Cadoles/bouncer
Cadoles
/
bouncer
10
0
Fork 0
Code Issues 2 Pull Requests 1 Projects Releases 3 Wiki Activity

fix(rewriter): prevent mixing of cached rule engines (#44)

This commit is contained in:
wpetit 2024-10-21 13:48:59 +02:00
parent 16fa751dc7
commit c611705d45
6 changed files with 76 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
internal/proxy/director/layer/authn/layer.go
View File

@ -10,6 +10,9 @@ import (
"forge.cadoles.com/Cadoles/go-proxy"
"forge.cadoles.com/Cadoles/go-proxy/wildcard"
"forge.cadoles.com/cadoles/bouncer/internal/proxy/director"
"forge.cadoles.com/cadoles/bouncer/internal/proxy/director/layer/util"
"forge.cadoles.com/cadoles/bouncer/internal/rule"
ruleHTTP "forge.cadoles.com/cadoles/bouncer/internal/rule/http"
"forge.cadoles.com/cadoles/bouncer/internal/store"
"github.com/Masterminds/sprig/v3"
"github.com/pkg/errors"
@ -21,6 +24,8 @@ type Layer struct {
auth Authenticator
debug bool
ruleEngineCache *util.RuleEngineCache[*Vars, *LayerOptions]
templateDir string
}
@ -74,7 +79,7 @@ func (l *Layer) Middleware(layer *store.Layer) proxy.Middleware {
return
}
if err := l.applyRules(ctx, r, options, user); err != nil {
if err := l.applyRules(ctx, r, layer, options, user); err != nil {
if errors.Is(err, ErrForbidden) {
l.renderForbiddenPage(w, r, layer, options, user)
return
@ -189,6 +194,18 @@ func NewLayer(layerType store.LayerType, auth Authenticator, funcs ...OptionFunc
opts := NewOptions(funcs...)
return &Layer{
ruleEngineCache: util.NewInMemoryRuleEngineCache[*Vars, *LayerOptions](func(options *LayerOptions) (*rule.Engine[*Vars], error) {
engine, err := rule.NewEngine[*Vars](
rule.WithRules(options.Rules...),
rule.WithExpr(getAuthnAPI()...),
ruleHTTP.WithRequestFuncs(),
)
if err != nil {
return nil, errors.WithStack(err)
}
return engine, nil
}),
layerType: layerType,
auth: auth,
templateDir: opts.TemplateDir,

7
internal/proxy/director/layer/authn/layer_options.go
View File

@ -28,12 +28,13 @@ func DefaultLayerOptions() LayerOptions {
return LayerOptions{
MatchURLs: []string{"*"},
Rules: []string{
"del_headers('Remote-*')",
"set_header('Remote-User', user.subject)",
"del_headers(ctx, 'Remote-*')",
"set_header(ctx,'Remote-User', vars.user.subject)",
`map(
toPairs(user.attrs), {
toPairs(vars.user.attrs), {
let name = replace(lower(string(get(#, 0))), '_', '-');
set_header(
ctx,
'Remote-User-Attr-' + name,
get(#, 1)
)

16
internal/proxy/director/layer/authn/rules.go
View File

@ -4,8 +4,8 @@ import (
"context"
"net/http"
"forge.cadoles.com/cadoles/bouncer/internal/rule"
ruleHTTP "forge.cadoles.com/cadoles/bouncer/internal/rule/http"
"forge.cadoles.com/cadoles/bouncer/internal/store"
"github.com/expr-lang/expr"
"github.com/pkg/errors"
)
@ -14,17 +14,11 @@ type Vars struct {
User *User `expr:"user"`
}
func (l *Layer) applyRules(ctx context.Context, r *http.Request, options *LayerOptions, user *User) error {
rules := options.Rules
if len(rules) == 0 {
return nil
}
func (l *Layer) applyRules(ctx context.Context, r *http.Request, layer *store.Layer, options *LayerOptions, user *User) error {
key := string(layer.Proxy) + "-" + string(layer.Name)
revisionedEngine := l.ruleEngineCache.Get(key)
engine, err := rule.NewEngine[*Vars](
rule.WithRules(options.Rules...),
rule.WithExpr(getAuthnAPI()...),
ruleHTTP.WithRequestFuncs(),
)
engine, err := revisionedEngine.Get(ctx, layer.Revision, options)
if err != nil {
return errors.WithStack(err)
}

12
internal/proxy/director/layer/rewriter/layer.go
View File

@ -16,8 +16,8 @@ import (
const LayerType store.LayerType = "rewriter"
type Layer struct {
requestRuleEngine *util.RevisionedRuleEngine[*RequestVars, *LayerOptions]
responseRuleEngine *util.RevisionedRuleEngine[*ResponseVars, *LayerOptions]
requestRuleEngineCache *util.RuleEngineCache[*RequestVars, *LayerOptions]
responseRuleEngineCache *util.RuleEngineCache[*ResponseVars, *LayerOptions]
}
func (l *Layer) LayerType() store.LayerType {
@ -42,7 +42,7 @@ func (l *Layer) Middleware(layer *store.Layer) proxy.Middleware {
return
}
if err := l.applyRequestRules(ctx, r, layer.Revision, options); err != nil {
if err := l.applyRequestRules(ctx, r, layer, options); err != nil {
var redirect *errRedirect
if errors.As(err, &redirect) {
http.Redirect(w, r, redirect.URL(), redirect.StatusCode())
@ -76,7 +76,7 @@ func (l *Layer) ResponseTransformer(layer *store.Layer) proxy.ResponseTransforme
ctx := r.Request.Context()
if err := l.applyResponseRules(ctx, r, layer.Revision, options); err != nil {
if err := l.applyResponseRules(ctx, r, layer, options); err != nil {
return errors.WithStack(err)
}
@ -86,7 +86,7 @@ func (l *Layer) ResponseTransformer(layer *store.Layer) proxy.ResponseTransforme
func New(funcs ...OptionFunc) *Layer {
return &Layer{
requestRuleEngine: util.NewRevisionedRuleEngine(func(options *LayerOptions) (*rule.Engine[*RequestVars], error) {
requestRuleEngineCache: util.NewInMemoryRuleEngineCache(func(options *LayerOptions) (*rule.Engine[*RequestVars], error) {
engine, err := rule.NewEngine[*RequestVars](
rule.WithRules(options.Rules.Request...),
ruleHTTP.WithRequestFuncs(),
@ -98,7 +98,7 @@ func New(funcs ...OptionFunc) *Layer {
return engine, nil
}),
responseRuleEngine: util.NewRevisionedRuleEngine(func(options *LayerOptions) (*rule.Engine[*ResponseVars], error) {
responseRuleEngineCache: util.NewInMemoryRuleEngineCache(func(options *LayerOptions) (*rule.Engine[*ResponseVars], error) {
engine, err := rule.NewEngine[*ResponseVars](
rule.WithRules(options.Rules.Response...),
ruleHTTP.WithResponseFuncs(),

23
internal/proxy/director/layer/rewriter/rules.go
View File

@ -8,6 +8,7 @@ import (
"forge.cadoles.com/cadoles/bouncer/internal/proxy/director"
"forge.cadoles.com/cadoles/bouncer/internal/rule"
ruleHTTP "forge.cadoles.com/cadoles/bouncer/internal/rule/http"
"forge.cadoles.com/cadoles/bouncer/internal/store"
"github.com/pkg/errors"
)
@ -87,13 +88,13 @@ func fromRequest(r *http.Request) RequestVar {
}
}
func (l *Layer) applyRequestRules(ctx context.Context, r *http.Request, layerRevision int, options *LayerOptions) error {
func (l *Layer) applyRequestRules(ctx context.Context, r *http.Request, layer *store.Layer, options *LayerOptions) error {
rules := options.Rules.Request
if len(rules) == 0 {
return nil
}
engine, err := l.getRequestRuleEngine(ctx, layerRevision, options)
engine, err := l.getRequestRuleEngine(ctx, layer, options)
if err != nil {
return errors.WithStack(err)
}
@ -117,8 +118,11 @@ func (l *Layer) applyRequestRules(ctx context.Context, r *http.Request, layerRev
return nil
}
func (l *Layer) getRequestRuleEngine(ctx context.Context, layerRevision int, options *LayerOptions) (*rule.Engine[*RequestVars], error) {
engine, err := l.requestRuleEngine.Get(ctx, layerRevision, options)
func (l *Layer) getRequestRuleEngine(ctx context.Context, layer *store.Layer, options *LayerOptions) (*rule.Engine[*RequestVars], error) {
key := string(layer.Proxy) + "-" + string(layer.Name)
revisionedEngine := l.requestRuleEngineCache.Get(key)
engine, err := revisionedEngine.Get(ctx, layer.Revision, options)
if err != nil {
return nil, errors.WithStack(err)
}
@ -145,13 +149,13 @@ type ResponseVar struct {
Trailer map[string][]string `expr:"trailer"`
}
func (l *Layer) applyResponseRules(ctx context.Context, r *http.Response, layerRevision int, options *LayerOptions) error {
func (l *Layer) applyResponseRules(ctx context.Context, r *http.Response, layer *store.Layer, options *LayerOptions) error {
rules := options.Rules.Response
if len(rules) == 0 {
return nil
}
engine, err := l.getResponseRuleEngine(ctx, layerRevision, options)
engine, err := l.getResponseRuleEngine(ctx, layer, options)
if err != nil {
return errors.WithStack(err)
}
@ -187,8 +191,11 @@ func (l *Layer) applyResponseRules(ctx context.Context, r *http.Response, layerR
return nil
}
func (l *Layer) getResponseRuleEngine(ctx context.Context, layerRevision int, options *LayerOptions) (*rule.Engine[*ResponseVars], error) {
engine, err := l.responseRuleEngine.Get(ctx, layerRevision, options)
func (l *Layer) getResponseRuleEngine(ctx context.Context, layer *store.Layer, options *LayerOptions) (*rule.Engine[*ResponseVars], error) {
key := string(layer.Proxy) + "-" + string(layer.Name)
revisionedEngine := l.responseRuleEngineCache.Get(key)
engine, err := revisionedEngine.Get(ctx, layer.Revision, options)
if err != nil {
return nil, errors.WithStack(err)
}

28
internal/proxy/director/layer/util/rule_engine_cache.go Normal file
View File

@ -0,0 +1,28 @@
package util
import (
"forge.cadoles.com/cadoles/bouncer/internal/cache"
"forge.cadoles.com/cadoles/bouncer/internal/cache/memory"
)
type RuleEngineCache[V any, O any] struct {
cache cache.Cache[string, *RevisionedRuleEngine[V, O]]
factory RuleEngineFactoryFunc[V, O]
}
func (c *RuleEngineCache[V, O]) Get(key string) *RevisionedRuleEngine[V, O] {
revisionedRuleEngine, exists := c.cache.Get(key)
if !exists {
revisionedRuleEngine = NewRevisionedRuleEngine(c.factory)
c.cache.Set(key, revisionedRuleEngine)
}
return revisionedRuleEngine
}
func NewInMemoryRuleEngineCache[V any, O any](factory RuleEngineFactoryFunc[V, O]) *RuleEngineCache[V, O] {
return &RuleEngineCache[V, O]{
factory: factory,
cache: memory.NewCache[string, *RevisionedRuleEngine[V, O]](),
}
}