git.iko.soy/typeable/oauth2-proxy
on master help sign in
Implement configurable timeout for upstream connections

Signed-off-by: Jack Henschel <jack.henschel@cern.ch>

commit7a27cb04dfaa0f86ab23ec5597d6246ebbe34ccf authorJack Henschel <jack.henschel@cern.ch> dateFri 13 May 2022, 22:36 (4 years ago) parent27f4bb6
10 files changed+86−21
CHANGELOG.md+1 docs/docs/configuration/alpha_config.md+1 docs/docs/configuration/overview.md+1 main_test.go+2 pkg/apis/options/legacy_options.go+6 pkg/apis/options/legacy_options_test.go+12 pkg/apis/options/load_test.go+1 pkg/apis/options/upstreams.go+7 pkg/upstream/http.go+22−7 pkg/upstream/http_test.go+33−14
CHANGELOG.md+1
@@ -39,6 +39,7 @@ If you are using an architecture specific tag (ex: v7.2.1-arm64) you should move
3939- [#1286](https://github.com/oauth2-proxy/oauth2-proxy/pull/1286) Add the `allowed_email_domains` and the `allowed_groups` on the `auth_request` + support standard wildcard char for validation with sub-domain and email-domain. (@w3st3ry @armandpicard)
4040- [#1361](https://github.com/oauth2-proxy/oauth2-proxy/pull/1541) PKCE Code Challenge Support - RFC-7636 (@braunsonm)
4141- [#1594](https://github.com/oauth2-proxy/oauth2-proxy/pull/1594) Release ARMv8 docker images (@braunsonm)
42+- [#1638](https://github.com/oauth2-proxy/oauth2-proxy/pull/1638) Implement configurable upstream timeout (@jacksgt)
4243
4344# V7.2.1
4445
docs/docs/configuration/alpha_config.md+1
@@ -512,6 +512,7 @@ Requests will be proxied to this upstream if the path matches the request path.
512512| `flushInterval` | _[Duration](#duration)_ | FlushInterval is the period between flushing the response buffer when<br/>streaming response from the upstream.<br/>Defaults to 1 second. |
513513| `passHostHeader` | _bool_ | PassHostHeader determines whether the request host header should be proxied<br/>to the upstream server.<br/>Defaults to true. |
514514| `proxyWebSockets` | _bool_ | ProxyWebSockets enables proxying of websockets to upstream servers<br/>Defaults to true. |
515+| `timeout` | _[Duration](#duration)_ | Timeout is the maximum duration the server will wait for a response from the upstream server.<br/>Defaults to 30 seconds. |
515516
516517### UpstreamConfig
517518
docs/docs/configuration/overview.md+1
@@ -196,6 +196,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
196196| `--tls-key-file` | string | path to private key file | |
197197| `--tls-min-version` | string | minimum TLS version that is acceptable, either `"TLS1.2"` or `"TLS1.3"` | `"TLS1.2"` |
198198| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
199+| `--upstream-timeout` | duration | maximum amount of time the server will wait for a response from the upstream | 30s |
199200| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
200201| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
201202| `--validate-url` | string | Access token validation endpoint | |
main_test.go+2
@@ -35,6 +35,7 @@ upstreamConfig:
3535 flushInterval: 1s
3636 passHostHeader: true
3737 proxyWebSockets: true
38+ timeout: 30s
3839injectRequestHeaders:
3940- name: Authorization
4041 values:
@@ -118,6 +119,7 @@ redirect_url="http://localhost:4180/oauth2/callback"
118119 FlushInterval: durationPtr(options.DefaultUpstreamFlushInterval),
119120 PassHostHeader: boolPtr(true),
120121 ProxyWebSockets: boolPtr(true),
122+ Timeout: durationPtr(options.DefaultUpstreamTimeout),
121123 },
122124 },
123125 }
pkg/apis/options/legacy_options.go+6
@@ -33,6 +33,7 @@ func NewLegacyOptions() *LegacyOptions {
3333 PassHostHeader: true,
3434 ProxyWebSockets: true,
3535 FlushInterval: DefaultUpstreamFlushInterval,
36+ Timeout: DefaultUpstreamTimeout,
3637 },
3738
3839 LegacyHeaders: LegacyHeaders{
@@ -101,6 +102,7 @@ type LegacyUpstreams struct {
101102 ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets"`
102103 SSLUpstreamInsecureSkipVerify bool `flag:"ssl-upstream-insecure-skip-verify" cfg:"ssl_upstream_insecure_skip_verify"`
103104 Upstreams []string `flag:"upstream" cfg:"upstreams"`
105+ Timeout time.Duration `flag:"upstream-timeout" cfg:"upstream_timeout"`
104106}
105107
106108func legacyUpstreamsFlagSet() *pflag.FlagSet {
@@ -111,6 +113,7 @@ func legacyUpstreamsFlagSet() *pflag.FlagSet {
111113 flagSet.Bool("proxy-websockets", true, "enables WebSocket proxying")
112114 flagSet.Bool("ssl-upstream-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS upstreams")
113115 flagSet.StringSlice("upstream", []string{}, "the http url(s) of the upstream endpoint, file:// paths for static files or static://<status_code> for static response. Routing is based on the path")
116+ flagSet.Duration("upstream-timeout", DefaultUpstreamTimeout, "maximum amount of time the server will wait for a response from the upstream")
114117
115118 return flagSet
116119}
@@ -129,6 +132,7 @@ func (l *LegacyUpstreams) convert() (UpstreamConfig, error) {
129132 }
130133
131134 flushInterval := Duration(l.FlushInterval)
135+ timeout := Duration(l.Timeout)
132136 upstream := Upstream{
133137 ID: u.Path,
134138 Path: u.Path,
@@ -137,6 +141,7 @@ func (l *LegacyUpstreams) convert() (UpstreamConfig, error) {
137141 PassHostHeader: &l.PassHostHeader,
138142 ProxyWebSockets: &l.ProxyWebSockets,
139143 FlushInterval: &flushInterval,
144+ Timeout: &timeout,
140145 }
141146
142147 switch u.Scheme {
@@ -168,6 +173,7 @@ func (l *LegacyUpstreams) convert() (UpstreamConfig, error) {
168173 upstream.PassHostHeader = nil
169174 upstream.ProxyWebSockets = nil
170175 upstream.FlushInterval = nil
176+ upstream.Timeout = nil
171177 }
172178
173179 upstreams.Upstreams = append(upstreams.Upstreams, upstream)
pkg/apis/options/legacy_options_test.go+12
@@ -17,7 +17,9 @@ var _ = Describe("Legacy Options", func() {
1717
1818 // Set upstreams and related options to test their conversion
1919 flushInterval := Duration(5 * time.Second)
20+ timeout := Duration(5 * time.Second)
2021 legacyOpts.LegacyUpstreams.FlushInterval = time.Duration(flushInterval)
22+ legacyOpts.LegacyUpstreams.Timeout = time.Duration(timeout)
2123 legacyOpts.LegacyUpstreams.PassHostHeader = true
2224 legacyOpts.LegacyUpstreams.ProxyWebSockets = true
2325 legacyOpts.LegacyUpstreams.SSLUpstreamInsecureSkipVerify = true
@@ -36,6 +38,7 @@ var _ = Describe("Legacy Options", func() {
3638 InsecureSkipTLSVerify: true,
3739 PassHostHeader: &truth,
3840 ProxyWebSockets: &truth,
41+ Timeout: &timeout,
3942 },
4043 {
4144 ID: "/bar",
@@ -45,6 +48,7 @@ var _ = Describe("Legacy Options", func() {
4548 InsecureSkipTLSVerify: true,
4649 PassHostHeader: &truth,
4750 ProxyWebSockets: &truth,
51+ Timeout: &timeout,
4852 },
4953 {
5054 ID: "static://204",
@@ -56,6 +60,7 @@ var _ = Describe("Legacy Options", func() {
5660 InsecureSkipTLSVerify: false,
5761 PassHostHeader: nil,
5862 ProxyWebSockets: nil,
63+ Timeout: nil,
5964 },
6065 },
6166 }
@@ -140,6 +145,7 @@ var _ = Describe("Legacy Options", func() {
140145 passHostHeader := false
141146 proxyWebSockets := true
142147 flushInterval := Duration(5 * time.Second)
148+ timeout := Duration(5 * time.Second)
143149
144150 // Test cases and expected outcomes
145151 validHTTP := "http://foo.bar/baz"
@@ -151,6 +157,7 @@ var _ = Describe("Legacy Options", func() {
151157 PassHostHeader: &passHostHeader,
152158 ProxyWebSockets: &proxyWebSockets,
153159 FlushInterval: &flushInterval,
160+ Timeout: &timeout,
154161 }
155162
156163 // Test cases and expected outcomes
@@ -163,6 +170,7 @@ var _ = Describe("Legacy Options", func() {
163170 PassHostHeader: &passHostHeader,
164171 ProxyWebSockets: &proxyWebSockets,
165172 FlushInterval: &flushInterval,
173+ Timeout: &timeout,
166174 }
167175
168176 validFileWithFragment := "file:///var/lib/website#/bar"
@@ -174,6 +182,7 @@ var _ = Describe("Legacy Options", func() {
174182 PassHostHeader: &passHostHeader,
175183 ProxyWebSockets: &proxyWebSockets,
176184 FlushInterval: &flushInterval,
185+ Timeout: &timeout,
177186 }
178187
179188 validStatic := "static://204"
@@ -188,6 +197,7 @@ var _ = Describe("Legacy Options", func() {
188197 PassHostHeader: nil,
189198 ProxyWebSockets: nil,
190199 FlushInterval: nil,
200+ Timeout: nil,
191201 }
192202
193203 invalidStatic := "static://abc"
@@ -202,6 +212,7 @@ var _ = Describe("Legacy Options", func() {
202212 PassHostHeader: nil,
203213 ProxyWebSockets: nil,
204214 FlushInterval: nil,
215+ Timeout: nil,
205216 }
206217
207218 invalidHTTP := ":foo"
@@ -215,6 +226,7 @@ var _ = Describe("Legacy Options", func() {
215226 PassHostHeader: passHostHeader,
216227 ProxyWebSockets: proxyWebSockets,
217228 FlushInterval: time.Duration(flushInterval),
229+ Timeout: time.Duration(timeout),
218230 }
219231
220232 upstreams, err := legacyUpstreams.convert()
pkg/apis/options/load_test.go+1
@@ -22,6 +22,7 @@ var _ = Describe("Load", func() {
2222 PassHostHeader: true,
2323 ProxyWebSockets: true,
2424 FlushInterval: DefaultUpstreamFlushInterval,
25+ Timeout: DefaultUpstreamTimeout,
2526 },
2627
2728 LegacyHeaders: LegacyHeaders{
pkg/apis/options/upstreams.go+7
@@ -5,6 +5,9 @@ import "time"
55const (
66 // DefaultUpstreamFlushInterval is the default value for the Upstream FlushInterval.
77 DefaultUpstreamFlushInterval = 1 * time.Second
8+
9+ // DefaultUpstreamTimeout is the maximum duration a network dial to a upstream server for a response.
10+ DefaultUpstreamTimeout = 30 * time.Second
811)
912
1013// UpstreamConfig is a collection of definitions for upstream servers.
@@ -84,4 +87,8 @@ type Upstream struct {
8487 // ProxyWebSockets enables proxying of websockets to upstream servers
8588 // Defaults to true.
8689 ProxyWebSockets *bool `json:"proxyWebSockets,omitempty"`
90+
91+ // Timeout is the maximum duration the server will wait for a response from the upstream server.
92+ // Defaults to 30 seconds.
93+ Timeout *Duration `json:"timeout,omitempty"`
8794}
pkg/upstream/http.go+22−7
@@ -1,7 +1,6 @@
11package upstream
22
33import (
4− "crypto/tls"
54 "net/http"
65 "net/http/httputil"
76 "net/url"
@@ -100,6 +99,14 @@ func (h *httpUpstreamProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request)
10099func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler ProxyErrorHandler) http.Handler {
101100 proxy := httputil.NewSingleHostReverseProxy(target)
102101
102+ // Inherit default transport options from Go's stdlib
103+ transport := http.DefaultTransport.(*http.Transport).Clone()
104+
105+ // Change default duration for waiting for an upstream response
106+ if upstream.Timeout != nil {
107+ transport.ResponseHeaderTimeout = upstream.Timeout.Duration()
108+ }
109+
103110 // Configure options on the SingleHostReverseProxy
104111 if upstream.FlushInterval != nil {
105112 proxy.FlushInterval = upstream.FlushInterval.Duration()
@@ -110,9 +117,7 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr
110117 // InsecureSkipVerify is a configurable option we allow
111118 /* #nosec G402 */
112119 if upstream.InsecureSkipTLSVerify {
113− proxy.Transport = &http.Transport{
114− TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
115− }
120+ transport.TLSClientConfig.InsecureSkipVerify = true
116121 }
117122
118123 // Ensure we always pass the original request path
@@ -127,6 +132,10 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr
127132 if errorHandler != nil {
128133 proxy.ErrorHandler = errorHandler
129134 }
135+
136+ // Apply the customized transport to our proxy before returning it
137+ proxy.Transport = transport
138+
130139 return proxy
131140}
132141
@@ -156,11 +165,17 @@ func setProxyDirector(proxy *httputil.ReverseProxy) {
156165// newWebSocketReverseProxy creates a new reverse proxy for proxying websocket connections.
157166func newWebSocketReverseProxy(u *url.URL, skipTLSVerify bool) http.Handler {
158167 wsProxy := httputil.NewSingleHostReverseProxy(u)
168+
169+ // Inherit default transport options from Go's stdlib
170+ transport := http.DefaultTransport.(*http.Transport).Clone()
171+
159172 /* #nosec G402 */
160173 if skipTLSVerify {
161− wsProxy.Transport = &http.Transport{
162− TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
163− }
174+ transport.TLSClientConfig.InsecureSkipVerify = true
164175 }
176+
177+ // Apply the customized transport to our proxy before returning it
178+ wsProxy.Transport = transport
179+
165180 return wsProxy
166181}
pkg/upstream/http_test.go+33−14
@@ -3,7 +3,6 @@ package upstream
33import (
44 "bytes"
55 "crypto"
6− "crypto/tls"
76 "encoding/json"
87 "fmt"
98 "net/http"
@@ -23,9 +22,8 @@ import (
2322)
2423
2524var _ = Describe("HTTP Upstream Suite", func() {
26−
27− const flushInterval5s = options.Duration(5 * time.Second)
28− const flushInterval1s = options.Duration(1 * time.Second)
25+ defaultFlushInterval := options.Duration(options.DefaultUpstreamFlushInterval)
26+ defaultTimeout := options.Duration(options.DefaultUpstreamTimeout)
2927 truth := true
3028 falsum := false
3129
@@ -62,12 +60,15 @@ var _ = Describe("HTTP Upstream Suite", func() {
6260
6361 flush := options.Duration(1 * time.Second)
6462
63+ timeout := options.Duration(options.DefaultUpstreamTimeout)
64+
6565 upstream := options.Upstream{
6666 ID: in.id,
6767 PassHostHeader: &in.passUpstreamHostHeader,
6868 ProxyWebSockets: &falsum,
6969 InsecureSkipTLSVerify: false,
7070 FlushInterval: &flush,
71+ Timeout: &timeout,
7172 }
7273
7374 Expect(in.serverAddr).ToNot(BeNil())
@@ -318,13 +319,13 @@ var _ = Describe("HTTP Upstream Suite", func() {
318319 req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{})
319320 rw := httptest.NewRecorder()
320321
321− flush := options.Duration(1 * time.Second)
322322 upstream := options.Upstream{
323323 ID: "noPassHost",
324324 PassHostHeader: &falsum,
325325 ProxyWebSockets: &falsum,
326326 InsecureSkipTLSVerify: false,
327− FlushInterval: &flush,
327+ FlushInterval: &defaultFlushInterval,
328+ Timeout: &defaultTimeout,
328329 }
329330
330331 u, err := url.Parse(serverAddr)
@@ -354,6 +355,7 @@ var _ = Describe("HTTP Upstream Suite", func() {
354355 skipVerify bool
355356 sigData *options.SignatureData
356357 errorHandler func(http.ResponseWriter, *http.Request, error)
358+ timeout options.Duration
357359 }
358360
359361 DescribeTable("newHTTPUpstreamProxy",
@@ -366,6 +368,7 @@ var _ = Describe("HTTP Upstream Suite", func() {
366368 FlushInterval: &in.flushInterval,
367369 InsecureSkipTLSVerify: in.skipVerify,
368370 ProxyWebSockets: &in.proxyWebSockets,
371+ Timeout: &in.timeout,
369372 }
370373
371374 handler := newHTTPUpstreamProxy(upstream, u, in.sigData, in.errorHandler)
@@ -380,49 +383,63 @@ var _ = Describe("HTTP Upstream Suite", func() {
380383 proxy, ok := upstreamProxy.handler.(*httputil.ReverseProxy)
381384 Expect(ok).To(BeTrue())
382385 Expect(proxy.FlushInterval).To(Equal(in.flushInterval.Duration()))
386+ transport, ok := proxy.Transport.(*http.Transport)
387+ Expect(ok).To(BeTrue())
388+ Expect(transport.ResponseHeaderTimeout).To(Equal(in.timeout.Duration()))
383389 Expect(proxy.ErrorHandler != nil).To(Equal(in.errorHandler != nil))
384390 if in.skipVerify {
385− Expect(proxy.Transport).To(Equal(&http.Transport{
386− TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
387− }))
391+ Expect(transport.TLSClientConfig.InsecureSkipVerify).To(Equal(true))
388392 }
389393 },
390394 Entry("with proxy websockets", &newUpstreamTableInput{
391395 proxyWebSockets: true,
392− flushInterval: flushInterval1s,
396+ flushInterval: defaultFlushInterval,
393397 skipVerify: false,
394398 sigData: nil,
395399 errorHandler: nil,
400+ timeout: defaultTimeout,
396401 }),
397402 Entry("with a non standard flush interval", &newUpstreamTableInput{
398403 proxyWebSockets: false,
399− flushInterval: flushInterval5s,
404+ flushInterval: options.Duration(5 * time.Second),
400405 skipVerify: false,
401406 sigData: nil,
402407 errorHandler: nil,
408+ timeout: defaultTimeout,
403409 }),
404410 Entry("with a InsecureSkipTLSVerify", &newUpstreamTableInput{
405411 proxyWebSockets: false,
406− flushInterval: flushInterval1s,
412+ flushInterval: defaultFlushInterval,
407413 skipVerify: true,
408414 sigData: nil,
409415 errorHandler: nil,
416+ timeout: defaultTimeout,
410417 }),
411418 Entry("with a SignatureData", &newUpstreamTableInput{
412419 proxyWebSockets: false,
413− flushInterval: flushInterval1s,
420+ flushInterval: defaultFlushInterval,
414421 skipVerify: false,
415422 sigData: &options.SignatureData{Hash: crypto.SHA256, Key: "secret"},
416423 errorHandler: nil,
424+ timeout: defaultTimeout,
417425 }),
418426 Entry("with an error handler", &newUpstreamTableInput{
419427 proxyWebSockets: false,
420− flushInterval: flushInterval1s,
428+ flushInterval: defaultFlushInterval,
421429 skipVerify: false,
422430 sigData: nil,
423431 errorHandler: func(rw http.ResponseWriter, req *http.Request, arg3 error) {
424432 rw.WriteHeader(502)
425433 },
434+ timeout: defaultTimeout,
435+ }),
436+ Entry("with a non-default timeout", &newUpstreamTableInput{
437+ proxyWebSockets: false,
438+ flushInterval: defaultFlushInterval,
439+ skipVerify: false,
440+ sigData: nil,
441+ errorHandler: nil,
442+ timeout: options.Duration(5 * time.Second),
426443 }),
427444 )
428445
@@ -431,12 +448,14 @@ var _ = Describe("HTTP Upstream Suite", func() {
431448
432449 BeforeEach(func() {
433450 flush := options.Duration(1 * time.Second)
451+ timeout := options.Duration(options.DefaultUpstreamTimeout)
434452 upstream := options.Upstream{
435453 ID: "websocketProxy",
436454 PassHostHeader: &truth,
437455 ProxyWebSockets: &truth,
438456 InsecureSkipTLSVerify: false,
439457 FlushInterval: &flush,
458+ Timeout: &timeout,
440459 }
441460
442461 u, err := url.Parse(serverAddr)