{"action":"created","issue":{"url":"https://api.github.com/repos/3scale/apicast/issues/938","repository_url":"https://api.github.com/repos/3scale/apicast","labels_url":"https://api.github.com/repos/3scale/apicast/issues/938/labels{/name}","comments_url":"https://api.github.com/repos/3scale/apicast/issues/938/comments","events_url":"https://api.github.com/repos/3scale/apicast/issues/938/events","html_url":"https://github.com/3scale/apicast/pull/938","id":371988838,"node_id":"MDExOlB1bGxSZXF1ZXN0MjI0MzExNjQ2","number":938,"title":"[THREESCALE-1430] Avoid trying to use path-based routing when using HTTPS","user":{"login":"davidor","id":907223,"node_id":"MDQ6VXNlcjkwNzIyMw==","avatar_url":"https://avatars2.githubusercontent.com/u/907223?v=4","gravatar_id":"","url":"https://api.github.com/users/davidor","html_url":"https://github.com/davidor","followers_url":"https://api.github.com/users/davidor/followers","following_url":"https://api.github.com/users/davidor/following{/other_user}","gists_url":"https://api.github.com/users/davidor/gists{/gist_id}","starred_url":"https://api.github.com/users/davidor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidor/subscriptions","organizations_url":"https://api.github.com/users/davidor/orgs","repos_url":"https://api.github.com/users/davidor/repos","events_url":"https://api.github.com/users/davidor/events{/privacy}","received_events_url":"https://api.github.com/users/davidor/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-10-19T14:44:54Z","updated_at":"2018-11-29T09:13:52Z","closed_at":"2018-10-22T08:35:50Z","author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/3scale/apicast/pulls/938","html_url":"https://github.com/3scale/apicast/pull/938","diff_url":"https://github.com/3scale/apicast/pull/938.diff","patch_url":"https://github.com/3scale/apicast/pull/938.patch"},"body":"When APICAST_HTTPS_ env vars are used to configure SSL certs, enabling path routing does not work. The reason is that when those envs are configured, the `find_service` policy runs in the `ssl_certificate` phase which does not have access to the http method nor the path, needed for the path-based routing.\r\n\r\nApart from fixing the issue, this PR refactors the `find_service` by extracting a couple of classes and reorganizing the tests. I think that properly testing the `ssl_certiticate` phase without this refactor would have needed lots of duplicated tests.\r\n\r\nRef: https://issues.jboss.org/browse/THREESCALE-1430"},"comment":{"url":"https://api.github.com/repos/3scale/apicast/issues/comments/442760534","html_url":"https://github.com/3scale/apicast/pull/938#issuecomment-442760534","issue_url":"https://api.github.com/repos/3scale/apicast/issues/938","id":442760534,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0Mjc2MDUzNA==","user":{"login":"nmasse-itix","id":7472564,"node_id":"MDQ6VXNlcjc0NzI1NjQ=","avatar_url":"https://avatars0.githubusercontent.com/u/7472564?v=4","gravatar_id":"","url":"https://api.github.com/users/nmasse-itix","html_url":"https://github.com/nmasse-itix","followers_url":"https://api.github.com/users/nmasse-itix/followers","following_url":"https://api.github.com/users/nmasse-itix/following{/other_user}","gists_url":"https://api.github.com/users/nmasse-itix/gists{/gist_id}","starred_url":"https://api.github.com/users/nmasse-itix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nmasse-itix/subscriptions","organizations_url":"https://api.github.com/users/nmasse-itix/orgs","repos_url":"https://api.github.com/users/nmasse-itix/repos","events_url":"https://api.github.com/users/nmasse-itix/events{/privacy}","received_events_url":"https://api.github.com/users/nmasse-itix/received_events","type":"User","site_admin":false},"created_at":"2018-11-29T09:13:52Z","updated_at":"2018-11-29T09:13:52Z","author_association":"CONTRIBUTOR","body":"Hello,\r\n\r\nWe can agree that we cannot use Path Routing to find the matching service to find the correct TLS certificate during the TLS negociation. \r\n\r\nHowever, I do not agree that we should disable Path Routing with HTTPS. We can still use the `ssl_certificate` phase with global policies. That way, the customer can still craft a global policy that fetch the correct certificate and have path routing. \r\n\r\nSince finding the correct TLS certificate is quite a standard mechanism, we could also provide the global policy that implement this mechanism :\r\n1. extract the host from the TLS negociation via the SNI extension\r\n2. find the first certificate that has a SAN or CN with an exact match\r\n3. if not found, find the first certificate that has a SAN or CN with wildcard match\r\n4. if not found, offer a default configured certificate\r\n\r\nCertificates can be supplied as a Kubernetes secret and mounted in a well-known or configured folder.\r\n\r\nThat way, we could also leverage the [OpenShift Service Signing Certificates](https://docs.openshift.com/container-platform/3.11/dev_guide/secrets.html#service-serving-certificate-secrets) and have a fully automated HTTPS setup on OpenShift. "}}
{"actor":{"display_login":"nmasse-itix"}}