pretecno/crowdsec-bouncer-traefik-plugin
3
0
Fork 0
mirror of https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git synced 2026-07-21 11:38:59 +02:00
Code Issues Packages Releases Activity

🐛 65 confused about configuring tls (#69)

Browse Source 
* 🐛 Fix bug reading LAPIKEY, update exemples

* 🚨 Fix lint
This commit is contained in:
mathieuHa
2022-12-30 11:24:14 +01:00
committed by GitHub
parent aff7c496c2
commit 29878e837c
10 changed files with 131 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/configuration/configuration.go
+113
View File
@@ -10,6 +10,7 @@ import (
"os"
"path/filepath"
"reflect"
"strings"
ip "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/ip"
logger "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger"
@@ -106,6 +107,8 @@ func GetVariable(config *Config, key string) (string, error) {
}
// ValidateParams validate all the param gave by user.
//
//nolint:gocyclo
func ValidateParams(config *Config) error {
if err := validateParamsRequired(config); err != nil {
return err
@@ -142,6 +145,13 @@ func ValidateParams(config *Config) error {
// We need to either have crowdsecLapiKey defined or the BouncerCert and Bouncerkey
if lapiKey == "" && (certBouncer == "" || certBouncerKey == "") {
return fmt.Errorf("CrowdsecLapiKey || (CrowdsecLapiTLSCertificateBouncer && CrowdsecLapiTLSCertificateBouncerKey): cannot be both empty")
} else if lapiKey != "" && (certBouncer == "" || certBouncerKey == "") {
// check LAPIKey
lapiKey = strings.TrimSuffix(lapiKey, "\n")
err = validateParamsAPIKey(lapiKey)
if err != nil {
return err
}
}
// Case https to contact Crowdsec LAPI and certificate must be provided
@@ -155,6 +165,109 @@ func ValidateParams(config *Config) error {
return nil
}
func validateParamsAPIKey(lapiKey string) error {
for i := 0; i < len(lapiKey); i++ {
c := lapiKey[i]
if !validHeaderFieldByte(c) {
return fmt.Errorf("CrowdsecLapiKey contains the following forbidden caracter %q", c)
}
}
return nil
}
// validHeaderFieldByte reports whether b is a valid byte in a header
// field name. RFC 7230 says:
//
// header-field = field-name ":" OWS field-value OWS
// field-name = token
// tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." /
// "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA
// token = 1*tchar
func validHeaderFieldByte(b byte) bool {
// isTokenTable is a copy of net/http/lex.go's isTokenTable.
// See https://httpwg.github.io/specs/rfc7230.html#rule.token.separators
var isTokenTable = [127]bool{
'!': true,
'#': true,
'$': true,
'%': true,
'&': true,
'\'': true,
'*': true,
'+': true,
'-': true,
'.': true,
'0': true,
'1': true,
'2': true,
'3': true,
'4': true,
'5': true,
'6': true,
'7': true,
'8': true,
'9': true,
'A': true,
'B': true,
'C': true,
'D': true,
'E': true,
'F': true,
'G': true,
'H': true,
'I': true,
'J': true,
'K': true,
'L': true,
'M': true,
'N': true,
'O': true,
'P': true,
'Q': true,
'R': true,
'S': true,
'T': true,
'U': true,
'W': true,
'V': true,
'X': true,
'Y': true,
'Z': true,
'^': true,
'_': true,
'`': true,
'a': true,
'b': true,
'c': true,
'd': true,
'e': true,
'f': true,
'g': true,
'h': true,
'i': true,
'j': true,
'k': true,
'l': true,
'm': true,
'n': true,
'o': true,
'p': true,
'q': true,
'r': true,
's': true,
't': true,
'u': true,
'v': true,
'w': true,
'x': true,
'y': true,
'z': true,
'|': true,
'~': true,
}
return int(b) < len(isTokenTable) && isTokenTable[b]
}
func validateParamsTLS(config *Config) error {
certAuth, err := GetVariable(config, "CrowdsecLapiTLSCertificateAuthority")
if err != nil {