git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #2589 from ianroberts/file-upstream-rewrite

Add support for rewriteTarget in file: upstreams

commite293dddef4d923987e12cdce1edc52c5796690e0 authorJoel Speed <Joel.speed@hotmail.co.uk> dateTue 3 Sep 2024, 09:37 (2 years ago) parente12ae0351c65c9
7 files changed+70−10
CHANGELOG.md+1 docs/docs/configuration/alpha_config.md+1−1 pkg/apis/options/upstreams.go+4−2 pkg/upstream/file.go+39−5 pkg/upstream/file_test.go+7−1 pkg/upstream/proxy.go+1−1 pkg/upstream/proxy_test.go+17
CHANGELOG.md+1
@@ -15,6 +15,7 @@
1515- [#2459](https://github.com/oauth2-proxy/oauth2-proxy/pull/2459) chore(deps): Updated to ginkgo v2 (@kvanzuijlen, @tuunit)
1616- [#2112](https://github.com/oauth2-proxy/oauth2-proxy/pull/2112) docs: update list of providers which support refresh tokens (@mikefab-msf)
1717- [#2734](https://github.com/oauth2-proxy/oauth2-proxy/pull/2734) Added s390x architecture option support (@priby05)
18+- [#2589](https://github.com/oauth2-proxy/oauth2-proxy/pull/2589) Added support for regex path matching and rewriting when using a static `file:` upstream (@ianroberts)
1819
1920# V7.6.0
2021
docs/docs/configuration/alpha_config.md+1−1
@@ -524,7 +524,7 @@ Requests will be proxied to this upstream if the path matches the request path.
524524| ----- | ---- | ----------- |
525525| `id` | _string_ | ID should be a unique identifier for the upstream.<br/>This value is required for all upstreams. |
526526| `path` | _string_ | Path is used to map requests to the upstream server.<br/>The closest match will take precedence and all Paths must be unique.<br/>Path can also take a pattern when used with RewriteTarget.<br/>Path segments can be captured and matched using regular experessions.<br/>Eg:<br/>- `^/foo$`: Match only the explicit path `/foo`<br/>- `^/bar/$`: Match any path prefixed with `/bar/`<br/>- `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget |
527−| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to<br/>the upstream server.<br/>Use the Path to capture segments for reuse within the rewrite target.<br/>Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite<br/>the request `/baz/abc/123` to `/foo/abc/123` before proxying to the<br/>upstream server. |
527+| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to<br/>the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem<br/>(for a `file:` upstream).<br/>Use the Path to capture segments for reuse within the rewrite target.<br/>Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite<br/>the request `/baz/abc/123` to `/foo/abc/123` before proxying to the<br/>upstream server. Or if the upstream were `file:///app`, a request for<br/>`/baz/info.html` would return the contents of the file `/app/foo/info.html`. |
528528| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File<br/>based URL. It may include a path, in which case all requests will be served<br/>under that path.<br/>Eg:<br/>- http://localhost:8080<br/>- https://service.localhost<br/>- https://service.localhost/path<br/>- file://host/path<br/>If the URI's path is "/base" and the incoming request was for "/dir",<br/>the upstream request will be for "/base/dir". |
529529| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.<br/>This option is insecure and will allow potential Man-In-The-Middle attacks<br/>between OAuth2 Proxy and the upstream server.<br/>Defaults to false. |
530530| `static` | _bool_ | Static will make all requests to this upstream have a static response.<br/>The response will have a body of "Authenticated" and a response code<br/>matching StaticCode.<br/>If StaticCode is not set, the response will return a 200 response. |
pkg/apis/options/upstreams.go+4−2
@@ -39,11 +39,13 @@ type Upstream struct {
3939 Path string `json:"path,omitempty"`
4040
4141 // RewriteTarget allows users to rewrite the request path before it is sent to
42− // the upstream server.
42+ // the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem
43+ // (for a `file:` upstream).
4344 // Use the Path to capture segments for reuse within the rewrite target.
4445 // Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite
4546 // the request `/baz/abc/123` to `/foo/abc/123` before proxying to the
46− // upstream server.
47+ // upstream server. Or if the upstream were `file:///app`, a request for
48+ // `/baz/info.html` would return the contents of the file `/app/foo/info.html`.
4749 RewriteTarget string `json:"rewriteTarget,omitempty"`
4850
4951 // The URI of the upstream server. This may be an HTTP(S) server of a File
pkg/upstream/file.go+39−5
@@ -2,9 +2,12 @@ package upstream
22
33import (
44 "net/http"
5+ "net/url"
56 "runtime"
67 "strings"
78
9+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
10+
811 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
912)
1013
@@ -12,22 +15,53 @@ const fileScheme = "file"
1215
1316// newFileServer creates a new fileServer that can serve requests
1417// to a file system location.
15−func newFileServer(id, path, fileSystemPath string) http.Handler {
18+func newFileServer(upstream options.Upstream, fileSystemPath string) http.Handler {
19+ handler := newFileServerForPath(fileSystemPath)
20+
21+ if upstream.RewriteTarget == "" {
22+ // if the upstream does not have a rewrite target, strip off the Path prefix
23+ // (so e.g. a request for /static/some-file.html looks for some-file.html
24+ // relative to the fileSystemPath rather than static/some-file.html).
25+ handler = http.StripPrefix(upstream.Path, handler)
26+ } else {
27+ // if the upstream *does* have a rewrite target then that means the target
28+ // path relative to the fileSystemPath will be the one in the (rewritten)
29+ // RequestURI.
30+ handler = requestURIToURL(handler)
31+ }
1632 return &fileServer{
17− upstream: id,
18− handler: newFileServerForPath(path, fileSystemPath),
33+ upstream: upstream.ID,
34+ handler: handler,
1935 }
2036}
2137
2238// newFileServerForPath creates a http.Handler to serve files from the filesystem
23−func newFileServerForPath(path string, filesystemPath string) http.Handler {
39+func newFileServerForPath(filesystemPath string) http.Handler {
2440 // Windows fileSSystemPath will be be prefixed with `/`, eg`/C:/...,
2541 // if they were parsed by url.Parse`
2642 if runtime.GOOS == "windows" {
2743 filesystemPath = strings.TrimPrefix(filesystemPath, "/")
2844 }
2945
30− return http.StripPrefix(path, http.FileServer(http.Dir(filesystemPath)))
46+ return http.FileServer(http.Dir(filesystemPath))
47+}
48+
49+// requestURIToURL returns a Handler that replaces the URL in its request with
50+// the result of parsing req.RequestURI. This is necessary for file handlers
51+// that have a rewrite target, since http.FileServer uses req.URL.Path when
52+// looking for the target file, but the rewrite handler only updates the
53+// RequestURI, leaving the original path in the URL.
54+func requestURIToURL(handler http.Handler) http.Handler {
55+ return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
56+ reqURL, err := url.ParseRequestURI(req.RequestURI)
57+ if err != nil {
58+ http.Error(rw, "500 Internal Server Error", http.StatusInternalServerError)
59+ return
60+ }
61+
62+ req.URL = reqURL
63+ handler.ServeHTTP(rw, req)
64+ })
3165}
3266
3367// fileServer represents a single filesystem upstream proxy
pkg/upstream/file_test.go+7−1
@@ -7,6 +7,8 @@ import (
77 "net/http/httptest"
88 "os"
99
10+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
11+
1012 middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
1113 . "github.com/onsi/ginkgo/v2"
1214 . "github.com/onsi/gomega"
@@ -31,8 +33,12 @@ var _ = Describe("File Server Suite", func() {
3133 _, err := io.ReadFull(rand.Reader, idBytes)
3234 Expect(err).ToNot(HaveOccurred())
3335 id = string(idBytes)
36+ upstream := options.Upstream{
37+ ID: id,
38+ Path: "/files",
39+ }
3440
35− handler = newFileServer(id, "/files", filesDir)
41+ handler = newFileServer(upstream, filesDir)
3642 })
3743
3844 AfterEach(func() {
pkg/upstream/proxy.go+1−1
@@ -81,7 +81,7 @@ func (m *multiUpstreamProxy) registerStaticResponseHandler(upstream options.Upst
8181// registerFileServer registers a new fileServer based on the configuration given.
8282func (m *multiUpstreamProxy) registerFileServer(upstream options.Upstream, u *url.URL, writer pagewriter.Writer) error {
8383 logger.Printf("mapping path %q => file system %q", upstream.Path, u.Path)
84− return m.registerHandler(upstream, newFileServer(upstream.ID, upstream.Path, u.Path), writer)
84+ return m.registerHandler(upstream, newFileServer(upstream, u.Path), writer)
8585}
8686
8787// registerHTTPUpstreamProxy registers a new httpUpstreamProxy based on the configuration given.
pkg/upstream/proxy_test.go+17
@@ -51,6 +51,12 @@ var _ = Describe("Proxy Suite", func() {
5151 Path: "/files/",
5252 URI: fmt.Sprintf("file:///%s", filesDir),
5353 },
54+ {
55+ ID: "rewrite-file-backend",
56+ Path: "^/rewrite-files/.*/(.*)$",
57+ RewriteTarget: "/$1",
58+ URI: fmt.Sprintf("file:///%s", filesDir),
59+ },
5460 {
5561 ID: "static-backend",
5662 Path: "/static/",
@@ -174,6 +180,17 @@ var _ = Describe("Proxy Suite", func() {
174180 },
175181 upstream: "file-backend",
176182 }),
183+ Entry("with a request to the File backend with rewrite", &proxyTableInput{
184+ target: "http://example.localhost/rewrite-files/anything-at-all/foo",
185+ response: testHTTPResponse{
186+ code: 200,
187+ header: map[string][]string{
188+ contentType: {textPlainUTF8},
189+ },
190+ raw: "foo",
191+ },
192+ upstream: "rewrite-file-backend",
193+ }),
177194 Entry("with a request to the Static backend", &proxyTableInput{
178195 target: "http://example.localhost/static/bar",
179196 response: testHTTPResponse{