From b0b7c7d3919ee617dd80a99dec8b0361a2076a72 Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Mon, 13 May 2019 09:36:33 +0200 Subject: [PATCH] Allow HTTP requests to insecure servers With SYSTEM_HTTP_CLIENT_TSL_INSECURE we reconfigure DefaultTransport and allow requests to insecure hosts. This has direct effect on OIDC autodiscovery. --- internal/config/http.go | 4 ++++ system/start.go | 14 ++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/internal/config/http.go b/internal/config/http.go index 3970d9c5c..194221caf 100644 --- a/internal/config/http.go +++ b/internal/config/http.go @@ -13,6 +13,8 @@ type ( Tracing bool Metrics bool + ClientTSLInsecure bool + MetricsUsername, MetricsPassword string } ) @@ -50,6 +52,8 @@ func (*HTTP) Init(prefix ...string) *HTTP { flag.BoolVar(&http.Pretty, p("http-pretty-json"), false, "Prettify returned JSON output") flag.BoolVar(&http.Tracing, p("http-error-tracing"), false, "Return error stack frame") + flag.BoolVar(&http.ClientTSLInsecure, p("http-client-tsl-insecure"), false, "Skip insecure TSL verification on outbound HTTP requests (allow invalid/self-signed certificates)") + flag.BoolVar(&http.Metrics, "metrics", false, "Provide metrics export for prometheus") flag.StringVar(&http.MetricsUsername, "metrics-username", "metrics", "Provide metrics export for prometheus") flag.StringVar(&http.MetricsPassword, "metrics-password", "", "Provide metrics export for prometheus") diff --git a/system/start.go b/system/start.go index 5e507d9f1..da596d33c 100644 --- a/system/start.go +++ b/system/start.go @@ -2,6 +2,7 @@ package service import ( "context" + "crypto/tls" "fmt" "net" "net/http" @@ -34,6 +35,19 @@ func Init(ctx context.Context) (err error) { return } + if flags.http.ClientTSLInsecure { + // This will allow HTTPS requests to insecure hosts (expired, wrong host, self signed, untrusted root...) + // With this enabled, features like OIDC auto-discovery should work on any of examples found on badssl.com. + // + // With SYSTEM_HTTP_CLIENT_TSL_INSECURE=0 (default) next command returns 404 error (expected) + // > ./system-cli external-auth auto-discovery foo-tsl-1 https://expired.badssl.com/ + // + // Without SYSTEM_HTTP_CLIENT_TSL_INSECURE=1 next command returns "x509: certificate has expired or is not yet valid" + // > ./system-cli external-auth auto-discovery foo-tsl-1 https://expired.badssl.com/ + // + http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true} + } + // configure resputil options resputil.SetConfig(resputil.Options{ Pretty: flags.http.Pretty,