From 9eb98dd27638fa281c52f4c950cf371f6cd9fcb2 Mon Sep 17 00:00:00 2001 From: = Date: Mon, 2 Jun 2025 15:40:13 +0530 Subject: [PATCH 1/3] feat: resolved gateway verify issue and validation check --- backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts | 2 ++ backend/src/lib/gateway/index.ts | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts index f653d0c0c..34e89cd28 100644 --- a/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts +++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts @@ -11,6 +11,8 @@ export const verifyHostInputValidity = async (host: string, isGateway = false) = if (appCfg.isDevelopmentMode) return [host]; + if (isGateway) return [host]; + const reservedHosts = [appCfg.DB_HOST || getDbConnectionHost(appCfg.DB_CONNECTION_URI)].concat( (appCfg.DB_READ_REPLICAS || []).map((el) => getDbConnectionHost(el.DB_CONNECTION_URI)), getDbConnectionHost(appCfg.REDIS_URL), diff --git a/backend/src/lib/gateway/index.ts b/backend/src/lib/gateway/index.ts index c1a8b48c6..4d6401eac 100644 --- a/backend/src/lib/gateway/index.ts +++ b/backend/src/lib/gateway/index.ts @@ -44,7 +44,7 @@ const createQuicConnection = async ( if (!certs || certs.length === 0) return quic.native.CryptoError.CertificateRequired; const serverCertificate = new crypto.X509Certificate(Buffer.from(certs[0])); const caCertificate = new crypto.X509Certificate(tlsOptions.ca); - const isValidServerCertificate = serverCertificate.checkIssued(caCertificate); + const isValidServerCertificate = serverCertificate.verify(caCertificate.publicKey); if (!isValidServerCertificate) return quic.native.CryptoError.BadCertificate; const subjectDetails = parseSubjectDetails(serverCertificate.subject); From a701635f084ca50542cc47133ca452c21b3678d8 Mon Sep 17 00:00:00 2001 From: = Date: Mon, 2 Jun 2025 16:23:10 +0530 Subject: [PATCH 2/3] feat: remove gateway condition --- backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts index 34e89cd28..3b405a418 100644 --- a/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts +++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts @@ -60,7 +60,7 @@ export const verifyHostInputValidity = async (host: string, isGateway = false) = } } - if (!isGateway && !(appCfg.DYNAMIC_SECRET_ALLOW_INTERNAL_IP || appCfg.ALLOW_INTERNAL_IP_CONNECTIONS)) { + if (!(appCfg.DYNAMIC_SECRET_ALLOW_INTERNAL_IP || appCfg.ALLOW_INTERNAL_IP_CONNECTIONS)) { const isInternalIp = inputHostIps.some((el) => isPrivateIp(el)); if (isInternalIp) throw new BadRequestError({ message: "Invalid db host" }); } From 16e0aa13c827ea61f4373f04031a118d9e38dbf1 Mon Sep 17 00:00:00 2001 From: = Date: Mon, 2 Jun 2025 19:18:04 +0530 Subject: [PATCH 3/3] feat: fixed type error --- backend/src/ee/services/dynamic-secret/providers/kubernetes.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts b/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts index 20ac8877f..8a54ba089 100644 --- a/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts +++ b/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts @@ -116,7 +116,7 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO): } }; - const create = async (inputs: unknown, expireAt: number) => { + const create = async ({ inputs, expireAt }: { inputs: unknown; expireAt: number }) => { const providerInputs = await validateProviderInputs(inputs); const tokenRequestCallback = async (host: string, port: number) => {