Bug 1953113: template config - HSTS header's pattern accepts case insensitive and white spaces #298

alebedev87 · 2021-06-03T19:46:51Z

This PR makes HAProxy's config template accept HSTS headers with case insensitive directives and white spaces as stated in RFC6797.

Apart from the unit test, tested manually:

$ oc get route console
NAME      HOST/PORT                                    PATH   SERVICES   PORT    TERMINATION          WILDCARD
console   console-openshift-console.apps-crc.testing          console    https   reencrypt/Redirect   None

$ oc get route console --template='{{$a := index .metadata.annotations "haproxy.router.openshift.io/hsts_header"}}{{$a}}{{"\n"}}'
MAX-age=99999 ;   includesubdomains;   Preload

$ curl -k -is https://console-openshift-console.apps-crc.testing | grep -i strict-transport
strict-transport-security: MAX-age=99999 ;   includesubdomains;   Preload

openshift-ci · 2021-06-03T19:46:54Z

@alebedev87: This pull request references Bugzilla bug 1953113, which is invalid:

expected the bug to target the "4.8.0" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 1953113: template config - HSTS header's pattern accepts case insensitive and white spaces

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

alebedev87 · 2021-06-03T19:47:50Z

/bugzilla refresh

openshift-ci · 2021-06-03T19:47:53Z

@alebedev87: This pull request references Bugzilla bug 1953113, which is invalid:

expected the bug to target the "4.8.0" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

alebedev87 · 2021-06-03T19:48:55Z

/assign @candita

pkg/router/router_test.go

images/router/haproxy/conf/haproxy-config.template

pkg/router/router_test.go

images/router/haproxy/conf/haproxy-config.template

pkg/router/router_test.go

alebedev87 · 2021-06-08T18:34:35Z

/retest

alebedev87 · 2021-06-09T14:39:48Z

/retest

pkg/router/router_test.go

Miciah · 2021-06-15T15:49:50Z

pkg/router/router_test.go

@@ -277,6 +440,12 @@ func (e mustCreate) Apply(h *harness) error {
 	return err
 }

+type mustCreateWithConfig struct {
+	mustCreate
+	configPattern string


The name is confusing; the test actually performs a substring search, not a pattern match (such as a regexp), right?

Indeed, it's not a regexp.
Didn't have many ideas for the name, renamed to configSnippet. Tell me if you have better ideas.

…ensitive and white spaces

alebedev87 · 2021-06-16T09:58:32Z

/retest

alebedev87 · 2021-06-17T16:01:47Z

/assign @Miciah

Miciah · 2021-06-17T16:44:07Z

pkg/router/router_test.go

+					},
+					tlsTermination: routev1.TLSTerminationEdge,
+				},
+				configSnippet: `http-response set-header Strict-Transport-Security 'min-age=99999'`,


Can we check for just the substring "http-response set-header Strict-Transport-Security" to make sure there are no false negatives?

Suggested change

configSnippet: `http-response set-header Strict-Transport-Security 'min-age=99999'`,

configSnippet: `http-response set-header Strict-Transport-Security`,

Oh, the state isn't cleared between test cases, is it? So with my suggestion, this test case would always fail.

Miciah · 2021-06-17T16:44:29Z

pkg/router/router_test.go

+					},
+					tlsTermination: routev1.TLSTerminationEdge,
+				},
+				configSnippet: `http-response set-header Strict-Transport-Security 'max-age=99999;includesubdomains;preload;wrongdirective'`,


Suggested change

configSnippet: `http-response set-header Strict-Transport-Security 'max-age=99999;includesubdomains;preload;wrongdirective'`,

configSnippet: `http-response set-header Strict-Transport-Security`,

Miciah · 2021-06-17T17:53:28Z

Thanks! I love the improved test coverage!
/lgtm
/approve

openshift-ci · 2021-06-17T17:53:37Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alebedev87, Miciah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Miciah]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Miciah · 2021-06-17T18:24:07Z

/bugzilla refresh

openshift-ci · 2021-06-17T18:24:16Z

@Miciah: This pull request references Bugzilla bug 1953113, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.9.0) matches configured target release for branch (4.9.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

Requesting review from QA contact:
/cc @quarterpin

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2021-06-17T21:29:19Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-06-17T21:41:20Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-06-18T00:41:19Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-06-18T09:18:08Z

/retest

Please review the full test history for this PR and help us cut down flakes.

alebedev87 · 2021-06-18T14:28:05Z

/retest

openshift-bot · 2021-06-18T15:08:06Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-ci · 2021-06-18T17:00:42Z

@alebedev87: All pull requests linked via external trackers have merged:

openshift/router#298

Bugzilla bug 1953113 has been moved to the MODIFIED state.

In response to this:

Bug 1953113: template config - HSTS header's pattern accepts case insensitive and white spaces

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci bot added the bugzilla/severity-high Referenced Bugzilla bug's severity is high for the branch this PR is targeting. label Jun 3, 2021

openshift-ci bot added the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label Jun 3, 2021

openshift-ci bot requested review from Miciah and smarterclayton June 3, 2021 19:47

openshift-ci bot assigned candita Jun 3, 2021