9bbd6ad · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Integrate HealthCheck middleware

commit9bbd6adce97057d2107d60b2a9494974bbc8a601 authorJoel Speed <joel.speed@hotmail.co.uk> dateSun 14 Jun 2020, 20:58 (6 years ago) parentca416a2

8 files changed+45−260

compare with master

unifiedsplit

http.go+7−39 http_test.go−99 logging_handler.go+1−4 logging_handler_test.go+13−76 main.go+21−5 oauthproxy.go−30 pkg/validation/logging.go+2−6 pkg/validation/options.go+1−1

http.go+7−39

@@ -9,6 +9,7 @@ import (

99 "strings"

1010 "time"

1111

12+ "github.com/justinas/alice"

1213 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"

1314 "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

1415)

@@ -29,45 +30,6 @@ func (s *Server) ListenAndServe() {

2930 }

3031}

3132

32−// Used with gcpHealthcheck()

33−const userAgentHeader = "User-Agent"

34−const googleHealthCheckUserAgent = "GoogleHC/1.0"

35−const rootPath = "/"

36−

37−// gcpHealthcheck handles healthcheck queries from GCP.

38−func gcpHealthcheck(h http.Handler) http.Handler {

39− return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

40− // Check for liveness and readiness: used for Google App Engine

41− if r.URL.EscapedPath() == "/liveness_check" {

42− w.WriteHeader(http.StatusOK)

43− w.Write([]byte("OK"))

44− return

45− }

46− if r.URL.EscapedPath() == "/readiness_check" {

47− w.WriteHeader(http.StatusOK)

48− w.Write([]byte("OK"))

49− return

50− }

51−

52− // Check for GKE ingress healthcheck: The ingress requires the root

53− // path of the target to return a 200 (OK) to indicate the service's good health. This can be quite a challenging demand

54− // depending on the application's path structure. This middleware filters out the requests from the health check by

55− //

56− // 1. checking that the request path is indeed the root path

57− // 2. ensuring that the User-Agent is "GoogleHC/1.0", the health checker

58− // 3. ensuring the request method is "GET"

59− if r.URL.Path == rootPath &&

60− r.Header.Get(userAgentHeader) == googleHealthCheckUserAgent &&

61− r.Method == http.MethodGet {

62−

63− w.WriteHeader(http.StatusOK)

64− return

65− }

66−

67− h.ServeHTTP(w, r)

68− })

69−}

70−

7133// ServeHTTP constructs a net.Listener and starts handling HTTP requests

7234func (s *Server) ServeHTTP() {

7335 HTTPAddress := s.Opts.HTTPAddress

@@ -168,6 +130,12 @@ func (ln tcpKeepAliveListener) Accept() (c net.Conn, err error) {

168130 return tc, nil

169131}

170132

133+func newRedirectToHTTPS(opts *options.Options) alice.Constructor {

134+ return func(next http.Handler) http.Handler {

135+ return redirectToHTTPS(opts, next)

136+ }

137+}

138+

171139func redirectToHTTPS(opts *options.Options, h http.Handler) http.Handler {

172140 return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

173141 proto := r.Header.Get("X-Forwarded-Proto")

http_test.go−99

@@ -11,105 +11,6 @@ import (

1111 "github.com/stretchr/testify/assert"

1212)

1313

14−const localhost = "127.0.0.1"

15−const host = "test-server"

16−

17−func TestGCPHealthcheckLiveness(t *testing.T) {

18− handler := func(w http.ResponseWriter, req *http.Request) {

19− w.Write([]byte("test"))

20− }

21−

22− h := gcpHealthcheck(http.HandlerFunc(handler))

23− rw := httptest.NewRecorder()

24− r, _ := http.NewRequest("GET", "/liveness_check", nil)

25− r.RemoteAddr = localhost

26− r.Host = host

27− h.ServeHTTP(rw, r)

28−

29− assert.Equal(t, 200, rw.Code)

30− assert.Equal(t, "OK", rw.Body.String())

31−}

32−

33−func TestGCPHealthcheckReadiness(t *testing.T) {

34− handler := func(w http.ResponseWriter, req *http.Request) {

35− w.Write([]byte("test"))

36− }

37−

38− h := gcpHealthcheck(http.HandlerFunc(handler))

39− rw := httptest.NewRecorder()

40− r, _ := http.NewRequest("GET", "/readiness_check", nil)

41− r.RemoteAddr = localhost

42− r.Host = host

43− h.ServeHTTP(rw, r)

44−

45− assert.Equal(t, 200, rw.Code)

46− assert.Equal(t, "OK", rw.Body.String())

47−}

48−

49−func TestGCPHealthcheckNotHealthcheck(t *testing.T) {

50− handler := func(w http.ResponseWriter, req *http.Request) {

51− w.Write([]byte("test"))

52− }

53−

54− h := gcpHealthcheck(http.HandlerFunc(handler))

55− rw := httptest.NewRecorder()

56− r, _ := http.NewRequest("GET", "/not_any_check", nil)

57− r.RemoteAddr = localhost

58− r.Host = host

59− h.ServeHTTP(rw, r)

60−

61− assert.Equal(t, "test", rw.Body.String())

62−}

63−

64−func TestGCPHealthcheckIngress(t *testing.T) {

65− handler := func(w http.ResponseWriter, req *http.Request) {

66− w.Write([]byte("test"))

67− }

68−

69− h := gcpHealthcheck(http.HandlerFunc(handler))

70− rw := httptest.NewRecorder()

71− r, _ := http.NewRequest("GET", "/", nil)

72− r.RemoteAddr = localhost

73− r.Host = host

74− r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)

75− h.ServeHTTP(rw, r)

76−

77− assert.Equal(t, 200, rw.Code)

78− assert.Equal(t, "", rw.Body.String())

79−}

80−

81−func TestGCPHealthcheckNotIngress(t *testing.T) {

82− handler := func(w http.ResponseWriter, req *http.Request) {

83− w.Write([]byte("test"))

84− }

85−

86− h := gcpHealthcheck(http.HandlerFunc(handler))

87− rw := httptest.NewRecorder()

88− r, _ := http.NewRequest("GET", "/foo", nil)

89− r.RemoteAddr = localhost

90− r.Host = host

91− r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)

92− h.ServeHTTP(rw, r)

93−

94− assert.Equal(t, "test", rw.Body.String())

95−}

96−

97−func TestGCPHealthcheckNotIngressPut(t *testing.T) {

98− handler := func(w http.ResponseWriter, req *http.Request) {

99− w.Write([]byte("test"))

100− }

101−

102− h := gcpHealthcheck(http.HandlerFunc(handler))

103− rw := httptest.NewRecorder()

104− r, _ := http.NewRequest("PUT", "/", nil)

105− r.RemoteAddr = localhost

106− r.Host = host

107− r.Header.Set(userAgentHeader, googleHealthCheckUserAgent)

108− h.ServeHTTP(rw, r)

109−

110− assert.Equal(t, "test", rw.Body.String())

111−}

112−

11314func TestRedirectToHTTPSTrue(t *testing.T) {

11415 opts := options.NewOptions()

11516 opts.ForceHTTPS = true

logging_handler.go+1−4

@@ -21,7 +21,6 @@ type responseLogger struct {

2121 size int

2222 upstream string

2323 authInfo string

24− silent bool

2524}

2625

2726// Header returns the ResponseWriter's Header

@@ -105,7 +104,5 @@ func (h loggingHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {

105104 url := *req.URL

106105 responseLogger := &responseLogger{w: w}

107106 h.handler.ServeHTTP(responseLogger, req)

108− if !responseLogger.silent {

109− logger.PrintReq(responseLogger.authInfo, responseLogger.upstream, req, url, t, responseLogger.Status(), responseLogger.Size())

110− }

107+ logger.PrintReq(responseLogger.authInfo, responseLogger.upstream, req, url, t, responseLogger.Status(), responseLogger.Size())

111108}

logging_handler_test.go+13−76

@@ -5,14 +5,11 @@ import (

55 "fmt"

66 "net/http"

77 "net/http/httptest"

8− "net/url"

98 "strings"

109 "testing"

1110 "time"

1211

13− "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"

1412 "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

15− "github.com/oauth2-proxy/oauth2-proxy/pkg/validation"

1613)

1714

1815func TestLoggingHandler_ServeHTTP(t *testing.T) {

@@ -22,21 +19,20 @@ func TestLoggingHandler_ServeHTTP(t *testing.T) {

2219 Format,

2320 ExpectedLogMessage,

2421 Path string

25− ExcludePaths []string

26− SilencePingLogging bool

22+ ExcludePaths []string

2723 }{

28− {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", []string{}, false},

29− {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", []string{}, true},

30− {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", []string{"/ping"}, false},

31− {logger.DefaultRequestLoggingFormat, "", "/foo/bar", []string{"/foo/bar"}, false},

32− {logger.DefaultRequestLoggingFormat, "", "/ping", []string{}, true},

33− {logger.DefaultRequestLoggingFormat, "", "/ping", []string{"/ping"}, false},

34− {logger.DefaultRequestLoggingFormat, "", "/ping", []string{"/ping"}, true},

35− {logger.DefaultRequestLoggingFormat, "", "/ping", []string{"/foo/bar", "/ping"}, false},

36− {"{{.RequestMethod}}", "GET\n", "/foo/bar", []string{}, true},

37− {"{{.RequestMethod}}", "GET\n", "/foo/bar", []string{"/ping"}, false},

38− {"{{.RequestMethod}}", "GET\n", "/ping", []string{}, false},

39− {"{{.RequestMethod}}", "", "/ping", []string{"/ping"}, true},

24+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", []string{}},

25+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", []string{}},

26+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", []string{"/ping"}},

27+ {logger.DefaultRequestLoggingFormat, "", "/foo/bar", []string{"/foo/bar"}},

28+ {logger.DefaultRequestLoggingFormat, "", "/ping", []string{}},

29+ {logger.DefaultRequestLoggingFormat, "", "/ping", []string{"/ping"}},

30+ {logger.DefaultRequestLoggingFormat, "", "/ping", []string{"/ping"}},

31+ {logger.DefaultRequestLoggingFormat, "", "/ping", []string{"/foo/bar", "/ping"}},

32+ {"{{.RequestMethod}}", "GET\n", "/foo/bar", []string{}},

33+ {"{{.RequestMethod}}", "GET\n", "/foo/bar", []string{"/ping"}},

34+ {"{{.RequestMethod}}", "GET\n", "/ping", []string{}},

35+ {"{{.RequestMethod}}", "", "/ping", []string{"/ping"}},

4036 }

4137

4238 for _, test := range tests {

@@ -52,9 +48,6 @@ func TestLoggingHandler_ServeHTTP(t *testing.T) {

5248

5349 logger.SetOutput(buf)

5450 logger.SetReqTemplate(test.Format)

55− if test.SilencePingLogging {

56− test.ExcludePaths = append(test.ExcludePaths, "/ping")

57− }

5851 logger.SetExcludePaths(test.ExcludePaths)

5952 h := LoggingHandler(http.HandlerFunc(handler))

6053

@@ -70,59 +63,3 @@ func TestLoggingHandler_ServeHTTP(t *testing.T) {

7063 }

7164 }

7265}

73−

74−func TestLoggingHandler_PingUserAgent(t *testing.T) {

75− tests := []struct {

76− ExpectedLogMessage string

77− Path string

78− SilencePingLogging bool

79− WithUserAgent string

80− }{

81− {"444\n", "/foo", true, "Blah"},

82− {"444\n", "/foo", false, "Blah"},

83− {"", "/ping", true, "Blah"},

84− {"200\n", "/ping", false, "Blah"},

85− {"", "/ping", true, "PingMe!"},

86− {"", "/ping", false, "PingMe!"},

87− {"", "/foo", true, "PingMe!"},

88− {"", "/foo", false, "PingMe!"},

89− }

90−

91− for idx, test := range tests {

92− t.Run(fmt.Sprintf("%d", idx), func(t *testing.T) {

93− opts := options.NewOptions()

94− opts.PingUserAgent = "PingMe!"

95− opts.SkipAuthRegex = []string{"/foo"}

96− opts.Upstreams = []string{"static://444/foo"}

97− opts.Logging.SilencePing = test.SilencePingLogging

98− if test.SilencePingLogging {

99− opts.Logging.ExcludePaths = []string{"/ping"}

100− }

101− opts.RawRedirectURL = "localhost"

102− validation.Validate(opts)

103−

104− p := NewOAuthProxy(opts, func(email string) bool {

105− return true

106− })

107− p.provider = NewTestProvider(&url.URL{Host: "localhost"}, "")

108−

109− buf := bytes.NewBuffer(nil)

110− logger.SetOutput(buf)

111− logger.SetReqEnabled(true)

112− logger.SetReqTemplate("{{.StatusCode}}")

113−

114− r, _ := http.NewRequest("GET", test.Path, nil)

115− if test.WithUserAgent != "" {

116− r.Header.Set("User-Agent", test.WithUserAgent)

117− }

118−

119− h := LoggingHandler(p)

120− h.ServeHTTP(httptest.NewRecorder(), r)

121−

122− actual := buf.String()

123− if !strings.Contains(actual, test.ExpectedLogMessage) {

124− t.Errorf("Log message was\n%s\ninstead of matching \n%s", actual, test.ExpectedLogMessage)

125− }

126− })

127− }

128−}

main.go+21−5

@@ -3,7 +3,6 @@ package main

33import (

44 "fmt"

55 "math/rand"

6− "net/http"

76 "os"

87 "os/signal"

98 "runtime"

@@ -11,8 +10,10 @@ import (

1110 "syscall"

1211 "time"

1312

13+ "github.com/justinas/alice"

1414 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"

1515 "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

16+ "github.com/oauth2-proxy/oauth2-proxy/pkg/middleware"

1617 "github.com/oauth2-proxy/oauth2-proxy/pkg/validation"

1718)

1819

@@ -71,14 +72,29 @@ func main() {

7172

7273 rand.Seed(time.Now().UnixNano())

7374

74− var handler http.Handler

75+ chain := alice.New()

76+

77+ if opts.ForceHTTPS {

78+ chain = chain.Append(newRedirectToHTTPS(opts))

79+ }

80+

81+ healthCheckPaths := []string{opts.PingPath}

82+ healthCheckUserAgents := []string{opts.PingUserAgent}

7583 if opts.GCPHealthChecks {

76− handler = redirectToHTTPS(opts, gcpHealthcheck(LoggingHandler(oauthproxy)))

84+ healthCheckPaths = append(healthCheckPaths, "/liveness_check", "/readiness_check")

85+ healthCheckUserAgents = append(healthCheckUserAgents, "GoogleHC/1.0")

86+ }

87+

88+ // To silence logging of health checks, register the health check handler before

89+ // the logging handler

90+ if opts.Logging.SilencePing {

91+ chain = chain.Append(middleware.NewHealthCheck(healthCheckPaths, healthCheckUserAgents), LoggingHandler)

7792 } else {

78− handler = redirectToHTTPS(opts, LoggingHandler(oauthproxy))

93+ chain = chain.Append(LoggingHandler, middleware.NewHealthCheck(healthCheckPaths, healthCheckUserAgents))

7994 }

95+

8096 s := &Server{

81− Handler: handler,

97+ Handler: chain.Then(oauthproxy),

8298 Opts: opts,

8399 stop: make(chan struct{}, 1),

84100 }

oauthproxy.go−30

@@ -81,9 +81,6 @@ type OAuthProxy struct {

8181 Validator func(string) bool

8282

8383 RobotsPath string

84− PingPath string

85− PingUserAgent string

86− SilencePings bool

8784 SignInPath string

8885 SignOutPath string

8986 OAuthStartPath string

@@ -313,9 +310,6 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) *OAuthPro

313310 Validator: validator,

314311

315312 RobotsPath: "/robots.txt",

316− PingPath: opts.PingPath,

317− PingUserAgent: opts.PingUserAgent,

318− SilencePings: opts.Logging.SilencePing,

319313 SignInPath: fmt.Sprintf("%s/sign_in", opts.ProxyPrefix),

320314 SignOutPath: fmt.Sprintf("%s/sign_out", opts.ProxyPrefix),

321315 OAuthStartPath: fmt.Sprintf("%s/start", opts.ProxyPrefix),

@@ -468,17 +462,6 @@ func (p *OAuthProxy) RobotsTxt(rw http.ResponseWriter) {

468462 fmt.Fprintf(rw, "User-agent: *\nDisallow: /")

469463}

470464

471−// PingPage responds 200 OK to requests

472−func (p *OAuthProxy) PingPage(rw http.ResponseWriter) {

473− if p.SilencePings {

474− if rl, ok := rw.(*responseLogger); ok {

475− rl.silent = true

476− }

477− }

478− rw.WriteHeader(http.StatusOK)

479− fmt.Fprintf(rw, "OK")

480−}

481−

482465// ErrorPage writes an error response

483466func (p *OAuthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, message string) {

484467 rw.WriteHeader(code)

@@ -684,17 +667,6 @@ func prepareNoCache(w http.ResponseWriter) {

684667 }

685668}

686669

687−// IsPingRequest will check if the request appears to be performing a health check

688−// either via the path it's requesting or by a special User-Agent configuration.

689−func (p *OAuthProxy) IsPingRequest(req *http.Request) bool {

690−

691− if req.URL.EscapedPath() == p.PingPath {

692− return true

693− }

694−

695− return p.PingUserAgent != "" && req.Header.Get("User-Agent") == p.PingUserAgent

696−}

697−

698670func (p *OAuthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {

699671 if strings.HasPrefix(req.URL.Path, p.ProxyPrefix) {

700672 prepareNoCache(rw)

@@ -703,8 +675,6 @@ func (p *OAuthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {

703675 switch path := req.URL.Path; {

704676 case path == p.RobotsPath:

705677 p.RobotsTxt(rw)

706− case p.IsPingRequest(req):

707− p.PingPage(rw)

708678 case p.IsWhitelistedRequest(req):

709679 p.serveMux.ServeHTTP(rw, req)

710680 case path == p.SignInPath:

pkg/validation/logging.go+2−6

@@ -9,7 +9,7 @@ import (

99)

1010

1111// configureLogger is responsible for configuring the logger based on the options given

12−func configureLogger(o options.Logging, pingPath string, msgs []string) []string {

12+func configureLogger(o options.Logging, msgs []string) []string {

1313 // Setup the log file

1414 if len(o.File.Filename) > 0 {

1515 // Validate that the file/dir can be written

@@ -48,11 +48,7 @@ func configureLogger(o options.Logging, pingPath string, msgs []string) []string

4848 logger.SetAuthTemplate(o.AuthFormat)

4949 logger.SetReqTemplate(o.RequestFormat)

5050

51− excludePaths := o.ExcludePaths

52− if o.SilencePing {

53− excludePaths = append(excludePaths, pingPath)

54− }

55− logger.SetExcludePaths(excludePaths)

51+ logger.SetExcludePaths(o.ExcludePaths)

5652

5753 if !o.LocalTime {

5854 logger.SetFlags(logger.Flags() | logger.LUTC)

pkg/validation/options.go+1−1

@@ -264,7 +264,7 @@ func Validate(o *options.Options) error {

264264

265265 msgs = parseSignatureKey(o, msgs)

266266 msgs = validateCookieName(o, msgs)

267− msgs = configureLogger(o.Logging, o.PingPath, msgs)

267+ msgs = configureLogger(o.Logging, msgs)

268268

269269 if o.ReverseProxy {

270270 parser, err := ip.GetRealClientIPParser(o.RealClientIPHeader)