Skip to content

Commit 296ec92

Browse files
author
Julien Pivotto
authored
Merge pull request #409 from prometheus/mem/proxy_header
Add support for proxy connect headers
2 parents 18281a2 + 4a0d730 commit 296ec92

8 files changed

+330
-1
lines changed

‎config/config.go

+24
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package config
1818

1919
import (
2020
"encoding/json"
21+
"net/http"
2122
"path/filepath"
2223
)
2324

@@ -48,6 +49,29 @@ func (s Secret) MarshalJSON() ([]byte, error) {
4849
return json.Marshal(secretToken)
4950
}
5051

52+
type Header map[string][]Secret
53+
54+
func (h *Header) HTTPHeader() http.Header {
55+
if h == nil || *h == nil {
56+
return nil
57+
}
58+
59+
header := make(http.Header)
60+
61+
for name, values := range *h {
62+
var s []string
63+
if values != nil {
64+
s = make([]string, 0, len(values))
65+
for _, value := range values {
66+
s = append(s, string(value))
67+
}
68+
}
69+
header[name] = s
70+
}
71+
72+
return header
73+
}
74+
5175
// DirectorySetter is a config type that contains file paths that may
5276
// be relative to the file containing the config.
5377
type DirectorySetter interface {

‎config/config_test.go

+192
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,13 @@
1414
package config
1515

1616
import (
17+
"bytes"
1718
"encoding/json"
19+
"net/http"
20+
"reflect"
1821
"testing"
22+
23+
"gopkg.in/yaml.v2"
1924
)
2025

2126
func TestJSONMarshalSecret(t *testing.T) {
@@ -51,3 +56,190 @@ func TestJSONMarshalSecret(t *testing.T) {
5156
})
5257
}
5358
}
59+
60+
func TestHeaderHTTPHeader(t *testing.T) {
61+
testcases := map[string]struct {
62+
header Header
63+
expected http.Header
64+
}{
65+
"basic": {
66+
header: Header{
67+
"single": []Secret{"v1"},
68+
"multi": []Secret{"v1", "v2"},
69+
"empty": []Secret{},
70+
"nil": nil,
71+
},
72+
expected: http.Header{
73+
"single": []string{"v1"},
74+
"multi": []string{"v1", "v2"},
75+
"empty": []string{},
76+
"nil": nil,
77+
},
78+
},
79+
"nil": {
80+
header: nil,
81+
expected: nil,
82+
},
83+
}
84+
85+
for name, tc := range testcases {
86+
t.Run(name, func(t *testing.T) {
87+
actual := tc.header.HTTPHeader()
88+
if !reflect.DeepEqual(actual, tc.expected) {
89+
t.Fatalf("expecting: %#v, actual: %#v", tc.expected, actual)
90+
}
91+
})
92+
}
93+
}
94+
95+
func TestHeaderYamlUnmarshal(t *testing.T) {
96+
testcases := map[string]struct {
97+
input string
98+
expected Header
99+
}{
100+
"void": {
101+
input: ``,
102+
},
103+
"simple": {
104+
input: "single:\n- a\n",
105+
expected: Header{"single": []Secret{"a"}},
106+
},
107+
"multi": {
108+
input: "multi:\n- a\n- b\n",
109+
expected: Header{"multi": []Secret{"a", "b"}},
110+
},
111+
"empty": {
112+
input: "{}",
113+
expected: Header{},
114+
},
115+
"empty value": {
116+
input: "empty:\n",
117+
expected: Header{"empty": nil},
118+
},
119+
}
120+
121+
for name, tc := range testcases {
122+
t.Run(name, func(t *testing.T) {
123+
var actual Header
124+
err := yaml.Unmarshal([]byte(tc.input), &actual)
125+
if err != nil {
126+
t.Fatalf("error unmarshaling %s: %s", tc.input, err)
127+
}
128+
if !reflect.DeepEqual(actual, tc.expected) {
129+
t.Fatalf("expecting: %#v, actual: %#v", tc.expected, actual)
130+
}
131+
})
132+
}
133+
}
134+
135+
func TestHeaderYamlMarshal(t *testing.T) {
136+
testcases := map[string]struct {
137+
input Header
138+
expected []byte
139+
}{
140+
"void": {
141+
input: nil,
142+
expected: []byte("{}\n"),
143+
},
144+
"simple": {
145+
input: Header{"single": []Secret{"a"}},
146+
expected: []byte("single:\n- <secret>\n"),
147+
},
148+
"multi": {
149+
input: Header{"multi": []Secret{"a", "b"}},
150+
expected: []byte("multi:\n- <secret>\n- <secret>\n"),
151+
},
152+
"empty": {
153+
input: Header{"empty": nil},
154+
expected: []byte("empty: []\n"),
155+
},
156+
}
157+
158+
for name, tc := range testcases {
159+
t.Run(name, func(t *testing.T) {
160+
actual, err := yaml.Marshal(tc.input)
161+
if err != nil {
162+
t.Fatalf("error unmarshaling %#v: %s", tc.input, err)
163+
}
164+
if !bytes.Equal(actual, tc.expected) {
165+
t.Fatalf("expecting: %q, actual: %q", tc.expected, actual)
166+
}
167+
})
168+
}
169+
}
170+
171+
func TestHeaderJsonUnmarshal(t *testing.T) {
172+
testcases := map[string]struct {
173+
input string
174+
expected Header
175+
}{
176+
"void": {
177+
input: `null`,
178+
},
179+
"simple": {
180+
input: `{"single": ["a"]}`,
181+
expected: Header{"single": []Secret{"a"}},
182+
},
183+
"multi": {
184+
input: `{"multi": ["a", "b"]}`,
185+
expected: Header{"multi": []Secret{"a", "b"}},
186+
},
187+
"empty": {
188+
input: `{}`,
189+
expected: Header{},
190+
},
191+
"empty value": {
192+
input: `{"empty":null}`,
193+
expected: Header{"empty": nil},
194+
},
195+
}
196+
197+
for name, tc := range testcases {
198+
t.Run(name, func(t *testing.T) {
199+
var actual Header
200+
err := json.Unmarshal([]byte(tc.input), &actual)
201+
if err != nil {
202+
t.Fatalf("error unmarshaling %s: %s", tc.input, err)
203+
}
204+
if !reflect.DeepEqual(actual, tc.expected) {
205+
t.Fatalf("expecting: %#v, actual: %#v", tc.expected, actual)
206+
}
207+
})
208+
}
209+
}
210+
211+
func TestHeaderJsonMarshal(t *testing.T) {
212+
testcases := map[string]struct {
213+
input Header
214+
expected []byte
215+
}{
216+
"void": {
217+
input: nil,
218+
expected: []byte("null"),
219+
},
220+
"simple": {
221+
input: Header{"single": []Secret{"a"}},
222+
expected: []byte("{\"single\":[\"\\u003csecret\\u003e\"]}"),
223+
},
224+
"multi": {
225+
input: Header{"multi": []Secret{"a", "b"}},
226+
expected: []byte("{\"multi\":[\"\\u003csecret\\u003e\",\"\\u003csecret\\u003e\"]}"),
227+
},
228+
"empty": {
229+
input: Header{"empty": nil},
230+
expected: []byte(`{"empty":null}`),
231+
},
232+
}
233+
234+
for name, tc := range testcases {
235+
t.Run(name, func(t *testing.T) {
236+
actual, err := json.Marshal(tc.input)
237+
if err != nil {
238+
t.Fatalf("error marshaling %#v: %s", tc.input, err)
239+
}
240+
if !bytes.Equal(actual, tc.expected) {
241+
t.Fatalf("expecting: %q, actual: %q", tc.expected, actual)
242+
}
243+
})
244+
}
245+
}

‎config/http_config.go

+11-1
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,11 @@ type HTTPClientConfig struct {
289289
BearerTokenFile string `yaml:"bearer_token_file,omitempty" json:"bearer_token_file,omitempty"`
290290
// HTTP proxy server to use to connect to the targets.
291291
ProxyURL URL `yaml:"proxy_url,omitempty" json:"proxy_url,omitempty"`
292+
// ProxyConnectHeader optionally specifies headers to send to
293+
// proxies during CONNECT requests. Assume that at least _some_ of
294+
// these headers are going to contain secrets and use Secret as the
295+
// value type instead of string.
296+
ProxyConnectHeader Header `yaml:"proxy_connect_header,omitempty" json:"proxy_connect_header,omitempty"`
292297
// TLSConfig to use to connect to the targets.
293298
TLSConfig TLSConfig `yaml:"tls_config,omitempty" json:"tls_config,omitempty"`
294299
// FollowRedirects specifies whether the client should follow HTTP 3xx redirects.
@@ -314,7 +319,8 @@ func (c *HTTPClientConfig) SetDirectory(dir string) {
314319
}
315320

316321
// Validate validates the HTTPClientConfig to check only one of BearerToken,
317-
// BasicAuth and BearerTokenFile is configured.
322+
// BasicAuth and BearerTokenFile is configured. It also validates that ProxyURL
323+
// is set if ProxyConnectHeader is set.
318324
func (c *HTTPClientConfig) Validate() error {
319325
// Backwards compatibility with the bearer_token field.
320326
if len(c.BearerToken) > 0 && len(c.BearerTokenFile) > 0 {
@@ -372,6 +378,9 @@ func (c *HTTPClientConfig) Validate() error {
372378
return fmt.Errorf("at most one of oauth2 client_secret & client_secret_file must be configured")
373379
}
374380
}
381+
if len(c.ProxyConnectHeader) > 0 && (c.ProxyURL.URL == nil || c.ProxyURL.String() == "") {
382+
return fmt.Errorf("if proxy_connect_header is configured proxy_url must also be configured")
383+
}
375384
return nil
376385
}
377386

@@ -500,6 +509,7 @@ func NewRoundTripperFromConfig(cfg HTTPClientConfig, name string, optFuncs ...HT
500509
// It is applied on request. So we leave out any timings here.
501510
var rt http.RoundTripper = &http.Transport{
502511
Proxy: http.ProxyURL(cfg.ProxyURL.URL),
512+
ProxyConnectHeader: cfg.ProxyConnectHeader.HTTPHeader(),
503513
MaxIdleConns: 20000,
504514
MaxIdleConnsPerHost: 1000, // see https://github.com/golang/go/issues/13801
505515
DisableKeepAlives: !opts.keepAlivesEnabled,

‎config/http_config_test.go

+67
Original file line numberDiff line numberDiff line change
@@ -447,6 +447,50 @@ func TestNewClientFromConfig(t *testing.T) {
447447
}
448448
}
449449

450+
func TestProxyConfiguration(t *testing.T) {
451+
testcases := map[string]struct {
452+
testFn string
453+
loader func(string) (*HTTPClientConfig, []byte, error)
454+
isValid bool
455+
}{
456+
"good yaml": {
457+
testFn: "testdata/http.conf.proxy-headers.good.yml",
458+
loader: LoadHTTPConfigFile,
459+
isValid: true,
460+
},
461+
"bad yaml": {
462+
testFn: "testdata/http.conf.proxy-headers.bad.yml",
463+
loader: LoadHTTPConfigFile,
464+
isValid: false,
465+
},
466+
"good json": {
467+
testFn: "testdata/http.conf.proxy-headers.good.json",
468+
loader: loadHTTPConfigJSONFile,
469+
isValid: true,
470+
},
471+
"bad json": {
472+
testFn: "testdata/http.conf.proxy-headers.bad.json",
473+
loader: loadHTTPConfigJSONFile,
474+
isValid: false,
475+
},
476+
}
477+
478+
for name, tc := range testcases {
479+
t.Run(name, func(t *testing.T) {
480+
_, _, err := tc.loader(tc.testFn)
481+
if tc.isValid {
482+
if err != nil {
483+
t.Fatalf("Error validating %s: %s", tc.testFn, err)
484+
}
485+
} else {
486+
if err == nil {
487+
t.Fatalf("Expecting error validating %s but got %s", tc.testFn, err)
488+
}
489+
}
490+
})
491+
}
492+
}
493+
450494
func TestNewClientFromInvalidConfig(t *testing.T) {
451495
var newClientInvalidConfig = []struct {
452496
clientConfig HTTPClientConfig
@@ -1622,3 +1666,26 @@ func TestModifyTLSCertificates(t *testing.T) {
16221666
})
16231667
}
16241668
}
1669+
1670+
// loadHTTPConfigJSON parses the JSON input s into a HTTPClientConfig.
1671+
func loadHTTPConfigJSON(buf []byte) (*HTTPClientConfig, error) {
1672+
cfg := &HTTPClientConfig{}
1673+
err := json.Unmarshal(buf, cfg)
1674+
if err != nil {
1675+
return nil, err
1676+
}
1677+
return cfg, nil
1678+
}
1679+
1680+
// loadHTTPConfigJSONFile parses the given JSON file into a HTTPClientConfig.
1681+
func loadHTTPConfigJSONFile(filename string) (*HTTPClientConfig, []byte, error) {
1682+
content, err := os.ReadFile(filename)
1683+
if err != nil {
1684+
return nil, nil, err
1685+
}
1686+
cfg, err := loadHTTPConfigJSON(content)
1687+
if err != nil {
1688+
return nil, nil, err
1689+
}
1690+
return cfg, content, nil
1691+
}

‎config/testdata/http.conf.proxy-headers.bad.json

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
"proxy_connect_header": {
3+
"single": [
4+
"value_0"
5+
],
6+
"multi": [
7+
"value_1",
8+
"value_2"
9+
]
10+
}
11+
}

‎config/testdata/http.conf.proxy-headers.bad.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
proxy_connect_header:
2+
single:
3+
- value_0
4+
multi:
5+
- value_1
6+
- value_2

‎config/testdata/http.conf.proxy-headers.good.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"proxy_url": "http://remote.host",
3+
"proxy_connect_header": {
4+
"single": [
5+
"value_0"
6+
],
7+
"multi": [
8+
"value_1",
9+
"value_2"
10+
]
11+
}
12+
}

0 commit comments

Comments
 (0)