mirror of
https://github.com/google/nomulus.git
synced 2025-06-21 11:50:48 +02:00
9e7c996081
Currently we exact the client certificate hash from header X-GFE-SSL-Certificate. This works because the proxy running on [] sends the request directly to the AFE via HttpOverRpc, bypassing the frontline GFE, which would strip away this header. [] After the proxy moves to GCP we can no longer use that header. Instead we should use X-SSL-Certificate, which does not get stripped by the GFE. In fact the open source build should never have contained X-GFE-SSL-Certificate because obviously external nomulus users have to go through the GFE to reach the registry app and that header would never have survived. Without changing how the [] proxy works, this CL makes the registry first try to extract the hash from X-GFE-SSL-Certificate, and fallback to X-SSL-Certificate if necessary. This allows the current setup to continue to work, while the new proxy is being tested. This should not open us up to attacks because even if an attacker uses a proxy that uses X-SSL-Certificate, it still needs to pass OAuth in order to talk to /_dr/epp. Similarly, we use X-Requested-Servername-SNI as fallback to X-GFE-Requested-Servername-SNI. This can be eliminated altogether when the [] proxy is retired, because the only reason we check if the client request is SNI enabled (by checking the existence of that header) is because the GFE only requests client certificate when SNI is enabled. The GCP proxy does not have that limitation, and also will be only serving one certificate with all SAN listed in it. Some formatting change is also introduced by the formatter. They seem to be better conforming to the style guide, so I left them there. ------------- Created by MOE: https://github.com/google/moe MOE_MIGRATED_REVID=165378083 |
||
|---|---|---|
| .. | ||
| backup | ||
| batch | ||
| bigquery | ||
| braintree | ||
| builddefs | ||
| config | ||
| cron | ||
| dns | ||
| eclipse | ||
| env | ||
| export | ||
| flows | ||
| gcs | ||
| groups | ||
| idn | ||
| keyring | ||
| loadtest | ||
| mapreduce | ||
| model | ||
| module | ||
| monitoring | ||
| pricing | ||
| rdap | ||
| rde | ||
| reporting | ||
| request | ||
| security | ||
| storage/drive | ||
| tldconfig/idn | ||
| tmch | ||
| tools | ||
| ui | ||
| util | ||
| whois | ||
| xjc | ||
| xml | ||
| BUILD | ||
| repositories.bzl | ||