3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-06-28 15:38:05 +02:00
Code Issues Projects Releases Packages Wiki Activity

config: add option for tls renogotiation

Browse source
This commit is contained in:
Caleb Doxsey 2022-11-28 12:20:01 -07:00
parent fa0ba60aee
commit 15d69424d9
5 changed files with 604 additions and 530 deletions
Download patch file Download diff file Expand all files Collapse all files

1
config/envoyconfig/clusters.go
View file

@ -308,6 +308,7 @@ func (b *Builder) buildPolicyTransportSocket(
}, },
}, },
Sni: sni, Sni: sni,
AllowRenegotiation: policy.TLSUpstreamAllowRenegotiation,
} }
if policy.ClientCertificate != nil { if policy.ClientCertificate != nil {
tlsContext.CommonTlsContext.TlsCertificates = append(tlsContext.CommonTlsContext.TlsCertificates, tlsContext.CommonTlsContext.TlsCertificates = append(tlsContext.CommonTlsContext.TlsCertificates,

55
config/envoyconfig/clusters_test.go
View file

@ -429,6 +429,61 @@ func Test_buildPolicyTransportSocket(t *testing.T) {
} }
`, ts) `, ts)
}) })
t.Run("allow renegotiation", func(t *testing.T) {
ts, err := b.buildPolicyTransportSocket(ctx, o1, &config.Policy{
To: mustParseWeightedURLs(t, "https://example.com"),
TLSUpstreamAllowRenegotiation: true,
}, *mustParseURL(t, "https://example.com"))
require.NoError(t, err)
testutil.AssertProtoJSONEqual(t, `
{
"name": "tls",
"typedConfig": {
"@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
"allowRenegotiation": true,
"commonTlsContext": {
"alpnProtocols": ["h2", "http/1.1"],
"tlsParams": {
"cipherSuites": [
"ECDHE-ECDSA-AES256-GCM-SHA384",
"ECDHE-RSA-AES256-GCM-SHA384",
"ECDHE-ECDSA-AES128-GCM-SHA256",
"ECDHE-RSA-AES128-GCM-SHA256",
"ECDHE-ECDSA-CHACHA20-POLY1305",
"ECDHE-RSA-CHACHA20-POLY1305",
"ECDHE-ECDSA-AES128-SHA",
"ECDHE-RSA-AES128-SHA",
"AES128-GCM-SHA256",
"AES128-SHA",
"ECDHE-ECDSA-AES256-SHA",
"ECDHE-RSA-AES256-SHA",
"AES256-GCM-SHA384",
"AES256-SHA"
],
"ecdhCurves": [
"X25519",
"P-256",
"P-384",
"P-521"
]
},
"validationContext": {
"matchTypedSubjectAltNames": [{
"sanType": "DNS",
"matcher": {
"exact": "example.com"
}
}],
"trustedCa": {
"filename": "`+rootCA+`"
}
}
},
"sni": "example.com"
}
}
`, ts)
})
} }
func Test_buildCluster(t *testing.T) { func Test_buildCluster(t *testing.T) {

3
config/policy.go
View file

@ -119,6 +119,9 @@ type Policy struct {
TLSDownstreamClientCA string `mapstructure:"tls_downstream_client_ca" yaml:"tls_downstream_client_ca,omitempty"` TLSDownstreamClientCA string `mapstructure:"tls_downstream_client_ca" yaml:"tls_downstream_client_ca,omitempty"`
TLSDownstreamClientCAFile string `mapstructure:"tls_downstream_client_ca_file" yaml:"tls_downstream_client_ca_file,omitempty"` TLSDownstreamClientCAFile string `mapstructure:"tls_downstream_client_ca_file" yaml:"tls_downstream_client_ca_file,omitempty"`
// TLSUpstreamAllowRenegotiation allows server-initiated TLS renegotiation.
TLSUpstreamAllowRenegotiation bool `mapstructure:"tls_upstream_allow_renegotiation" yaml:"allow_renegotiation,omitempty"`
// SetAuthorizationHeader sets the authorization request header based on the user's identity. Supported modes are // SetAuthorizationHeader sets the authorization request header based on the user's identity. Supported modes are
// `pass_through`, `access_token` and `id_token`. // `pass_through`, `access_token` and `id_token`.
SetAuthorizationHeader string `mapstructure:"set_authorization_header" yaml:"set_authorization_header,omitempty"` SetAuthorizationHeader string `mapstructure:"set_authorization_header" yaml:"set_authorization_header,omitempty"`

1071
pkg/grpc/config/config.pb.go
View file

File diff suppressed because it is too large Load diff

2
pkg/grpc/config/config.proto
View file

@ -90,6 +90,8 @@ message Route {
string tls_downstream_client_ca = 38; string tls_downstream_client_ca = 38;
string tls_downstream_client_ca_file = 39; string tls_downstream_client_ca_file = 39;
bool tls_upstream_allow_renegotiation = 60;
map<string, string> set_request_headers = 22; map<string, string> set_request_headers = 22;
repeated string remove_request_headers = 23; repeated string remove_request_headers = 23;
map<string, string> set_response_headers = 41; map<string, string> set_response_headers = 41;