From 8c450ea7f538beb0b2cd21d35c05d18db49a1802 Mon Sep 17 00:00:00 2001 From: Daniil Baturin Date: Wed, 22 Nov 2023 00:53:35 +0000 Subject: https api: T5772: check if keys are configured unless PAM auth is enabled for GraphQL --- src/conf_mode/https.py | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) (limited to 'src/conf_mode') diff --git a/src/conf_mode/https.py b/src/conf_mode/https.py index 028a5007a..88b26fdc7 100755 --- a/src/conf_mode/https.py +++ b/src/conf_mode/https.py @@ -76,6 +76,8 @@ def get_config(config=None): return https def verify(https): + from vyos.utils.dict import dict_search + if https is None: return None @@ -135,6 +137,30 @@ def verify(https): raise ConfigError(f'"{proto}" port "{_port}" is used by another service') verify_vrf(https) + + # Verify API server settings, if present + if 'api' in https: + keys = dict_search('api.keys.id', https) + gql_auth_type = dict_search('api.graphql.authentication.type', https) + + # If "api graphql" is not defined and `gql_auth_type` is None, + # there's certainly no JWT auth option, and keys are required + jwt_auth = (gql_auth_type == "token") + + # Check for incomplete key configurations in every case + valid_keys_exist = False + if keys: + for k in keys: + if 'key' not in keys[k]: + raise ConfigError(f'Missing HTTPS API key string for key id "{k}"') + else: + valid_keys_exist = True + + # If only key-based methods are enabled, + # fail the commit if no valid key configurations are found + if (not valid_keys_exist) and (not jwt_auth): + raise ConfigError('At least one HTTPS API key is required unless GraphQL token authentication is enabled') + return None def generate(https): -- cgit v1.2.3