mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-01-01 18:01:28 -06:00
07a718dc8e
With Go 1.20 the "Rewrite" hook for ReverseProxy was introduced to
supersede of the "Director" hook (see:
a55793835f)
The Rewrite hooks allows for better separation between the incoming and
outgoing request. In particular it makes it pretty easy to set the
correct X-Forwarded-* Headers on the outgoing request.
The need for using "Rewrite" came up when trying to embed
authelia. It uses the X-Forwarded-Host and X-Forwared-Proto headers to
e.g. compute the correct return values for the various endpoints in
.well-known/openid-configuration.
80 lines
2.3 KiB
Go
80 lines
2.3 KiB
Go
package proxy
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"errors"
|
|
"net"
|
|
"net/http"
|
|
"net/http/httputil"
|
|
"os"
|
|
"time"
|
|
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/log"
|
|
"github.com/owncloud/ocis/v2/services/proxy/pkg/config"
|
|
"github.com/owncloud/ocis/v2/services/proxy/pkg/proxy/policy"
|
|
"github.com/owncloud/ocis/v2/services/proxy/pkg/router"
|
|
)
|
|
|
|
// MultiHostReverseProxy extends "httputil" to support multiple hosts with different policies
|
|
type MultiHostReverseProxy struct {
|
|
httputil.ReverseProxy
|
|
// Directors holds policy route type method endpoint Director
|
|
Directors map[string]map[config.RouteType]map[string]map[string]func(req *http.Request)
|
|
PolicySelector policy.Selector
|
|
logger log.Logger
|
|
config *config.Config
|
|
}
|
|
|
|
// NewMultiHostReverseProxy creates a new MultiHostReverseProxy
|
|
func NewMultiHostReverseProxy(opts ...Option) (*MultiHostReverseProxy, error) {
|
|
options := newOptions(opts...)
|
|
|
|
rp := &MultiHostReverseProxy{
|
|
Directors: make(map[string]map[config.RouteType]map[string]map[string]func(req *http.Request)),
|
|
logger: options.Logger,
|
|
config: options.Config,
|
|
}
|
|
|
|
rp.Rewrite = func(r *httputil.ProxyRequest) {
|
|
ri := router.ContextRoutingInfo(r.In.Context())
|
|
ri.Rewrite()(r)
|
|
}
|
|
|
|
tlsConf := &tls.Config{
|
|
MinVersion: tls.VersionTLS12,
|
|
InsecureSkipVerify: options.Config.InsecureBackends, //nolint:gosec
|
|
}
|
|
if options.Config.BackendHTTPSCACert != "" {
|
|
certs := x509.NewCertPool()
|
|
pemData, err := os.ReadFile(options.Config.BackendHTTPSCACert)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if !certs.AppendCertsFromPEM(pemData) {
|
|
return nil, errors.New("Error initializing LDAP Backend. Adding CA cert failed")
|
|
}
|
|
tlsConf.RootCAs = certs
|
|
}
|
|
// equals http.DefaultTransport except TLSClientConfig
|
|
rp.Transport = &http.Transport{
|
|
Proxy: http.ProxyFromEnvironment,
|
|
DialContext: (&net.Dialer{
|
|
Timeout: 30 * time.Second,
|
|
KeepAlive: 30 * time.Second,
|
|
DualStack: true,
|
|
}).DialContext,
|
|
ForceAttemptHTTP2: true,
|
|
MaxIdleConns: 100,
|
|
IdleConnTimeout: 90 * time.Second,
|
|
TLSHandshakeTimeout: 10 * time.Second,
|
|
ExpectContinueTimeout: 1 * time.Second,
|
|
TLSClientConfig: tlsConf,
|
|
}
|
|
return rp, nil
|
|
}
|
|
|
|
func (p *MultiHostReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
|
p.ReverseProxy.ServeHTTP(w, r)
|
|
}
|