)]}'
{"api-ref/source/parameters.yaml":[{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"aa93664a63a5e8a6694cb0f5ee8ea876cb6cbf07","unresolved":false,"context_lines":[{"line_number":665,"context_line":"l7rule-type:"},{"line_number":666,"context_line":"  description: |"},{"line_number":667,"context_line":"    The L7 rule type.  One of ``COOKIE``, ``FILE_TYPE``, ``HEADER``,"},{"line_number":668,"context_line":"    ``HOST_NAME``, ``PATH``, ``SSL_CONN_HAS_CERT``, ``SSL_CONN_USE_CERT``,"},{"line_number":669,"context_line":"    ``SSL_VERIFY_RES`` or ``SSL_DN_FIELD``."},{"line_number":670,"context_line":"  in: body"},{"line_number":671,"context_line":"  required: true"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"9fdfeff1_599fc964","line":668,"range":{"start_line":668,"start_character":29,"end_line":668,"end_character":73},"updated":"2019-02-22 01:47:16.000000000","message":"This is confusing and most drivers don\u0027t separate these. I think we should standardize on ``SSL_CONN_HAS_CERT`` and remove ``SSL_CONN_USE_CERT``.\nHAS_CERT is more clear that there is a certificate, but that this field does not assert a valid certificate.","commit_id":"e86761a4c550de2bfa91f7fa46cae833b0b16580"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"aa93664a63a5e8a6694cb0f5ee8ea876cb6cbf07","unresolved":false,"context_lines":[{"line_number":666,"context_line":"  description: |"},{"line_number":667,"context_line":"    The L7 rule type.  One of ``COOKIE``, ``FILE_TYPE``, ``HEADER``,"},{"line_number":668,"context_line":"    ``HOST_NAME``, ``PATH``, ``SSL_CONN_HAS_CERT``, ``SSL_CONN_USE_CERT``,"},{"line_number":669,"context_line":"    ``SSL_VERIFY_RES`` or ``SSL_DN_FIELD``."},{"line_number":670,"context_line":"  in: body"},{"line_number":671,"context_line":"  required: true"},{"line_number":672,"context_line":"  type: string"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"9fdfeff1_1ca36f02","line":669,"range":{"start_line":669,"start_character":6,"end_line":669,"end_character":20},"updated":"2019-02-22 01:47:16.000000000","message":"SSL_VERIFY_RESULT","commit_id":"e86761a4c550de2bfa91f7fa46cae833b0b16580"}],"octavia/common/constants.py":[{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"aa93664a63a5e8a6694cb0f5ee8ea876cb6cbf07","unresolved":false,"context_lines":[{"line_number":154,"context_line":"                          L7RULE_TYPE_SSL_VERIFY_RES,"},{"line_number":155,"context_line":"                          L7RULE_TYPE_SSL_DN_FIELD)"},{"line_number":156,"context_line":"# reference from RFC 2253"},{"line_number":157,"context_line":"SUPPORTED_DN_FIELDS \u003d [\u0027CN\u0027, \u0027L\u0027, \u0027ST\u0027, \u0027O\u0027, \u0027OU\u0027, \u0027C\u0027, \u0027STREET\u0027, \u0027DC\u0027, \u0027UID\u0027]"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"L7RULE_COMPARE_TYPE_REGEX \u003d \u0027REGEX\u0027"},{"line_number":160,"context_line":"L7RULE_COMPARE_TYPE_STARTS_WITH \u003d \u0027STARTS_WITH\u0027"}],"source_content_type":"text/x-python","patch_set":7,"id":"9fdfeff1_5c9fb764","line":157,"updated":"2019-02-22 01:47:16.000000000","message":"I like the idea of validating these, but there are many of these in use that are not part of that RFC. I think we need to allow arbitrary fields, with some basic validation.","commit_id":"e86761a4c550de2bfa91f7fa46cae833b0b16580"}],"octavia/common/jinja/haproxy/templates/macros.j2":[{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"aa93664a63a5e8a6694cb0f5ee8ea876cb6cbf07","unresolved":false,"context_lines":[{"line_number":105,"context_line":"        acl {{ l7rule.id }} ssl_fc_has_crt"},{"line_number":106,"context_line":"    {% elif l7rule.type \u003d\u003d constants.L7RULE_TYPE_SSL_CONN_USE_CERT %}"},{"line_number":107,"context_line":"        acl {{ l7rule.id }} ssl_c_used"},{"line_number":108,"context_line":"    {% elif l7rule.type \u003d\u003d constants.L7RULE_TYPE_SSL_VERIFY_RES and l7rule.value|int \u003e\u003d 0 %}"},{"line_number":109,"context_line":"        acl {{ l7rule.id }} ssl_c_verify {{ l7rule.value }}"},{"line_number":110,"context_line":"    {% elif l7rule.type \u003d\u003d constants.L7RULE_TYPE_SSL_DN_FIELD %}"},{"line_number":111,"context_line":"        acl {{ l7rule.id }} ssl_c_s_dn({{ dn_key_split(constants, l7rule.key) }}) {{"}],"source_content_type":"text/x-jinja2","patch_set":7,"id":"9fdfeff1_13335a64","line":108,"range":{"start_line":108,"start_character":64,"end_line":108,"end_character":89},"updated":"2019-02-22 01:47:16.000000000","message":"Why limit this? Having this value 0 is a security enforcement. If you don\u0027t put this line in the haproxy configuration, it is saying \"any status\"","commit_id":"e86761a4c550de2bfa91f7fa46cae833b0b16580"}],"octavia/common/validate.py":[{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"aa93664a63a5e8a6694cb0f5ee8ea876cb6cbf07","unresolved":false,"context_lines":[{"line_number":220,"context_line":"            # log or raise key and value must be specified."},{"line_number":221,"context_line":"            msg \u003d \u0027L7rule type {0} needs to specify a key.\u0027.format("},{"line_number":222,"context_line":"                rule_type)"},{"line_number":223,"context_line":"        elif \u0027-\u0027 not in req_key:"},{"line_number":224,"context_line":"            # log or raise the key must be splited by \u0027-\u0027"},{"line_number":225,"context_line":"            if req_key.upper() not in constants.SUPPORTED_DN_FIELDS:"},{"line_number":226,"context_line":"                msg \u003d ("}],"source_content_type":"text/x-python","patch_set":7,"id":"9fdfeff1_93bd0a04","line":223,"updated":"2019-02-22 01:47:16.000000000","message":"The problem here is a hyphen is a valid character for DN attribute per RFC 4514 and 4512.\nThis seems a bit proprietary for HAProxy as well.\nI think we should do simple DN attribute selection here and come back to add advanced selection if/when it is needed.","commit_id":"e86761a4c550de2bfa91f7fa46cae833b0b16580"}]}