Skip to content

Commit d4d9a43

Browse files
TUN-6639: Validate cyclic ingress configuration
It is currently possible to set cloudflared to proxy to the hostname that traffic is ingressing from as an origin service. This change checks for this configuration error and prompts a change.
1 parent 046a30e commit d4d9a43

File tree

2 files changed

+14
-0
lines changed

2 files changed

+14
-0
lines changed

ingress/ingress.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -232,6 +232,10 @@ func validateIngress(ingress []config.UnvalidatedIngressRule, defaults OriginReq
232232
} else {
233233
service = newTCPOverWSService(u)
234234
}
235+
236+
if u.Hostname() == r.Hostname {
237+
return Ingress{}, fmt.Errorf("Cyclic Ingress configuration: Hostname:%s points to service:%s.", r.Hostname, r.Service)
238+
}
235239
}
236240

237241
if err := validateHostname(r, i, len(ingress)); err != nil {

ingress/ingress_test.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -404,6 +404,16 @@ ingress:
404404
service: https://localhost:8000
405405
- hostname: "*"
406406
service: https://localhost:8001
407+
`},
408+
wantErr: true,
409+
},
410+
{
411+
name: "Cyclic hostname definition",
412+
args: args{rawYAML: `
413+
ingress:
414+
- hostname: "test.example.com"
415+
service: https://test.example.com
416+
- service: http_status_404
407417
`},
408418
wantErr: true,
409419
},

0 commit comments

Comments
 (0)