Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Fastly SSL validation fields #12578

Merged
merged 2 commits into from
Mar 13, 2017
Merged

Add Fastly SSL validation fields #12578

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c27ee43
Add Fastly SSL validation fields
jeremylivingston Mar 10, 2017
14b23e0
Add deprecation notice for ssl_hostname
jeremylivingston Mar 12, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion builtin/providers/fastly/resource_fastly_service_v1.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,7 +188,19 @@ func resourceServiceV1() *schema.Resource {
Type: schema.TypeString,
Optional: true,
Default: "",
Description: "SSL certificate hostname",
Description: "SSL certificate hostname (deprecated by Fastly)",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this is deprecated in fastly, then do you think we should also deprecate this in Terraform?

If so, helper schema has the following:

Deprecated: ""

Please be aware that this will have to be a backwards compatible change that we accept both values for a while and make the code work

},
"ssl_cert_hostname": {
Type: schema.TypeString,
Optional: true,
Default: "",
Description: "SSL certificate hostname for cert verification",
},
"ssl_sni_hostname": {
Type: schema.TypeString,
Optional: true,
Default: "",
Description: "SSL certificate hostname for SNI verification",
},
// UseSSL is something we want to support in the future, but
// requires SSL setup we don't yet have
Expand Down Expand Up @@ -1011,6 +1023,8 @@ func resourceServiceV1Update(d *schema.ResourceData, meta interface{}) error {
AutoLoadbalance: gofastly.CBool(df["auto_loadbalance"].(bool)),
SSLCheckCert: gofastly.CBool(df["ssl_check_cert"].(bool)),
SSLHostname: df["ssl_hostname"].(string),
SSLCertHostname: df["ssl_cert_hostname"].(string),
SSLSNIHostname: df["ssl_sni_hostname"].(string),
Shield: df["shield"].(string),
Port: uint(df["port"].(int)),
BetweenBytesTimeout: uint(df["between_bytes_timeout"].(int)),
Expand Down Expand Up @@ -1917,6 +1931,8 @@ func flattenBackends(backendList []*gofastly.Backend) []map[string]interface{} {
"shield": b.Shield,
"ssl_check_cert": gofastly.CBool(b.SSLCheckCert),
"ssl_hostname": b.SSLHostname,
"ssl_cert_hostname": b.SSLCertHostname,
"ssl_sni_hostname": b.SSLSNIHostname,
"weight": int(b.Weight),
"request_condition": b.RequestCondition,
}
Expand Down
4 changes: 4 additions & 0 deletions builtin/providers/fastly/resource_fastly_service_v1_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,8 @@ func TestResourceFastlyFlattenBackend(t *testing.T) {
RequestCondition: "",
SSLCheckCert: true,
SSLHostname: "",
SSLCertHostname: "",
SSLSNIHostname: "",
Shield: "New York",
Weight: uint(100),
},
Expand All @@ -91,6 +93,8 @@ func TestResourceFastlyFlattenBackend(t *testing.T) {
"request_condition": "",
"ssl_check_cert": gofastly.CBool(true),
"ssl_hostname": "",
"ssl_cert_hostname": "",
"ssl_sni_hostname": "",
"shield": "New York",
"weight": 100,
},
Expand Down
4 changes: 3 additions & 1 deletion website/source/docs/providers/fastly/r/service_v1.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,9 @@ Default `200`.
* `port` - (Optional) The port number on which the Backend responds. Default `80`.
* `request_condition` - (Optional, string) Name of already defined `condition`, which if met, will select this backend during a request.
* `ssl_check_cert` - (Optional) Be strict about checking SSL certs. Default `true`.
* `ssl_hostname` - (Optional) Used for both SNI during the TLS handshake and to validate the cert.
* `ssl_hostname` - (Optional, deprecated by Fastly) Used for both SNI during the TLS handshake and to validate the cert.
* `ssl_cert_hostname` - (Optional) Overrides ssl_hostname, but only for cert verification. Does not affect SNI at all.
* `ssl_sni_hostname` - (Optional) Overrides ssl_hostname, but only for SNI in the handshake. Does not affect cert validation at all.
* `shield` - (Optional) The POP of the shield designated to reduce inbound load.
* `weight` - (Optional) The [portion of traffic](https://docs.fastly.com/guides/performance-tuning/load-balancing-configuration.html#how-weight-affects-load-balancing) to send to this Backend. Each Backend receives `weight / total` of the traffic. Default `100`.

Expand Down