git.iko.soy/typeable/oauth2-proxy
on master help sign in
fix: static upstreams failing validation due to `passHostHeader` and `proxyWebSockets` defaults being set incorrectly (#3302)
59f4e42Sourav Agrawal
CHANGELOG.md+1
compare with master
unifiedsplit
@@ -9,6 +9,7 @@
9## Changes since v7.14.0
9## Changes since v7.14.0
10
10
11- [#3309](https://github.com/oauth2-proxy/oauth2-proxy/pull/3309) fix: Return 302 redirect from AuthOnly endpoint when skip-provider-button is true (@StefanMarkmann)
11- [#3309](https://github.com/oauth2-proxy/oauth2-proxy/pull/3309) fix: Return 302 redirect from AuthOnly endpoint when skip-provider-button is true (@StefanMarkmann)
12+- [#3302](https://github.com/oauth2-proxy/oauth2-proxy/pull/3302) fix: static upstreams failing validation due to `passHostHeader` and `proxyWebSockets` defaults being set incorrectly (@sourava01 / @tuunit)
12
13
13# V7.14.0
14# V7.14.0
14
15
pkg/apis/options/legacy_options.go+4−4
@@ -179,10 +179,10 @@ func (l *LegacyUpstreams) convert() (UpstreamConfig, error) {
179 upstream.URI = ""
179 upstream.URI = ""
180 upstream.InsecureSkipTLSVerify = ptr.To(false)
180 upstream.InsecureSkipTLSVerify = ptr.To(false)
181 upstream.DisableKeepAlives = ptr.To(false)
181 upstream.DisableKeepAlives = ptr.To(false)
182− upstream.PassHostHeader = nil
182+ upstream.PassHostHeader = ptr.To(false)
183− upstream.ProxyWebSockets = nil
183+ upstream.ProxyWebSockets = ptr.To(false)
184− upstream.FlushInterval = nil
184+ upstream.FlushInterval = ptr.To(DefaultUpstreamFlushInterval)
185− upstream.Timeout = nil
185+ upstream.Timeout = ptr.To(DefaultUpstreamTimeout)
186 case "unix":
186 case "unix":
187 upstream.Path = "/"
187 upstream.Path = "/"
188 }
188 }
pkg/apis/options/legacy_options_test.go+12−12
@@ -204,12 +204,12 @@ var _ = Describe("Legacy Options", func() {
204 URI: "",
204 URI: "",
205 Static: ptr.To(true),
205 Static: ptr.To(true),
206 StaticCode: &validStaticCode,
206 StaticCode: &validStaticCode,
207− InsecureSkipTLSVerify: ptr.To(false),
207+ InsecureSkipTLSVerify: ptr.To(DefaultUpsteamInsecureSkipTLSVerify),
208− PassHostHeader: nil,
208+ PassHostHeader: ptr.To(DefaultStaticPassHostHeader),
209− ProxyWebSockets: nil,
209+ ProxyWebSockets: ptr.To(DefaultStaticProxyWebSockets),
210− FlushInterval: nil,
210+ FlushInterval: ptr.To(DefaultUpstreamFlushInterval),
211− Timeout: nil,
211+ Timeout: ptr.To(DefaultUpstreamTimeout),
212− DisableKeepAlives: ptr.To(false),
212+ DisableKeepAlives: ptr.To(DefaultUpstreamDisableKeepAlives),
213 }
213 }
214
214
215 invalidStatic := "static://abc"
215 invalidStatic := "static://abc"
@@ -220,12 +220,12 @@ var _ = Describe("Legacy Options", func() {
220 URI: "",
220 URI: "",
221 Static: ptr.To(true),
221 Static: ptr.To(true),
222 StaticCode: &invalidStaticCode,
222 StaticCode: &invalidStaticCode,
223− InsecureSkipTLSVerify: ptr.To(false),
223+ InsecureSkipTLSVerify: ptr.To(DefaultUpsteamInsecureSkipTLSVerify),
224− PassHostHeader: nil,
224+ PassHostHeader: ptr.To(DefaultStaticPassHostHeader),
225− ProxyWebSockets: nil,
225+ ProxyWebSockets: ptr.To(DefaultStaticProxyWebSockets),
226− FlushInterval: nil,
226+ FlushInterval: ptr.To(DefaultUpstreamFlushInterval),
227− Timeout: nil,
227+ Timeout: ptr.To(DefaultUpstreamTimeout),
228− DisableKeepAlives: ptr.To(false),
228+ DisableKeepAlives: ptr.To(DefaultUpstreamDisableKeepAlives),
229 }
229 }
230
230
231 invalidHTTP := ":foo"
231 invalidHTTP := ":foo"
pkg/apis/options/upstreams.go+21−3
@@ -29,9 +29,15 @@ const (
29 // DefaultUpstreamPassHostHeader determines if upstreams will pass the host header by default.
29 // DefaultUpstreamPassHostHeader determines if upstreams will pass the host header by default.
30 DefaultUpstreamPassHostHeader bool = true
30 DefaultUpstreamPassHostHeader bool = true
31
31
32+ // Static upstreams cannot pass the host header.
33+ DefaultStaticPassHostHeader bool = false
34+
32 // DefaultUpstreamProxyWebSockets determines if upstreams will proxy websockets by default.
35 // DefaultUpstreamProxyWebSockets determines if upstreams will proxy websockets by default.
33 DefaultUpstreamProxyWebSockets bool = true
36 DefaultUpstreamProxyWebSockets bool = true
34
37
38+ // Static upstreams cannot proxy websockets.
39+ DefaultStaticProxyWebSockets bool = false
40+
35 // DefaultUpstreamDisableKeepAlives determines if upstreams will disable keep-alives by default.
41 // DefaultUpstreamDisableKeepAlives determines if upstreams will disable keep-alives by default.
36 DefaultUpstreamDisableKeepAlives bool = false
42 DefaultUpstreamDisableKeepAlives bool = false
37)
43)
@@ -143,19 +149,31 @@ func (u *Upstream) EnsureDefaults() {
143 if u.Static == nil {
149 if u.Static == nil {
144 u.Static = ptr.To(DefaultUpstreamStatic)
150 u.Static = ptr.To(DefaultUpstreamStatic)
145 }
151 }
146− if u.FlushInterval == nil {
147− u.FlushInterval = ptr.To(DefaultUpstreamFlushInterval)
148− }
149 if u.PassHostHeader == nil {
152 if u.PassHostHeader == nil {
150 u.PassHostHeader = ptr.To(DefaultUpstreamPassHostHeader)
153 u.PassHostHeader = ptr.To(DefaultUpstreamPassHostHeader)
151 }
154 }
152 if u.ProxyWebSockets == nil {
155 if u.ProxyWebSockets == nil {
153 u.ProxyWebSockets = ptr.To(DefaultUpstreamProxyWebSockets)
156 u.ProxyWebSockets = ptr.To(DefaultUpstreamProxyWebSockets)
154 }
157 }
158+ if u.FlushInterval == nil {
159+ u.FlushInterval = ptr.To(DefaultUpstreamFlushInterval)
160+ }
155 if u.Timeout == nil {
161 if u.Timeout == nil {
156 u.Timeout = ptr.To(DefaultUpstreamTimeout)
162 u.Timeout = ptr.To(DefaultUpstreamTimeout)
157 }
163 }
158 if u.DisableKeepAlives == nil {
164 if u.DisableKeepAlives == nil {
159 u.DisableKeepAlives = ptr.To(DefaultUpstreamDisableKeepAlives)
165 u.DisableKeepAlives = ptr.To(DefaultUpstreamDisableKeepAlives)
160 }
166 }
167+
168+ // Force defaults compatible with static upstreams.
169+ // This overrides any user provided values to ensure static upstreams behave correctly.
170+ if ptr.Deref(u.Static, DefaultUpstreamStatic) {
171+ u.URI = ""
172+ u.InsecureSkipTLSVerify = ptr.To(DefaultUpsteamInsecureSkipTLSVerify)
173+ u.DisableKeepAlives = ptr.To(DefaultUpstreamDisableKeepAlives)
174+ u.PassHostHeader = ptr.To(DefaultStaticPassHostHeader)
175+ u.ProxyWebSockets = ptr.To(DefaultStaticProxyWebSockets)
176+ u.FlushInterval = ptr.To(DefaultUpstreamFlushInterval)
177+ u.Timeout = ptr.To(DefaultUpstreamTimeout)
178+ }
161}
179}
pkg/validation/upstreams.go+3−3
@@ -70,13 +70,13 @@ func validateStaticUpstream(upstream options.Upstream) []string {
70 if ptr.Deref(upstream.InsecureSkipTLSVerify, options.DefaultUpsteamInsecureSkipTLSVerify) {
70 if ptr.Deref(upstream.InsecureSkipTLSVerify, options.DefaultUpsteamInsecureSkipTLSVerify) {
71 msgs = append(msgs, fmt.Sprintf("upstream %q has insecureSkipTLSVerify, but is a static upstream, this will have no effect.", upstream.ID))
71 msgs = append(msgs, fmt.Sprintf("upstream %q has insecureSkipTLSVerify, but is a static upstream, this will have no effect.", upstream.ID))
72 }
72 }
73− if upstream.FlushInterval != nil && *upstream.FlushInterval != options.DefaultUpstreamFlushInterval {
73+ if ptr.Deref(upstream.FlushInterval, options.DefaultUpstreamFlushInterval) != options.DefaultUpstreamFlushInterval {
74 msgs = append(msgs, fmt.Sprintf("upstream %q has flushInterval, but is a static upstream, this will have no effect.", upstream.ID))
74 msgs = append(msgs, fmt.Sprintf("upstream %q has flushInterval, but is a static upstream, this will have no effect.", upstream.ID))
75 }
75 }
76− if upstream.PassHostHeader != nil {
76+ if ptr.Deref(upstream.PassHostHeader, options.DefaultStaticPassHostHeader) != options.DefaultStaticPassHostHeader {
77 msgs = append(msgs, fmt.Sprintf("upstream %q has passHostHeader, but is a static upstream, this will have no effect.", upstream.ID))
77 msgs = append(msgs, fmt.Sprintf("upstream %q has passHostHeader, but is a static upstream, this will have no effect.", upstream.ID))
78 }
78 }
79− if upstream.ProxyWebSockets != nil {
79+ if ptr.Deref(upstream.ProxyWebSockets, options.DefaultStaticProxyWebSockets) != options.DefaultStaticProxyWebSockets {
80 msgs = append(msgs, fmt.Sprintf("upstream %q has proxyWebSockets, but is a static upstream, this will have no effect.", upstream.ID))
80 msgs = append(msgs, fmt.Sprintf("upstream %q has proxyWebSockets, but is a static upstream, this will have no effect.", upstream.ID))
81 }
81 }
82
82
pkg/validation/upstreams_test.go+19−1
@@ -138,7 +138,7 @@ var _ = Describe("Upstreams", func() {
138 },
138 },
139 errStrings: []string{invalidURISchemeMsg},
139 errStrings: []string{invalidURISchemeMsg},
140 }),
140 }),
141− Entry("with a static upstream and invalid optons", &validateUpstreamTableInput{
141+ Entry("with a static upstream and invalid options", &validateUpstreamTableInput{
142 upstreams: options.UpstreamConfig{
142 upstreams: options.UpstreamConfig{
143 Upstreams: []options.Upstream{
143 Upstreams: []options.Upstream{
144 {
144 {
@@ -161,6 +161,24 @@ var _ = Describe("Upstreams", func() {
161 staticWithProxyWebSocketsMsg,
161 staticWithProxyWebSocketsMsg,
162 },
162 },
163 }),
163 }),
164+ Entry("with a static upstream and sane default options", &validateUpstreamTableInput{
165+ upstreams: options.UpstreamConfig{
166+ Upstreams: []options.Upstream{
167+ {
168+ ID: "foo",
169+ Path: "/foo",
170+ URI: "ftp://foo",
171+ Static: ptr.To(true),
172+ PassHostHeader: ptr.To(false),
173+ ProxyWebSockets: ptr.To(false),
174+ InsecureSkipTLSVerify: ptr.To(false),
175+ },
176+ },
177+ },
178+ errStrings: []string{
179+ staticWithURIMsg,
180+ },
181+ }),
164 Entry("with duplicate IDs", &validateUpstreamTableInput{
182 Entry("with duplicate IDs", &validateUpstreamTableInput{
165 upstreams: options.UpstreamConfig{
183 upstreams: options.UpstreamConfig{
166 Upstreams: []options.Upstream{
184 Upstreams: []options.Upstream{