feat: add support for setting a unix binding's socket file mode (#3376)

fix: linter issues and set default unix socket permissions to 0660

Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Tristan <tristan@mangadex.org>

pkg/proxyhttp/server.go

@@ -8,6 +8,7 @@ import (
 	"net"
 	"net/http"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -95,15 +96,62 @@ func (s *server) setupListener(opts Opts) error {
 	networkType := getNetworkScheme(opts.BindAddress)
 	listenAddr := getListenAddress(opts.BindAddress)
 
-	listener, err := net.Listen(networkType, listenAddr)
+	listener, err := func() (net.Listener, error) {
+		if networkType == "unix" {
+			return setupUnixSocketListener(networkType, listenAddr)
+		}
+		return net.Listen(networkType, listenAddr)
+	}()
+
 	if err != nil {
 		return fmt.Errorf("listen (%s, %s) failed: %w", networkType, listenAddr, err)
 	}
-	s.listener = listener
 
+	s.listener = listener
 	return nil
 }
 
+func setupUnixSocketListener(networkType string, address string) (net.Listener, error) {
+	socketOpts := strings.Split(address, ",")
+	if len(socketOpts) < 2 {
+		return net.Listen(networkType, address)
+	}
+
+	socketPath := socketOpts[0]
+	var socketMode os.FileMode
+	hasSocketMode := false
+
+	for _, socketOpt := range socketOpts[1:] {
+		socketOpt := strings.SplitN(socketOpt, "=", 2)
+		if len(socketOpt) != 2 {
+			return nil, fmt.Errorf("unix socket option %s expects a value", socketOpt[0])
+		}
+
+		if socketOpt[0] == "mode" {
+			mode, err := strconv.ParseUint(socketOpt[1], 8, 32)
+			if err != nil {
+				return nil, fmt.Errorf("unix socket file mode has invalid value %s", socketOpt[1])
+			}
+			socketMode = os.FileMode(mode)
+			hasSocketMode = true
+		}
+	}
+
+	listener, err := net.Listen(networkType, socketPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if hasSocketMode {
+		err = os.Chmod(socketPath, socketMode)
+		if err != nil {
+			return nil, fmt.Errorf("cannot set unix socket file mode on %s: %v", socketPath, err)
+		}
+	}
+
+	return listener, nil
+}
+
 func parseCipherSuites(names []string) ([]uint16, error) {
 	cipherNameMap := make(map[string]uint16)
 

pkg/proxyhttp/server_test.go

@@ -28,6 +28,8 @@ var _ = Describe("Server", func() {
 			expectedErr        error
 			expectHTTPListener bool
 			expectTLSListener  bool
+			expectedSocketMode os.FileMode
+			socketPath         string
 			fdAddr             string
 			ipv6               bool
 		}
@@ -57,6 +59,12 @@ var _ = Describe("Server", func() {
 			s, ok := srv.(*server)
 			Expect(ok).To(BeTrue())
 
+			if in.socketPath != "" {
+				fileInfo, err := os.Stat(in.socketPath)
+				Expect(err).ToNot(HaveOccurred())
+				Expect(fileInfo.Mode().Perm()).To(Equal(in.expectedSocketMode.Perm()))
+			}
+
 			Expect(s.listener != nil).To(Equal(in.expectHTTPListener))
 			if in.expectHTTPListener {
 				Expect(s.listener.Close()).To(Succeed())
@@ -648,6 +656,48 @@ var _ = Describe("Server", func() {
 				expectTLSListener:  true,
 				ipv6:               true,
 			}),
+			Entry("with a valid unix socket path", &newServerTableInput{
+				opts: Opts{
+					Handler:     handler,
+					BindAddress: "unix:///tmp/oauth2-proxy.sock",
+				},
+				expectedErr:        nil,
+				expectHTTPListener: true,
+				expectTLSListener:  false,
+				ipv6:               false,
+			}),
+			Entry("with a valid unix socket path and a valid socket file mode", &newServerTableInput{
+				opts: Opts{
+					Handler:     handler,
+					BindAddress: "unix:///tmp/oauth2-proxy.sock,mode=0777",
+				},
+				expectedErr:        nil,
+				expectHTTPListener: true,
+				expectTLSListener:  false,
+				expectedSocketMode: 0o777,
+				socketPath:         "/tmp/oauth2-proxy.sock",
+				ipv6:               false,
+			}),
+			Entry("with a valid unix socket path and a value-less socket file mode argument", &newServerTableInput{
+				opts: Opts{
+					Handler:     handler,
+					BindAddress: "unix:///tmp/oauth2-proxy.sock,mode",
+				},
+				expectedErr:        errors.New("error setting up listener: listen (unix, /tmp/oauth2-proxy.sock,mode) failed: unix socket option mode expects a value"),
+				expectHTTPListener: false,
+				expectTLSListener:  false,
+				ipv6:               false,
+			}),
+			Entry("with a valid unix socket path and an invalid socket file mode value", &newServerTableInput{
+				opts: Opts{
+					Handler:     handler,
+					BindAddress: "unix:///tmp/oauth2-proxy.sock,mode=-1",
+				},
+				expectedErr:        errors.New("error setting up listener: listen (unix, /tmp/oauth2-proxy.sock,mode=-1) failed: unix socket file mode has invalid value -1"),
+				expectHTTPListener: false,
+				expectTLSListener:  false,
+				ipv6:               false,
+			}),
 		)
 	})