git.iko.soy/typeable/oauth2-proxy
on master help sign in
typeable/oauth2-proxy/pkg/validation/upstreams.go
114 lines 4.2 kB history raw
1package validation
3import (
4 "fmt"
5 "net/url"
7 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
8 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
9)
11func validateUpstreams(upstreams options.UpstreamConfig) []string {
12 //nolint:prealloc
13 msgs := []string{}
14 ids := make(map[string]struct{})
15 paths := make(map[string]struct{})
17 for _, upstream := range upstreams.Upstreams {
18 msgs = append(msgs, validateUpstream(upstream, ids, paths)...)
19 }
21 return msgs
24// validateUpstream validates that the upstream has valid options and that
25// the ids and paths are unique across all options
26func validateUpstream(upstream options.Upstream, ids, paths map[string]struct{}) []string {
27 msgs := []string{}
29 if upstream.ID == "" {
30 msgs = append(msgs, "upstream has empty id: ids are required for all upstreams")
31 }
32 if upstream.Path == "" {
33 msgs = append(msgs, fmt.Sprintf("upstream %q has empty path: paths are required for all upstreams", upstream.ID))
34 }
36 // Ensure upstream IDs are unique
37 if _, ok := ids[upstream.ID]; ok {
38 msgs = append(msgs, fmt.Sprintf("multiple upstreams found with id %q: upstream ids must be unique", upstream.ID))
39 }
40 ids[upstream.ID] = struct{}{}
42 // Ensure upstream Paths are unique
43 if _, ok := paths[upstream.Path]; ok {
44 msgs = append(msgs, fmt.Sprintf("multiple upstreams found with path %q: upstream paths must be unique", upstream.Path))
45 }
46 paths[upstream.Path] = struct{}{}
48 msgs = append(msgs, validateUpstreamURI(upstream)...)
49 msgs = append(msgs, validateStaticUpstream(upstream)...)
50 return msgs
53// validateStaticUpstream checks that the StaticCode is only set when Static
54// is set, and that any options that do not make sense for a static upstream
55// are not set.
56func validateStaticUpstream(upstream options.Upstream) []string {
57 msgs := []string{}
59 if !ptr.Deref(upstream.Static, options.DefaultUpstreamStatic) && upstream.StaticCode != nil {
60 msgs = append(msgs, fmt.Sprintf("upstream %q has staticCode (%d), but is not a static upstream, set 'static' for a static response", upstream.ID, *upstream.StaticCode))
61 }
63 // Checks after this only make sense when the upstream is static
64 if !ptr.Deref(upstream.Static, options.DefaultUpstreamStatic) {
65 return msgs
66 }
68 if upstream.URI != "" {
69 msgs = append(msgs, fmt.Sprintf("upstream %q has uri, but is a static upstream, this will have no effect.", upstream.ID))
70 }
71 if ptr.Deref(upstream.InsecureSkipTLSVerify, options.DefaultUpsteamInsecureSkipTLSVerify) {
72 msgs = append(msgs, fmt.Sprintf("upstream %q has insecureSkipTLSVerify, but is a static upstream, this will have no effect.", upstream.ID))
73 }
74 if ptr.Deref(upstream.FlushInterval, options.DefaultUpstreamFlushInterval) != options.DefaultUpstreamFlushInterval {
75 msgs = append(msgs, fmt.Sprintf("upstream %q has flushInterval, but is a static upstream, this will have no effect.", upstream.ID))
76 }
77 if ptr.Deref(upstream.PassHostHeader, options.DefaultStaticPassHostHeader) != options.DefaultStaticPassHostHeader {
78 msgs = append(msgs, fmt.Sprintf("upstream %q has passHostHeader, but is a static upstream, this will have no effect.", upstream.ID))
79 }
80 if ptr.Deref(upstream.ProxyWebSockets, options.DefaultStaticProxyWebSockets) != options.DefaultStaticProxyWebSockets {
81 msgs = append(msgs, fmt.Sprintf("upstream %q has proxyWebSockets, but is a static upstream, this will have no effect.", upstream.ID))
82 }
84 return msgs
87func validateUpstreamURI(upstream options.Upstream) []string {
88 msgs := []string{}
90 if !ptr.Deref(upstream.Static, options.DefaultUpstreamStatic) && upstream.URI == "" {
91 msgs = append(msgs, fmt.Sprintf("upstream %q has empty uri: uris are required for all non-static upstreams", upstream.ID))
92 return msgs
93 }
95 // Checks after this only make sense the upstream is not static
96 if ptr.Deref(upstream.Static, options.DefaultUpstreamStatic) {
97 return msgs
98 }
100 u, err := url.Parse(upstream.URI)
101 if err != nil {
102 msgs = append(msgs, fmt.Sprintf("upstream %q has invalid uri: %v", upstream.ID, err))
103 return msgs
104 }
106 switch u.Scheme {
107 case "http", "https", "file", "unix":
108 // Valid, do nothing
109 default:
110 msgs = append(msgs, fmt.Sprintf("upstream %q has invalid scheme: %q", upstream.ID, u.Scheme))
111 }
113 return msgs