Merge branch 'master' into ocis-1132

proxy/pkg/config/config.go

@@ -117,6 +117,7 @@ type Config struct {
 	PreSignedURL          PreSignedURL
 	AutoprovisionAccounts bool
 	EnableBasicAuth       bool
+	InsecureBackends      bool
 }
 
 // OIDC is the config for the OpenID-Connect middleware. If set the proxy will try to authenticate every request

proxy/pkg/flagset/flagset.go

@@ -185,6 +185,13 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 			EnvVars:     []string{"PROXY_REVA_GATEWAY_ADDR"},
 			Destination: &cfg.Reva.Address,
 		},
+		&cli.BoolFlag{
+			Name:        "insecure",
+			Value:       false,
+			Usage:       "allow insecure communication to upstream servers",
+			EnvVars:     []string{"PROXY_INSECURE_BACKENDS"},
+			Destination: &cfg.InsecureBackends,
+		},
 
 		// OIDC
 

proxy/pkg/proxy/proxy.go

@@ -2,11 +2,14 @@ package proxy
 
 import (
 	"context"
+	"crypto/tls"
+	"net"
 	"net/http"
 	"net/http/httputil"
 	"net/url"
 	"regexp"
 	"strings"
+	"time"
 
 	"github.com/owncloud/ocis/proxy/pkg/proxy/policy"
 	"go.opencensus.io/plugin/ochttp/propagation/tracecontext"
@@ -37,6 +40,24 @@ func NewMultiHostReverseProxy(opts ...Option) *MultiHostReverseProxy {
 	}
 	rp.Director = rp.directorSelectionDirector
 
+	// equals http.DefaultTransport except TLSClientConfig
+	rp.Transport = &http.Transport{
+		Proxy: http.ProxyFromEnvironment,
+		DialContext: (&net.Dialer{
+			Timeout:   30 * time.Second,
+			KeepAlive: 30 * time.Second,
+			DualStack: true,
+		}).DialContext,
+		ForceAttemptHTTP2:     true,
+		MaxIdleConns:          100,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+		TLSClientConfig: &tls.Config{
+			InsecureSkipVerify: options.Config.InsecureBackends,
+		},
+	}
+
 	if options.Config.Policies == nil {
 		rp.logger.Info().Str("source", "runtime").Msg("Policies")
 		options.Config.Policies = defaultPolicies()