Skip to content

Commit 806dcee

Browse files
miheermiheer
committed
This is a followup PR to openshift#1364
The header name max size limit is changed to 255. This was changed as haproxy does not allow more 255 bytes to be set for header name because of the reason mentioned here: https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/ Issue link: https://issues.redhat.com/browse/OCPBUGS-17414
1 parent 26b8597 commit 806dcee

11 files changed

+28
-28
lines changed

‎openapi/generated_openapi/zz_generated.openapi.go

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎openapi/openapi.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25579,7 +25579,7 @@
2557925579
"$ref": "#/definitions/com.github.openshift.api.operator.v1.IngressControllerHTTPHeaderActionUnion"
2558025580
},
2558125581
"name": {
25582-
"description": "name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, \"-!#$%&'*+.^_`\". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. It must be no more than 1024 characters in length. Header name must be unique.",
25582+
"description": "name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, \"-!#$%&'*+.^_`\". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. It must be no more than 255 characters in length. Header name must be unique.",
2558325583
"type": "string",
2558425584
"default": ""
2558525585
}
@@ -31438,7 +31438,7 @@
3143831438
"$ref": "#/definitions/com.github.openshift.api.route.v1.RouteHTTPHeaderActionUnion"
3143931439
},
3144031440
"name": {
31441-
"description": "name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, \"-!#$%&'*+.^_`\". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Cookie, Set-Cookie. It must be no more than 1024 characters in length. Header name must be unique.",
31441+
"description": "name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, \"-!#$%&'*+.^_`\". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Cookie, Set-Cookie. It must be no more than 255 characters in length. Header name must be unique.",
3144231442
"type": "string",
3144331443
"default": ""
3144431444
}

‎operator/v1/0000_50_ingress-operator_00-ingresscontroller.crd.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -296,8 +296,8 @@ spec:
296296
- message: set is required when type is Set, and forbidden otherwise
297297
rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) : !has(self.set)'
298298
name:
299-
description: 'name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, "-!#$%&''*+.^_`". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. It must be no more than 1024 characters in length. Header name must be unique.'
300-
maxLength: 1024
299+
description: 'name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, "-!#$%&''*+.^_`". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. It must be no more than 255 characters in length. Header name must be unique.'
300+
maxLength: 255
301301
minLength: 1
302302
pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$
303303
type: string
@@ -356,8 +356,8 @@ spec:
356356
- message: set is required when type is Set, and forbidden otherwise
357357
rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) : !has(self.set)'
358358
name:
359-
description: 'name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, "-!#$%&''*+.^_`". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. It must be no more than 1024 characters in length. Header name must be unique.'
360-
maxLength: 1024
359+
description: 'name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, "-!#$%&''*+.^_`". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie. It must be no more than 255 characters in length. Header name must be unique.'
360+
maxLength: 255
361361
minLength: 1
362362
pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$
363363
type: string

‎operator/v1/types_ingress.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1473,11 +1473,11 @@ type IngressControllerHTTPHeader struct {
14731473
// The name must consist only of alphanumeric and the following special characters, "-!#$%&'*+.^_`".
14741474
// The following header names are reserved and may not be modified via this API:
14751475
// Strict-Transport-Security, Proxy, Host, Cookie, Set-Cookie.
1476-
// It must be no more than 1024 characters in length.
1476+
// It must be no more than 255 characters in length.
14771477
// Header name must be unique.
14781478
// +kubebuilder:validation:Required
14791479
// +kubebuilder:validation:MinLength=1
1480-
// +kubebuilder:validation:MaxLength=1024
1480+
// +kubebuilder:validation:MaxLength=255
14811481
// +kubebuilder:validation:Pattern="^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$"
14821482
// +kubebuilder:validation:XValidation:rule="self.lowerAscii() != 'strict-transport-security'",message="strict-transport-security header may not be modified via header actions"
14831483
// +kubebuilder:validation:XValidation:rule="self.lowerAscii() != 'proxy'",message="proxy header may not be modified via header actions"

‎operator/v1/zz_generated.swagger_doc_generated.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎route/v1/generated.proto

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎route/v1/route-CustomNoUpgrade.crd.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -128,9 +128,9 @@ spec:
128128
- rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) : !has(self.set)'
129129
message: set is required when type is Set, and forbidden otherwise
130130
name:
131-
description: 'name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, "-!#$%&''*+.^_`". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Cookie, Set-Cookie. It must be no more than 1024 characters in length. Header name must be unique.'
131+
description: 'name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, "-!#$%&''*+.^_`". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Cookie, Set-Cookie. It must be no more than 255 characters in length. Header name must be unique.'
132132
type: string
133-
maxLength: 1024
133+
maxLength: 255
134134
minLength: 1
135135
pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$
136136
x-kubernetes-validations:
@@ -186,9 +186,9 @@ spec:
186186
- rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) : !has(self.set)'
187187
message: set is required when type is Set, and forbidden otherwise
188188
name:
189-
description: 'name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, "-!#$%&''*+.^_`". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Cookie, Set-Cookie. It must be no more than 1024 characters in length. Header name must be unique.'
189+
description: 'name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, "-!#$%&''*+.^_`". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Cookie, Set-Cookie. It must be no more than 255 characters in length. Header name must be unique.'
190190
type: string
191-
maxLength: 1024
191+
maxLength: 255
192192
minLength: 1
193193
pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$
194194
x-kubernetes-validations:

‎route/v1/route-TechPreviewNoUpgrade.crd.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -128,9 +128,9 @@ spec:
128128
- rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) : !has(self.set)'
129129
message: set is required when type is Set, and forbidden otherwise
130130
name:
131-
description: 'name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, "-!#$%&''*+.^_`". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Cookie, Set-Cookie. It must be no more than 1024 characters in length. Header name must be unique.'
131+
description: 'name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, "-!#$%&''*+.^_`". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Cookie, Set-Cookie. It must be no more than 255 characters in length. Header name must be unique.'
132132
type: string
133-
maxLength: 1024
133+
maxLength: 255
134134
minLength: 1
135135
pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$
136136
x-kubernetes-validations:
@@ -186,9 +186,9 @@ spec:
186186
- rule: 'has(self.type) && self.type == ''Set'' ? has(self.set) : !has(self.set)'
187187
message: set is required when type is Set, and forbidden otherwise
188188
name:
189-
description: 'name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, "-!#$%&''*+.^_`". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Cookie, Set-Cookie. It must be no more than 1024 characters in length. Header name must be unique.'
189+
description: 'name specifies the name of a header on which to perform an action. Its value must be a valid HTTP header name as defined in RFC 2616 section 4.2. The name must consist only of alphanumeric and the following special characters, "-!#$%&''*+.^_`". The following header names are reserved and may not be modified via this API: Strict-Transport-Security, Proxy, Cookie, Set-Cookie. It must be no more than 255 characters in length. Header name must be unique.'
190190
type: string
191-
maxLength: 1024
191+
maxLength: 255
192192
minLength: 1
193193
pattern: ^[-!#$%&'*+.0-9A-Z^_`a-z|~]+$
194194
x-kubernetes-validations:

0 commit comments

Comments
 (0)