mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-30 10:56:28 +02:00
e4832cb4ed
* authorize: add client mtls support * authorize: better error messages for envoy * switch from function to input * add TrustedCa to envoy config so that users are prompted for the correct client certificate * update documentation * fix invalid ClientCAFile * regenerate cache protobuf * avoid recursion, add test * move comment line * use http.StatusOK * various fixes
106 lines
3.1 KiB
Go
106 lines
3.1 KiB
Go
package authorize
|
|
|
|
import (
|
|
"bytes"
|
|
"net/http"
|
|
"strings"
|
|
|
|
envoy_api_v2_core "github.com/envoyproxy/go-control-plane/envoy/api/v2/core"
|
|
envoy_service_auth_v2 "github.com/envoyproxy/go-control-plane/envoy/service/auth/v2"
|
|
envoy_type "github.com/envoyproxy/go-control-plane/envoy/type"
|
|
"google.golang.org/genproto/googleapis/rpc/status"
|
|
"google.golang.org/grpc/codes"
|
|
|
|
"github.com/pomerium/pomerium/internal/httputil"
|
|
"github.com/pomerium/pomerium/internal/log"
|
|
)
|
|
|
|
func (a *Authorize) deniedResponse(in *envoy_service_auth_v2.CheckRequest,
|
|
code int32, reason string, headers map[string]string) *envoy_service_auth_v2.CheckResponse {
|
|
|
|
returnHTMLError := true
|
|
inHeaders := in.GetAttributes().GetRequest().GetHttp().GetHeaders()
|
|
if inHeaders != nil {
|
|
returnHTMLError = strings.Contains(inHeaders["accept"], "text/html")
|
|
}
|
|
|
|
if returnHTMLError {
|
|
return a.htmlDeniedResponse(code, reason, headers)
|
|
}
|
|
return a.plainTextDeniedResponse(code, reason, headers)
|
|
}
|
|
|
|
func (a *Authorize) htmlDeniedResponse(code int32, reason string, headers map[string]string) *envoy_service_auth_v2.CheckResponse {
|
|
var details string
|
|
switch code {
|
|
case httputil.StatusInvalidClientCertificate:
|
|
details = "a valid client certificate is required to access this page"
|
|
case http.StatusForbidden:
|
|
details = "access to this page is forbidden"
|
|
default:
|
|
details = reason
|
|
}
|
|
|
|
var buf bytes.Buffer
|
|
err := a.templates.ExecuteTemplate(&buf, "error.html", map[string]interface{}{
|
|
"Status": code,
|
|
"StatusText": reason,
|
|
"CanDebug": code/100 == 4,
|
|
"Error": details,
|
|
})
|
|
if err != nil {
|
|
buf.WriteString(reason)
|
|
log.Error().Err(err).Msg("error executing error template")
|
|
}
|
|
|
|
envoyHeaders := []*envoy_api_v2_core.HeaderValueOption{
|
|
mkHeader("Content-Type", "text/html"),
|
|
}
|
|
for k, v := range headers {
|
|
envoyHeaders = append(envoyHeaders, mkHeader(k, v))
|
|
}
|
|
|
|
return &envoy_service_auth_v2.CheckResponse{
|
|
Status: &status.Status{Code: int32(codes.PermissionDenied), Message: "Access Denied"},
|
|
HttpResponse: &envoy_service_auth_v2.CheckResponse_DeniedResponse{
|
|
DeniedResponse: &envoy_service_auth_v2.DeniedHttpResponse{
|
|
Status: &envoy_type.HttpStatus{
|
|
Code: envoy_type.StatusCode(code),
|
|
},
|
|
Headers: envoyHeaders,
|
|
Body: buf.String(),
|
|
},
|
|
},
|
|
}
|
|
}
|
|
|
|
func (a *Authorize) plainTextDeniedResponse(code int32, reason string, headers map[string]string) *envoy_service_auth_v2.CheckResponse {
|
|
envoyHeaders := []*envoy_api_v2_core.HeaderValueOption{
|
|
mkHeader("Content-Type", "text/plain"),
|
|
}
|
|
for k, v := range headers {
|
|
envoyHeaders = append(envoyHeaders, mkHeader(k, v))
|
|
}
|
|
|
|
return &envoy_service_auth_v2.CheckResponse{
|
|
Status: &status.Status{Code: int32(codes.PermissionDenied), Message: "Access Denied"},
|
|
HttpResponse: &envoy_service_auth_v2.CheckResponse_DeniedResponse{
|
|
DeniedResponse: &envoy_service_auth_v2.DeniedHttpResponse{
|
|
Status: &envoy_type.HttpStatus{
|
|
Code: envoy_type.StatusCode(code),
|
|
},
|
|
Headers: envoyHeaders,
|
|
Body: reason,
|
|
},
|
|
},
|
|
}
|
|
}
|
|
|
|
func mkHeader(k, v string) *envoy_api_v2_core.HeaderValueOption {
|
|
return &envoy_api_v2_core.HeaderValueOption{
|
|
Header: &envoy_api_v2_core.HeaderValue{
|
|
Key: k,
|
|
Value: v,
|
|
},
|
|
}
|
|
}
|