tricot/src/https.rs

use std::convert::Infallible;
use std::net::SocketAddr;
use std::sync::{atomic::Ordering, Arc};
use std::time::Duration;

use anyhow::Result;
use log::*;

use accept_encoding_fork::Encoding;
use async_compression::tokio::bufread::*;
use futures::stream::FuturesUnordered;
use futures::{StreamExt, TryStreamExt};
use http::header::{HeaderName, HeaderValue};
use http::method::Method;
use hyper::server::conn::Http;
use hyper::service::service_fn;
use hyper::{header, Body, Request, Response, StatusCode};
use tokio::net::TcpListener;
use tokio::select;
use tokio::sync::watch;
use tokio_rustls::TlsAcceptor;
use tokio_util::io::{ReaderStream, StreamReader};

use crate::cert_store::{CertStore, StoreResolver};
use crate::proxy_config::ProxyConfig;
use crate::reverse_proxy;

const MAX_CONNECTION_LIFETIME: Duration = Duration::from_secs(24 * 3600);

pub struct HttpsConfig {
	pub bind_addr: SocketAddr,
	pub enable_compression: bool,
	pub compress_mime_types: Vec<String>,
}

pub async fn serve_https(
	config: HttpsConfig,
	cert_store: Arc<CertStore>,
	rx_proxy_config: watch::Receiver<Arc<ProxyConfig>>,
	mut must_exit: watch::Receiver<bool>,
) -> Result<()> {
	let config = Arc::new(config);

	let mut tls_cfg = rustls::ServerConfig::builder()
		.with_safe_defaults()
		.with_no_client_auth()
		.with_cert_resolver(Arc::new(StoreResolver(cert_store)));

	tls_cfg.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
	let tls_acceptor = Arc::new(TlsAcceptor::from(Arc::new(tls_cfg)));

	info!("Starting to serve on https://{}.", config.bind_addr);

	let tcp = TcpListener::bind(config.bind_addr).await?;
	let mut connections = FuturesUnordered::new();

	while !*must_exit.borrow() {
		let wait_conn_finished = async {
			if connections.is_empty() {
				futures::future::pending().await
			} else {
				connections.next().await
			}
		};
		let (socket, remote_addr) = select! {
			a = tcp.accept() => a?,
			_ = wait_conn_finished => continue,
			_ = must_exit.changed() => continue,
		};

		let rx_proxy_config = rx_proxy_config.clone();
		let tls_acceptor = tls_acceptor.clone();
		let config = config.clone();

		let mut must_exit_2 = must_exit.clone();
		let conn = tokio::spawn(async move {
			match tls_acceptor.accept(socket).await {
				Ok(stream) => {
					debug!("TLS handshake was successfull");
					let http_conn = Http::new().serve_connection(
						stream,
						service_fn(move |req: Request<Body>| {
							let https_config = config.clone();
							let proxy_config: Arc<ProxyConfig> = rx_proxy_config.borrow().clone();
							handle_outer(remote_addr, req, https_config, proxy_config)
						}),
					);
					let timeout = tokio::time::sleep(MAX_CONNECTION_LIFETIME);
					tokio::pin!(http_conn, timeout);
					let http_result = loop {
						select! (
							r = &mut http_conn => break r.map_err(Into::into),
							_ = &mut timeout => break Err(anyhow!("Connection lived more than 24h, killing it.")),
							_ = must_exit_2.changed() => {
								if *must_exit_2.borrow() {
									http_conn.as_mut().graceful_shutdown();
								}
							}
						)
					};
					if let Err(http_err) = http_result {
						warn!("HTTP error: {}", http_err);
					}
				}
				Err(e) => warn!("Error in TLS connection: {}", e),
			}
		});
		connections.push(conn);
	}

	drop(tcp);

	info!("HTTPS server shutting down, draining remaining connections...");
	while connections.next().await.is_some() {}

	Ok(())
}

async fn handle_outer(
	remote_addr: SocketAddr,
	req: Request<Body>,
	https_config: Arc<HttpsConfig>,
	proxy_config: Arc<ProxyConfig>,
) -> Result<Response<Body>, Infallible> {
	match handle(remote_addr, req, https_config, proxy_config).await {
		Err(e) => {
			warn!("Handler error: {}", e);
			Ok(Response::builder()
				.status(StatusCode::INTERNAL_SERVER_ERROR)
				.body(Body::from(format!("{}", e)))
				.unwrap())
		}
		Ok(r) => Ok(r),
	}
}

// Custom echo service, handling two different routes and a
// catch-all 404 responder.
async fn handle(
	remote_addr: SocketAddr,
	req: Request<Body>,
	https_config: Arc<HttpsConfig>,
	proxy_config: Arc<ProxyConfig>,
) -> Result<Response<Body>, anyhow::Error> {
	let method = req.method().clone();
	let uri = req.uri().to_string();

	let host = if let Some(auth) = req.uri().authority() {
		auth.as_str()
	} else {
		req.headers()
			.get("host")
			.ok_or_else(|| anyhow!("Missing host header"))?
			.to_str()?
	};
	let path = req.uri().path();
	let accept_encoding = accept_encoding_fork::encodings(req.headers()).unwrap_or_else(|_| vec![]);

	let best_match = proxy_config
		.entries
		.iter()
		.filter(|ent| {
			ent.host.matches(host)
				&& ent
					.path_prefix
					.as_ref()
					.map(|prefix| path.starts_with(prefix))
					.unwrap_or(true)
		})
		.max_by_key(|ent| {
			(
				ent.priority,
				ent.path_prefix
					.as_ref()
					.map(|x| x.len() as i32)
					.unwrap_or(0),
				ent.same_node,
				ent.same_site,
				-ent.calls.load(Ordering::SeqCst),
			)
		});

	if let Some(proxy_to) = best_match {
		proxy_to.calls.fetch_add(1, Ordering::SeqCst);

		debug!("{}{} -> {}", host, path, proxy_to);
		trace!("Request: {:?}", req);

		let mut response = if proxy_to.https_target {
			let to_addr = format!("https://{}", proxy_to.target_addr);
			handle_error(reverse_proxy::call_https(remote_addr.ip(), &to_addr, req).await)
		} else {
			let to_addr = format!("http://{}", proxy_to.target_addr);
			handle_error(reverse_proxy::call(remote_addr.ip(), &to_addr, req).await)
		};

		if response.status().is_success() {
			// (TODO: maybe we want to add these headers even if it's not a success?)
			for (header, value) in proxy_to.add_headers.iter() {
				response.headers_mut().insert(
					HeaderName::from_bytes(header.as_bytes())?,
					HeaderValue::from_str(value)?,
				);
			}
		}

		if https_config.enable_compression {
			response =
				try_compress(response, method.clone(), accept_encoding, &https_config).await?
		};

		trace!("Final response: {:?}", response);
		info!("{} {} {}", method, response.status().as_u16(), uri);
		Ok(response)
	} else {
		debug!("{}{} -> NOT FOUND", host, path);
		info!("{} 404 {}", method, uri);

		Ok(Response::builder()
			.status(StatusCode::NOT_FOUND)
			.body(Body::from("No matching proxy entry"))?)
	}
}

fn handle_error(resp: Result<Response<Body>>) -> Response<Body> {
	match resp {
		Ok(resp) => resp,
		Err(e) => Response::builder()
			.status(StatusCode::BAD_GATEWAY)
			.body(Body::from(format!("Proxy error: {}", e)))
			.unwrap(),
	}
}

async fn try_compress(
	response: Response<Body>,
	method: Method,
	accept_encoding: Vec<(Option<Encoding>, f32)>,
	https_config: &HttpsConfig,
) -> Result<Response<Body>> {
	// Don't bother compressing successfull responses for HEAD and PUT (they should have an empty body)
	// Don't compress partial content as it causes issues
	// Don't bother compressing non-2xx results
	// Don't compress Upgrade responses (e.g. websockets)
	// Don't compress responses that are already compressed
	if (response.status().is_success() && (method == Method::HEAD || method == Method::PUT))
		|| response.status() == StatusCode::PARTIAL_CONTENT
		|| !response.status().is_success()
		|| response.headers().get(header::CONNECTION) == Some(&HeaderValue::from_static("Upgrade"))
		|| response.headers().get(header::CONTENT_ENCODING).is_some()
	{
		return Ok(response);
	}

	// Select preferred encoding among those proposed in accept_encoding
	let max_q: f32 = accept_encoding
		.iter()
		.max_by_key(|(_, q)| (q * 10000f32) as i64)
		.unwrap_or(&(None, 1.))
		.1;
	let preference = [
		Encoding::Zstd,
		//Encoding::Brotli,
		Encoding::Deflate,
		Encoding::Gzip,
	];
	#[allow(clippy::float_cmp)]
	let encoding_opt = accept_encoding
		.iter()
		.filter(|(_, q)| *q == max_q)
		.filter_map(|(enc, _)| *enc)
		.filter(|enc| preference.contains(enc))
		.min_by_key(|enc| preference.iter().position(|x| x == enc).unwrap());

	// If preferred encoding is none, return as is
	let encoding = match encoding_opt {
		None | Some(Encoding::Identity) => return Ok(response),
		Some(enc) => enc,
	};

	// If content type not in mime types for which to compress, return as is
	match response.headers().get(header::CONTENT_TYPE) {
		Some(ct) => {
			let ct_str = ct.to_str()?;
			let mime_type = match ct_str.split_once(';') {
				Some((mime_type, _params)) => mime_type,
				None => ct_str,
			};
			if !https_config
				.compress_mime_types
				.iter()
				.any(|x| x == mime_type)
			{
				return Ok(response);
			}
		}
		None => return Ok(response), // don't compress if unknown mime type
	};

	let (mut head, mut body) = response.into_parts();

	// ---- If body is smaller than 1400 bytes, don't compress ----
	let mut chunks = vec![];
	let mut sum_lengths = 0;
	while sum_lengths < 1400 {
		match body.next().await {
			Some(chunk) => {
				let chunk = chunk?;
				sum_lengths += chunk.len();
				chunks.push(chunk);
			}
			None => {
				return Ok(Response::from_parts(head, Body::from(chunks.concat())));
			}
		}
	}

	// put beginning chunks back into body
	let body = futures::stream::iter(chunks.into_iter().map(Ok)).chain(body);

	// make an async reader from that for compressor
	let body_rd =
		StreamReader::new(body.map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e)));

	trace!(
		"Compressing response body as {:?} (at least {} bytes)",
		encoding,
		sum_lengths
	);

	// we don't know the compressed content-length so remove that header
	head.headers.remove(header::CONTENT_LENGTH);

	let (encoding, compressed_body) = match encoding {
		Encoding::Gzip => (
			"gzip",
			Body::wrap_stream(ReaderStream::new(GzipEncoder::new(body_rd))),
		),
		// Encoding::Brotli => {
		// 	head.headers.insert(header::CONTENT_ENCODING, "br".parse()?);
		// 	Body::wrap_stream(ReaderStream::new(BrotliEncoder::new(body_rd)))
		// }
		Encoding::Deflate => (
			"deflate",
			Body::wrap_stream(ReaderStream::new(DeflateEncoder::new(body_rd))),
		),
		Encoding::Zstd => (
			"zstd",
			Body::wrap_stream(ReaderStream::new(ZstdEncoder::new(body_rd))),
		),
		_ => unreachable!(),
	};
	head.headers
		.insert(header::CONTENT_ENCODING, encoding.parse()?);

	Ok(Response::from_parts(head, compressed_body))
}
Compression 2021-12-09 14:43:19 +00:00			`use std::convert::Infallible;`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`use std::net::SocketAddr;`
Round robin backends 2021-12-07 15:37:22 +00:00			`use std::sync::{atomic::Ordering, Arc};`
Handle proxy timeouts 2022-01-24 18:38:13 +00:00			`use std::time::Duration;`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
			`use anyhow::Result;`
			`use log::*;`

Compression 2021-12-09 14:43:19 +00:00			`use accept_encoding_fork::Encoding;`
			`use async_compression::tokio::bufread::*;`
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`use futures::stream::FuturesUnordered;`
Actually that was quite a stupid way of handling timeouts 2022-01-24 19:55:26 +00:00			`use futures::{StreamExt, TryStreamExt};`
Better handle get_cert for https request (faster path, hostname verification) 2021-12-07 17:50:58 +00:00			`use http::header::{HeaderName, HeaderValue};`
Exclude partial content from compression 2021-12-10 15:40:05 +00:00			`use http::method::Method;`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`use hyper::server::conn::Http;`
			`use hyper::service::service_fn;`
Compression 2021-12-09 14:43:19 +00:00			`use hyper::{header, Body, Request, Response, StatusCode};`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`use tokio::net::TcpListener;`
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`use tokio::select;`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`use tokio::sync::watch;`
			`use tokio_rustls::TlsAcceptor;`
Compression 2021-12-09 14:43:19 +00:00			`use tokio_util::io::{ReaderStream, StreamReader};`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
			`use crate::cert_store::{CertStore, StoreResolver};`
			`use crate::proxy_config::ProxyConfig;`
			`use crate::reverse_proxy;`

Kill connections lasting more than 24h 2022-01-24 18:49:14 +00:00			`const MAX_CONNECTION_LIFETIME: Duration = Duration::from_secs(24 * 3600);`

Compression 2021-12-09 14:43:19 +00:00			`pub struct HttpsConfig {`
			`pub bind_addr: SocketAddr,`
			`pub enable_compression: bool,`
			`pub compress_mime_types: Vec<String>,`
			`}`

Got a reverse proxy 2021-12-07 14:20:45 +00:00			`pub async fn serve_https(`
Compression 2021-12-09 14:43:19 +00:00			`config: HttpsConfig,`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`cert_store: Arc<CertStore>,`
Compression 2021-12-09 14:43:19 +00:00			`rx_proxy_config: watch::Receiver<Arc<ProxyConfig>>,`
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`mut must_exit: watch::Receiver<bool>,`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`) -> Result<()> {`
Compression 2021-12-09 14:43:19 +00:00			`let config = Arc::new(config);`

			`let mut tls_cfg = rustls::ServerConfig::builder()`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`.with_safe_defaults()`
			`.with_no_client_auth()`
			`.with_cert_resolver(Arc::new(StoreResolver(cert_store)));`

Compression 2021-12-09 14:43:19 +00:00			`tls_cfg.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];`
			`let tls_acceptor = Arc::new(TlsAcceptor::from(Arc::new(tls_cfg)));`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
Compression 2021-12-09 14:43:19 +00:00			`info!("Starting to serve on https://{}.", config.bind_addr);`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
Compression 2021-12-09 14:43:19 +00:00			`let tcp = TcpListener::bind(config.bind_addr).await?;`
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`let mut connections = FuturesUnordered::new();`

			`while !*must_exit.borrow() {`
Fix busy loop 2022-01-24 19:06:31 +00:00			`let wait_conn_finished = async {`
			`if connections.is_empty() {`
			`futures::future::pending().await`
			`} else {`
			`connections.next().await`
			`}`
			`};`
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`let (socket, remote_addr) = select! {`
			`a = tcp.accept() => a?,`
Fix busy loop 2022-01-24 19:06:31 +00:00			`_ = wait_conn_finished => continue,`
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`_ = must_exit.changed() => continue,`
			`};`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
Compression 2021-12-09 14:43:19 +00:00			`let rx_proxy_config = rx_proxy_config.clone();`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`let tls_acceptor = tls_acceptor.clone();`
Compression 2021-12-09 14:43:19 +00:00			`let config = config.clone();`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`let mut must_exit_2 = must_exit.clone();`
			`let conn = tokio::spawn(async move {`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`match tls_acceptor.accept(socket).await {`
			`Ok(stream) => {`
			`debug!("TLS handshake was successfull");`
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`let http_conn = Http::new().serve_connection(`
			`stream,`
			`service_fn(move \|req: Request<Body>\| {`
			`let https_config = config.clone();`
			`let proxy_config: Arc<ProxyConfig> = rx_proxy_config.borrow().clone();`
			`handle_outer(remote_addr, req, https_config, proxy_config)`
			`}),`
			`);`
Kill connections lasting more than 24h 2022-01-24 18:49:14 +00:00			`let timeout = tokio::time::sleep(MAX_CONNECTION_LIFETIME);`
			`tokio::pin!(http_conn, timeout);`
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`let http_result = loop {`
			`select! (`
Kill connections lasting more than 24h 2022-01-24 18:49:14 +00:00			`r = &mut http_conn => break r.map_err(Into::into),`
			`_ = &mut timeout => break Err(anyhow!("Connection lived more than 24h, killing it.")),`
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`_ = must_exit_2.changed() => {`
			`if *must_exit_2.borrow() {`
			`http_conn.as_mut().graceful_shutdown();`
			`}`
			`}`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`)`
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`};`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`if let Err(http_err) = http_result {`
Logging output improvements 2021-12-08 10:24:25 +00:00			`warn!("HTTP error: {}", http_err);`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`}`
			`}`
Logging output improvements 2021-12-08 10:24:25 +00:00			`Err(e) => warn!("Error in TLS connection: {}", e),`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`}`
			`});`
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`connections.push(conn);`
			`}`

Kill connections lasting more than 24h 2022-01-24 18:49:14 +00:00			`drop(tcp);`

Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00			`info!("HTTPS server shutting down, draining remaining connections...");`
Fix busy loop 2022-01-24 19:06:31 +00:00			`while connections.next().await.is_some() {}`
Add graceful shutdown and memory tracing 2022-01-24 18:28:18 +00:00
			`Ok(())`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`}`

Compression 2021-12-09 14:43:19 +00:00			`async fn handle_outer(`
			`remote_addr: SocketAddr,`
			`req: Request<Body>,`
			`https_config: Arc<HttpsConfig>,`
			`proxy_config: Arc<ProxyConfig>,`
			`) -> Result<Response<Body>, Infallible> {`
			`match handle(remote_addr, req, https_config, proxy_config).await {`
			`Err(e) => {`
			`warn!("Handler error: {}", e);`
			`Ok(Response::builder()`
			`.status(StatusCode::INTERNAL_SERVER_ERROR)`
			`.body(Body::from(format!("{}", e)))`
			`.unwrap())`
			`}`
			`Ok(r) => Ok(r),`
			`}`
			`}`

Got a reverse proxy 2021-12-07 14:20:45 +00:00			`// Custom echo service, handling two different routes and a`
			`// catch-all 404 responder.`
			`async fn handle(`
			`remote_addr: SocketAddr,`
			`req: Request<Body>,`
Compression 2021-12-09 14:43:19 +00:00			`https_config: Arc<HttpsConfig>,`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`proxy_config: Arc<ProxyConfig>,`
			`) -> Result<Response<Body>, anyhow::Error> {`
Handle HTTPS targets 2021-12-08 21:58:19 +00:00			`let method = req.method().clone();`
			`let uri = req.uri().to_string();`

Got a reverse proxy 2021-12-07 14:20:45 +00:00			`let host = if let Some(auth) = req.uri().authority() {`
			`auth.as_str()`
			`} else {`
			`req.headers()`
			`.get("host")`
			`.ok_or_else(\|\| anyhow!("Missing host header"))?`
			`.to_str()?`
			`};`
			`let path = req.uri().path();`
cargo clippy 2021-12-09 22:38:56 +00:00			`let accept_encoding = accept_encoding_fork::encodings(req.headers()).unwrap_or_else(\|_\| vec![]);`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
Handle HTTPS targets 2021-12-08 21:58:19 +00:00			`let best_match = proxy_config`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`.entries`
			`.iter()`
			`.filter(\|ent\| {`
Implement glob pattern hostnames no wildcard certificates: one certificate per matching hostname that actually recieves requests 2021-12-08 10:11:22 +00:00			`ent.host.matches(host)`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`&& ent`
			`.path_prefix`
			`.as_ref()`
			`.map(\|prefix\| path.starts_with(prefix))`
			`.unwrap_or(true)`
			`})`
Inverse how priorities work 2021-12-08 21:29:08 +00:00			`.max_by_key(\|ent\| {`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`(`
			`ent.priority,`
Inverse how priorities work 2021-12-08 21:29:08 +00:00			`ent.path_prefix`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`.as_ref()`
			`.map(\|x\| x.len() as i32)`
Inverse how priorities work 2021-12-08 21:29:08 +00:00			`.unwrap_or(0),`
Make nodes aware of where they are and use that to priorize backends 2022-01-13 10:31:08 +00:00			`ent.same_node,`
			`ent.same_site,`
Inverse how priorities work 2021-12-08 21:29:08 +00:00			`-ent.calls.load(Ordering::SeqCst),`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`)`
			`});`

Handle HTTPS targets 2021-12-08 21:58:19 +00:00			`if let Some(proxy_to) = best_match {`
			`proxy_to.calls.fetch_add(1, Ordering::SeqCst);`
Different logging 2021-12-08 21:24:58 +00:00
			`debug!("{}{} -> {}", host, path, proxy_to);`
Try to fix things 2021-12-08 12:28:07 +00:00			`trace!("Request: {:?}", req);`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
Handle HTTPS targets 2021-12-08 21:58:19 +00:00			`let mut response = if proxy_to.https_target {`
			`let to_addr = format!("https://{}", proxy_to.target_addr);`
Actually that was quite a stupid way of handling timeouts 2022-01-24 19:55:26 +00:00			`handle_error(reverse_proxy::call_https(remote_addr.ip(), &to_addr, req).await)`
Handle HTTPS targets 2021-12-08 21:58:19 +00:00			`} else {`
			`let to_addr = format!("http://{}", proxy_to.target_addr);`
Actually that was quite a stupid way of handling timeouts 2022-01-24 19:55:26 +00:00			`handle_error(reverse_proxy::call(remote_addr.ip(), &to_addr, req).await)`
Handle HTTPS targets 2021-12-08 21:58:19 +00:00			`};`
Add support for custom headers 2021-12-07 17:19:51 +00:00
Try to clean up code and to fix WebSocket problems 2022-05-06 10:21:15 +00:00			`if response.status().is_success() {`
			`// (TODO: maybe we want to add these headers even if it's not a success?)`
			`for (header, value) in proxy_to.add_headers.iter() {`
			`response.headers_mut().insert(`
			`HeaderName::from_bytes(header.as_bytes())?,`
			`HeaderValue::from_str(value)?,`
			`);`
			`}`
Handle proxy timeouts 2022-01-24 18:38:13 +00:00			`}`

Compression 2021-12-09 14:43:19 +00:00			`if https_config.enable_compression {`
Try to clean up code and to fix WebSocket problems 2022-05-06 10:21:15 +00:00			`response =`
			`try_compress(response, method.clone(), accept_encoding, &https_config).await?`
			`};`

			`trace!("Final response: {:?}", response);`
			`info!("{} {} {}", method, response.status().as_u16(), uri);`
			`Ok(response)`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`} else {`
Handle HTTPS targets 2021-12-08 21:58:19 +00:00			`debug!("{}{} -> NOT FOUND", host, path);`
			`info!("{} 404 {}", method, uri);`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
			`Ok(Response::builder()`
			`.status(StatusCode::NOT_FOUND)`
			`.body(Body::from("No matching proxy entry"))?)`
			`}`
			`}`
Compression 2021-12-09 14:43:19 +00:00
Actually that was quite a stupid way of handling timeouts 2022-01-24 19:55:26 +00:00			`fn handle_error(resp: Result<Response<Body>>) -> Response<Body> {`
			`match resp {`
			`Ok(resp) => resp,`
			`Err(e) => Response::builder()`
			`.status(StatusCode::BAD_GATEWAY)`
			`.body(Body::from(format!("Proxy error: {}", e)))`
			`.unwrap(),`
			`}`
Handle proxy timeouts 2022-01-24 18:38:13 +00:00			`}`

Remove content-length when compressed; don't compress small response 2021-12-09 18:00:50 +00:00			`async fn try_compress(`
Compression 2021-12-09 14:43:19 +00:00			`response: Response<Body>,`
Exclude partial content from compression 2021-12-10 15:40:05 +00:00			`method: Method,`
Better compression choices 2021-12-09 15:03:19 +00:00			`accept_encoding: Vec<(Option<Encoding>, f32)>,`
Compression 2021-12-09 14:43:19 +00:00			`https_config: &HttpsConfig,`
			`) -> Result<Response<Body>> {`
Exclude partial content from compression 2021-12-10 15:40:05 +00:00			`// Don't bother compressing successfull responses for HEAD and PUT (they should have an empty body)`
Try to clean up code and to fix WebSocket problems 2022-05-06 10:21:15 +00:00			`// Don't compress partial content as it causes issues`
			`// Don't bother compressing non-2xx results`
			`// Don't compress Upgrade responses (e.g. websockets)`
			`// Don't compress responses that are already compressed`
Exclude partial content from compression 2021-12-10 15:40:05 +00:00			`if (response.status().is_success() && (method == Method::HEAD \|\| method == Method::PUT))`
			`\|\| response.status() == StatusCode::PARTIAL_CONTENT`
Try to clean up code and to fix WebSocket problems 2022-05-06 10:21:15 +00:00			`\|\| !response.status().is_success()`
			`\|\| response.headers().get(header::CONNECTION) == Some(&HeaderValue::from_static("Upgrade"))`
Exclude partial content from compression 2021-12-10 15:40:05 +00:00			`\|\| response.headers().get(header::CONTENT_ENCODING).is_some()`
			`{`
			`return Ok(response);`
			`}`

			`// Select preferred encoding among those proposed in accept_encoding`
Better compression choices 2021-12-09 15:03:19 +00:00			`let max_q: f32 = accept_encoding`
			`.iter()`
			`.max_by_key(\|(_, q)\| (q * 10000f32) as i64)`
			`.unwrap_or(&(None, 1.))`
			`.1;`
			`let preference = [`
			`Encoding::Zstd,`
Brotli seems to cause issues, disable it 2021-12-09 23:03:34 +00:00			`//Encoding::Brotli,`
Better compression choices 2021-12-09 15:03:19 +00:00			`Encoding::Deflate,`
			`Encoding::Gzip,`
			`];`
cargo clippy 2021-12-09 22:38:56 +00:00			`#[allow(clippy::float_cmp)]`
Better compression choices 2021-12-09 15:03:19 +00:00			`let encoding_opt = accept_encoding`
			`.iter()`
			`.filter(\|(_, q)\| *q == max_q)`
			`.filter_map(\|(enc, _)\| *enc)`
			`.filter(\|enc\| preference.contains(enc))`
			`.min_by_key(\|enc\| preference.iter().position(\|x\| x == enc).unwrap());`

			`// If preferred encoding is none, return as is`
			`let encoding = match encoding_opt {`
Compression 2021-12-09 14:43:19 +00:00			`None \| Some(Encoding::Identity) => return Ok(response),`
			`Some(enc) => enc,`
			`};`

			`// If content type not in mime types for which to compress, return as is`
			`match response.headers().get(header::CONTENT_TYPE) {`
			`Some(ct) => {`
			`let ct_str = ct.to_str()?;`
Better compression choices 2021-12-09 15:03:19 +00:00			`let mime_type = match ct_str.split_once(';') {`
			`Some((mime_type, _params)) => mime_type,`
			`None => ct_str,`
			`};`
cargo fmt 2021-12-09 15:19:41 +00:00			`if !https_config`
			`.compress_mime_types`
			`.iter()`
			`.any(\|x\| x == mime_type)`
			`{`
Compression 2021-12-09 14:43:19 +00:00			`return Ok(response);`
			`}`
			`}`
Exclude partial content from compression 2021-12-10 15:40:05 +00:00			`None => return Ok(response), // don't compress if unknown mime type`
Compression 2021-12-09 14:43:19 +00:00			`};`

Remove content-length when compressed; don't compress small response 2021-12-09 18:00:50 +00:00			`let (mut head, mut body) = response.into_parts();`
Compression 2021-12-09 14:43:19 +00:00
Remove content-length when compressed; don't compress small response 2021-12-09 18:00:50 +00:00			`// ---- If body is smaller than 1400 bytes, don't compress ----`
			`let mut chunks = vec![];`
			`let mut sum_lengths = 0;`
			`while sum_lengths < 1400 {`
			`match body.next().await {`
			`Some(chunk) => {`
			`let chunk = chunk?;`
			`sum_lengths += chunk.len();`
			`chunks.push(chunk);`
			`}`
			`None => {`
			`return Ok(Response::from_parts(head, Body::from(chunks.concat())));`
			`}`
			`}`
			`}`

			`// put beginning chunks back into body`
cargo clippy 2021-12-09 22:38:56 +00:00			`let body = futures::stream::iter(chunks.into_iter().map(Ok)).chain(body);`
Remove content-length when compressed; don't compress small response 2021-12-09 18:00:50 +00:00
			`// make an async reader from that for compressor`
Compression 2021-12-09 14:43:19 +00:00			`let body_rd =`
			`StreamReader::new(body.map_err(\|e\| std::io::Error::new(std::io::ErrorKind::Other, e)));`
Remove content-length when compressed; don't compress small response 2021-12-09 18:00:50 +00:00
Exclude partial content from compression 2021-12-10 15:40:05 +00:00			`trace!(`
cargo clippy 2021-12-09 22:38:56 +00:00			`"Compressing response body as {:?} (at least {} bytes)",`
Exclude partial content from compression 2021-12-10 15:40:05 +00:00			`encoding,`
			`sum_lengths`
cargo clippy 2021-12-09 22:38:56 +00:00			`);`
Exclude partial content from compression 2021-12-10 15:40:05 +00:00
			`// we don't know the compressed content-length so remove that header`
Remove content-length when compressed; don't compress small response 2021-12-09 18:00:50 +00:00			`head.headers.remove(header::CONTENT_LENGTH);`

Exclude partial content from compression 2021-12-10 15:40:05 +00:00			`let (encoding, compressed_body) = match encoding {`
			`Encoding::Gzip => (`
			`"gzip",`
			`Body::wrap_stream(ReaderStream::new(GzipEncoder::new(body_rd))),`
			`),`
Brotli seems to cause issues, disable it 2021-12-09 23:03:34 +00:00			`// Encoding::Brotli => {`
			`// head.headers.insert(header::CONTENT_ENCODING, "br".parse()?);`
			`// Body::wrap_stream(ReaderStream::new(BrotliEncoder::new(body_rd)))`
			`// }`
Exclude partial content from compression 2021-12-10 15:40:05 +00:00			`Encoding::Deflate => (`
			`"deflate",`
			`Body::wrap_stream(ReaderStream::new(DeflateEncoder::new(body_rd))),`
			`),`
			`Encoding::Zstd => (`
			`"zstd",`
			`Body::wrap_stream(ReaderStream::new(ZstdEncoder::new(body_rd))),`
			`),`
Compression 2021-12-09 14:43:19 +00:00			`_ => unreachable!(),`
			`};`
Exclude partial content from compression 2021-12-10 15:40:05 +00:00			`head.headers`
			`.insert(header::CONTENT_ENCODING, encoding.parse()?);`
Compression 2021-12-09 14:43:19 +00:00
			`Ok(Response::from_parts(head, compressed_body))`
			`}`