2019-09-02 23:01:02 -05:00
|
|
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
|
|
|
package reverseproxy
|
|
|
|
|
|
|
|
import (
|
2019-09-05 14:14:39 -05:00
|
|
|
"context"
|
2019-09-03 16:26:09 -05:00
|
|
|
"crypto/tls"
|
|
|
|
"crypto/x509"
|
|
|
|
"encoding/base64"
|
|
|
|
"fmt"
|
2020-07-18 16:00:00 -05:00
|
|
|
weakrand "math/rand"
|
2019-09-02 23:01:02 -05:00
|
|
|
"net"
|
|
|
|
"net/http"
|
2021-09-29 12:17:48 -05:00
|
|
|
"os"
|
2019-09-03 16:26:09 -05:00
|
|
|
"reflect"
|
2022-06-14 22:53:05 -05:00
|
|
|
"strings"
|
2019-09-02 23:01:02 -05:00
|
|
|
"time"
|
|
|
|
|
|
|
|
"github.com/caddyserver/caddy/v2"
|
2020-05-05 13:35:32 -05:00
|
|
|
"github.com/caddyserver/caddy/v2/modules/caddytls"
|
2022-07-23 23:38:41 -05:00
|
|
|
"go.uber.org/zap"
|
2019-10-29 11:22:49 -05:00
|
|
|
"golang.org/x/net/http2"
|
2019-09-02 23:01:02 -05:00
|
|
|
)
|
|
|
|
|
|
|
|
func init() {
|
|
|
|
caddy.RegisterModule(HTTPTransport{})
|
|
|
|
}
|
|
|
|
|
2019-09-03 17:56:09 -05:00
|
|
|
// HTTPTransport is essentially a configuration wrapper for http.Transport.
|
|
|
|
// It defines a JSON structure useful when configuring the HTTP transport
|
2019-11-05 18:29:10 -05:00
|
|
|
// for Caddy's reverse proxy. It builds its http.Transport at Provision.
|
2019-09-02 23:01:02 -05:00
|
|
|
type HTTPTransport struct {
|
|
|
|
// TODO: It's possible that other transports (like fastcgi) might be
|
|
|
|
// able to borrow/use at least some of these config fields; if so,
|
2019-11-05 18:29:10 -05:00
|
|
|
// maybe move them into a type called CommonTransport and embed it?
|
2019-12-10 15:36:46 -05:00
|
|
|
|
2020-07-18 16:00:00 -05:00
|
|
|
// Configures the DNS resolver used to resolve the IP address of upstream hostnames.
|
|
|
|
Resolver *UpstreamResolver `json:"resolver,omitempty"`
|
|
|
|
|
2020-04-07 09:31:52 -05:00
|
|
|
// Configures TLS to the upstream. Setting this to an empty struct
|
|
|
|
// is sufficient to enable TLS with reasonable defaults.
|
|
|
|
TLS *TLSConfig `json:"tls,omitempty"`
|
|
|
|
|
|
|
|
// Configures HTTP Keep-Alive (enabled by default). Should only be
|
|
|
|
// necessary if rigorous testing has shown that tuning this helps
|
|
|
|
// improve performance.
|
|
|
|
KeepAlive *KeepAlive `json:"keep_alive,omitempty"`
|
|
|
|
|
|
|
|
// Whether to enable compression to upstream. Default: true
|
|
|
|
Compression *bool `json:"compression,omitempty"`
|
|
|
|
|
|
|
|
// Maximum number of connections per host. Default: 0 (no limit)
|
|
|
|
MaxConnsPerHost int `json:"max_conns_per_host,omitempty"`
|
|
|
|
|
|
|
|
// How long to wait before timing out trying to connect to
|
2021-11-24 01:32:25 -05:00
|
|
|
// an upstream. Default: `3s`.
|
2020-04-07 09:31:52 -05:00
|
|
|
DialTimeout caddy.Duration `json:"dial_timeout,omitempty"`
|
|
|
|
|
|
|
|
// How long to wait before spawning an RFC 6555 Fast Fallback
|
2021-11-24 01:32:25 -05:00
|
|
|
// connection. A negative value disables this. Default: `300ms`.
|
2020-04-07 09:31:52 -05:00
|
|
|
FallbackDelay caddy.Duration `json:"dial_fallback_delay,omitempty"`
|
|
|
|
|
2021-11-24 01:32:25 -05:00
|
|
|
// How long to wait for reading response headers from server. Default: No timeout.
|
2019-09-02 23:01:02 -05:00
|
|
|
ResponseHeaderTimeout caddy.Duration `json:"response_header_timeout,omitempty"`
|
2020-04-07 09:31:52 -05:00
|
|
|
|
|
|
|
// The length of time to wait for a server's first response
|
|
|
|
// headers after fully writing the request headers if the
|
2021-11-24 01:32:25 -05:00
|
|
|
// request has a header "Expect: 100-continue". Default: No timeout.
|
2019-09-02 23:01:02 -05:00
|
|
|
ExpectContinueTimeout caddy.Duration `json:"expect_continue_timeout,omitempty"`
|
|
|
|
|
2021-11-24 01:32:25 -05:00
|
|
|
// The maximum bytes to read from response headers. Default: `10MiB`.
|
2020-04-07 09:31:52 -05:00
|
|
|
MaxResponseHeaderSize int64 `json:"max_response_header_size,omitempty"`
|
|
|
|
|
2021-11-24 01:32:25 -05:00
|
|
|
// The size of the write buffer in bytes. Default: `4KiB`.
|
2020-04-07 09:31:52 -05:00
|
|
|
WriteBufferSize int `json:"write_buffer_size,omitempty"`
|
|
|
|
|
2021-11-24 01:32:25 -05:00
|
|
|
// The size of the read buffer in bytes. Default: `4KiB`.
|
2020-04-07 09:31:52 -05:00
|
|
|
ReadBufferSize int `json:"read_buffer_size,omitempty"`
|
|
|
|
|
2022-07-23 23:38:41 -05:00
|
|
|
// The maximum time to wait for next read from backend. Default: no timeout.
|
|
|
|
ReadTimeout caddy.Duration `json:"read_timeout,omitempty"`
|
|
|
|
|
|
|
|
// The maximum time to wait for next write to backend. Default: no timeout.
|
|
|
|
WriteTimeout caddy.Duration `json:"write_timeout,omitempty"`
|
|
|
|
|
2020-05-05 13:33:21 -05:00
|
|
|
// The versions of HTTP to support. As a special case, "h2c"
|
|
|
|
// can be specified to use H2C (HTTP/2 over Cleartext) to the
|
|
|
|
// upstream (this feature is experimental and subject to
|
|
|
|
// change or removal). Default: ["1.1", "2"]
|
2020-04-07 09:31:52 -05:00
|
|
|
Versions []string `json:"versions,omitempty"`
|
|
|
|
|
|
|
|
// The pre-configured underlying HTTP transport.
|
2019-11-05 18:29:10 -05:00
|
|
|
Transport *http.Transport `json:"-"`
|
2020-05-05 13:33:21 -05:00
|
|
|
|
|
|
|
h2cTransport *http2.Transport
|
2019-09-02 23:01:02 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
// CaddyModule returns the Caddy module information.
|
|
|
|
func (HTTPTransport) CaddyModule() caddy.ModuleInfo {
|
|
|
|
return caddy.ModuleInfo{
|
2019-12-10 15:36:46 -05:00
|
|
|
ID: "http.reverse_proxy.transport.http",
|
|
|
|
New: func() caddy.Module { return new(HTTPTransport) },
|
2019-09-02 23:01:02 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-11-05 18:29:10 -05:00
|
|
|
// Provision sets up h.Transport with a *http.Transport
|
2019-09-03 17:56:09 -05:00
|
|
|
// that is ready to use.
|
2020-04-09 14:22:05 -05:00
|
|
|
func (h *HTTPTransport) Provision(ctx caddy.Context) error {
|
2019-11-05 18:27:51 -05:00
|
|
|
if len(h.Versions) == 0 {
|
|
|
|
h.Versions = []string{"1.1", "2"}
|
|
|
|
}
|
2019-11-05 18:29:10 -05:00
|
|
|
|
2020-04-09 14:22:05 -05:00
|
|
|
rt, err := h.NewTransport(ctx)
|
2019-11-05 18:29:10 -05:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
h.Transport = rt
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-05-05 13:35:32 -05:00
|
|
|
// NewTransport builds a standard-lib-compatible http.Transport value from h.
|
2022-07-23 23:38:41 -05:00
|
|
|
func (h *HTTPTransport) NewTransport(caddyCtx caddy.Context) (*http.Transport, error) {
|
2021-11-24 01:32:25 -05:00
|
|
|
// Set keep-alive defaults if it wasn't otherwise configured
|
|
|
|
if h.KeepAlive == nil {
|
|
|
|
h.KeepAlive = &KeepAlive{
|
|
|
|
ProbeInterval: caddy.Duration(30 * time.Second),
|
|
|
|
IdleConnTimeout: caddy.Duration(2 * time.Minute),
|
|
|
|
MaxIdleConnsPerHost: 32, // seems about optimal, see #2805
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Set a relatively short default dial timeout.
|
|
|
|
// This is helpful to make load-balancer retries more speedy.
|
|
|
|
if h.DialTimeout == 0 {
|
|
|
|
h.DialTimeout = caddy.Duration(3 * time.Second)
|
|
|
|
}
|
|
|
|
|
2019-09-02 23:01:02 -05:00
|
|
|
dialer := &net.Dialer{
|
|
|
|
Timeout: time.Duration(h.DialTimeout),
|
|
|
|
FallbackDelay: time.Duration(h.FallbackDelay),
|
2020-07-18 16:00:00 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
if h.Resolver != nil {
|
2022-03-06 19:43:39 -05:00
|
|
|
err := h.Resolver.ParseAddresses()
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
2020-07-18 16:00:00 -05:00
|
|
|
}
|
|
|
|
d := &net.Dialer{
|
|
|
|
Timeout: time.Duration(h.DialTimeout),
|
|
|
|
FallbackDelay: time.Duration(h.FallbackDelay),
|
|
|
|
}
|
|
|
|
dialer.Resolver = &net.Resolver{
|
|
|
|
PreferGo: true,
|
|
|
|
Dial: func(ctx context.Context, _, _ string) (net.Conn, error) {
|
2020-11-22 16:50:29 -05:00
|
|
|
//nolint:gosec
|
2020-07-18 16:00:00 -05:00
|
|
|
addr := h.Resolver.netAddrs[weakrand.Intn(len(h.Resolver.netAddrs))]
|
|
|
|
return d.DialContext(ctx, addr.Network, addr.JoinHostPort(0))
|
|
|
|
},
|
|
|
|
}
|
2019-09-02 23:01:02 -05:00
|
|
|
}
|
2019-09-05 14:14:39 -05:00
|
|
|
|
2022-08-12 14:11:13 -05:00
|
|
|
// Set up the dialer to pull the correct information from the context
|
|
|
|
dialContext := func(ctx context.Context, network, address string) (net.Conn, error) {
|
|
|
|
// the proper dialing information should be embedded into the request's context
|
|
|
|
if dialInfo, ok := GetDialInfo(ctx); ok {
|
|
|
|
network = dialInfo.Network
|
|
|
|
address = dialInfo.Address
|
|
|
|
}
|
2022-07-23 23:38:41 -05:00
|
|
|
|
2022-08-12 14:11:13 -05:00
|
|
|
conn, err := dialer.DialContext(ctx, network, address)
|
|
|
|
if err != nil {
|
|
|
|
// identify this error as one that occurred during
|
|
|
|
// dialing, which can be important when trying to
|
|
|
|
// decide whether to retry a request
|
|
|
|
return nil, DialError{err}
|
|
|
|
}
|
2022-07-23 23:38:41 -05:00
|
|
|
|
2022-08-12 14:11:13 -05:00
|
|
|
// if read/write timeouts are configured and this is a TCP connection, enforce the timeouts
|
|
|
|
// by wrapping the connection with our own type
|
|
|
|
if tcpConn, ok := conn.(*net.TCPConn); ok && (h.ReadTimeout > 0 || h.WriteTimeout > 0) {
|
|
|
|
conn = &tcpRWTimeoutConn{
|
|
|
|
TCPConn: tcpConn,
|
|
|
|
readTimeout: time.Duration(h.ReadTimeout),
|
|
|
|
writeTimeout: time.Duration(h.WriteTimeout),
|
2022-09-16 17:55:30 -05:00
|
|
|
logger: caddyCtx.Logger(),
|
2022-07-23 23:38:41 -05:00
|
|
|
}
|
2022-08-12 14:11:13 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
return conn, nil
|
|
|
|
}
|
2022-07-23 23:38:41 -05:00
|
|
|
|
2022-08-12 14:11:13 -05:00
|
|
|
rt := &http.Transport{
|
|
|
|
DialContext: dialContext,
|
2019-09-02 23:01:02 -05:00
|
|
|
MaxConnsPerHost: h.MaxConnsPerHost,
|
|
|
|
ResponseHeaderTimeout: time.Duration(h.ResponseHeaderTimeout),
|
|
|
|
ExpectContinueTimeout: time.Duration(h.ExpectContinueTimeout),
|
|
|
|
MaxResponseHeaderBytes: h.MaxResponseHeaderSize,
|
|
|
|
WriteBufferSize: h.WriteBufferSize,
|
|
|
|
ReadBufferSize: h.ReadBufferSize,
|
|
|
|
}
|
|
|
|
|
|
|
|
if h.TLS != nil {
|
|
|
|
rt.TLSHandshakeTimeout = time.Duration(h.TLS.HandshakeTimeout)
|
2019-09-03 16:26:09 -05:00
|
|
|
var err error
|
2022-07-23 23:38:41 -05:00
|
|
|
rt.TLSClientConfig, err = h.TLS.MakeTLSClientConfig(caddyCtx)
|
2019-09-03 16:26:09 -05:00
|
|
|
if err != nil {
|
2019-11-05 18:29:10 -05:00
|
|
|
return nil, fmt.Errorf("making TLS client config: %v", err)
|
2019-09-03 16:26:09 -05:00
|
|
|
}
|
2019-09-02 23:01:02 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
if h.KeepAlive != nil {
|
|
|
|
dialer.KeepAlive = time.Duration(h.KeepAlive.ProbeInterval)
|
2019-11-05 18:29:10 -05:00
|
|
|
if h.KeepAlive.Enabled != nil {
|
|
|
|
rt.DisableKeepAlives = !*h.KeepAlive.Enabled
|
2019-09-02 23:01:02 -05:00
|
|
|
}
|
|
|
|
rt.MaxIdleConns = h.KeepAlive.MaxIdleConns
|
|
|
|
rt.MaxIdleConnsPerHost = h.KeepAlive.MaxIdleConnsPerHost
|
|
|
|
rt.IdleConnTimeout = time.Duration(h.KeepAlive.IdleConnTimeout)
|
|
|
|
}
|
|
|
|
|
|
|
|
if h.Compression != nil {
|
|
|
|
rt.DisableCompression = !*h.Compression
|
|
|
|
}
|
|
|
|
|
2019-11-05 18:27:51 -05:00
|
|
|
if sliceContains(h.Versions, "2") {
|
|
|
|
if err := http2.ConfigureTransport(rt); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2019-10-29 01:07:45 -05:00
|
|
|
}
|
|
|
|
|
2022-08-12 14:11:13 -05:00
|
|
|
// if h2c is enabled, configure its transport (std lib http.Transport
|
|
|
|
// does not "HTTP/2 over cleartext TCP")
|
|
|
|
if sliceContains(h.Versions, "h2c") {
|
|
|
|
// crafting our own http2.Transport doesn't allow us to utilize
|
|
|
|
// most of the customizations/preferences on the http.Transport,
|
|
|
|
// because, for some reason, only http2.ConfigureTransport()
|
|
|
|
// is allowed to set the unexported field that refers to a base
|
|
|
|
// http.Transport config; oh well
|
|
|
|
h2t := &http2.Transport{
|
|
|
|
// kind of a hack, but for plaintext/H2C requests, pretend to dial TLS
|
|
|
|
DialTLSContext: func(ctx context.Context, network, address string, _ *tls.Config) (net.Conn, error) {
|
|
|
|
return dialContext(ctx, network, address)
|
|
|
|
},
|
|
|
|
AllowHTTP: true,
|
|
|
|
}
|
|
|
|
if h.Compression != nil {
|
|
|
|
h2t.DisableCompression = !*h.Compression
|
|
|
|
}
|
|
|
|
h.h2cTransport = h2t
|
|
|
|
}
|
|
|
|
|
2019-11-05 18:29:10 -05:00
|
|
|
return rt, nil
|
|
|
|
}
|
2019-09-02 23:01:02 -05:00
|
|
|
|
2022-06-14 22:53:05 -05:00
|
|
|
// replaceTLSServername checks TLS servername to see if it needs replacing
|
|
|
|
// if it does need replacing, it creates a new cloned HTTPTransport object to avoid any races
|
|
|
|
// and does the replacing of the TLS servername on that and returns the new object
|
|
|
|
// if no replacement is necessary it returns the original
|
|
|
|
func (h *HTTPTransport) replaceTLSServername(repl *caddy.Replacer) *HTTPTransport {
|
|
|
|
// check whether we have TLS and need to replace the servername in the TLSClientConfig
|
|
|
|
if h.TLSEnabled() && strings.Contains(h.TLS.ServerName, "{") {
|
|
|
|
// make a new h, "copy" the parts we don't need to touch, add a new *tls.Config and replace servername
|
|
|
|
newtransport := &HTTPTransport{
|
|
|
|
Resolver: h.Resolver,
|
|
|
|
TLS: h.TLS,
|
|
|
|
KeepAlive: h.KeepAlive,
|
|
|
|
Compression: h.Compression,
|
|
|
|
MaxConnsPerHost: h.MaxConnsPerHost,
|
|
|
|
DialTimeout: h.DialTimeout,
|
|
|
|
FallbackDelay: h.FallbackDelay,
|
|
|
|
ResponseHeaderTimeout: h.ResponseHeaderTimeout,
|
|
|
|
ExpectContinueTimeout: h.ExpectContinueTimeout,
|
|
|
|
MaxResponseHeaderSize: h.MaxResponseHeaderSize,
|
|
|
|
WriteBufferSize: h.WriteBufferSize,
|
|
|
|
ReadBufferSize: h.ReadBufferSize,
|
|
|
|
Versions: h.Versions,
|
|
|
|
Transport: h.Transport.Clone(),
|
|
|
|
h2cTransport: h.h2cTransport,
|
|
|
|
}
|
|
|
|
newtransport.Transport.TLSClientConfig.ServerName = repl.ReplaceAll(newtransport.Transport.TLSClientConfig.ServerName, "")
|
|
|
|
return newtransport
|
|
|
|
}
|
|
|
|
|
|
|
|
return h
|
|
|
|
}
|
|
|
|
|
2019-11-05 18:29:10 -05:00
|
|
|
// RoundTrip implements http.RoundTripper.
|
|
|
|
func (h *HTTPTransport) RoundTrip(req *http.Request) (*http.Response, error) {
|
2022-06-14 22:53:05 -05:00
|
|
|
// Try to replace TLS servername if needed
|
|
|
|
repl := req.Context().Value(caddy.ReplacerCtxKey).(*caddy.Replacer)
|
|
|
|
transport := h.replaceTLSServername(repl)
|
|
|
|
|
2022-07-13 09:52:30 -05:00
|
|
|
transport.SetScheme(req)
|
2020-05-05 13:33:21 -05:00
|
|
|
|
|
|
|
// if H2C ("HTTP/2 over cleartext") is enabled and the upstream request is
|
2022-05-10 16:25:58 -05:00
|
|
|
// HTTP without TLS, use the alternate H2C-capable transport instead
|
|
|
|
if req.URL.Scheme == "http" && h.h2cTransport != nil {
|
2020-05-05 13:33:21 -05:00
|
|
|
return h.h2cTransport.RoundTrip(req)
|
|
|
|
}
|
|
|
|
|
2022-06-14 22:53:05 -05:00
|
|
|
return transport.Transport.RoundTrip(req)
|
2019-09-02 23:01:02 -05:00
|
|
|
}
|
|
|
|
|
2022-07-13 09:52:30 -05:00
|
|
|
// SetScheme ensures that the outbound request req
|
2019-11-05 18:29:10 -05:00
|
|
|
// has the scheme set in its URL; the underlying
|
|
|
|
// http.Transport requires a scheme to be set.
|
2022-07-13 09:52:30 -05:00
|
|
|
//
|
|
|
|
// This method may be used by other transport modules
|
|
|
|
// that wrap/use this one.
|
|
|
|
func (h *HTTPTransport) SetScheme(req *http.Request) {
|
2022-06-22 14:01:57 -05:00
|
|
|
if req.URL.Scheme != "" {
|
|
|
|
return
|
2022-06-20 12:51:42 -05:00
|
|
|
}
|
2022-06-22 14:01:57 -05:00
|
|
|
if h.shouldUseTLS(req) {
|
|
|
|
req.URL.Scheme = "https"
|
|
|
|
} else {
|
2019-11-05 18:29:10 -05:00
|
|
|
req.URL.Scheme = "http"
|
2022-06-22 14:01:57 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// shouldUseTLS returns true if TLS should be used for req.
|
|
|
|
func (h *HTTPTransport) shouldUseTLS(req *http.Request) bool {
|
|
|
|
if h.TLS == nil {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
port := req.URL.Port()
|
|
|
|
for i := range h.TLS.ExceptPorts {
|
|
|
|
if h.TLS.ExceptPorts[i] == port {
|
|
|
|
return false
|
2019-11-05 18:29:10 -05:00
|
|
|
}
|
|
|
|
}
|
2022-06-22 14:01:57 -05:00
|
|
|
|
|
|
|
return true
|
2019-09-02 23:01:02 -05:00
|
|
|
}
|
|
|
|
|
2020-04-07 09:31:52 -05:00
|
|
|
// TLSEnabled returns true if TLS is enabled.
|
|
|
|
func (h HTTPTransport) TLSEnabled() bool {
|
|
|
|
return h.TLS != nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// EnableTLS enables TLS on the transport.
|
|
|
|
func (h *HTTPTransport) EnableTLS(base *TLSConfig) error {
|
|
|
|
h.TLS = base
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-09-14 19:10:29 -05:00
|
|
|
// Cleanup implements caddy.CleanerUpper and closes any idle connections.
|
|
|
|
func (h HTTPTransport) Cleanup() error {
|
2020-01-07 14:07:42 -05:00
|
|
|
if h.Transport == nil {
|
|
|
|
return nil
|
|
|
|
}
|
2019-11-05 18:29:10 -05:00
|
|
|
h.Transport.CloseIdleConnections()
|
2019-09-14 19:10:29 -05:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-04-07 09:31:52 -05:00
|
|
|
// TLSConfig holds configuration related to the TLS configuration for the
|
|
|
|
// transport/client.
|
2019-09-02 23:01:02 -05:00
|
|
|
type TLSConfig struct {
|
2020-04-07 09:31:52 -05:00
|
|
|
// Optional list of base64-encoded DER-encoded CA certificates to trust.
|
2019-09-03 16:26:09 -05:00
|
|
|
RootCAPool []string `json:"root_ca_pool,omitempty"`
|
2020-04-07 09:31:52 -05:00
|
|
|
|
|
|
|
// List of PEM-encoded CA certificate files to add to the same trust
|
|
|
|
// store as RootCAPool (or root_ca_pool in the JSON).
|
2020-01-22 11:35:03 -05:00
|
|
|
RootCAPEMFiles []string `json:"root_ca_pem_files,omitempty"`
|
2020-04-07 09:31:52 -05:00
|
|
|
|
|
|
|
// PEM-encoded client certificate filename to present to servers.
|
|
|
|
ClientCertificateFile string `json:"client_certificate_file,omitempty"`
|
|
|
|
|
|
|
|
// PEM-encoded key to use with the client certificate.
|
|
|
|
ClientCertificateKeyFile string `json:"client_certificate_key_file,omitempty"`
|
|
|
|
|
2020-05-05 13:35:32 -05:00
|
|
|
// If specified, Caddy will use and automate a client certificate
|
|
|
|
// with this subject name.
|
|
|
|
ClientCertificateAutomate string `json:"client_certificate_automate,omitempty"`
|
|
|
|
|
2020-04-07 09:31:52 -05:00
|
|
|
// If true, TLS verification of server certificates will be disabled.
|
|
|
|
// This is insecure and may be removed in the future. Do not use this
|
|
|
|
// option except in testing or local development environments.
|
|
|
|
InsecureSkipVerify bool `json:"insecure_skip_verify,omitempty"`
|
|
|
|
|
2021-11-24 01:32:25 -05:00
|
|
|
// The duration to allow a TLS handshake to a server. Default: No timeout.
|
2020-04-07 09:31:52 -05:00
|
|
|
HandshakeTimeout caddy.Duration `json:"handshake_timeout,omitempty"`
|
|
|
|
|
2022-06-06 13:37:09 -05:00
|
|
|
// The server name used when verifying the certificate received in the TLS
|
|
|
|
// handshake. By default, this will use the upstream address' host part.
|
|
|
|
// You only need to override this if your upstream address does not match the
|
|
|
|
// certificate the upstream is likely to use. For example if the upstream
|
|
|
|
// address is an IP address, then you would need to configure this to the
|
|
|
|
// hostname being served by the upstream server. Currently, this does not
|
|
|
|
// support placeholders because the TLS config is not provisioned on each
|
|
|
|
// connection, so a static value must be used.
|
2020-04-07 09:31:52 -05:00
|
|
|
ServerName string `json:"server_name,omitempty"`
|
2022-06-10 10:33:35 -05:00
|
|
|
|
|
|
|
// TLS renegotiation level. TLS renegotiation is the act of performing
|
|
|
|
// subsequent handshakes on a connection after the first.
|
|
|
|
// The level can be:
|
|
|
|
// - "never": (the default) disables renegotiation.
|
|
|
|
// - "once": allows a remote server to request renegotiation once per connection.
|
|
|
|
// - "freely": allows a remote server to repeatedly request renegotiation.
|
|
|
|
Renegotiation string `json:"renegotiation,omitempty"`
|
2022-06-20 12:51:42 -05:00
|
|
|
|
|
|
|
// Skip TLS ports specifies a list of upstream ports on which TLS should not be
|
|
|
|
// attempted even if it is configured. Handy when using dynamic upstreams that
|
|
|
|
// return HTTP and HTTPS endpoints too.
|
|
|
|
// When specified, TLS will automatically be configured on the transport.
|
|
|
|
// The value can be a list of any valid tcp port numbers, default empty.
|
|
|
|
ExceptPorts []string `json:"except_ports,omitempty"`
|
2019-09-03 16:26:09 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
// MakeTLSClientConfig returns a tls.Config usable by a client to a backend.
|
|
|
|
// If there is no custom TLS configuration, a nil config may be returned.
|
2020-05-05 13:35:32 -05:00
|
|
|
func (t TLSConfig) MakeTLSClientConfig(ctx caddy.Context) (*tls.Config, error) {
|
2019-09-03 16:26:09 -05:00
|
|
|
cfg := new(tls.Config)
|
|
|
|
|
|
|
|
// client auth
|
|
|
|
if t.ClientCertificateFile != "" && t.ClientCertificateKeyFile == "" {
|
|
|
|
return nil, fmt.Errorf("client_certificate_file specified without client_certificate_key_file")
|
|
|
|
}
|
|
|
|
if t.ClientCertificateFile == "" && t.ClientCertificateKeyFile != "" {
|
|
|
|
return nil, fmt.Errorf("client_certificate_key_file specified without client_certificate_file")
|
|
|
|
}
|
|
|
|
if t.ClientCertificateFile != "" && t.ClientCertificateKeyFile != "" {
|
|
|
|
cert, err := tls.LoadX509KeyPair(t.ClientCertificateFile, t.ClientCertificateKeyFile)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("loading client certificate key pair: %v", err)
|
|
|
|
}
|
|
|
|
cfg.Certificates = []tls.Certificate{cert}
|
|
|
|
}
|
2020-05-05 13:35:32 -05:00
|
|
|
if t.ClientCertificateAutomate != "" {
|
2021-02-09 16:15:04 -05:00
|
|
|
// TODO: use or enable ctx.IdentityCredentials() ...
|
2020-05-05 13:35:32 -05:00
|
|
|
tlsAppIface, err := ctx.App("tls")
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("getting tls app: %v", err)
|
|
|
|
}
|
|
|
|
tlsApp := tlsAppIface.(*caddytls.TLS)
|
|
|
|
err = tlsApp.Manage([]string{t.ClientCertificateAutomate})
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("managing client certificate: %v", err)
|
|
|
|
}
|
|
|
|
cfg.GetClientCertificate = func(cri *tls.CertificateRequestInfo) (*tls.Certificate, error) {
|
|
|
|
certs := tlsApp.AllMatchingCertificates(t.ClientCertificateAutomate)
|
|
|
|
var err error
|
|
|
|
for _, cert := range certs {
|
|
|
|
err = cri.SupportsCertificate(&cert.Certificate)
|
|
|
|
if err == nil {
|
|
|
|
return &cert.Certificate, nil
|
|
|
|
}
|
2022-02-02 01:33:36 -05:00
|
|
|
}
|
|
|
|
if err == nil {
|
|
|
|
err = fmt.Errorf("no client certificate found for automate name: %s", t.ClientCertificateAutomate)
|
2020-05-05 13:35:32 -05:00
|
|
|
}
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
2019-09-03 16:26:09 -05:00
|
|
|
|
|
|
|
// trusted root CAs
|
2020-01-22 11:35:03 -05:00
|
|
|
if len(t.RootCAPool) > 0 || len(t.RootCAPEMFiles) > 0 {
|
2019-09-03 16:26:09 -05:00
|
|
|
rootPool := x509.NewCertPool()
|
|
|
|
for _, encodedCACert := range t.RootCAPool {
|
|
|
|
caCert, err := decodeBase64DERCert(encodedCACert)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("parsing CA certificate: %v", err)
|
|
|
|
}
|
|
|
|
rootPool.AddCert(caCert)
|
|
|
|
}
|
2020-01-22 11:35:03 -05:00
|
|
|
for _, pemFile := range t.RootCAPEMFiles {
|
2021-09-29 12:17:48 -05:00
|
|
|
pemData, err := os.ReadFile(pemFile)
|
2020-01-07 14:07:42 -05:00
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed reading ca cert: %v", err)
|
|
|
|
}
|
|
|
|
rootPool.AppendCertsFromPEM(pemData)
|
|
|
|
|
|
|
|
}
|
2019-09-03 16:26:09 -05:00
|
|
|
cfg.RootCAs = rootPool
|
|
|
|
}
|
|
|
|
|
2022-06-10 10:33:35 -05:00
|
|
|
// Renegotiation
|
|
|
|
switch t.Renegotiation {
|
2022-06-14 10:05:25 -05:00
|
|
|
case "never", "":
|
2022-06-10 10:33:35 -05:00
|
|
|
cfg.Renegotiation = tls.RenegotiateNever
|
|
|
|
case "once":
|
|
|
|
cfg.Renegotiation = tls.RenegotiateOnceAsClient
|
|
|
|
case "freely":
|
|
|
|
cfg.Renegotiation = tls.RenegotiateFreelyAsClient
|
|
|
|
default:
|
|
|
|
return nil, fmt.Errorf("invalid TLS renegotiation level: %v", t.Renegotiation)
|
|
|
|
}
|
|
|
|
|
2022-06-06 13:37:09 -05:00
|
|
|
// override for the server name used verify the TLS handshake
|
2019-10-10 18:17:06 -05:00
|
|
|
cfg.ServerName = t.ServerName
|
|
|
|
|
2019-09-03 16:26:09 -05:00
|
|
|
// throw all security out the window
|
|
|
|
cfg.InsecureSkipVerify = t.InsecureSkipVerify
|
|
|
|
|
|
|
|
// only return a config if it's not empty
|
|
|
|
if reflect.DeepEqual(cfg, new(tls.Config)) {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return cfg, nil
|
|
|
|
}
|
|
|
|
|
2019-11-05 18:27:51 -05:00
|
|
|
// KeepAlive holds configuration pertaining to HTTP Keep-Alive.
|
|
|
|
type KeepAlive struct {
|
2022-06-06 13:37:09 -05:00
|
|
|
// Whether HTTP Keep-Alive is enabled. Default: `true`
|
2020-04-07 09:31:52 -05:00
|
|
|
Enabled *bool `json:"enabled,omitempty"`
|
|
|
|
|
2021-11-24 01:32:25 -05:00
|
|
|
// How often to probe for liveness. Default: `30s`.
|
2020-04-07 09:31:52 -05:00
|
|
|
ProbeInterval caddy.Duration `json:"probe_interval,omitempty"`
|
|
|
|
|
2022-06-06 13:37:09 -05:00
|
|
|
// Maximum number of idle connections. Default: `0`, which means no limit.
|
2020-04-07 09:31:52 -05:00
|
|
|
MaxIdleConns int `json:"max_idle_conns,omitempty"`
|
|
|
|
|
2022-06-06 13:37:09 -05:00
|
|
|
// Maximum number of idle connections per host. Default: `32`.
|
2020-04-07 09:31:52 -05:00
|
|
|
MaxIdleConnsPerHost int `json:"max_idle_conns_per_host,omitempty"`
|
|
|
|
|
2021-11-24 01:32:25 -05:00
|
|
|
// How long connections should be kept alive when idle. Default: `2m`.
|
2020-04-07 09:31:52 -05:00
|
|
|
IdleConnTimeout caddy.Duration `json:"idle_timeout,omitempty"`
|
2019-11-05 18:27:51 -05:00
|
|
|
}
|
|
|
|
|
2022-07-23 23:38:41 -05:00
|
|
|
// tcpRWTimeoutConn enforces read/write timeouts for a TCP connection.
|
|
|
|
// If it fails to set deadlines, the error is logged but does not abort
|
|
|
|
// the read/write attempt (ignoring the error is consistent with what
|
|
|
|
// the standard library does: https://github.com/golang/go/blob/c5da4fb7ac5cb7434b41fc9a1df3bee66c7f1a4d/src/net/http/server.go#L981-L986)
|
|
|
|
type tcpRWTimeoutConn struct {
|
|
|
|
*net.TCPConn
|
|
|
|
readTimeout, writeTimeout time.Duration
|
|
|
|
logger *zap.Logger
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *tcpRWTimeoutConn) Read(b []byte) (int, error) {
|
|
|
|
if c.readTimeout > 0 {
|
|
|
|
err := c.TCPConn.SetReadDeadline(time.Now().Add(c.readTimeout))
|
|
|
|
if err != nil {
|
|
|
|
c.logger.Error("failed to set read deadline", zap.Error(err))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return c.TCPConn.Read(b)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *tcpRWTimeoutConn) Write(b []byte) (int, error) {
|
|
|
|
if c.writeTimeout > 0 {
|
|
|
|
err := c.TCPConn.SetWriteDeadline(time.Now().Add(c.writeTimeout))
|
|
|
|
if err != nil {
|
|
|
|
c.logger.Error("failed to set write deadline", zap.Error(err))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return c.TCPConn.Write(b)
|
|
|
|
}
|
|
|
|
|
2019-09-03 16:26:09 -05:00
|
|
|
// decodeBase64DERCert base64-decodes, then DER-decodes, certStr.
|
|
|
|
func decodeBase64DERCert(certStr string) (*x509.Certificate, error) {
|
|
|
|
// decode base64
|
|
|
|
derBytes, err := base64.StdEncoding.DecodeString(certStr)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// parse the DER-encoded certificate
|
|
|
|
return x509.ParseCertificate(derBytes)
|
2019-09-02 23:01:02 -05:00
|
|
|
}
|
|
|
|
|
2019-11-05 18:27:51 -05:00
|
|
|
// sliceContains returns true if needle is in haystack.
|
|
|
|
func sliceContains(haystack []string, needle string) bool {
|
|
|
|
for _, s := range haystack {
|
|
|
|
if s == needle {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false
|
2019-09-02 23:01:02 -05:00
|
|
|
}
|
2019-09-05 14:42:20 -05:00
|
|
|
|
|
|
|
// Interface guards
|
|
|
|
var (
|
2019-09-14 19:10:29 -05:00
|
|
|
_ caddy.Provisioner = (*HTTPTransport)(nil)
|
|
|
|
_ http.RoundTripper = (*HTTPTransport)(nil)
|
|
|
|
_ caddy.CleanerUpper = (*HTTPTransport)(nil)
|
2020-04-07 09:31:52 -05:00
|
|
|
_ TLSTransport = (*HTTPTransport)(nil)
|
2019-09-05 14:42:20 -05:00
|
|
|
)
|