b49e62f · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

Initalize TLS.Config when connecting to Redis with TLS (#1296)

b49e62fMaciej Strzelecki5 years ago

CHANGELOG.md+1

compare with master

unifiedsplit

@@ -47,6 +47,7 @@

47- [#1357](https://github.com/oauth2-proxy/oauth2-proxy/pull/1357) Fix unsafe access to session variable (@harzallah)

48- [#997](https://github.com/oauth2-proxy/oauth2-proxy/pull/997) Allow passing the raw url path when proxying upstream requests - e.g. /%2F/ (@FStelzer)

49- [#1147](https://github.com/oauth2-proxy/oauth2-proxy/pull/1147) Multiarch support for docker image (@goshlanguage)

50+- [#1296](https://github.com/oauth2-proxy/oauth2-proxy/pull/1296) Fixed `panic` when connecting to Redis with TLS (@mstrzele)

51# V7.1.3

52# V7.1.3

pkg/http/http_suite_test.go+6−33

@@ -2,20 +2,15 @@ package http

3import (

4 "bytes"

5− "crypto/rand"

6− "crypto/rsa"

7 "crypto/tls"

5 "crypto/tls"

8 "crypto/x509"

6 "crypto/x509"

9− "crypto/x509/pkix"

10 "encoding/pem"

7 "encoding/pem"

11− "math/big"

12− "net"

13 "net/http"

8 "net/http"

14 "testing"

9 "testing"

15− "time"

17 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

18 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

12 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

13+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"

19 . "github.com/onsi/ginkgo"

14 . "github.com/onsi/ginkgo"

20 . "github.com/onsi/gomega"

15 . "github.com/onsi/gomega"

21)

16)

@@ -34,38 +29,16 @@ func TestHTTPSuite(t *testing.T) {

35var _ = BeforeSuite(func() {

30var _ = BeforeSuite(func() {

36 By("Generating a self-signed cert for TLS tests", func() {

31 By("Generating a self-signed cert for TLS tests", func() {

37− priv, err := rsa.GenerateKey(rand.Reader, 2048)

32+ certBytes, keyBytes, err := util.GenerateCert()

38− Expect(err).ToNot(HaveOccurred())

39−

40− keyOut := bytes.NewBuffer(nil)

41− privBytes, err := x509.MarshalPKCS8PrivateKey(priv)

42− Expect(err).ToNot(HaveOccurred())

43− Expect(pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})).To(Succeed())

44− keyDataSource.Value = keyOut.Bytes()

45−

46− serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)

47− serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)

48− Expect(err).ToNot(HaveOccurred())

49−

50− template := x509.Certificate{

51− SerialNumber: serialNumber,

52− Subject: pkix.Name{

53− Organization: []string{"OAuth2 Proxy Test Suite"},

54− },

55− NotBefore: time.Now(),

56− NotAfter: time.Now().Add(time.Hour),

57− IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},

58− KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,

59− ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},

60− }

61−

62− certBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)

63 Expect(err).ToNot(HaveOccurred())

33 Expect(err).ToNot(HaveOccurred())

64 certData = certBytes

34 certData = certBytes

66− certOut := bytes.NewBuffer(nil)

36+ certOut := new(bytes.Buffer)

67 Expect(pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: certBytes})).To(Succeed())

37 Expect(pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: certBytes})).To(Succeed())

68 certDataSource.Value = certOut.Bytes()

38 certDataSource.Value = certOut.Bytes()

39+ keyOut := new(bytes.Buffer)

40+ Expect(pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: keyBytes})).To(Succeed())

41+ keyDataSource.Value = keyOut.Bytes()

69 })

42 })

71 By("Setting up a http client", func() {

44 By("Setting up a http client", func() {

pkg/sessions/redis/redis_store.go+11

@@ -2,6 +2,7 @@ package redis

3import (

4 "context"

5+ "crypto/tls"

5 "crypto/x509"

6 "crypto/x509"

6 "fmt"

7 "fmt"

7 "io/ioutil"

8 "io/ioutil"

@@ -127,6 +128,11 @@ func buildStandaloneClient(opts options.RedisStoreOptions) (Client, error) {

127 }

128 }

128

129

129 if opts.InsecureSkipTLSVerify {

130 if opts.InsecureSkipTLSVerify {

131+ if opt.TLSConfig == nil {

132+ /* #nosec */

133+ opt.TLSConfig = &tls.Config{}

134+ }

135+

130 opt.TLSConfig.InsecureSkipVerify = true

136 opt.TLSConfig.InsecureSkipVerify = true

131 }

137 }

132

138

@@ -148,6 +154,11 @@ func buildStandaloneClient(opts options.RedisStoreOptions) (Client, error) {

148 logger.Errorf("no certs appended, using system certs only")

154 logger.Errorf("no certs appended, using system certs only")

149 }

155 }

150

156

157+ if opt.TLSConfig == nil {

158+ /* #nosec */

159+ opt.TLSConfig = &tls.Config{}

160+ }

161+

151 opt.TLSConfig.RootCAs = rootCAs

162 opt.TLSConfig.RootCAs = rootCAs

152 }

163 }

153

164

pkg/sessions/redis/redis_store_test.go+104

@@ -1,7 +1,10 @@

1package redis

3import (

4+ "bytes"

4 "context"

5 "context"

6+ "crypto/tls"

7+ "encoding/pem"

5 "log"

8 "log"

6 "os"

9 "os"

7 "testing"

10 "testing"

@@ -15,6 +18,7 @@ import (

15 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

18 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

16 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/sessions/persistence"

19 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/sessions/persistence"

17 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/sessions/tests"

20 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/sessions/tests"

21+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"

18 . "github.com/onsi/ginkgo"

22 . "github.com/onsi/ginkgo"

19 . "github.com/onsi/gomega"

23 . "github.com/onsi/gomega"

20)

24)

@@ -224,4 +228,104 @@ var _ = Describe("Redis SessionStore Tests", func() {

224 )

228 )

225 })

229 })

226 })

230 })

231+

232+ Context("with custom CA path", func() {

233+ var caPath string

234+

235+ BeforeEach(func() {

236+ certBytes, keyBytes, err := util.GenerateCert()

237+ Expect(err).ToNot(HaveOccurred())

238+ certOut := new(bytes.Buffer)

239+ Expect(pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: certBytes})).To(Succeed())

240+ certData := certOut.Bytes()

241+ keyOut := new(bytes.Buffer)

242+ Expect(pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: keyBytes})).To(Succeed())

243+ cert, err := tls.X509KeyPair(certData, keyOut.Bytes())

244+ Expect(err).ToNot(HaveOccurred())

245+

246+ certFile, err := os.CreateTemp("", "cert.*.pem")

247+ Expect(err).ToNot(HaveOccurred())

248+ caPath = certFile.Name()

249+ _, err = certFile.Write(certData)

250+ defer certFile.Close()

251+ Expect(err).ToNot(HaveOccurred())

252+

253+ mr.Close()

254+

255+ mr, err = miniredis.RunTLS(&tls.Config{Certificates: []tls.Certificate{cert}})

256+ Expect(err).ToNot(HaveOccurred())

257+ })

258+

259+ AfterEach(func() {

260+ Expect(os.Remove(caPath)).ToNot(HaveOccurred())

261+

262+ mr.Close()

263+

264+ var err error

265+ mr, err = miniredis.Run()

266+ Expect(err).ToNot(HaveOccurred())

267+ })

268+

269+ tests.RunSessionStoreTests(

270+ func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {

271+ // Set the connection URL

272+ opts.Type = options.RedisSessionStoreType

273+ opts.Redis.ConnectionURL = "redis://" + mr.Addr()

274+ opts.Redis.CAPath = caPath

275+

276+ // Capture the session store so that we can close the client

277+ var err error

278+ ss, err = NewRedisSessionStore(opts, cookieOpts)

279+ return ss, err

280+ },

281+ func(d time.Duration) error {

282+ mr.FastForward(d)

283+ return nil

284+ },

285+ )

286+ })

287+

288+ Context("with insecure TLS connection", func() {

289+ BeforeEach(func() {

290+ certBytes, keyBytes, err := util.GenerateCert()

291+ Expect(err).ToNot(HaveOccurred())

292+ certOut := new(bytes.Buffer)

293+ Expect(pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: certBytes})).To(Succeed())

294+ keyOut := new(bytes.Buffer)

295+ Expect(pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: keyBytes})).To(Succeed())

296+ cert, err := tls.X509KeyPair(certOut.Bytes(), keyOut.Bytes())

297+ Expect(err).ToNot(HaveOccurred())

298+

299+ mr.Close()

300+

301+ mr, err = miniredis.RunTLS(&tls.Config{Certificates: []tls.Certificate{cert}})

302+ Expect(err).ToNot(HaveOccurred())

303+ })

304+

305+ AfterEach(func() {

306+ mr.Close()

307+

308+ var err error

309+ mr, err = miniredis.Run()

310+ Expect(err).ToNot(HaveOccurred())

311+ })

312+

313+ tests.RunSessionStoreTests(

314+ func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {

315+ // Set the connection URL

316+ opts.Type = options.RedisSessionStoreType

317+ opts.Redis.ConnectionURL = "redis://127.0.0.1:" + mr.Port() // func (*Miniredis) StartTLS listens on 127.0.0.1

318+ opts.Redis.InsecureSkipTLSVerify = true

319+

320+ // Capture the session store so that we can close the client

321+ var err error

322+ ss, err = NewRedisSessionStore(opts, cookieOpts)

323+ return ss, err

324+ },

325+ func(d time.Duration) error {

326+ mr.FastForward(d)

327+ return nil

328+ },

329+ )

330+ })

227})

331})

pkg/util/util.go+43

@@ -1,9 +1,15 @@

1package util

3import (

4+ "crypto/rand"

5+ "crypto/rsa"

4 "crypto/x509"

6 "crypto/x509"

7+ "crypto/x509/pkix"

5 "fmt"

8 "fmt"

6 "io/ioutil"

9 "io/ioutil"

10+ "math/big"

11+ "net"

12+ "time"

13)

9func GetCertPool(paths []string) (*x509.CertPool, error) {

15func GetCertPool(paths []string) (*x509.CertPool, error) {

@@ -23,3 +29,40 @@ func GetCertPool(paths []string) (*x509.CertPool, error) {

23 }

29 }

24 return pool, nil

30 return pool, nil

25}

31}

32+

33+// https://golang.org/src/crypto/tls/generate_cert.go as a function

34+func GenerateCert() ([]byte, []byte, error) {

35+ var err error

36+

37+ priv, err := rsa.GenerateKey(rand.Reader, 2048)

38+ if err != nil {

39+ return nil, nil, err

40+ }

41+

42+ keyBytes, err := x509.MarshalPKCS8PrivateKey(priv)

43+ if err != nil {

44+ return nil, keyBytes, err

45+ }

46+

47+ serialNumber, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))

48+ if err != nil {

49+ return nil, keyBytes, err

50+ }

51+

52+ notBefore := time.Now()

53+ template := x509.Certificate{

54+ SerialNumber: serialNumber,

55+ Subject: pkix.Name{

56+ Organization: []string{"OAuth2 Proxy Test Suite"},

57+ },

58+ NotBefore: notBefore,

59+ NotAfter: notBefore.Add(time.Hour),

60+ KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,

61+

62+ ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},

63+

64+ IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},

65+ }

66+ certBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)

67+ return certBytes, keyBytes, err

68+}

watcher.go+1

@@ -1,3 +1,4 @@

1+//go:build go1.3 && !plan9 && !solaris

1// +build go1.3,!plan9,!solaris

2// +build go1.3,!plan9,!solaris

3package main

4package main

watcher_unsupported.go+1

@@ -1,3 +1,4 @@

1+//go:build !go1.3 || plan9 || solaris

1// +build !go1.3 plan9 solaris

2// +build !go1.3 plan9 solaris

3package main

4package main