github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: ignore https mappings when no ssl certificate exists

Browse Source 
This fixes issues where users may somehow add an https mapping but are missing an ssl certificate, causing nginx to not load properly. We now ignore the mapping and warn users of the misconfiguration.

Closes #5368
This commit is contained in:
Jose Diaz-Gonzalez
2022-10-22 17:47:54 -04:00
parent d0966ce3d4
commit 4ef260f57a
3 changed files with 45 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
plugins/nginx-vhosts/functions
View File

@@ -320,6 +320,11 @@ nginx_build_config() {
local IS_APP_VHOST_ENABLED=true
plugn trigger domains-vhost-enabled "$APP" 2>/dev/null || IS_APP_VHOST_ENABLED=false
local IS_SSL_ENABLED=false
if is_ssl_enabled "$APP"; then
IS_SSL_ENABLED=true
fi
if [[ "$(plugn trigger proxy-is-enabled "$APP")" == "true" ]]; then
if [[ -z "$DOKKU_APP_LISTEN_PORT" ]] && [[ -z "$DOKKU_APP_LISTEN_IP" ]]; then
DOKKU_APP_LISTENERS="$(plugn trigger network-get-listeners "$APP" "web" | xargs)"
@@ -333,19 +338,28 @@ nginx_build_config() {
local PROXY_SSL_PORT=$(config_get "$APP" DOKKU_PROXY_SSL_PORT)
local PROXY_PORT_MAP=$(config_get "$APP" DOKKU_PROXY_PORT_MAP)
local PORT_MAP
local PORT_MAP proxy_port_map
for PORT_MAP in $PROXY_PORT_MAP; do
local PROXY_UPSTREAM_SCHEME="$(awk -F ':' '{ print $1 }' <<<"$PORT_MAP")"
if [[ "$PROXY_UPSTREAM_SCHEME" == "https" ]] && [[ "$IS_SSL_ENABLED" == "false" ]]; then
dokku_log_warn "Ignoring detected https port mapping without an accompanying ssl certificate (${PORT_MAP})"
continue
fi
proxy_port_map="$proxy_port_map $PORT_MAP"
local PROXY_UPSTREAM_PORT="$(awk -F ':' '{ print $3 }' <<<"$PORT_MAP")"
if [[ "$(is_val_in_list "$PROXY_UPSTREAM_PORT" "$PROXY_UPSTREAM_PORTS" " ")" == "false" ]]; then
local PROXY_UPSTREAM_PORTS+="$PROXY_UPSTREAM_PORT "
fi
done
PROXY_PORT_MAP="$proxy_port_map"
local PROXY_UPSTREAM_PORTS="$(echo "$PROXY_UPSTREAM_PORTS" | xargs)"
local SSL_INUSE=
local NONSSL_VHOSTS=$(plugn trigger domains-list "$APP")
local NOSSL_SERVER_NAME=$(echo "$NONSSL_VHOSTS" | xargs)
if is_ssl_enabled "$APP"; then
if [[ "$IS_SSL_ENABLED" == "true" ]]; then
local SSL_INUSE=true
local SCHEME=https
validate_ssl_domains "$APP"

24
tests/unit/nginx-vhosts_8.bats
View File

@@ -116,3 +116,27 @@ teardown() {
echo "status: $status"
assert_output_contains "45s;" 0
}
@test "(nginx-vhosts) nginx:build-config ignore bad https mapping" {
setup_test_tls
run deploy_app "dockerfile-noexpose"
echo "output: $output"
echo "status: $status"
assert_output_contains "Ignoring detected https port mapping without an accompanying ssl certificate" 0
teardown_test_tls
run /bin/bash -c "dokku proxy:report $TEST_APP --proxy-port-map"
echo "output: $output"
echo "status: $status"
assert_output "http:80:5000 https:443:5000"
run /bin/bash -c "dokku nginx:build-config $TEST_APP"
echo "output: $output"
echo "status: $status"
assert_output_contains "Ignoring detected https port mapping without an accompanying ssl certificate" 1
run /bin/bash -c "dokku proxy:report $TEST_APP --proxy-port-map"
echo "output: $output"
echo "status: $status"
assert_output "http:80:5000 https:443:5000"
}

5
tests/unit/test_helper.bash
View File

@@ -366,6 +366,11 @@ setup_test_tls() {
sudo chown -R dokku:dokku "${TLS}/.."
}
teardown_test_tls() {
local TLS="/home/dokku/$TEST_APP/tls"
rm -rf "$TLS"
}
custom_ssl_nginx_template() {
local APP="$1"
local APP_REPO_DIR="$2"