summaryrefslogtreecommitdiff
path: root/src/conf_mode/load-balancing_reverse-proxy.py
diff options
context:
space:
mode:
authorAlex W <embezzle.dev@proton.me>2024-04-15 18:23:05 +0100
committerAlex W <embezzle.dev@proton.me>2024-04-15 19:22:05 +0100
commitaafe22d08bb38a579dd5075fd27a1b88beeca791 (patch)
tree13c3b82e730e181b89e947a6b7e449b5674578ab /src/conf_mode/load-balancing_reverse-proxy.py
parentf3d45223da40ea615d8b4ea73ec902462e3cebb4 (diff)
downloadvyos-1x-aafe22d08bb38a579dd5075fd27a1b88beeca791.tar.gz
vyos-1x-aafe22d08bb38a579dd5075fd27a1b88beeca791.zip
T6242: load-balancing reverse-proxy: Ability for ssl backends to not verify server certificates
Diffstat (limited to 'src/conf_mode/load-balancing_reverse-proxy.py')
-rwxr-xr-xsrc/conf_mode/load-balancing_reverse-proxy.py4
1 files changed, 4 insertions, 0 deletions
diff --git a/src/conf_mode/load-balancing_reverse-proxy.py b/src/conf_mode/load-balancing_reverse-proxy.py
index 694a4e1ea..9f895c4e2 100755
--- a/src/conf_mode/load-balancing_reverse-proxy.py
+++ b/src/conf_mode/load-balancing_reverse-proxy.py
@@ -84,6 +84,10 @@ def verify(lb):
if {'send_proxy', 'send_proxy_v2'} <= set(bk_server_conf):
raise ConfigError(f'Cannot use both "send-proxy" and "send-proxy-v2" for server "{bk_server}"')
+ if 'ssl' in back_config:
+ if {'no_verify', 'ca_certificate'} <= set(back_config['ssl']):
+ raise ConfigError(f'backend {back} cannot have both ssl options no-verify and ca-certificate set!')
+
for front, front_config in lb['service'].items():
for cert in dict_search('ssl.certificate', front_config) or []:
verify_pki_certificate(lb, cert)