This repository was archived by the owner on Sep 30, 2024. It is now read-only.
all: support certificates in tls.external#8092
Merged
Merged
Conversation
Extended the experimental tls.external site setting to include a list of certificates. When set repo-updater will add the certificates to the HTTP client's RootCAs. This features works on top of any certificates added to an individual external service configuration. Additionally these certificates are also set for remote git commands. This was tested by running a local HTTPS proxy to GitHub.com. I ensured both API requests and git requests only worked when the relevant tls.external setting was configured.
Member
Author
|
I did lots of manual testing. Will think about how to testing this in an automatic way (it can be modified to be go test, but is quite a lot of work for an unknown value). Here are my detailed notes on testing: openssl genrsa -out server.key 2048
openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650Ran a proxy to github.com with it package main
import (
"log"
"net/http"
"net/http/httputil"
"net/url"
"strings"
)
func main() {
u, err := url.Parse("https://api.github.com")
if err != nil {
log.Fatal(err)
}
urlDirector := httputil.NewSingleHostReverseProxy(u).Director
director := func(req *http.Request) {
orig := req.URL.String()
urlDirector(req)
if strings.HasPrefix(req.URL.Path, "/api/") {
req.URL.Path = strings.TrimPrefix(req.URL.Path, "/api")
req.URL.Path = strings.TrimPrefix(req.URL.Path, "/v3")
} else {
req.URL.Host = "github.com"
}
req.Host = req.URL.Host
log.Println(orig, "->", req.URL)
}
err = http.ListenAndServeTLS(":443", "server.crt", "server.key", &httputil.ReverseProxy{
Director: director,
})
if err != nil {
log.Fatal("ListenAndServe: ", err)
}
}Then configured a GitHub external service pointing to my localhost. Everything "tls.external": {
"insecureSkipVerify": true,
"certificates": ["CERTHERE"]
}Command line snippet to JSONify cert: echo '{}' | jq --arg val "$(cat test/server.crt)" '$val' | pbcopyAdditionally I had to modify the GitHub external service to use the baseURL diff --git a/cmd/repo-updater/repos/github.go b/cmd/repo-updater/repos/github.go
index fb5839966b..94d4284c84 100644
--- a/cmd/repo-updater/repos/github.go
+++ b/cmd/repo-updater/repos/github.go
@@ -305,6 +305,7 @@ func (s *GithubSource) authenticatedRemoteURL(repo *github.Repository) string {
return repo.URL
}
u.User = url.User(s.config.Token)
+ u.Host = s.originalHostname
return u.String()
} |
unknwon
approved these changes
Jan 29, 2020
Co-Authored-By: ᴜɴᴋɴᴡᴏɴ <joe@sourcegraph.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extended the experimental tls.external site setting to include a list of
certificates. When set repo-updater will add the certificates to the HTTP
client's RootCAs. This features works on top of any certificates added to an
individual external service configuration. Additionally these certificates are
also set for remote git commands.
This was tested by running a local HTTPS proxy to GitHub.com. I ensured both
API requests and git requests only worked when the relevant tls.external
setting was configured.
Note: AWS CodeCommit still does not support these setting. However, I don't expect AWS CodeCommit to be self hosted so should be fine.
Fixes #71