3d457a8 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Create server options struct and move legacy server options to legacyOptions

commit3d457a8cdf8b2ac08e9e2f184a5c5d8f9829fcfd authorJoel Speed <joel.speed@hotmail.co.uk> dateSun 14 Feb 2021, 18:47 (6 years ago) parent602dac7

5 files changed+199−13

compare with master

unifiedsplit

pkg/apis/options/alpha_options.go+16 pkg/apis/options/legacy_options.go+60 pkg/apis/options/legacy_options_test.go+93 pkg/apis/options/options.go+3−13 pkg/apis/options/server.go+27

pkg/apis/options/alpha_options.go+16

@@ -28,6 +28,18 @@ type AlphaOptions struct {

2828 // Headers may source values from either the authenticated user's session

2929 // or from a static secret value.

3030 InjectResponseHeaders []Header `json:"injectResponseHeaders,omitempty"`

31+

32+ // Server is used to configure the HTTP(S) server for the proxy application.

33+ // You may choose to run both HTTP and HTTPS servers simultaneously.

34+ // This can be done by setting the BindAddress and the SecureBindAddress simultaneously.

35+ // To use the secure server you must configure a TLS certificate and key.

36+ Server Server `json:"server,omitempty"`

37+

38+ // MetricsServer is used to configure the HTTP(S) server for metrics.

39+ // You may choose to run both HTTP and HTTPS servers simultaneously.

40+ // This can be done by setting the BindAddress and the SecureBindAddress simultaneously.

41+ // To use the secure server you must configure a TLS certificate and key.

42+ MetricsServer Server `json:"metricsServer,omitempty"`

3143}

3244

3345// MergeInto replaces alpha options in the Options struct with the values

@@ -36,6 +48,8 @@ func (a *AlphaOptions) MergeInto(opts *Options) {

3648 opts.UpstreamServers = a.Upstreams

3749 opts.InjectRequestHeaders = a.InjectRequestHeaders

3850 opts.InjectResponseHeaders = a.InjectResponseHeaders

51+ opts.Server = a.Server

52+ opts.MetricsServer = a.MetricsServer

3953}

4054

4155// ExtractFrom populates the fields in the AlphaOptions with the values from

@@ -44,4 +58,6 @@ func (a *AlphaOptions) ExtractFrom(opts *Options) {

4458 a.Upstreams = opts.UpstreamServers

4559 a.InjectRequestHeaders = opts.InjectRequestHeaders

4660 a.InjectResponseHeaders = opts.InjectResponseHeaders

61+ a.Server = opts.Server

62+ a.MetricsServer = opts.MetricsServer

4763}

pkg/apis/options/legacy_options.go+60

@@ -18,6 +18,9 @@ type LegacyOptions struct {

1818 // Legacy options for injecting request/response headers

1919 LegacyHeaders LegacyHeaders `cfg:",squash"`

2020

21+ // Legacy options for the server address and TLS

22+ LegacyServer LegacyServer `cfg:",squash"`

23+

2124 Options Options `cfg:",squash"`

2225}

2326

@@ -35,6 +38,11 @@ func NewLegacyOptions() *LegacyOptions {

3538 SkipAuthStripHeaders: true,

3639 },

3740

41+ LegacyServer: LegacyServer{

42+ HTTPAddress: "127.0.0.1:4180",

43+ HTTPSAddress: ":443",

44+ },

45+

3846 Options: *NewOptions(),

3947 }

4048}

@@ -44,6 +52,7 @@ func NewLegacyFlagSet() *pflag.FlagSet {

4452

4553 flagSet.AddFlagSet(legacyUpstreamsFlagSet())

4654 flagSet.AddFlagSet(legacyHeadersFlagSet())

55+ flagSet.AddFlagSet(legacyServerFlagset())

4756

4857 return flagSet

4958}

@@ -56,6 +65,8 @@ func (l *LegacyOptions) ToOptions() (*Options, error) {

5665 l.Options.UpstreamServers = upstreams

5766

5867 l.Options.InjectRequestHeaders, l.Options.InjectResponseHeaders = l.LegacyHeaders.convert()

68+ l.Options.Server, l.Options.MetricsServer = l.LegacyServer.convert()

69+

5970 return &l.Options, nil

6071}

6172

@@ -403,3 +414,52 @@ func getXAuthRequestAccessTokenHeader() Header {

403414 },

404415 }

405416}

417+

418+type LegacyServer struct {

419+ MetricsAddress string `flag:"metrics-address" cfg:"metrics_address"`

420+ HTTPAddress string `flag:"http-address" cfg:"http_address"`

421+ HTTPSAddress string `flag:"https-address" cfg:"https_address"`

422+ TLSCertFile string `flag:"tls-cert-file" cfg:"tls_cert_file"`

423+ TLSKeyFile string `flag:"tls-key-file" cfg:"tls_key_file"`

424+}

425+

426+func legacyServerFlagset() *pflag.FlagSet {

427+ flagSet := pflag.NewFlagSet("server", pflag.ExitOnError)

428+

429+ flagSet.String("metrics-address", "", "the address /metrics will be served on (e.g. \":9100\")")

430+ flagSet.String("http-address", "127.0.0.1:4180", "[http://]<addr>:<port> or unix://<path> to listen on for HTTP clients")

431+ flagSet.String("https-address", ":443", "<addr>:<port> to listen on for HTTPS clients")

432+ flagSet.String("tls-cert-file", "", "path to certificate file")

433+ flagSet.String("tls-key-file", "", "path to private key file")

434+

435+ return flagSet

436+}

437+

438+func (l LegacyServer) convert() (Server, Server) {

439+ appServer := Server{

440+ BindAddress: l.HTTPAddress,

441+ SecureBindAddress: l.HTTPSAddress,

442+ }

443+ if l.TLSKeyFile != "" || l.TLSCertFile != "" {

444+ appServer.TLS = &TLS{

445+ Key: &SecretSource{

446+ FromFile: l.TLSKeyFile,

447+ },

448+ Cert: &SecretSource{

449+ FromFile: l.TLSCertFile,

450+ },

451+ }

452+ // Preserve backwards compatibility, only run one server

453+ appServer.BindAddress = ""

454+ } else {

455+ // Disable the HTTPS server if there's no certificates.

456+ // This preserves backwards compatibility.

457+ appServer.SecureBindAddress = ""

458+ }

459+

460+ metricsServer := Server{

461+ BindAddress: l.MetricsAddress,

462+ }

463+

464+ return appServer, metricsServer

465+}

pkg/apis/options/legacy_options_test.go+93

@@ -106,6 +106,10 @@ var _ = Describe("Legacy Options", func() {

106106

107107 opts.InjectResponseHeaders = []Header{}

108108

109+ opts.Server = Server{

110+ BindAddress: "127.0.0.1:4180",

111+ }

112+

109113 converted, err := legacyOpts.ToOptions()

110114 Expect(err).ToNot(HaveOccurred())

111115 Expect(converted).To(Equal(opts))

@@ -759,4 +763,93 @@ var _ = Describe("Legacy Options", func() {

759763 }),

760764 )

761765 })

766+

767+ Context("Legacy Servers", func() {

768+ type legacyServersTableInput struct {

769+ legacyServer LegacyServer

770+ expectedAppServer Server

771+ expectedMetricsServer Server

772+ }

773+

774+ const (

775+ insecureAddr = "127.0.0.1:8080"

776+ insecureMetricsAddr = ":9090"

777+ secureAddr = ":443"

778+ secureMetricsAddr = ":9443"

779+ crtPath = "tls.crt"

780+ keyPath = "tls.key"

781+ )

782+

783+ var tlsConfig = &TLS{

784+ Cert: &SecretSource{

785+ FromFile: crtPath,

786+ },

787+ Key: &SecretSource{

788+ FromFile: keyPath,

789+ },

790+ }

791+

792+ DescribeTable("should convert to app and metrics servers",

793+ func(in legacyServersTableInput) {

794+ appServer, metricsServer := in.legacyServer.convert()

795+ Expect(appServer).To(Equal(in.expectedAppServer))

796+ Expect(metricsServer).To(Equal(in.expectedMetricsServer))

797+ },

798+ Entry("with default options only starts app HTTP server", legacyServersTableInput{

799+ legacyServer: LegacyServer{

800+ HTTPAddress: insecureAddr,

801+ HTTPSAddress: secureAddr,

802+ },

803+ expectedAppServer: Server{

804+ BindAddress: insecureAddr,

805+ },

806+ }),

807+ Entry("with TLS options specified only starts app HTTPS server", legacyServersTableInput{

808+ legacyServer: LegacyServer{

809+ HTTPAddress: insecureAddr,

810+ HTTPSAddress: secureAddr,

811+ TLSKeyFile: keyPath,

812+ TLSCertFile: crtPath,

813+ },

814+ expectedAppServer: Server{

815+ SecureBindAddress: secureAddr,

816+ TLS: tlsConfig,

817+ },

818+ }),

819+ Entry("with metrics HTTP and HTTPS addresses", legacyServersTableInput{

820+ legacyServer: LegacyServer{

821+ HTTPAddress: insecureAddr,

822+ HTTPSAddress: secureAddr,

823+ MetricsAddress: insecureMetricsAddr,

824+ MetricsSecureAddress: secureMetricsAddr,

825+ },

826+ expectedAppServer: Server{

827+ BindAddress: insecureAddr,

828+ },

829+ expectedMetricsServer: Server{

830+ BindAddress: insecureMetricsAddr,

831+ SecureBindAddress: secureMetricsAddr,

832+ },

833+ }),

834+ Entry("with metrics HTTPS and tls cert/key", legacyServersTableInput{

835+ legacyServer: LegacyServer{

836+ HTTPAddress: insecureAddr,

837+ HTTPSAddress: secureAddr,

838+ MetricsAddress: insecureMetricsAddr,

839+ MetricsSecureAddress: secureMetricsAddr,

840+ MetricsTLSKeyFile: keyPath,

841+ MetricsTLSCertFile: crtPath,

842+ },

843+ expectedAppServer: Server{

844+ BindAddress: insecureAddr,

845+ },

846+ expectedMetricsServer: Server{

847+ BindAddress: insecureMetricsAddr,

848+ SecureBindAddress: secureMetricsAddr,

849+ TLS: tlsConfig,

850+ },

851+ }),

852+ )

853+

854+ })

762855})

pkg/apis/options/options.go+3−13

@@ -22,9 +22,6 @@ type Options struct {

2222 ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix"`

2323 PingPath string `flag:"ping-path" cfg:"ping_path"`

2424 PingUserAgent string `flag:"ping-user-agent" cfg:"ping_user_agent"`

25− MetricsAddress string `flag:"metrics-address" cfg:"metrics_address"`

26− HTTPAddress string `flag:"http-address" cfg:"http_address"`

27− HTTPSAddress string `flag:"https-address" cfg:"https_address"`

2825 ReverseProxy bool `flag:"reverse-proxy" cfg:"reverse_proxy"`

2926 RealClientIPHeader string `flag:"real-client-ip-header" cfg:"real_client_ip_header"`

3027 TrustedIPs []string `flag:"trusted-ip" cfg:"trusted_ips"`

@@ -33,8 +30,6 @@ type Options struct {

3330 ClientID string `flag:"client-id" cfg:"client_id"`

3431 ClientSecret string `flag:"client-secret" cfg:"client_secret"`

3532 ClientSecretFile string `flag:"client-secret-file" cfg:"client_secret_file"`

36− TLSCertFile string `flag:"tls-cert-file" cfg:"tls_cert_file"`

37− TLSKeyFile string `flag:"tls-key-file" cfg:"tls_key_file"`

3833

3934 AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file"`

4035 KeycloakGroups []string `flag:"keycloak-group" cfg:"keycloak_groups"`

@@ -68,6 +63,9 @@ type Options struct {

6863 InjectRequestHeaders []Header `cfg:",internal"`

6964 InjectResponseHeaders []Header `cfg:",internal"`

7065

66+ Server Server `cfg:",internal"`

67+ MetricsServer Server `cfg:",internal"`

68+

7169 SkipAuthRegex []string `flag:"skip-auth-regex" cfg:"skip_auth_regex"`

7270 SkipAuthRoutes []string `flag:"skip-auth-route" cfg:"skip_auth_routes"`

7371 SkipJwtBearerTokens bool `flag:"skip-jwt-bearer-tokens" cfg:"skip_jwt_bearer_tokens"`

@@ -136,10 +134,7 @@ func NewOptions() *Options {

136134 return &Options{

137135 ProxyPrefix: "/oauth2",

138136 ProviderType: "google",

139− MetricsAddress: "",

140137 PingPath: "/ping",

141− HTTPAddress: "127.0.0.1:4180",

142− HTTPSAddress: ":443",

143138 RealClientIPHeader: "X-Real-IP",

144139 ForceHTTPS: false,

145140 Cookie: cookieDefaults(),

@@ -162,14 +157,10 @@ func NewOptions() *Options {

162157func NewFlagSet() *pflag.FlagSet {

163158 flagSet := pflag.NewFlagSet("oauth2-proxy", pflag.ExitOnError)

164159

165− flagSet.String("http-address", "127.0.0.1:4180", "[http://]<addr>:<port> or unix://<path> to listen on for HTTP clients")

166− flagSet.String("https-address", ":443", "<addr>:<port> to listen on for HTTPS clients")

167160 flagSet.Bool("reverse-proxy", false, "are we running behind a reverse proxy, controls whether headers like X-Real-Ip are accepted")

168161 flagSet.String("real-client-ip-header", "X-Real-IP", "Header used to determine the real IP of the client (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)")

169162 flagSet.StringSlice("trusted-ip", []string{}, "list of IPs or CIDR ranges to allow to bypass authentication. WARNING: trusting by IP has inherent security flaws, read the configuration documentation for more information.")

170163 flagSet.Bool("force-https", false, "force HTTPS redirect for HTTP requests")

171− flagSet.String("tls-cert-file", "", "path to certificate file")

172− flagSet.String("tls-key-file", "", "path to private key file")

173164 flagSet.String("redirect-url", "", "the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"")

174165 flagSet.StringSlice("skip-auth-regex", []string{}, "(DEPRECATED for --skip-auth-route) bypass authentication for requests path's that match (may be given multiple times)")

175166 flagSet.StringSlice("skip-auth-route", []string{}, "bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods")

@@ -204,7 +195,6 @@ func NewFlagSet() *pflag.FlagSet {

204195 flagSet.String("proxy-prefix", "/oauth2", "the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in)")

205196 flagSet.String("ping-path", "/ping", "the ping endpoint that can be used for basic health checks")

206197 flagSet.String("ping-user-agent", "", "special User-Agent that will be used for basic health checks")

207− flagSet.String("metrics-address", "", "the address /metrics will be served on (e.g. \":9100\")")

208198 flagSet.String("session-store-type", "cookie", "the session storage provider to use")

209199 flagSet.Bool("session-cookie-minimal", false, "strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)")

210200 flagSet.String("redis-connection-url", "", "URL of redis server for redis session storage (eg: redis://HOST[:PORT])")

pkg/apis/options/server.gonew file+27

@@ -0,0 +1,27 @@

1+package options

3+// Server represents the configuration for an HTTP(S) server

4+type Server struct {

5+ // BindAddress is the the address on which to serve traffic.

6+ // Leave blank or set to "-" to disable.

7+ BindAddress string

9+ // SecureBindAddress is the the address on which to serve secure traffic.

10+ // Leave blank or set to "-" to disable.

11+ SecureBindAddress string

12+

13+ // TLS contains the information for loading the certificate and key for the

14+ // secure traffic.

15+ TLS *TLS

16+}

17+

18+// TLS contains the information for loading a TLS certifcate and key.

19+type TLS struct {

20+ // Key is the the TLS key data to use.

21+ // Typically this will come from a file.

22+ Key *SecretSource

23+

24+ // Cert is the TLS certificate data to use.

25+ // Typically this will come from a file.

26+ Cert *SecretSource

27+}