3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-07-19 09:38:03 +02:00
Code Issues Projects Releases Packages Wiki Activity

validation: option to bypass

Browse source
This commit is contained in:
Denis Mishin 2023-10-31 19:08:18 -04:00
parent 6511440c2f
commit 63d4c8fbf9
3 changed files with 16 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
config/options.go
View file

@ -300,6 +300,8 @@ type Options struct {
AuditKey *PublicKeyEncryptionKeyOptions `mapstructure:"audit_key"` AuditKey *PublicKeyEncryptionKeyOptions `mapstructure:"audit_key"`
BrandingOptions httputil.BrandingOptions BrandingOptions httputil.BrandingOptions
DisableValidation bool
} }
type certificateFilePair struct { type certificateFilePair struct {
@ -577,6 +579,10 @@ func bindEnvsRecursive(t reflect.Type, v *viper.Viper, keyPrefix, envPrefix stri
// Validate ensures the Options fields are valid, and hydrated. // Validate ensures the Options fields are valid, and hydrated.
func (o *Options) Validate() error { func (o *Options) Validate() error {
if o.DisableValidation {
return nil
}
ctx := context.TODO() ctx := context.TODO()
if !IsValidService(o.Services) { if !IsValidService(o.Services) {
return fmt.Errorf("config: %s is an invalid service type", o.Services) return fmt.Errorf("config: %s is an invalid service type", o.Services)

5
internal/databroker/config_source.go
View file

@ -101,10 +101,13 @@ func (src *ConfigSource) rebuild(ctx context.Context, firstTime firstTime) {
ids := maps.Keys(src.dbConfigs) ids := maps.Keys(src.dbConfigs)
sort.Strings(ids) sort.Strings(ids)
certsIndex := cryptutil.NewCertificatesIndex() var certsIndex *cryptutil.CertificatesIndex
if !cfg.Options.DisableValidation {
certsIndex = cryptutil.NewCertificatesIndex()
for _, cert := range cfg.Options.GetX509Certificates() { for _, cert := range cfg.Options.GetX509Certificates() {
certsIndex.Add(cert) certsIndex.Add(cert)
} }
}
// add all the config policies to the list // add all the config policies to the list
for _, id := range ids { for _, id := range ids {

4
pkg/cryptutil/certificates_index.go
View file

@ -34,6 +34,10 @@ func (c *CertificatesIndex) Add(cert *x509.Certificate) {
// OverlapsWithExistingCertificate returns true if the certificate overlaps with an existing certificate. // OverlapsWithExistingCertificate returns true if the certificate overlaps with an existing certificate.
func (c *CertificatesIndex) OverlapsWithExistingCertificate(cert *x509.Certificate) (bool, string) { func (c *CertificatesIndex) OverlapsWithExistingCertificate(cert *x509.Certificate) (bool, string) {
if c == nil {
return false, ""
}
usage := getCertUsage(cert) usage := getCertUsage(cert)
for _, name := range cert.DNSNames { for _, name := range cert.DNSNames {
if c.match(name, usage) { if c.match(name, usage) {