2019-09-02 23:01:02 -05:00
// Copyright 2015 Matthew Holt and The Caddy Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package reverseproxy
import (
2019-09-05 14:14:39 -05:00
"context"
2019-09-03 16:26:09 -05:00
"crypto/tls"
"crypto/x509"
"encoding/base64"
"fmt"
2020-01-07 14:07:42 -05:00
"io/ioutil"
2020-07-18 16:00:00 -05:00
weakrand "math/rand"
2019-09-02 23:01:02 -05:00
"net"
"net/http"
2019-09-03 16:26:09 -05:00
"reflect"
2019-09-02 23:01:02 -05:00
"time"
"github.com/caddyserver/caddy/v2"
2020-05-05 13:35:32 -05:00
"github.com/caddyserver/caddy/v2/modules/caddytls"
2019-10-29 11:22:49 -05:00
"golang.org/x/net/http2"
2019-09-02 23:01:02 -05:00
)
func init ( ) {
caddy . RegisterModule ( HTTPTransport { } )
}
2019-09-03 17:56:09 -05:00
// HTTPTransport is essentially a configuration wrapper for http.Transport.
// It defines a JSON structure useful when configuring the HTTP transport
2019-11-05 18:29:10 -05:00
// for Caddy's reverse proxy. It builds its http.Transport at Provision.
2019-09-02 23:01:02 -05:00
type HTTPTransport struct {
// TODO: It's possible that other transports (like fastcgi) might be
// able to borrow/use at least some of these config fields; if so,
2019-11-05 18:29:10 -05:00
// maybe move them into a type called CommonTransport and embed it?
2019-12-10 15:36:46 -05:00
2020-07-18 16:00:00 -05:00
// Configures the DNS resolver used to resolve the IP address of upstream hostnames.
Resolver * UpstreamResolver ` json:"resolver,omitempty" `
2020-04-07 09:31:52 -05:00
// Configures TLS to the upstream. Setting this to an empty struct
// is sufficient to enable TLS with reasonable defaults.
TLS * TLSConfig ` json:"tls,omitempty" `
// Configures HTTP Keep-Alive (enabled by default). Should only be
// necessary if rigorous testing has shown that tuning this helps
// improve performance.
KeepAlive * KeepAlive ` json:"keep_alive,omitempty" `
// Whether to enable compression to upstream. Default: true
Compression * bool ` json:"compression,omitempty" `
// Maximum number of connections per host. Default: 0 (no limit)
MaxConnsPerHost int ` json:"max_conns_per_host,omitempty" `
// How long to wait before timing out trying to connect to
// an upstream.
DialTimeout caddy . Duration ` json:"dial_timeout,omitempty" `
// How long to wait before spawning an RFC 6555 Fast Fallback
// connection. A negative value disables this.
FallbackDelay caddy . Duration ` json:"dial_fallback_delay,omitempty" `
// How long to wait for reading response headers from server.
2019-09-02 23:01:02 -05:00
ResponseHeaderTimeout caddy . Duration ` json:"response_header_timeout,omitempty" `
2020-04-07 09:31:52 -05:00
// The length of time to wait for a server's first response
// headers after fully writing the request headers if the
// request has a header "Expect: 100-continue".
2019-09-02 23:01:02 -05:00
ExpectContinueTimeout caddy . Duration ` json:"expect_continue_timeout,omitempty" `
2020-04-07 09:31:52 -05:00
// The maximum bytes to read from response headers.
MaxResponseHeaderSize int64 ` json:"max_response_header_size,omitempty" `
// The size of the write buffer in bytes.
WriteBufferSize int ` json:"write_buffer_size,omitempty" `
// The size of the read buffer in bytes.
ReadBufferSize int ` json:"read_buffer_size,omitempty" `
2020-05-05 13:33:21 -05:00
// The versions of HTTP to support. As a special case, "h2c"
// can be specified to use H2C (HTTP/2 over Cleartext) to the
// upstream (this feature is experimental and subject to
// change or removal). Default: ["1.1", "2"]
2020-04-07 09:31:52 -05:00
Versions [ ] string ` json:"versions,omitempty" `
// The pre-configured underlying HTTP transport.
2019-11-05 18:29:10 -05:00
Transport * http . Transport ` json:"-" `
2020-05-05 13:33:21 -05:00
h2cTransport * http2 . Transport
2019-09-02 23:01:02 -05:00
}
// CaddyModule returns the Caddy module information.
func ( HTTPTransport ) CaddyModule ( ) caddy . ModuleInfo {
return caddy . ModuleInfo {
2019-12-10 15:36:46 -05:00
ID : "http.reverse_proxy.transport.http" ,
New : func ( ) caddy . Module { return new ( HTTPTransport ) } ,
2019-09-02 23:01:02 -05:00
}
}
2019-11-05 18:29:10 -05:00
// Provision sets up h.Transport with a *http.Transport
2019-09-03 17:56:09 -05:00
// that is ready to use.
2020-04-09 14:22:05 -05:00
func ( h * HTTPTransport ) Provision ( ctx caddy . Context ) error {
2019-11-05 18:27:51 -05:00
if len ( h . Versions ) == 0 {
h . Versions = [ ] string { "1.1" , "2" }
}
2019-11-05 18:29:10 -05:00
2020-04-09 14:22:05 -05:00
rt , err := h . NewTransport ( ctx )
2019-11-05 18:29:10 -05:00
if err != nil {
return err
}
h . Transport = rt
2020-05-05 13:33:21 -05:00
// if h2c is enabled, configure its transport (std lib http.Transport
// does not "HTTP/2 over cleartext TCP")
if sliceContains ( h . Versions , "h2c" ) {
// crafting our own http2.Transport doesn't allow us to utilize
// most of the customizations/preferences on the http.Transport,
// because, for some reason, only http2.ConfigureTransport()
// is allowed to set the unexported field that refers to a base
// http.Transport config; oh well
h2t := & http2 . Transport {
// kind of a hack, but for plaintext/H2C requests, pretend to dial TLS
DialTLS : func ( network , addr string , _ * tls . Config ) ( net . Conn , error ) {
// TODO: no context, thus potentially wrong dial info
return net . Dial ( network , addr )
} ,
AllowHTTP : true ,
}
if h . Compression != nil {
h2t . DisableCompression = ! * h . Compression
}
h . h2cTransport = h2t
}
2019-11-05 18:29:10 -05:00
return nil
}
2020-05-05 13:35:32 -05:00
// NewTransport builds a standard-lib-compatible http.Transport value from h.
func ( h * HTTPTransport ) NewTransport ( ctx caddy . Context ) ( * http . Transport , error ) {
2019-09-02 23:01:02 -05:00
dialer := & net . Dialer {
Timeout : time . Duration ( h . DialTimeout ) ,
FallbackDelay : time . Duration ( h . FallbackDelay ) ,
2020-07-18 16:00:00 -05:00
}
if h . Resolver != nil {
for _ , v := range h . Resolver . Addresses {
addr , err := caddy . ParseNetworkAddress ( v )
if err != nil {
return nil , err
}
if addr . PortRangeSize ( ) != 1 {
return nil , fmt . Errorf ( "resolver address must have exactly one address; cannot call %v" , addr )
}
h . Resolver . netAddrs = append ( h . Resolver . netAddrs , addr )
}
d := & net . Dialer {
Timeout : time . Duration ( h . DialTimeout ) ,
FallbackDelay : time . Duration ( h . FallbackDelay ) ,
}
dialer . Resolver = & net . Resolver {
PreferGo : true ,
Dial : func ( ctx context . Context , _ , _ string ) ( net . Conn , error ) {
2020-11-22 16:50:29 -05:00
//nolint:gosec
2020-07-18 16:00:00 -05:00
addr := h . Resolver . netAddrs [ weakrand . Intn ( len ( h . Resolver . netAddrs ) ) ]
return d . DialContext ( ctx , addr . Network , addr . JoinHostPort ( 0 ) )
} ,
}
2019-09-02 23:01:02 -05:00
}
2019-09-05 14:14:39 -05:00
2019-09-02 23:01:02 -05:00
rt := & http . Transport {
2019-09-05 14:14:39 -05:00
DialContext : func ( ctx context . Context , network , address string ) ( net . Conn , error ) {
// the proper dialing information should be embedded into the request's context
http: Change routes to sequential matcher evaluation (#2967)
Previously, all matchers in a route would be evaluated before any
handlers were executed, and a composite route of the matching routes
would be created. This made rewrites especially tricky, since the only
way to defer later matchers' evaluation was to wrap them in a subroute,
or to invoke a "rehandle" which often caused bugs.
Instead, this new sequential design evaluates each route's matchers then
its handlers in lock-step; matcher-handlers-matcher-handlers...
If the first matching route consists of a rewrite, then the second route
will be evaluated against the rewritten request, rather than the original
one, and so on.
This should do away with any need for rehandling.
I've also taken this opportunity to avoid adding new values to the
request context in the handler chain, as this creates a copy of the
Request struct, which may possibly lead to bugs like it has in the past
(see PR #1542, PR #1481, and maybe issue #2463). We now add all the
expected context values in the top-level handler at the server, then
any new values can be added to the variable table via the VarsCtxKey
context key, or just the GetVar/SetVar functions. In particular, we are
using this facility to convey dial information in the reverse proxy.
Had to be careful in one place as the middleware compilation logic has
changed, and moved a bit. We no longer compile a middleware chain per-
request; instead, we can compile it at provision-time, and defer only the
evaluation of matchers to request-time, which should slightly improve
performance. Doing this, however, we take advantage of multiple function
closures, and we also changed the use of HandlerFunc (function pointer)
to Handler (interface)... this led to a situation where, if we aren't
careful, allows one request routed a certain way to permanently change
the "next" handler for all/most other requests! We avoid this by making
a copy of the interface value (which is a lightweight pointer copy) and
using exclusively that within our wrapped handlers. This way, the
original stack frame is preserved in a "read-only" fashion. The comments
in the code describe this phenomenon.
This may very well be a breaking change for some configurations, however
I do not expect it to impact many people. I will make it clear in the
release notes that this change has occurred.
2020-01-09 12:00:13 -05:00
if dialInfo , ok := GetDialInfo ( ctx ) ; ok {
2019-09-05 14:14:39 -05:00
network = dialInfo . Network
address = dialInfo . Address
}
2019-10-05 17:22:05 -05:00
conn , err := dialer . DialContext ( ctx , network , address )
if err != nil {
// identify this error as one that occurred during
// dialing, which can be important when trying to
// decide whether to retry a request
return nil , DialError { err }
}
return conn , nil
2019-09-05 14:14:39 -05:00
} ,
2019-09-02 23:01:02 -05:00
MaxConnsPerHost : h . MaxConnsPerHost ,
ResponseHeaderTimeout : time . Duration ( h . ResponseHeaderTimeout ) ,
ExpectContinueTimeout : time . Duration ( h . ExpectContinueTimeout ) ,
MaxResponseHeaderBytes : h . MaxResponseHeaderSize ,
WriteBufferSize : h . WriteBufferSize ,
ReadBufferSize : h . ReadBufferSize ,
}
if h . TLS != nil {
rt . TLSHandshakeTimeout = time . Duration ( h . TLS . HandshakeTimeout )
2019-09-03 16:26:09 -05:00
var err error
2020-05-05 13:35:32 -05:00
rt . TLSClientConfig , err = h . TLS . MakeTLSClientConfig ( ctx )
2019-09-03 16:26:09 -05:00
if err != nil {
2019-11-05 18:29:10 -05:00
return nil , fmt . Errorf ( "making TLS client config: %v" , err )
2019-09-03 16:26:09 -05:00
}
2019-09-02 23:01:02 -05:00
}
if h . KeepAlive != nil {
dialer . KeepAlive = time . Duration ( h . KeepAlive . ProbeInterval )
2019-11-05 18:29:10 -05:00
if h . KeepAlive . Enabled != nil {
rt . DisableKeepAlives = ! * h . KeepAlive . Enabled
2019-09-02 23:01:02 -05:00
}
rt . MaxIdleConns = h . KeepAlive . MaxIdleConns
rt . MaxIdleConnsPerHost = h . KeepAlive . MaxIdleConnsPerHost
rt . IdleConnTimeout = time . Duration ( h . KeepAlive . IdleConnTimeout )
}
if h . Compression != nil {
rt . DisableCompression = ! * h . Compression
}
2019-11-05 18:27:51 -05:00
if sliceContains ( h . Versions , "2" ) {
if err := http2 . ConfigureTransport ( rt ) ; err != nil {
return nil , err
}
2019-10-29 01:07:45 -05:00
}
2019-11-05 18:29:10 -05:00
return rt , nil
}
2019-09-02 23:01:02 -05:00
2019-11-05 18:29:10 -05:00
// RoundTrip implements http.RoundTripper.
func ( h * HTTPTransport ) RoundTrip ( req * http . Request ) ( * http . Response , error ) {
2020-04-07 09:31:52 -05:00
h . SetScheme ( req )
2020-05-05 13:33:21 -05:00
// if H2C ("HTTP/2 over cleartext") is enabled and the upstream request is
// HTTP/2 without TLS, use the alternate H2C-capable transport instead
if req . ProtoMajor == 2 && req . URL . Scheme == "http" && h . h2cTransport != nil {
return h . h2cTransport . RoundTrip ( req )
}
2019-11-05 18:29:10 -05:00
return h . Transport . RoundTrip ( req )
2019-09-02 23:01:02 -05:00
}
2020-04-07 09:31:52 -05:00
// SetScheme ensures that the outbound request req
2019-11-05 18:29:10 -05:00
// has the scheme set in its URL; the underlying
// http.Transport requires a scheme to be set.
2020-04-07 09:31:52 -05:00
func ( h * HTTPTransport ) SetScheme ( req * http . Request ) {
2019-11-05 18:29:10 -05:00
if req . URL . Scheme == "" {
req . URL . Scheme = "http"
if h . TLS != nil {
req . URL . Scheme = "https"
}
}
2019-09-02 23:01:02 -05:00
}
2020-04-07 09:31:52 -05:00
// TLSEnabled returns true if TLS is enabled.
func ( h HTTPTransport ) TLSEnabled ( ) bool {
return h . TLS != nil
}
// EnableTLS enables TLS on the transport.
func ( h * HTTPTransport ) EnableTLS ( base * TLSConfig ) error {
h . TLS = base
return nil
}
2019-09-14 19:10:29 -05:00
// Cleanup implements caddy.CleanerUpper and closes any idle connections.
func ( h HTTPTransport ) Cleanup ( ) error {
2020-01-07 14:07:42 -05:00
if h . Transport == nil {
return nil
}
2019-11-05 18:29:10 -05:00
h . Transport . CloseIdleConnections ( )
2019-09-14 19:10:29 -05:00
return nil
}
2020-04-07 09:31:52 -05:00
// TLSConfig holds configuration related to the TLS configuration for the
// transport/client.
2019-09-02 23:01:02 -05:00
type TLSConfig struct {
2020-04-07 09:31:52 -05:00
// Optional list of base64-encoded DER-encoded CA certificates to trust.
2019-09-03 16:26:09 -05:00
RootCAPool [ ] string ` json:"root_ca_pool,omitempty" `
2020-04-07 09:31:52 -05:00
// List of PEM-encoded CA certificate files to add to the same trust
// store as RootCAPool (or root_ca_pool in the JSON).
2020-01-22 11:35:03 -05:00
RootCAPEMFiles [ ] string ` json:"root_ca_pem_files,omitempty" `
2020-04-07 09:31:52 -05:00
// PEM-encoded client certificate filename to present to servers.
ClientCertificateFile string ` json:"client_certificate_file,omitempty" `
// PEM-encoded key to use with the client certificate.
ClientCertificateKeyFile string ` json:"client_certificate_key_file,omitempty" `
2020-05-05 13:35:32 -05:00
// If specified, Caddy will use and automate a client certificate
// with this subject name.
ClientCertificateAutomate string ` json:"client_certificate_automate,omitempty" `
2020-04-07 09:31:52 -05:00
// If true, TLS verification of server certificates will be disabled.
// This is insecure and may be removed in the future. Do not use this
// option except in testing or local development environments.
InsecureSkipVerify bool ` json:"insecure_skip_verify,omitempty" `
// The duration to allow a TLS handshake to a server.
HandshakeTimeout caddy . Duration ` json:"handshake_timeout,omitempty" `
// The server name (SNI) to use in TLS handshakes.
ServerName string ` json:"server_name,omitempty" `
2019-09-03 16:26:09 -05:00
}
// MakeTLSClientConfig returns a tls.Config usable by a client to a backend.
// If there is no custom TLS configuration, a nil config may be returned.
2020-05-05 13:35:32 -05:00
func ( t TLSConfig ) MakeTLSClientConfig ( ctx caddy . Context ) ( * tls . Config , error ) {
2019-09-03 16:26:09 -05:00
cfg := new ( tls . Config )
// client auth
if t . ClientCertificateFile != "" && t . ClientCertificateKeyFile == "" {
return nil , fmt . Errorf ( "client_certificate_file specified without client_certificate_key_file" )
}
if t . ClientCertificateFile == "" && t . ClientCertificateKeyFile != "" {
return nil , fmt . Errorf ( "client_certificate_key_file specified without client_certificate_file" )
}
if t . ClientCertificateFile != "" && t . ClientCertificateKeyFile != "" {
cert , err := tls . LoadX509KeyPair ( t . ClientCertificateFile , t . ClientCertificateKeyFile )
if err != nil {
return nil , fmt . Errorf ( "loading client certificate key pair: %v" , err )
}
cfg . Certificates = [ ] tls . Certificate { cert }
}
2020-05-05 13:35:32 -05:00
if t . ClientCertificateAutomate != "" {
2021-02-09 16:15:04 -05:00
// TODO: use or enable ctx.IdentityCredentials() ...
2020-05-05 13:35:32 -05:00
tlsAppIface , err := ctx . App ( "tls" )
if err != nil {
return nil , fmt . Errorf ( "getting tls app: %v" , err )
}
tlsApp := tlsAppIface . ( * caddytls . TLS )
err = tlsApp . Manage ( [ ] string { t . ClientCertificateAutomate } )
if err != nil {
return nil , fmt . Errorf ( "managing client certificate: %v" , err )
}
cfg . GetClientCertificate = func ( cri * tls . CertificateRequestInfo ) ( * tls . Certificate , error ) {
certs := tlsApp . AllMatchingCertificates ( t . ClientCertificateAutomate )
var err error
for _ , cert := range certs {
err = cri . SupportsCertificate ( & cert . Certificate )
if err == nil {
return & cert . Certificate , nil
}
}
return nil , err
}
}
2019-09-03 16:26:09 -05:00
// trusted root CAs
2020-01-22 11:35:03 -05:00
if len ( t . RootCAPool ) > 0 || len ( t . RootCAPEMFiles ) > 0 {
2019-09-03 16:26:09 -05:00
rootPool := x509 . NewCertPool ( )
for _ , encodedCACert := range t . RootCAPool {
caCert , err := decodeBase64DERCert ( encodedCACert )
if err != nil {
return nil , fmt . Errorf ( "parsing CA certificate: %v" , err )
}
rootPool . AddCert ( caCert )
}
2020-01-22 11:35:03 -05:00
for _ , pemFile := range t . RootCAPEMFiles {
2020-01-07 14:07:42 -05:00
pemData , err := ioutil . ReadFile ( pemFile )
if err != nil {
return nil , fmt . Errorf ( "failed reading ca cert: %v" , err )
}
rootPool . AppendCertsFromPEM ( pemData )
}
2019-09-03 16:26:09 -05:00
cfg . RootCAs = rootPool
}
2019-10-10 18:17:06 -05:00
// custom SNI
cfg . ServerName = t . ServerName
2019-09-03 16:26:09 -05:00
// throw all security out the window
cfg . InsecureSkipVerify = t . InsecureSkipVerify
// only return a config if it's not empty
if reflect . DeepEqual ( cfg , new ( tls . Config ) ) {
return nil , nil
}
return cfg , nil
}
2020-07-18 16:00:00 -05:00
// UpstreamResolver holds the set of addresses of DNS resolvers of
// upstream addresses
type UpstreamResolver struct {
// The addresses of DNS resolvers to use when looking up the addresses of proxy upstreams.
// It accepts [network addresses](/docs/conventions#network-addresses)
// with port range of only 1. If the host is an IP address, it will be dialed directly to resolve the upstream server.
// If the host is not an IP address, the addresses are resolved using the [name resolution convention](https://golang.org/pkg/net/#hdr-Name_Resolution) of the Go standard library.
// If the array contains more than 1 resolver address, one is chosen at random.
Addresses [ ] string ` json:"addresses,omitempty" `
netAddrs [ ] caddy . NetworkAddress
}
2019-11-05 18:27:51 -05:00
// KeepAlive holds configuration pertaining to HTTP Keep-Alive.
type KeepAlive struct {
2020-04-07 09:31:52 -05:00
// Whether HTTP Keep-Alive is enabled. Default: true
Enabled * bool ` json:"enabled,omitempty" `
// How often to probe for liveness.
ProbeInterval caddy . Duration ` json:"probe_interval,omitempty" `
2021-06-15 15:54:48 -05:00
// Maximum number of idle connections. Default: 0, which means no limit.
2020-04-07 09:31:52 -05:00
MaxIdleConns int ` json:"max_idle_conns,omitempty" `
2021-06-16 15:29:42 -05:00
// Maximum number of idle connections per host. Default: 32.
2020-04-07 09:31:52 -05:00
MaxIdleConnsPerHost int ` json:"max_idle_conns_per_host,omitempty" `
2021-06-15 15:54:48 -05:00
// How long connections should be kept alive when idle. Default: 0, which means no timeout.
2020-04-07 09:31:52 -05:00
IdleConnTimeout caddy . Duration ` json:"idle_timeout,omitempty" `
2019-11-05 18:27:51 -05:00
}
2019-09-03 16:26:09 -05:00
// decodeBase64DERCert base64-decodes, then DER-decodes, certStr.
func decodeBase64DERCert ( certStr string ) ( * x509 . Certificate , error ) {
// decode base64
derBytes , err := base64 . StdEncoding . DecodeString ( certStr )
if err != nil {
return nil , err
}
// parse the DER-encoded certificate
return x509 . ParseCertificate ( derBytes )
2019-09-02 23:01:02 -05:00
}
2019-11-05 18:27:51 -05:00
// sliceContains returns true if needle is in haystack.
func sliceContains ( haystack [ ] string , needle string ) bool {
for _ , s := range haystack {
if s == needle {
return true
}
}
return false
2019-09-02 23:01:02 -05:00
}
2019-09-05 14:42:20 -05:00
// Interface guards
var (
2019-09-14 19:10:29 -05:00
_ caddy . Provisioner = ( * HTTPTransport ) ( nil )
_ http . RoundTripper = ( * HTTPTransport ) ( nil )
_ caddy . CleanerUpper = ( * HTTPTransport ) ( nil )
2020-04-07 09:31:52 -05:00
_ TLSTransport = ( * HTTPTransport ) ( nil )
2019-09-05 14:42:20 -05:00
)