git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #2803 from tuunit/bugfix/self-signed-certificate-handling
d68336dJoel Speed
CHANGELOG.md+2
compare with master
unifiedsplit
@@ -8,6 +8,8 @@
8
8
9## Changes since v7.7.0
9## Changes since v7.7.0
10
10
11+- [#2803](https://github.com/oauth2-proxy/oauth2-proxy/pull/2803) fix: self signed certificate handling in v7.7.0 (@tuunit)
12+
11# V7.7.0
13# V7.7.0
12
14
13## Release Highlights
15## Release Highlights
pkg/requests/http.go+3−1
@@ -18,10 +18,12 @@ func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error
18}
18}
19
19
20var DefaultHTTPClient = &http.Client{Transport: &userAgentTransport{
20var DefaultHTTPClient = &http.Client{Transport: &userAgentTransport{
21− next: http.DefaultTransport,
21+ next: DefaultTransport,
22 userAgent: "oauth2-proxy/" + version.VERSION,
22 userAgent: "oauth2-proxy/" + version.VERSION,
23}}
23}}
24
24
25+var DefaultTransport = http.DefaultTransport
26+
25func setDefaultUserAgent(header http.Header, userAgent string) {
27func setDefaultUserAgent(header http.Header, userAgent string) {
26 if header != nil && len(header.Values("User-Agent")) == 0 {
28 if header != nil && len(header.Values("User-Agent")) == 0 {
27 header.Set("User-Agent", userAgent)
29 header.Set("User-Agent", userAgent)
pkg/validation/options.go+4−7
@@ -13,6 +13,7 @@ import (
13 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
13 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
14 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
14 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
15 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
15 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
16+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
16 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
17 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
17)
18)
18
19
@@ -30,20 +31,16 @@ func Validate(o *options.Options) error {
30 msgs = parseSignatureKey(o, msgs)
31 msgs = parseSignatureKey(o, msgs)
31
32
32 if o.SSLInsecureSkipVerify {
33 if o.SSLInsecureSkipVerify {
33− insecureTransport := &http.Transport{
34+ transport := requests.DefaultTransport.(*http.Transport)
34− TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
35+ transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
35− }
36− http.DefaultClient = &http.Client{Transport: insecureTransport}
37 } else if len(o.Providers[0].CAFiles) > 0 {
36 } else if len(o.Providers[0].CAFiles) > 0 {
38 pool, err := util.GetCertPool(o.Providers[0].CAFiles, o.Providers[0].UseSystemTrustStore)
37 pool, err := util.GetCertPool(o.Providers[0].CAFiles, o.Providers[0].UseSystemTrustStore)
39 if err == nil {
38 if err == nil {
40− transport := http.DefaultTransport.(*http.Transport).Clone()
39+ transport := requests.DefaultTransport.(*http.Transport)
41 transport.TLSClientConfig = &tls.Config{
40 transport.TLSClientConfig = &tls.Config{
42 RootCAs: pool,
41 RootCAs: pool,
43 MinVersion: tls.VersionTLS12,
42 MinVersion: tls.VersionTLS12,
44 }
43 }
45−
46− http.DefaultClient = &http.Client{Transport: transport}
47 } else {
44 } else {
48 msgs = append(msgs, fmt.Sprintf("unable to load provider CA file(s): %v", err))
45 msgs = append(msgs, fmt.Sprintf("unable to load provider CA file(s): %v", err))
49 }
46 }