git.iko.soy/typeable/oauth2-proxy
on f820deb help sign in
typeable/oauth2-proxy/pkg/http/server.go
256 lines 6.9 kB history raw
1package http
3import (
4 "context"
5 "crypto/tls"
6 "errors"
7 "fmt"
8 "net"
9 "net/http"
10 "strings"
11 "time"
13 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
14 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options/util"
15 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
16 "golang.org/x/sync/errgroup"
19// Server represents an HTTP or HTTPS server.
20type Server interface {
21 // Start blocks and runs the server.
22 Start(ctx context.Context) error
25// Opts contains the information required to set up the server.
26type Opts struct {
27 // Handler is the http.Handler to be used to serve http pages by the server.
28 Handler http.Handler
30 // BindAddress is the address the HTTP server should listen on.
31 BindAddress string
33 // SecureBindAddress is the address the HTTPS server should listen on.
34 SecureBindAddress string
36 // TLS is the TLS configuration for the server.
37 TLS *options.TLS
40// NewServer creates a new Server from the options given.
41func NewServer(opts Opts) (Server, error) {
42 s := &server{
43 handler: opts.Handler,
44 }
45 if err := s.setupListener(opts); err != nil {
46 return nil, fmt.Errorf("error setting up listener: %v", err)
47 }
48 if err := s.setupTLSListener(opts); err != nil {
49 return nil, fmt.Errorf("error setting up TLS listener: %v", err)
50 }
52 return s, nil
55// server is an implementation of the Server interface.
56type server struct {
57 handler http.Handler
59 listener net.Listener
60 tlsListener net.Listener
63// setupListener sets the server listener if the HTTP server is enabled.
64// The HTTP server can be disabled by setting the BindAddress to "-" or by
65// leaving it empty.
66func (s *server) setupListener(opts Opts) error {
67 if opts.BindAddress == "" || opts.BindAddress == "-" {
68 // No HTTP listener required
69 return nil
70 }
72 networkType := getNetworkScheme(opts.BindAddress)
73 listenAddr := getListenAddress(opts.BindAddress)
75 listener, err := net.Listen(networkType, listenAddr)
76 if err != nil {
77 return fmt.Errorf("listen (%s, %s) failed: %v", networkType, listenAddr, err)
78 }
79 s.listener = listener
81 return nil
84// setupTLSListener sets the server TLS listener if the HTTPS server is enabled.
85// The HTTPS server can be disabled by setting the SecureBindAddress to "-" or by
86// leaving it empty.
87func (s *server) setupTLSListener(opts Opts) error {
88 if opts.SecureBindAddress == "" || opts.SecureBindAddress == "-" {
89 // No HTTPS listener required
90 return nil
91 }
93 config := &tls.Config{
94 MinVersion: tls.VersionTLS12, // default, override below
95 MaxVersion: tls.VersionTLS13,
96 NextProtos: []string{"http/1.1"},
97 }
98 if opts.TLS == nil {
99 return errors.New("no TLS config provided")
100 }
101 cert, err := getCertificate(opts.TLS)
102 if err != nil {
103 return fmt.Errorf("could not load certificate: %v", err)
104 }
105 config.Certificates = []tls.Certificate{cert}
107 if len(opts.TLS.MinVersion) > 0 {
108 switch opts.TLS.MinVersion {
109 case "TLS1.2":
110 config.MinVersion = tls.VersionTLS12
111 case "TLS1.3":
112 config.MinVersion = tls.VersionTLS13
113 default:
114 return errors.New("unknown TLS MinVersion config provided")
115 }
116 }
118 listenAddr := getListenAddress(opts.SecureBindAddress)
120 listener, err := net.Listen("tcp", listenAddr)
121 if err != nil {
122 return fmt.Errorf("listen (%s) failed: %v", listenAddr, err)
123 }
125 s.tlsListener = tls.NewListener(tcpKeepAliveListener{listener.(*net.TCPListener)}, config)
126 return nil
129// Start starts the HTTP and HTTPS server if applicable.
130// It will block until the context is cancelled.
131// If any errors occur, only the first error will be returned.
132func (s *server) Start(ctx context.Context) error {
133 g, groupCtx := errgroup.WithContext(ctx)
135 if s.listener != nil {
136 g.Go(func() error {
137 if err := s.startServer(groupCtx, s.listener); err != nil {
138 return fmt.Errorf("error starting insecure server: %v", err)
139 }
140 return nil
141 })
142 }
144 if s.tlsListener != nil {
145 g.Go(func() error {
146 if err := s.startServer(groupCtx, s.tlsListener); err != nil {
147 return fmt.Errorf("error starting secure server: %v", err)
148 }
149 return nil
150 })
151 }
153 return g.Wait()
156// startServer creates and starts a new server with the given listener.
157// When the given context is cancelled the server will be shutdown.
158// If any errors occur, only the first error will be returned.
159func (s *server) startServer(ctx context.Context, listener net.Listener) error {
160 srv := &http.Server{Handler: s.handler}
161 g, groupCtx := errgroup.WithContext(ctx)
163 g.Go(func() error {
164 <-groupCtx.Done()
166 if err := srv.Shutdown(context.Background()); err != nil {
167 return fmt.Errorf("error shutting down server: %v", err)
168 }
169 return nil
170 })
172 g.Go(func() error {
173 if err := srv.Serve(listener); err != nil && !errors.Is(err, http.ErrServerClosed) {
174 return fmt.Errorf("could not start server: %v", err)
175 }
176 return nil
177 })
179 return g.Wait()
182// getNetworkScheme gets the scheme for the HTTP server.
183func getNetworkScheme(addr string) string {
184 var scheme string
185 i := strings.Index(addr, "://")
186 if i > -1 {
187 scheme = addr[0:i]
188 }
190 switch scheme {
191 case "", "http":
192 return "tcp"
193 default:
194 return scheme
195 }
198// getListenAddress gets the address for the HTTP server.
199func getListenAddress(addr string) string {
200 slice := strings.SplitN(addr, "//", 2)
201 return slice[len(slice)-1]
204// getCertificate loads the certificate data from the TLS config.
205func getCertificate(opts *options.TLS) (tls.Certificate, error) {
206 keyData, err := getSecretValue(opts.Key)
207 if err != nil {
208 return tls.Certificate{}, fmt.Errorf("could not load key data: %v", err)
209 }
211 certData, err := getSecretValue(opts.Cert)
212 if err != nil {
213 return tls.Certificate{}, fmt.Errorf("could not load cert data: %v", err)
214 }
216 cert, err := tls.X509KeyPair(certData, keyData)
217 if err != nil {
218 return tls.Certificate{}, fmt.Errorf("could not parse certificate data: %v", err)
219 }
221 return cert, nil
224// getSecretValue wraps util.GetSecretValue so that we can return an error if no
225// source is provided.
226func getSecretValue(src *options.SecretSource) ([]byte, error) {
227 if src == nil {
228 return nil, errors.New("no configuration provided")
229 }
230 return util.GetSecretValue(src)
233// tcpKeepAliveListener sets TCP keep-alive timeouts on accepted
234// connections. It's used by so that dead TCP connections (e.g. closing laptop
235// mid-download) eventually go away.
236type tcpKeepAliveListener struct {
237 *net.TCPListener
240// Accept implements the TCPListener interface.
241// It sets the keep alive period to 3 minutes for each connection.
242func (ln tcpKeepAliveListener) Accept() (net.Conn, error) {
243 tc, err := ln.AcceptTCP()
244 if err != nil {
245 return nil, err
246 }
247 err = tc.SetKeepAlive(true)
248 if err != nil {
249 logger.Errorf("Error setting Keep-Alive: %v", err)
250 }
251 err = tc.SetKeepAlivePeriod(3 * time.Minute)
252 if err != nil {
253 logger.Printf("Error setting Keep-Alive period: %v", err)
254 }
255 return tc, nil