Complete rebuild of the plugin

* Fix bug affecting Azure OIDC authentication ( and most likely others ) * Fixes issue #51 * Ensure that appended roles are unique. Update the documentation. * Improvements targetting possible memory usage spikes. * Additional fixes and cleanup * Refactoring code to fix the issues identified by the users. * Modernize run * Fieldalignment * Multiple changes to improve performance and reduce complexity. - Optimise the errors and recovery. - Deduplicate code in metadata cache. - Remove unused performance monitoring code. - Simplify session management and settings handling. * Fix claims issue. * Add ability to overwrite the default scopes in the settings file * Well.. that escalated quickly. Completely forgot that Traefik uses outdated Yaegi and requires compatibility with 1.20 ( pre-generic Go code ). * Bugfix #51: Ensures that user provided scopes overrides work. * fixup! Bugfix #51: Ensures that user provided scopes overrides work. * fixup! fixup! Bugfix #51: Ensures that user provided scopes overrides work. * Abstract the provider logic into a separate package. * Additional micro fixes and cleanups. * Simplify all the things. * fixup! Simplify all the things. * fixup! fixup! Simplify all the things. * fixup! fixup! fixup! Simplify all the things. * fixup! fixup! fixup! fixup! Simplify all the things. * ... * Cleanup tests. * fixup! Cleanup tests. * fixup! fixup! fixup! Cleanup tests. * fixup! fixup! fixup! fixup! Cleanup tests. * fixup! fixup! fixup! fixup! fixup! Cleanup tests. * Issue #53: Fix CSRF token handling in reverse proxy 1. ✅ HTTPS Detection Fixed (session.go:723) - Now uses X-Forwarded-Proto header instead of r.URL.Scheme - Properly detects HTTPS in reverse proxy environments 2. ✅ SameSite Cookie Attribute Fixed - Removed automatic SameSiteStrictMode for HTTPS (would break OAuth) - Keeps SameSiteLaxMode to allow OAuth callbacks from external domains - Only uses Strict for AJAX requests which don't involve OAuth redirects 3. ✅ Cookie Domain Handling Fixed - Now respects X-Forwarded-Host header for cookie domain - Ensures cookies are set for the public domain, not internal proxy domain 4. ✅ EnhanceSessionSecurity Properly Integrated - Function is now actually called during session save - Applies security enhancements without breaking OAuth flow Why Issue #53 Failed Before: 1. Cookies were not marked Secure in HTTPS environments (browser wouldn't send them back) 2. If they had been Secure with SameSite=Strict, Azure callbacks would still fail 3. Cookie domain might have been wrong (internal vs public domain) Why It Works Now: 1. Cookies are properly marked Secure for HTTPS 2. Uses SameSite=Lax to allow OAuth provider callbacks 3. Cookie domain uses public domain from X-Forwarded-Host 4. CSRF token persists through the entire OAuth flow * Next set of enhancements together with memory usage improvements. * Memory leak fixes and optimisations. * CSRF and Cookie Domain fixes * fixup! CSRF and Cookie Domain fixes * Metadata cache leak fix + profiling * fixup! Metadata cache leak fix + profiling * Memory leaks hunting, part 1337. * Further pursue of perfection. * fixup! Further pursue of perfection. * fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * Clear race conditions * fixup! Clear race conditions * Weekend fun with memory leaks * Splitting code into multiple files with reasonable testing coverage. ``` ok github.com/lukaszraczylo/traefikoidc 117.017s coverage: 72.6% of statements ok github.com/lukaszraczylo/traefikoidc/auth 0.505s coverage: 87.1% of statements ok github.com/lukaszraczylo/traefikoidc/circuit_breaker 0.283s coverage: 99.0% of statements github.com/lukaszraczylo/traefikoidc/config coverage: 0.0% of statements ok github.com/lukaszraczylo/traefikoidc/handlers 0.349s coverage: 98.2% of statements ok github.com/lukaszraczylo/traefikoidc/internal/providers (cached) coverage: 94.3% of statements ok github.com/lukaszraczylo/traefikoidc/middleware 0.808s coverage: 78.0% of statements ok github.com/lukaszraczylo/traefikoidc/recovery 0.653s coverage: 100.0% of statements ok github.com/lukaszraczylo/traefikoidc/session/chunking (cached) coverage: 87.8% of statements ok github.com/lukaszraczylo/traefikoidc/session/core (cached) coverage: 85.6% of statements ok github.com/lukaszraczylo/traefikoidc/session/crypto (cached) coverage: 81.8% of statements ok github.com/lukaszraczylo/traefikoidc/session/storage (cached) coverage: 93.5% of statements ok github.com/lukaszraczylo/traefikoidc/session/validators (cached) coverage: 98.8% of statements ```` * fixup! Splitting code into multiple files with reasonable testing coverage. * fixup! fixup! Splitting code into multiple files with reasonable testing coverage. * Weekend fun with further optimisations. * fixup! Weekend fun with further optimisations. * fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! fixup! fixup! Weekend fun with further optimisations. * Pre-release cleanup. * Enhance test coverage. * fixup! Enhance test coverage. * fixup! fixup! Enhance test coverage. * fixup! fixup! fixup! Enhance test coverage.
2026-10-14 04:07:46 +00:00 · 2025-09-18 11:01:30 +01:00
parent 784b161732
commit 1b49e133da
181 changed files with 78067 additions and 8289 deletions
@@ -0,0 +1,473 @@
+// Package pool provides a unified, centralized memory pool management system
+// for the entire application. It consolidates all duplicate pool implementations
+// into a single, efficient, and thread-safe package.
+package pool
+
+import (
+	"bytes"
+	"compress/gzip"
+	"strings"
+	"sync"
+	"sync/atomic"
+)
+
+// Manager is the centralized pool manager that consolidates all memory pools
+// used throughout the application. It provides a single entry point for
+// all pooling operations, reducing duplicate code and improving maintainability.
+type Manager struct {
+	// Buffer pools
+	smallBufferPool  *sync.Pool // 1KB buffers
+	mediumBufferPool *sync.Pool // 4KB buffers
+	largeBufferPool  *sync.Pool // 8KB buffers
+	xlBufferPool     *sync.Pool // 16KB buffers
+
+	// Compression pools
+	gzipWriterPool *sync.Pool
+	gzipReaderPool *sync.Pool
+
+	// String builder pool
+	stringBuilderPool *sync.Pool
+
+	// JWT parsing buffers
+	jwtBufferPool *sync.Pool
+
+	// HTTP response buffers
+	httpResponsePool *sync.Pool
+
+	// Byte slice pools for various sizes
+	byteSlicePools map[int]*sync.Pool
+	poolMu         sync.RWMutex
+
+	// Statistics
+	stats PoolStats
+}
+
+// PoolStats tracks pool usage statistics
+type PoolStats struct {
+	BufferGets       uint64
+	BufferPuts       uint64
+	GzipGets         uint64
+	GzipPuts         uint64
+	StringGets       uint64
+	StringPuts       uint64
+	JWTGets          uint64
+	JWTPuts          uint64
+	HTTPGets         uint64
+	HTTPPuts         uint64
+	OversizedRejects uint64
+}
+
+// JWTBuffer provides pre-allocated buffers for JWT parsing
+type JWTBuffer struct {
+	Header    []byte
+	Payload   []byte
+	Signature []byte
+}
+
+var (
+	// globalManager is the singleton pool manager instance
+	globalManager *Manager
+	// managerOnce ensures single initialization
+	managerOnce sync.Once
+)
+
+// Get returns the global pool manager instance
+func Get() *Manager {
+	managerOnce.Do(func() {
+		globalManager = newManager()
+	})
+	return globalManager
+}
+
+// newManager creates a new pool manager with all pools initialized
+func newManager() *Manager {
+	m := &Manager{
+		byteSlicePools: make(map[int]*sync.Pool),
+	}
+
+	// Initialize buffer pools with different sizes
+	m.smallBufferPool = &sync.Pool{
+		New: func() interface{} {
+			return bytes.NewBuffer(make([]byte, 0, 1024))
+		},
+	}
+
+	m.mediumBufferPool = &sync.Pool{
+		New: func() interface{} {
+			return bytes.NewBuffer(make([]byte, 0, 4096))
+		},
+	}
+
+	m.largeBufferPool = &sync.Pool{
+		New: func() interface{} {
+			return bytes.NewBuffer(make([]byte, 0, 8192))
+		},
+	}
+
+	m.xlBufferPool = &sync.Pool{
+		New: func() interface{} {
+			return bytes.NewBuffer(make([]byte, 0, 16384))
+		},
+	}
+
+	// Initialize compression pools
+	m.gzipWriterPool = &sync.Pool{
+		New: func() interface{} {
+			w, _ := gzip.NewWriterLevel(nil, gzip.BestSpeed)
+			return w
+		},
+	}
+
+	m.gzipReaderPool = &sync.Pool{
+		New: func() interface{} {
+			return (*gzip.Reader)(nil)
+		},
+	}
+
+	// Initialize string builder pool
+	m.stringBuilderPool = &sync.Pool{
+		New: func() interface{} {
+			sb := &strings.Builder{}
+			sb.Grow(1024)
+			return sb
+		},
+	}
+
+	// Initialize JWT buffer pool
+	m.jwtBufferPool = &sync.Pool{
+		New: func() interface{} {
+			return &JWTBuffer{
+				Header:    make([]byte, 0, 512),
+				Payload:   make([]byte, 0, 2048),
+				Signature: make([]byte, 0, 512),
+			}
+		},
+	}
+
+	// Initialize HTTP response buffer pool
+	m.httpResponsePool = &sync.Pool{
+		New: func() interface{} {
+			buf := make([]byte, 0, 8192)
+			return &buf
+		},
+	}
+
+	// Initialize common byte slice pools
+	for _, size := range []int{256, 512, 1024, 2048, 4096, 8192, 16384} {
+		size := size // capture for closure
+		m.byteSlicePools[size] = &sync.Pool{
+			New: func() interface{} {
+				b := make([]byte, size)
+				return &b
+			},
+		}
+	}
+
+	return m
+}
+
+// GetBuffer returns a buffer from the appropriate pool based on size hint
+func (m *Manager) GetBuffer(sizeHint int) *bytes.Buffer {
+	atomic.AddUint64(&m.stats.BufferGets, 1)
+
+	switch {
+	case sizeHint <= 1024:
+		return m.smallBufferPool.Get().(*bytes.Buffer)
+	case sizeHint <= 4096:
+		return m.mediumBufferPool.Get().(*bytes.Buffer)
+	case sizeHint <= 8192:
+		return m.largeBufferPool.Get().(*bytes.Buffer)
+	case sizeHint <= 16384:
+		return m.xlBufferPool.Get().(*bytes.Buffer)
+	default:
+		// For very large buffers, create new ones
+		return bytes.NewBuffer(make([]byte, 0, sizeHint))
+	}
+}
+
+// PutBuffer returns a buffer to the appropriate pool
+func (m *Manager) PutBuffer(buf *bytes.Buffer) {
+	if buf == nil {
+		return
+	}
+
+	atomic.AddUint64(&m.stats.BufferPuts, 1)
+
+	// Reset buffer before returning to pool
+	capacity := buf.Cap()
+	buf.Reset()
+
+	// Reject oversized buffers to prevent memory bloat
+	if capacity > 32768 {
+		atomic.AddUint64(&m.stats.OversizedRejects, 1)
+		return
+	}
+
+	// Return to appropriate pool based on capacity
+	switch {
+	case capacity <= 1024:
+		m.smallBufferPool.Put(buf)
+	case capacity <= 4096:
+		m.mediumBufferPool.Put(buf)
+	case capacity <= 8192:
+		m.largeBufferPool.Put(buf)
+	case capacity <= 16384:
+		m.xlBufferPool.Put(buf)
+	}
+}
+
+// GetGzipWriter returns a gzip writer from the pool
+func (m *Manager) GetGzipWriter() *gzip.Writer {
+	atomic.AddUint64(&m.stats.GzipGets, 1)
+	return m.gzipWriterPool.Get().(*gzip.Writer)
+}
+
+// PutGzipWriter returns a gzip writer to the pool
+func (m *Manager) PutGzipWriter(w *gzip.Writer) {
+	if w == nil {
+		return
+	}
+	atomic.AddUint64(&m.stats.GzipPuts, 1)
+	w.Reset(nil)
+	m.gzipWriterPool.Put(w)
+}
+
+// GetGzipReader returns a gzip reader from the pool
+func (m *Manager) GetGzipReader() *gzip.Reader {
+	atomic.AddUint64(&m.stats.GzipGets, 1)
+	r := m.gzipReaderPool.Get()
+	if r == nil {
+		return nil
+	}
+	return r.(*gzip.Reader)
+}
+
+// PutGzipReader returns a gzip reader to the pool
+func (m *Manager) PutGzipReader(r *gzip.Reader) {
+	if r == nil {
+		return
+	}
+	atomic.AddUint64(&m.stats.GzipPuts, 1)
+	r.Reset(nil)
+	m.gzipReaderPool.Put(r)
+}
+
+// GetStringBuilder returns a string builder from the pool
+func (m *Manager) GetStringBuilder() *strings.Builder {
+	atomic.AddUint64(&m.stats.StringGets, 1)
+	sb := m.stringBuilderPool.Get().(*strings.Builder)
+	sb.Reset()
+	return sb
+}
+
+// PutStringBuilder returns a string builder to the pool
+func (m *Manager) PutStringBuilder(sb *strings.Builder) {
+	if sb == nil {
+		return
+	}
+
+	atomic.AddUint64(&m.stats.StringPuts, 1)
+
+	// Reject oversized builders
+	if sb.Cap() > 16384 {
+		atomic.AddUint64(&m.stats.OversizedRejects, 1)
+		return
+	}
+
+	sb.Reset()
+	m.stringBuilderPool.Put(sb)
+}
+
+// GetJWTBuffer returns JWT parsing buffers from the pool
+func (m *Manager) GetJWTBuffer() *JWTBuffer {
+	atomic.AddUint64(&m.stats.JWTGets, 1)
+	return m.jwtBufferPool.Get().(*JWTBuffer)
+}
+
+// PutJWTBuffer returns JWT parsing buffers to the pool
+func (m *Manager) PutJWTBuffer(buf *JWTBuffer) {
+	if buf == nil {
+		return
+	}
+
+	atomic.AddUint64(&m.stats.JWTPuts, 1)
+
+	// Check for oversized buffers
+	if cap(buf.Header) > 2048 || cap(buf.Payload) > 8192 || cap(buf.Signature) > 2048 {
+		atomic.AddUint64(&m.stats.OversizedRejects, 1)
+		return
+	}
+
+	// Reset slices to zero length
+	buf.Header = buf.Header[:0]
+	buf.Payload = buf.Payload[:0]
+	buf.Signature = buf.Signature[:0]
+	m.jwtBufferPool.Put(buf)
+}
+
+// GetHTTPResponseBuffer returns an HTTP response buffer from the pool
+func (m *Manager) GetHTTPResponseBuffer() []byte {
+	atomic.AddUint64(&m.stats.HTTPGets, 1)
+	return *m.httpResponsePool.Get().(*[]byte)
+}
+
+// PutHTTPResponseBuffer returns an HTTP response buffer to the pool
+func (m *Manager) PutHTTPResponseBuffer(buf []byte) {
+	if buf == nil {
+		return
+	}
+
+	atomic.AddUint64(&m.stats.HTTPPuts, 1)
+
+	// Reject oversized buffers
+	if cap(buf) > 32768 {
+		atomic.AddUint64(&m.stats.OversizedRejects, 1)
+		return
+	}
+
+	buf = buf[:0]
+	m.httpResponsePool.Put(&buf)
+}
+
+// GetByteSlice returns a byte slice of the specified size from the pool
+func (m *Manager) GetByteSlice(size int) []byte {
+	m.poolMu.RLock()
+	pool, exists := m.byteSlicePools[size]
+	m.poolMu.RUnlock()
+
+	if !exists {
+		// Round up to nearest power of 2
+		poolSize := 1
+		for poolSize < size {
+			poolSize *= 2
+		}
+
+		m.poolMu.Lock()
+		// Double-check after acquiring write lock
+		pool, exists = m.byteSlicePools[poolSize]
+		if !exists {
+			pool = &sync.Pool{
+				New: func() interface{} {
+					b := make([]byte, poolSize)
+					return &b
+				},
+			}
+			m.byteSlicePools[poolSize] = pool
+		}
+		m.poolMu.Unlock()
+	}
+
+	b := pool.Get().(*[]byte)
+	return (*b)[:size]
+}
+
+// PutByteSlice returns a byte slice to the pool
+func (m *Manager) PutByteSlice(b []byte) {
+	if b == nil || cap(b) > 65536 { // Don't pool very large slices
+		return
+	}
+
+	size := cap(b)
+	m.poolMu.RLock()
+	pool, exists := m.byteSlicePools[size]
+	m.poolMu.RUnlock()
+
+	if exists {
+		b = b[:0]
+		pool.Put(&b)
+	}
+}
+
+// GetStats returns current pool statistics
+func (m *Manager) GetStats() PoolStats {
+	return PoolStats{
+		BufferGets:       atomic.LoadUint64(&m.stats.BufferGets),
+		BufferPuts:       atomic.LoadUint64(&m.stats.BufferPuts),
+		GzipGets:         atomic.LoadUint64(&m.stats.GzipGets),
+		GzipPuts:         atomic.LoadUint64(&m.stats.GzipPuts),
+		StringGets:       atomic.LoadUint64(&m.stats.StringGets),
+		StringPuts:       atomic.LoadUint64(&m.stats.StringPuts),
+		JWTGets:          atomic.LoadUint64(&m.stats.JWTGets),
+		JWTPuts:          atomic.LoadUint64(&m.stats.JWTPuts),
+		HTTPGets:         atomic.LoadUint64(&m.stats.HTTPGets),
+		HTTPPuts:         atomic.LoadUint64(&m.stats.HTTPPuts),
+		OversizedRejects: atomic.LoadUint64(&m.stats.OversizedRejects),
+	}
+}
+
+// ResetStats resets all statistics counters
+func (m *Manager) ResetStats() {
+	atomic.StoreUint64(&m.stats.BufferGets, 0)
+	atomic.StoreUint64(&m.stats.BufferPuts, 0)
+	atomic.StoreUint64(&m.stats.GzipGets, 0)
+	atomic.StoreUint64(&m.stats.GzipPuts, 0)
+	atomic.StoreUint64(&m.stats.StringGets, 0)
+	atomic.StoreUint64(&m.stats.StringPuts, 0)
+	atomic.StoreUint64(&m.stats.JWTGets, 0)
+	atomic.StoreUint64(&m.stats.JWTPuts, 0)
+	atomic.StoreUint64(&m.stats.HTTPGets, 0)
+	atomic.StoreUint64(&m.stats.HTTPPuts, 0)
+	atomic.StoreUint64(&m.stats.OversizedRejects, 0)
+}
+
+// Global convenience functions
+
+// Buffer returns a buffer from the global pool
+func Buffer(sizeHint int) *bytes.Buffer {
+	return Get().GetBuffer(sizeHint)
+}
+
+// ReturnBuffer returns a buffer to the global pool
+func ReturnBuffer(buf *bytes.Buffer) {
+	Get().PutBuffer(buf)
+}
+
+// GzipWriter returns a gzip writer from the global pool
+func GzipWriter() *gzip.Writer {
+	return Get().GetGzipWriter()
+}
+
+// ReturnGzipWriter returns a gzip writer to the global pool
+func ReturnGzipWriter(w *gzip.Writer) {
+	Get().PutGzipWriter(w)
+}
+
+// StringBuilder returns a string builder from the global pool
+func StringBuilder() *strings.Builder {
+	return Get().GetStringBuilder()
+}
+
+// ReturnStringBuilder returns a string builder to the global pool
+func ReturnStringBuilder(sb *strings.Builder) {
+	Get().PutStringBuilder(sb)
+}
+
+// JWTBuffers returns JWT parsing buffers from the global pool
+func JWTBuffers() *JWTBuffer {
+	return Get().GetJWTBuffer()
+}
+
+// ReturnJWTBuffers returns JWT parsing buffers to the global pool
+func ReturnJWTBuffers(buf *JWTBuffer) {
+	Get().PutJWTBuffer(buf)
+}
+
+// HTTPBuffer returns an HTTP response buffer from the global pool
+func HTTPBuffer() []byte {
+	return Get().GetHTTPResponseBuffer()
+}
+
+// ReturnHTTPBuffer returns an HTTP response buffer to the global pool
+func ReturnHTTPBuffer(buf []byte) {
+	Get().PutHTTPResponseBuffer(buf)
+}
+
+// ByteSlice returns a byte slice from the global pool
+func ByteSlice(size int) []byte {
+	return Get().GetByteSlice(size)
+}
+
+// ReturnByteSlice returns a byte slice to the global pool
+func ReturnByteSlice(b []byte) {
+	Get().PutByteSlice(b)
+}