8635391 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Merge pull request #178 from kskewes/pinglog

Add silence-ping-logging flag

commit863539154366f456d8ba57142b3a66b4544fda82 authorJoel Speed <Joel.speed@hotmail.co.uk> dateFri 19 Jul 2019, 11:30 (7 years ago) parent2c104c4 f29e353

8 files changed+75−14

compare with master

unifiedsplit

CHANGELOG.md+1 docs/configuration/configuration.md+5 logging_handler.go+3−2 logging_handler_test.go+21−4 main.go+3 oauthproxy.go+1−1 options.go+20−7 pkg/logger/logger.go+21

CHANGELOG.md+1

@@ -31,6 +31,7 @@

3131

3232## Changes since v3.2.0

3333

34+- [#178](https://github.com/pusher/outh2_proxy/pull/178) Add Silence Ping Logging and Exclude Logging Paths flags (@kskewes)

3435- [#209](https://github.com/pusher/outh2_proxy/pull/209) Improve docker build caching of layers (@dekimsey)

3536- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent (@JoelSpeed)

3637- [#187](https://github.com/pusher/oauth2_proxy/pull/187) Move root packages to pkg folder (@JoelSpeed)

docs/configuration/configuration.md+5

@@ -42,6 +42,7 @@ Usage of oauth2_proxy:

4242 -display-htpasswd-form: display username / password login form if an htpasswd file is provided (default true)

4343 -email-domain value: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email

4444 -extra-jwt-issuers: if -skip-jwt-bearer-tokens is set, a list of extra JWT issuer=audience pairs (where the issuer URL has a .well-known/openid-configuration or a .well-known/jwks.json)

45+ -exclude-logging-paths: comma separated list of paths to exclude from logging, eg: "/ping,/path2" (default "" = no paths excluded)

4546 -flush-interval: period between flushing response buffers when streaming responses (default "1s")

4647 -banner string: custom banner string. Use "-" to disable default banner.

4748 -footer string: custom footer string. Use "-" to disable default footer.

@@ -73,6 +74,7 @@ Usage of oauth2_proxy:

7374 -pass-user-headers: pass X-Forwarded-User and X-Forwarded-Email information to upstream (default true)

7475 -profile-url string: Profile access endpoint

7576 -provider string: OAuth provider (default "google")

77+ -ping-path string: the ping endpoint that can be used for basic health checks (default "/ping")

7678 -proxy-prefix string: the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in) (default "/oauth2")

7779 -proxy-websockets: enables WebSocket proxying (default true)

7880 -pubjwk-url string: JWK pubkey access endpoint: required by login.gov

@@ -90,6 +92,7 @@ Usage of oauth2_proxy:

9092 -set-xauthrequest: set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)

9193 -set-authorization-header: set Authorization Bearer response header (useful in Nginx auth_request mode)

9294 -signature-key string: GAP-Signature request signature key (algorithm:secretkey)

95+ -silence-ping-logging bool: disable logging of requests to ping endpoint (default false)

9396 -skip-auth-preflight: will skip authentication for OPTIONS requests

9497 -skip-auth-regex value: bypass authentication for requests path's that match (may be given multiple times)

9598 -skip-jwt-bearer-tokens: will skip requests that have verified JWT bearer tokens

@@ -139,6 +142,8 @@ There are three different types of logging: standard, authentication, and HTTP r

139142

140143Each type of logging has their own configurable format and variables. By default these formats are similar to the Apache Combined Log.

141144

145+Logging of requests to the `/ping` endpoint can be disabled with `-silence-ping-logging` reducing log volume. This flag appends the `-ping-path` to `-exclude-logging-paths`.

146+

142147### Auth Log Format

143148Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:

144149

logging_handler.go+3−2

@@ -75,18 +75,19 @@ func (l *responseLogger) Status() int {

7575 return l.status

7676}

7777

78−// Size returns teh response size

78+// Size returns the response size

7979func (l *responseLogger) Size() int {

8080 return l.size

8181}

8282

83+// Flush sends any buffered data to the client

8384func (l *responseLogger) Flush() {

8485 if flusher, ok := l.w.(http.Flusher); ok {

8586 flusher.Flush()

8687 }

8788}

8889

89−// loggingHandler is the http.Handler implementation for LoggingHandlerTo and its friends

90+// loggingHandler is the http.Handler implementation for LoggingHandler

9091type loggingHandler struct {

9192 handler http.Handler

9293}

logging_handler_test.go+21−4

@@ -17,10 +17,23 @@ func TestLoggingHandler_ServeHTTP(t *testing.T) {

1717

1818 tests := []struct {

1919 Format,

20− ExpectedLogMessage string

20+ ExpectedLogMessage,

21+ Path string

22+ ExcludePaths []string

23+ SilencePingLogging bool

2124 }{

22− {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts))},

23− {"{{.RequestMethod}}", "GET\n"},

25+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", []string{}, false},

26+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", []string{}, true},

27+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", []string{"/ping"}, false},

28+ {logger.DefaultRequestLoggingFormat, "", "/foo/bar", []string{"/foo/bar"}, false},

29+ {logger.DefaultRequestLoggingFormat, "", "/ping", []string{}, true},

30+ {logger.DefaultRequestLoggingFormat, "", "/ping", []string{"/ping"}, false},

31+ {logger.DefaultRequestLoggingFormat, "", "/ping", []string{"/ping"}, true},

32+ {logger.DefaultRequestLoggingFormat, "", "/ping", []string{"/foo/bar", "/ping"}, false},

33+ {"{{.RequestMethod}}", "GET\n", "/foo/bar", []string{}, true},

34+ {"{{.RequestMethod}}", "GET\n", "/foo/bar", []string{"/ping"}, false},

35+ {"{{.RequestMethod}}", "GET\n", "/ping", []string{}, false},

36+ {"{{.RequestMethod}}", "", "/ping", []string{"/ping"}, true},

2437 }

2538

2639 for _, test := range tests {

@@ -36,9 +49,13 @@ func TestLoggingHandler_ServeHTTP(t *testing.T) {

3649

3750 logger.SetOutput(buf)

3851 logger.SetReqTemplate(test.Format)

52+ if test.SilencePingLogging {

53+ test.ExcludePaths = append(test.ExcludePaths, "/ping")

54+ }

55+ logger.SetExcludePaths(test.ExcludePaths)

3956 h := LoggingHandler(http.HandlerFunc(handler))

4057

41− r, _ := http.NewRequest("GET", "/foo/bar", nil)

58+ r, _ := http.NewRequest("GET", test.Path, nil)

4259 r.RemoteAddr = "127.0.0.1"

4360 r.Host = "test-server"

4461

main.go+3

@@ -69,6 +69,7 @@ func main() {

6969 flagSet.String("banner", "", "custom banner string. Use \"-\" to disable default banner.")

7070 flagSet.String("footer", "", "custom footer string. Use \"-\" to disable default footer.")

7171 flagSet.String("proxy-prefix", "/oauth2", "the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in)")

72+ flagSet.String("ping-path", "/ping", "the ping endpoint that can be used for basic health checks")

7273 flagSet.Bool("proxy-websockets", true, "enables WebSocket proxying")

7374

7475 flagSet.String("cookie-name", "_oauth2_proxy", "the name of the cookie that the oauth_proxy creates")

@@ -98,6 +99,8 @@ func main() {

9899

99100 flagSet.Bool("request-logging", true, "Log HTTP requests")

100101 flagSet.String("request-logging-format", logger.DefaultRequestLoggingFormat, "Template for HTTP request log lines")

102+ flagSet.String("exclude-logging-paths", "", "Exclude logging requests to paths (eg: '/path1,/path2,/path3')")

103+ flagSet.Bool("silence-ping-logging", false, "Disable logging of requests to ping endpoint")

101104

102105 flagSet.Bool("auth-logging", true, "Log authentication attempts")

103106 flagSet.String("auth-logging-format", logger.DefaultAuthLoggingFormat, "Template for authentication log lines")

oauthproxy.go+1−1

@@ -254,7 +254,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

254254 Validator: validator,

255255

256256 RobotsPath: "/robots.txt",

257− PingPath: "/ping",

257+ PingPath: opts.PingPath,

258258 SignInPath: fmt.Sprintf("%s/sign_in", opts.ProxyPrefix),

259259 SignOutPath: fmt.Sprintf("%s/sign_out", opts.ProxyPrefix),

260260 OAuthStartPath: fmt.Sprintf("%s/start", opts.ProxyPrefix),

options.go+20−7

@@ -30,6 +30,7 @@ import (

3030// or Config File

3131type Options struct {

3232 ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix" env:"OAUTH2_PROXY_PROXY_PREFIX"`

33+ PingPath string `flag:"ping-path" cfg:"ping_path" env:"OAUTH2_PROXY_PING_PATH"`

3334 ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets" env:"OAUTH2_PROXY_PROXY_WEBSOCKETS"`

3435 HTTPAddress string `flag:"http-address" cfg:"http_address" env:"OAUTH2_PROXY_HTTP_ADDRESS"`

3536 HTTPSAddress string `flag:"https-address" cfg:"https_address" env:"OAUTH2_PROXY_HTTPS_ADDRESS"`

@@ -103,15 +104,16 @@ type Options struct {

103104 StandardLoggingFormat string `flag:"standard-logging-format" cfg:"standard_logging_format" env:"OAUTH2_PROXY_STANDARD_LOGGING_FORMAT"`

104105 RequestLogging bool `flag:"request-logging" cfg:"request_logging" env:"OAUTH2_PROXY_REQUEST_LOGGING"`

105106 RequestLoggingFormat string `flag:"request-logging-format" cfg:"request_logging_format" env:"OAUTH2_PROXY_REQUEST_LOGGING_FORMAT"`

107+ ExcludeLoggingPaths string `flag:"exclude-logging-paths" cfg:"exclude_logging_paths" env:"OAUTH2_PROXY_EXCLUDE_LOGGING_PATHS"`

108+ SilencePingLogging bool `flag:"silence-ping-logging" cfg:"silence_ping_logging" env:"OAUTH2_PROXY_SILENCE_PING_LOGGING"`

106109 AuthLogging bool `flag:"auth-logging" cfg:"auth_logging" env:"OAUTH2_PROXY_LOGGING_AUTH_LOGGING"`

107110 AuthLoggingFormat string `flag:"auth-logging-format" cfg:"auth_logging_format" env:"OAUTH2_PROXY_AUTH_LOGGING_FORMAT"`

108−

109− SignatureKey string `flag:"signature-key" cfg:"signature_key" env:"OAUTH2_PROXY_SIGNATURE_KEY"`

110− AcrValues string `flag:"acr-values" cfg:"acr_values" env:"OAUTH2_PROXY_ACR_VALUES"`

111− JWTKey string `flag:"jwt-key" cfg:"jwt_key" env:"OAUTH2_PROXY_JWT_KEY"`

112− JWTKeyFile string `flag:"jwt-key-file" cfg:"jwt_key_file" env:"OAUTH2_PROXY_JWT_KEY_FILE"`

113− PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url" env:"OAUTH2_PROXY_PUBJWK_URL"`

114− GCPHealthChecks bool `flag:"gcp-healthchecks" cfg:"gcp_healthchecks" env:"OAUTH2_PROXY_GCP_HEALTHCHECKS"`

111+ SignatureKey string `flag:"signature-key" cfg:"signature_key" env:"OAUTH2_PROXY_SIGNATURE_KEY"`

112+ AcrValues string `flag:"acr-values" cfg:"acr_values" env:"OAUTH2_PROXY_ACR_VALUES"`

113+ JWTKey string `flag:"jwt-key" cfg:"jwt_key" env:"OAUTH2_PROXY_JWT_KEY"`

114+ JWTKeyFile string `flag:"jwt-key-file" cfg:"jwt_key_file" env:"OAUTH2_PROXY_JWT_KEY_FILE"`

115+ PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url" env:"OAUTH2_PROXY_PUBJWK_URL"`

116+ GCPHealthChecks bool `flag:"gcp-healthchecks" cfg:"gcp_healthchecks" env:"OAUTH2_PROXY_GCP_HEALTHCHECKS"`

115117

116118 // internal values that are set after config validation

117119 redirectURL *url.URL

@@ -134,6 +136,7 @@ type SignatureData struct {

134136func NewOptions() *Options {

135137 return &Options{

136138 ProxyPrefix: "/oauth2",

139+ PingPath: "/ping",

137140 ProxyWebSockets: true,

138141 HTTPAddress: "127.0.0.1:4180",

139142 HTTPSAddress: ":443",

@@ -165,6 +168,8 @@ func NewOptions() *Options {

165168 LoggingMaxBackups: 0,

166169 LoggingLocalTime: true,

167170 LoggingCompress: false,

171+ ExcludeLoggingPaths: "",

172+ SilencePingLogging: false,

168173 StandardLogging: true,

169174 StandardLoggingFormat: logger.DefaultStandardLoggingFormat,

170175 RequestLogging: true,

@@ -571,6 +576,14 @@ func setupLogger(o *Options, msgs []string) []string {

571576 logger.SetAuthTemplate(o.AuthLoggingFormat)

572577 logger.SetReqTemplate(o.RequestLoggingFormat)

573578

579+ excludePaths := make([]string, 0)

580+ excludePaths = append(excludePaths, strings.Split(o.ExcludeLoggingPaths, ",")...)

581+ if o.SilencePingLogging {

582+ excludePaths = append(excludePaths, o.PingPath)

583+ }

584+

585+ logger.SetExcludePaths(excludePaths)

586+

574587 if !o.LoggingLocalTime {

575588 logger.SetFlags(logger.Flags() | logger.LUTC)

576589 }

pkg/logger/logger.go+21

@@ -88,6 +88,7 @@ type Logger struct {

8888 stdEnabled bool

8989 authEnabled bool

9090 reqEnabled bool

91+ excludePaths map[string]struct{}

9192 stdLogTemplate *template.Template

9293 authTemplate *template.Template

9394 reqTemplate *template.Template

@@ -101,6 +102,7 @@ func New(flag int) *Logger {

101102 stdEnabled: true,

102103 authEnabled: true,

103104 reqEnabled: true,

105+ excludePaths: nil,

104106 stdLogTemplate: template.Must(template.New("std-log").Parse(DefaultStandardLoggingFormat)),

105107 authTemplate: template.Must(template.New("auth-log").Parse(DefaultAuthLoggingFormat)),

106108 reqTemplate: template.Must(template.New("req-log").Parse(DefaultRequestLoggingFormat)),

@@ -177,6 +179,10 @@ func (l *Logger) PrintReq(username, upstream string, req *http.Request, url url.

177179 return

178180 }

179181

182+ if _, ok := l.excludePaths[url.Path]; ok {

183+ return

184+ }

185+

180186 duration := float64(time.Now().Sub(ts)) / float64(time.Second)

181187

182188 if username == "" {

@@ -302,6 +308,16 @@ func (l *Logger) SetReqEnabled(e bool) {

302308 l.reqEnabled = e

303309}

304310

311+// SetExcludePaths sets the paths to exclude from logging.

312+func (l *Logger) SetExcludePaths(s []string) {

313+ l.mu.Lock()

314+ defer l.mu.Unlock()

315+ l.excludePaths = make(map[string]struct{})

316+ for _, p := range s {

317+ l.excludePaths[p] = struct{}{}

318+ }

319+}

320+

305321// SetStandardTemplate sets the template for standard logging.

306322func (l *Logger) SetStandardTemplate(t string) {

307323 l.mu.Lock()

@@ -365,6 +381,11 @@ func SetReqEnabled(e bool) {

365381 std.SetReqEnabled(e)

366382}

367383

384+// SetExcludePaths sets the path to exclude from logging, eg: health checks

385+func SetExcludePaths(s []string) {

386+ std.SetExcludePaths(s)

387+}

388+

368389// SetStandardTemplate sets the template for standard logging for

369390// the standard logger.

370391func SetStandardTemplate(t string) {