3045392 · typeable/oauth2-proxy

CHANGELOG.md+1

@@ -10,6 +10,7 @@

10

11- [#2539](https://github.com/oauth2-proxy/oauth2-proxy/pull/2539) pkg/http: Fix leaky test (@isodude)

12- [#4917](https://github.com/oauth2-proxy/oauth2-proxy/pull/4917) Upgraded all modules to the latest version (@pierluigilenoci)

13+- [#2570](https://github.com/oauth2-proxy/oauth2-proxy/pull/2570) Set default user agent to oauth2-proxy/$version (from default Golang one)

13

14

14# V7.6.0

15# V7.6.0

15

16

Makefile+1−1

@@ -40,7 +40,7 @@ lint: validate-go-version

40build: validate-go-version clean $(BINARY)

41

42$(BINARY):

43− CGO_ENABLED=0 $(GO) build -a -installsuffix cgo -ldflags="-X main.VERSION=${VERSION}" -o $@ github.com/oauth2-proxy/oauth2-proxy/v7

43+ CGO_ENABLED=0 $(GO) build -a -installsuffix cgo -ldflags="-X github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version.VERSION=${VERSION}" -o $@ github.com/oauth2-proxy/oauth2-proxy/v7

44

45DOCKER_BUILD_PLATFORM ?= linux/amd64,linux/arm64,linux/ppc64le,linux/arm/v7

46DOCKER_BUILD_RUNTIME_IMAGE ?= gcr.io/distroless/static:nonroot

dist.sh+4−2

@@ -32,10 +32,12 @@ for ARCH in "${ARCHS[@]}"; do

32 # Create architecture specific binaries

33 if [[ ${GO_ARCH} == armv* ]]; then

34 GO_ARM=$(echo $GO_ARCH | awk -Fv '{print $2}')

35− GO111MODULE=on GOOS=${GO_OS} GOARCH=arm GOARM=${GO_ARM} CGO_ENABLED=0 go build -ldflags="-X main.VERSION=${VERSION}" \

35+ GO111MODULE=on GOOS=${GO_OS} GOARCH=arm GOARM=${GO_ARM} CGO_ENABLED=0 go build \

36+ -ldflags="-X github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version.VERSION=${VERSION}" \

36 -o release/${BINARY}-${VERSION}.${ARCH}/${BINARY} .

37 -o release/${BINARY}-${VERSION}.${ARCH}/${BINARY} .

37 else

38 else

38− GO111MODULE=on GOOS=${GO_OS} GOARCH=${GO_ARCH} CGO_ENABLED=0 go build -ldflags="-X main.VERSION=${VERSION}" \

39+ GO111MODULE=on GOOS=${GO_OS} GOARCH=${GO_ARCH} CGO_ENABLED=0 go build \

40+ -ldflags="-X github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version.VERSION=${VERSION}" \

39 -o release/${BINARY}-${VERSION}.${ARCH}/${BINARY} .

41 -o release/${BINARY}-${VERSION}.${ARCH}/${BINARY} .

40 fi

42 fi

41

43

main.go+2−1

@@ -9,6 +9,7 @@ import (

9 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

10 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/validation"

12+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version"

12 "github.com/spf13/pflag"

13 "github.com/spf13/pflag"

13)

14)

14

15

@@ -28,7 +29,7 @@ func main() {

28 configFlagSet.Parse(os.Args[1:])

29 configFlagSet.Parse(os.Args[1:])

29

30

30 if *showVersion {

31 if *showVersion {

31− fmt.Printf("oauth2-proxy %s (built with %s)\n", VERSION, runtime.Version())

32+ fmt.Printf("oauth2-proxy %s (built with %s)\n", version.VERSION, runtime.Version())

32 return

33 return

33 }

34 }

34

35

oauthproxy.go+2−1

@@ -30,6 +30,7 @@ import (

30 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/encryption"

31 proxyhttp "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/http"

32 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"

33+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version"

33

34

34 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"

35 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"

35 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

36 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

@@ -142,7 +143,7 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr

142 CustomLogo: opts.Templates.CustomLogo,

143 CustomLogo: opts.Templates.CustomLogo,

143 ProxyPrefix: opts.ProxyPrefix,

144 ProxyPrefix: opts.ProxyPrefix,

144 Footer: opts.Templates.Footer,

145 Footer: opts.Templates.Footer,

145− Version: VERSION,

146+ Version: version.VERSION,

146 Debug: opts.Templates.Debug,

147 Debug: opts.Templates.Debug,

147 ProviderName: buildProviderName(provider, opts.Providers[0].Name),

148 ProviderName: buildProviderName(provider, opts.Providers[0].Name),

148 SignInMessage: buildSignInMessage(opts),

149 SignInMessage: buildSignInMessage(opts),

pkg/providers/oidc/provider_verifier.go+2

@@ -6,6 +6,7 @@ import (

6 "fmt"

7

8 "github.com/coreos/go-oidc/v3/oidc"

9+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

9 k8serrors "k8s.io/apimachinery/pkg/util/errors"

10 k8serrors "k8s.io/apimachinery/pkg/util/errors"

10)

11)

11

12

@@ -130,6 +131,7 @@ func getVerifierBuilder(ctx context.Context, opts ProviderVerifierOptions) (veri

130

131

131// newVerifierBuilder returns a function to create a IDToken verifier from an OIDC config.

132// newVerifierBuilder returns a function to create a IDToken verifier from an OIDC config.

132func newVerifierBuilder(ctx context.Context, issuerURL, jwksURL string, supportedSigningAlgs []string) verifierBuilder {

133func newVerifierBuilder(ctx context.Context, issuerURL, jwksURL string, supportedSigningAlgs []string) verifierBuilder {

134+ ctx = oidc.ClientContext(ctx, requests.DefaultHTTPClient)

133 keySet := oidc.NewRemoteKeySet(ctx, jwksURL)

135 keySet := oidc.NewRemoteKeySet(ctx, jwksURL)

134 return func(oidcConfig *oidc.Config) *oidc.IDTokenVerifier {

136 return func(oidcConfig *oidc.Config) *oidc.IDTokenVerifier {

135 if len(supportedSigningAlgs) > 0 {

137 if len(supportedSigningAlgs) > 0 {

pkg/requests/builder.go+2−2

@@ -58,7 +58,7 @@ func (r *builder) WithMethod(method string) Builder {

58

59// WithHeaders replaces the request header map with the given header map.

60func (r *builder) WithHeaders(header http.Header) Builder {

61− r.header = header

61+ r.header = header.Clone()

62 return r

63}

64

@@ -99,7 +99,7 @@ func (r *builder) do() Result {

99 }

100 req.Header = r.header

101

102− resp, err := http.DefaultClient.Do(req)

102+ resp, err := DefaultHTTPClient.Do(req)

103 if err != nil {

104 r.result = &result{err: fmt.Errorf("error performing request: %v", err)}

105 return r.result

pkg/requests/builder_test.go+3−1

@@ -8,6 +8,8 @@ import (

8 "fmt"

9 "net/http"

10

11+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version"

12+

11 "github.com/bitly/go-simplejson"

13 "github.com/bitly/go-simplejson"

12 . "github.com/onsi/ginkgo"

14 . "github.com/onsi/ginkgo"

13 . "github.com/onsi/gomega"

15 . "github.com/onsi/gomega"

@@ -19,7 +21,7 @@ var _ = Describe("Builder suite", func() {

19

21

20 baseHeaders := http.Header{

22 baseHeaders := http.Header{

21 "Accept-Encoding": []string{"gzip"},

23 "Accept-Encoding": []string{"gzip"},

22− "User-Agent": []string{"Go-http-client/1.1"},

24+ "User-Agent": []string{"oauth2-proxy/" + version.VERSION},

23 }

25 }

24

26

25 BeforeEach(func() {

27 BeforeEach(func() {

pkg/requests/http.gonew file+29

@@ -0,0 +1,29 @@

1+package requests

2+

3+import (

4+ "net/http"

5+

6+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/version"

7+)

8+

9+type userAgentTransport struct {

10+ next http.RoundTripper

11+ userAgent string

12+}

13+

14+func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {

15+ r := req.Clone(req.Context())

16+ setDefaultUserAgent(r.Header, t.userAgent)

17+ return t.next.RoundTrip(r)

18+}

19+

20+var DefaultHTTPClient = &http.Client{Transport: &userAgentTransport{

21+ next: http.DefaultTransport,

22+ userAgent: "oauth2-proxy/" + version.VERSION,

23+}}

24+

25+func setDefaultUserAgent(header http.Header, userAgent string) {

26+ if header != nil && len(header.Values("User-Agent")) == 0 {

27+ header.Set("User-Agent", userAgent)

28+ }

29+}

version.go → pkg/version/version.gorenamed+1−1

@@ -1,4 +1,4 @@

1−package main

1+package version

2

3// VERSION contains version information

4var VERSION = "undefined"

providers/oidc.go+7

@@ -7,9 +7,11 @@ import (

7 "net/url"

8 "time"

9

10+ "github.com/coreos/go-oidc/v3/oidc"

10 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

12 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

12 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

13 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

14+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

13 "golang.org/x/oauth2"

15 "golang.org/x/oauth2"

14)

16)

15

17

@@ -83,6 +85,8 @@ func (p *OIDCProvider) Redeem(ctx context.Context, redirectURL, code, codeVerifi

83 },

85 },

84 RedirectURL: redirectURL,

86 RedirectURL: redirectURL,

85 }

87 }

88+

89+ ctx = oidc.ClientContext(ctx, requests.DefaultHTTPClient)

86 token, err := c.Exchange(ctx, code, opts...)

90 token, err := c.Exchange(ctx, code, opts...)

87 if err != nil {

91 if err != nil {

88 return nil, fmt.Errorf("token exchange failed: %v", err)

92 return nil, fmt.Errorf("token exchange failed: %v", err)

@@ -103,6 +107,7 @@ func (p *OIDCProvider) EnrichSession(_ context.Context, s *sessions.SessionState

103

107

104// ValidateSession checks that the session's IDToken is still valid

108// ValidateSession checks that the session's IDToken is still valid

105func (p *OIDCProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {

109func (p *OIDCProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {

110+ ctx = oidc.ClientContext(ctx, requests.DefaultHTTPClient)

106 _, err := p.Verifier.Verify(ctx, s.IDToken)

111 _, err := p.Verifier.Verify(ctx, s.IDToken)

107 if err != nil {

112 if err != nil {

108 logger.Errorf("id_token verification failed: %v", err)

113 logger.Errorf("id_token verification failed: %v", err)

@@ -127,6 +132,7 @@ func (p *OIDCProvider) RefreshSession(ctx context.Context, s *sessions.SessionSt

127 return false, nil

132 return false, nil

128 }

133 }

129

134

135+ ctx = oidc.ClientContext(ctx, requests.DefaultHTTPClient)

130 err := p.redeemRefreshToken(ctx, s)

136 err := p.redeemRefreshToken(ctx, s)

131 if err != nil {

137 if err != nil {

132 return false, fmt.Errorf("unable to redeem refresh token: %v", err)

138 return false, fmt.Errorf("unable to redeem refresh token: %v", err)

@@ -185,6 +191,7 @@ func (p *OIDCProvider) redeemRefreshToken(ctx context.Context, s *sessions.Sessi

185

191

186// CreateSessionFromToken converts Bearer IDTokens into sessions

192// CreateSessionFromToken converts Bearer IDTokens into sessions

187func (p *OIDCProvider) CreateSessionFromToken(ctx context.Context, token string) (*sessions.SessionState, error) {

193func (p *OIDCProvider) CreateSessionFromToken(ctx context.Context, token string) (*sessions.SessionState, error) {

194+ ctx = oidc.ClientContext(ctx, requests.DefaultHTTPClient)

188 idToken, err := p.Verifier.Verify(ctx, token)

195 idToken, err := p.Verifier.Verify(ctx, token)

189 if err != nil {

196 if err != nil {

190 return nil, err

197 return nil, err