git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #309 from lleszczu/customCaForRedis

Add support for Redis with custom CA.

commit9f920b0fc151ffdc057540c7dfdc87c612a2f8e7 authorJoel Speed <Joel.speed@hotmail.co.uk> dateTue 12 Nov 2019, 16:30 (7 years ago) parentfef940d06a283e
4 files changed+33−1
compare with master
unifiedsplit
CHANGELOG.md+1−1 main.go+2 pkg/apis/options/sessions.go+2 pkg/sessions/redis/redis_store.go+28
CHANGELOG.md+1−1
@@ -12,7 +12,7 @@
1212- [#302](https://github.com/pusher/oauth2_proxy/pull/302) Rewrite dist script (@syscll)
1313- [#304](https://github.com/pusher/oauth2_proxy/pull/304) Add new Logo! :tada: (@JoelSpeed)
1414- [#300](https://github.com/pusher/oauth2_proxy/pull/300) Added userinfo endpoint (@kbabuadze)
15−
15+- [#309](https://github.com/pusher/oauth2_proxy/pull/309) Added support for custom CA when connecting to Redis cache
1616# v4.0.0
1717
1818- [#248](https://github.com/pusher/oauth2_proxy/pull/248) Fix issue with X-Auth-Request-Redirect header being ignored
main.go+2
@@ -91,6 +91,8 @@ func main() {
9191 flagSet.String("redis-connection-url", "", "URL of redis server for redis session storage (eg: redis://HOST[:PORT])")
9292 flagSet.Bool("redis-use-sentinel", false, "Connect to redis via sentinels. Must set --redis-sentinel-master-name and --redis-sentinel-connection-urls to use this feature")
9393 flagSet.String("redis-sentinel-master-name", "", "Redis sentinel master name. Used in conjunction with --redis-use-sentinel")
94+ flagSet.String("redis-ca-path", "", "Redis custom CA path")
95+ flagSet.Bool("redis-insecure-skip-tls-verify", false, "Use insecure TLS connection to redis")
9496 flagSet.Var(&redisSentinelConnectionURLs, "redis-sentinel-connection-urls", "List of Redis sentinel connection URLs (eg redis://HOST[:PORT]). Used in conjunction with --redis-use-sentinel")
9597
9698 flagSet.String("logging-filename", "", "File to log requests to, empty for stdout")
pkg/apis/options/sessions.go+2
@@ -27,4 +27,6 @@ type RedisStoreOptions struct {
2727 UseSentinel bool `flag:"redis-use-sentinel" cfg:"redis_use_sentinel" env:"OAUTH2_PROXY_REDIS_USE_SENTINEL"`
2828 SentinelMasterName string `flag:"redis-sentinel-master-name" cfg:"redis_sentinel_master_name" env:"OAUTH2_PROXY_REDIS_SENTINEL_MASTER_NAME"`
2929 SentinelConnectionURLs []string `flag:"redis-sentinel-connection-urls" cfg:"redis_sentinel_connection_urls" env:"OAUTH2_PROXY_REDIS_SENTINEL_CONNECTION_URLS"`
30+ RedisCAPath string `flag:"redis-ca-path" cfg:"redis_ca_path" env:"OAUTH2_PROXY_REDIS_CA_PATH"`
31+ RedisInsecureTLS bool `flag:"redis-insecure-skip-tls-verify" cfg:"redis_insecure_skip_tls_verify" env:"OAUTH2_PROXY_REDIS_INSECURE_SKIP_TLS_VERIFY"`
3032}
pkg/sessions/redis/redis_store.go+28
@@ -4,10 +4,12 @@ import (
44 "crypto/aes"
55 "crypto/cipher"
66 "crypto/rand"
7+ "crypto/x509"
78 "encoding/base64"
89 "encoding/hex"
910 "fmt"
1011 "io"
12+ "io/ioutil"
1113 "net/http"
1214 "strings"
1315 "time"
@@ -17,6 +19,7 @@ import (
1719 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
1820 "github.com/pusher/oauth2_proxy/pkg/cookies"
1921 "github.com/pusher/oauth2_proxy/pkg/encryption"
22+ "github.com/pusher/oauth2_proxy/pkg/logger"
2023)
2124
2225// TicketData is a structure representing the ticket used in server session storage
@@ -64,6 +67,31 @@ func newRedisClient(opts options.RedisStoreOptions) (*redis.Client, error) {
6467 return nil, fmt.Errorf("unable to parse redis url: %s", err)
6568 }
6669
70+ if opts.RedisInsecureTLS != false {
71+ opt.TLSConfig.InsecureSkipVerify = true
72+ }
73+
74+ if opts.RedisCAPath != "" {
75+ rootCAs, err := x509.SystemCertPool()
76+ if err != nil {
77+ logger.Printf("failed to load system cert pool for redis connection, falling back to empty cert pool")
78+ }
79+ if rootCAs == nil {
80+ rootCAs = x509.NewCertPool()
81+ }
82+ certs, err := ioutil.ReadFile(opts.RedisCAPath)
83+ if err != nil {
84+ return nil, fmt.Errorf("failed to load %q, %v", opts.RedisCAPath, err)
85+ }
86+
87+ // Append our cert to the system pool
88+ if ok := rootCAs.AppendCertsFromPEM(certs); !ok {
89+ logger.Printf("no certs appended, using system certs only")
90+ }
91+
92+ opt.TLSConfig.RootCAs = rootCAs
93+ }
94+
6795 client := redis.NewClient(opt)
6896 return client, nil
6997}