mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-10-19 04:47:48 +00:00
* Fix bug affecting Azure OIDC authentication ( and most likely others ) * Fixes issue #51 * Ensure that appended roles are unique. Update the documentation. * Improvements targetting possible memory usage spikes. * Additional fixes and cleanup * Refactoring code to fix the issues identified by the users. * Modernize run * Fieldalignment * Multiple changes to improve performance and reduce complexity. - Optimise the errors and recovery. - Deduplicate code in metadata cache. - Remove unused performance monitoring code. - Simplify session management and settings handling. * Fix claims issue. * Add ability to overwrite the default scopes in the settings file * Well.. that escalated quickly. Completely forgot that Traefik uses outdated Yaegi and requires compatibility with 1.20 ( pre-generic Go code ). * Bugfix #51: Ensures that user provided scopes overrides work. * fixup! Bugfix #51: Ensures that user provided scopes overrides work. * fixup! fixup! Bugfix #51: Ensures that user provided scopes overrides work. * Abstract the provider logic into a separate package. * Additional micro fixes and cleanups. * Simplify all the things. * fixup! Simplify all the things. * fixup! fixup! Simplify all the things. * fixup! fixup! fixup! Simplify all the things. * fixup! fixup! fixup! fixup! Simplify all the things. * ... * Cleanup tests. * fixup! Cleanup tests. * fixup! fixup! fixup! Cleanup tests. * fixup! fixup! fixup! fixup! Cleanup tests. * fixup! fixup! fixup! fixup! fixup! Cleanup tests. * Issue #53: Fix CSRF token handling in reverse proxy 1. ✅ HTTPS Detection Fixed (session.go:723) - Now uses X-Forwarded-Proto header instead of r.URL.Scheme - Properly detects HTTPS in reverse proxy environments 2. ✅ SameSite Cookie Attribute Fixed - Removed automatic SameSiteStrictMode for HTTPS (would break OAuth) - Keeps SameSiteLaxMode to allow OAuth callbacks from external domains - Only uses Strict for AJAX requests which don't involve OAuth redirects 3. ✅ Cookie Domain Handling Fixed - Now respects X-Forwarded-Host header for cookie domain - Ensures cookies are set for the public domain, not internal proxy domain 4. ✅ EnhanceSessionSecurity Properly Integrated - Function is now actually called during session save - Applies security enhancements without breaking OAuth flow Why Issue #53 Failed Before: 1. Cookies were not marked Secure in HTTPS environments (browser wouldn't send them back) 2. If they had been Secure with SameSite=Strict, Azure callbacks would still fail 3. Cookie domain might have been wrong (internal vs public domain) Why It Works Now: 1. Cookies are properly marked Secure for HTTPS 2. Uses SameSite=Lax to allow OAuth provider callbacks 3. Cookie domain uses public domain from X-Forwarded-Host 4. CSRF token persists through the entire OAuth flow * Next set of enhancements together with memory usage improvements. * Memory leak fixes and optimisations. * CSRF and Cookie Domain fixes * fixup! CSRF and Cookie Domain fixes * Metadata cache leak fix + profiling * fixup! Metadata cache leak fix + profiling * Memory leaks hunting, part 1337. * Further pursue of perfection. * fixup! Further pursue of perfection. * fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * Clear race conditions * fixup! Clear race conditions * Weekend fun with memory leaks * Splitting code into multiple files with reasonable testing coverage. ``` ok github.com/lukaszraczylo/traefikoidc 117.017s coverage: 72.6% of statements ok github.com/lukaszraczylo/traefikoidc/auth 0.505s coverage: 87.1% of statements ok github.com/lukaszraczylo/traefikoidc/circuit_breaker 0.283s coverage: 99.0% of statements github.com/lukaszraczylo/traefikoidc/config coverage: 0.0% of statements ok github.com/lukaszraczylo/traefikoidc/handlers 0.349s coverage: 98.2% of statements ok github.com/lukaszraczylo/traefikoidc/internal/providers (cached) coverage: 94.3% of statements ok github.com/lukaszraczylo/traefikoidc/middleware 0.808s coverage: 78.0% of statements ok github.com/lukaszraczylo/traefikoidc/recovery 0.653s coverage: 100.0% of statements ok github.com/lukaszraczylo/traefikoidc/session/chunking (cached) coverage: 87.8% of statements ok github.com/lukaszraczylo/traefikoidc/session/core (cached) coverage: 85.6% of statements ok github.com/lukaszraczylo/traefikoidc/session/crypto (cached) coverage: 81.8% of statements ok github.com/lukaszraczylo/traefikoidc/session/storage (cached) coverage: 93.5% of statements ok github.com/lukaszraczylo/traefikoidc/session/validators (cached) coverage: 98.8% of statements ```` * fixup! Splitting code into multiple files with reasonable testing coverage. * fixup! fixup! Splitting code into multiple files with reasonable testing coverage. * Weekend fun with further optimisations. * fixup! Weekend fun with further optimisations. * fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! fixup! fixup! Weekend fun with further optimisations. * Pre-release cleanup. * Enhance test coverage. * fixup! Enhance test coverage. * fixup! fixup! Enhance test coverage. * fixup! fixup! fixup! Enhance test coverage.
199 lines
6.0 KiB
Go
199 lines
6.0 KiB
Go
//
|
|
// Copyright (c) 2011-2019 Canonical Ltd
|
|
// Copyright (c) 2006-2010 Kirill Simonov
|
|
//
|
|
// Permission is hereby granted, free of charge, to any person obtaining a copy of
|
|
// this software and associated documentation files (the "Software"), to deal in
|
|
// the Software without restriction, including without limitation the rights to
|
|
// use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
|
|
// of the Software, and to permit persons to whom the Software is furnished to do
|
|
// so, subject to the following conditions:
|
|
//
|
|
// The above copyright notice and this permission notice shall be included in all
|
|
// copies or substantial portions of the Software.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
// SOFTWARE.
|
|
|
|
package yaml
|
|
|
|
const (
|
|
// The size of the input raw buffer.
|
|
input_raw_buffer_size = 512
|
|
|
|
// The size of the input buffer.
|
|
// It should be possible to decode the whole raw buffer.
|
|
input_buffer_size = input_raw_buffer_size * 3
|
|
|
|
// The size of the output buffer.
|
|
output_buffer_size = 128
|
|
|
|
// The size of the output raw buffer.
|
|
// It should be possible to encode the whole output buffer.
|
|
output_raw_buffer_size = (output_buffer_size*2 + 2)
|
|
|
|
// The size of other stacks and queues.
|
|
initial_stack_size = 16
|
|
initial_queue_size = 16
|
|
initial_string_size = 16
|
|
)
|
|
|
|
// Check if the character at the specified position is an alphabetical
|
|
// character, a digit, '_', or '-'.
|
|
func is_alpha(b []byte, i int) bool {
|
|
return b[i] >= '0' && b[i] <= '9' || b[i] >= 'A' && b[i] <= 'Z' || b[i] >= 'a' && b[i] <= 'z' || b[i] == '_' || b[i] == '-'
|
|
}
|
|
|
|
// Check if the character at the specified position is a digit.
|
|
func is_digit(b []byte, i int) bool {
|
|
return b[i] >= '0' && b[i] <= '9'
|
|
}
|
|
|
|
// Get the value of a digit.
|
|
func as_digit(b []byte, i int) int {
|
|
return int(b[i]) - '0'
|
|
}
|
|
|
|
// Check if the character at the specified position is a hex-digit.
|
|
func is_hex(b []byte, i int) bool {
|
|
return b[i] >= '0' && b[i] <= '9' || b[i] >= 'A' && b[i] <= 'F' || b[i] >= 'a' && b[i] <= 'f'
|
|
}
|
|
|
|
// Get the value of a hex-digit.
|
|
func as_hex(b []byte, i int) int {
|
|
bi := b[i]
|
|
if bi >= 'A' && bi <= 'F' {
|
|
return int(bi) - 'A' + 10
|
|
}
|
|
if bi >= 'a' && bi <= 'f' {
|
|
return int(bi) - 'a' + 10
|
|
}
|
|
return int(bi) - '0'
|
|
}
|
|
|
|
// Check if the character is ASCII.
|
|
func is_ascii(b []byte, i int) bool {
|
|
return b[i] <= 0x7F
|
|
}
|
|
|
|
// Check if the character at the start of the buffer can be printed unescaped.
|
|
func is_printable(b []byte, i int) bool {
|
|
return ((b[i] == 0x0A) || // . == #x0A
|
|
(b[i] >= 0x20 && b[i] <= 0x7E) || // #x20 <= . <= #x7E
|
|
(b[i] == 0xC2 && b[i+1] >= 0xA0) || // #0xA0 <= . <= #xD7FF
|
|
(b[i] > 0xC2 && b[i] < 0xED) ||
|
|
(b[i] == 0xED && b[i+1] < 0xA0) ||
|
|
(b[i] == 0xEE) ||
|
|
(b[i] == 0xEF && // #xE000 <= . <= #xFFFD
|
|
!(b[i+1] == 0xBB && b[i+2] == 0xBF) && // && . != #xFEFF
|
|
!(b[i+1] == 0xBF && (b[i+2] == 0xBE || b[i+2] == 0xBF))))
|
|
}
|
|
|
|
// Check if the character at the specified position is NUL.
|
|
func is_z(b []byte, i int) bool {
|
|
return b[i] == 0x00
|
|
}
|
|
|
|
// Check if the beginning of the buffer is a BOM.
|
|
func is_bom(b []byte, i int) bool {
|
|
return b[0] == 0xEF && b[1] == 0xBB && b[2] == 0xBF
|
|
}
|
|
|
|
// Check if the character at the specified position is space.
|
|
func is_space(b []byte, i int) bool {
|
|
return b[i] == ' '
|
|
}
|
|
|
|
// Check if the character at the specified position is tab.
|
|
func is_tab(b []byte, i int) bool {
|
|
return b[i] == '\t'
|
|
}
|
|
|
|
// Check if the character at the specified position is blank (space or tab).
|
|
func is_blank(b []byte, i int) bool {
|
|
//return is_space(b, i) || is_tab(b, i)
|
|
return b[i] == ' ' || b[i] == '\t'
|
|
}
|
|
|
|
// Check if the character at the specified position is a line break.
|
|
func is_break(b []byte, i int) bool {
|
|
return (b[i] == '\r' || // CR (#xD)
|
|
b[i] == '\n' || // LF (#xA)
|
|
b[i] == 0xC2 && b[i+1] == 0x85 || // NEL (#x85)
|
|
b[i] == 0xE2 && b[i+1] == 0x80 && b[i+2] == 0xA8 || // LS (#x2028)
|
|
b[i] == 0xE2 && b[i+1] == 0x80 && b[i+2] == 0xA9) // PS (#x2029)
|
|
}
|
|
|
|
func is_crlf(b []byte, i int) bool {
|
|
return b[i] == '\r' && b[i+1] == '\n'
|
|
}
|
|
|
|
// Check if the character is a line break or NUL.
|
|
func is_breakz(b []byte, i int) bool {
|
|
//return is_break(b, i) || is_z(b, i)
|
|
return (
|
|
// is_break:
|
|
b[i] == '\r' || // CR (#xD)
|
|
b[i] == '\n' || // LF (#xA)
|
|
b[i] == 0xC2 && b[i+1] == 0x85 || // NEL (#x85)
|
|
b[i] == 0xE2 && b[i+1] == 0x80 && b[i+2] == 0xA8 || // LS (#x2028)
|
|
b[i] == 0xE2 && b[i+1] == 0x80 && b[i+2] == 0xA9 || // PS (#x2029)
|
|
// is_z:
|
|
b[i] == 0)
|
|
}
|
|
|
|
// Check if the character is a line break, space, or NUL.
|
|
func is_spacez(b []byte, i int) bool {
|
|
//return is_space(b, i) || is_breakz(b, i)
|
|
return (
|
|
// is_space:
|
|
b[i] == ' ' ||
|
|
// is_breakz:
|
|
b[i] == '\r' || // CR (#xD)
|
|
b[i] == '\n' || // LF (#xA)
|
|
b[i] == 0xC2 && b[i+1] == 0x85 || // NEL (#x85)
|
|
b[i] == 0xE2 && b[i+1] == 0x80 && b[i+2] == 0xA8 || // LS (#x2028)
|
|
b[i] == 0xE2 && b[i+1] == 0x80 && b[i+2] == 0xA9 || // PS (#x2029)
|
|
b[i] == 0)
|
|
}
|
|
|
|
// Check if the character is a line break, space, tab, or NUL.
|
|
func is_blankz(b []byte, i int) bool {
|
|
//return is_blank(b, i) || is_breakz(b, i)
|
|
return (
|
|
// is_blank:
|
|
b[i] == ' ' || b[i] == '\t' ||
|
|
// is_breakz:
|
|
b[i] == '\r' || // CR (#xD)
|
|
b[i] == '\n' || // LF (#xA)
|
|
b[i] == 0xC2 && b[i+1] == 0x85 || // NEL (#x85)
|
|
b[i] == 0xE2 && b[i+1] == 0x80 && b[i+2] == 0xA8 || // LS (#x2028)
|
|
b[i] == 0xE2 && b[i+1] == 0x80 && b[i+2] == 0xA9 || // PS (#x2029)
|
|
b[i] == 0)
|
|
}
|
|
|
|
// Determine the width of the character.
|
|
func width(b byte) int {
|
|
// Don't replace these by a switch without first
|
|
// confirming that it is being inlined.
|
|
if b&0x80 == 0x00 {
|
|
return 1
|
|
}
|
|
if b&0xE0 == 0xC0 {
|
|
return 2
|
|
}
|
|
if b&0xF0 == 0xE0 {
|
|
return 3
|
|
}
|
|
if b&0xF8 == 0xF0 {
|
|
return 4
|
|
}
|
|
return 0
|
|
|
|
}
|