TrueCloudLab/frostfs-s3-gw

Fork 20

Support TLS termination on a proxy-level for SSE-C #562

New issue

Closed

opened 2024-11-25 14:49:42 +00:00 by alexvanin · 3 comments

alexvanin commented

2024-11-25 14:49:42 +00:00

Owner

Encryption parameters are processed by gateway when TLS is enabled.

func formEncryptionParamsBase(r *http.Request, ...){
	...
	if r.TLS == nil {
		return enc, apierr.GetAPIError(apierr.ErrInsecureSSECustomerRequest)
	}
	...
}

However, there might be an option, when TLS is terminated by the reverse-proxy server before gateway

Source

Describe the solution you'd like

Add a setting to disable TLS check.

Describe alternatives you've considered

Consider having such setting a dangerous thing and use self-signed cert for reverse proxy anyway.
Do not terminate TLS on proxy level at all.

Additional context

Minio restricts encryption headers without TLS and does not configure it, see 9a39f8ad4d/cmd/generic-handlers.go (L439)

## Is your feature request related to a problem? Please describe. Encryption parameters are processed by gateway when TLS is enabled. ```go func formEncryptionParamsBase(r *http.Request, ...){ ... if r.TLS == nil { return enc, apierr.GetAPIError(apierr.ErrInsecureSSECustomerRequest) } ... } ``` However, there might be an option, when TLS is terminated by the reverse-proxy server before gateway ![proxy-tls.svg](/attachments/9eb9956d-c032-42dd-8cb1-4e877a10d6f7) [Source](https://www.plantuml.com/plantuml/uml/TP31JiCm38RlUGhJqoOXE6n7X2R6nWuSfcMSnbI5rbs3MhjANBOAyUwurSO1GKw9Ft-_hSoYk21jNPahJrdLvWXtsVHsFatdJE8yORXf5D__mUk62KdEtDWk2jRf0xUKkz2DYY9UGx8C76LfOP5n71gICNmQqFCJC6e2dphjtU07XeWml1CjqC7JAHd_QeyJHNO2Jqxmw3hbNsQj8jEeLV8ICMZDRB1ADttb4hzRRRTh2yAmqft8rRX_fNKhm6_lc0aSlPHWxKBbtdsyxANppdBlLfovgjI0VsL3B0Z17qgb1Uo6cBq1s3xhT0or9oUU2KhND4WHIWnea7BeHMDcUjKl_GO0) ## Describe the solution you'd like Add a setting to disable TLS check. ## Describe alternatives you've considered * Consider having such setting a dangerous thing and use self-signed cert for reverse proxy anyway. * Do not terminate TLS on proxy level at all. ## Additional context Minio restricts encryption headers without TLS and does not configure it, see https://github.com/minio/minio/blob/9a39f8ad4d40b53dc4c73196e75570df23a01257/cmd/generic-handlers.go#L439

proxy-tls.svg

10 KiB

alexvanin added the

discussion

label 2024-11-25 14:49:42 +00:00

r.loginov was assigned by alexvanin

2024-11-25 14:49:42 +00:00

dkirillov commented

2024-11-26 12:46:49 +00:00

Member

Maybe we can disable TLS check if poxy will provide specific header.

alexvanin commented

2024-11-28 06:36:15 +00:00

Author

Owner

Maybe we can disable TLS check if poxy will provide specific header.

Yes, that makes sense.

> Maybe we can disable TLS check if poxy will provide specific header. Yes, that makes sense.

r.loginov referenced this issue from a pull request that will close it,

2024-12-03 12:52:36 +00:00

[#562] Support TLS termination header for SSE-C #566

alexvanin added this to the v0.32.0 milestone 2024-12-10 14:51:53 +00:00

alexvanin referenced this issue from a commit

2024-12-11 14:16:57 +00:00

[#562] Support TLS termination header for SSE-C

alexvanin referenced this issue from a commit

2024-12-11 14:16:57 +00:00

[#562] Add tests for form encryption params

alexvanin closed this issue

2024-12-11 14:16:57 +00:00

alexvanin commented

2024-12-11 14:24:27 +00:00

Author

Owner

I reopen this, because by default this feature is enabled as soon as client attaches proper HTTP header. It should be disabled by default. Consider having empty setting for this header. This should disable TLS check skip for SSE operations.

alexvanin reopened this issue

2024-12-11 14:24:28 +00:00

r.loginov referenced this issue from a pull request that will close it,

2024-12-11 16:07:04 +00:00

[#562] Empty default value for TLS termination header param #575

alexvanin referenced this issue from a commit

2024-12-13 11:13:00 +00:00

[#562] Empty default value for TLS termination header param

alexvanin closed this issue

2024-12-13 11:13:00 +00:00