tricot/src/reverse_proxy.rs

//! Copied from https://github.com/felipenoris/hyper-reverse-proxy
//! See there for original Copyright notice

use std::convert::TryInto;
use std::net::IpAddr;
use std::str::FromStr;
use std::sync::Arc;
use std::time::{Duration, SystemTime};

use anyhow::Result;
use log::*;

use http::header::HeaderName;
use hyper::header::{HeaderMap, HeaderValue};
use hyper::{client::HttpConnector, header, Body, Client, Request, Response, Uri};
use rustls::client::{ServerCertVerified, ServerCertVerifier};
use rustls::{Certificate, ServerName};

use crate::tls_util::HttpsConnectorFixedDnsname;

pub const PROXY_TIMEOUT: Duration = Duration::from_secs(60);

const HOP_HEADERS: &[HeaderName] = &[
	header::CONNECTION,
	// header::KEEP_ALIVE, // not found in http::header
	header::PROXY_AUTHENTICATE,
	header::PROXY_AUTHORIZATION,
	header::TE,
	header::TRAILER,
	header::TRANSFER_ENCODING,
	header::UPGRADE,
];

fn is_hop_header(name: &HeaderName) -> bool {
	HOP_HEADERS.iter().any(|h| h == name)
}

/// Returns a clone of the headers without the [hop-by-hop headers].
///
/// [hop-by-hop headers]: http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
fn remove_hop_headers(headers: &HeaderMap<HeaderValue>) -> HeaderMap<HeaderValue> {
	let mut result = HeaderMap::new();
	for (k, v) in headers.iter() {
		if !is_hop_header(k) {
			result.append(k.clone(), v.clone());
		}
	}
	result
}

fn create_proxied_response<B>(mut response: Response<B>) -> Response<B> {
	*response.headers_mut() = remove_hop_headers(response.headers());
	response
}

fn forward_uri<B>(forward_url: &str, req: &Request<B>) -> Result<Uri> {
	let forward_uri = match req.uri().query() {
		Some(query) => format!("{}{}?{}", forward_url, req.uri().path(), query),
		None => format!("{}{}", forward_url, req.uri().path()),
	};

	Ok(Uri::from_str(forward_uri.as_str())?)
}

fn create_proxied_request<B>(
	client_ip: IpAddr,
	forward_url: &str,
	request: Request<B>,
) -> Result<Request<B>> {
	let mut builder = Request::builder()
		.method(request.method())
		.uri(forward_uri(forward_url, &request)?)
		.version(hyper::Version::HTTP_11);

	*builder.headers_mut().unwrap() = remove_hop_headers(request.headers());

	// If request does not have host header, add it from original URI authority
	if let header::Entry::Vacant(entry) = builder.headers_mut().unwrap().entry(header::HOST) {
		if let Some(authority) = request.uri().authority() {
			entry.insert(authority.as_str().parse()?);
		}
	}

	// Add forwarding information in the headers
	let x_forwarded_for_header_name = "x-forwarded-for";
	match builder
		.headers_mut()
		.unwrap()
		.entry(x_forwarded_for_header_name)
	{
		header::Entry::Vacant(entry) => {
			entry.insert(client_ip.to_string().parse()?);
		}

		header::Entry::Occupied(mut entry) => {
			let addr = format!("{}, {}", entry.get().to_str()?, client_ip);
			entry.insert(addr.parse()?);
		}
	}

	builder.headers_mut().unwrap().insert(
		HeaderName::from_bytes(b"x-forwarded-proto")?,
		"https".try_into()?,
	);

	// Proxy upgrade requests properly
	if let Some(conn) = request.headers().get(header::CONNECTION) {
		if conn.to_str()?.to_lowercase() == "upgrade" {
			if let Some(upgrade) = request.headers().get(header::UPGRADE) {
				builder
					.headers_mut()
					.unwrap()
					.insert(header::CONNECTION, "Upgrade".try_into()?);
				builder
					.headers_mut()
					.unwrap()
					.insert(header::UPGRADE, upgrade.clone());
			}
		}
	}

	Ok(builder.body(request.into_body())?)
}

pub async fn call(
	client_ip: IpAddr,
	forward_uri: &str,
	request: Request<Body>,
) -> Result<Response<Body>> {
	let proxied_request = create_proxied_request(client_ip, forward_uri, request)?;

	trace!("Proxied request: {:?}", proxied_request);

	let mut connector = HttpConnector::new();
	connector.set_connect_timeout(Some(PROXY_TIMEOUT));

	let client: Client<_, hyper::Body> = Client::builder().set_host(false).build(connector);

	let response = client.request(proxied_request).await?;

	trace!("Inner response: {:?}", response);

	let proxied_response = create_proxied_response(response);
	Ok(proxied_response)
}

pub async fn call_https(
	client_ip: IpAddr,
	forward_uri: &str,
	request: Request<Body>,
) -> Result<Response<Body>> {
	let proxied_request = create_proxied_request(client_ip, forward_uri, request)?;

	trace!("Proxied request (HTTPS): {:?}", proxied_request);

	let tls_config = rustls::client::ClientConfig::builder()
		.with_safe_defaults()
		.with_custom_certificate_verifier(Arc::new(DontVerifyServerCert))
		.with_no_client_auth();

	let mut http_connector = HttpConnector::new();
	http_connector.set_connect_timeout(Some(PROXY_TIMEOUT));
	let connector = HttpsConnectorFixedDnsname::new(tls_config, "dummy", http_connector);

	let client: Client<_, hyper::Body> = Client::builder().set_host(false).build(connector);
	let response = client.request(proxied_request).await?;

	trace!("Inner response (HTTPS): {:?}", response);

	let proxied_response = create_proxied_response(response);
	Ok(proxied_response)
}

struct DontVerifyServerCert;

impl ServerCertVerifier for DontVerifyServerCert {
	fn verify_server_cert(
		&self,
		_end_entity: &Certificate,
		_intermediates: &[Certificate],
		_server_name: &ServerName,
		_scts: &mut dyn Iterator<Item = &[u8]>,
		_ocsp_response: &[u8],
		_now: SystemTime,
	) -> Result<ServerCertVerified, rustls::Error> {
		Ok(ServerCertVerified::assertion())
	}
}
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`//! Copied from https://github.com/felipenoris/hyper-reverse-proxy`
			`//! See there for original Copyright notice`

Support totally ignoring backend HTTPS certificate stuff 2021-12-08 22:45:24 +00:00			`use std::convert::TryInto;`
			`use std::net::IpAddr;`
			`use std::str::FromStr;`
Improved management of ACME orders and certificate pre-expiration period 2021-12-09 11:18:23 +00:00			`use std::sync::Arc;`
Actually that was quite a stupid way of handling timeouts 2022-01-24 19:55:26 +00:00			`use std::time::{Duration, SystemTime};`
Support totally ignoring backend HTTPS certificate stuff 2021-12-08 22:45:24 +00:00
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`use anyhow::Result;`
Try to fix things 2021-12-08 12:28:07 +00:00			`use log::*;`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
Try to fix things 2021-12-08 12:28:07 +00:00			`use http::header::HeaderName;`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`use hyper::header::{HeaderMap, HeaderValue};`
Actually that was quite a stupid way of handling timeouts 2022-01-24 19:55:26 +00:00			`use hyper::{client::HttpConnector, header, Body, Client, Request, Response, Uri};`
Improved management of ACME orders and certificate pre-expiration period 2021-12-09 11:18:23 +00:00			`use rustls::client::{ServerCertVerified, ServerCertVerifier};`
			`use rustls::{Certificate, ServerName};`
Support totally ignoring backend HTTPS certificate stuff 2021-12-08 22:45:24 +00:00
			`use crate::tls_util::HttpsConnectorFixedDnsname;`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
Actually that was quite a stupid way of handling timeouts 2022-01-24 19:55:26 +00:00			`pub const PROXY_TIMEOUT: Duration = Duration::from_secs(60);`

Compression 2021-12-09 14:43:19 +00:00			`const HOP_HEADERS: &[HeaderName] = &[`
			`header::CONNECTION,`
Try to fix duplicate Host header issue - disable http2 to backend connections even when using tls - forbid hyper from adding a host header 2022-01-25 16:01:39 +00:00			`// header::KEEP_ALIVE, // not found in http::header`
Compression 2021-12-09 14:43:19 +00:00			`header::PROXY_AUTHENTICATE,`
			`header::PROXY_AUTHORIZATION,`
			`header::TE,`
			`header::TRAILER,`
			`header::TRANSFER_ENCODING,`
			`header::UPGRADE,`
			`];`

			`fn is_hop_header(name: &HeaderName) -> bool {`
			`HOP_HEADERS.iter().any(\|h\| h == name)`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`}`

			`/// Returns a clone of the headers without the [hop-by-hop headers].`
			`///`
			`/// [hop-by-hop headers]: http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html`
			`fn remove_hop_headers(headers: &HeaderMap<HeaderValue>) -> HeaderMap<HeaderValue> {`
			`let mut result = HeaderMap::new();`
			`for (k, v) in headers.iter() {`
cargo clippy 2021-12-09 22:38:56 +00:00			`if !is_hop_header(k) {`
Fix multiple header occurences 2021-12-09 10:20:04 +00:00			`result.append(k.clone(), v.clone());`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`}`
			`}`
			`result`
			`}`

			`fn create_proxied_response<B>(mut response: Response<B>) -> Response<B> {`
			`*response.headers_mut() = remove_hop_headers(response.headers());`
			`response`
			`}`

			`fn forward_uri<B>(forward_url: &str, req: &Request<B>) -> Result<Uri> {`
			`let forward_uri = match req.uri().query() {`
			`Some(query) => format!("{}{}?{}", forward_url, req.uri().path(), query),`
			`None => format!("{}{}", forward_url, req.uri().path()),`
			`};`

			`Ok(Uri::from_str(forward_uri.as_str())?)`
			`}`

			`fn create_proxied_request<B>(`
			`client_ip: IpAddr,`
			`forward_url: &str,`
			`request: Request<B>,`
			`) -> Result<Request<B>> {`
Try to fix things 2021-12-08 12:28:07 +00:00			`let mut builder = Request::builder()`
			`.method(request.method())`
Try to fix duplicate Host header issue - disable http2 to backend connections even when using tls - forbid hyper from adding a host header 2022-01-25 16:01:39 +00:00			`.uri(forward_uri(forward_url, &request)?)`
			`.version(hyper::Version::HTTP_11);`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
			`*builder.headers_mut().unwrap() = remove_hop_headers(request.headers());`

			`// If request does not have host header, add it from original URI authority`
Compression 2021-12-09 14:43:19 +00:00			`if let header::Entry::Vacant(entry) = builder.headers_mut().unwrap().entry(header::HOST) {`
Fix multiple header occurences 2021-12-09 10:20:04 +00:00			`if let Some(authority) = request.uri().authority() {`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`entry.insert(authority.as_str().parse()?);`
			`}`
			`}`

			`// Add forwarding information in the headers`
Fix path prefixes 2021-12-08 16:27:27 +00:00			`let x_forwarded_for_header_name = "x-forwarded-for";`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`match builder`
			`.headers_mut()`
			`.unwrap()`
			`.entry(x_forwarded_for_header_name)`
			`{`
Compression 2021-12-09 14:43:19 +00:00			`header::Entry::Vacant(entry) => {`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`entry.insert(client_ip.to_string().parse()?);`
			`}`

Compression 2021-12-09 14:43:19 +00:00			`header::Entry::Occupied(mut entry) => {`
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`let addr = format!("{}, {}", entry.get().to_str()?, client_ip);`
			`entry.insert(addr.parse()?);`
			`}`
			`}`

Exit more agressively on certain errors 2021-12-08 16:50:40 +00:00			`builder.headers_mut().unwrap().insert(`
			`HeaderName::from_bytes(b"x-forwarded-proto")?,`
			`"https".try_into()?,`
			`);`
Fix path prefixes 2021-12-08 16:27:27 +00:00
Fix multiple header occurences 2021-12-09 10:20:04 +00:00			`// Proxy upgrade requests properly`
Compression 2021-12-09 14:43:19 +00:00			`if let Some(conn) = request.headers().get(header::CONNECTION) {`
Try to fix things 2021-12-08 12:28:07 +00:00			`if conn.to_str()?.to_lowercase() == "upgrade" {`
Compression 2021-12-09 14:43:19 +00:00			`if let Some(upgrade) = request.headers().get(header::UPGRADE) {`
			`builder`
			`.headers_mut()`
			`.unwrap()`
			`.insert(header::CONNECTION, "Upgrade".try_into()?);`
Try to fix things 2021-12-08 12:28:07 +00:00			`builder`
			`.headers_mut()`
			`.unwrap()`
Compression 2021-12-09 14:43:19 +00:00			`.insert(header::UPGRADE, upgrade.clone());`
Try to fix things 2021-12-08 12:28:07 +00:00			`}`
			`}`
			`}`

Got a reverse proxy 2021-12-07 14:20:45 +00:00			`Ok(builder.body(request.into_body())?)`
			`}`

			`pub async fn call(`
			`client_ip: IpAddr,`
			`forward_uri: &str,`
			`request: Request<Body>,`
			`) -> Result<Response<Body>> {`
Cargo clippy 2021-12-09 11:20:37 +00:00			`let proxied_request = create_proxied_request(client_ip, forward_uri, request)?;`
Got a reverse proxy 2021-12-07 14:20:45 +00:00
Try to fix things 2021-12-08 12:28:07 +00:00			`trace!("Proxied request: {:?}", proxied_request);`

Actually that was quite a stupid way of handling timeouts 2022-01-24 19:55:26 +00:00			`let mut connector = HttpConnector::new();`
			`connector.set_connect_timeout(Some(PROXY_TIMEOUT));`

Try to fix duplicate Host header issue - disable http2 to backend connections even when using tls - forbid hyper from adding a host header 2022-01-25 16:01:39 +00:00			`let client: Client<_, hyper::Body> = Client::builder().set_host(false).build(connector);`
Actually that was quite a stupid way of handling timeouts 2022-01-24 19:55:26 +00:00
Got a reverse proxy 2021-12-07 14:20:45 +00:00			`let response = client.request(proxied_request).await?;`
Try to fix things 2021-12-08 12:28:07 +00:00
			`trace!("Inner response: {:?}", response);`

Got a reverse proxy 2021-12-07 14:20:45 +00:00			`let proxied_response = create_proxied_response(response);`
			`Ok(proxied_response)`
			`}`
Handle HTTPS targets 2021-12-08 21:58:19 +00:00
			`pub async fn call_https(`
			`client_ip: IpAddr,`
			`forward_uri: &str,`
			`request: Request<Body>,`
			`) -> Result<Response<Body>> {`
Cargo clippy 2021-12-09 11:20:37 +00:00			`let proxied_request = create_proxied_request(client_ip, forward_uri, request)?;`
Handle HTTPS targets 2021-12-08 21:58:19 +00:00
			`trace!("Proxied request (HTTPS): {:?}", proxied_request);`

Support totally ignoring backend HTTPS certificate stuff 2021-12-08 22:45:24 +00:00			`let tls_config = rustls::client::ClientConfig::builder()`
			`.with_safe_defaults()`
			`.with_custom_certificate_verifier(Arc::new(DontVerifyServerCert))`
			`.with_no_client_auth();`
Actually that was quite a stupid way of handling timeouts 2022-01-24 19:55:26 +00:00
			`let mut http_connector = HttpConnector::new();`
			`http_connector.set_connect_timeout(Some(PROXY_TIMEOUT));`
			`let connector = HttpsConnectorFixedDnsname::new(tls_config, "dummy", http_connector);`

Try to fix duplicate Host header issue - disable http2 to backend connections even when using tls - forbid hyper from adding a host header 2022-01-25 16:01:39 +00:00			`let client: Client<_, hyper::Body> = Client::builder().set_host(false).build(connector);`
Handle HTTPS targets 2021-12-08 21:58:19 +00:00			`let response = client.request(proxied_request).await?;`

			`trace!("Inner response (HTTPS): {:?}", response);`

			`let proxied_response = create_proxied_response(response);`
			`Ok(proxied_response)`
			`}`
Support totally ignoring backend HTTPS certificate stuff 2021-12-08 22:45:24 +00:00
			`struct DontVerifyServerCert;`

			`impl ServerCertVerifier for DontVerifyServerCert {`
			`fn verify_server_cert(`
Improved management of ACME orders and certificate pre-expiration period 2021-12-09 11:18:23 +00:00			`&self,`
			`_end_entity: &Certificate,`
			`_intermediates: &[Certificate],`
			`_server_name: &ServerName,`
			`_scts: &mut dyn Iterator<Item = &[u8]>,`
			`_ocsp_response: &[u8],`
			`_now: SystemTime,`
			`) -> Result<ServerCertVerified, rustls::Error> {`
Support totally ignoring backend HTTPS certificate stuff 2021-12-08 22:45:24 +00:00			`Ok(ServerCertVerified::assertion())`
			`}`
			`}`