Skip to content

Commit 5a6ecd9

Browse files
committed
feat(dgw): emit a warning alert when TLS is not configured and credentials are pushed
For instance, proxy-based credentials injection for RDP requires a TLS certificate and private key to be configured.
1 parent e6be3d0 commit 5a6ecd9

File tree

2 files changed

+16
-3
lines changed

2 files changed

+16
-3
lines changed

devolutions-gateway/src/api/preflight.rs

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,8 @@ pub(crate) enum PreflightAlertStatus {
124124
GeneralFailure,
125125
#[serde(rename = "info")]
126126
Info,
127+
#[serde(rename = "warn")]
128+
Warn,
127129
#[serde(rename = "unsupported-operation")]
128130
UnsupportedOperation,
129131
#[serde(rename = "invalid-parameters")]
@@ -340,6 +342,17 @@ async fn handle_operation(
340342
});
341343
}
342344

345+
if conf.tls.is_none() && operation.kind.as_str() == OP_PROVISION_CREDENTIALS {
346+
outputs.push(PreflightOutput {
347+
operation_id: operation.id,
348+
kind: PreflightOutputKind::Alert {
349+
status: PreflightAlertStatus::Warn,
350+
message: "no TLS certificate configured, this may cause problems with credentials injection"
351+
.to_owned(),
352+
},
353+
});
354+
}
355+
343356
outputs.push(PreflightOutput {
344357
operation_id: operation.id,
345358
kind: PreflightOutputKind::Ack,

devolutions-gateway/tests/preflight.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,9 @@ async fn test_provision_credentials_success() -> anyhow::Result<()> {
8787

8888
let body = response.into_body().collect().await?.to_bytes();
8989
let body: serde_json::Value = serde_json::from_slice(&body)?;
90-
assert_eq!(body.as_array().expect("an array").len(), 1);
91-
assert_eq!(body[0]["operation_id"], op_id.to_string());
92-
assert_eq!(body[0]["kind"], "ack", "{:?}", body[0]);
90+
assert_eq!(body.as_array().expect("an array").len(), 2);
91+
assert_eq!(body[1]["operation_id"], op_id.to_string());
92+
assert_eq!(body[1]["kind"], "ack", "{:?}", body[1]);
9393

9494
let entry = state.credential_store.get(token_id).expect("the provisioned entry");
9595
assert_eq!(entry.token, token);

0 commit comments

Comments
 (0)