Add docker security headers via labels #2334

dtomcej · 2017-10-26T18:32:07Z

This PR creates the ability to configure the security headers for frontends via docker labels.
This should provide comprehensive functionality such as per-frontend SSL redirection.

Based on some of the work done in #2146

Fixes #1903

ldez · 2017-11-04T20:25:07Z

provider/docker/docker.go

+		"getRequestHeaders":                 p.getRequestHeaders,
+		"hasResponseHeaders":                p.hasResponseHeaders,
+		"getResponseHeaders":                p.getResponseHeaders,
+		"hasAllowedHostsHeaders":            p.hasAllowedHostsHeaders,


You can simplify your code like that:

"hasAllowedHostsHeaders": p.hasLabel(types.LabelFrontendAllowedHosts),

func (p Provider) hasLabel(label string) func(container dockerData) bool { return func(container dockerData) bool { label, err := getLabel(container, label) return err == nil && len(label) > 0 } }

Good Call!

Was just getting code roughed in. I knew that there is a lot of duplication, but I wanted to see it as a whole first, before condensing :)

dtomcej · 2017-11-07T18:37:03Z

In case it wasn't clear, I will be integrating k8s annotations in this PR as well, since the functions will be the same.

ldez · 2017-11-16T16:30:23Z

@dtomcej So that your PR is integrated in the 1.5, it is imperative that it is ready by Tuesday 21 November at the latest. 🚀

dtomcej · 2017-11-16T16:42:38Z

Thank you for the reminder! Will have it ready!

elsbrock · 2017-11-17T23:33:38Z

types/common_label.go

@@ -16,6 +16,24 @@ const (
 	LabelFrontendEntryPoints                     = LabelPrefix + "frontend.entryPoints"
 	LabelFrontendRequestHeader                   = LabelPrefix + "frontend.headers.customrequestheaders"
 	LabelFrontendResponseHeader                  = LabelPrefix + "frontend.headers.customresoponseheaders"


I just noticed this typo: customresoponseheaders

It's already fixed in master

ldez · 2017-11-22T00:49:09Z

provider/docker/docker.go

-		"getServicePassHostHeader":    p.getServicePassHostHeader,
-		"getServicePriority":          p.getServicePriority,
-		"getServiceBackend":           p.getServiceBackend,
-		"getServiceRedirect":          p.getServiceRedirect,


This entry is missing.

nmengin

@dtomcej Many thanks for this PR! 👏

Just few suggestions about the documentation.

nmengin · 2017-11-22T13:30:20Z

docs/configuration/backends/docker.md

+
+| Label                                                     | Description                                                                                                                                                                                                                                                                                                                                                                                                                     |
+|-----------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.frontend.headers.allowedHosts=EXPR`              | Provide a list of allowed hosts that requests will be processed. Format: `Host1,Host2`                                                                                                                                                                                                                                                                                                                                                     |


Provides to be homogeneous with the others lines

nmengin · 2017-11-22T13:57:54Z

docs/configuration/backends/docker.md

+|`traefik.frontend.headers.customrequestheaders=EXPR `     | Provides the container with custom request headers that will be appended to each request forwarded to the container. Format:  `HEADER:value,HEADER2:value2`                                                                                                                                                                                                            |
+| `traefik.frontend.headers.customresponseheaders=EXPR`     | Appends the headers to each response returned by the container, before forwarding the response to the client. Format:  `HEADER:value,HEADER2:value2`                                                                                                                                                                                                            |
+|`traefik.frontend.headers.hostsProxyHeaders=EXPR `     | Provides a list of headers that the proxied hostname may be stored. Format:  `HEADER1,HEADER2`                                                                                                                                                                                                            |
+| `traefik.frontend.headers.SSLRedirect=true`                                     | Force the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                                                                                                                                                                                                                                                |


Forces to be homogeneous with the others lines

nmengin · 2017-11-22T13:58:12Z

docs/configuration/backends/docker.md

+| `traefik.frontend.headers.customresponseheaders=EXPR`     | Appends the headers to each response returned by the container, before forwarding the response to the client. Format:  `HEADER:value,HEADER2:value2`                                                                                                                                                                                                            |
+|`traefik.frontend.headers.hostsProxyHeaders=EXPR `     | Provides a list of headers that the proxied hostname may be stored. Format:  `HEADER1,HEADER2`                                                                                                                                                                                                            |
+| `traefik.frontend.headers.SSLRedirect=true`                                     | Force the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                                                                                                                                                                                                                                                |
+| `traefik.frontend.headers.SSLTemporaryRedirect=true`                                     | Force the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                                                                                                                                                                                                                                                                                                |


Forces to be homogeneous with the others lines

ldez · 2017-11-22T16:26:48Z

provider/docker/docker.go

+func getBoolHeader(container dockerData, containerType string) bool {
+	label, err := getLabel(container, containerType)
+	return err == nil && len(label) > 0 && strings.EqualFold(strings.TrimSpace(label), "true")
+


Could your remove this empty line?

ldez

LGTM 🎉

nmengin

LGTM 👏 👏

juliens

LGTM

add template function list function frameworks add prelim function added template functions add functions to template fix case on template vars fix typo re-add redirect update templates delete autogen add security headers documentation fix missing line chore: add autogen. chore: remove old generated file. fix spelling :) remove missing line

robholland · 2017-11-23T09:30:23Z

It doesn't look like this adds support for kubernetes?

ldez · 2017-11-23T10:36:37Z

@robholland this PR only concern Docker.

robholland · 2017-11-23T10:38:28Z

#2334 (comment) says kubernetes would be included and #2146 was closed in favour of this :(

dtomcej · 2017-11-23T16:55:43Z

@robholland You are correct. My intention was to have both in this PR, but it was decided to keep the two separate due to testing. Will have a new PR for k8s today. Again, apologies for the delay.

dtomcej · 2017-11-23T17:27:58Z

@robholland Discussed with the team, and the new PR will make it into 1.5, so will make the next release, so this delay will not affect the mainline release :)

robholland · 2017-11-23T17:28:47Z

Great, thanks! :)

vito-c · 2017-11-30T22:45:31Z

docs/configuration/backends/docker.md

+| Label                                                     | Description                                                                                                                                                                                                                                                                                                                                                                                                                     |
+|-----------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.frontend.headers.allowedHosts=EXPR`              | Provides a list of allowed hosts that requests will be processed. Format: `Host1,Host2`                                                                                                                                                                                                                                                                                                                                                     |
+|`traefik.frontend.headers.customrequestheaders=EXPR `     | Provides the container with custom request headers that will be appended to each request forwarded to the container. Format:  `HEADER:value,HEADER2:value2`                                                                                                                                                                                                            |


are these meant to be lowercase or camel case?

traefik.frontend.headers.customrequestheaders should be traefik.frontend.headers.customRequestHeaders

@vito-c Please open an issue instead of commented an already merged PR.

@vito-c or open a PR. thanks

vito-c · 2017-11-30T22:48:00Z

types/common_label.go

@@ -16,6 +16,24 @@ const (
 	LabelFrontendEntryPoints                     = LabelPrefix + "frontend.entryPoints"
 	LabelFrontendRequestHeader                   = LabelPrefix + "frontend.headers.customrequestheaders"


if camelcase then these should be updated as well

@vito-c Please open an issue instead of commented an already merged PR.

@vito-c or open a PR. thanks

dtomcej added area/provider/docker size/M WIP labels Oct 26, 2017

dtomcej requested a review from a team as a code owner October 26, 2017 19:35

ldez added this to the 1.5 milestone Oct 26, 2017

ldez added the kind/enhancement a new or improved feature. label Oct 26, 2017

ldez reviewed Nov 4, 2017

View reviewed changes

soul9 mentioned this pull request Nov 14, 2017

SSLRedirect = true / Traefik Label for Docker Swarm #1903

Closed

ldez added the contributor/needs-resolve-conflicts label Nov 16, 2017

elsbrock reviewed Nov 17, 2017

View reviewed changes

dtomcej force-pushed the docker-secure-labels branch from 52fea6e to e1c388b Compare November 18, 2017 04:21

ldez removed the WIP label Nov 18, 2017

dtomcej force-pushed the docker-secure-labels branch 3 times, most recently from 643d9b3 to c6fa8bb Compare November 21, 2017 20:31

ldez removed the contributor/needs-resolve-conflicts label Nov 22, 2017

ldez suggested changes Nov 22, 2017

View reviewed changes

traefiker added the contributor/waiting-for-corrections label Nov 22, 2017

ldez added status/2-needs-review and removed contributor/waiting-for-corrections labels Nov 22, 2017

nmengin added the contributor/needs-resolve-conflicts label Nov 22, 2017

nmengin force-pushed the docker-secure-labels branch from 3d66e52 to bdc5f55 Compare November 22, 2017 13:51

nmengin requested changes Nov 22, 2017

View reviewed changes

traefiker added the contributor/waiting-for-corrections label Nov 22, 2017

nmengin removed the contributor/needs-resolve-conflicts label Nov 22, 2017

dtomcej force-pushed the docker-secure-labels branch from 74672f0 to f9bde55 Compare November 22, 2017 16:23

ldez removed the contributor/waiting-for-corrections label Nov 22, 2017

ldez suggested changes Nov 22, 2017

View reviewed changes

traefiker added the contributor/waiting-for-corrections label Nov 22, 2017

dtomcej force-pushed the docker-secure-labels branch from f9bde55 to 0a54441 Compare November 22, 2017 16:44

ldez removed the contributor/waiting-for-corrections label Nov 22, 2017

ldez approved these changes Nov 22, 2017

View reviewed changes

nmengin approved these changes Nov 22, 2017

View reviewed changes

juliens approved these changes Nov 22, 2017

View reviewed changes

juliens added status/3-needs-merge and removed status/2-needs-review labels Nov 22, 2017

traefiker added the bot/need-human-merge label Nov 22, 2017

dtomcej force-pushed the docker-secure-labels branch from 0a54441 to 763a29c Compare November 22, 2017 17:53

ldez removed the bot/need-human-merge label Nov 22, 2017

traefiker merged commit 7063da1 into traefik:master Nov 22, 2017

traefiker removed the status/3-needs-merge label Nov 22, 2017

dtomcej mentioned this pull request Nov 24, 2017

Kubernetes security header annotations #2460

Merged

vito-c reviewed Nov 30, 2017

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add docker security headers via labels #2334

Add docker security headers via labels #2334

dtomcej commented Oct 26, 2017 •

edited by ldez

Loading

ldez Nov 4, 2017

dtomcej Nov 6, 2017

dtomcej commented Nov 7, 2017

ldez commented Nov 16, 2017

dtomcej commented Nov 16, 2017

elsbrock Nov 17, 2017

ldez Nov 18, 2017

ldez Nov 22, 2017

dtomcej Nov 22, 2017

nmengin left a comment

nmengin Nov 22, 2017

nmengin Nov 22, 2017

nmengin Nov 22, 2017

ldez Nov 22, 2017

dtomcej Nov 22, 2017

ldez left a comment

nmengin left a comment

juliens left a comment

robholland commented Nov 23, 2017

ldez commented Nov 23, 2017

robholland commented Nov 23, 2017

dtomcej commented Nov 23, 2017

dtomcej commented Nov 23, 2017

robholland commented Nov 23, 2017

vito-c Nov 30, 2017

ldez Nov 30, 2017 •

edited

Loading

ldez Nov 30, 2017

vito-c Nov 30, 2017

ldez Nov 30, 2017 •

edited

Loading

ldez Nov 30, 2017

		@@ -16,6 +16,24 @@ const (
		LabelFrontendEntryPoints = LabelPrefix + "frontend.entryPoints"
		LabelFrontendRequestHeader = LabelPrefix + "frontend.headers.customrequestheaders"

Add docker security headers via labels #2334

Add docker security headers via labels #2334

Conversation

dtomcej commented Oct 26, 2017 • edited by ldez Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dtomcej commented Nov 7, 2017

ldez commented Nov 16, 2017

dtomcej commented Nov 16, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nmengin left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ldez left a comment

Choose a reason for hiding this comment

nmengin left a comment

Choose a reason for hiding this comment

juliens left a comment

Choose a reason for hiding this comment

robholland commented Nov 23, 2017

ldez commented Nov 23, 2017

robholland commented Nov 23, 2017

dtomcej commented Nov 23, 2017

dtomcej commented Nov 23, 2017

robholland commented Nov 23, 2017

Choose a reason for hiding this comment

ldez Nov 30, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ldez Nov 30, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dtomcej commented Oct 26, 2017 •

edited by ldez

Loading

ldez Nov 30, 2017 •

edited

Loading

ldez Nov 30, 2017 •

edited

Loading