From d38588a299273959c0c3f0a69be1aea77adb5aeb Mon Sep 17 00:00:00 2001 From: Ara Sadoyan Date: Sun, 25 May 2025 11:19:28 +0200 Subject: [PATCH] http to https redirect --- src/utils/consul.rs | 6 ++-- src/utils/healthcheck.rs | 8 ++--- src/utils/parceyaml.rs | 13 ++++++-- src/utils/structs.rs | 4 ++- src/utils/tools.rs | 6 ++-- src/web/gethosts.rs | 7 ++-- src/web/proxyhttp.rs | 71 ++++++++++++++++++++++++++++++---------- 7 files changed, 81 insertions(+), 34 deletions(-) diff --git a/src/utils/consul.rs b/src/utils/consul.rs index 32284f6..7a25c83 100644 --- a/src/utils/consul.rs +++ b/src/utils/consul.rs @@ -109,7 +109,7 @@ async fn consul_request(url: String, whitelist: Option>, tok Some(upstreams) } -async fn get_by_http(url: String, token: Option) -> Option, AtomicUsize)>> { +async fn get_by_http(url: String, token: Option) -> Option, AtomicUsize)>> { let client = reqwest::Client::new(); let mut headers = HeaderMap::new(); if let Some(token) = token { @@ -118,7 +118,7 @@ async fn get_by_http(url: String, token: Option) -> Option, AtomicUsize)> = DashMap::new(); + let upstreams: DashMap, AtomicUsize)> = DashMap::new(); match u.await { Ok(r) => { let jason = r.json::>().await; @@ -127,7 +127,7 @@ async fn get_by_http(url: String, token: Option) -> Option, fullist: Arc, for val in fclone.iter() { let host = val.key(); let inner = DashMap::new(); - let mut _scheme: (String, u16, bool, bool) = ("".to_string(), 0, false, false); + let mut _scheme: (String, u16, bool, bool, bool) = ("".to_string(), 0, false, false, false); for path_entry in val.value().iter() { // let inner = DashMap::new(); let path = path_entry.key(); let mut innervec= Vec::new(); for k in path_entry.value().0 .iter().enumerate() { - let (ip, port, _ssl, _version) = k.1; + let (ip, port, _ssl, _version, _redir) = k.1; let mut _link = String::new(); let tls = detect_tls(ip, port).await; let mut is_h2 = false; @@ -52,13 +52,13 @@ pub async fn hc2(upslist: Arc, fullist: Arc, // }else { // _scheme = (ip.to_string(), *port, false); // } - _scheme = (ip.to_string(), *port, tls.0, is_h2); + _scheme = (ip.to_string(), *port, tls.0, is_h2, *_redir); // let link = format!("{}{}:{}{}", _pref, ip, port, path); let resp = http_request(_link.as_str(), params.0, "").await; match resp.0 { true => { if resp.1 { - _scheme = (ip.to_string(), *port, tls.0, true); + _scheme = (ip.to_string(), *port, tls.0, true, *_redir); } innervec.push(_scheme.clone()); } diff --git a/src/utils/parceyaml.rs b/src/utils/parceyaml.rs index 769e359..0d1517c 100644 --- a/src/utils/parceyaml.rs +++ b/src/utils/parceyaml.rs @@ -73,6 +73,7 @@ pub fn load_configuration(d: &str, kind: &str) -> Option { let path_map = DashMap::new(); let header_list = DashMap::new(); for (path, path_config) in host_config.paths { + // println!("{:?}", path_config); let mut server_list = Vec::new(); let mut hl = Vec::new(); if let Some(headers) = &path_config.headers { @@ -86,8 +87,9 @@ pub fn load_configuration(d: &str, kind: &str) -> Option { for server in path_config.servers { if let Some((ip, port_str)) = server.split_once(':') { if let Ok(port) = port_str.parse::() { - // server_list.push((ip.to_string(), port, path_config.ssl)); - server_list.push((ip.to_string(), port, true, false)); + // let to_https = matches!(path_config.to_https, Some(true)); + let to_https = path_config.to_https.unwrap_or(false); + server_list.push((ip.to_string(), port, true, false, to_https)); } } } @@ -139,5 +141,12 @@ pub fn parce_main_config(path: &str) -> AppConfig { cfo.local_server = Option::from((ip.to_string(), port)); } } + if let Some(tlsport_cfg) = cfo.proxy_address_tls.clone() { + if let Some((_, port_str)) = tlsport_cfg.split_once(':') { + if let Ok(port) = port_str.parse::() { + cfo.proxy_port_tls = Some(port); + } + } + }; cfo } diff --git a/src/utils/structs.rs b/src/utils/structs.rs index ec7b6ab..9e8bcd4 100644 --- a/src/utils/structs.rs +++ b/src/utils/structs.rs @@ -3,7 +3,7 @@ use serde::{Deserialize, Serialize}; use std::collections::HashMap; use std::sync::atomic::AtomicUsize; -pub type InnerMap = (String, u16, bool, bool); +pub type InnerMap = (String, u16, bool, bool, bool); pub type UpstreamsDashMap = DashMap, AtomicUsize)>>; pub type UpstreamsIdMap = DashMap; pub type Headers = DashMap>>; @@ -43,6 +43,7 @@ pub struct HostConfig { #[derive(Debug, Serialize, Deserialize)] pub struct PathConfig { pub servers: Vec, + pub to_https: Option, pub headers: Option>, } #[derive(Debug)] @@ -64,6 +65,7 @@ pub struct AppConfig { pub proxy_address_http: String, pub master_key: String, pub proxy_address_tls: Option, + pub proxy_port_tls: Option, pub tls_certificate: Option, pub tls_key_file: Option, pub local_server: Option<(String, u16)>, diff --git a/src/utils/tools.rs b/src/utils/tools.rs index f3b51e9..87bf3f7 100644 --- a/src/utils/tools.rs +++ b/src/utils/tools.rs @@ -16,8 +16,8 @@ pub fn print_upstreams(upstreams: &UpstreamsDashMap) { let path = path_entry.key(); println!(" Path: {}", path); - for (ip, port, ssl, vers) in path_entry.value().0.clone() { - println!(" ===> IP: {}, Port: {}, SSL: {}, H2: {}", ip, port, ssl, vers); + for (ip, port, ssl, vers, to_https) in path_entry.value().0.clone() { + println!(" ===> IP: {}, Port: {}, SSL: {}, H2: {}, To HTTPS: {}", ip, port, ssl, vers, to_https); } } } @@ -139,7 +139,7 @@ pub fn clone_idmap_into(original: &UpstreamsDashMap, cloned: &UpstreamsIdMap) { let hash = hasher.finalize(); let hex_hash = base16ct::lower::encode_string(&hash); let hh = hex_hash[0..50].to_string(); - cloned.insert(id, (hh.clone(), 0000, false, false)); + cloned.insert(id, (hh.clone(), 0000, false, false, false)); cloned.insert(hh, x.to_owned()); } new_inner_map.insert(path.clone(), new_vec); diff --git a/src/web/gethosts.rs b/src/web/gethosts.rs index a8a40b0..5670f4c 100644 --- a/src/web/gethosts.rs +++ b/src/web/gethosts.rs @@ -1,15 +1,16 @@ +use crate::utils::structs::InnerMap; use crate::web::proxyhttp::LB; use async_trait::async_trait; use std::sync::atomic::Ordering; #[async_trait] pub trait GetHost { - fn get_host(&self, peer: &str, path: &str, backend_id: Option<&str>) -> Option<(String, u16, bool, bool)>; + fn get_host(&self, peer: &str, path: &str, backend_id: Option<&str>) -> Option; fn get_header(&self, peer: &str, path: &str) -> Option>; } #[async_trait] impl GetHost for LB { - fn get_host(&self, peer: &str, path: &str, backend_id: Option<&str>) -> Option<(String, u16, bool, bool)> { + fn get_host(&self, peer: &str, path: &str, backend_id: Option<&str>) -> Option { if let Some(b) = backend_id { if let Some(bb) = self.ump_byid.get(b) { // println!("BIB :===> {:?}", Some(bb.value())); @@ -19,7 +20,7 @@ impl GetHost for LB { let host_entry = self.ump_upst.get(peer)?; let mut current_path = path.to_string(); - let mut best_match: Option<(String, u16, bool, bool)> = None; + let mut best_match: Option = None; loop { if let Some(entry) = host_entry.get(¤t_path) { let (servers, index) = entry.value(); diff --git a/src/web/proxyhttp.rs b/src/web/proxyhttp.rs index eae0af8..3548bf7 100644 --- a/src/web/proxyhttp.rs +++ b/src/web/proxyhttp.rs @@ -4,11 +4,10 @@ use crate::web::gethosts::GetHost; use arc_swap::ArcSwap; use async_trait::async_trait; use log::{debug, warn}; -use pingora::http::RequestHeader; +use pingora::http::{RequestHeader, ResponseHeader, StatusCode}; use pingora::prelude::*; use pingora_core::listeners::ALPN; use pingora_core::prelude::HttpPeer; -use pingora_http::ResponseHeader; use pingora_proxy::{ProxyHttp, Session}; use std::sync::Arc; @@ -23,6 +22,8 @@ pub struct LB { pub struct Context { backend_id: String, + to_https: bool, + redirect_to: String, } #[async_trait] @@ -31,7 +32,11 @@ impl ProxyHttp for LB { // fn new_ctx(&self) -> Self::CTX {} type CTX = Context; fn new_ctx(&self) -> Self::CTX { - Context { backend_id: String::new() } + Context { + backend_id: String::new(), + to_https: false, + redirect_to: String::new(), + } } async fn request_filter(&self, session: &mut Session, _ctx: &mut Self::CTX) -> Result { if let Some(auth) = self.extraparams.load().authentication.get("authorization") { @@ -42,6 +47,7 @@ impl ProxyHttp for LB { return Ok(true); } }; + // if session.req_header().uri.path().starts_with("/denied") { // let _ = session.respond_error(403).await; // warn!("Forbidden: {:?}, {}", session.client_addr(), session.req_header().uri.path().to_string()); @@ -73,7 +79,7 @@ impl ProxyHttp for LB { let ddr = self.get_host(hostname, hostname, backend_id); match ddr { - Some((address, port, ssl, is_h2)) => { + Some((address, port, ssl, is_h2, to_https)) => { let mut peer = Box::new(HttpPeer::new((address.clone(), port.clone()), ssl, String::new())); // if session.is_http2() { if is_h2 { @@ -84,14 +90,34 @@ impl ProxyHttp for LB { peer.options.verify_cert = false; peer.options.verify_hostname = false; } - // info!( - // "upstream peer: hostname {}, address{}, alpn {}, h2 {:?}", - // hostname, - // address.as_str(), - // peer.options.alpn, - // is_h2 - // ); + // println!("{}, {}, alpn {}, h2 {:?}, to_https {}", hostname, address.as_str(), peer.options.alpn, is_h2, _to_https); + // let mut gogo = false; + // let mut location = String::new(); + if to_https { + if let Some(stream) = session.stream() { + if stream.get_ssl().is_none() { + if let Some(addr) = session.server_addr() { + if let Some((host, _)) = addr.to_string().split_once(':') { + let uri = session.req_header().uri.path_and_query().map_or("/", |pq| pq.as_str()); + let port = self.config.proxy_port_tls.unwrap_or(443); + // let location = format!("https://{}:{}{}", host, port, uri); + // println!("Redirect: {} => {}", hostname, location); + // gogo = true; + _ctx.to_https = true; + _ctx.redirect_to = format!("https://{}:{}{}", host, port, uri); + } + } + } + } + } + + // if gogo { + // println!("Redirect: {} => {}", hostname, location); + // let _ = session.respond_error(301).await; + // warn!("Forbidden: {:?}, {}", session.client_addr(), session.req_header().uri.path().to_string()); + // } _ctx.backend_id = format!("{}:{}:{}", address.clone(), port.clone(), ssl); + // println!("{:?}, {:?}", session.request_summary(), session.server_addr()); Ok(peer) } None => { @@ -107,9 +133,8 @@ impl ProxyHttp for LB { } } - async fn upstream_request_filter(&self, _session: &mut Session, _upstream_request: &mut RequestHeader, _ctx: &mut Self::CTX) -> Result<()> { - let clientip = _session.client_addr(); - match clientip { + async fn upstream_request_filter(&self, session: &mut Session, _upstream_request: &mut RequestHeader, _ctx: &mut Self::CTX) -> Result<()> { + match session.client_addr() { Some(ip) => { let inet = ip.as_inet(); match inet { @@ -128,7 +153,7 @@ impl ProxyHttp for LB { Ok(()) } - async fn response_filter(&self, _session: &mut Session, _upstream_response: &mut ResponseHeader, _ctx: &mut Self::CTX) -> Result<()> { + async fn response_filter(&self, session: &mut Session, _upstream_response: &mut ResponseHeader, _ctx: &mut Self::CTX) -> Result<()> { // _upstream_response.insert_header("X-Proxied-From", "Fooooooooooooooo").unwrap(); if self.extraparams.load().stickysessions { let backend_id = _ctx.backend_id.clone(); @@ -138,10 +163,20 @@ impl ProxyHttp for LB { } } - let host_name = return_header_host(&_session); - match host_name { + if _ctx.to_https { + // println!("{} => {}", _ctx.to_https, _ctx.redirect_to); + let mut redirect_response = ResponseHeader::build(StatusCode::MOVED_PERMANENTLY, None)?; + redirect_response.insert_header("Location", _ctx.redirect_to.clone())?; + redirect_response.insert_header("Content-Length", "0")?; + session.write_response_header(Box::new(redirect_response), false).await?; + // return Ok(()); + // let response = session.write_response_header(Box::new(redirect_response), false).await?; + // return Ok(response); + } + + match return_header_host(&session) { Some(host) => { - let path = _session.req_header().uri.path(); + let path = session.req_header().uri.path(); let host_header = host; let split_header = host_header.split_once(':'); match split_header {