093f9da · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Move cipher creation to options and away from oauth2_proxy.go

commit093f9da881e8c3974b2df9b69dbbc1f75e03083f authorJoel Speed <Joel.speed@hotmail.co.uk> dateWed 15 May 2019, 16:56 (7 years ago) parent76bd237

7 files changed+30−52

compare with master

unifiedsplit

oauthproxy.go−11 oauthproxy_test.go+2−2 options.go+9−3 pkg/apis/options/sessions.go+7−5 pkg/sessions/cookie/session_store.go+2−11 pkg/sessions/session_store.go+1−3 pkg/sessions/session_store_test.go+9−17

oauthproxy.go−11

@@ -85,7 +85,6 @@ type OAuthProxy struct {

8585 PassAccessToken bool

8686 SetAuthorization bool

8787 PassAuthorization bool

88− CookieCipher *cookie.Cipher

8988 skipAuthRegex []string

9089 skipAuthPreflight bool

9190 compiledRegex []*regexp.Regexp

@@ -215,15 +214,6 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

215214

216215 logger.Printf("Cookie settings: name:%s secure(https):%v httponly:%v expiry:%s domain:%s path:%s refresh:%s", opts.CookieName, opts.CookieSecure, opts.CookieHTTPOnly, opts.CookieExpire, opts.CookieDomain, opts.CookiePath, refresh)

217216

218− var cipher *cookie.Cipher

219− if opts.PassAccessToken || opts.SetAuthorization || opts.PassAuthorization || (opts.CookieRefresh != time.Duration(0)) {

220− var err error

221− cipher, err = cookie.NewCipher(secretBytes(opts.CookieSecret))

222− if err != nil {

223− logger.Fatal("cookie-secret error: ", err)

224− }

225− }

226−

227217 return &OAuthProxy{

228218 CookieName: opts.CookieName,

229219 CSRFCookieName: fmt.Sprintf("%v_%v", opts.CookieName, "csrf"),

@@ -261,7 +251,6 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

261251 SetAuthorization: opts.SetAuthorization,

262252 PassAuthorization: opts.PassAuthorization,

263253 SkipProviderButton: opts.SkipProviderButton,

264− CookieCipher: cipher,

265254 templates: loadTemplates(opts.CustomTemplatesDir),

266255 Footer: opts.Footer,

267256 }

oauthproxy_test.go+2−2

@@ -1083,7 +1083,7 @@ func TestClearSplitCookie(t *testing.T) {

10831083 opts := NewOptions()

10841084 opts.CookieName = "oauth2"

10851085 opts.CookieDomain = "abc"

1086− store, err := cookie.NewCookieSessionStore(opts.SessionOptions.CookieStoreOptions, &opts.CookieOptions)

1086+ store, err := cookie.NewCookieSessionStore(&opts.SessionOptions, &opts.CookieOptions)

10871087 assert.Equal(t, err, nil)

10881088 p := OAuthProxy{CookieName: opts.CookieName, CookieDomain: opts.CookieDomain, sessionStore: store}

10891089 var rw = httptest.NewRecorder()

@@ -1112,7 +1112,7 @@ func TestClearSingleCookie(t *testing.T) {

11121112 opts := NewOptions()

11131113 opts.CookieName = "oauth2"

11141114 opts.CookieDomain = "abc"

1115− store, err := cookie.NewCookieSessionStore(opts.SessionOptions.CookieStoreOptions, &opts.CookieOptions)

1115+ store, err := cookie.NewCookieSessionStore(&opts.SessionOptions, &opts.CookieOptions)

11161116 assert.Equal(t, err, nil)

11171117 p := OAuthProxy{CookieName: opts.CookieName, CookieDomain: opts.CookieDomain, sessionStore: store}

11181118 var rw = httptest.NewRecorder()

options.go+9−3

@@ -17,6 +17,7 @@ import (

1717 oidc "github.com/coreos/go-oidc"

1818 "github.com/dgrijalva/jwt-go"

1919 "github.com/mbland/hmacauth"

20+ "github.com/pusher/oauth2_proxy/cookie"

2021 "github.com/pusher/oauth2_proxy/logger"

2122 "github.com/pusher/oauth2_proxy/pkg/apis/options"

2223 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

@@ -267,7 +268,8 @@ func (o *Options) Validate() error {

267268 }

268269 msgs = parseProviderInfo(o, msgs)

269270

270− if o.PassAccessToken || (o.CookieRefresh != time.Duration(0)) {

271+ var cipher *cookie.Cipher

272+ if o.PassAccessToken || o.SetAuthorization || o.PassAuthorization || (o.CookieRefresh != time.Duration(0)) {

271273 validCookieSecretSize := false

272274 for _, i := range []int{16, 24, 32} {

273275 if len(secretBytes(o.CookieSecret)) == i {

@@ -290,11 +292,15 @@ func (o *Options) Validate() error {

290292 "cookie_refresh != 0, but is %d bytes.%s",

291293 len(secretBytes(o.CookieSecret)), suffix))

292294 } else {

293− // Enable encryption in the session store

294− o.EnableCipher = true

295+ var err error

296+ cipher, err = cookie.NewCipher(secretBytes(o.CookieSecret))

297+ if err != nil {

298+ msgs = append(msgs, fmt.Sprintf("cookie-secret error: %v", err))

299+ }

295300 }

296301 }

297302

303+ o.SessionOptions.Cipher = cipher

298304 sessionStore, err := sessions.NewSessionStore(&o.SessionOptions, &o.CookieOptions)

299305 if err != nil {

300306 msgs = append(msgs, fmt.Sprintf("error initialising session storage: %v", err))

pkg/apis/options/sessions.go+7−5

@@ -1,9 +1,13 @@

11package options

3+import (

4+ "github.com/pusher/oauth2_proxy/cookie"

5+)

37// SessionOptions contains configuration options for the SessionStore providers.

48type SessionOptions struct {

5− Type string `flag:"session-store-type" cfg:"session_store_type" env:"OAUTH2_PROXY_SESSION_STORE_TYPE"`

6− EnableCipher bool // Allow the user to choose encryption or not

9+ Type string `flag:"session-store-type" cfg:"session_store_type" env:"OAUTH2_PROXY_SESSION_STORE_TYPE"`

10+ Cipher *cookie.Cipher

711 CookieStoreOptions

812}

913

@@ -12,6 +16,4 @@ type SessionOptions struct {

1216var CookieSessionStoreType = "cookie"

1317

1418// CookieStoreOptions contains configuration options for the CookieSessionStore.

15−type CookieStoreOptions struct {

16− EnableCipher bool // Allow the user to choose encryption or not

17−}

19+type CookieStoreOptions struct{}

pkg/sessions/cookie/session_store.go+2−11

@@ -118,18 +118,9 @@ func (s *SessionStore) makeCookie(req *http.Request, name string, value string,

118118

119119// NewCookieSessionStore initialises a new instance of the SessionStore from

120120// the configuration given

121−func NewCookieSessionStore(opts options.CookieStoreOptions, cookieOpts *options.CookieOptions) (sessions.SessionStore, error) {

122− var cipher *cookie.Cipher

123− if opts.EnableCipher {

124− var err error

125− cipher, err = cookie.NewCipher(utils.SecretBytes(cookieOpts.CookieSecret))

126− if err != nil {

127− return nil, fmt.Errorf("unable to create cipher: %v", err)

128− }

129− }

130−

121+func NewCookieSessionStore(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessions.SessionStore, error) {

131122 return &SessionStore{

132− CookieCipher: cipher,

123+ CookieCipher: opts.Cipher,

133124 CookieOptions: cookieOpts,

134125 }, nil

135126}

pkg/sessions/session_store.go+1−3

@@ -12,9 +12,7 @@ import (

1212func NewSessionStore(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessions.SessionStore, error) {

1313 switch opts.Type {

1414 case options.CookieSessionStoreType:

15− // Ensure EnableCipher is propogated from the parent option

16− opts.CookieStoreOptions.EnableCipher = opts.EnableCipher

17− return cookie.NewCookieSessionStore(opts.CookieStoreOptions, cookieOpts)

15+ return cookie.NewCookieSessionStore(opts, cookieOpts)

1816 default:

1917 return nil, fmt.Errorf("unknown session store type '%s'", opts.Type)

2018 }

pkg/sessions/session_store_test.go+9−17

@@ -12,11 +12,13 @@ import (

1212

1313 . "github.com/onsi/ginkgo"

1414 . "github.com/onsi/gomega"

15+ "github.com/pusher/oauth2_proxy/cookie"

1516 "github.com/pusher/oauth2_proxy/pkg/apis/options"

1617 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1718 "github.com/pusher/oauth2_proxy/pkg/cookies"

1819 "github.com/pusher/oauth2_proxy/pkg/sessions"

19− "github.com/pusher/oauth2_proxy/pkg/sessions/cookie"

20+ sessionscookie "github.com/pusher/oauth2_proxy/pkg/sessions/cookie"

21+ "github.com/pusher/oauth2_proxy/pkg/sessions/utils"

2022)

2123

2224func TestSessionStore(t *testing.T) {

@@ -200,13 +202,16 @@ var _ = Describe("NewSessionStore", func() {

200202 SessionStoreInterfaceTests()

201203 })

202204

203− Context("with encryption enabled", func() {

205+ Context("with a cipher", func() {

204206 BeforeEach(func() {

205207 secret := make([]byte, 32)

206208 _, err := rand.Read(secret)

207209 Expect(err).ToNot(HaveOccurred())

208210 cookieOpts.CookieSecret = base64.URLEncoding.EncodeToString(secret)

209− opts.EnableCipher = true

211+ cipher, err := cookie.NewCipher(utils.SecretBytes(cookieOpts.CookieSecret))

212+ Expect(err).ToNot(HaveOccurred())

213+ Expect(cipher).ToNot(BeNil())

214+ opts.Cipher = cipher

210215

211216 ss, err = sessions.NewSessionStore(opts, cookieOpts)

212217 Expect(err).ToNot(HaveOccurred())

@@ -214,19 +219,6 @@ var _ = Describe("NewSessionStore", func() {

214219

215220 SessionStoreInterfaceTests()

216221 })

217−

218− Context("with encryption enabled, but no secret", func() {

219− BeforeEach(func() {

220− opts.EnableCipher = true

221− })

222−

223− It("returns an error", func() {

224− ss, err := sessions.NewSessionStore(opts, cookieOpts)

225− Expect(err).To(HaveOccurred())

226− Expect(err.Error()).To(Equal("unable to create cipher: crypto/aes: invalid key size 0"))

227− Expect(ss).To(BeNil())

228− })

229− })

230222 }

231223

232224 BeforeEach(func() {

@@ -264,7 +256,7 @@ var _ = Describe("NewSessionStore", func() {

264256 It("creates a cookie.SessionStore", func() {

265257 ss, err := sessions.NewSessionStore(opts, cookieOpts)

266258 Expect(err).NotTo(HaveOccurred())

267− Expect(ss).To(BeAssignableToTypeOf(&cookie.SessionStore{}))

259+ Expect(ss).To(BeAssignableToTypeOf(&sessionscookie.SessionStore{}))

268260 })

269261

270262 Context("the cookie.SessionStore", func() {