Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion hack/Dockerfile.debug
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ RUN INSTALL_PKGS="rsyslog procps-ng util-linux socat" && \
yum clean all && \
mkdir -p /var/lib/haproxy/router/{certs,cacerts,allowlists} && \
mkdir -p /var/lib/haproxy/{conf/.tmp,run,bin,log} && \
touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config,os_wildcard_domain}.map,haproxy.config} && \
touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config}.map,haproxy.config} && \
setcap 'cap_net_bind_service=ep' /usr/sbin/haproxy && \
chown -R :0 /var/lib/haproxy && \
chmod -R g+w /var/lib/haproxy
Expand Down
2 changes: 1 addition & 1 deletion images/router/haproxy/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ RUN INSTALL_PKGS="socat haproxy28 rsyslog sysvinit-tools" && \
yum clean all && \
mkdir -p /var/lib/haproxy/router/{certs,cacerts,allowlists} && \
mkdir -p /var/lib/haproxy/{conf/.tmp,run,bin,log,mtls} && \
touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config,os_wildcard_domain}.map,haproxy.config} && \
touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config}.map,haproxy.config} && \
setcap 'cap_net_bind_service=ep' /usr/sbin/haproxy && \
chown -R :0 /var/lib/haproxy && \
chmod -R g+w /var/lib/haproxy
Expand Down
2 changes: 1 addition & 1 deletion images/router/haproxy/Dockerfile.ocp
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ RUN INSTALL_PKGS="socat haproxy32 rsyslog procps-ng util-linux" && \
yum clean all && \
mkdir -p /var/lib/haproxy/router/{certs,cacerts,allowlists} && \
mkdir -p /var/lib/haproxy/{conf/.tmp,run,bin,log,mtls} && \
touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config,os_wildcard_domain}.map,haproxy.config} && \
touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config}.map,haproxy.config} && \
setcap 'cap_net_bind_service=ep' /usr/sbin/haproxy && \
chown -R :0 /var/lib/haproxy && \
chmod -R g+w /var/lib/haproxy && \
Expand Down
2 changes: 1 addition & 1 deletion images/router/haproxy/Dockerfile.rhel
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ RUN INSTALL_PKGS="socat haproxy28 rsyslog sysvinit-tools" && \
yum clean all && \
mkdir -p /var/lib/haproxy/router/{certs,cacerts,allowlists} && \
mkdir -p /var/lib/haproxy/{conf/.tmp,run,bin,log,mtls} && \
touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config,os_wildcard_domain}.map,haproxy.config} && \
touch /var/lib/haproxy/conf/{{os_http_be,os_edge_reencrypt_be,os_tcp_be,os_sni_passthrough,os_route_http_redirect,cert_config}.map,haproxy.config} && \
setcap 'cap_net_bind_service=ep' /usr/sbin/haproxy && \
chown -R :0 /var/lib/haproxy && \
chmod -R g+w /var/lib/haproxy
Expand Down
13 changes: 0 additions & 13 deletions images/router/haproxy/conf/haproxy-config.template
Original file line number Diff line number Diff line change
Expand Up @@ -909,19 +909,6 @@ backend {{ genBackendNamePrefix $cfg.TLSTermination }}:{{ $cfgIdx }}
{{ end }}{{/* end haproxy config template */}}

{{/*--------------------------------- END OF HAPROXY CONFIG, BELOW ARE MAPPING FILES ------------------------*/}}
{{/*
os_wildcard_domain.map: contains a mapping of wildcard hosts for a
[sub]domain regexps. This map is used to check if
a host matches a [sub]domain with has wildcard support.
*/}}
{{ define "conf/os_wildcard_domain.map" -}}
{{ if isTrue (env "ROUTER_ALLOW_WILDCARD_ROUTES") -}}
{{ range $idx, $line := generateHAProxyMap . -}}
{{ $line }}
{{ end -}}
{{ end -}}{{/* end if router allows wildcard routes */ -}}
{{ end -}}{{/* end wildcard domain map template */}}


{{/*
os_http_be.map : contains a mapping of www.example.com -> <service name>. This map is used to discover the correct backend
Expand Down
3 changes: 0 additions & 3 deletions pkg/router/template/configmanager/haproxy/manager.go
Original file line number Diff line number Diff line change
Expand Up @@ -842,9 +842,6 @@ func (entry *routeBackendEntry) BuildMapAssociations(route *routev1.Route) {

// And then handle the host specific regular expression usage.
hostRE := templateutil.GenerateRouteRegexp(hostspec, "", entry.wildcard)
if len(os.Getenv("ROUTER_ALLOW_WILDCARD_ROUTES")) > 0 && entry.wildcard {
associate("os_wildcard_domain.map", hostRE, "1")
}
switch termination {
case routev1.TLSTerminationReencrypt:
associate("os_tcp_be.map", hostRE, name)
Expand Down
27 changes: 3 additions & 24 deletions pkg/router/template/template_helper.go
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ import (
"text/template"

routev1 "github.com/openshift/api/route/v1"
"github.com/openshift/router/pkg/router/routeapihelpers"
templateutil "github.com/openshift/router/pkg/router/template/util"
haproxyutil "github.com/openshift/router/pkg/router/template/util/haproxy"
"github.com/openshift/router/pkg/router/template/util/haproxytime"
Expand Down Expand Up @@ -129,25 +128,6 @@ func matchPattern(pattern, s string) bool {
return false
}

// genSubdomainWildcardRegexp is now legacy and around for backward
// compatibility and allows old templates to continue running.
// Generate a regular expression to match wildcard hosts (and paths if any)
// for a [sub]domain.
func genSubdomainWildcardRegexp(hostname, path string, exactPath bool) string {
subdomain := routeapihelpers.GetDomainForHost(hostname)
if len(subdomain) == 0 {
log.V(0).Info("generating subdomain wildcard regexp - invalid host name", "hostname", hostname)
return fmt.Sprintf("%s%s", hostname, path)
}

expr := regexp.QuoteMeta(fmt.Sprintf(".%s%s", subdomain, path))
if exactPath {
return fmt.Sprintf(`^[^\.]*%s$`, expr)
}

return fmt.Sprintf(`^[^\.]*%s(|/.*)$`, expr)
}

// generateRouteRegexp is now legacy and around for backward
// compatibility and allows old templates to continue running.
// Generate a regular expression to match route hosts (and paths if any).
Expand Down Expand Up @@ -414,10 +394,9 @@ var helperFunctions = template.FuncMap{
"isInteger": isInteger, //determines if a given variable is an integer
"matchValues": matchValues, //compares a given string to a list of allowed strings

"genSubdomainWildcardRegexp": genSubdomainWildcardRegexp, //generates a regular expression matching the subdomain for hosts (and paths) with a wildcard policy
"generateRouteRegexp": generateRouteRegexp, //generates a regular expression matching the route hosts (and paths)
"genCertificateHostName": genCertificateHostName, //generates host name to use for serving/matching certificates
"genBackendNamePrefix": templateutil.GenerateBackendNamePrefix, //generates the prefix for the backend name
"generateRouteRegexp": generateRouteRegexp, //generates a regular expression matching the route hosts (and paths)
"genCertificateHostName": genCertificateHostName, //generates host name to use for serving/matching certificates
"genBackendNamePrefix": templateutil.GenerateBackendNamePrefix, //generates the prefix for the backend name

"isTrue": isTrue, //determines if a given variable is a true value
"firstMatch": firstMatch, //anchors provided regular expression and evaluates against given strings, returns the first matched string or ""
Expand Down
13 changes: 1 addition & 12 deletions pkg/router/template/template_helper_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -436,25 +436,14 @@ func TestGenerateHAProxyMap(t *testing.T) {
ServiceUnits: make(map[ServiceUnitKey]ServiceUnit),
}

wildcardDomainOrder := []string{
`^[^\.]*\.foo\.wildcard\.test\.?(:[0-9]+)?(/.*)?$`,
`^[^\.]*\.foo\.127\.0\.0\.1\.nip\.io\.?(:[0-9]+)?(/.*)?$`,
`^[^\.]*\.127\.0\.0\.1\.nip\.io\.?(:[0-9]+)?(/.*)?$`,
}

lines := generateHAProxyMap("os_wildcard_domain.map", td)
if err := checkExpectedOrderPrefixes(lines, wildcardDomainOrder); err != nil {
t.Errorf("TestGenerateHAProxyMap os_tcp_be.map error: %v", err)
}

httpBackendOrder := []string{
"be_edge_http:zzz:zed-route",
"be_edge_http:dev:api-route",
"be_edge_http:devel2:foo-wildcard-test",
"be_edge_http:devel2:foo-wildcard-route",
}

lines = generateHAProxyMap("os_http_be.map", td)
lines := generateHAProxyMap("os_http_be.map", td)
if err := checkExpectedOrderSuffixes(lines, httpBackendOrder); err != nil {
t.Errorf("TestGenerateHAProxyMap os_http_be.map error: %v", err)
}
Expand Down
12 changes: 0 additions & 12 deletions pkg/router/template/util/haproxy/map_entry.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,17 +10,6 @@ import (
// mapEntryGeneratorFunc generates an haproxy config map entry.
type mapEntryGeneratorFunc func(*BackendConfig) *HAProxyMapEntry

// generateWildcardDomainMapEntry generates a wildcard domain map entry.
func generateWildcardDomainMapEntry(cfg *BackendConfig) *HAProxyMapEntry {
if len(cfg.Host) > 0 && cfg.IsWildcard {
return &HAProxyMapEntry{
Key: templateutil.GenerateRouteRegexp(cfg.Host, "", cfg.IsWildcard),
Value: "1",
}
}
return nil
}

// generateHttpMapEntry generates a map entry for insecure/http hosts.
func generateHttpMapEntry(cfg *BackendConfig) *HAProxyMapEntry {
if len(cfg.Host) == 0 {
Expand Down Expand Up @@ -111,7 +100,6 @@ func generateCertConfigMapEntry(cfg *BackendConfig) *HAProxyMapEntry {
// GenerateMapEntry generates a haproxy map entry.
func GenerateMapEntry(id string, cfg *BackendConfig) *HAProxyMapEntry {
generator, ok := map[string]mapEntryGeneratorFunc{
"os_wildcard_domain.map": generateWildcardDomainMapEntry,
"os_http_be.map": generateHttpMapEntry,
"os_edge_reencrypt_be.map": generateEdgeReencryptMapEntry,
"os_route_http_redirect.map": generateHttpRedirectMapEntry,
Expand Down
97 changes: 0 additions & 97 deletions pkg/router/template/util/haproxy/map_entry_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -41,103 +41,6 @@ func testBackendConfig(name, host, path string, wildcard bool, termination route
}
}

func TestGenerateWildcardDomainMapEntry(t *testing.T) {
mapName := "os_wildcard_domain.map"
tests := []struct {
name string
hostname string
path string
wildcard bool
expected *HAProxyMapEntry
}{
{
name: "empty host",
hostname: "",
path: "",
wildcard: false,
expected: nil,
},
{
name: "empty host with path (ignored)",
hostname: "",
path: "/ignored/path/to/resource",
wildcard: false,
expected: nil,
},
{
name: "host",
hostname: "www.example.test",
path: "",
wildcard: false,
expected: nil,
},
{
name: "host with path (ignored)",
hostname: "www.example.test",
path: "/x/y/z",
wildcard: false,
expected: nil,
},
{
name: "wildcard host",
hostname: "www.wild.test",
path: "",
wildcard: true,
expected: &HAProxyMapEntry{
Key: `^[^\.]*\.wild\.test\.?(:[0-9]+)?(/.*)?$`,
Value: "1",
},
},
{
name: "wildcard host with path (ignored)",
hostname: "path.aces.wild.test",
path: "/ac/es/wi/ld/te/st",
wildcard: true,
expected: &HAProxyMapEntry{
Key: `^[^\.]*\.aces\.wild\.test\.?(:[0-9]+)?(/.*)?$`,
Value: "1",
},
},
}

for _, tc := range tests {
configVariations := []*BackendConfig{}
for _, termination := range getTestTerminations() {
for _, policy := range getTestInsecurePolicies() {
cfg := testBackendConfig(tc.name, tc.hostname, tc.path, tc.wildcard, termination, policy, false)
configVariations = append(configVariations, cfg)
}
}

for _, cfg := range configVariations {
// directly call generator function
entry := generateWildcardDomainMapEntry(cfg)
if tc.expected == nil {
if entry != nil {
t.Errorf("direct:%s: did not expect a map entry, got %+v", tc.name, entry)
}
} else {
if !reflect.DeepEqual(tc.expected, entry) {
t.Errorf("direct:%s: expected map entry %+v, got %+v", tc.name, tc.expected, entry)

}
}

// call via exported function
entry = GenerateMapEntry(mapName, cfg)
if tc.expected == nil {
if entry != nil {
t.Errorf("%s: did not expect a map entry, got %+v", tc.name, entry)
}
} else {
if !reflect.DeepEqual(tc.expected, entry) {
t.Errorf("%s: expected map entry %+v, got %+v", tc.name, tc.expected, entry)
}
}
}
}
}

func TestGenerateHttpMapEntry(t *testing.T) {
mapName := "os_http_be.map"
tests := []struct {
Expand Down