cce2c68 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Move RealClientIP code to IP packages

commitcce2c680d897c43cb39c856a9309d747fd71d622 authorJoel Speed <joel.speed@hotmail.co.uk> dateSat 23 May 2020, 15:17 (6 years ago) parentc3f9cbe

6 files changed+47−37

compare with master

unifiedsplit

oauthproxy.go+5−4 pkg/apis/ip/interfaces.go+11 pkg/apis/options/options.go+20−20 pkg/apis/logging/realclientip.go → pkg/ip/realclientip.go+5−8 pkg/apis/logging/realclientip_test.go → pkg/ip/realclientip_test.go+3−2 pkg/validation/options.go+3−3

oauthproxy.go+5−4

@@ -19,11 +19,12 @@ import (

1919

2020 "github.com/coreos/go-oidc"

2121 "github.com/mbland/hmacauth"

22− "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/logging"

22+ ipapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/ip"

2323 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"

2424 sessionsapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

2525 "github.com/oauth2-proxy/oauth2-proxy/pkg/cookies"

2626 "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

27+ "github.com/oauth2-proxy/oauth2-proxy/pkg/ip"

2728 "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

2829 "github.com/oauth2-proxy/oauth2-proxy/providers"

2930 "github.com/yhat/wsutil"

@@ -114,7 +115,7 @@ type OAuthProxy struct {

114115 jwtBearerVerifiers []*oidc.IDTokenVerifier

115116 compiledRegex []*regexp.Regexp

116117 templates *template.Template

117− realClientIPParser logging.RealClientIPParser

118+ realClientIPParser ipapi.RealClientIPParser

118119 Banner string

119120 Footer string

120121}

@@ -762,7 +763,7 @@ func (p *OAuthProxy) OAuthStart(rw http.ResponseWriter, req *http.Request) {

762763// OAuthCallback is the OAuth2 authentication flow callback that finishes the

763764// OAuth2 authentication flow

764765func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {

765− remoteAddr := logging.GetClientString(p.realClientIPParser, req, true)

766+ remoteAddr := ip.GetClientString(p.realClientIPParser, req, true)

766767

767768 // finish the oauth cycle

768769 err := req.ParseForm()

@@ -890,7 +891,7 @@ func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.R

890891 }

891892 }

892893

893− remoteAddr := logging.GetClientString(p.realClientIPParser, req, true)

894+ remoteAddr := ip.GetClientString(p.realClientIPParser, req, true)

894895 if session == nil {

895896 session, err = p.LoadCookiedSession(req)

896897 if err != nil {

pkg/apis/ip/interfaces.gonew file+11

@@ -0,0 +1,11 @@

1+package ip

3+import (

4+ "net"

5+ "net/http"

6+)

8+// RealClientIPParser is an interface for a getting the client's real IP to be used for logging.

9+type RealClientIPParser interface {

10+ GetRealClientIP(http.Header) (net.IP, error)

11+}

pkg/apis/options/options.go+20−20

@@ -7,7 +7,7 @@ import (

77 "time"

99 oidc "github.com/coreos/go-oidc"

10− "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/logging"

10+ ipapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/ip"

1111 sessionsapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

1212 "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

1313 "github.com/oauth2-proxy/oauth2-proxy/providers"

@@ -132,30 +132,30 @@ type Options struct {

132132 signatureData *SignatureData

133133 oidcVerifier *oidc.IDTokenVerifier

134134 jwtBearerVerifiers []*oidc.IDTokenVerifier

135− realClientIPParser logging.RealClientIPParser

135+ realClientIPParser ipapi.RealClientIPParser

136136}

137137

138138// Options for Getting internal values

139−func (o *Options) GetRedirectURL() *url.URL { return o.redirectURL }

140−func (o *Options) GetProxyURLs() []*url.URL { return o.proxyURLs }

141−func (o *Options) GetCompiledRegex() []*regexp.Regexp { return o.compiledRegex }

142−func (o *Options) GetProvider() providers.Provider { return o.provider }

143−func (o *Options) GetSessionStore() sessionsapi.SessionStore { return o.sessionStore }

144−func (o *Options) GetSignatureData() *SignatureData { return o.signatureData }

145−func (o *Options) GetOIDCVerifier() *oidc.IDTokenVerifier { return o.oidcVerifier }

146−func (o *Options) GetJWTBearerVerifiers() []*oidc.IDTokenVerifier { return o.jwtBearerVerifiers }

147−func (o *Options) GetRealClientIPParser() logging.RealClientIPParser { return o.realClientIPParser }

139+func (o *Options) GetRedirectURL() *url.URL { return o.redirectURL }

140+func (o *Options) GetProxyURLs() []*url.URL { return o.proxyURLs }

141+func (o *Options) GetCompiledRegex() []*regexp.Regexp { return o.compiledRegex }

142+func (o *Options) GetProvider() providers.Provider { return o.provider }

143+func (o *Options) GetSessionStore() sessionsapi.SessionStore { return o.sessionStore }

144+func (o *Options) GetSignatureData() *SignatureData { return o.signatureData }

145+func (o *Options) GetOIDCVerifier() *oidc.IDTokenVerifier { return o.oidcVerifier }

146+func (o *Options) GetJWTBearerVerifiers() []*oidc.IDTokenVerifier { return o.jwtBearerVerifiers }

147+func (o *Options) GetRealClientIPParser() ipapi.RealClientIPParser { return o.realClientIPParser }

148148

149149// Options for Setting internal values

150−func (o *Options) SetRedirectURL(s *url.URL) { o.redirectURL = s }

151−func (o *Options) SetProxyURLs(s []*url.URL) { o.proxyURLs = s }

152−func (o *Options) SetCompiledRegex(s []*regexp.Regexp) { o.compiledRegex = s }

153−func (o *Options) SetProvider(s providers.Provider) { o.provider = s }

154−func (o *Options) SetSessionStore(s sessionsapi.SessionStore) { o.sessionStore = s }

155−func (o *Options) SetSignatureData(s *SignatureData) { o.signatureData = s }

156−func (o *Options) SetOIDCVerifier(s *oidc.IDTokenVerifier) { o.oidcVerifier = s }

157−func (o *Options) SetJWTBearerVerifiers(s []*oidc.IDTokenVerifier) { o.jwtBearerVerifiers = s }

158−func (o *Options) SetRealClientIPParser(s logging.RealClientIPParser) { o.realClientIPParser = s }

150+func (o *Options) SetRedirectURL(s *url.URL) { o.redirectURL = s }

151+func (o *Options) SetProxyURLs(s []*url.URL) { o.proxyURLs = s }

152+func (o *Options) SetCompiledRegex(s []*regexp.Regexp) { o.compiledRegex = s }

153+func (o *Options) SetProvider(s providers.Provider) { o.provider = s }

154+func (o *Options) SetSessionStore(s sessionsapi.SessionStore) { o.sessionStore = s }

155+func (o *Options) SetSignatureData(s *SignatureData) { o.signatureData = s }

156+func (o *Options) SetOIDCVerifier(s *oidc.IDTokenVerifier) { o.oidcVerifier = s }

157+func (o *Options) SetJWTBearerVerifiers(s []*oidc.IDTokenVerifier) { o.jwtBearerVerifiers = s }

158+func (o *Options) SetRealClientIPParser(s ipapi.RealClientIPParser) { o.realClientIPParser = s }

159159

160160// NewOptions constructs a new Options with defaulted values

161161func NewOptions() *Options {

pkg/apis/logging/realclientip.go → pkg/ip/realclientip.gorenamed+5−8

@@ -1,18 +1,15 @@

1−package logging

1+package ip

33import (

44 "fmt"

55 "net"

66 "net/http"

77 "strings"

8−)

10−// RealClientIPParser is an interface for a getting the client's real IP to be used for logging.

11−type RealClientIPParser interface {

12− GetRealClientIP(http.Header) (net.IP, error)

13−}

9+ ipapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/ip"

10+)

1411

15−func GetRealClientIPParser(headerKey string) (RealClientIPParser, error) {

12+func GetRealClientIPParser(headerKey string) (ipapi.RealClientIPParser, error) {

1613 headerKey = http.CanonicalHeaderKey(headerKey)

1714

1815 switch headerKey {

@@ -73,7 +70,7 @@ func getRemoteIP(req *http.Request) (net.IP, error) {

7370}

7471

7572// GetClientString obtains the human readable string of the remote IP and optionally the real client IP if available

76−func GetClientString(p RealClientIPParser, req *http.Request, full bool) (s string) {

73+func GetClientString(p ipapi.RealClientIPParser, req *http.Request, full bool) (s string) {

7774 var realClientIPStr string

7875 if p != nil {

7976 if realClientIP, err := p.GetRealClientIP(req.Header); err == nil && realClientIP != nil {

pkg/apis/logging/realclientip_test.go → pkg/ip/realclientip_test.gorenamed+3−2

@@ -1,4 +1,4 @@

1−package logging

1+package ip

33import (

44 "net"

@@ -6,6 +6,7 @@ import (

66 "reflect"

77 "testing"

9+ ipapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/ip"

910 "github.com/stretchr/testify/assert"

1011)

1112

@@ -144,7 +145,7 @@ func TestGetClientString(t *testing.T) {

144145 p := &xForwardedForClientIPParser{header: http.CanonicalHeaderKey("X-Forwarded-For")}

145146

146147 tests := []struct {

147− parser RealClientIPParser

148+ parser ipapi.RealClientIPParser

148149 remoteAddr string

149150 headerValue string

150151 expectedClient string

pkg/validation/options.go+3−3

@@ -17,9 +17,9 @@ import (

1717 "github.com/coreos/go-oidc"

1818 "github.com/dgrijalva/jwt-go"

1919 "github.com/mbland/hmacauth"

20− "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/logging"

2120 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"

2221 "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

22+ "github.com/oauth2-proxy/oauth2-proxy/pkg/ip"

2323 "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

2424 "github.com/oauth2-proxy/oauth2-proxy/pkg/requests"

2525 "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions"

@@ -272,7 +272,7 @@ func Validate(o *options.Options) error {

272272 msgs = setupLogger(o, msgs)

273273

274274 if o.ReverseProxy {

275− parser, err := logging.GetRealClientIPParser(o.RealClientIPHeader)

275+ parser, err := ip.GetRealClientIPParser(o.RealClientIPHeader)

276276 if err != nil {

277277 msgs = append(msgs, fmt.Sprintf("real_client_ip_header (%s) not accepted parameter value: %v", o.RealClientIPHeader, err))

278278 }

@@ -496,7 +496,7 @@ func setupLogger(o *options.Options, msgs []string) []string {

496496 logger.SetAuthTemplate(o.AuthLoggingFormat)

497497 logger.SetReqTemplate(o.RequestLoggingFormat)

498498 logger.SetGetClientFunc(func(r *http.Request) string {

499− return logging.GetClientString(o.GetRealClientIPParser(), r, false)

499+ return ip.GetClientString(o.GetRealClientIPParser(), r, false)

500500 })

501501

502502 excludePaths := make([]string, 0)