@@ -0,0 +1,271 @@
1+package redis
2+
3+import (
4+ "crypto/aes"
5+ "crypto/cipher"
6+ "crypto/rand"
7+ "encoding/base64"
8+ "encoding/hex"
9+ "fmt"
10+ "io"
11+ "net/http"
12+ "strings"
13+ "time"
14+
15+ "github.com/go-redis/redis"
16+ "github.com/pusher/oauth2_proxy/cookie"
17+ "github.com/pusher/oauth2_proxy/pkg/apis/options"
18+ "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
19+ "github.com/pusher/oauth2_proxy/pkg/cookies"
20+ "github.com/pusher/oauth2_proxy/pkg/sessions/utils"
21+)
22+
23+// TicketData is a structure representing a used in server session storage
24+type TicketData struct {
25+ TicketID string
26+ Secret []byte
27+}
28+
29+// SessionStore is an implementation of the sessions.SessionStore
30+// interface that stores sessions in redis
31+type SessionStore struct {
32+ CookieCipher *cookie.Cipher
33+ CookieDomain string
34+ CookieExpire time.Duration
35+ CookieHTTPOnly bool
36+ CookieName string
37+ CookiePath string
38+ CookieSecret string
39+ CookieSecure bool
40+ Client *redis.Client
41+}
42+
43+// NewRedisSessionStore initialises a new instance of the SessionStore from
44+// the configuration given
45+func NewRedisSessionStore(opts options.RedisStoreOptions, cookieOpts *options.CookieOptions) (sessions.SessionStore, error) {
46+ opt, err := redis.ParseURL(opts.RedisConnectionURL)
47+ if err != nil {
48+ return nil, fmt.Errorf("unable to parse redis url: %s", err)
49+ }
50+
51+ var cookieCipher *cookie.Cipher
52+ if len(cookieOpts.CookieSecret) > 0 {
53+ var err error
54+ cookieCipher, err = cookie.NewCipher(utils.SecretBytes(cookieOpts.CookieSecret))
55+ if err != nil {
56+ return nil, fmt.Errorf("unable to create cookieCipher: %v", err)
57+ }
58+ }
59+
60+ client := redis.NewClient(opt)
61+
62+ rs := &SessionStore{
63+ Client: client,
64+ CookieCipher: cookieCipher,
65+ CookieDomain: cookieOpts.CookieDomain,
66+ CookieExpire: cookieOpts.CookieExpire,
67+ CookieHTTPOnly: cookieOpts.CookieHTTPOnly,
68+ CookieName: cookieOpts.CookieName,
69+ CookiePath: cookieOpts.CookiePath,
70+ CookieSecret: cookieOpts.CookieSecret,
71+ CookieSecure: cookieOpts.CookieSecure,
72+ }
73+ return rs, nil
74+
75+}
76+
77+// Save takes a sessions.SessionState and stores the information from it
78+// to redies, and adds a new ticket cookie on the HTTP response writer
79+func (store *SessionStore) Save(rw http.ResponseWriter, req *http.Request, s *sessions.SessionState) error {
80+ requestCookie, _ := req.Cookie(store.CookieName)
81+ value, err := s.EncodeSessionState(store.CookieCipher)
82+ if err != nil {
83+ return err
84+ }
85+ ticketString, err := store.storeValue(value, s.ExpiresOn, requestCookie)
86+ if err != nil {
87+ return err
88+ }
89+
90+ ticketCookie := cookies.MakeCookie(
91+ req,
92+ store.CookieName,
93+ ticketString,
94+ store.CookiePath,
95+ store.CookieDomain,
96+ store.CookieHTTPOnly,
97+ store.CookieSecure,
98+ store.CookieExpire,
99+ time.Now(),
100+ )
101+
102+ http.SetCookie(rw, ticketCookie)
103+ return nil
104+}
105+
106+// Load reads sessions.SessionState information from a ticket
107+// cookie within the HTTP request object
108+func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {
109+ requestCookie, _ := req.Cookie(store.CookieName)
110+ // No cookie validation necessary
111+ session, err := store.LoadSessionFromString(requestCookie.Value)
112+ if err != nil {
113+ return nil, fmt.Errorf("error loading session: %s", err)
114+ }
115+ return session, nil
116+}
117+
118+// LoadSessionFromString loads the session based on the ticket value
119+func (store *SessionStore) LoadSessionFromString(value string) (*sessions.SessionState, error) {
120+ ticket, err := decodeTicket(store.CookieName, value)
121+ if err != nil {
122+ return nil, err
123+ }
124+
125+ result, err := store.Client.Get(ticket.asHandle(store.CookieName)).Result()
126+ if err != nil {
127+ return nil, err
128+ }
129+
130+ resultBytes := []byte(result)
131+ block, err := aes.NewCipher(ticket.Secret)
132+ if err != nil {
133+ return nil, err
134+ }
135+ // Use secret as the IV too, because each entry has it's own key
136+ stream := cipher.NewCFBDecrypter(block, ticket.Secret)
137+ stream.XORKeyStream(resultBytes, resultBytes)
138+
139+ session, err := sessions.DecodeSessionState(string(resultBytes), store.CookieCipher)
140+ if err != nil {
141+ return nil, err
142+ }
143+ return session, nil
144+}
145+
146+// Clear clears any saved session information for a given ticket cookie
147+// from redis, and then clears the session
148+func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) error {
149+ requestCookie, _ := req.Cookie(store.CookieName)
150+
151+ // We go ahead and clear the cookie first, always.
152+ clearCookie := cookies.MakeCookie(
153+ req,
154+ store.CookieName,
155+ "",
156+ store.CookiePath,
157+ store.CookieDomain,
158+ store.CookieHTTPOnly,
159+ store.CookieSecure,
160+ time.Hour*-1,
161+ time.Now(),
162+ )
163+ http.SetCookie(rw, clearCookie)
164+
165+ // We only return an error if we had an issue with redis
166+ // If there's an issue decoding the ticket, ignore it
167+ ticket, _ := decodeTicket(store.CookieName, requestCookie.Value)
168+ if ticket != nil {
169+ deleted, err := store.Client.Del(ticket.asHandle(store.CookieName)).Result()
170+ fmt.Println("delted %n", deleted)
171+ if err != nil {
172+ return fmt.Errorf("error clearing cookie from redis: %s", err)
173+ }
174+ }
175+ return nil
176+}
177+
178+func (store *SessionStore) storeValue(value string, expiresOn time.Time, requestCookie *http.Cookie) (string, error) {
179+ var ticket *TicketData
180+ if requestCookie != nil {
181+ var err error
182+ ticket, err = decodeTicket(store.CookieName, requestCookie.Value)
183+ if err != nil {
184+ return "", err
185+ }
186+ } else {
187+ var err error
188+ ticket, err = newTicket()
189+ if err != nil {
190+ return "", fmt.Errorf("error creating new ticket: %s", err)
191+ }
192+ }
193+
194+ ciphertext := make([]byte, len(value))
195+ block, err := aes.NewCipher(ticket.Secret)
196+ if err != nil {
197+ return "", fmt.Errorf("error initiating cipher block %s", err)
198+ }
199+
200+ // Use secret as the IV too, because each entry has it's own key
201+ stream := cipher.NewCFBEncrypter(block, ticket.Secret)
202+ stream.XORKeyStream(ciphertext, []byte(value))
203+
204+ handle := ticket.asHandle(store.CookieName)
205+ expires := expiresOn.Sub(time.Now())
206+ err = store.Client.Set(handle, ciphertext, expires).Err()
207+ if err != nil {
208+ return "", err
209+ }
210+ return ticket.encodeTicket(store.CookieName), nil
211+}
212+
213+func newTicket() (*TicketData, error) {
214+ rawID := make([]byte, 16)
215+ if _, err := io.ReadFull(rand.Reader, rawID); err != nil {
216+ return nil, fmt.Errorf("failed to create new ticket ID %s", err)
217+ }
218+ // ticketID is hex encoded
219+ ticketID := fmt.Sprintf("%x", rawID)
220+
221+ secret := make([]byte, aes.BlockSize)
222+ if _, err := io.ReadFull(rand.Reader, secret); err != nil {
223+ return nil, fmt.Errorf("failed to create initialization vector %s", err)
224+ }
225+ ticket := &TicketData{
226+ TicketID: ticketID,
227+ Secret: secret,
228+ }
229+ return ticket, nil
230+}
231+
232+func (ticket *TicketData) asHandle(prefix string) string {
233+ return fmt.Sprintf("%s-%s", prefix, ticket.TicketID)
234+}
235+
236+func decodeTicket(cookieName string, ticketString string) (*TicketData, error) {
237+ prefix := cookieName + "-"
238+ if !strings.HasPrefix(ticketString, prefix) {
239+ return nil, fmt.Errorf("failed to decode ticket handle")
240+ }
241+ trimmedTicket := strings.TrimPrefix(ticketString, prefix)
242+
243+ ticketParts := strings.Split(trimmedTicket, ".")
244+ if len(ticketParts) != 2 {
245+ return nil, fmt.Errorf("failed to decode ticket")
246+ }
247+ ticketID, secretBase64 := ticketParts[0], ticketParts[1]
248+
249+ // ticketID must be a hexadecimal string
250+ _, err := hex.DecodeString(ticketID)
251+ if err != nil {
252+ return nil, fmt.Errorf("server ticket failed sanity checks")
253+ // s is not a valid
254+ }
255+
256+ secret, err := base64.RawURLEncoding.DecodeString(secretBase64)
257+ if err != nil {
258+ return nil, fmt.Errorf("failed to decode initialization vector %s", err)
259+ }
260+ ticketData := &TicketData{
261+ TicketID: ticketID,
262+ Secret: secret,
263+ }
264+ return ticketData, nil
265+}
266+
267+func (ticket *TicketData) encodeTicket(prefix string) string {
268+ handle := ticket.asHandle(prefix)
269+ ticketString := handle + "." + base64.RawURLEncoding.EncodeToString(ticket.Secret)
270+ return ticketString
271+}