, `deniedMethods`, `denyHttp`, `httpsOnly`, `redirectFromDomain`, `ReqMode`, `reqPathSearchReplace`, `outboundHostname`, or `userDef` parameters. In that case, `srcPort` is required.

### TCP Mode HTTP Query Parameters

Expand Down
126 changes: 41 additions & 85 deletions proxy/types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import (
"strings"
)

var usersBasePath = "/run/secrets/dfp_users_%s"
var usersBasePath string = "/run/secrets/dfp_users_%s"

// ServiceDest holds data used to generate proxy configuration. It is extracted as a separate struct since a single service can have multiple combinations.
type ServiceDest struct {
Expand Down Expand Up @@ -325,7 +325,7 @@ func GetServiceFromProvider(provider ServiceParameterProvider) *Service {
sr.ServiceName,
provider.GetString("users"),
provider.GetString("usersSecret"),
getBoolParam(provider, "usersPassEncrypted", ""),
getBoolParam(provider, "usersPassEncrypted"),
globalUsersString,
globalUsersEncrypted,
)
Expand All @@ -336,20 +336,20 @@ func GetServiceFromProvider(provider ServiceParameterProvider) *Service {

func getServiceDestList(sr *Service, provider ServiceParameterProvider) []ServiceDest {
sdList := []ServiceDest{}
rootSd := getServiceDest(sr, provider, -1)
sd := getServiceDest(sr, provider, -1)
serviceDomain := []string{}
if isServiceDestValid(&rootSd, nil) {
sdList = append(sdList, rootSd)
if isServiceDestValid(&sd) {
sdList = append(sdList, sd)
} else {
serviceDomain = rootSd.ServiceDomain
serviceDomain = sd.ServiceDomain
}
httpsOnly := rootSd.HttpsOnly
httpsOnly := sd.HttpsOnly
if !httpsOnly {
httpsOnly, _ = strconv.ParseBool(os.Getenv("HTTPS_ONLY"))
}
for i := 1; i <= 10; i++ {
sd := getServiceDest(sr, provider, i)
if isServiceDestValid(&sd, &rootSd) {
if isServiceDestValid(&sd) {
sdList = append(sdList, sd)
} else {
break
Expand Down Expand Up @@ -382,17 +382,16 @@ func getServiceDest(sr *Service, provider ServiceParameterProvider, index int) S
suffix = fmt.Sprintf(".%d", index)
}
userAgent := UserAgent{}
userAgentString := getStringParam(provider, "userAgent", suffix)
if len(userAgentString) > 0 {
userAgent.Value = strings.Split(userAgentString, separator)
if len(provider.GetString(fmt.Sprintf("userAgent%s", suffix))) > 0 {
userAgent.Value = strings.Split(provider.GetString(fmt.Sprintf("userAgent%s", suffix)), separator)
userAgent.AclName = replaceNonAlphabetAndNumbers(userAgent.Value)
}
reqMode := "http"
if len(getStringParam(provider, "reqMode", suffix)) > 0 {
reqMode = getStringParam(provider, "reqMode", suffix)
if len(provider.GetString(fmt.Sprintf("reqMode%s", suffix))) > 0 {
reqMode = provider.GetString(fmt.Sprintf("reqMode%s", suffix))
}
srcPort, _ := strconv.Atoi(getStringParam(provider, "srcPort", suffix))
headerString := getStringParam(provider, "serviceHeader", suffix)
srcPort, _ := strconv.Atoi(provider.GetString(fmt.Sprintf("srcPort%s", suffix)))
headerString := provider.GetString(fmt.Sprintf("serviceHeader%s", suffix))
header := map[string]string{}
if len(headerString) > 0 {
for _, value := range strings.Split(headerString, separator) {
Expand All @@ -406,17 +405,20 @@ func getServiceDest(sr *Service, provider ServiceParameterProvider, index int) S
if sdIndex < 0 {
sdIndex = 0
}
outboundHostname := provider.GetString(fmt.Sprintf("outboundHostname%s", suffix))
if len(outboundHostname) == 0 {
outboundHostname = provider.GetString("outboundHostname")
}
reqPathSearchReplaceFormatted := []string{}
if len(sr.ReqPathSearch) > 0 {
reqPathSearchReplaceFormatted = append(
reqPathSearchReplaceFormatted,
fmt.Sprintf("%s,%s", sr.ReqPathSearch, sr.ReqPathReplace),
)
}
reqPathSearchReplace := getStringParam(provider, "reqPathSearchReplace", suffix)
// TODO: Remove for issue #435
reqPathSearchReplace := provider.GetString(fmt.Sprintf("reqPathSearchReplace%s", suffix))
if len(reqPathSearchReplace) == 0 {
reqPathSearchReplace = getStringParam(provider, "reqPathSearchReplace", "")
reqPathSearchReplace = provider.GetString("reqPathSearchReplace")
}
if len(reqPathSearchReplace) > 0 {
searchReplace := strings.Split(reqPathSearchReplace, ":")
Expand All @@ -425,96 +427,50 @@ func getServiceDest(sr *Service, provider ServiceParameterProvider, index int) S
searchReplace...,
)
}
outboundHostname := getStringParam(provider, "outboundHostname", suffix)
// TODO: Remove for issue #435
if len(outboundHostname) == 0 {
outboundHostname = getStringParam(provider, "outboundHostname", "")
}
return ServiceDest{
AllowedMethods: getSliceFromString(provider, "allowedMethods", suffix),
DeniedMethods: getSliceFromString(provider, "deniedMethods", suffix),
DenyHttp: getBoolParam(provider, "denyHttp", suffix),
HttpsOnly: getBoolParam(provider, "httpsOnly", suffix),
HttpsRedirectCode: getStringParam(provider, "httpsRedirectCode", suffix),
IgnoreAuthorization: getBoolParam(provider, "ignoreAuthorization", suffix),
AllowedMethods: getSliceFromString(provider, fmt.Sprintf("allowedMethods%s", suffix)),
DeniedMethods: getSliceFromString(provider, fmt.Sprintf("deniedMethods%s", suffix)),
DenyHttp: getBoolParam(provider, fmt.Sprintf("denyHttp%s", suffix)),
HttpsOnly: getBoolParam(provider, fmt.Sprintf("httpsOnly%s", suffix)),
HttpsRedirectCode: provider.GetString(fmt.Sprintf("httpsRedirectCode%s", suffix)),
IgnoreAuthorization: getBoolParam(provider, fmt.Sprintf("ignoreAuthorization%s", suffix)),
OutboundHostname: outboundHostname,
Port: getStringParam(provider, "port", suffix),
RedirectFromDomain: getSliceFromString(provider, "redirectFromDomain", suffix),
Port: provider.GetString(fmt.Sprintf("port%s", suffix)),
RedirectFromDomain: getSliceFromString(provider, fmt.Sprintf("redirectFromDomain%s", suffix)),
ReqMode: reqMode,
ReqPathSearchReplace: reqPathSearchReplace,
ReqPathSearchReplaceFormatted: reqPathSearchReplaceFormatted,
ServiceDomain: getSliceFromString(provider, "serviceDomain", suffix),
ServiceDomain: getSliceFromString(provider, fmt.Sprintf("serviceDomain%s", suffix)),
ServiceHeader: header,
ServicePath: getSliceFromString(provider, "servicePath", suffix),
ServicePathExclude: getSliceFromString(provider, "servicePathExclude", suffix),
ServicePath: getSliceFromString(provider, fmt.Sprintf("servicePath%s", suffix)),
ServicePathExclude: getSliceFromString(provider, fmt.Sprintf("servicePathExclude%s", suffix)),
SrcPort: srcPort,
VerifyClientSsl: getBoolParam(provider, "verifyClientSsl", suffix),
VerifyClientSsl: getBoolParam(provider, fmt.Sprintf("verifyClientSsl%s", suffix)),
UserAgent: userAgent,
UserDef: getStringParam(provider, "userDef", suffix),
UserDef: provider.GetString(fmt.Sprintf("userDef%s", suffix)),
Index: sdIndex,
}
}

func getSliceFromString(provider ServiceParameterProvider, prefix, suffix string) []string {
func getSliceFromString(provider ServiceParameterProvider, key string) []string {
separator := os.Getenv("SEPARATOR")
value := []string{}
key := fmt.Sprintf("%s%s", prefix, suffix)
if len(provider.GetString(key)) > 0 {
value = strings.Split(provider.GetString(key), separator)
// TODO: Uncomment for issue #435
// } else if len(provider.GetString(prefix)) > 0 {
// value = strings.Split(provider.GetString(prefix), separator)
}
return value
}

func getBoolParam(req ServiceParameterProvider, prefix, suffix string) bool {
value := false
key := fmt.Sprintf("%s%s", prefix, suffix)
if len(req.GetString(key)) > 0 {
value, _ = strconv.ParseBool(req.GetString(key))
}
return value
}

func getStringParam(req ServiceParameterProvider, prefix, suffix string) string {
key := fmt.Sprintf("%s%s", prefix, suffix)
value := req.GetString(key)
// TODO: Uncomment for issue #435
// if len(value) > 0 {
// return value
// }
// return req.GetString(prefix)
return value
}

func isServiceDestValid(sd, rootSd *ServiceDest) bool {
sdValid := len(sd.ServicePath) > 0 || len(sd.Port) > 0
// TODO: Uncomment for issue #435
// if rootSd == nil {
// return sdValid
// }
// sdSameAsRoot := isSliceEqual(sd.ServicePath, rootSd.ServicePath) && sd.Port == rootSd.Port
// return sdValid && !sdSameAsRoot
return sdValid
func isServiceDestValid(sd *ServiceDest) bool {
return len(sd.ServicePath) > 0 || len(sd.Port) > 0
}

func isSliceEqual(s1, s2 []string) bool {
if s1 == nil && s2 == nil {
return true
}
if s1 == nil || s2 == nil {
return false
}
if len(s1) != len(s2) {
return false
}
for i := range s1 {
if s1[i] != s2[i] {
return false
}
func getBoolParam(req ServiceParameterProvider, param string) bool {
value := false
if len(req.GetString(param)) > 0 {
value, _ = strconv.ParseBool(req.GetString(param))
}
return true
return value
}

func mergeUsers(
Expand Down
1 change: 0 additions & 1 deletion proxy/types_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,6 @@ x:X`, false, false)
// GetServiceFromMap

func (s *TypesTestSuite) Test_GetServiceFromMap_ReturnsProxyService() {
println("000")
expected := s.getExpectedService()
expected.ServiceDest[0].Index = 0
serviceMap := s.getServiceMap(expected, "", ",")
Expand Down

0 comments on commit 6da0ae2

Please sign in to comment.