git.iko.soy/typeable/oauth2-proxy
on master help sign in
Break legacy upstream options into LegacyUpstreams struct
commit71dc70222b705acf687bec97c1469cc363d3329f authorJoel Speed <joel.speed@hotmail.co.uk> dateSun 12 Jul 2020, 16:47 (6 years ago) parent5dbcd73
3 files changed+49−27
compare with master
unifiedsplit
pkg/apis/options/legacy_options.go+34−15 pkg/apis/options/legacy_options_test.go+14−6 pkg/apis/options/options.go+1−6
pkg/apis/options/legacy_options.go+34−15
@@ -7,31 +7,30 @@ import (
77 "time"
88
99 "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"
10+ "github.com/spf13/pflag"
1011)
1112
1213type LegacyOptions struct {
1314 // Legacy options related to upstream servers
14− LegacyFlushInterval time.Duration `flag:"flush-interval" cfg:"flush_interval"`
15− LegacyPassHostHeader bool `flag:"pass-host-header" cfg:"pass_host_header"`
16− LegacyProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets"`
17− LegacySSLUpstreamInsecureSkipVerify bool `flag:"ssl-upstream-insecure-skip-verify" cfg:"ssl_upstream_insecure_skip_verify"`
18− LegacyUpstreams []string `flag:"upstream" cfg:"upstreams"`
15+ LegacyUpstreams LegacyUpstreams `cfg:",squash"`
1916
2017 Options Options `cfg:",squash"`
2118}
2219
2320func NewLegacyOptions() *LegacyOptions {
2421 return &LegacyOptions{
25− LegacyPassHostHeader: true,
26− LegacyProxyWebSockets: true,
27− LegacyFlushInterval: time.Duration(1) * time.Second,
22+ LegacyUpstreams: LegacyUpstreams{
23+ PassHostHeader: true,
24+ ProxyWebSockets: true,
25+ FlushInterval: time.Duration(1) * time.Second,
26+ },
2827
2928 Options: *NewOptions(),
3029 }
3130}
3231
3332func (l *LegacyOptions) ToOptions() (*Options, error) {
34− upstreams, err := convertLegacyUpstreams(l.LegacyUpstreams, l.LegacySSLUpstreamInsecureSkipVerify, l.LegacyPassHostHeader, l.LegacyProxyWebSockets, l.LegacyFlushInterval)
33+ upstreams, err := l.LegacyUpstreams.convert()
3534 if err != nil {
3635 return nil, fmt.Errorf("error converting upstreams: %v", err)
3736 }
@@ -40,10 +39,30 @@ func (l *LegacyOptions) ToOptions() (*Options, error) {
4039 return &l.Options, nil
4140}
4241
43−func convertLegacyUpstreams(upstreamStrings []string, skipVerify, passHostHeader, proxyWebSockets bool, flushInterval time.Duration) (Upstreams, error) {
42+type LegacyUpstreams struct {
43+ FlushInterval time.Duration `flag:"flush-interval" cfg:"flush_interval"`
44+ PassHostHeader bool `flag:"pass-host-header" cfg:"pass_host_header"`
45+ ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets"`
46+ SSLUpstreamInsecureSkipVerify bool `flag:"ssl-upstream-insecure-skip-verify" cfg:"ssl_upstream_insecure_skip_verify"`
47+ Upstreams []string `flag:"upstream" cfg:"upstreams"`
48+}
49+
50+func legacyUpstreamsFlagSet() *pflag.FlagSet {
51+ flagSet := pflag.NewFlagSet("upstreams", pflag.ExitOnError)
52+
53+ flagSet.Duration("flush-interval", time.Duration(1)*time.Second, "period between response flushing when streaming responses")
54+ flagSet.Bool("pass-host-header", true, "pass the request Host Header to upstream")
55+ flagSet.Bool("proxy-websockets", true, "enables WebSocket proxying")
56+ flagSet.Bool("ssl-upstream-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS upstreams")
57+ flagSet.StringSlice("upstream", []string{}, "the http url(s) of the upstream endpoint, file:// paths for static files or static://<status_code> for static response. Routing is based on the path")
58+
59+ return flagSet
60+}
61+
62+func (l *LegacyUpstreams) convert() (Upstreams, error) {
4463 upstreams := Upstreams{}
4564
46− for _, upstreamString := range upstreamStrings {
65+ for _, upstreamString := range l.Upstreams {
4766 u, err := url.Parse(upstreamString)
4867 if err != nil {
4968 return nil, fmt.Errorf("could not parse upstream %q: %v", upstreamString, err)
@@ -57,10 +76,10 @@ func convertLegacyUpstreams(upstreamStrings []string, skipVerify, passHostHeader
5776 ID: u.Path,
5877 Path: u.Path,
5978 URI: upstreamString,
60− InsecureSkipTLSVerify: skipVerify,
61− PassHostHeader: passHostHeader,
62− ProxyWebSockets: proxyWebSockets,
63− FlushInterval: &flushInterval,
79+ InsecureSkipTLSVerify: l.SSLUpstreamInsecureSkipVerify,
80+ PassHostHeader: l.PassHostHeader,
81+ ProxyWebSockets: l.ProxyWebSockets,
82+ FlushInterval: &l.FlushInterval,
6483 }
6584
6685 switch u.Scheme {
pkg/apis/options/legacy_options_test.go+14−6
@@ -17,11 +17,11 @@ var _ = Describe("Legacy Options", func() {
1717
1818 // Set upstreams and related options to test their conversion
1919 flushInterval := 5 * time.Second
20− legacyOpts.LegacyFlushInterval = flushInterval
21− legacyOpts.LegacyPassHostHeader = true
22− legacyOpts.LegacyProxyWebSockets = true
23− legacyOpts.LegacySSLUpstreamInsecureSkipVerify = true
24− legacyOpts.LegacyUpstreams = []string{"http://foo.bar/baz", "file://var/lib/website#/bar"}
20+ legacyOpts.LegacyUpstreams.FlushInterval = flushInterval
21+ legacyOpts.LegacyUpstreams.PassHostHeader = true
22+ legacyOpts.LegacyUpstreams.ProxyWebSockets = true
23+ legacyOpts.LegacyUpstreams.SSLUpstreamInsecureSkipVerify = true
24+ legacyOpts.LegacyUpstreams.Upstreams = []string{"http://foo.bar/baz", "file://var/lib/website#/bar"}
2525
2626 opts.UpstreamServers = Upstreams{
2727 {
@@ -133,7 +133,15 @@ var _ = Describe("Legacy Options", func() {
133133
134134 DescribeTable("convertLegacyUpstreams",
135135 func(o *convertUpstreamsTableInput) {
136− upstreams, err := convertLegacyUpstreams(o.upstreamStrings, skipVerify, passHostHeader, proxyWebSockets, flushInterval)
136+ legacyUpstreams := LegacyUpstreams{
137+ Upstreams: o.upstreamStrings,
138+ SSLUpstreamInsecureSkipVerify: skipVerify,
139+ PassHostHeader: passHostHeader,
140+ ProxyWebSockets: proxyWebSockets,
141+ FlushInterval: flushInterval,
142+ }
143+
144+ upstreams, err := legacyUpstreams.convert()
137145
138146 if o.errMsg != "" {
139147 Expect(err).To(HaveOccurred())
pkg/apis/options/options.go+1−6
@@ -4,7 +4,6 @@ import (
44 "crypto"
55 "net/url"
66 "regexp"
7− "time"
87
98 oidc "github.com/coreos/go-oidc"
109 ipapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/ip"
@@ -185,14 +184,12 @@ func NewFlagSet() *pflag.FlagSet {
185184 flagSet.String("tls-key-file", "", "path to private key file")
186185 flagSet.String("redirect-url", "", "the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"")
187186 flagSet.Bool("set-xauthrequest", false, "set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)")
188− flagSet.StringSlice("upstream", []string{}, "the http url(s) of the upstream endpoint, file:// paths for static files or static://<status_code> for static response. Routing is based on the path")
189187 flagSet.Bool("pass-basic-auth", true, "pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream")
190188 flagSet.Bool("set-basic-auth", false, "set HTTP Basic Auth information in response (useful in Nginx auth_request mode)")
191189 flagSet.Bool("prefer-email-to-user", false, "Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, eg. htaccess authentication. Used in conjunction with -pass-basic-auth and -pass-user-headers")
192190 flagSet.Bool("pass-user-headers", true, "pass X-Forwarded-User and X-Forwarded-Email information to upstream")
193191 flagSet.String("basic-auth-password", "", "the password to set when passing the HTTP Basic Auth header")
194192 flagSet.Bool("pass-access-token", false, "pass OAuth access_token to upstream via X-Forwarded-Access-Token header")
195− flagSet.Bool("pass-host-header", true, "pass the request Host Header to upstream")
196193 flagSet.Bool("pass-authorization-header", false, "pass the Authorization Header to upstream")
197194 flagSet.Bool("set-authorization-header", false, "set Authorization response headers (useful in Nginx auth_request mode)")
198195 flagSet.StringSlice("skip-auth-regex", []string{}, "bypass authentication for requests path's that match (may be given multiple times)")
@@ -200,8 +197,6 @@ func NewFlagSet() *pflag.FlagSet {
200197 flagSet.Bool("skip-provider-button", false, "will skip sign-in-page to directly reach the next step: oauth/start")
201198 flagSet.Bool("skip-auth-preflight", false, "will skip authentication for OPTIONS requests")
202199 flagSet.Bool("ssl-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS providers")
203− flagSet.Bool("ssl-upstream-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS upstreams")
204− flagSet.Duration("flush-interval", time.Duration(1)*time.Second, "period between response flushing when streaming responses")
205200 flagSet.Bool("skip-jwt-bearer-tokens", false, "will skip requests that have verified JWT bearer tokens (default false)")
206201 flagSet.StringSlice("extra-jwt-issuers", []string{}, "if skip-jwt-bearer-tokens is set, a list of extra JWT issuer=audience pairs (where the issuer URL has a .well-known/openid-configuration or a .well-known/jwks.json)")
207202
@@ -232,7 +227,6 @@ func NewFlagSet() *pflag.FlagSet {
232227 flagSet.String("proxy-prefix", "/oauth2", "the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in)")
233228 flagSet.String("ping-path", "/ping", "the ping endpoint that can be used for basic health checks")
234229 flagSet.String("ping-user-agent", "", "special User-Agent that will be used for basic health checks")
235− flagSet.Bool("proxy-websockets", true, "enables WebSocket proxying")
236230 flagSet.String("session-store-type", "cookie", "the session storage provider to use")
237231 flagSet.Bool("session-cookie-minimal", false, "strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)")
238232 flagSet.String("redis-connection-url", "", "URL of redis server for redis session storage (eg: redis://HOST[:PORT])")
@@ -272,6 +266,7 @@ func NewFlagSet() *pflag.FlagSet {
272266
273267 flagSet.AddFlagSet(cookieFlagSet())
274268 flagSet.AddFlagSet(loggingFlagSet())
269+ flagSet.AddFlagSet(legacyUpstreamsFlagSet())
275270
276271 return flagSet
277272}