Skip to content

Commit 0c8b78a

Browse files
aarmamaarmam
authored
Merge 87e14c7 into 9f37172 
2 parents 9f37172 + 87e14c7 commit 0c8b78a

File tree

6 files changed

+300
-9
lines changed

6 files changed

+300
-9
lines changed

‎consent/strategy_default.go

+20-5
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ import (
1212
"strings"
1313
"time"
1414

15+
"github.com/ory/x/httpx"
16+
1517
"github.com/gorilla/sessions"
1618
"github.com/pborman/uuid"
1719
"github.com/pkg/errors"
@@ -38,17 +40,30 @@ const (
3840
)
3941

4042
type DefaultStrategy struct {
41-
c *config.DefaultProvider
42-
r InternalRegistry
43+
c *config.DefaultProvider
44+
r InternalRegistry
45+
httpClientOptions httpx.ResilientOptions
4346
}
4447

4548
func NewStrategy(
4649
r InternalRegistry,
4750
c *config.DefaultProvider,
4851
) *DefaultStrategy {
52+
httpClientTlsConfig, err := c.TLSClientConfigWithDefaultFallback(config.KeyPrefixClientBackChannelLogout)
53+
if err != nil {
54+
r.Logger().WithError(err).Fatalf("Unable to setup back-channel logout http client TLS configuration.")
55+
}
56+
httpClientOptions := httpx.ResilientClientWithClient(&http.Client{
57+
Timeout: time.Minute,
58+
Transport: &http.Transport{
59+
Proxy: http.ProxyFromEnvironment,
60+
TLSClientConfig: httpClientTlsConfig,
61+
},
62+
})
4963
return &DefaultStrategy{
50-
c: c,
51-
r: r,
64+
c: c,
65+
r: r,
66+
httpClientOptions: httpClientOptions,
5267
}
5368
}
5469

@@ -688,7 +703,7 @@ func (s *DefaultStrategy) executeBackChannelLogout(ctx context.Context, r *http.
688703
WithField("client_id", t.clientID).
689704
WithField("backchannel_logout_url", t.url)
690705

691-
res, err := s.r.HTTPClient(ctx).PostForm(t.url, url.Values{"logout_token": {t.token}})
706+
res, err := s.r.HTTPClient(ctx, s.httpClientOptions).PostForm(t.url, url.Values{"logout_token": {t.token}})
692707
if err != nil {
693708
log.WithError(err).Error("Unable to execute OpenID Connect Back-Channel Logout Request")
694709
return

‎driver/config/tls.go

+70
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,10 @@ package config
66
import (
77
"context"
88
"crypto/tls"
9+
"fmt"
10+
"strings"
911

12+
"github.com/hashicorp/go-secure-stdlib/tlsutil"
1013
"github.com/pkg/errors"
1114

1215
"github.com/ory/x/logrusx"
@@ -27,6 +30,35 @@ const (
2730
KeyTLSCertPath = "serve." + KeySuffixTLSCertPath
2831
KeyTLSKeyPath = "serve." + KeySuffixTLSKeyPath
2932
KeyTLSEnabled = "serve." + KeySuffixTLSEnabled
33+
34+
KeyClientTLSInsecureSkipVerify = "tls.insecure_skip_verify"
35+
KeySuffixClientTLSCipherSuites = "tls.cipher_suites"
36+
KeySuffixClientTLSMinVer = "tls.min_version"
37+
KeySuffixClientTLSMaxVer = "tls.max_version"
38+
)
39+
40+
type ClientInterface interface {
41+
Key(suffix string) string
42+
}
43+
44+
func (iface *clientPrefix) Key(suffix string) string {
45+
return fmt.Sprintf("%s.%s", iface.prefix, suffix)
46+
}
47+
48+
type clientPrefix struct {
49+
prefix string
50+
}
51+
52+
var (
53+
KeyPrefixClientDefault ClientInterface = &clientPrefix{
54+
prefix: "client.default",
55+
}
56+
KeyPrefixClientBackChannelLogout ClientInterface = &clientPrefix{
57+
prefix: "client.back_channel_logout",
58+
}
59+
KeyPrefixClientRefreshTokenHook ClientInterface = &clientPrefix{
60+
prefix: "client.refresh_token_hook",
61+
}
3062
)
3163

3264
type TLSConfig interface {
@@ -66,6 +98,44 @@ func (p *DefaultProvider) TLS(ctx context.Context, iface ServeInterface) TLSConf
6698
}
6799
}
68100

101+
func (p *DefaultProvider) TLSClientConfigDefault() (*tls.Config, error) {
102+
return p.TLSClientConfigWithDefaultFallback(KeyPrefixClientDefault)
103+
}
104+
105+
func (p *DefaultProvider) TLSClientConfigWithDefaultFallback(iface ClientInterface) (*tls.Config, error) {
106+
tlsClientConfig := new(tls.Config)
107+
tlsClientConfig.InsecureSkipVerify = p.p.BoolF(KeyClientTLSInsecureSkipVerify, false)
108+
109+
if p.p.Exists(KeyPrefixClientDefault.Key(KeySuffixClientTLSCipherSuites)) || p.p.Exists(iface.Key(KeySuffixClientTLSCipherSuites)) {
110+
keyCipherSuites := p.p.StringsF(iface.Key(KeySuffixClientTLSCipherSuites), p.p.Strings(KeyPrefixClientDefault.Key(KeySuffixClientTLSCipherSuites)))
111+
cipherSuites, err := tlsutil.ParseCiphers(strings.Join(keyCipherSuites[:], ","))
112+
if err != nil {
113+
return nil, errors.WithMessage(err, "Unable to setup client TLS configuration")
114+
}
115+
tlsClientConfig.CipherSuites = cipherSuites
116+
}
117+
118+
if p.p.Exists(KeyPrefixClientDefault.Key(KeySuffixClientTLSMinVer)) || p.p.Exists(iface.Key(KeySuffixClientTLSMinVer)) {
119+
keyMinVer := p.p.StringF(iface.Key(KeySuffixClientTLSMinVer), p.p.String(KeyPrefixClientDefault.Key(KeySuffixClientTLSMinVer)))
120+
if tlsMinVer, found := tlsutil.TLSLookup[keyMinVer]; !found {
121+
return nil, errors.Errorf("Unable to setup client TLS configuration. Invalid minimum TLS version: %s", keyMinVer)
122+
} else {
123+
tlsClientConfig.MinVersion = tlsMinVer
124+
}
125+
}
126+
127+
if p.p.Exists(KeyPrefixClientDefault.Key(KeySuffixClientTLSMaxVer)) || p.p.Exists(iface.Key(KeySuffixClientTLSMaxVer)) {
128+
keyMaxVer := p.p.StringF(iface.Key(KeySuffixClientTLSMaxVer), p.p.String(KeyPrefixClientDefault.Key(KeySuffixClientTLSMaxVer)))
129+
if tlsMaxVer, found := tlsutil.TLSLookup[keyMaxVer]; !found {
130+
return nil, errors.Errorf("Unable to setup client TLS configuration. Invalid maximum TLS version: %s", keyMaxVer)
131+
} else {
132+
tlsClientConfig.MaxVersion = tlsMaxVer
133+
}
134+
}
135+
136+
return tlsClientConfig, nil
137+
}
138+
69139
func (c *tlsConfig) GetCertificateFunc(stopReload <-chan struct{}, log *logrusx.Logger) (func(*tls.ClientHelloInfo) (*tls.Certificate, error), error) {
70140
if c.certPath != "" && c.keyPath != "" { // attempt to load from disk first (enables hot-reloading)
71141
ctx, cancel := context.WithCancel(context.Background())

‎driver/config/tls_test.go

+90
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
// Copyright © 2022 Ory Corp
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
package config
5+
6+
import (
7+
"context"
8+
"crypto/tls"
9+
"testing"
10+
11+
"github.com/stretchr/testify/assert"
12+
13+
"github.com/ory/x/configx"
14+
"github.com/ory/x/logrusx"
15+
)
16+
17+
func TestTLSClientConfig_CipherSuite(t *testing.T) {
18+
l := logrusx.New("", "")
19+
c := MustNew(context.TODO(), l, configx.WithValue("client.default.tls.cipher_suites", []string{"TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384"}))
20+
21+
tlsClientConfig, err := c.TLSClientConfigDefault()
22+
assert.NoError(t, err)
23+
cipherSuites := tlsClientConfig.CipherSuites
24+
25+
assert.Len(t, cipherSuites, 2)
26+
assert.Equal(t, tls.TLS_AES_128_GCM_SHA256, cipherSuites[0])
27+
assert.Equal(t, tls.TLS_AES_256_GCM_SHA384, cipherSuites[1])
28+
}
29+
30+
func TestTLSClientConfig_InvalidCipherSuite(t *testing.T) {
31+
l := logrusx.New("", "")
32+
c := MustNew(context.TODO(), l, configx.WithValue("client.default.tls.cipher_suites", []string{"TLS_AES_128_GCM_SHA256", "TLS_INVALID_CIPHER_SUITE"}))
33+
34+
_, err := c.TLSClientConfigDefault()
35+
36+
assert.EqualError(t, err, "Unable to setup client TLS configuration: unsupported cipher \"TLS_INVALID_CIPHER_SUITE\"")
37+
}
38+
39+
func TestTLSClientConfig_MinVersion(t *testing.T) {
40+
l := logrusx.New("", "")
41+
c := MustNew(context.TODO(), l, configx.WithValue("client.default.tls.min_version", "tls13"))
42+
43+
tlsClientConfig, err := c.TLSClientConfigDefault()
44+
45+
assert.NoError(t, err)
46+
assert.Equal(t, uint16(tls.VersionTLS13), tlsClientConfig.MinVersion)
47+
}
48+
49+
func TestTLSClientConfig_InvalidMinVersion(t *testing.T) {
50+
l := logrusx.New("", "")
51+
c := MustNew(context.TODO(), l, configx.WithValue("client.default.tls.min_version", "tlsx"))
52+
53+
_, err := c.TLSClientConfigDefault()
54+
55+
assert.EqualError(t, err, "Unable to setup client TLS configuration. Invalid minimum TLS version: tlsx")
56+
}
57+
58+
func TestTLSClientConfig_MaxVersion(t *testing.T) {
59+
l := logrusx.New("", "")
60+
c := MustNew(context.TODO(), l, configx.WithValue("client.default.tls.max_version", "tls10"))
61+
62+
tlsClientConfig, err := c.TLSClientConfigDefault()
63+
64+
assert.NoError(t, err)
65+
assert.Equal(t, uint16(tls.VersionTLS10), tlsClientConfig.MaxVersion)
66+
}
67+
68+
func TestTLSClientConfig_InvalidMaxTlsVersion(t *testing.T) {
69+
l := logrusx.New("", "")
70+
c := MustNew(context.TODO(), l, configx.WithValue("client.default.tls.max_version", "tlsx"))
71+
72+
_, err := c.TLSClientConfigDefault()
73+
74+
assert.EqualError(t, err, "Unable to setup client TLS configuration. Invalid maximum TLS version: tlsx")
75+
}
76+
77+
func TestTLSClientConfig_WithDefaultFallback(t *testing.T) {
78+
l := logrusx.New("", "")
79+
c := MustNew(context.TODO(), l)
80+
ctx := context.Background()
81+
c.MustSet(ctx, "client.default.tls.min_version", "tls11")
82+
c.MustSet(ctx, "client.default.tls.max_version", "tls12")
83+
c.MustSet(ctx, "client.back_channel_logout.tls.max_version", "tls13")
84+
85+
tlsClientConfig, err := c.TLSClientConfigWithDefaultFallback(KeyPrefixClientBackChannelLogout)
86+
87+
assert.NoError(t, err)
88+
assert.Equal(t, uint16(tls.VersionTLS11), tlsClientConfig.MinVersion)
89+
assert.Equal(t, uint16(tls.VersionTLS13), tlsClientConfig.MaxVersion)
90+
}

‎go.mod

+5
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ require (
3030
github.com/gorilla/sessions v1.2.1
3131
github.com/gtank/cryptopasta v0.0.0-20170601214702-1f550f6f2f69
3232
github.com/hashicorp/go-retryablehttp v0.7.1
33+
github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2
3334
github.com/instana/testify v1.6.2-0.20200721153833-94b1851f4d65
3435
github.com/jackc/pgx/v4 v4.17.2
3536
github.com/julienschmidt/httprouter v1.3.0
@@ -138,6 +139,9 @@ require (
138139
github.com/gorilla/handlers v1.5.1 // indirect
139140
github.com/gorilla/websocket v1.5.0 // indirect
140141
github.com/grpc-ecosystem/grpc-gateway/v2 v2.12.0 // indirect
142+
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1 // indirect
143+
github.com/hashicorp/go-secure-stdlib/strutil v0.1.1 // indirect
144+
github.com/hashicorp/go-sockaddr v1.0.2 // indirect
141145
github.com/hashicorp/hcl v1.0.0 // indirect
142146
github.com/huandu/xstrings v1.3.2 // indirect
143147
github.com/imdario/mergo v0.3.13 // indirect
@@ -189,6 +193,7 @@ require (
189193
github.com/prometheus/common v0.37.0 // indirect
190194
github.com/prometheus/procfs v0.8.0 // indirect
191195
github.com/rogpeppe/go-internal v1.9.0 // indirect
196+
github.com/ryanuber/go-glob v1.0.0 // indirect
192197
github.com/seatgeek/logrus-gelf-formatter v0.0.0-20210414080842-5b05eb8ff761 // indirect
193198
github.com/segmentio/backo-go v1.0.1 // indirect
194199
github.com/sergi/go-diff v1.2.0 // indirect

‎go.sum

+8
Original file line numberDiff line numberDiff line change
@@ -516,7 +516,14 @@ github.com/hashicorp/go-retryablehttp v0.7.1/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER
516516
github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
517517
github.com/hashicorp/go-rootcerts v1.0.1/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
518518
github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
519+
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1 h1:78ki3QBevHwYrVxnyVeaEz+7WtifHhauYF23es/0KlI=
520+
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
521+
github.com/hashicorp/go-secure-stdlib/strutil v0.1.1 h1:nd0HIW15E6FG1MsnArYaHfuw9C2zgzM8LxkG5Ty/788=
522+
github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
523+
github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 h1:phcbL8urUzF/kxA/Oj6awENaRwfWsjP59GW7u2qlDyY=
524+
github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2/go.mod h1:l8slYwnJA26yBz+ErHpp2IRCLr0vuOMGBORIz4rRiAs=
519525
github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
526+
github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
520527
github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
521528
github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
522529
github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
@@ -912,6 +919,7 @@ github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQD
912919
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
913920
github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
914921
github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
922+
github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
915923
github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
916924
github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
917925
github.com/sawadashota/encrypta v0.0.2 h1:R46/RxYmYdxI3VOt63B637OVBHzu+fazPyLo5CqK6QE=

0 commit comments

Comments
 (0)