git.iko.soy/typeable/oauth2-proxy
on 4ee3f13 help sign in
typeable/oauth2-proxy/pkg/http/server.go
245 lines 6.6 kB history raw
1package http
3import (
4 "context"
5 "crypto/tls"
6 "errors"
7 "fmt"
8 "net"
9 "net/http"
10 "strings"
11 "time"
13 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
14 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options/util"
15 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
16 "golang.org/x/sync/errgroup"
19// Server represents an HTTP or HTTPS server.
20type Server interface {
21 // Start blocks and runs the server.
22 Start(ctx context.Context) error
25// Opts contains the information required to set up the server.
26type Opts struct {
27 // Handler is the http.Handler to be used to serve http pages by the server.
28 Handler http.Handler
30 // BindAddress is the address the HTTP server should listen on.
31 BindAddress string
33 // SecureBindAddress is the address the HTTPS server should listen on.
34 SecureBindAddress string
36 // TLS is the TLS configuration for the server.
37 TLS *options.TLS
40// NewServer creates a new Server from the options given.
41func NewServer(opts Opts) (Server, error) {
42 s := &server{
43 handler: opts.Handler,
44 }
45 if err := s.setupListener(opts); err != nil {
46 return nil, fmt.Errorf("error setting up listener: %v", err)
47 }
48 if err := s.setupTLSListener(opts); err != nil {
49 return nil, fmt.Errorf("error setting up TLS listener: %v", err)
50 }
52 return s, nil
55// server is an implementation of the Server interface.
56type server struct {
57 handler http.Handler
59 listener net.Listener
60 tlsListener net.Listener
63// setupListener sets the server listener if the HTTP server is enabled.
64// The HTTP server can be disabled by setting the BindAddress to "-" or by
65// leaving it empty.
66func (s *server) setupListener(opts Opts) error {
67 if opts.BindAddress == "" || opts.BindAddress == "-" {
68 // No HTTP listener required
69 return nil
70 }
72 networkType := getNetworkScheme(opts.BindAddress)
73 listenAddr := getListenAddress(opts.BindAddress)
75 listener, err := net.Listen(networkType, listenAddr)
76 if err != nil {
77 return fmt.Errorf("listen (%s, %s) failed: %v", networkType, listenAddr, err)
78 }
79 s.listener = listener
81 return nil
84// setupTLSListener sets the server TLS listener if the HTTPS server is enabled.
85// The HTTPS server can be disabled by setting the SecureBindAddress to "-" or by
86// leaving it empty.
87func (s *server) setupTLSListener(opts Opts) error {
88 if opts.SecureBindAddress == "" || opts.SecureBindAddress == "-" {
89 // No HTTPS listener required
90 return nil
91 }
93 config := &tls.Config{
94 MinVersion: tls.VersionTLS12,
95 MaxVersion: tls.VersionTLS13,
96 NextProtos: []string{"http/1.1"},
97 }
98 if opts.TLS == nil {
99 return errors.New("no TLS config provided")
100 }
101 cert, err := getCertificate(opts.TLS)
102 if err != nil {
103 return fmt.Errorf("could not load certificate: %v", err)
104 }
105 config.Certificates = []tls.Certificate{cert}
107 listenAddr := getListenAddress(opts.SecureBindAddress)
109 listener, err := net.Listen("tcp", listenAddr)
110 if err != nil {
111 return fmt.Errorf("listen (%s) failed: %v", listenAddr, err)
112 }
114 s.tlsListener = tls.NewListener(tcpKeepAliveListener{listener.(*net.TCPListener)}, config)
115 return nil
118// Start starts the HTTP and HTTPS server if applicable.
119// It will block until the context is cancelled.
120// If any errors occur, only the first error will be returned.
121func (s *server) Start(ctx context.Context) error {
122 g, groupCtx := errgroup.WithContext(ctx)
124 if s.listener != nil {
125 g.Go(func() error {
126 if err := s.startServer(groupCtx, s.listener); err != nil {
127 return fmt.Errorf("error starting insecure server: %v", err)
128 }
129 return nil
130 })
131 }
133 if s.tlsListener != nil {
134 g.Go(func() error {
135 if err := s.startServer(groupCtx, s.tlsListener); err != nil {
136 return fmt.Errorf("error starting secure server: %v", err)
137 }
138 return nil
139 })
140 }
142 return g.Wait()
145// startServer creates and starts a new server with the given listener.
146// When the given context is cancelled the server will be shutdown.
147// If any errors occur, only the first error will be returned.
148func (s *server) startServer(ctx context.Context, listener net.Listener) error {
149 srv := &http.Server{Handler: s.handler}
150 g, groupCtx := errgroup.WithContext(ctx)
152 g.Go(func() error {
153 <-groupCtx.Done()
155 if err := srv.Shutdown(context.Background()); err != nil {
156 return fmt.Errorf("error shutting down server: %v", err)
157 }
158 return nil
159 })
161 g.Go(func() error {
162 if err := srv.Serve(listener); err != nil && !errors.Is(err, http.ErrServerClosed) {
163 return fmt.Errorf("could not start server: %v", err)
164 }
165 return nil
166 })
168 return g.Wait()
171// getNetworkScheme gets the scheme for the HTTP server.
172func getNetworkScheme(addr string) string {
173 var scheme string
174 i := strings.Index(addr, "://")
175 if i > -1 {
176 scheme = addr[0:i]
177 }
179 switch scheme {
180 case "", "http":
181 return "tcp"
182 default:
183 return scheme
184 }
187// getListenAddress gets the address for the HTTP server.
188func getListenAddress(addr string) string {
189 slice := strings.SplitN(addr, "//", 2)
190 return slice[len(slice)-1]
193// getCertificate loads the certificate data from the TLS config.
194func getCertificate(opts *options.TLS) (tls.Certificate, error) {
195 keyData, err := getSecretValue(opts.Key)
196 if err != nil {
197 return tls.Certificate{}, fmt.Errorf("could not load key data: %v", err)
198 }
200 certData, err := getSecretValue(opts.Cert)
201 if err != nil {
202 return tls.Certificate{}, fmt.Errorf("could not load cert data: %v", err)
203 }
205 cert, err := tls.X509KeyPair(certData, keyData)
206 if err != nil {
207 return tls.Certificate{}, fmt.Errorf("could not parse certificate data: %v", err)
208 }
210 return cert, nil
213// getSecretValue wraps util.GetSecretValue so that we can return an error if no
214// source is provided.
215func getSecretValue(src *options.SecretSource) ([]byte, error) {
216 if src == nil {
217 return nil, errors.New("no configuration provided")
218 }
219 return util.GetSecretValue(src)
222// tcpKeepAliveListener sets TCP keep-alive timeouts on accepted
223// connections. It's used by so that dead TCP connections (e.g. closing laptop
224// mid-download) eventually go away.
225type tcpKeepAliveListener struct {
226 *net.TCPListener
229// Accept implements the TCPListener interface.
230// It sets the keep alive period to 3 minutes for each connection.
231func (ln tcpKeepAliveListener) Accept() (net.Conn, error) {
232 tc, err := ln.AcceptTCP()
233 if err != nil {
234 return nil, err
235 }
236 err = tc.SetKeepAlive(true)
237 if err != nil {
238 logger.Errorf("Error setting Keep-Alive: %v", err)
239 }
240 err = tc.SetKeepAlivePeriod(3 * time.Minute)
241 if err != nil {
242 logger.Printf("Error setting Keep-Alive period: %v", err)
243 }
244 return tc, nil