From 403b3948ec6fd042d97762c9d335cd3db505f2fd Mon Sep 17 00:00:00 2001 From: wei840222 Date: Thu, 14 Nov 2024 00:35:28 +0800 Subject: [PATCH 1/2] feat: rule.upstream support insecure_skip_verify --- proxy/proxy.go | 5 ++++- rule/rule.go | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/proxy/proxy.go b/proxy/proxy.go index e21f253adb..49ee925c25 100644 --- a/proxy/proxy.go +++ b/proxy/proxy.go @@ -5,6 +5,7 @@ package proxy import ( "context" + "crypto/tls" "io" "net/http" "net/http/httputil" @@ -74,7 +75,9 @@ func (d *Proxy) RoundTrip(r *http.Request) (*http.Response, error) { Header: rw.header, }, nil } else if err == nil { - res, err := http.DefaultTransport.RoundTrip(r) + tr := http.DefaultTransport.(*http.Transport).Clone() + tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: rl.Upstream.InsecureSkipVerify} + res, err := tr.RoundTrip(r) if err != nil { d.r.Logger(). WithError(errors.WithStack(err)). diff --git a/rule/rule.go b/rule/rule.go index 6a4b851e66..d909df2118 100644 --- a/rule/rule.go +++ b/rule/rule.go @@ -130,6 +130,9 @@ type Rule struct { } type Upstream struct { + // InsecureSkipVerify, if true, skips TLS verification when forwarding the request to the upstream URL. + InsecureSkipVerify bool `json:"insecure_skip_verify"` + // PreserveHost, if false (the default), tells ORY Oathkeeper to set the upstream request's Host header to the // hostname of the API's upstream's URL. Setting this flag to true instructs ORY Oathkeeper not to do so. PreserveHost bool `json:"preserve_host"` From f6e4eb09311dd71bef1d1e4f3d64c08dfe3d83ce Mon Sep 17 00:00:00 2001 From: wei840222 Date: Wed, 20 Nov 2024 00:03:07 +0800 Subject: [PATCH 2/2] fix: RuleMigration tests --- rule/rule_migrator_test.go | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/rule/rule_migrator_test.go b/rule/rule_migrator_test.go index 50c82e1c5e..01176eea4c 100644 --- a/rule/rule_migrator_test.go +++ b/rule/rule_migrator_test.go @@ -26,25 +26,25 @@ func TestRuleMigration(t *testing.T) { { d: "should work with v0.19.0-beta.1", in: `{}`, - out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"preserve_host":false,"strip_path":"","url":""}}`, + out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}}`, version: "v0.19.0-beta.1", }, { d: "should work with v0.19.0-beta.1+oryOS.12", in: `{}`, - out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"preserve_host":false,"strip_path":"","url":""}}`, + out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}}`, version: "v0.19.0-beta.1+oryOS.12", }, { d: "should work with v0.19.0-beta.1", in: `{"version":"v0.19.0-beta.1"}`, - out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"preserve_host":false,"strip_path":"","url":""}}`, + out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}}`, version: "v0.19.0-beta.1", }, { d: "should work with 0.19.0-beta.1", in: `{"version":"0.19.0-beta.1"}`, - out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"preserve_host":false,"strip_path":"","url":""}}`, + out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}}`, version: "v0.19.0-beta.1+oryOS.12", }, { @@ -80,7 +80,7 @@ func TestRuleMigration(t *testing.T) { } } ], - "upstream":{"preserve_host":false,"strip_path":"","url":""} + "upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""} }`, version: "v0.33.0-beta.1+oryOS.12", }, @@ -112,7 +112,7 @@ func TestRuleMigration(t *testing.T) { } }, "mutators": null, - "upstream":{"preserve_host":false,"strip_path":"","url":""} + "upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""} }`, version: "v0.37.0+oryOS.18", },