Initalize TLS.Config when connecting to Redis with TLS (#1296)

* init TLS.Config when connecting to Redis with TLS * don't overwrite TLS config if it exists * add tests for Redis with TLS * remove hardcoded certs * add GenerateCert func * use GenerateCert util func * fix issue reported by go fmt * limit return statements in GenerateCert
2026-10-18 22:41:04 +02:00 · 2021-10-19 09:17:42 +01:00
parent ea261ca014
commit b49e62f9b2
7 changed files with 167 additions and 33 deletions
@@ -2,6 +2,7 @@ package redis

 import (
 	"context"
+	"crypto/tls"
 	"crypto/x509"
 	"fmt"
 	"io/ioutil"
@@ -127,6 +128,11 @@ func buildStandaloneClient(opts options.RedisStoreOptions) (Client, error) {
 	}

 	if opts.InsecureSkipTLSVerify {
+		if opt.TLSConfig == nil {
+			/* #nosec */
+			opt.TLSConfig = &tls.Config{}
+		}
+
 		opt.TLSConfig.InsecureSkipVerify = true
 	}

@@ -148,6 +154,11 @@ func buildStandaloneClient(opts options.RedisStoreOptions) (Client, error) {
 			logger.Errorf("no certs appended, using system certs only")
 		}

+		if opt.TLSConfig == nil {
+			/* #nosec */
+			opt.TLSConfig = &tls.Config{}
+		}
+
 		opt.TLSConfig.RootCAs = rootCAs
 	}

@@ -1,7 +1,10 @@
 package redis

 import (
+	"bytes"
 	"context"
+	"crypto/tls"
+	"encoding/pem"
 	"log"
 	"os"
 	"testing"
@@ -15,6 +18,7 @@ import (
 	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
 	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/sessions/persistence"
 	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/sessions/tests"
+	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 )
@@ -224,4 +228,104 @@ var _ = Describe("Redis SessionStore Tests", func() {
 			)
 		})
 	})
+
+	Context("with custom CA path", func() {
+		var caPath string
+
+		BeforeEach(func() {
+			certBytes, keyBytes, err := util.GenerateCert()
+			Expect(err).ToNot(HaveOccurred())
+			certOut := new(bytes.Buffer)
+			Expect(pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: certBytes})).To(Succeed())
+			certData := certOut.Bytes()
+			keyOut := new(bytes.Buffer)
+			Expect(pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: keyBytes})).To(Succeed())
+			cert, err := tls.X509KeyPair(certData, keyOut.Bytes())
+			Expect(err).ToNot(HaveOccurred())
+
+			certFile, err := os.CreateTemp("", "cert.*.pem")
+			Expect(err).ToNot(HaveOccurred())
+			caPath = certFile.Name()
+			_, err = certFile.Write(certData)
+			defer certFile.Close()
+			Expect(err).ToNot(HaveOccurred())
+
+			mr.Close()
+
+			mr, err = miniredis.RunTLS(&tls.Config{Certificates: []tls.Certificate{cert}})
+			Expect(err).ToNot(HaveOccurred())
+		})
+
+		AfterEach(func() {
+			Expect(os.Remove(caPath)).ToNot(HaveOccurred())
+
+			mr.Close()
+
+			var err error
+			mr, err = miniredis.Run()
+			Expect(err).ToNot(HaveOccurred())
+		})
+
+		tests.RunSessionStoreTests(
+			func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {
+				// Set the connection URL
+				opts.Type = options.RedisSessionStoreType
+				opts.Redis.ConnectionURL = "redis://" + mr.Addr()
+				opts.Redis.CAPath = caPath
+
+				// Capture the session store so that we can close the client
+				var err error
+				ss, err = NewRedisSessionStore(opts, cookieOpts)
+				return ss, err
+			},
+			func(d time.Duration) error {
+				mr.FastForward(d)
+				return nil
+			},
+		)
+	})
+
+	Context("with insecure TLS connection", func() {
+		BeforeEach(func() {
+			certBytes, keyBytes, err := util.GenerateCert()
+			Expect(err).ToNot(HaveOccurred())
+			certOut := new(bytes.Buffer)
+			Expect(pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: certBytes})).To(Succeed())
+			keyOut := new(bytes.Buffer)
+			Expect(pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: keyBytes})).To(Succeed())
+			cert, err := tls.X509KeyPair(certOut.Bytes(), keyOut.Bytes())
+			Expect(err).ToNot(HaveOccurred())
+
+			mr.Close()
+
+			mr, err = miniredis.RunTLS(&tls.Config{Certificates: []tls.Certificate{cert}})
+			Expect(err).ToNot(HaveOccurred())
+		})
+
+		AfterEach(func() {
+			mr.Close()
+
+			var err error
+			mr, err = miniredis.Run()
+			Expect(err).ToNot(HaveOccurred())
+		})
+
+		tests.RunSessionStoreTests(
+			func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {
+				// Set the connection URL
+				opts.Type = options.RedisSessionStoreType
+				opts.Redis.ConnectionURL = "redis://127.0.0.1:" + mr.Port() // func (*Miniredis) StartTLS listens on 127.0.0.1
+				opts.Redis.InsecureSkipTLSVerify = true
+
+				// Capture the session store so that we can close the client
+				var err error
+				ss, err = NewRedisSessionStore(opts, cookieOpts)
+				return ss, err
+			},
+			func(d time.Duration) error {
+				mr.FastForward(d)
+				return nil
+			},
+		)
+	})
 })