Disable domain fronting
Co-authored-by: jbdoumenjou <jb.doumenjou@gmail.com>
This commit is contained in:
Romain
GitHub
parent
416c367778
commit
2b35397169
19 changed files with 532 additions and 58 deletions
|
|
@ -130,6 +130,20 @@ tls:
|
|||
|
||||
If no default certificate is provided, Traefik generates and uses a self-signed certificate.
|
||||
|
||||
## Domain fronting
|
||||
|
||||
Basically, [domain fronting](https://en.wikipedia.org/wiki/Domain_fronting) is a technique that allows to open a
|
||||
connection with a specific domain name, thanks to the
|
||||
[Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication), then access a service with another
|
||||
domain set in the HTTP `Host` header.
|
||||
|
||||
Since the `v2.2.2`, Traefik avoids (by default) using domain fronting.
|
||||
As it is valid for advanced use cases, the `HostHeader` and `HostSNI` [rules](../routing/routers/index.md#rule) allow
|
||||
to fine tune the routing with the `Server Name Indication` and `Host header` value.
|
||||
|
||||
If you encounter routing issues with a previously working configuration, please refer to the
|
||||
[migration guide](../migration/v2.md) to update your configuration.
|
||||
|
||||
## TLS Options
|
||||
|
||||
The TLS options allow one to configure some parameters of the TLS connection.
|
||||
|
|
@ -317,7 +331,7 @@ spec:
|
|||
### Strict SNI Checking
|
||||
|
||||
With strict SNI checking, Traefik won't allow connections from clients connections
|
||||
that do not specify a server_name extension.
|
||||
that do not specify a server_name extension or don't match any certificate configured on the tlsOption.
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# Dynamic configuration
|
||||
|
|
|
|||
|
|
@ -1,5 +1,117 @@
|
|||
# Migration: Steps needed between the versions
|
||||
|
||||
## v2.x to v2.2.2
|
||||
|
||||
### Domain fronting
|
||||
|
||||
In `v2.2.2` we introduced the ability to avoid [Domain fronting](https://en.wikipedia.org/wiki/Domain_fronting),
|
||||
and enabled it by default for [https routers](../routing/routers/index.md#rule) configured with ```Host(`something`)```.
|
||||
|
||||
!!! example "Allow Domain Fronting on a Specific Router"
|
||||
|
||||
!!! info "Before v2.2.2"
|
||||
|
||||
```yaml tab="Docker"
|
||||
labels:
|
||||
- "traefik.http.routers.router0.rule=Host(`test.localhost`)"
|
||||
```
|
||||
|
||||
```yaml tab="K8s Ingress"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: ingressroutebar
|
||||
|
||||
spec:
|
||||
entryPoints:
|
||||
- http
|
||||
routes:
|
||||
- match: Host(`test.localhost`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: server0
|
||||
port: 80
|
||||
- name: server1
|
||||
port: 80
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[http.routers.router0]
|
||||
rule = "Host(`test.localhost`)"
|
||||
service = "my-service"
|
||||
```
|
||||
|
||||
```toml tab="File (YAML)"
|
||||
http:
|
||||
routers:
|
||||
router0:
|
||||
rule: "Host(`test.localhost`)"
|
||||
service: my-service
|
||||
```
|
||||
|
||||
!!! info "v2.2.2"
|
||||
|
||||
```yaml tab="Docker"
|
||||
labels:
|
||||
- "traefik.http.routers.router0.rule=HostHeader(`test.localhost`)"
|
||||
```
|
||||
|
||||
```yaml tab="K8s Ingress"
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: ingressroutebar
|
||||
|
||||
spec:
|
||||
entryPoints:
|
||||
- http
|
||||
routes:
|
||||
- match: HostHeader(`test.localhost`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: server0
|
||||
port: 80
|
||||
- name: server1
|
||||
port: 80
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[http.routers.router0]
|
||||
rule = "HostHeader(`test.localhost`)"
|
||||
service = "my-service"
|
||||
```
|
||||
|
||||
```toml tab="File (YAML)"
|
||||
http:
|
||||
routers:
|
||||
router0:
|
||||
rule: "HostHeader(`test.localhost`)"
|
||||
service: my-service
|
||||
```
|
||||
|
||||
As a fallback, a new flag is available as a global option:
|
||||
|
||||
!!! example "Enabling Domain Fronting for All Routers"
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# Static configuration
|
||||
[global]
|
||||
# Enabling domain fronting
|
||||
insecureSNI = true
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
# Static configuration
|
||||
global:
|
||||
# Enabling domain fronting
|
||||
insecureSNI: true
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
# Enabling domain fronting
|
||||
--global.insecureSNI
|
||||
```
|
||||
|
||||
## v2.0 to v2.1
|
||||
|
||||
### Kubernetes CRD
|
||||
|
|
|
|||
|
|
@ -162,6 +162,9 @@ WriteTimeout is the maximum duration before timing out writes of the response. I
|
|||
`--global.checknewversion`:
|
||||
Periodically check if a new version has been released. (Default: ```false```)
|
||||
|
||||
`--global.insecuresni`:
|
||||
Allow domain fronting. If the option is not specified, it will be disabled by default. (Default: ```false```)
|
||||
|
||||
`--global.sendanonymoususage`:
|
||||
Periodically send anonymous usage statistics. If the option is not specified, it will be enabled by default. (Default: ```false```)
|
||||
|
||||
|
|
|
|||
|
|
@ -162,6 +162,9 @@ WriteTimeout is the maximum duration before timing out writes of the response. I
|
|||
`TRAEFIK_GLOBAL_CHECKNEWVERSION`:
|
||||
Periodically check if a new version has been released. (Default: ```false```)
|
||||
|
||||
`TRAEFIK_GLOBAL_INSECURESNI`:
|
||||
Allow domain fronting. If the option is not specified, it will be disabled by default. (Default: ```false```)
|
||||
|
||||
`TRAEFIK_GLOBAL_SENDANONYMOUSUSAGE`:
|
||||
Periodically send anonymous usage statistics. If the option is not specified, it will be enabled by default. (Default: ```false```)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
[global]
|
||||
checkNewVersion = true
|
||||
sendAnonymousUsage = true
|
||||
insecureSNI = false
|
||||
|
||||
[serversTransport]
|
||||
insecureSkipVerify = true
|
||||
|
|
|
|||
|
|
@ -1,6 +1,8 @@
|
|||
global:
|
||||
checkNewVersion: true
|
||||
sendAnonymousUsage: true
|
||||
insecureSNI: false
|
||||
|
||||
serversTransport:
|
||||
insecureSkipVerify: true
|
||||
rootCAs:
|
||||
|
|
|
|||
|
|
@ -228,16 +228,18 @@ If the rule is verified, the router becomes active, calls middlewares, and then
|
|||
|
||||
The table below lists all the available matchers:
|
||||
|
||||
| Rule | Description |
|
||||
|------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------|
|
||||
| ```Headers(`key`, `value`)``` | Check if there is a key `key`defined in the headers, with the value `value` |
|
||||
| ```HeadersRegexp(`key`, `regexp`)``` | Check if there is a key `key`defined in the headers, with a value that matches the regular expression `regexp` |
|
||||
| ```Host(`example.com`, ...)``` | Check if the request domain targets one of the given `domains`. |
|
||||
| ```HostRegexp(`example.com`, `{subdomain:[a-z]+}.example.com`, ...)``` | Check if the request domain matches the given `regexp`. |
|
||||
| ```Method(`GET`, ...)``` | Check if the request method is one of the given `methods` (`GET`, `POST`, `PUT`, `DELETE`, `PATCH`) |
|
||||
| ```Path(`/path`, `/articles/{cat:[a-z]+}/{id:[0-9]+}`, ...)``` | Match exact request path. It accepts a sequence of literal and regular expression paths. |
|
||||
| ```PathPrefix(`/products/`, `/articles/{cat:[a-z]+}/{id:[0-9]+}`)``` | Match request prefix path. It accepts a sequence of literal and regular expression prefix paths. |
|
||||
| ```Query(`foo=bar`, `bar=baz`)``` | Match Query String parameters. It accepts a sequence of key=value pairs. |
|
||||
| Rule | Description |
|
||||
|------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| ```Headers(`key`, `value`)``` | Check if there is a key `key`defined in the headers, with the value `value` |
|
||||
| ```HeadersRegexp(`key`, `regexp`)``` | Check if there is a key `key`defined in the headers, with a value that matches the regular expression `regexp` |
|
||||
| ```Host(`example.com`, ...)``` | By default, is equivalent to `HostHeader` **AND** `HostSNI` rules. See [Domain Fronting](../../https/tls.md#domain-fronting) and the [migration guide](../../migration/v2.md#domain-fronting) for more details. |
|
||||
| ```HostHeader(`example.com`, ...)``` | Check if the request domain (host header value) targets one of the given `domains`. |
|
||||
| ```HostSNI(`example.com`, ...)``` | Check if the [Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication) corresponds to the given `domains`. |
|
||||
| ```HostRegexp(`example.com`, `{subdomain:[a-z]+}.example.com`, ...)``` | Check if the request domain matches the given `regexp`. |
|
||||
| ```Method(`GET`, ...)``` | Check if the request method is one of the given `methods` (`GET`, `POST`, `PUT`, `DELETE`, `PATCH`) |
|
||||
| ```Path(`/path`, `/articles/{cat:[a-z]+}/{id:[0-9]+}`, ...)``` | Match exact request path. It accepts a sequence of literal and regular expression paths. |
|
||||
| ```PathPrefix(`/products/`, `/articles/{cat:[a-z]+}/{id:[0-9]+}`)``` | Match request prefix path. It accepts a sequence of literal and regular expression prefix paths. |
|
||||
| ```Query(`foo=bar`, `bar=baz`)``` | Match Query String parameters. It accepts a sequence of key=value pairs. |
|
||||
|
||||
!!! important "Regexp Syntax"
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue