Jeff Mitchell
58a448fc6a
This allows us to use SNI for actual host (e.g. routing) information. We don't have the client cert yet so we can't look at that, so this provides a way for us to convey the information needed to look up that session's TLS stack. Using SNI for hosts means we also run into the fact that we don't have automatic agreement in terms of SANs. So when generating the certs we now also pass worker address information to the function to be encoded in the cert. Finally, there is a change in how the websocket dialing happens, because http.RoundTripper tries to be too clever for its own good and overwrites NextProtos on a whim.
39 lines
1.1 KiB
Go
39 lines
1.1 KiB
Go
package globals
|
|
|
|
import "time"
|
|
|
|
const (
|
|
TcpProxyV1 = "boundary-tcp-proxy-v1"
|
|
ServiceTokenV1 = "s1"
|
|
SessionPrefix = "s_"
|
|
)
|
|
|
|
type (
|
|
ContextMaxRequestSizeType struct{}
|
|
ContextOriginalRequestPathType struct{}
|
|
)
|
|
|
|
var (
|
|
// DefaultMaxRequestDuration is the amount of time we'll wait for a request
|
|
DefaultMaxRequestDuration = 90 * time.Second
|
|
|
|
// DefaultMaxRequestSize is the maximum size of a request we allow by default
|
|
DefaultMaxRequestSize = int64(1024 * 1024)
|
|
|
|
// ContextMaxRequestSizeTypeKey is a value to keep linters from complaining
|
|
// about clashing string identifiers
|
|
ContextMaxRequestSizeTypeKey ContextMaxRequestSizeType
|
|
|
|
// ContextOriginalRequestPathTypeKey is a value to keep linters from complaining
|
|
// about clashing string identifiers
|
|
ContextOriginalRequestPathTypeKey ContextOriginalRequestPathType
|
|
|
|
// RecoveryTokenValidityPeriod is exported so we can modify it in tests if
|
|
// we want
|
|
RecoveryTokenValidityPeriod = 5 * time.Minute
|
|
|
|
// WorkerAuthNonceValidityPeriod is exported so we can modify it in tests if
|
|
// we want
|
|
WorkerAuthNonceValidityPeriod = 2 * time.Minute
|
|
)
|