-
Notifications
You must be signed in to change notification settings - Fork 15
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add hcl scheme validation for 'inline' configurations #59
- Loading branch information
Marcel Ludwig
committed
Nov 24, 2020
1 parent
0b4dd6c
commit 191c3d9
Showing
7 changed files
with
181 additions
and
160 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,26 +1,7 @@ | ||
| package config | ||
|
|
||
| import ( | ||
| "github.com/hashicorp/hcl/v2" | ||
| "github.com/hashicorp/hcl/v2/gohcl" | ||
| ) | ||
|
|
||
| type Definitions struct { | ||
| Backend []*Backend `hcl:"backend,block"` | ||
| BasicAuth []*BasicAuth `hcl:"basic_auth,block"` | ||
| JWT []*JWT `hcl:"jwt,block"` | ||
| } | ||
|
|
||
| func (d Definitions) Schema(inline bool) *hcl.BodySchema { | ||
| schema, _ := gohcl.ImpliedBodySchema(d) | ||
| if !inline { | ||
| return schema | ||
| } | ||
| // backend, remove label for inline usage | ||
| for i, block := range schema.Blocks { | ||
| if block.Type == "backend" && len(block.LabelNames) > 0 { | ||
| schema.Blocks[i].LabelNames = nil | ||
| } | ||
| } | ||
| return schema | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,130 @@ | ||
| package runtime | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "net/url" | ||
| "reflect" | ||
| "regexp" | ||
| "strings" | ||
|
|
||
| "github.com/hashicorp/hcl/v2" | ||
| "github.com/hashicorp/hcl/v2/gohcl" | ||
|
|
||
| ac "github.com/avenga/couper/accesscontrol" | ||
| "github.com/avenga/couper/config" | ||
| ) | ||
|
|
||
| var ( | ||
| // reValidFormat validates the format only, validating for a valid host or port is out of scope. | ||
| reValidFormat = regexp.MustCompile(`^([a-z0-9.-]+|\*)(:\*|:\d{1,5})?$`) | ||
| reCleanPattern = regexp.MustCompile(`{([^}]+)}`) | ||
| rePortCheck = regexp.MustCompile(`^(0|[1-9][0-9]{0,4})$`) | ||
| ) | ||
|
|
||
| // validatePortHosts ensures expected host:port formats and unique hosts per port. | ||
| // Host options: | ||
| // "*:<port>" listen for all hosts on given port | ||
| // "*:<port(configuredPort)> given port equals configured default port, listen for all hosts | ||
| // "*" equals to "*:configuredPort" | ||
| // "host:*" equals to "host:configuredPort" | ||
| // "host" listen on configured default port for given host | ||
| func validatePortHosts(conf *config.Gateway, configuredPort int) (ports, hosts, error) { | ||
| portMap := make(ports) | ||
| hostMap := make(hosts) | ||
| isHostsMandatory := len(conf.Server) > 1 | ||
|
|
||
| for _, srv := range conf.Server { | ||
| if isHostsMandatory && len(srv.Hosts) == 0 { | ||
| return nil, nil, fmt.Errorf("hosts attribute is mandatory for multiple servers: %q", srv.Name) | ||
| } | ||
|
|
||
| srvPortMap := make(ports) | ||
| for _, host := range srv.Hosts { | ||
| if !reValidFormat.MatchString(host) { | ||
| return nil, nil, fmt.Errorf("host format is invalid: %q", host) | ||
| } | ||
|
|
||
| ho, po, err := splitWildcardHostPort(host, configuredPort) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| if _, ok := srvPortMap[po]; !ok { | ||
| srvPortMap[po] = make(hosts) | ||
| } | ||
|
|
||
| srvPortMap[po][ho] = true | ||
|
|
||
| hostMap[fmt.Sprintf("%s:%d", ho, po)] = true | ||
| } | ||
|
|
||
| // srvPortMap contains all unique host port combinations for | ||
| // the current server and should not exist multiple times. | ||
| for po, ho := range srvPortMap { | ||
| if _, ok := portMap[po]; !ok { | ||
| portMap[po] = make(hosts) | ||
| } | ||
|
|
||
| for h := range ho { | ||
| if _, ok := portMap[po][h]; ok { | ||
| return nil, nil, fmt.Errorf("conflict: host %q already defined for port: %d", h, po) | ||
| } | ||
|
|
||
| portMap[po][h] = true | ||
| } | ||
| } | ||
| } | ||
|
|
||
| return portMap, hostMap, nil | ||
| } | ||
|
|
||
| func validateOrigin(origin string, ctxRange hcl.Range) error { | ||
| diagErr := &hcl.Diagnostic{ | ||
| Subject: &ctxRange, | ||
| Summary: "invalid backend.origin value", | ||
| } | ||
| if origin == "" { | ||
| diagErr.Detail = "origin attribute is required" | ||
| return hcl.Diagnostics{diagErr} | ||
| } | ||
| u, err := url.Parse(origin) | ||
| if err != nil { | ||
| diagErr.Detail = fmt.Sprintf("url parse error: %v", err) | ||
| return hcl.Diagnostics{diagErr} | ||
| } | ||
| if u.Scheme != "http" && u.Scheme != "https" { | ||
| diagErr.Detail = fmt.Sprintf("valid http scheme required for origin: %q", origin) | ||
| return hcl.Diagnostics{diagErr} | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func validateACName(accessControls ac.Map, name, acType string) (string, error) { | ||
| name = strings.TrimSpace(name) | ||
|
|
||
| if name == "" { | ||
| return name, fmt.Errorf("Missing a non-empty label for %q", acType) | ||
| } | ||
|
|
||
| if _, ok := accessControls[name]; ok { | ||
| return name, fmt.Errorf("Label %q already exists in the ACL", name) | ||
| } | ||
|
|
||
| return name, nil | ||
| } | ||
|
|
||
| func validateInlineScheme(ctx *hcl.EvalContext, body hcl.Body, inlineType config.Inline) error { | ||
| _, partialBody, diags := body.PartialContent(inlineType.Schema(true)) | ||
| result := reflect.New(reflect.TypeOf(inlineType)) | ||
| diags = append(diags, gohcl.DecodeBody(partialBody, ctx, &result)...) | ||
| if diags.HasErrors() { | ||
| return diags | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func isUnique(endpoints map[string]bool, pattern string) (bool, string) { | ||
| pattern = reCleanPattern.ReplaceAllString(pattern, "{}") | ||
|
|
||
| return !endpoints[pattern], pattern | ||
| } |
Oops, something went wrong.