diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-04-16 18:40:44 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-04-16 18:40:44 +0200 |
| commit | 8f778f989d8fed30eec0a95d5b1fbb67594c67df (patch) | |
| tree | 9821118961aa3ce924f6170287a95498d3262e5a /src | |
| parent | 5a481813c0590d1dd800772251c9ccb25f6faefc (diff) | |
| parent | deb92e4661106283d7951570fc9ab243e74bccd9 (diff) | |
| download | vyos-1x-8f778f989d8fed30eec0a95d5b1fbb67594c67df.tar.gz vyos-1x-8f778f989d8fed30eec0a95d5b1fbb67594c67df.zip | |
Merge pull request #3318 from vyos/mergify/bp/sagitta/pr-3315
T6242: load-balancing reverse-proxy: Ability for ssl backends to not verify server certificates (backport #3315)
Diffstat (limited to 'src')
| -rwxr-xr-x | src/conf_mode/load-balancing_reverse-proxy.py | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/conf_mode/load-balancing_reverse-proxy.py b/src/conf_mode/load-balancing_reverse-proxy.py index 694a4e1ea..9f895c4e2 100755 --- a/src/conf_mode/load-balancing_reverse-proxy.py +++ b/src/conf_mode/load-balancing_reverse-proxy.py @@ -84,6 +84,10 @@ def verify(lb): if {'send_proxy', 'send_proxy_v2'} <= set(bk_server_conf): raise ConfigError(f'Cannot use both "send-proxy" and "send-proxy-v2" for server "{bk_server}"') + if 'ssl' in back_config: + if {'no_verify', 'ca_certificate'} <= set(back_config['ssl']): + raise ConfigError(f'backend {back} cannot have both ssl options no-verify and ca-certificate set!') + for front, front_config in lb['service'].items(): for cert in dict_search('ssl.certificate', front_config) or []: verify_pki_certificate(lb, cert) |