committed by
GitHub
15 changed files with 1628 additions and 50 deletions
@ -0,0 +1,358 @@ |
|||||
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
|
//
|
||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
// you may not use this file except in compliance with the License.
|
||||
|
// You may obtain a copy of the License at
|
||||
|
//
|
||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
//
|
||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
|
// See the License for the specific language governing permissions and
|
||||
|
// limitations under the License.
|
||||
|
|
||||
|
package caddy |
||||
|
|
||||
|
import ( |
||||
|
"bytes" |
||||
|
"encoding/json" |
||||
|
"fmt" |
||||
|
"log" |
||||
|
"net/http" |
||||
|
"path" |
||||
|
"strconv" |
||||
|
"strings" |
||||
|
"sync" |
||||
|
) |
||||
|
|
||||
|
func init() { |
||||
|
RegisterModule(router{}) |
||||
|
} |
||||
|
|
||||
|
type router []AdminRoute |
||||
|
|
||||
|
// CaddyModule returns the Caddy module information.
|
||||
|
func (router) CaddyModule() ModuleInfo { |
||||
|
return ModuleInfo{ |
||||
|
Name: "admin.routers.dynamic_config", |
||||
|
New: func() Module { |
||||
|
return router{ |
||||
|
{ |
||||
|
Pattern: "/" + rawConfigKey + "/", |
||||
|
Handler: http.HandlerFunc(handleConfig), |
||||
|
}, |
||||
|
{ |
||||
|
Pattern: "/id/", |
||||
|
Handler: http.HandlerFunc(handleConfigID), |
||||
|
}, |
||||
|
} |
||||
|
}, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
func (r router) Routes() []AdminRoute { return r } |
||||
|
|
||||
|
// handleConfig handles config changes or exports according to r.
|
||||
|
// This function is safe for concurrent use.
|
||||
|
func handleConfig(w http.ResponseWriter, r *http.Request) { |
||||
|
rawCfgMu.Lock() |
||||
|
defer rawCfgMu.Unlock() |
||||
|
unsyncedHandleConfig(w, r) |
||||
|
} |
||||
|
|
||||
|
// handleConfigID accesses the config through a user-assigned ID
|
||||
|
// that is mapped to its full/expanded path in the JSON structure.
|
||||
|
// It is the same as handleConfig except it replaces the ID in
|
||||
|
// the request path with the full, expanded URL path.
|
||||
|
// This function is safe for concurrent use.
|
||||
|
func handleConfigID(w http.ResponseWriter, r *http.Request) { |
||||
|
parts := strings.Split(r.URL.Path, "/") |
||||
|
if len(parts) < 3 || parts[2] == "" { |
||||
|
http.Error(w, "request path is missing object ID", http.StatusBadRequest) |
||||
|
return |
||||
|
} |
||||
|
id := parts[2] |
||||
|
|
||||
|
rawCfgMu.Lock() |
||||
|
defer rawCfgMu.Unlock() |
||||
|
|
||||
|
// map the ID to the expanded path
|
||||
|
expanded, ok := rawCfgIndex[id] |
||||
|
if !ok { |
||||
|
http.Error(w, "unknown object ID: "+id, http.StatusBadRequest) |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
// piece the full URL path back together
|
||||
|
parts = append([]string{expanded}, parts[3:]...) |
||||
|
r.URL.Path = path.Join(parts...) |
||||
|
|
||||
|
unsyncedHandleConfig(w, r) |
||||
|
} |
||||
|
|
||||
|
// configIndex recurisvely searches ptr for object fields named "@id"
|
||||
|
// and maps that ID value to the full configPath in the index.
|
||||
|
// This function is NOT safe for concurrent access; use rawCfgMu.
|
||||
|
func configIndex(ptr interface{}, configPath string, index map[string]string) error { |
||||
|
switch val := ptr.(type) { |
||||
|
case map[string]interface{}: |
||||
|
for k, v := range val { |
||||
|
if k == "@id" { |
||||
|
switch idVal := v.(type) { |
||||
|
case string: |
||||
|
index[idVal] = configPath |
||||
|
case float64: // all JSON numbers decode as float64
|
||||
|
index[fmt.Sprintf("%v", idVal)] = configPath |
||||
|
default: |
||||
|
return fmt.Errorf("%s: @id field must be a string or number", configPath) |
||||
|
} |
||||
|
delete(val, "@id") // field is no longer needed, and will break config if not removed
|
||||
|
continue |
||||
|
} |
||||
|
// traverse this object property recursively
|
||||
|
err := configIndex(val[k], path.Join(configPath, k), index) |
||||
|
if err != nil { |
||||
|
return err |
||||
|
} |
||||
|
} |
||||
|
case []interface{}: |
||||
|
// traverse each element of the array recursively
|
||||
|
for i := range val { |
||||
|
err := configIndex(val[i], path.Join(configPath, strconv.Itoa(i)), index) |
||||
|
if err != nil { |
||||
|
return err |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
// unsycnedHandleConfig handles config accesses without a lock
|
||||
|
// on rawCfgMu. This is NOT safe for concurrent use, so be sure
|
||||
|
// to acquire a lock on rawCfgMu before calling this.
|
||||
|
func unsyncedHandleConfig(w http.ResponseWriter, r *http.Request) { |
||||
|
switch r.Method { |
||||
|
case http.MethodGet, http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete: |
||||
|
default: |
||||
|
http.Error(w, http.StatusText(http.StatusMethodNotAllowed), http.StatusMethodNotAllowed) |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
// perform the mutation with our decoded representation
|
||||
|
// (the map), which may change pointers deep within it
|
||||
|
err := mutateConfig(w, r) |
||||
|
if err != nil { |
||||
|
http.Error(w, "mutating config: "+err.Error(), http.StatusBadRequest) |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
if r.Method != http.MethodGet { |
||||
|
// find any IDs in this config and index them
|
||||
|
idx := make(map[string]string) |
||||
|
err = configIndex(rawCfg[rawConfigKey], "/config", idx) |
||||
|
if err != nil { |
||||
|
http.Error(w, "indexing config: "+err.Error(), http.StatusInternalServerError) |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
// the mutation is complete, so encode the entire config as JSON
|
||||
|
newCfg, err := json.Marshal(rawCfg[rawConfigKey]) |
||||
|
if err != nil { |
||||
|
http.Error(w, "encoding new config: "+err.Error(), http.StatusBadRequest) |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
// if nothing changed, no need to do a whole reload unless the client forces it
|
||||
|
if r.Header.Get("Cache-Control") != "must-revalidate" && bytes.Equal(rawCfgJSON, newCfg) { |
||||
|
log.Printf("[ADMIN][INFO] Config is unchanged") |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
// load this new config; if it fails, we need to revert to
|
||||
|
// our old representation of caddy's actual config
|
||||
|
err = Load(bytes.NewReader(newCfg)) |
||||
|
if err != nil { |
||||
|
// restore old config state to keep it consistent
|
||||
|
// with what caddy is still running; we need to
|
||||
|
// unmarshal it again because it's likely that
|
||||
|
// pointers deep in our rawCfg map were modified
|
||||
|
var oldCfg interface{} |
||||
|
err2 := json.Unmarshal(rawCfgJSON, &oldCfg) |
||||
|
if err2 != nil { |
||||
|
err = fmt.Errorf("%v; additionally, restoring old config: %v", err, err2) |
||||
|
} |
||||
|
rawCfg[rawConfigKey] = oldCfg |
||||
|
|
||||
|
// report error
|
||||
|
log.Printf("[ADMIN][ERROR] loading config: %v", err) |
||||
|
http.Error(w, err.Error(), http.StatusBadRequest) |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
// success, so update our stored copy of the encoded
|
||||
|
// config to keep it consistent with what caddy is now
|
||||
|
// running (storing an encoded copy is not strictly
|
||||
|
// necessary, but avoids an extra json.Marshal for
|
||||
|
// each config change)
|
||||
|
rawCfgJSON = newCfg |
||||
|
rawCfgIndex = idx |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// mutateConfig changes the rawCfg according to r. It is NOT
|
||||
|
// safe for concurrent use; use rawCfgMu. If the request's
|
||||
|
// method is GET, the config will not be changed.
|
||||
|
func mutateConfig(w http.ResponseWriter, r *http.Request) error { |
||||
|
var err error |
||||
|
var val interface{} |
||||
|
|
||||
|
// if there is a request body, make sure we recognize its content-type and decode it
|
||||
|
if r.Method != http.MethodGet && r.Method != http.MethodDelete { |
||||
|
if ct := r.Header.Get("Content-Type"); !strings.Contains(ct, "/json") { |
||||
|
return fmt.Errorf("unacceptable content-type: %v; 'application/json' required", ct) |
||||
|
} |
||||
|
err = json.NewDecoder(r.Body).Decode(&val) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("decoding request body: %v", err) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
buf := new(bytes.Buffer) |
||||
|
enc := json.NewEncoder(buf) |
||||
|
|
||||
|
cleanPath := strings.Trim(r.URL.Path, "/") |
||||
|
if cleanPath == "" { |
||||
|
return fmt.Errorf("no traversable path") |
||||
|
} |
||||
|
|
||||
|
parts := strings.Split(cleanPath, "/") |
||||
|
if len(parts) == 0 { |
||||
|
return fmt.Errorf("path missing") |
||||
|
} |
||||
|
|
||||
|
var ptr interface{} = rawCfg |
||||
|
|
||||
|
traverseLoop: |
||||
|
for i, part := range parts { |
||||
|
switch v := ptr.(type) { |
||||
|
case map[string]interface{}: |
||||
|
// if the next part enters a slice, and the slice is our destination,
|
||||
|
// handle it specially (because appending to the slice copies the slice
|
||||
|
// header, which does not replace the original one like we want)
|
||||
|
if arr, ok := v[part].([]interface{}); ok && i == len(parts)-2 { |
||||
|
var idx int |
||||
|
if r.Method != http.MethodPost { |
||||
|
idxStr := parts[len(parts)-1] |
||||
|
idx, err = strconv.Atoi(idxStr) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("[%s] invalid array index '%s': %v", |
||||
|
r.URL.Path, idxStr, err) |
||||
|
} |
||||
|
if idx < 0 || idx >= len(arr) { |
||||
|
return fmt.Errorf("[%s] array index out of bounds: %s", r.URL.Path, idxStr) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
switch r.Method { |
||||
|
case http.MethodGet: |
||||
|
err = enc.Encode(arr[idx]) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("encoding config: %v", err) |
||||
|
} |
||||
|
case http.MethodPost: |
||||
|
v[part] = append(arr, val) |
||||
|
case http.MethodPut: |
||||
|
// avoid creation of new slice and a second copy (see
|
||||
|
// https://github.com/golang/go/wiki/SliceTricks#insert)
|
||||
|
arr = append(arr, nil) |
||||
|
copy(arr[idx+1:], arr[idx:]) |
||||
|
arr[idx] = val |
||||
|
v[part] = arr |
||||
|
case http.MethodPatch: |
||||
|
arr[idx] = val |
||||
|
case http.MethodDelete: |
||||
|
v[part] = append(arr[:idx], arr[idx+1:]...) |
||||
|
default: |
||||
|
return fmt.Errorf("unrecognized method %s", r.Method) |
||||
|
} |
||||
|
break traverseLoop |
||||
|
} |
||||
|
|
||||
|
if i == len(parts)-1 { |
||||
|
switch r.Method { |
||||
|
case http.MethodGet: |
||||
|
err = enc.Encode(v[part]) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("encoding config: %v", err) |
||||
|
} |
||||
|
case http.MethodPost: |
||||
|
if arr, ok := v[part].([]interface{}); ok { |
||||
|
// if the part is an existing list, POST appends to it
|
||||
|
// TODO: Do we ever reach this point, since we handle arrays
|
||||
|
// separately above?
|
||||
|
v[part] = append(arr, val) |
||||
|
} else { |
||||
|
// otherwise, it simply sets the value
|
||||
|
v[part] = val |
||||
|
} |
||||
|
case http.MethodPut: |
||||
|
if _, ok := v[part]; ok { |
||||
|
return fmt.Errorf("[%s] key already exists: %s", r.URL.Path, part) |
||||
|
} |
||||
|
v[part] = val |
||||
|
case http.MethodPatch: |
||||
|
if _, ok := v[part]; !ok { |
||||
|
return fmt.Errorf("[%s] key does not exist: %s", r.URL.Path, part) |
||||
|
} |
||||
|
v[part] = val |
||||
|
case http.MethodDelete: |
||||
|
delete(v, part) |
||||
|
default: |
||||
|
return fmt.Errorf("unrecognized method %s", r.Method) |
||||
|
} |
||||
|
} else { |
||||
|
ptr = v[part] |
||||
|
} |
||||
|
|
||||
|
case []interface{}: |
||||
|
partInt, err := strconv.Atoi(part) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("[/%s] invalid array index '%s': %v", |
||||
|
strings.Join(parts[:i+1], "/"), part, err) |
||||
|
} |
||||
|
if partInt < 0 || partInt >= len(v) { |
||||
|
return fmt.Errorf("[/%s] array index out of bounds: %s", |
||||
|
strings.Join(parts[:i+1], "/"), part) |
||||
|
} |
||||
|
ptr = v[partInt] |
||||
|
|
||||
|
default: |
||||
|
return fmt.Errorf("invalid path: %s", parts[:i+1]) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
if r.Method == http.MethodGet { |
||||
|
w.Header().Set("Content-Type", "application/json") |
||||
|
w.Write(buf.Bytes()) |
||||
|
} |
||||
|
|
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
var ( |
||||
|
// rawCfg is the current, generic-decoded configuration;
|
||||
|
// we initialize it as a map with one field ("config")
|
||||
|
// to maintain parity with the API endpoint and to avoid
|
||||
|
// the special case of having to access/mutate the variable
|
||||
|
// directly without traversing into it
|
||||
|
rawCfg = map[string]interface{}{ |
||||
|
rawConfigKey: nil, |
||||
|
} |
||||
|
rawCfgJSON []byte // keeping the encoded form avoids an extra Marshal on changes
|
||||
|
rawCfgIndex map[string]string // map of user-assigned ID to expanded path
|
||||
|
rawCfgMu sync.Mutex // protects rawCfg, rawCfgJSON, and rawCfgIndex
|
||||
|
) |
||||
|
|
||||
|
const rawConfigKey = "config" |
@ -0,0 +1,123 @@ |
|||||
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
|
//
|
||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
// you may not use this file except in compliance with the License.
|
||||
|
// You may obtain a copy of the License at
|
||||
|
//
|
||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
//
|
||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
|
// See the License for the specific language governing permissions and
|
||||
|
// limitations under the License.
|
||||
|
|
||||
|
package caddy |
||||
|
|
||||
|
import ( |
||||
|
"encoding/json" |
||||
|
"net/http" |
||||
|
"net/http/httptest" |
||||
|
"reflect" |
||||
|
"strings" |
||||
|
"testing" |
||||
|
) |
||||
|
|
||||
|
func TestMutateConfig(t *testing.T) { |
||||
|
// each test is performed in sequence, so
|
||||
|
// each change builds on the previous ones;
|
||||
|
// the config is not reset between tests
|
||||
|
for i, tc := range []struct { |
||||
|
method string |
||||
|
path string // rawConfigKey will be prepended
|
||||
|
payload string |
||||
|
expect string // JSON representation of what the whole config is expected to be after the request
|
||||
|
shouldErr bool |
||||
|
}{ |
||||
|
{ |
||||
|
method: "POST", |
||||
|
path: "", |
||||
|
payload: `{"foo": "bar", "list": ["a", "b", "c"]}`, // starting value
|
||||
|
expect: `{"foo": "bar", "list": ["a", "b", "c"]}`, |
||||
|
}, |
||||
|
{ |
||||
|
method: "POST", |
||||
|
path: "/foo", |
||||
|
payload: `"jet"`, |
||||
|
expect: `{"foo": "jet", "list": ["a", "b", "c"]}`, |
||||
|
}, |
||||
|
{ |
||||
|
method: "POST", |
||||
|
path: "/bar", |
||||
|
payload: `{"aa": "bb", "qq": "zz"}`, |
||||
|
expect: `{"foo": "jet", "bar": {"aa": "bb", "qq": "zz"}, "list": ["a", "b", "c"]}`, |
||||
|
}, |
||||
|
{ |
||||
|
method: "DELETE", |
||||
|
path: "/bar/qq", |
||||
|
expect: `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c"]}`, |
||||
|
}, |
||||
|
{ |
||||
|
method: "POST", |
||||
|
path: "/list", |
||||
|
payload: `"e"`, |
||||
|
expect: `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "e"]}`, |
||||
|
}, |
||||
|
{ |
||||
|
method: "PUT", |
||||
|
path: "/list/3", |
||||
|
payload: `"d"`, |
||||
|
expect: `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "d", "e"]}`, |
||||
|
}, |
||||
|
{ |
||||
|
method: "DELETE", |
||||
|
path: "/list/3", |
||||
|
expect: `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "e"]}`, |
||||
|
}, |
||||
|
{ |
||||
|
method: "PATCH", |
||||
|
path: "/list/3", |
||||
|
payload: `"d"`, |
||||
|
expect: `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "d"]}`, |
||||
|
}, |
||||
|
} { |
||||
|
req, err := http.NewRequest(tc.method, rawConfigKey+tc.path, strings.NewReader(tc.payload)) |
||||
|
if err != nil { |
||||
|
t.Fatalf("Test %d: making test request: %v", i, err) |
||||
|
} |
||||
|
req.Header.Set("Content-Type", "application/json") |
||||
|
|
||||
|
w := httptest.NewRecorder() |
||||
|
|
||||
|
err = mutateConfig(w, req) |
||||
|
|
||||
|
if tc.shouldErr && err == nil { |
||||
|
t.Fatalf("Test %d: Expected error return value, but got: %v", i, err) |
||||
|
} |
||||
|
if !tc.shouldErr && err != nil { |
||||
|
t.Fatalf("Test %d: Should not have had error return value, but got: %v", i, err) |
||||
|
} |
||||
|
|
||||
|
if tc.shouldErr && w.Code == http.StatusOK { |
||||
|
t.Fatalf("Test %d: Expected error, but got HTTP %d: %s", |
||||
|
i, w.Code, w.Body.String()) |
||||
|
} |
||||
|
if !tc.shouldErr && w.Code != http.StatusOK { |
||||
|
t.Fatalf("Test %d: Should not have errored, but got HTTP %d: %s", |
||||
|
i, w.Code, w.Body.String()) |
||||
|
} |
||||
|
|
||||
|
// decode the expected config so we can do a convenient DeepEqual
|
||||
|
var expectedDecoded interface{} |
||||
|
err = json.Unmarshal([]byte(tc.expect), &expectedDecoded) |
||||
|
if err != nil { |
||||
|
t.Fatalf("Test %d: Unmarshaling expected config: %v", i, err) |
||||
|
} |
||||
|
|
||||
|
// make sure the resulting config is as we expect it
|
||||
|
if !reflect.DeepEqual(rawCfg[rawConfigKey], expectedDecoded) { |
||||
|
t.Fatalf("Test %d:\nExpected:\n\t%#v\nActual:\n\t%#v", |
||||
|
i, expectedDecoded, rawCfg[rawConfigKey]) |
||||
|
} |
||||
|
} |
||||
|
} |
@ -0,0 +1,205 @@ |
|||||
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
|
//
|
||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
// you may not use this file except in compliance with the License.
|
||||
|
// You may obtain a copy of the License at
|
||||
|
//
|
||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
//
|
||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
|
// See the License for the specific language governing permissions and
|
||||
|
// limitations under the License.
|
||||
|
|
||||
|
package httpcache |
||||
|
|
||||
|
import ( |
||||
|
"bytes" |
||||
|
"encoding/gob" |
||||
|
"fmt" |
||||
|
"io" |
||||
|
"log" |
||||
|
"net/http" |
||||
|
"sync" |
||||
|
|
||||
|
"github.com/caddyserver/caddy/v2" |
||||
|
"github.com/caddyserver/caddy/v2/modules/caddyhttp" |
||||
|
"github.com/golang/groupcache" |
||||
|
) |
||||
|
|
||||
|
func init() { |
||||
|
caddy.RegisterModule(Cache{}) |
||||
|
} |
||||
|
|
||||
|
// Cache implements a simple distributed cache.
|
||||
|
type Cache struct { |
||||
|
group *groupcache.Group |
||||
|
} |
||||
|
|
||||
|
// CaddyModule returns the Caddy module information.
|
||||
|
func (Cache) CaddyModule() caddy.ModuleInfo { |
||||
|
return caddy.ModuleInfo{ |
||||
|
Name: "http.handlers.cache", |
||||
|
New: func() caddy.Module { return new(Cache) }, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Provision provisions c.
|
||||
|
func (c *Cache) Provision(ctx caddy.Context) error { |
||||
|
// TODO: proper pool configuration
|
||||
|
me := "http://localhost:5555" |
||||
|
// TODO: Make max size configurable
|
||||
|
maxSize := int64(512 << 20) |
||||
|
poolMu.Lock() |
||||
|
if pool == nil { |
||||
|
pool = groupcache.NewHTTPPool(me) |
||||
|
c.group = groupcache.NewGroup(groupName, maxSize, groupcache.GetterFunc(c.getter)) |
||||
|
} else { |
||||
|
c.group = groupcache.GetGroup(groupName) |
||||
|
} |
||||
|
pool.Set(me) |
||||
|
poolMu.Unlock() |
||||
|
|
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
// Validate validates c.
|
||||
|
func (c *Cache) Validate() error { |
||||
|
// TODO: implement
|
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
func (c *Cache) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error { |
||||
|
// TODO: proper RFC implementation of cache control headers...
|
||||
|
if r.Header.Get("Cache-Control") == "no-cache" || r.Method != "GET" { |
||||
|
return next.ServeHTTP(w, r) |
||||
|
} |
||||
|
|
||||
|
ctx := getterContext{w, r, next} |
||||
|
|
||||
|
// TODO: rigorous performance testing
|
||||
|
|
||||
|
// TODO: pretty much everything else to handle the nuances of HTTP caching...
|
||||
|
|
||||
|
// TODO: groupcache has no explicit cache eviction, so we need to embed
|
||||
|
// all information related to expiring cache entries into the key; right
|
||||
|
// now we just use the request URI as a proof-of-concept
|
||||
|
key := r.RequestURI |
||||
|
|
||||
|
var cachedBytes []byte |
||||
|
err := c.group.Get(ctx, key, groupcache.AllocatingByteSliceSink(&cachedBytes)) |
||||
|
if err == errUncacheable { |
||||
|
return nil |
||||
|
} |
||||
|
if err != nil { |
||||
|
return err |
||||
|
} |
||||
|
|
||||
|
// the cached bytes consists of two parts: first a
|
||||
|
// gob encoding of the status and header, immediately
|
||||
|
// followed by the raw bytes of the response body
|
||||
|
rdr := bytes.NewReader(cachedBytes) |
||||
|
|
||||
|
// read the header and status first
|
||||
|
var hs headerAndStatus |
||||
|
err = gob.NewDecoder(rdr).Decode(&hs) |
||||
|
if err != nil { |
||||
|
return err |
||||
|
} |
||||
|
|
||||
|
// set and write the cached headers
|
||||
|
for k, v := range hs.Header { |
||||
|
w.Header()[k] = v |
||||
|
} |
||||
|
w.WriteHeader(hs.Status) |
||||
|
|
||||
|
// write the cached response body
|
||||
|
io.Copy(w, rdr) |
||||
|
|
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
func (c *Cache) getter(ctx groupcache.Context, key string, dest groupcache.Sink) error { |
||||
|
combo := ctx.(getterContext) |
||||
|
|
||||
|
// the buffer will store the gob-encoded header, then the body
|
||||
|
buf := bufPool.Get().(*bytes.Buffer) |
||||
|
buf.Reset() |
||||
|
defer bufPool.Put(buf) |
||||
|
|
||||
|
// we need to record the response if we are to cache it; only cache if
|
||||
|
// request is successful (TODO: there's probably much more nuance needed here)
|
||||
|
var rr caddyhttp.ResponseRecorder |
||||
|
rr = caddyhttp.NewResponseRecorder(combo.rw, buf, func(status int) bool { |
||||
|
shouldBuf := status < 300 |
||||
|
|
||||
|
if shouldBuf { |
||||
|
// store the header before the body, so we can efficiently
|
||||
|
// and conveniently use a single buffer for both; gob
|
||||
|
// decoder will only read up to end of gob message, and
|
||||
|
// the rest will be the body, which will be written
|
||||
|
// implicitly for us by the recorder
|
||||
|
err := gob.NewEncoder(buf).Encode(headerAndStatus{ |
||||
|
Header: rr.Header(), |
||||
|
Status: status, |
||||
|
}) |
||||
|
if err != nil { |
||||
|
log.Printf("[ERROR] Encoding headers for cache entry: %v; not caching this request", err) |
||||
|
return false |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return shouldBuf |
||||
|
}) |
||||
|
|
||||
|
// execute next handlers in chain
|
||||
|
err := combo.next.ServeHTTP(rr, combo.req) |
||||
|
if err != nil { |
||||
|
return err |
||||
|
} |
||||
|
|
||||
|
// if response body was not buffered, response was
|
||||
|
// already written and we are unable to cache
|
||||
|
if !rr.Buffered() { |
||||
|
return errUncacheable |
||||
|
} |
||||
|
|
||||
|
// add to cache
|
||||
|
dest.SetBytes(buf.Bytes()) |
||||
|
|
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
type headerAndStatus struct { |
||||
|
Header http.Header |
||||
|
Status int |
||||
|
} |
||||
|
|
||||
|
type getterContext struct { |
||||
|
rw http.ResponseWriter |
||||
|
req *http.Request |
||||
|
next caddyhttp.Handler |
||||
|
} |
||||
|
|
||||
|
var bufPool = sync.Pool{ |
||||
|
New: func() interface{} { |
||||
|
return new(bytes.Buffer) |
||||
|
}, |
||||
|
} |
||||
|
|
||||
|
var ( |
||||
|
pool *groupcache.HTTPPool |
||||
|
poolMu sync.Mutex |
||||
|
) |
||||
|
|
||||
|
var errUncacheable = fmt.Errorf("uncacheable") |
||||
|
|
||||
|
const groupName = "http_requests" |
||||
|
|
||||
|
// Interface guards
|
||||
|
var ( |
||||
|
_ caddy.Provisioner = (*Cache)(nil) |
||||
|
_ caddy.Validator = (*Cache)(nil) |
||||
|
_ caddyhttp.MiddlewareHandler = (*Cache)(nil) |
||||
|
) |
@ -0,0 +1,152 @@ |
|||||
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
|
//
|
||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
// you may not use this file except in compliance with the License.
|
||||
|
// You may obtain a copy of the License at
|
||||
|
//
|
||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
//
|
||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
|
// See the License for the specific language governing permissions and
|
||||
|
// limitations under the License.
|
||||
|
|
||||
|
package reverseproxy |
||||
|
|
||||
|
import ( |
||||
|
"fmt" |
||||
|
"sync/atomic" |
||||
|
"time" |
||||
|
|
||||
|
"github.com/caddyserver/caddy/v2" |
||||
|
"github.com/vulcand/oxy/memmetrics" |
||||
|
) |
||||
|
|
||||
|
func init() { |
||||
|
caddy.RegisterModule(localCircuitBreaker{}) |
||||
|
} |
||||
|
|
||||
|
// localCircuitBreaker implements circuit breaking functionality
|
||||
|
// for requests within this process over a sliding time window.
|
||||
|
type localCircuitBreaker struct { |
||||
|
tripped int32 |
||||
|
cbType int32 |
||||
|
threshold float64 |
||||
|
metrics *memmetrics.RTMetrics |
||||
|
tripTime time.Duration |
||||
|
Config |
||||
|
} |
||||
|
|
||||
|
// CaddyModule returns the Caddy module information.
|
||||
|
func (localCircuitBreaker) CaddyModule() caddy.ModuleInfo { |
||||
|
return caddy.ModuleInfo{ |
||||
|
Name: "http.handlers.reverse_proxy.circuit_breakers.local", |
||||
|
New: func() caddy.Module { return new(localCircuitBreaker) }, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Provision sets up a configured circuit breaker.
|
||||
|
func (c *localCircuitBreaker) Provision(ctx caddy.Context) error { |
||||
|
t, ok := typeCB[c.Type] |
||||
|
if !ok { |
||||
|
return fmt.Errorf("type is not defined") |
||||
|
} |
||||
|
|
||||
|
if c.TripTime == "" { |
||||
|
c.TripTime = defaultTripTime |
||||
|
} |
||||
|
|
||||
|
tw, err := time.ParseDuration(c.TripTime) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("cannot parse trip_time duration, %v", err.Error()) |
||||
|
} |
||||
|
|
||||
|
mt, err := memmetrics.NewRTMetrics() |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("cannot create new metrics: %v", err.Error()) |
||||
|
} |
||||
|
|
||||
|
c.cbType = t |
||||
|
c.tripTime = tw |
||||
|
c.threshold = c.Threshold |
||||
|
c.metrics = mt |
||||
|
c.tripped = 0 |
||||
|
|
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
// Ok returns whether the circuit breaker is tripped or not.
|
||||
|
func (c *localCircuitBreaker) Ok() bool { |
||||
|
tripped := atomic.LoadInt32(&c.tripped) |
||||
|
return tripped == 0 |
||||
|
} |
||||
|
|
||||
|
// RecordMetric records a response status code and execution time of a request. This function should be run in a separate goroutine.
|
||||
|
func (c *localCircuitBreaker) RecordMetric(statusCode int, latency time.Duration) { |
||||
|
c.metrics.Record(statusCode, latency) |
||||
|
c.checkAndSet() |
||||
|
} |
||||
|
|
||||
|
// Ok checks our metrics to see if we should trip our circuit breaker, or if the fallback duration has completed.
|
||||
|
func (c *localCircuitBreaker) checkAndSet() { |
||||
|
var isTripped bool |
||||
|
|
||||
|
switch c.cbType { |
||||
|
case typeErrorRatio: |
||||
|
// check if amount of network errors exceed threshold over sliding window, threshold for comparison should be < 1.0 i.e. .5 = 50th percentile
|
||||
|
if c.metrics.NetworkErrorRatio() > c.threshold { |
||||
|
isTripped = true |
||||
|
} |
||||
|
case typeLatency: |
||||
|
// check if threshold in milliseconds is reached and trip
|
||||
|
hist, err := c.metrics.LatencyHistogram() |
||||
|
if err != nil { |
||||
|
return |
||||
|
} |
||||
|
|
||||
|
l := hist.LatencyAtQuantile(c.threshold) |
||||
|
if l.Nanoseconds()/int64(time.Millisecond) > int64(c.threshold) { |
||||
|
isTripped = true |
||||
|
} |
||||
|
case typeStatusCodeRatio: |
||||
|
// check ratio of error status codes of sliding window, threshold for comparison should be < 1.0 i.e. .5 = 50th percentile
|
||||
|
if c.metrics.ResponseCodeRatio(500, 600, 0, 600) > c.threshold { |
||||
|
isTripped = true |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
if isTripped { |
||||
|
c.metrics.Reset() |
||||
|
atomic.AddInt32(&c.tripped, 1) |
||||
|
|
||||
|
// wait tripTime amount before allowing operations to resume.
|
||||
|
t := time.NewTimer(c.tripTime) |
||||
|
<-t.C |
||||
|
|
||||
|
atomic.AddInt32(&c.tripped, -1) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Config represents the configuration of a circuit breaker.
|
||||
|
type Config struct { |
||||
|
Threshold float64 `json:"threshold"` |
||||
|
Type string `json:"type"` |
||||
|
TripTime string `json:"trip_time"` |
||||
|
} |
||||
|
|
||||
|
const ( |
||||
|
typeLatency = iota + 1 |
||||
|
typeErrorRatio |
||||
|
typeStatusCodeRatio |
||||
|
defaultTripTime = "5s" |
||||
|
) |
||||
|
|
||||
|
var ( |
||||
|
// typeCB handles converting a Config Type value to the internal circuit breaker types.
|
||||
|
typeCB = map[string]int32{ |
||||
|
"latency": typeLatency, |
||||
|
"error_ratio": typeErrorRatio, |
||||
|
"status_ratio": typeStatusCodeRatio, |
||||
|
} |
||||
|
) |
@ -0,0 +1,19 @@ |
|||||
|
{ |
||||
|
"apps": { |
||||
|
"http": { |
||||
|
"servers": { |
||||
|
"MY_SERVER": { |
||||
|
"listen": [":3001"], |
||||
|
"routes": [ |
||||
|
{ |
||||
|
"handle": { |
||||
|
"handler": "starlark", |
||||
|
"script": "def setup(r):\n\t# create some middlewares specific to this request\n\ttemplates = loadModule('http.handlers.templates', {'include_root': './includes'})\n\tmidChain = execute([templates])\n\ndef serveHTTP (rw, r):\n\trw.Write('Hello world, from Starlark!')\n" |
||||
|
} |
||||
|
} |
||||
|
] |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
} |
@ -0,0 +1,165 @@ |
|||||
|
package lib |
||||
|
|
||||
|
import ( |
||||
|
"encoding/json" |
||||
|
"fmt" |
||||
|
"strings" |
||||
|
|
||||
|
"github.com/caddyserver/caddy/v2/modules/caddyhttp" |
||||
|
|
||||
|
"github.com/caddyserver/caddy/v2" |
||||
|
"go.starlark.net/starlark" |
||||
|
) |
||||
|
|
||||
|
// ResponderModule represents a module that satisfies the caddyhttp handler.
|
||||
|
type ResponderModule struct { |
||||
|
Name string |
||||
|
Cfg json.RawMessage |
||||
|
Instance caddyhttp.Handler |
||||
|
} |
||||
|
|
||||
|
func (r ResponderModule) Freeze() {} |
||||
|
func (r ResponderModule) Hash() (uint32, error) { return 0, fmt.Errorf("unhashable: responder module") } |
||||
|
func (r ResponderModule) String() string { return "responder module" } |
||||
|
func (r ResponderModule) Type() string { return "responder module" } |
||||
|
func (r ResponderModule) Truth() starlark.Bool { return true } |
||||
|
|
||||
|
// Middleware represents a module that satisfies the starlark Value interface.
|
||||
|
type Middleware struct { |
||||
|
Name string |
||||
|
Cfg json.RawMessage |
||||
|
Instance caddyhttp.MiddlewareHandler |
||||
|
} |
||||
|
|
||||
|
func (r Middleware) Freeze() {} |
||||
|
func (r Middleware) Hash() (uint32, error) { return 0, fmt.Errorf("unhashable: middleware") } |
||||
|
func (r Middleware) String() string { return "middleware" } |
||||
|
func (r Middleware) Type() string { return "middleware" } |
||||
|
func (r Middleware) Truth() starlark.Bool { return true } |
||||
|
|
||||
|
// LoadMiddleware represents the method exposed to starlark to load a Caddy module.
|
||||
|
type LoadMiddleware struct { |
||||
|
Middleware Middleware |
||||
|
Ctx caddy.Context |
||||
|
} |
||||
|
|
||||
|
func (r LoadMiddleware) Freeze() {} |
||||
|
func (r LoadMiddleware) Hash() (uint32, error) { return 0, fmt.Errorf("unhashable: loadMiddleware") } |
||||
|
func (r LoadMiddleware) String() string { return "loadMiddleware" } |
||||
|
func (r LoadMiddleware) Type() string { return "function: loadMiddleware" } |
||||
|
func (r LoadMiddleware) Truth() starlark.Bool { return true } |
||||
|
|
||||
|
// Run is the method bound to the starlark loadMiddleware function.
|
||||
|
func (r *LoadMiddleware) Run(thread *starlark.Thread, fn *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) { |
||||
|
var name string |
||||
|
var cfg *starlark.Dict |
||||
|
err := starlark.UnpackPositionalArgs(fn.Name(), args, kwargs, 2, &name, &cfg) |
||||
|
if err != nil { |
||||
|
return starlark.None, fmt.Errorf("unpacking arguments: %v", err.Error()) |
||||
|
} |
||||
|
|
||||
|
js := json.RawMessage(cfg.String()) |
||||
|
|
||||
|
if strings.Index(name, "http.handlers.") == -1 { |
||||
|
name = fmt.Sprintf("http.handlers.%s", name) |
||||
|
} |
||||
|
|
||||
|
inst, err := r.Ctx.LoadModule(name, js) |
||||
|
if err != nil { |
||||
|
return starlark.None, err |
||||
|
} |
||||
|
|
||||
|
mid, ok := inst.(caddyhttp.MiddlewareHandler) |
||||
|
if !ok { |
||||
|
return starlark.None, fmt.Errorf("could not assert as middleware handler") |
||||
|
} |
||||
|
|
||||
|
m := Middleware{ |
||||
|
Name: name, |
||||
|
Cfg: js, |
||||
|
Instance: mid, |
||||
|
} |
||||
|
|
||||
|
r.Middleware = m |
||||
|
|
||||
|
return m, nil |
||||
|
} |
||||
|
|
||||
|
// LoadResponder represents the method exposed to starlark to load a Caddy middleware responder.
|
||||
|
type LoadResponder struct { |
||||
|
Module ResponderModule |
||||
|
Ctx caddy.Context |
||||
|
} |
||||
|
|
||||
|
func (r LoadResponder) Freeze() {} |
||||
|
func (r LoadResponder) Hash() (uint32, error) { return 0, fmt.Errorf("unhashable: loadModule") } |
||||
|
func (r LoadResponder) String() string { return "loadModule" } |
||||
|
func (r LoadResponder) Type() string { return "function: loadModule" } |
||||
|
func (r LoadResponder) Truth() starlark.Bool { return true } |
||||
|
|
||||
|
// Run is the method bound to the starlark loadResponder function.
|
||||
|
func (r *LoadResponder) Run(thread *starlark.Thread, fn *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) { |
||||
|
var name string |
||||
|
var cfg *starlark.Dict |
||||
|
err := starlark.UnpackPositionalArgs(fn.Name(), args, kwargs, 2, &name, &cfg) |
||||
|
if err != nil { |
||||
|
return starlark.None, fmt.Errorf("unpacking arguments: %v", err.Error()) |
||||
|
} |
||||
|
|
||||
|
js := json.RawMessage(cfg.String()) |
||||
|
|
||||
|
if strings.Index(name, "http.handlers.") == -1 { |
||||
|
name = fmt.Sprintf("http.handlers.%s", name) |
||||
|
} |
||||
|
|
||||
|
inst, err := r.Ctx.LoadModule(name, js) |
||||
|
if err != nil { |
||||
|
return starlark.None, err |
||||
|
} |
||||
|
|
||||
|
res, ok := inst.(caddyhttp.Handler) |
||||
|
if !ok { |
||||
|
return starlark.None, fmt.Errorf("could not assert as responder") |
||||
|
} |
||||
|
|
||||
|
m := ResponderModule{ |
||||
|
Name: name, |
||||
|
Cfg: js, |
||||
|
Instance: res, |
||||
|
} |
||||
|
|
||||
|
r.Module = m |
||||
|
|
||||
|
return m, nil |
||||
|
} |
||||
|
|
||||
|
// Execute represents the method exposed to starlark to build a middleware chain.
|
||||
|
type Execute struct { |
||||
|
Modules []Middleware |
||||
|
} |
||||
|
|
||||
|
func (r Execute) Freeze() {} |
||||
|
func (r Execute) Hash() (uint32, error) { return 0, fmt.Errorf("unhashable: execute") } |
||||
|
func (r Execute) String() string { return "execute" } |
||||
|
func (r Execute) Type() string { return "function: execute" } |
||||
|
func (r Execute) Truth() starlark.Bool { return true } |
||||
|
|
||||
|
// Run is the method bound to the starlark execute function.
|
||||
|
func (r *Execute) Run(thread *starlark.Thread, fn *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) { |
||||
|
var mids *starlark.List |
||||
|
err := starlark.UnpackPositionalArgs(fn.Name(), args, kwargs, 1, &mids) |
||||
|
if err != nil { |
||||
|
return starlark.None, fmt.Errorf("unpacking arguments: %v", err.Error()) |
||||
|
} |
||||
|
|
||||
|
for i := 0; i < mids.Len(); i++ { |
||||
|
val, ok := mids.Index(i).(Middleware) |
||||
|
if !ok { |
||||
|
return starlark.None, fmt.Errorf("cannot get module from execute") |
||||
|
} |
||||
|
|
||||
|
r.Modules = append(r.Modules, val) |
||||
|
} |
||||
|
|
||||
|
return starlark.None, nil |
||||
|
} |
@ -0,0 +1,172 @@ |
|||||
|
package starlarkmw |
||||
|
|
||||
|
import ( |
||||
|
"context" |
||||
|
"fmt" |
||||
|
"net/http" |
||||
|
|
||||
|
"github.com/caddyserver/caddy/v2" |
||||
|
"github.com/caddyserver/caddy/v2/modules/caddyhttp" |
||||
|
caddyscript "github.com/caddyserver/caddy/v2/pkg/caddyscript/lib" |
||||
|
"github.com/caddyserver/caddy/v2/modules/caddyhttp/starlarkmw/internal/lib" |
||||
|
"github.com/starlight-go/starlight/convert" |
||||
|
"go.starlark.net/starlark" |
||||
|
) |
||||
|
|
||||
|
func init() { |
||||
|
caddy.RegisterModule(StarlarkMW{}) |
||||
|
} |
||||
|
|
||||
|
// StarlarkMW represents a middleware responder written in starlark
|
||||
|
type StarlarkMW struct { |
||||
|
Script string `json:"script"` |
||||
|
serveHTTP *starlark.Function |
||||
|
setup *starlark.Function |
||||
|
thread *starlark.Thread |
||||
|
loadMiddleware *lib.LoadMiddleware |
||||
|
execute *lib.Execute |
||||
|
globals *starlark.StringDict |
||||
|
gctx caddy.Context |
||||
|
rctx caddy.Context |
||||
|
rcancel context.CancelFunc |
||||
|
} |
||||
|
|
||||
|
// CaddyModule returns the Caddy module information.
|
||||
|
func (StarlarkMW) CaddyModule() caddy.ModuleInfo { |
||||
|
return caddy.ModuleInfo{ |
||||
|
Name: "http.handlers.starlark", |
||||
|
New: func() caddy.Module { return new(StarlarkMW) }, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// ServeHTTP responds to an http request with starlark.
|
||||
|
func (s *StarlarkMW) ServeHTTP(w http.ResponseWriter, r *http.Request) error { |
||||
|
var mwcancel context.CancelFunc |
||||
|
var mwctx caddy.Context |
||||
|
|
||||
|
// call setup() to prepare the middleware chain if it is defined
|
||||
|
if s.setup != nil { |
||||
|
mwctx, mwcancel = caddy.NewContext(s.gctx) |
||||
|
defer mwcancel() |
||||
|
|
||||
|
s.loadMiddleware.Ctx = mwctx |
||||
|
args := starlark.Tuple{caddyscript.HTTPRequest{Req: r}} |
||||
|
|
||||
|
_, err := starlark.Call(new(starlark.Thread), s.setup, args, nil) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("starlark setup(), %v", err) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// dynamically build middleware chain for each request
|
||||
|
stack := caddyhttp.HandlerFunc(func(w http.ResponseWriter, r *http.Request) error { |
||||
|
wr, err := convert.ToValue(w) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("cannot convert response writer to starlark value") |
||||
|
} |
||||
|
|
||||
|
args := starlark.Tuple{wr, caddyscript.HTTPRequest{Req: r}} |
||||
|
v, err := starlark.Call(new(starlark.Thread), s.serveHTTP, args, nil) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("starlark serveHTTP(), %v", err) |
||||
|
} |
||||
|
|
||||
|
// if a responder type was returned from starlark we should run it otherwise it
|
||||
|
// is expected to handle the request
|
||||
|
if resp, ok := v.(lib.ResponderModule); ok { |
||||
|
return resp.Instance.ServeHTTP(w, r) |
||||
|
} |
||||
|
|
||||
|
return nil |
||||
|
}) |
||||
|
|
||||
|
// TODO :- make middlewareResponseWriter exported and wrap w with that
|
||||
|
var mid []caddyhttp.Middleware |
||||
|
for _, m := range s.execute.Modules { |
||||
|
mid = append(mid, func(next caddyhttp.HandlerFunc) caddyhttp.HandlerFunc { |
||||
|
return func(w http.ResponseWriter, r *http.Request) error { |
||||
|
return m.Instance.ServeHTTP(w, r, next) |
||||
|
} |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
for i := len(mid) - 1; i >= 0; i-- { |
||||
|
stack = mid[i](stack) |
||||
|
} |
||||
|
|
||||
|
s.execute.Modules = nil |
||||
|
|
||||
|
return stack(w, r) |
||||
|
} |
||||
|
|
||||
|
// Cleanup cleans up any modules loaded during the creation of a starlark route.
|
||||
|
func (s *StarlarkMW) Cleanup() error { |
||||
|
s.rcancel() |
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
// Provision sets up the starlark env.
|
||||
|
func (s *StarlarkMW) Provision(ctx caddy.Context) error { |
||||
|
// store global context
|
||||
|
s.gctx = ctx |
||||
|
|
||||
|
// setup context for cleaning up any modules loaded during starlark script parsing phase
|
||||
|
rctx, cancel := caddy.NewContext(ctx) |
||||
|
s.rcancel = cancel |
||||
|
|
||||
|
// setup starlark global env
|
||||
|
env := make(starlark.StringDict) |
||||
|
loadMiddleware := lib.LoadMiddleware{} |
||||
|
loadResponder := lib.LoadResponder{ |
||||
|
Ctx: rctx, |
||||
|
} |
||||
|
execute := lib.Execute{} |
||||
|
|
||||
|
lr := starlark.NewBuiltin("loadResponder", loadResponder.Run) |
||||
|
lr = lr.BindReceiver(&loadResponder) |
||||
|
env["loadResponder"] = lr |
||||
|
|
||||
|
lm := starlark.NewBuiltin("loadMiddleware", loadMiddleware.Run) |
||||
|
lm = lm.BindReceiver(&loadMiddleware) |
||||
|
env["loadMiddleware"] = lm |
||||
|
|
||||
|
ex := starlark.NewBuiltin("execute", execute.Run) |
||||
|
ex = ex.BindReceiver(&execute) |
||||
|
env["execute"] = ex |
||||
|
|
||||
|
// import caddyscript lib
|
||||
|
env["time"] = caddyscript.Time{} |
||||
|
env["regexp"] = caddyscript.Regexp{} |
||||
|
|
||||
|
// configure starlark
|
||||
|
thread := new(starlark.Thread) |
||||
|
s.thread = thread |
||||
|
|
||||
|
// run starlark script
|
||||
|
globals, err := starlark.ExecFile(thread, "", s.Script, env) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("starlark exec file: %v", err.Error()) |
||||
|
} |
||||
|
|
||||
|
// extract defined methods to setup middleware chain and responder, setup is not required
|
||||
|
var setup *starlark.Function |
||||
|
if _, ok := globals["setup"]; ok { |
||||
|
setup, ok = globals["setup"].(*starlark.Function) |
||||
|
if !ok { |
||||
|
return fmt.Errorf("setup function not defined in starlark script") |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
serveHTTP, ok := globals["serveHTTP"].(*starlark.Function) |
||||
|
if !ok { |
||||
|
return fmt.Errorf("serveHTTP function not defined in starlark script") |
||||
|
} |
||||
|
|
||||
|
s.setup = setup |
||||
|
s.serveHTTP = serveHTTP |
||||
|
s.loadMiddleware = &loadMiddleware |
||||
|
s.execute = &execute |
||||
|
s.globals = &globals |
||||
|
|
||||
|
return nil |
||||
|
} |
@ -0,0 +1,40 @@ |
|||||
|
# any module that provisions resources |
||||
|
proxyConfig = { |
||||
|
'load_balance_type': 'round_robin', |
||||
|
'upstreams': [ |
||||
|
{ |
||||
|
'host': 'http://localhost:8080', |
||||
|
'circuit_breaker': { |
||||
|
'type': 'status_ratio', |
||||
|
'threshold': 0.5 |
||||
|
} |
||||
|
}, |
||||
|
{ |
||||
|
'host': 'http://localhost:8081' |
||||
|
} |
||||
|
] |
||||
|
} |
||||
|
|
||||
|
sfConfig = { |
||||
|
'root': '/Users/dev/Desktop', |
||||
|
'browse': {}, |
||||
|
} |
||||
|
|
||||
|
proxy = loadResponder('reverse_proxy', proxyConfig) |
||||
|
static_files = loadResponder('file_server', sfConfig) |
||||
|
|
||||
|
def setup(r): |
||||
|
# create some middlewares specific to this request |
||||
|
mid = [] |
||||
|
|
||||
|
if r.query.get('log') == 'true': |
||||
|
logMid = loadMiddleware('log', {'file': 'access.log'}) |
||||
|
mid.append(logMid) |
||||
|
|
||||
|
execute(mid) |
||||
|
|
||||
|
def serveHTTP(w, r): |
||||
|
if r.url.find('static') > 0: |
||||
|
return static_files |
||||
|
|
||||
|
return proxy |
@ -0,0 +1,71 @@ |
|||||
|
package caddytls |
||||
|
|
||||
|
import ( |
||||
|
"crypto/tls" |
||||
|
"crypto/x509" |
||||
|
"fmt" |
||||
|
"math/big" |
||||
|
|
||||
|
"github.com/caddyserver/caddy/v2" |
||||
|
"github.com/mholt/certmagic" |
||||
|
) |
||||
|
|
||||
|
func init() { |
||||
|
caddy.RegisterModule(Policy{}) |
||||
|
} |
||||
|
|
||||
|
// Policy represents a policy for selecting the certificate used to
|
||||
|
// complete a handshake when there may be multiple options. All fields
|
||||
|
// specified must match the candidate certificate for it to be chosen.
|
||||
|
// This was needed to solve https://github.com/caddyserver/caddy/issues/2588.
|
||||
|
type Policy struct { |
||||
|
SerialNumber *big.Int `json:"serial_number,omitempty"` |
||||
|
SubjectOrganization string `json:"subject_organization,omitempty"` |
||||
|
PublicKeyAlgorithm PublicKeyAlgorithm `json:"public_key_algorithm,omitempty"` |
||||
|
Tag string `json:"tag,omitempty"` |
||||
|
} |
||||
|
|
||||
|
// CaddyModule returns the Caddy module information.
|
||||
|
func (Policy) CaddyModule() caddy.ModuleInfo { |
||||
|
return caddy.ModuleInfo{ |
||||
|
Name: "tls.certificate_selection.custom", |
||||
|
New: func() caddy.Module { return new(Policy) }, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// SelectCertificate implements certmagic.CertificateSelector.
|
||||
|
func (p Policy) SelectCertificate(_ *tls.ClientHelloInfo, choices []certmagic.Certificate) (certmagic.Certificate, error) { |
||||
|
for _, cert := range choices { |
||||
|
if p.SerialNumber != nil && cert.SerialNumber.Cmp(p.SerialNumber) != 0 { |
||||
|
continue |
||||
|
} |
||||
|
|
||||
|
if p.PublicKeyAlgorithm != PublicKeyAlgorithm(x509.UnknownPublicKeyAlgorithm) && |
||||
|
PublicKeyAlgorithm(cert.PublicKeyAlgorithm) != p.PublicKeyAlgorithm { |
||||
|
continue |
||||
|
} |
||||
|
|
||||
|
if p.SubjectOrganization != "" { |
||||
|
var matchOrg bool |
||||
|
for _, org := range cert.Subject.Organization { |
||||
|
if p.SubjectOrganization == org { |
||||
|
matchOrg = true |
||||
|
break |
||||
|
} |
||||
|
} |
||||
|
if !matchOrg { |
||||
|
continue |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
if p.Tag != "" && !cert.HasTag(p.Tag) { |
||||
|
continue |
||||
|
} |
||||
|
|
||||
|
return cert, nil |
||||
|
} |
||||
|
return certmagic.Certificate{}, fmt.Errorf("no certificates matched custom selection policy") |
||||
|
} |
||||
|
|
||||
|
// Interface guard
|
||||
|
var _ certmagic.CertificateSelector = (*Policy)(nil) |
@ -0,0 +1,228 @@ |
|||||
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
|
//
|
||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
// you may not use this file except in compliance with the License.
|
||||
|
// You may obtain a copy of the License at
|
||||
|
//
|
||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
//
|
||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
|
// See the License for the specific language governing permissions and
|
||||
|
// limitations under the License.
|
||||
|
|
||||
|
// Package distributedstek provides TLS session ticket ephemeral
|
||||
|
// keys (STEKs) in a distributed fashion by utilizing configured
|
||||
|
// storage for locking and key sharing. This allows a cluster of
|
||||
|
// machines to optimally resume TLS sessions in a load-balanced
|
||||
|
// environment without any hassle. This is similar to what
|
||||
|
// Twitter does, but without needing to rely on SSH, as it is
|
||||
|
// built into the web server this way:
|
||||
|
// https://blog.twitter.com/engineering/en_us/a/2013/forward-secrecy-at-twitter.html
|
||||
|
package distributedstek |
||||
|
|
||||
|
import ( |
||||
|
"bytes" |
||||
|
"encoding/gob" |
||||
|
"encoding/json" |
||||
|
"fmt" |
||||
|
"log" |
||||
|
"time" |
||||
|
|
||||
|
"github.com/caddyserver/caddy/v2" |
||||
|
"github.com/caddyserver/caddy/v2/modules/caddytls" |
||||
|
"github.com/mholt/certmagic" |
||||
|
) |
||||
|
|
||||
|
func init() { |
||||
|
caddy.RegisterModule(Provider{}) |
||||
|
} |
||||
|
|
||||
|
// Provider implements a distributed STEK provider.
|
||||
|
type Provider struct { |
||||
|
Storage json.RawMessage `json:"storage,omitempty"` |
||||
|
|
||||
|
storage certmagic.Storage |
||||
|
stekConfig *caddytls.SessionTicketService |
||||
|
timer *time.Timer |
||||
|
} |
||||
|
|
||||
|
// CaddyModule returns the Caddy module information.
|
||||
|
func (Provider) CaddyModule() caddy.ModuleInfo { |
||||
|
return caddy.ModuleInfo{ |
||||
|
Name: "tls.stek.distributed", |
||||
|
New: func() caddy.Module { return new(Provider) }, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Provision provisions s.
|
||||
|
func (s *Provider) Provision(ctx caddy.Context) error { |
||||
|
// unpack the storage module to use, if different from the default
|
||||
|
if s.Storage != nil { |
||||
|
val, err := ctx.LoadModuleInline("module", "caddy.storage", s.Storage) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("loading TLS storage module: %s", err) |
||||
|
} |
||||
|
cmStorage, err := val.(caddy.StorageConverter).CertMagicStorage() |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("creating TLS storage configuration: %v", err) |
||||
|
} |
||||
|
s.storage = cmStorage |
||||
|
s.Storage = nil // allow GC to deallocate
|
||||
|
} |
||||
|
|
||||
|
// otherwise, use default storage
|
||||
|
if s.storage == nil { |
||||
|
s.storage = ctx.Storage() |
||||
|
} |
||||
|
|
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
// Initialize sets the configuration for s and returns the starting keys.
|
||||
|
func (s *Provider) Initialize(config *caddytls.SessionTicketService) ([][32]byte, error) { |
||||
|
// keep a reference to the config; we'll need it when rotating keys
|
||||
|
s.stekConfig = config |
||||
|
|
||||
|
dstek, err := s.getSTEK() |
||||
|
if err != nil { |
||||
|
return nil, err |
||||
|
} |
||||
|
|
||||
|
// create timer for the remaining time on the interval;
|
||||
|
// this timer is cleaned up only when rotate() returns
|
||||
|
s.timer = time.NewTimer(time.Until(dstek.NextRotation)) |
||||
|
|
||||
|
return dstek.Keys, nil |
||||
|
} |
||||
|
|
||||
|
// Next returns a channel which transmits the latest session ticket keys.
|
||||
|
func (s *Provider) Next(doneChan <-chan struct{}) <-chan [][32]byte { |
||||
|
keysChan := make(chan [][32]byte) |
||||
|
go s.rotate(doneChan, keysChan) |
||||
|
return keysChan |
||||
|
} |
||||
|
|
||||
|
func (s *Provider) loadSTEK() (distributedSTEK, error) { |
||||
|
var sg distributedSTEK |
||||
|
gobBytes, err := s.storage.Load(stekFileName) |
||||
|
if err != nil { |
||||
|
return sg, err // don't wrap, in case error is certmagic.ErrNotExist
|
||||
|
} |
||||
|
dec := gob.NewDecoder(bytes.NewReader(gobBytes)) |
||||
|
err = dec.Decode(&sg) |
||||
|
if err != nil { |
||||
|
return sg, fmt.Errorf("STEK gob corrupted: %v", err) |
||||
|
} |
||||
|
return sg, nil |
||||
|
} |
||||
|
|
||||
|
func (s *Provider) storeSTEK(dstek distributedSTEK) error { |
||||
|
var buf bytes.Buffer |
||||
|
err := gob.NewEncoder(&buf).Encode(dstek) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("encoding STEK gob: %v", err) |
||||
|
} |
||||
|
err = s.storage.Store(stekFileName, buf.Bytes()) |
||||
|
if err != nil { |
||||
|
return fmt.Errorf("storing STEK gob: %v", err) |
||||
|
} |
||||
|
return nil |
||||
|
} |
||||
|
|
||||
|
// getSTEK locks and loads the current STEK from storage. If none
|
||||
|
// currently exists, a new STEK is created and persisted. If the
|
||||
|
// current STEK is outdated (NextRotation time is in the past),
|
||||
|
// then it is rotated and persisted. The resulting STEK is returned.
|
||||
|
func (s *Provider) getSTEK() (distributedSTEK, error) { |
||||
|
s.storage.Lock(stekLockName) |
||||
|
defer s.storage.Unlock(stekLockName) |
||||
|
|
||||
|
// load the current STEKs from storage
|
||||
|
dstek, err := s.loadSTEK() |
||||
|
if _, isNotExist := err.(certmagic.ErrNotExist); isNotExist { |
||||
|
// if there is none, then make some right away
|
||||
|
dstek, err = s.rotateKeys(dstek) |
||||
|
if err != nil { |
||||
|
return dstek, fmt.Errorf("creating new STEK: %v", err) |
||||
|
} |
||||
|
} else if err != nil { |
||||
|
// some other error, that's a problem
|
||||
|
return dstek, fmt.Errorf("loading STEK: %v", err) |
||||
|
} else if time.Now().After(dstek.NextRotation) { |
||||
|
// if current STEKs are outdated, rotate them
|
||||
|
dstek, err = s.rotateKeys(dstek) |
||||
|
if err != nil { |
||||
|
return dstek, fmt.Errorf("rotating keys: %v", err) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return dstek, nil |
||||
|
} |
||||
|
|
||||
|
// rotateKeys rotates the keys of oldSTEK and returns the new distributedSTEK
|
||||
|
// with updated keys and timestamps. It stores the returned STEK in storage,
|
||||
|
// so this function must only be called in a storage-provided lock.
|
||||
|
func (s *Provider) rotateKeys(oldSTEK distributedSTEK) (distributedSTEK, error) { |
||||
|
var newSTEK distributedSTEK |
||||
|
var err error |
||||
|
|
||||
|
newSTEK.Keys, err = s.stekConfig.RotateSTEKs(oldSTEK.Keys) |
||||
|
if err != nil { |
||||
|
return newSTEK, err |
||||
|
} |
||||
|
|
||||
|
now := time.Now() |
||||
|
newSTEK.LastRotation = now |
||||
|
newSTEK.NextRotation = now.Add(time.Duration(s.stekConfig.RotationInterval)) |
||||
|
|
||||
|
err = s.storeSTEK(newSTEK) |
||||
|
if err != nil { |
||||
|
return newSTEK, err |
||||
|
} |
||||
|
|
||||
|
return newSTEK, nil |
||||
|
} |
||||
|
|
||||
|
// rotate rotates keys on a regular basis, sending each updated set of
|
||||
|
// keys down keysChan, until doneChan is closed.
|
||||
|
func (s *Provider) rotate(doneChan <-chan struct{}, keysChan chan<- [][32]byte) { |
||||
|
for { |
||||
|
select { |
||||
|
case <-s.timer.C: |
||||
|
dstek, err := s.getSTEK() |
||||
|
if err != nil { |
||||
|
// TODO: improve this handling
|
||||
|
log.Printf("[ERROR] Loading STEK: %v", err) |
||||
|
continue |
||||
|
} |
||||
|
|
||||
|
// send the updated keys to the service
|
||||
|
keysChan <- dstek.Keys |
||||
|
|
||||
|
// timer channel is already drained, so reset directly (see godoc)
|
||||
|
s.timer.Reset(time.Until(dstek.NextRotation)) |
||||
|
|
||||
|
case <-doneChan: |
||||
|
// again, see godocs for why timer is stopped this way
|
||||
|
if !s.timer.Stop() { |
||||
|
<-s.timer.C |
||||
|
} |
||||
|
return |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
type distributedSTEK struct { |
||||
|
Keys [][32]byte |
||||
|
LastRotation, NextRotation time.Time |
||||
|
} |
||||
|
|
||||
|
const ( |
||||
|
stekLockName = "stek_check" |
||||
|
stekFileName = "stek/stek.bin" |
||||
|
) |
||||
|
|
||||
|
// Interface guard
|
||||
|
var _ caddytls.STEKProvider = (*Provider)(nil) |
@ -0,0 +1,65 @@ |
|||||
|
// Copyright 2015 Matthew Holt and The Caddy Authors
|
||||
|
//
|
||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
// you may not use this file except in compliance with the License.
|
||||
|
// You may obtain a copy of the License at
|
||||
|
//
|
||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
//
|
||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
|
// See the License for the specific language governing permissions and
|
||||
|
// limitations under the License.
|
||||
|
|
||||
|
package caddytls |
||||
|
|
||||
|
import ( |
||||
|
"crypto/tls" |
||||
|
"fmt" |
||||
|
|
||||
|
"github.com/caddyserver/caddy/v2" |
||||
|
) |
||||
|
|
||||
|
func init() { |
||||
|
caddy.RegisterModule(PEMLoader{}) |
||||
|
} |
||||
|
|
||||
|
// PEMLoader loads certificates and their associated keys by
|
||||
|
// decoding their PEM blocks directly. This has the advantage
|
||||
|
// of not needing to store them on disk at all.
|
||||
|
type PEMLoader []CertKeyPEMPair |
||||
|
|
||||
|
// CaddyModule returns the Caddy module information.
|
||||
|
func (PEMLoader) CaddyModule() caddy.ModuleInfo { |
||||
|
return caddy.ModuleInfo{ |
||||
|
Name: "tls.certificates.load_pem", |
||||
|
New: func() caddy.Module { return PEMLoader{} }, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// CertKeyPEMPair pairs certificate and key PEM blocks.
|
||||
|
type CertKeyPEMPair struct { |
||||
|
CertificatePEM string `json:"certificate"` |
||||
|
KeyPEM string `json:"key"` |
||||
|
Tags []string `json:"tags,omitempty"` |
||||
|
} |
||||
|
|
||||
|
// LoadCertificates returns the certificates contained in pl.
|
||||
|
func (pl PEMLoader) LoadCertificates() ([]Certificate, error) { |
||||
|
var certs []Certificate |
||||
|
for i, pair := range pl { |
||||
|
cert, err := tls.X509KeyPair([]byte(pair.CertificatePEM), []byte(pair.KeyPEM)) |
||||
|
if err != nil { |
||||
|
return nil, fmt.Errorf("PEM pair %d: %v", i, err) |
||||
|
} |
||||
|
certs = append(certs, Certificate{ |
||||
|
Certificate: cert, |
||||
|
Tags: pair.Tags, |
||||
|
}) |
||||
|
} |
||||
|
return certs, nil |
||||
|
} |
||||
|
|
||||
|
// Interface guard
|
||||
|
var _ CertificateLoader = (PEMLoader)(nil) |
Loading…
Reference in new issue