Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: rule.upstream support insecure_skip_verify #1197

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

feat: rule.upstream support insecure_skip_verify #1197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
403b394
feat: rule.upstream support insecure_skip_verify
wei840222 Nov 13, 2024
f6e4eb0
fix: RuleMigration tests
wei840222 Nov 19, 2024
fd550a9
Merge branch 'master' into master
wei840222 Nov 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion proxy/proxy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ package proxy

import (
"context"
"crypto/tls"
"io"
"net/http"
"net/http/httputil"
Expand Down Expand Up @@ -74,7 +75,9 @@ func (d *Proxy) RoundTrip(r *http.Request) (*http.Response, error) {
Header: rw.header,
}, nil
} else if err == nil {
res, err := http.DefaultTransport.RoundTrip(r)
tr := http.DefaultTransport.(*http.Transport).Clone()
tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: rl.Upstream.InsecureSkipVerify}
res, err := tr.RoundTrip(r)
if err != nil {
d.r.Logger().
WithError(errors.WithStack(err)).
Expand Down
3 changes: 3 additions & 0 deletions rule/rule.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,9 @@ type Rule struct {
}

type Upstream struct {
// InsecureSkipVerify, if true, skips TLS verification when forwarding the request to the upstream URL.
InsecureSkipVerify bool `json:"insecure_skip_verify"`

// PreserveHost, if false (the default), tells ORY Oathkeeper to set the upstream request's Host header to the
// hostname of the API's upstream's URL. Setting this flag to true instructs ORY Oathkeeper not to do so.
PreserveHost bool `json:"preserve_host"`
Expand Down
12 changes: 6 additions & 6 deletions rule/rule_migrator_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,25 +26,25 @@ func TestRuleMigration(t *testing.T) {
{
d: "should work with v0.19.0-beta.1",
in: `{}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"preserve_host":false,"strip_path":"","url":""}}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}}`,
version: "v0.19.0-beta.1",
},
{
d: "should work with v0.19.0-beta.1+oryOS.12",
in: `{}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"preserve_host":false,"strip_path":"","url":""}}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}}`,
version: "v0.19.0-beta.1+oryOS.12",
},
{
d: "should work with v0.19.0-beta.1",
in: `{"version":"v0.19.0-beta.1"}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"preserve_host":false,"strip_path":"","url":""}}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}}`,
version: "v0.19.0-beta.1",
},
{
d: "should work with 0.19.0-beta.1",
in: `{"version":"0.19.0-beta.1"}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"preserve_host":false,"strip_path":"","url":""}}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}}`,
version: "v0.19.0-beta.1+oryOS.12",
},
{
Expand Down Expand Up @@ -80,7 +80,7 @@ func TestRuleMigration(t *testing.T) {
}
}
],
"upstream":{"preserve_host":false,"strip_path":"","url":""}
"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}
}`,
version: "v0.33.0-beta.1+oryOS.12",
},
Expand Down Expand Up @@ -112,7 +112,7 @@ func TestRuleMigration(t *testing.T) {
}
},
"mutators": null,
"upstream":{"preserve_host":false,"strip_path":"","url":""}
"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}
}`,
version: "v0.37.0+oryOS.18",
},
Expand Down
Loading