eb07005 · typeable/oauth2-proxy

CHANGELOG.md+1

compare with master

unifiedsplit

@@ -43,6 +43,7 @@

43

44## Changes since v6.1.1

45

46+- [#916](https://github.com/oauth2-proxy/oauth2-rpoxy/pull/916) Add AlphaOptions struct to prepare for alpha config loading (@JoelSpeed)

46- [#923](https://github.com/oauth2-proxy/oauth2-proxy/pull/923) Support TLS 1.3 (@aajisaka)

47- [#923](https://github.com/oauth2-proxy/oauth2-proxy/pull/923) Support TLS 1.3 (@aajisaka)

47- [#918](https://github.com/oauth2-proxy/oauth2-proxy/pull/918) Fix log header output (@JoelSpeed)

48- [#918](https://github.com/oauth2-proxy/oauth2-proxy/pull/918) Fix log header output (@JoelSpeed)

48- [#911](https://github.com/oauth2-proxy/oauth2-proxy/pull/911) Validate provider type on startup.

49- [#911](https://github.com/oauth2-proxy/oauth2-proxy/pull/911) Validate provider type on startup.

pkg/apis/options/alpha_options.gonew file+31

@@ -0,0 +1,31 @@

1+package options

2+

3+// AlphaOptions contains alpha structured configuration options.

4+// Usage of these options allows users to access alpha features that are not

5+// available as part of the primary configuration structure for OAuth2 Proxy.

6+//

7+// :::warning

8+// The options within this structure are considered alpha.

9+// They may change between releases without notice.

10+// :::

11+type AlphaOptions struct {

12+ // Upstreams is used to configure upstream servers.

13+ // Once a user is authenticated, requests to the server will be proxied to

14+ // these upstream servers based on the path mappings defined in this list.

15+ Upstreams Upstreams `json:"upstreams,omitempty"`

16+

17+ // InjectRequestHeaders is used to configure headers that should be added

18+ // to requests to upstream servers.

19+ // Headers may source values from either the authenticated user's session

20+ // or from a static secret value.

21+ InjectRequestHeaders []Header `json:"injectRequestHeaders,omitempty"`

22+

23+ // InjectResponseHeaders is used to configure headers that should be added

24+ // to responses from the proxy.

25+ // This is typically used when using the proxy as an external authentication

26+ // provider in conjunction with another proxy such as NGINX and its

27+ // auth_request module.

28+ // Headers may source values from either the authenticated user's session

29+ // or from a static secret value.

30+ InjectResponseHeaders []Header `json:"injectResponseHeaders,omitempty"`

31+}

pkg/apis/options/common.go+51−3

@@ -1,14 +1,62 @@

1package options

2

3+import (

4+ "fmt"

5+ "strconv"

6+ "time"

7+)

8+

3// SecretSource references an individual secret value.

9// SecretSource references an individual secret value.

4// Only one source within the struct should be defined at any time.

10// Only one source within the struct should be defined at any time.

5type SecretSource struct {

11type SecretSource struct {

6 // Value expects a base64 encoded string value.

12 // Value expects a base64 encoded string value.

7− Value []byte

13+ Value []byte `json:"value,omitempty"`

8

14

9 // FromEnv expects the name of an environment variable.

15 // FromEnv expects the name of an environment variable.

10− FromEnv string

16+ FromEnv string `json:"fromEnv,omitempty"`

11

17

12 // FromFile expects a path to a file containing the secret value.

18 // FromFile expects a path to a file containing the secret value.

13− FromFile string

19+ FromFile string `json:"fromFile,omitempty"`

20+}

21+

22+// Duration is an alias for time.Duration so that we can ensure the marshalling

23+// and unmarshalling of string durations is done as users expect.

24+// Intentional blank line below to keep this first part of the comment out of

25+// any generated references.

26+

27+// Duration is as string representation of a period of time.

28+// A duration string is a is a possibly signed sequence of decimal numbers,

29+// each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m".

30+// Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

31+type Duration time.Duration

32+

33+// UnmarshalJSON parses the duration string and sets the value of duration

34+// to the value of the duration string.

35+func (d *Duration) UnmarshalJSON(data []byte) error {

36+ input := string(data)

37+ if unquoted, err := strconv.Unquote(input); err == nil {

38+ input = unquoted

39+ }

40+

41+ du, err := time.ParseDuration(input)

42+ if err != nil {

43+ return err

44+ }

45+ *d = Duration(du)

46+ return nil

47+}

48+

49+// MarshalJSON ensures that when the string is marshalled to JSON as a human

50+// readable string.

51+func (d *Duration) MarshalJSON() ([]byte, error) {

52+ dStr := fmt.Sprintf("%q", d.Duration().String())

53+ return []byte(dStr), nil

54+}

55+

56+// Duration returns the time.Duration version of this Duration

57+func (d *Duration) Duration() time.Duration {

58+ if d == nil {

59+ return time.Duration(0)

60+ }

61+ return time.Duration(*d)

14}

62}

pkg/apis/options/common_test.gonew file+88

@@ -0,0 +1,88 @@

1+package options

2+

3+import (

4+ "encoding/json"

5+ "errors"

6+ "time"

7+

8+ . "github.com/onsi/ginkgo"

9+ . "github.com/onsi/ginkgo/extensions/table"

10+ . "github.com/onsi/gomega"

11+)

12+

13+var _ = Describe("Common", func() {

14+ Context("Duration", func() {

15+ type marshalJSONTableInput struct {

16+ duration Duration

17+ expectedJSON string

18+ }

19+

20+ DescribeTable("MarshalJSON",

21+ func(in marshalJSONTableInput) {

22+ data, err := in.duration.MarshalJSON()

23+ Expect(err).ToNot(HaveOccurred())

24+ Expect(string(data)).To(Equal(in.expectedJSON))

25+

26+ var d Duration

27+ Expect(json.Unmarshal(data, &d)).To(Succeed())

28+ Expect(d).To(Equal(in.duration))

29+ },

30+ Entry("30 seconds", marshalJSONTableInput{

31+ duration: Duration(30 * time.Second),

32+ expectedJSON: "\"30s\"",

33+ }),

34+ Entry("1 minute", marshalJSONTableInput{

35+ duration: Duration(1 * time.Minute),

36+ expectedJSON: "\"1m0s\"",

37+ }),

38+ Entry("1 hour 15 minutes", marshalJSONTableInput{

39+ duration: Duration(75 * time.Minute),

40+ expectedJSON: "\"1h15m0s\"",

41+ }),

42+ Entry("A zero Duration", marshalJSONTableInput{

43+ duration: Duration(0),

44+ expectedJSON: "\"0s\"",

45+ }),

46+ )

47+

48+ type unmarshalJSONTableInput struct {

49+ json string

50+ expectedErr error

51+ expectedDuration Duration

52+ }

53+

54+ DescribeTable("UnmarshalJSON",

55+ func(in unmarshalJSONTableInput) {

56+ // A duration must be initialised pointer before UnmarshalJSON will work.

57+ zero := Duration(0)

58+ d := &zero

59+

60+ err := d.UnmarshalJSON([]byte(in.json))

61+ if in.expectedErr != nil {

62+ Expect(err).To(MatchError(in.expectedErr.Error()))

63+ } else {

64+ Expect(err).ToNot(HaveOccurred())

65+ }

66+ Expect(d).ToNot(BeNil())

67+ Expect(*d).To(Equal(in.expectedDuration))

68+ },

69+ Entry("1m", unmarshalJSONTableInput{

70+ json: "\"1m\"",

71+ expectedDuration: Duration(1 * time.Minute),

72+ }),

73+ Entry("30s", unmarshalJSONTableInput{

74+ json: "\"30s\"",

75+ expectedDuration: Duration(30 * time.Second),

76+ }),

77+ Entry("1h15m", unmarshalJSONTableInput{

78+ json: "\"1h15m\"",

79+ expectedDuration: Duration(75 * time.Minute),

80+ }),

81+ Entry("am", unmarshalJSONTableInput{

82+ json: "\"am\"",

83+ expectedErr: errors.New("time: invalid duration \"am\""),

84+ expectedDuration: Duration(0),

85+ }),

86+ )

87+ })

88+})

pkg/apis/options/header.go+6−6

@@ -5,26 +5,26 @@ package options

5type Header struct {

6 // Name is the header name to be used for this set of values.

7 // Names should be unique within a list of Headers.

8− Name string `json:"name"`

8+ Name string `json:"name,omitempty"`

9

10 // PreserveRequestValue determines whether any values for this header

11 // should be preserved for the request to the upstream server.

12 // This option only takes effet on injected request headers.

13 // Defaults to false (headers that match this header will be stripped).

14− PreserveRequestValue bool `json:"preserveRequestValue"`

14+ PreserveRequestValue bool `json:"preserveRequestValue,omitempty"`

15

16 // Values contains the desired values for this header

17− Values []HeaderValue `json:"values"`

17+ Values []HeaderValue `json:"values,omitempty"`

18}

19

20// HeaderValue represents a single header value and the sources that can

21// make up the header value

22type HeaderValue struct {

23 // Allow users to load the value from a secret source

24− *SecretSource

24+ *SecretSource `json:",omitempty"`

25

26 // Allow users to load the value from a session claim

27− *ClaimSource

27+ *ClaimSource `json:",omitempty"`

28}

29

30// ClaimSource allows loading a header value from a claim within the session

@@ -40,5 +40,5 @@ type ClaimSource struct {

40 // BasicAuthPassword converts this claim into a basic auth header.

41 // Note the value of claim will become the basic auth username and the

42 // basicAuthPassword will be used as the password value.

43− BasicAuthPassword *SecretSource

43+ BasicAuthPassword *SecretSource `json:"basicAuthPassword,omitempty"`

44}

pkg/apis/options/legacy_options.go+4−3

@@ -27,7 +27,7 @@ func NewLegacyOptions() *LegacyOptions {

27 LegacyUpstreams: LegacyUpstreams{

28 PassHostHeader: true,

29 ProxyWebSockets: true,

30− FlushInterval: time.Duration(1) * time.Second,

30+ FlushInterval: DefaultUpstreamFlushInterval,

31 },

32

33 LegacyHeaders: LegacyHeaders{

@@ -62,7 +62,7 @@ type LegacyUpstreams struct {

62func legacyUpstreamsFlagSet() *pflag.FlagSet {

63 flagSet := pflag.NewFlagSet("upstreams", pflag.ExitOnError)

64

65− flagSet.Duration("flush-interval", time.Duration(1)*time.Second, "period between response flushing when streaming responses")

65+ flagSet.Duration("flush-interval", DefaultUpstreamFlushInterval, "period between response flushing when streaming responses")

66 flagSet.Bool("pass-host-header", true, "pass the request Host Header to upstream")

67 flagSet.Bool("proxy-websockets", true, "enables WebSocket proxying")

68 flagSet.Bool("ssl-upstream-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS upstreams")

@@ -84,6 +84,7 @@ func (l *LegacyUpstreams) convert() (Upstreams, error) {

84 u.Path = "/"

85 }

86

87+ flushInterval := Duration(l.FlushInterval)

87 upstream := Upstream{

88 upstream := Upstream{

88 ID: u.Path,

89 ID: u.Path,

89 Path: u.Path,

90 Path: u.Path,

@@ -91,7 +92,7 @@ func (l *LegacyUpstreams) convert() (Upstreams, error) {

91 InsecureSkipTLSVerify: l.SSLUpstreamInsecureSkipVerify,

92 InsecureSkipTLSVerify: l.SSLUpstreamInsecureSkipVerify,

92 PassHostHeader: &l.PassHostHeader,

93 PassHostHeader: &l.PassHostHeader,

93 ProxyWebSockets: &l.ProxyWebSockets,

94 ProxyWebSockets: &l.ProxyWebSockets,

94− FlushInterval: &l.FlushInterval,

95+ FlushInterval: &flushInterval,

95 }

96 }

96

97

97 switch u.Scheme {

98 switch u.Scheme {

pkg/apis/options/legacy_options_test.go+4−4

@@ -17,8 +17,8 @@ var _ = Describe("Legacy Options", func() {

17 legacyOpts := NewLegacyOptions()

18

19 // Set upstreams and related options to test their conversion

20− flushInterval := 5 * time.Second

20+ flushInterval := Duration(5 * time.Second)

21− legacyOpts.LegacyUpstreams.FlushInterval = flushInterval

21+ legacyOpts.LegacyUpstreams.FlushInterval = time.Duration(flushInterval)

22 legacyOpts.LegacyUpstreams.PassHostHeader = true

23 legacyOpts.LegacyUpstreams.ProxyWebSockets = true

24 legacyOpts.LegacyUpstreams.SSLUpstreamInsecureSkipVerify = true

@@ -124,7 +124,7 @@ var _ = Describe("Legacy Options", func() {

124 skipVerify := true

125 passHostHeader := false

126 proxyWebSockets := true

127− flushInterval := 5 * time.Second

127+ flushInterval := Duration(5 * time.Second)

128

129 // Test cases and expected outcomes

130 validHTTP := "http://foo.bar/baz"

@@ -199,7 +199,7 @@ var _ = Describe("Legacy Options", func() {

199 SSLUpstreamInsecureSkipVerify: skipVerify,

200 PassHostHeader: passHostHeader,

201 ProxyWebSockets: proxyWebSockets,

202− FlushInterval: flushInterval,

202+ FlushInterval: time.Duration(flushInterval),

203 }

204

205 upstreams, err := legacyUpstreams.convert()

pkg/apis/options/upstreams.go+13−8

@@ -2,6 +2,11 @@ package options

2

3import "time"

4

5+const (

6+ // DefaultUpstreamFlushInterval is the default value for the Upstream FlushInterval.

7+ DefaultUpstreamFlushInterval = 1 * time.Second

8+)

9+

5// Upstreams is a collection of definitions for upstream servers.

10// Upstreams is a collection of definitions for upstream servers.

6type Upstreams []Upstream

11type Upstreams []Upstream

7

12

@@ -10,11 +15,11 @@ type Upstreams []Upstream

10type Upstream struct {

15type Upstream struct {

11 // ID should be a unique identifier for the upstream.

16 // ID should be a unique identifier for the upstream.

12 // This value is required for all upstreams.

17 // This value is required for all upstreams.

13− ID string `json:"id"`

18+ ID string `json:"id,omitempty"`

14

19

15 // Path is used to map requests to the upstream server.

20 // Path is used to map requests to the upstream server.

16 // The closest match will take precedence and all Paths must be unique.

21 // The closest match will take precedence and all Paths must be unique.

17− Path string `json:"path"`

22+ Path string `json:"path,omitempty"`

18

23

19 // The URI of the upstream server. This may be an HTTP(S) server of a File

24 // The URI of the upstream server. This may be an HTTP(S) server of a File

20 // based URL. It may include a path, in which case all requests will be served

25 // based URL. It may include a path, in which case all requests will be served

@@ -26,19 +31,19 @@ type Upstream struct {

26 // - file://host/path

31 // - file://host/path

27 // If the URI's path is "/base" and the incoming request was for "/dir",

32 // If the URI's path is "/base" and the incoming request was for "/dir",

28 // the upstream request will be for "/base/dir".

33 // the upstream request will be for "/base/dir".

29− URI string `json:"uri"`

34+ URI string `json:"uri,omitempty"`

30

35

31 // InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.

36 // InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts.

32 // This option is insecure and will allow potential Man-In-The-Middle attacks

37 // This option is insecure and will allow potential Man-In-The-Middle attacks

33 // betweem OAuth2 Proxy and the usptream server.

38 // betweem OAuth2 Proxy and the usptream server.

34 // Defaults to false.

39 // Defaults to false.

35− InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify"`

40+ InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify,omitempty"`

36

41

37 // Static will make all requests to this upstream have a static response.

42 // Static will make all requests to this upstream have a static response.

38 // The response will have a body of "Authenticated" and a response code

43 // The response will have a body of "Authenticated" and a response code

39 // matching StaticCode.

44 // matching StaticCode.

40 // If StaticCode is not set, the response will return a 200 response.

45 // If StaticCode is not set, the response will return a 200 response.

41− Static bool `json:"static"`

46+ Static bool `json:"static,omitempty"`

42

47

43 // StaticCode determines the response code for the Static response.

48 // StaticCode determines the response code for the Static response.

44 // This option can only be used with Static enabled.

49 // This option can only be used with Static enabled.

@@ -47,14 +52,14 @@ type Upstream struct {

47 // FlushInterval is the period between flushing the response buffer when

52 // FlushInterval is the period between flushing the response buffer when

48 // streaming response from the upstream.

53 // streaming response from the upstream.

49 // Defaults to 1 second.

54 // Defaults to 1 second.

50− FlushInterval *time.Duration `json:"flushInterval,omitempty"`

55+ FlushInterval *Duration `json:"flushInterval,omitempty"`

51

56

52 // PassHostHeader determines whether the request host header should be proxied

57 // PassHostHeader determines whether the request host header should be proxied

53 // to the upstream server.

58 // to the upstream server.

54 // Defaults to true.

59 // Defaults to true.

55− PassHostHeader *bool `json:"passHostHeader"`

60+ PassHostHeader *bool `json:"passHostHeader,omitempty"`

56

61

57 // ProxyWebSockets enables proxying of websockets to upstream servers

62 // ProxyWebSockets enables proxying of websockets to upstream servers

58 // Defaults to true.

63 // Defaults to true.

59− ProxyWebSockets *bool `json:"proxyWebSockets"`

64+ ProxyWebSockets *bool `json:"proxyWebSockets,omitempty"`

60}

65}

pkg/upstream/http.go+2−3

@@ -6,7 +6,6 @@ import (

6 "net/http/httputil"

7 "net/url"

8 "strings"

9− "time"

10

9

11 "github.com/mbland/hmacauth"

10 "github.com/mbland/hmacauth"

12 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

@@ -98,9 +97,9 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr

98

97

99 // Configure options on the SingleHostReverseProxy

98 // Configure options on the SingleHostReverseProxy

100 if upstream.FlushInterval != nil {

99 if upstream.FlushInterval != nil {

101− proxy.FlushInterval = *upstream.FlushInterval

100+ proxy.FlushInterval = upstream.FlushInterval.Duration()

102 } else {

101 } else {

103− proxy.FlushInterval = 1 * time.Second

102+ proxy.FlushInterval = options.DefaultUpstreamFlushInterval

104 }

103 }

105

104

106 // InsecureSkipVerify is a configurable option we allow

105 // InsecureSkipVerify is a configurable option we allow

pkg/upstream/http_test.go+7−7

@@ -22,8 +22,8 @@ import (

22

23var _ = Describe("HTTP Upstream Suite", func() {

24

25− const flushInterval5s = 5 * time.Second

25+ const flushInterval5s = options.Duration(5 * time.Second)

26− const flushInterval1s = 1 * time.Second

26+ const flushInterval1s = options.Duration(1 * time.Second)

27 truth := true

28 falsum := false

29

@@ -52,7 +52,7 @@ var _ = Describe("HTTP Upstream Suite", func() {

52

53 rw := httptest.NewRecorder()

54

55− flush := 1 * time.Second

55+ flush := options.Duration(1 * time.Second)

56

57 upstream := options.Upstream{

58 ID: in.id,

@@ -258,7 +258,7 @@ var _ = Describe("HTTP Upstream Suite", func() {

258 req := httptest.NewRequest("", "http://example.localhost/foo", nil)

259 rw := httptest.NewRecorder()

260

261− flush := 1 * time.Second

261+ flush := options.Duration(1 * time.Second)

262 upstream := options.Upstream{

263 ID: "noPassHost",

264 PassHostHeader: &falsum,

@@ -290,7 +290,7 @@ var _ = Describe("HTTP Upstream Suite", func() {

290

291 type newUpstreamTableInput struct {

292 proxyWebSockets bool

293− flushInterval time.Duration

293+ flushInterval options.Duration

294 skipVerify bool

295 sigData *options.SignatureData

296 errorHandler func(http.ResponseWriter, *http.Request, error)

@@ -319,7 +319,7 @@ var _ = Describe("HTTP Upstream Suite", func() {

319

320 proxy, ok := upstreamProxy.handler.(*httputil.ReverseProxy)

321 Expect(ok).To(BeTrue())

322− Expect(proxy.FlushInterval).To(Equal(in.flushInterval))

322+ Expect(proxy.FlushInterval).To(Equal(in.flushInterval.Duration()))

323 Expect(proxy.ErrorHandler != nil).To(Equal(in.errorHandler != nil))

324 if in.skipVerify {

325 Expect(proxy.Transport).To(Equal(&http.Transport{

@@ -370,7 +370,7 @@ var _ = Describe("HTTP Upstream Suite", func() {

370 var proxyServer *httptest.Server

371

372 BeforeEach(func() {

373− flush := 1 * time.Second

373+ flush := options.Duration(1 * time.Second)

374 upstream := options.Upstream{

375 ID: "websocketProxy",

376 PassHostHeader: &truth,

pkg/validation/upstreams.go+1−2

@@ -3,7 +3,6 @@ package validation

3import (

4 "fmt"

5 "net/url"

6− "time"

7

6

8 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

7 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

9)

8)

@@ -70,7 +69,7 @@ func validateStaticUpstream(upstream options.Upstream) []string {

70 if upstream.InsecureSkipTLSVerify {

69 if upstream.InsecureSkipTLSVerify {

71 msgs = append(msgs, fmt.Sprintf("upstream %q has insecureSkipTLSVerify, but is a static upstream, this will have no effect.", upstream.ID))

70 msgs = append(msgs, fmt.Sprintf("upstream %q has insecureSkipTLSVerify, but is a static upstream, this will have no effect.", upstream.ID))

72 }

71 }

73− if upstream.FlushInterval != nil && *upstream.FlushInterval != time.Second {

72+ if upstream.FlushInterval != nil && upstream.FlushInterval.Duration() != options.DefaultUpstreamFlushInterval {

74 msgs = append(msgs, fmt.Sprintf("upstream %q has flushInterval, but is a static upstream, this will have no effect.", upstream.ID))

73 msgs = append(msgs, fmt.Sprintf("upstream %q has flushInterval, but is a static upstream, this will have no effect.", upstream.ID))

75 }

74 }

76 if upstream.PassHostHeader != nil {

75 if upstream.PassHostHeader != nil {

pkg/validation/upstreams_test.go+1−1

@@ -15,7 +15,7 @@ var _ = Describe("Upstreams", func() {

15 errStrings []string

16 }

17

18− flushInterval := 5 * time.Second

18+ flushInterval := options.Duration(5 * time.Second)

19 staticCode200 := 200

20 truth := true

21