diff --git a/hack/Dockerfile.debug b/hack/Dockerfile.debug index 3b305d318..46f07bf6a 100644 --- a/hack/Dockerfile.debug +++ b/hack/Dockerfile.debug @@ -7,7 +7,7 @@ RUN INSTALL_PKGS="rsyslog procps-ng util-linux socat" && \ yum clean all && \ mkdir -p /var/lib/haproxy/router/{certs,cacerts,allowlists} && \ mkdir -p /var/lib/haproxy/{conf/.tmp,run,bin,log} && \ - touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config,os_wildcard_domain}.map,haproxy.config} && \ + touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config}.map,haproxy.config} && \ setcap 'cap_net_bind_service=ep' /usr/sbin/haproxy && \ chown -R :0 /var/lib/haproxy && \ chmod -R g+w /var/lib/haproxy diff --git a/images/router/haproxy/Dockerfile b/images/router/haproxy/Dockerfile index 77cbbf4de..fd8e53604 100644 --- a/images/router/haproxy/Dockerfile +++ b/images/router/haproxy/Dockerfile @@ -5,7 +5,7 @@ RUN INSTALL_PKGS="socat haproxy28 rsyslog sysvinit-tools" && \ yum clean all && \ mkdir -p /var/lib/haproxy/router/{certs,cacerts,allowlists} && \ mkdir -p /var/lib/haproxy/{conf/.tmp,run,bin,log,mtls} && \ - touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config,os_wildcard_domain}.map,haproxy.config} && \ + touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config}.map,haproxy.config} && \ setcap 'cap_net_bind_service=ep' /usr/sbin/haproxy && \ chown -R :0 /var/lib/haproxy && \ chmod -R g+w /var/lib/haproxy diff --git a/images/router/haproxy/Dockerfile.ocp b/images/router/haproxy/Dockerfile.ocp index 75436e69f..cb125f4d3 100644 --- a/images/router/haproxy/Dockerfile.ocp +++ b/images/router/haproxy/Dockerfile.ocp @@ -5,7 +5,7 @@ RUN INSTALL_PKGS="socat haproxy32 rsyslog procps-ng util-linux" && \ yum clean all && \ mkdir -p /var/lib/haproxy/router/{certs,cacerts,allowlists} && \ mkdir -p /var/lib/haproxy/{conf/.tmp,run,bin,log,mtls} && \ - touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config,os_wildcard_domain}.map,haproxy.config} && \ + touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config}.map,haproxy.config} && \ setcap 'cap_net_bind_service=ep' /usr/sbin/haproxy && \ chown -R :0 /var/lib/haproxy && \ chmod -R g+w /var/lib/haproxy && \ diff --git a/images/router/haproxy/Dockerfile.rhel b/images/router/haproxy/Dockerfile.rhel index f5c508e8f..b221b50ee 100644 --- a/images/router/haproxy/Dockerfile.rhel +++ b/images/router/haproxy/Dockerfile.rhel @@ -5,7 +5,7 @@ RUN INSTALL_PKGS="socat haproxy28 rsyslog sysvinit-tools" && \ yum clean all && \ mkdir -p /var/lib/haproxy/router/{certs,cacerts,allowlists} && \ mkdir -p /var/lib/haproxy/{conf/.tmp,run,bin,log,mtls} && \ - touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config,os_wildcard_domain}.map,haproxy.config} && \ + touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config}.map,haproxy.config} && \ setcap 'cap_net_bind_service=ep' /usr/sbin/haproxy && \ chown -R :0 /var/lib/haproxy && \ chmod -R g+w /var/lib/haproxy diff --git a/images/router/haproxy/conf/haproxy-config.template b/images/router/haproxy/conf/haproxy-config.template index 33fc45901..f908fa5c6 100644 --- a/images/router/haproxy/conf/haproxy-config.template +++ b/images/router/haproxy/conf/haproxy-config.template @@ -909,19 +909,6 @@ backend {{ genBackendNamePrefix $cfg.TLSTermination }}:{{ $cfgIdx }} {{ end }}{{/* end haproxy config template */}} {{/*--------------------------------- END OF HAPROXY CONFIG, BELOW ARE MAPPING FILES ------------------------*/}} -{{/* - os_wildcard_domain.map: contains a mapping of wildcard hosts for a - [sub]domain regexps. This map is used to check if - a host matches a [sub]domain with has wildcard support. -*/}} -{{ define "conf/os_wildcard_domain.map" -}} -{{ if isTrue (env "ROUTER_ALLOW_WILDCARD_ROUTES") -}} - {{ range $idx, $line := generateHAProxyMap . -}} - {{ $line }} - {{ end -}} -{{ end -}}{{/* end if router allows wildcard routes */ -}} -{{ end -}}{{/* end wildcard domain map template */}} - {{/* os_http_be.map : contains a mapping of www.example.com -> . This map is used to discover the correct backend diff --git a/pkg/router/template/configmanager/haproxy/manager.go b/pkg/router/template/configmanager/haproxy/manager.go index d812c5bba..6c2b984ba 100644 --- a/pkg/router/template/configmanager/haproxy/manager.go +++ b/pkg/router/template/configmanager/haproxy/manager.go @@ -842,9 +842,6 @@ func (entry *routeBackendEntry) BuildMapAssociations(route *routev1.Route) { // And then handle the host specific regular expression usage. hostRE := templateutil.GenerateRouteRegexp(hostspec, "", entry.wildcard) - if len(os.Getenv("ROUTER_ALLOW_WILDCARD_ROUTES")) > 0 && entry.wildcard { - associate("os_wildcard_domain.map", hostRE, "1") - } switch termination { case routev1.TLSTerminationReencrypt: associate("os_tcp_be.map", hostRE, name) diff --git a/pkg/router/template/template_helper.go b/pkg/router/template/template_helper.go index 361c84768..c311e54b1 100644 --- a/pkg/router/template/template_helper.go +++ b/pkg/router/template/template_helper.go @@ -14,7 +14,6 @@ import ( "text/template" routev1 "github.com/openshift/api/route/v1" - "github.com/openshift/router/pkg/router/routeapihelpers" templateutil "github.com/openshift/router/pkg/router/template/util" haproxyutil "github.com/openshift/router/pkg/router/template/util/haproxy" "github.com/openshift/router/pkg/router/template/util/haproxytime" @@ -129,25 +128,6 @@ func matchPattern(pattern, s string) bool { return false } -// genSubdomainWildcardRegexp is now legacy and around for backward -// compatibility and allows old templates to continue running. -// Generate a regular expression to match wildcard hosts (and paths if any) -// for a [sub]domain. -func genSubdomainWildcardRegexp(hostname, path string, exactPath bool) string { - subdomain := routeapihelpers.GetDomainForHost(hostname) - if len(subdomain) == 0 { - log.V(0).Info("generating subdomain wildcard regexp - invalid host name", "hostname", hostname) - return fmt.Sprintf("%s%s", hostname, path) - } - - expr := regexp.QuoteMeta(fmt.Sprintf(".%s%s", subdomain, path)) - if exactPath { - return fmt.Sprintf(`^[^\.]*%s$`, expr) - } - - return fmt.Sprintf(`^[^\.]*%s(|/.*)$`, expr) -} - // generateRouteRegexp is now legacy and around for backward // compatibility and allows old templates to continue running. // Generate a regular expression to match route hosts (and paths if any). @@ -414,10 +394,9 @@ var helperFunctions = template.FuncMap{ "isInteger": isInteger, //determines if a given variable is an integer "matchValues": matchValues, //compares a given string to a list of allowed strings - "genSubdomainWildcardRegexp": genSubdomainWildcardRegexp, //generates a regular expression matching the subdomain for hosts (and paths) with a wildcard policy - "generateRouteRegexp": generateRouteRegexp, //generates a regular expression matching the route hosts (and paths) - "genCertificateHostName": genCertificateHostName, //generates host name to use for serving/matching certificates - "genBackendNamePrefix": templateutil.GenerateBackendNamePrefix, //generates the prefix for the backend name + "generateRouteRegexp": generateRouteRegexp, //generates a regular expression matching the route hosts (and paths) + "genCertificateHostName": genCertificateHostName, //generates host name to use for serving/matching certificates + "genBackendNamePrefix": templateutil.GenerateBackendNamePrefix, //generates the prefix for the backend name "isTrue": isTrue, //determines if a given variable is a true value "firstMatch": firstMatch, //anchors provided regular expression and evaluates against given strings, returns the first matched string or "" diff --git a/pkg/router/template/template_helper_test.go b/pkg/router/template/template_helper_test.go index 6d844d795..f508cdabe 100644 --- a/pkg/router/template/template_helper_test.go +++ b/pkg/router/template/template_helper_test.go @@ -436,17 +436,6 @@ func TestGenerateHAProxyMap(t *testing.T) { ServiceUnits: make(map[ServiceUnitKey]ServiceUnit), } - wildcardDomainOrder := []string{ - `^[^\.]*\.foo\.wildcard\.test\.?(:[0-9]+)?(/.*)?$`, - `^[^\.]*\.foo\.127\.0\.0\.1\.nip\.io\.?(:[0-9]+)?(/.*)?$`, - `^[^\.]*\.127\.0\.0\.1\.nip\.io\.?(:[0-9]+)?(/.*)?$`, - } - - lines := generateHAProxyMap("os_wildcard_domain.map", td) - if err := checkExpectedOrderPrefixes(lines, wildcardDomainOrder); err != nil { - t.Errorf("TestGenerateHAProxyMap os_tcp_be.map error: %v", err) - } - httpBackendOrder := []string{ "be_edge_http:zzz:zed-route", "be_edge_http:dev:api-route", @@ -454,7 +443,7 @@ func TestGenerateHAProxyMap(t *testing.T) { "be_edge_http:devel2:foo-wildcard-route", } - lines = generateHAProxyMap("os_http_be.map", td) + lines := generateHAProxyMap("os_http_be.map", td) if err := checkExpectedOrderSuffixes(lines, httpBackendOrder); err != nil { t.Errorf("TestGenerateHAProxyMap os_http_be.map error: %v", err) } diff --git a/pkg/router/template/util/haproxy/map_entry.go b/pkg/router/template/util/haproxy/map_entry.go index f816cef85..0725a0468 100644 --- a/pkg/router/template/util/haproxy/map_entry.go +++ b/pkg/router/template/util/haproxy/map_entry.go @@ -10,17 +10,6 @@ import ( // mapEntryGeneratorFunc generates an haproxy config map entry. type mapEntryGeneratorFunc func(*BackendConfig) *HAProxyMapEntry -// generateWildcardDomainMapEntry generates a wildcard domain map entry. -func generateWildcardDomainMapEntry(cfg *BackendConfig) *HAProxyMapEntry { - if len(cfg.Host) > 0 && cfg.IsWildcard { - return &HAProxyMapEntry{ - Key: templateutil.GenerateRouteRegexp(cfg.Host, "", cfg.IsWildcard), - Value: "1", - } - } - return nil -} - // generateHttpMapEntry generates a map entry for insecure/http hosts. func generateHttpMapEntry(cfg *BackendConfig) *HAProxyMapEntry { if len(cfg.Host) == 0 { @@ -111,7 +100,6 @@ func generateCertConfigMapEntry(cfg *BackendConfig) *HAProxyMapEntry { // GenerateMapEntry generates a haproxy map entry. func GenerateMapEntry(id string, cfg *BackendConfig) *HAProxyMapEntry { generator, ok := map[string]mapEntryGeneratorFunc{ - "os_wildcard_domain.map": generateWildcardDomainMapEntry, "os_http_be.map": generateHttpMapEntry, "os_edge_reencrypt_be.map": generateEdgeReencryptMapEntry, "os_route_http_redirect.map": generateHttpRedirectMapEntry, diff --git a/pkg/router/template/util/haproxy/map_entry_test.go b/pkg/router/template/util/haproxy/map_entry_test.go index 11d364764..b9d291e89 100644 --- a/pkg/router/template/util/haproxy/map_entry_test.go +++ b/pkg/router/template/util/haproxy/map_entry_test.go @@ -41,103 +41,6 @@ func testBackendConfig(name, host, path string, wildcard bool, termination route } } -func TestGenerateWildcardDomainMapEntry(t *testing.T) { - mapName := "os_wildcard_domain.map" - tests := []struct { - name string - hostname string - path string - wildcard bool - expected *HAProxyMapEntry - }{ - { - name: "empty host", - hostname: "", - path: "", - wildcard: false, - expected: nil, - }, - { - name: "empty host with path (ignored)", - hostname: "", - path: "/ignored/path/to/resource", - wildcard: false, - expected: nil, - }, - { - name: "host", - hostname: "www.example.test", - path: "", - wildcard: false, - expected: nil, - }, - { - name: "host with path (ignored)", - hostname: "www.example.test", - path: "/x/y/z", - wildcard: false, - expected: nil, - }, - { - name: "wildcard host", - hostname: "www.wild.test", - path: "", - wildcard: true, - expected: &HAProxyMapEntry{ - Key: `^[^\.]*\.wild\.test\.?(:[0-9]+)?(/.*)?$`, - Value: "1", - }, - }, - { - name: "wildcard host with path (ignored)", - hostname: "path.aces.wild.test", - path: "/ac/es/wi/ld/te/st", - wildcard: true, - expected: &HAProxyMapEntry{ - Key: `^[^\.]*\.aces\.wild\.test\.?(:[0-9]+)?(/.*)?$`, - Value: "1", - }, - }, - } - - for _, tc := range tests { - configVariations := []*BackendConfig{} - for _, termination := range getTestTerminations() { - for _, policy := range getTestInsecurePolicies() { - cfg := testBackendConfig(tc.name, tc.hostname, tc.path, tc.wildcard, termination, policy, false) - configVariations = append(configVariations, cfg) - } - } - - for _, cfg := range configVariations { - // directly call generator function - entry := generateWildcardDomainMapEntry(cfg) - if tc.expected == nil { - if entry != nil { - t.Errorf("direct:%s: did not expect a map entry, got %+v", tc.name, entry) - } - } else { - if !reflect.DeepEqual(tc.expected, entry) { - t.Errorf("direct:%s: expected map entry %+v, got %+v", tc.name, tc.expected, entry) - - } - } - - // call via exported function - entry = GenerateMapEntry(mapName, cfg) - if tc.expected == nil { - if entry != nil { - t.Errorf("%s: did not expect a map entry, got %+v", tc.name, entry) - } - } else { - if !reflect.DeepEqual(tc.expected, entry) { - t.Errorf("%s: expected map entry %+v, got %+v", tc.name, tc.expected, entry) - } - } - } - } -} - func TestGenerateHttpMapEntry(t *testing.T) { mapName := "os_http_be.map" tests := []struct {