From 9a5a072fc4fa2d1d7b52f5b6ca774c70962f98aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20=C4=8Cajka?= <jcajka@redhat.com>
Date: Sun, 20 Jan 2019 20:32:50 +0100
Subject: [PATCH] Initial commit

---
 Dockerfile           | 33 ++++++++++++++++
 egress-http-proxy.sh | 93 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 126 insertions(+)
 create mode 100644 Dockerfile
 create mode 100755 egress-http-proxy.sh

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..d08fff7
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,33 @@
+#
+# This is the egress router HTTP proxy for OpenShift Origin
+#
+# The standard name for this image is openshift/origin-egress-http-proxy
+#
+FROM registry.fedoraproject.org/f29/origin-base:latest
+
+ENV NAME=origin-egress-http-proxy \
+    VERSION=3.11 \
+    ARCH=x86_64
+
+RUN INSTALL_PKGS="squid" && \
+    dnf install -y $INSTALL_PKGS && \
+    rpm -V $INSTALL_PKGS && \
+    dnf clean all && \
+    rmdir /var/log/squid /var/spool/squid && \
+    rm -f /etc/squid/squid.conf
+
+LABEL io.k8s.display-name="OpenShift Origin HTTP proxy egress router" \
+      io.k8s.description="This is the egress router HTTP proxy for OpenShift Origin" \
+      io.openshift.tags="openshift,router,egress,http" \
+      summary="This is the egress router HTTP proxy for OpenShift Origin" \
+      maintainer="Jakub Cajka <jcajka@fedoraproject.org>" \
+      License="GPLv2+" \
+      name="$FGC/$NAME" \
+      com.redhat.component="$NAME" \
+      version="$VERSION" \
+      architecture="$ARCH" \
+      usage="This is the egress router HTTP proxy for OpenShift Origin"
+
+ADD egress-http-proxy.sh /bin/egress-http-proxy.sh
+
+ENTRYPOINT /bin/egress-http-proxy.sh
diff --git a/egress-http-proxy.sh b/egress-http-proxy.sh
new file mode 100755
index 0000000..fa4b832
--- /dev/null
+++ b/egress-http-proxy.sh
@@ -0,0 +1,93 @@
+#!/bin/bash
+
+# OpenShift egress HTTP proxy setup script
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+function die() {
+    echo "$*" 1>&2
+    exit 1
+}
+
+if [[ -z "${EGRESS_HTTP_PROXY_DESTINATION}" ]]; then
+    die "No EGRESS_HTTP_PROXY_DESTINATION specified"
+fi
+
+IPADDR_REGEX="[[:xdigit:].:]*[.:][[:xdigit:].:]+"
+OPT_CIDR_MASK_REGEX="(/[[:digit:]]+)?"
+HOSTNAME_REGEX="[[:alnum:]][[:alnum:].-]+"
+DOMAIN_REGEX="\*\.${HOSTNAME_REGEX}"
+
+function generate_acls() {
+    n=0
+    saw_wildcard=
+    while read dest; do
+	if [[ "${dest}" =~ ^\w*$ || "${dest}" =~ ^# ]]; then
+	    # comment or blank line
+	    continue
+	fi
+	n=$(($n + 1))
+
+	if [[ "${dest}" == "*" ]]; then
+	    saw_wildcard=1
+	    continue
+	elif [[ -n "${saw_wildcard}" ]]; then
+	    die "Wildcard must be last rule, if present"
+	fi
+
+	if [[ "${dest}" =~ ^! ]]; then
+	    rule=deny
+	    dest="${dest#!}"
+	else
+	    rule=allow
+	fi
+
+	echo ""
+	if [[ "${dest}" =~ ^${IPADDR_REGEX}${OPT_CIDR_MASK_REGEX}$ ]]; then
+	    echo acl dest$n dst "${dest}"
+	    echo http_access "${rule}" dest$n
+	elif [[ "${dest}" =~ ^${DOMAIN_REGEX}$ ]]; then
+	    echo acl dest$n dstdomain "${dest#\*}"
+	    echo http_access "${rule}" dest$n
+	elif [[ "${dest}" =~ ^${HOSTNAME_REGEX}$ ]]; then
+	    echo acl dest$n dstdomain "${dest}"
+	    echo http_access "${rule}" dest$n
+	else
+	    die "Bad destination '${dest}'"
+	fi
+    done <<< "${EGRESS_HTTP_PROXY_DESTINATION}"
+
+    echo ""
+    if [[ -n "${saw_wildcard}" ]]; then
+	echo "http_access allow all"
+    else
+	echo "http_access deny all"
+    fi
+}
+
+if [[ "${EGRESS_HTTP_PROXY_MODE:-}" == "unit-test" ]]; then
+    generate_acls
+    exit 0
+fi
+
+CONF=/etc/squid/squid.conf
+rm -f ${CONF}
+
+cat > ${CONF} <<EOF
+http_port 8080
+cache deny all
+access_log none all
+debug_options ALL,0
+shutdown_lifetime 0
+EOF
+
+generate_acls >> ${CONF}
+
+echo "Running squid with config:"
+sed -e 's/^/  /' ${CONF}
+echo ""
+echo ""
+
+exec squid -N