Skip to content

Commit 33daaac

Browse files
oliweroliwer
committed
MEDIUM: Add support for the ssl-f-use keyword
1 parent a0970bd commit 33daaac

35 files changed

+4946
-37
lines changed

‎.aspell.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,4 @@ allowed:
3131
- quic
3232
- userlist
3333
- cve
34+
- ssl

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
build/
2+
e2e/logs/
23
vendor/
34
cmd/dataplaneapi/*
45
.vscode/

‎configure_data_plane.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -847,6 +847,13 @@ func configureAPI(api *operations.DataPlaneAPI) http.Handler { //nolint:cyclop,m
847847
api.LogProfileEditLogProfileHandler = &handlers.EditLogProfileHandler{Client: client, ReloadAgent: ra}
848848
api.LogProfileDeleteLogProfileHandler = &handlers.DeleteLogProfileHandlerImpl{Client: client, ReloadAgent: ra}
849849

850+
// ssl-f-use handlers
851+
api.SslFrontUseGetAllSSLFrontUsesHandler = &handlers.GetAllSSLFrontUsesHandlerImpl{Client: client}
852+
api.SslFrontUseCreateSSLFrontUseHandler = &handlers.CreateSSLFrontUseHandlerImpl{Client: client, ReloadAgent: ra}
853+
api.SslFrontUseGetSSLFrontUseHandler = &handlers.GetSSLFrontUseHandlerImpl{Client: client}
854+
api.SslFrontUseReplaceSSLFrontUseHandler = &handlers.ReplaceSSLFrontUseHandlerImpl{Client: client, ReloadAgent: ra}
855+
api.SslFrontUseDeleteSSLFrontUseHandler = &handlers.DeleteSSLFrontUseHandlerImpl{Client: client, ReloadAgent: ra}
856+
850857
// setup info handler
851858
api.InformationGetInfoHandler = &handlers.GetInfoHandlerImpl{SystemInfo: haproxyOptions.ShowSystemInfo, BuildTime: BuildTime, Version: Version}
852859

‎e2e/tests/ssl_front_use/data/3.pem

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC/ZGXoEmYgWL2m
3+
nd41cr1kRSPISmWw12o8vdGZP2OLoL8E2X8IFF6mIyNxakdhOYILBADGArCiNzYp
4+
f0XpxO0LsOWC8m7lckF+Dyyh7TSmQ5TcxxT8Bf5JxvZEAwM09FIZooVDy0vJeo3g
5+
xC08MIqtTaZbstyuRLKkigu75QWnun+qhgcxV9IMN8s/Ee6X5wFsneCvLHFgzELS
6+
9gcephLieBEfPLDpDh8mGnUgvEmyBJjDRz6cFYOEvsqW0D+6krUDe3ELnV20TFeY
7+
CrvBPZ+ZHFZWoSjE3ainpQHd9w0Kx4w0SIrYAs2AOC1qakkrh5QjFiky30DpJ6EU
8+
yg/eltW5AgMBAAECggEARk1RpXpEqzMNjstEWSupZ9CBwUuaqOenrWIoQHtpTFui
9+
btyZbdVVov8bQMjCKXNfUj6JLjLEwQE40uteOe1NCVNUKtJ0a7GZXv2h7mTcRwph
10+
/urdyWlGK8F6qibVIblxAtuQygM99mcfAGXvG8HU3q28IsjDiPvRBuFyR/VrK12R
11+
AY/cU5kADrRwLeswT8Clw7DhNhWEMcvAuS0R8liyXhQ8IG4WOZYIkBF3NI+GB3X+
12+
PE4SFZfk2CvbGSth1vvVKv7TAVczw81Ek6FJXV6A/XP3mFjuDqDU0NbEL4QQds2z
13+
S/0JpEzx5LurN/UEIAyf/u+iEtPc56oUdAXJpHfWFQKBgQD86aOJDADg9F3HAdvG
14+
Xkh60B6PZ63r6iw6wCsJD2olOl+XF7GdGXKGzCZQsz2fob1E4zhb8kduHNEPeBG7
15+
x5WyS7fqycRyz3oEyozz9KLcggfOU+yyuQ2kn/1O51/aiABlkinyj7ed/FL9jqeE
16+
LdUM6194QEPgQnghjYMj6UcHpwKBgQDBuoFsgmA1OvtuSpijnZ/0ueI9Lkh8Quk2
17+
HusTKglP4KnuRCKm60PRXxxsFNxQgxuXhxEgBuMwJo1RO+CLjzh540pFnAN235QZ
18+
F2FKio5hQT7olo8Weu6IEbLE5nzTDEcnuKZrmqEGFlsUXLBW3zYgn1PorWDRMvv6
19+
m+T4+NDjnwKBgDbKjwlDtnUFu8M/XdON3Xnt2JEMzxsK8mYP98LQuhgymz7qfSoh
20+
tzQIykw1aKZKrexcpXsV8++hApGtW3oo9P9ZdBDDgXG2DSM4lmzLlPTcnsBOYjsd
21+
6BzAJGqRqax4Rk266qeIBymM3pXb7+Ks4zkXTOmKUqok/E2YkM6Y3TCFAoGBALg2
22+
jscNmkpDkb4odMhwJB/jebvPfOGcBoKOF94bRMuNyEhmxcSPReebVz13AKAWa3BE
23+
4QXhRrsMjahHFZffUkak2IUkey7YHs1VLBBjfEwCbL1iHSG1N4hvu9v7h4pvzGF6
24+
9dSwLpnJPEY6dPvGOIQAvRstcji7EFwXTT1p68flAoGANxFyWNiCC0LZ1t+4aS4j
25+
cA7piBgu1bfc1LtL9wBj7LeCLW942S1yCcHd/YI3KMc8ZP8MkD2eKuMOCD48JVN7
26+
k1Pnh+V+/Bnin1owach62ckZjgubLQfbffiGmpEo3KqP4g8h7lst6Xbja1DatJ2Q
27+
Ml0WvPvs/l61lp1CI36UuUA=
28+
-----END PRIVATE KEY-----
29+
-----BEGIN CERTIFICATE-----
30+
MIICoDCCAYgCAhACMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNVBAMMCEludGVybTIu
31+
MB4XDTIwMTEyNTEyMTIwNFoXDTIxMTEyNTEyMTIwNFowGDEWMBQGA1UEAwwNMS5l
32+
eGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL9kZegS
33+
ZiBYvaad3jVyvWRFI8hKZbDXajy90Zk/Y4ugvwTZfwgUXqYjI3FqR2E5ggsEAMYC
34+
sKI3Nil/RenE7Quw5YLybuVyQX4PLKHtNKZDlNzHFPwF/knG9kQDAzT0UhmihUPL
35+
S8l6jeDELTwwiq1Npluy3K5EsqSKC7vlBae6f6qGBzFX0gw3yz8R7pfnAWyd4K8s
36+
cWDMQtL2Bx6mEuJ4ER88sOkOHyYadSC8SbIEmMNHPpwVg4S+ypbQP7qStQN7cQud
37+
XbRMV5gKu8E9n5kcVlahKMTdqKelAd33DQrHjDRIitgCzYA4LWpqSSuHlCMWKTLf
38+
QOknoRTKD96W1bkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAeeAoG3xpVfAcA2ZN
39+
aJA0uEB7ZH5BjhFsvmc1kEZylkEo6STVs1uTTvc9+v3PqzYANycbHy/3N0EUo5OX
40+
X6tfo3SMn3c8MyZu/3960Vcs1YJApdC1P3FvHj25IQGz8qLgsmION1tijg0ySPQb
41+
CYFXZ8T0ZYHA2X2QMieYiB9cNcmaL3Mlx04nf2Vfb+e/6kCWKkETlfSDIde9/J2M
42+
kVAYLGWWnwWvfRvjEaZ7SZNWslBttUTEr4PiFkvdPU01UF3VAjkcAOcDzvueGdmT
43+
d5Eg1BEWWmNBdT+Yg5hoy5Hx8R7H9ZcyoXnIMKCa9pOoIBIEk/hmcXj3smmjAMfO
44+
wTO08w==
45+
-----END CERTIFICATE-----
46+
-----BEGIN CERTIFICATE-----
47+
MIICsTCCAZmgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwEjEQMA4GA1UEAwwHUm9v
48+
dC1jYTAeFw0yMDExMjUxMjEyMDRaFw0yMTExMjUxMjEyMDRaMBMxETAPBgNVBAMM
49+
CEludGVybTEuMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0/VPbQ2O
50+
YERPdfjLsTn/eGu4R98iNOw3pwyOtxK5b7w/b3sheGvoA7iRdyk6TBQ6e6sGUnUj
51+
fImyxNnWHRNBsX6NwwYk3DvFMvVgIfYi657m+7JaPYT+TcsLF223n2mDP3PHQe4B
52+
etOdP81gC2c+l1cmPSduMwzi3Ze64gQ15PvyTjVcTRuVCFZIpdAZ2DLEFMviuc7O
53+
vnxA+DFfN5Ve5gCJIEmxEtkHtolqZbhBIVPsfz5CofjD9bPm452ibssNoZgKU030
54+
9h2QPzvOhJ4iN2UDto2/Mq6xemEXxhVV7GyJ5iKtlnz1TYNAVPKkzhY+J9fnG/yT
55+
/MOwREaq+/9AbwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUA
56+
A4IBAQCyqfVs2oawxgymfI/Nk6aGG+EjG+aBixu9tO45hQT2mEyb5ztP49ZwFOpc
57+
+ys1snq3gtol2r7J+Up96DJ3aF6U3OE3iDqbtfjosMmi+rQQDRK/hp6QcU5rQucY
58+
hDiooiuajp7bhUgEdjhDW7GbV9yT1bA9WL5urFoGE0THUKLoMV4GCRQAQsodEx+B
59+
yos50UBCHuSkeJWRGmR4lpyIprPJaQgC7E83FfLe5UDsP1bioDiW4RZk4sqryy/z
60+
VJQNGgXYnlftf6J6WOPLdzU51R21yGCRjmNP0G9Vay9Wq7WOdDqjiQjWZyXWFf6H
61+
bbp7qAgS2JLTieLZ3GXBg0RTi+lK
62+
-----END CERTIFICATE-----
63+
-----BEGIN CERTIFICATE-----
64+
MIICsjCCAZqgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwEzERMA8GA1UEAwwISW50
65+
ZXJtMS4wHhcNMjAxMTI1MTIxMjA0WhcNMjExMTI1MTIxMjA0WjATMREwDwYDVQQD
66+
DAhJbnRlcm0yLjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKto0lJW
67+
e+0+6u/gxG3NNfoqHWAMiDm+Ogcv1aIUTxTK8CO6dlwLTAMDg47wXgZSE+fpwtJf
68+
OCV9uwUvoVrdBazPil13KTQKHkN3jV6TnrU92gJpb1uBCQwQQXvCaQeUrMNPC7h3
69+
lYaxAODH62B5Pl2PY/DXdaKNbsN0chOZmNl87FgtXH4/ITOqqHY/vLW4ikYbADHi
70+
HLZOXFFV6VK6tNm5NgbKpDeUG5I5mjilZSfxnHHJAFIrIy19wK+wyPr9X+Eyph7Z
71+
slYDDZ/+RRIEp3tNlaac+g+uv1CJZWdRcTb+q/fAMd/emL0ofg3XKRNtSwfDuDNh
72+
z7i68VKL/6Xtd3cCAwEAAaMQMA4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsF
73+
AAOCAQEAYUwKKDKMG0ZwUJwJuqXZfCrf+95t9aeb+ALcFw7gABrdSFY9VmDQj2wW
74+
wl1afkV0jAREEnOtHJ0wioAhD86TUMoj99+UMEtp/r9QPH1XMClnCS0kp1M9ogCu
75+
PlqFamJlKhIa3xvvKSamU6G7qlbVzi2y7x/SBhK/U/FDo4bElgwG6WVXsluOQ6fT
76+
uUAJTqNfWcSdw2ntIGbwlbg1sco3a2JENB/5tyTSIWlwwUo6d+s2W3ZcNePWAPdr
77+
gEAVV1yOWsb1OVse2NRye5lH3cc+x0O1XYzWiC6G3GWYUmoPhl50fsidrd6WQIt5
78+
+6MXQJQW+CgBnPiCdSfN58mxv49xJQ==
79+
-----END CERTIFICATE-----

‎e2e/tests/ssl_front_use/data/haproxy.cfg

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# _version=42
2+
3+
global
4+
log 127.0.0.1 local2
5+
chroot /var/lib/haproxy
6+
pidfile /var/run/haproxy.pid
7+
maxconn 4000
8+
user haproxy
9+
group haproxy
10+
stats socket /var/lib/haproxy/stats level admin
11+
12+
defaults mydefaults
13+
mode http
14+
log global
15+
option httplog
16+
option dontlognull
17+
option http-server-close
18+
option forwardfor except 127.0.0.0/8
19+
option redispatch
20+
retries 3
21+
timeout http-request 10s
22+
timeout queue 1m
23+
timeout connect 10s
24+
timeout client 1m
25+
timeout server 1m
26+
timeout http-keep-alive 10s
27+
timeout check 10s
28+
maxconn 3000
29+
30+
frontend front1
31+
#bind ip:port
32+
mode http
33+
option http-server-close

‎e2e/tests/ssl_front_use/data/post.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"certificate": "/etc/haproxy/ssl/cert.pem",
3+
"allow_0rtt": true,
4+
"no_alpn": true
5+
}

‎e2e/tests/ssl_front_use/data/put.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"certificate": "/etc/haproxy/ssl/cert.pem",
3+
"allow_0rtt": false,
4+
"no_alpn": true,
5+
"verify": "none"
6+
}

‎e2e/tests/ssl_front_use/test.bats

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#!/usr/bin/env bats
2+
#
3+
# Copyright 2025 HAProxy Technologies
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http:#www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
18+
load '../../libs/dataplaneapi'
19+
load '../../libs/debug'
20+
load '../../libs/get_json_path'
21+
load '../../libs/haproxy_config_setup'
22+
load '../../libs/haproxy_version'
23+
load '../../libs/resource_client'
24+
load '../../libs/version'
25+
26+
load 'utils/_helpers'
27+
28+
cert=/etc/haproxy/ssl/cert.pem
29+
30+
@test "ssl_front_uses: get/create/modify/delete (>=3.2)" {
31+
haproxy_version_ge "3.2" || skip
32+
33+
run docker cp "${BATS_TEST_DIRNAME}/data/3.pem" "${DOCKER_CONTAINER_NAME}:$cert"
34+
35+
# debug "ssl-f-use: create"
36+
resource_post "$(ssl_front_uses_path front1)" "data/post.json"
37+
assert_equal "$SC" "202"
38+
39+
# debug "ssl-f-use: get all"
40+
resource_get "$(ssl_front_uses_path front1)"
41+
assert_equal "$SC" "200"
42+
assert_equal "$(get_json_path "$BODY" '.|length')" 1
43+
assert_equal "$(get_json_path "$BODY" '.[0].certificate')" "$cert"
44+
assert_equal "$(get_json_path "$BODY" '.[0].allow_0rtt')" true
45+
46+
# debug "ssl-f-use: get one"
47+
resource_get "$(ssl_front_uses_path front1 0)"
48+
assert_equal "$SC" "200"
49+
assert_equal "$(get_json_path "$BODY" '.certificate')" "$cert"
50+
assert_equal "$(get_json_path "$BODY" '.allow_0rtt')" true
51+
52+
# debug "ssl-f-use: edit"
53+
resource_put "$(ssl_front_uses_path front1 0)" "data/put.json"
54+
assert_equal "$SC" "202"
55+
assert_equal "$(get_json_path "$BODY" '.certificate')" "$cert"
56+
assert_equal "$(get_json_path "$BODY" '.allow_0rtt')" null
57+
assert_equal "$(get_json_path "$BODY" '.no_alpn')" true
58+
assert_equal "$(get_json_path "$BODY" '.verify')" none
59+
60+
# debug "ssl-f-use: delete"
61+
resource_delete "$(ssl_front_uses_path front1 0)"
62+
assert_equal "$SC" "202"
63+
resource_get "$(ssl_front_uses_path front1)"
64+
assert_equal "$SC" "200"
65+
assert_equal "$(get_json_path "$BODY" '.|length')" 0
66+
}

‎e2e/tests/ssl_front_use/utils/_helpers.bash

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# /services/haproxy/configuration/frontends/{parent_name}/ssl_front_uses/{index}
2+
ssl_front_uses_path() {
3+
echo "/services/haproxy/configuration/frontends/${1:?}/ssl_front_uses${2:+/$2}"
4+
}

0 commit comments

Comments
 (0)