Browse Source
* caddyhttp: Redirect HTTP requests on the HTTPS port to https:// * Apply suggestions from code review Co-authored-by: Matt Holt <mholt@users.noreply.github.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>master
Francis Lavoie
3 years ago
committed by
GitHub
2 changed files with 119 additions and 0 deletions
@ -0,0 +1,114 @@ |
|||
// Copyright 2015 Matthew Holt and The Caddy Authors
|
|||
//
|
|||
// Licensed under the Apache License, Version 2.0 (the "License");
|
|||
// you may not use this file except in compliance with the License.
|
|||
// You may obtain a copy of the License at
|
|||
//
|
|||
// http://www.apache.org/licenses/LICENSE-2.0
|
|||
//
|
|||
// Unless required by applicable law or agreed to in writing, software
|
|||
// distributed under the License is distributed on an "AS IS" BASIS,
|
|||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|||
// See the License for the specific language governing permissions and
|
|||
// limitations under the License.
|
|||
|
|||
package caddyhttp |
|||
|
|||
import ( |
|||
"bufio" |
|||
"fmt" |
|||
"net" |
|||
"net/http" |
|||
"sync" |
|||
) |
|||
|
|||
// httpRedirectListener is listener that checks the first few bytes
|
|||
// of the request when the server is intended to accept HTTPS requests,
|
|||
// to respond to an HTTP request with a redirect.
|
|||
type httpRedirectListener struct { |
|||
net.Listener |
|||
} |
|||
|
|||
// Accept waits for and returns the next connection to the listener,
|
|||
// wrapping it with a httpRedirectConn.
|
|||
func (l *httpRedirectListener) Accept() (net.Conn, error) { |
|||
c, err := l.Listener.Accept() |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
|
|||
return &httpRedirectConn{ |
|||
Conn: c, |
|||
r: bufio.NewReader(c), |
|||
}, nil |
|||
} |
|||
|
|||
type httpRedirectConn struct { |
|||
net.Conn |
|||
once sync.Once |
|||
r *bufio.Reader |
|||
} |
|||
|
|||
// Read tries to peek at the first few bytes of the request, and if we get
|
|||
// an error reading the headers, and that error was due to the bytes looking
|
|||
// like an HTTP request, then we perform a HTTP->HTTPS redirect on the same
|
|||
// port as the original connection.
|
|||
func (c *httpRedirectConn) Read(p []byte) (int, error) { |
|||
var errReturn error |
|||
c.once.Do(func() { |
|||
firstBytes, err := c.r.Peek(5) |
|||
if err != nil { |
|||
return |
|||
} |
|||
|
|||
// If the request doesn't look like HTTP, then it's probably
|
|||
// TLS bytes and we don't need to do anything.
|
|||
if !firstBytesLookLikeHTTP(firstBytes) { |
|||
return |
|||
} |
|||
|
|||
// Parse the HTTP request, so we can get the Host and URL to redirect to.
|
|||
req, err := http.ReadRequest(c.r) |
|||
if err != nil { |
|||
return |
|||
} |
|||
|
|||
// Build the redirect response, using the same Host and URL,
|
|||
// but replacing the scheme with https.
|
|||
headers := make(http.Header) |
|||
headers.Add("Location", "https://"+req.Host+req.URL.String()) |
|||
resp := &http.Response{ |
|||
Proto: "HTTP/1.0", |
|||
Status: "308 Permanent Redirect", |
|||
StatusCode: 308, |
|||
ProtoMajor: 1, |
|||
ProtoMinor: 0, |
|||
Header: headers, |
|||
} |
|||
|
|||
err = resp.Write(c.Conn) |
|||
if err != nil { |
|||
errReturn = fmt.Errorf("couldn't write HTTP->HTTPS redirect") |
|||
return |
|||
} |
|||
|
|||
errReturn = fmt.Errorf("redirected HTTP request on HTTPS port") |
|||
c.Conn.Close() |
|||
}) |
|||
|
|||
if errReturn != nil { |
|||
return 0, errReturn |
|||
} |
|||
|
|||
return c.r.Read(p) |
|||
} |
|||
|
|||
// firstBytesLookLikeHTTP reports whether a TLS record header
|
|||
// looks like it might've been a misdirected plaintext HTTP request.
|
|||
func firstBytesLookLikeHTTP(hdr []byte) bool { |
|||
switch string(hdr[:5]) { |
|||
case "GET /", "HEAD ", "POST ", "PUT /", "OPTIO": |
|||
return true |
|||
} |
|||
return false |
|||
} |
Loading…
Reference in new issue