committed by
							
								 GitHub
								GitHub
							
						
					
				
				 15 changed files with 1628 additions and 50 deletions
			
			
		| @ -0,0 +1,358 @@ | |||
| // Copyright 2015 Matthew Holt and The Caddy Authors
 | |||
| //
 | |||
| // Licensed under the Apache License, Version 2.0 (the "License");
 | |||
| // you may not use this file except in compliance with the License.
 | |||
| // You may obtain a copy of the License at
 | |||
| //
 | |||
| //     http://www.apache.org/licenses/LICENSE-2.0
 | |||
| //
 | |||
| // Unless required by applicable law or agreed to in writing, software
 | |||
| // distributed under the License is distributed on an "AS IS" BASIS,
 | |||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 | |||
| // See the License for the specific language governing permissions and
 | |||
| // limitations under the License.
 | |||
| 
 | |||
| package caddy | |||
| 
 | |||
| import ( | |||
| 	"bytes" | |||
| 	"encoding/json" | |||
| 	"fmt" | |||
| 	"log" | |||
| 	"net/http" | |||
| 	"path" | |||
| 	"strconv" | |||
| 	"strings" | |||
| 	"sync" | |||
| ) | |||
| 
 | |||
| func init() { | |||
| 	RegisterModule(router{}) | |||
| } | |||
| 
 | |||
| type router []AdminRoute | |||
| 
 | |||
| // CaddyModule returns the Caddy module information.
 | |||
| func (router) CaddyModule() ModuleInfo { | |||
| 	return ModuleInfo{ | |||
| 		Name: "admin.routers.dynamic_config", | |||
| 		New: func() Module { | |||
| 			return router{ | |||
| 				{ | |||
| 					Pattern: "/" + rawConfigKey + "/", | |||
| 					Handler: http.HandlerFunc(handleConfig), | |||
| 				}, | |||
| 				{ | |||
| 					Pattern: "/id/", | |||
| 					Handler: http.HandlerFunc(handleConfigID), | |||
| 				}, | |||
| 			} | |||
| 		}, | |||
| 	} | |||
| } | |||
| 
 | |||
| func (r router) Routes() []AdminRoute { return r } | |||
| 
 | |||
| // handleConfig handles config changes or exports according to r.
 | |||
| // This function is safe for concurrent use.
 | |||
| func handleConfig(w http.ResponseWriter, r *http.Request) { | |||
| 	rawCfgMu.Lock() | |||
| 	defer rawCfgMu.Unlock() | |||
| 	unsyncedHandleConfig(w, r) | |||
| } | |||
| 
 | |||
| // handleConfigID accesses the config through a user-assigned ID
 | |||
| // that is mapped to its full/expanded path in the JSON structure.
 | |||
| // It is the same as handleConfig except it replaces the ID in
 | |||
| // the request path with the full, expanded URL path.
 | |||
| // This function is safe for concurrent use.
 | |||
| func handleConfigID(w http.ResponseWriter, r *http.Request) { | |||
| 	parts := strings.Split(r.URL.Path, "/") | |||
| 	if len(parts) < 3 || parts[2] == "" { | |||
| 		http.Error(w, "request path is missing object ID", http.StatusBadRequest) | |||
| 		return | |||
| 	} | |||
| 	id := parts[2] | |||
| 
 | |||
| 	rawCfgMu.Lock() | |||
| 	defer rawCfgMu.Unlock() | |||
| 
 | |||
| 	// map the ID to the expanded path
 | |||
| 	expanded, ok := rawCfgIndex[id] | |||
| 	if !ok { | |||
| 		http.Error(w, "unknown object ID: "+id, http.StatusBadRequest) | |||
| 		return | |||
| 	} | |||
| 
 | |||
| 	// piece the full URL path back together
 | |||
| 	parts = append([]string{expanded}, parts[3:]...) | |||
| 	r.URL.Path = path.Join(parts...) | |||
| 
 | |||
| 	unsyncedHandleConfig(w, r) | |||
| } | |||
| 
 | |||
| // configIndex recurisvely searches ptr for object fields named "@id"
 | |||
| // and maps that ID value to the full configPath in the index.
 | |||
| // This function is NOT safe for concurrent access; use rawCfgMu.
 | |||
| func configIndex(ptr interface{}, configPath string, index map[string]string) error { | |||
| 	switch val := ptr.(type) { | |||
| 	case map[string]interface{}: | |||
| 		for k, v := range val { | |||
| 			if k == "@id" { | |||
| 				switch idVal := v.(type) { | |||
| 				case string: | |||
| 					index[idVal] = configPath | |||
| 				case float64: // all JSON numbers decode as float64
 | |||
| 					index[fmt.Sprintf("%v", idVal)] = configPath | |||
| 				default: | |||
| 					return fmt.Errorf("%s: @id field must be a string or number", configPath) | |||
| 				} | |||
| 				delete(val, "@id") // field is no longer needed, and will break config if not removed
 | |||
| 				continue | |||
| 			} | |||
| 			// traverse this object property recursively
 | |||
| 			err := configIndex(val[k], path.Join(configPath, k), index) | |||
| 			if err != nil { | |||
| 				return err | |||
| 			} | |||
| 		} | |||
| 	case []interface{}: | |||
| 		// traverse each element of the array recursively
 | |||
| 		for i := range val { | |||
| 			err := configIndex(val[i], path.Join(configPath, strconv.Itoa(i)), index) | |||
| 			if err != nil { | |||
| 				return err | |||
| 			} | |||
| 		} | |||
| 	} | |||
| 
 | |||
| 	return nil | |||
| } | |||
| 
 | |||
| // unsycnedHandleConfig handles config accesses without a lock
 | |||
| // on rawCfgMu. This is NOT safe for concurrent use, so be sure
 | |||
| // to acquire a lock on rawCfgMu before calling this.
 | |||
| func unsyncedHandleConfig(w http.ResponseWriter, r *http.Request) { | |||
| 	switch r.Method { | |||
| 	case http.MethodGet, http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete: | |||
| 	default: | |||
| 		http.Error(w, http.StatusText(http.StatusMethodNotAllowed), http.StatusMethodNotAllowed) | |||
| 		return | |||
| 	} | |||
| 
 | |||
| 	// perform the mutation with our decoded representation
 | |||
| 	// (the map), which may change pointers deep within it
 | |||
| 	err := mutateConfig(w, r) | |||
| 	if err != nil { | |||
| 		http.Error(w, "mutating config: "+err.Error(), http.StatusBadRequest) | |||
| 		return | |||
| 	} | |||
| 
 | |||
| 	if r.Method != http.MethodGet { | |||
| 		// find any IDs in this config and index them
 | |||
| 		idx := make(map[string]string) | |||
| 		err = configIndex(rawCfg[rawConfigKey], "/config", idx) | |||
| 		if err != nil { | |||
| 			http.Error(w, "indexing config: "+err.Error(), http.StatusInternalServerError) | |||
| 			return | |||
| 		} | |||
| 
 | |||
| 		// the mutation is complete, so encode the entire config as JSON
 | |||
| 		newCfg, err := json.Marshal(rawCfg[rawConfigKey]) | |||
| 		if err != nil { | |||
| 			http.Error(w, "encoding new config: "+err.Error(), http.StatusBadRequest) | |||
| 			return | |||
| 		} | |||
| 
 | |||
| 		// if nothing changed, no need to do a whole reload unless the client forces it
 | |||
| 		if r.Header.Get("Cache-Control") != "must-revalidate" && bytes.Equal(rawCfgJSON, newCfg) { | |||
| 			log.Printf("[ADMIN][INFO] Config is unchanged") | |||
| 			return | |||
| 		} | |||
| 
 | |||
| 		// load this new config; if it fails, we need to revert to
 | |||
| 		// our old representation of caddy's actual config
 | |||
| 		err = Load(bytes.NewReader(newCfg)) | |||
| 		if err != nil { | |||
| 			// restore old config state to keep it consistent
 | |||
| 			// with what caddy is still running; we need to
 | |||
| 			// unmarshal it again because it's likely that
 | |||
| 			// pointers deep in our rawCfg map were modified
 | |||
| 			var oldCfg interface{} | |||
| 			err2 := json.Unmarshal(rawCfgJSON, &oldCfg) | |||
| 			if err2 != nil { | |||
| 				err = fmt.Errorf("%v; additionally, restoring old config: %v", err, err2) | |||
| 			} | |||
| 			rawCfg[rawConfigKey] = oldCfg | |||
| 
 | |||
| 			// report error
 | |||
| 			log.Printf("[ADMIN][ERROR] loading config: %v", err) | |||
| 			http.Error(w, err.Error(), http.StatusBadRequest) | |||
| 			return | |||
| 		} | |||
| 
 | |||
| 		// success, so update our stored copy of the encoded
 | |||
| 		// config to keep it consistent with what caddy is now
 | |||
| 		// running (storing an encoded copy is not strictly
 | |||
| 		// necessary, but avoids an extra json.Marshal for
 | |||
| 		// each config change)
 | |||
| 		rawCfgJSON = newCfg | |||
| 		rawCfgIndex = idx | |||
| 	} | |||
| } | |||
| 
 | |||
| // mutateConfig changes the rawCfg according to r. It is NOT
 | |||
| // safe for concurrent use; use rawCfgMu. If the request's
 | |||
| // method is GET, the config will not be changed.
 | |||
| func mutateConfig(w http.ResponseWriter, r *http.Request) error { | |||
| 	var err error | |||
| 	var val interface{} | |||
| 
 | |||
| 	// if there is a request body, make sure we recognize its content-type and decode it
 | |||
| 	if r.Method != http.MethodGet && r.Method != http.MethodDelete { | |||
| 		if ct := r.Header.Get("Content-Type"); !strings.Contains(ct, "/json") { | |||
| 			return fmt.Errorf("unacceptable content-type: %v; 'application/json' required", ct) | |||
| 		} | |||
| 		err = json.NewDecoder(r.Body).Decode(&val) | |||
| 		if err != nil { | |||
| 			return fmt.Errorf("decoding request body: %v", err) | |||
| 		} | |||
| 	} | |||
| 
 | |||
| 	buf := new(bytes.Buffer) | |||
| 	enc := json.NewEncoder(buf) | |||
| 
 | |||
| 	cleanPath := strings.Trim(r.URL.Path, "/") | |||
| 	if cleanPath == "" { | |||
| 		return fmt.Errorf("no traversable path") | |||
| 	} | |||
| 
 | |||
| 	parts := strings.Split(cleanPath, "/") | |||
| 	if len(parts) == 0 { | |||
| 		return fmt.Errorf("path missing") | |||
| 	} | |||
| 
 | |||
| 	var ptr interface{} = rawCfg | |||
| 
 | |||
| traverseLoop: | |||
| 	for i, part := range parts { | |||
| 		switch v := ptr.(type) { | |||
| 		case map[string]interface{}: | |||
| 			// if the next part enters a slice, and the slice is our destination,
 | |||
| 			// handle it specially (because appending to the slice copies the slice
 | |||
| 			// header, which does not replace the original one like we want)
 | |||
| 			if arr, ok := v[part].([]interface{}); ok && i == len(parts)-2 { | |||
| 				var idx int | |||
| 				if r.Method != http.MethodPost { | |||
| 					idxStr := parts[len(parts)-1] | |||
| 					idx, err = strconv.Atoi(idxStr) | |||
| 					if err != nil { | |||
| 						return fmt.Errorf("[%s] invalid array index '%s': %v", | |||
| 							r.URL.Path, idxStr, err) | |||
| 					} | |||
| 					if idx < 0 || idx >= len(arr) { | |||
| 						return fmt.Errorf("[%s] array index out of bounds: %s", r.URL.Path, idxStr) | |||
| 					} | |||
| 				} | |||
| 
 | |||
| 				switch r.Method { | |||
| 				case http.MethodGet: | |||
| 					err = enc.Encode(arr[idx]) | |||
| 					if err != nil { | |||
| 						return fmt.Errorf("encoding config: %v", err) | |||
| 					} | |||
| 				case http.MethodPost: | |||
| 					v[part] = append(arr, val) | |||
| 				case http.MethodPut: | |||
| 					// avoid creation of new slice and a second copy (see
 | |||
| 					// https://github.com/golang/go/wiki/SliceTricks#insert)
 | |||
| 					arr = append(arr, nil) | |||
| 					copy(arr[idx+1:], arr[idx:]) | |||
| 					arr[idx] = val | |||
| 					v[part] = arr | |||
| 				case http.MethodPatch: | |||
| 					arr[idx] = val | |||
| 				case http.MethodDelete: | |||
| 					v[part] = append(arr[:idx], arr[idx+1:]...) | |||
| 				default: | |||
| 					return fmt.Errorf("unrecognized method %s", r.Method) | |||
| 				} | |||
| 				break traverseLoop | |||
| 			} | |||
| 
 | |||
| 			if i == len(parts)-1 { | |||
| 				switch r.Method { | |||
| 				case http.MethodGet: | |||
| 					err = enc.Encode(v[part]) | |||
| 					if err != nil { | |||
| 						return fmt.Errorf("encoding config: %v", err) | |||
| 					} | |||
| 				case http.MethodPost: | |||
| 					if arr, ok := v[part].([]interface{}); ok { | |||
| 						// if the part is an existing list, POST appends to it
 | |||
| 						// TODO: Do we ever reach this point, since we handle arrays
 | |||
| 						// separately above?
 | |||
| 						v[part] = append(arr, val) | |||
| 					} else { | |||
| 						// otherwise, it simply sets the value
 | |||
| 						v[part] = val | |||
| 					} | |||
| 				case http.MethodPut: | |||
| 					if _, ok := v[part]; ok { | |||
| 						return fmt.Errorf("[%s] key already exists: %s", r.URL.Path, part) | |||
| 					} | |||
| 					v[part] = val | |||
| 				case http.MethodPatch: | |||
| 					if _, ok := v[part]; !ok { | |||
| 						return fmt.Errorf("[%s] key does not exist: %s", r.URL.Path, part) | |||
| 					} | |||
| 					v[part] = val | |||
| 				case http.MethodDelete: | |||
| 					delete(v, part) | |||
| 				default: | |||
| 					return fmt.Errorf("unrecognized method %s", r.Method) | |||
| 				} | |||
| 			} else { | |||
| 				ptr = v[part] | |||
| 			} | |||
| 
 | |||
| 		case []interface{}: | |||
| 			partInt, err := strconv.Atoi(part) | |||
| 			if err != nil { | |||
| 				return fmt.Errorf("[/%s] invalid array index '%s': %v", | |||
| 					strings.Join(parts[:i+1], "/"), part, err) | |||
| 			} | |||
| 			if partInt < 0 || partInt >= len(v) { | |||
| 				return fmt.Errorf("[/%s] array index out of bounds: %s", | |||
| 					strings.Join(parts[:i+1], "/"), part) | |||
| 			} | |||
| 			ptr = v[partInt] | |||
| 
 | |||
| 		default: | |||
| 			return fmt.Errorf("invalid path: %s", parts[:i+1]) | |||
| 		} | |||
| 	} | |||
| 
 | |||
| 	if r.Method == http.MethodGet { | |||
| 		w.Header().Set("Content-Type", "application/json") | |||
| 		w.Write(buf.Bytes()) | |||
| 	} | |||
| 
 | |||
| 	return nil | |||
| } | |||
| 
 | |||
| var ( | |||
| 	// rawCfg is the current, generic-decoded configuration;
 | |||
| 	// we initialize it as a map with one field ("config")
 | |||
| 	// to maintain parity with the API endpoint and to avoid
 | |||
| 	// the special case of having to access/mutate the variable
 | |||
| 	// directly without traversing into it
 | |||
| 	rawCfg = map[string]interface{}{ | |||
| 		rawConfigKey: nil, | |||
| 	} | |||
| 	rawCfgJSON  []byte            // keeping the encoded form avoids an extra Marshal on changes
 | |||
| 	rawCfgIndex map[string]string // map of user-assigned ID to expanded path
 | |||
| 	rawCfgMu    sync.Mutex        // protects rawCfg, rawCfgJSON, and rawCfgIndex
 | |||
| ) | |||
| 
 | |||
| const rawConfigKey = "config" | |||
| @ -0,0 +1,123 @@ | |||
| // Copyright 2015 Matthew Holt and The Caddy Authors
 | |||
| //
 | |||
| // Licensed under the Apache License, Version 2.0 (the "License");
 | |||
| // you may not use this file except in compliance with the License.
 | |||
| // You may obtain a copy of the License at
 | |||
| //
 | |||
| //     http://www.apache.org/licenses/LICENSE-2.0
 | |||
| //
 | |||
| // Unless required by applicable law or agreed to in writing, software
 | |||
| // distributed under the License is distributed on an "AS IS" BASIS,
 | |||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 | |||
| // See the License for the specific language governing permissions and
 | |||
| // limitations under the License.
 | |||
| 
 | |||
| package caddy | |||
| 
 | |||
| import ( | |||
| 	"encoding/json" | |||
| 	"net/http" | |||
| 	"net/http/httptest" | |||
| 	"reflect" | |||
| 	"strings" | |||
| 	"testing" | |||
| ) | |||
| 
 | |||
| func TestMutateConfig(t *testing.T) { | |||
| 	// each test is performed in sequence, so
 | |||
| 	// each change builds on the previous ones;
 | |||
| 	// the config is not reset between tests
 | |||
| 	for i, tc := range []struct { | |||
| 		method    string | |||
| 		path      string // rawConfigKey will be prepended
 | |||
| 		payload   string | |||
| 		expect    string // JSON representation of what the whole config is expected to be after the request
 | |||
| 		shouldErr bool | |||
| 	}{ | |||
| 		{ | |||
| 			method:  "POST", | |||
| 			path:    "", | |||
| 			payload: `{"foo": "bar", "list": ["a", "b", "c"]}`, // starting value
 | |||
| 			expect:  `{"foo": "bar", "list": ["a", "b", "c"]}`, | |||
| 		}, | |||
| 		{ | |||
| 			method:  "POST", | |||
| 			path:    "/foo", | |||
| 			payload: `"jet"`, | |||
| 			expect:  `{"foo": "jet", "list": ["a", "b", "c"]}`, | |||
| 		}, | |||
| 		{ | |||
| 			method:  "POST", | |||
| 			path:    "/bar", | |||
| 			payload: `{"aa": "bb", "qq": "zz"}`, | |||
| 			expect:  `{"foo": "jet", "bar": {"aa": "bb", "qq": "zz"}, "list": ["a", "b", "c"]}`, | |||
| 		}, | |||
| 		{ | |||
| 			method: "DELETE", | |||
| 			path:   "/bar/qq", | |||
| 			expect: `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c"]}`, | |||
| 		}, | |||
| 		{ | |||
| 			method:  "POST", | |||
| 			path:    "/list", | |||
| 			payload: `"e"`, | |||
| 			expect:  `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "e"]}`, | |||
| 		}, | |||
| 		{ | |||
| 			method:  "PUT", | |||
| 			path:    "/list/3", | |||
| 			payload: `"d"`, | |||
| 			expect:  `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "d", "e"]}`, | |||
| 		}, | |||
| 		{ | |||
| 			method: "DELETE", | |||
| 			path:   "/list/3", | |||
| 			expect: `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "e"]}`, | |||
| 		}, | |||
| 		{ | |||
| 			method:  "PATCH", | |||
| 			path:    "/list/3", | |||
| 			payload: `"d"`, | |||
| 			expect:  `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "d"]}`, | |||
| 		}, | |||
| 	} { | |||
| 		req, err := http.NewRequest(tc.method, rawConfigKey+tc.path, strings.NewReader(tc.payload)) | |||
| 		if err != nil { | |||
| 			t.Fatalf("Test %d: making test request: %v", i, err) | |||
| 		} | |||
| 		req.Header.Set("Content-Type", "application/json") | |||
| 
 | |||
| 		w := httptest.NewRecorder() | |||
| 
 | |||
| 		err = mutateConfig(w, req) | |||
| 
 | |||
| 		if tc.shouldErr && err == nil { | |||
| 			t.Fatalf("Test %d: Expected error return value, but got: %v", i, err) | |||
| 		} | |||
| 		if !tc.shouldErr && err != nil { | |||
| 			t.Fatalf("Test %d: Should not have had error return value, but got: %v", i, err) | |||
| 		} | |||
| 
 | |||
| 		if tc.shouldErr && w.Code == http.StatusOK { | |||
| 			t.Fatalf("Test %d: Expected error, but got HTTP %d: %s", | |||
| 				i, w.Code, w.Body.String()) | |||
| 		} | |||
| 		if !tc.shouldErr && w.Code != http.StatusOK { | |||
| 			t.Fatalf("Test %d: Should not have errored, but got HTTP %d: %s", | |||
| 				i, w.Code, w.Body.String()) | |||
| 		} | |||
| 
 | |||
| 		// decode the expected config so we can do a convenient DeepEqual
 | |||
| 		var expectedDecoded interface{} | |||
| 		err = json.Unmarshal([]byte(tc.expect), &expectedDecoded) | |||
| 		if err != nil { | |||
| 			t.Fatalf("Test %d: Unmarshaling expected config: %v", i, err) | |||
| 		} | |||
| 
 | |||
| 		// make sure the resulting config is as we expect it
 | |||
| 		if !reflect.DeepEqual(rawCfg[rawConfigKey], expectedDecoded) { | |||
| 			t.Fatalf("Test %d:\nExpected:\n\t%#v\nActual:\n\t%#v", | |||
| 				i, expectedDecoded, rawCfg[rawConfigKey]) | |||
| 		} | |||
| 	} | |||
| } | |||
| @ -0,0 +1,205 @@ | |||
| // Copyright 2015 Matthew Holt and The Caddy Authors
 | |||
| //
 | |||
| // Licensed under the Apache License, Version 2.0 (the "License");
 | |||
| // you may not use this file except in compliance with the License.
 | |||
| // You may obtain a copy of the License at
 | |||
| //
 | |||
| //     http://www.apache.org/licenses/LICENSE-2.0
 | |||
| //
 | |||
| // Unless required by applicable law or agreed to in writing, software
 | |||
| // distributed under the License is distributed on an "AS IS" BASIS,
 | |||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 | |||
| // See the License for the specific language governing permissions and
 | |||
| // limitations under the License.
 | |||
| 
 | |||
| package httpcache | |||
| 
 | |||
| import ( | |||
| 	"bytes" | |||
| 	"encoding/gob" | |||
| 	"fmt" | |||
| 	"io" | |||
| 	"log" | |||
| 	"net/http" | |||
| 	"sync" | |||
| 
 | |||
| 	"github.com/caddyserver/caddy/v2" | |||
| 	"github.com/caddyserver/caddy/v2/modules/caddyhttp" | |||
| 	"github.com/golang/groupcache" | |||
| ) | |||
| 
 | |||
| func init() { | |||
| 	caddy.RegisterModule(Cache{}) | |||
| } | |||
| 
 | |||
| // Cache implements a simple distributed cache.
 | |||
| type Cache struct { | |||
| 	group *groupcache.Group | |||
| } | |||
| 
 | |||
| // CaddyModule returns the Caddy module information.
 | |||
| func (Cache) CaddyModule() caddy.ModuleInfo { | |||
| 	return caddy.ModuleInfo{ | |||
| 		Name: "http.handlers.cache", | |||
| 		New:  func() caddy.Module { return new(Cache) }, | |||
| 	} | |||
| } | |||
| 
 | |||
| // Provision provisions c.
 | |||
| func (c *Cache) Provision(ctx caddy.Context) error { | |||
| 	// TODO: proper pool configuration
 | |||
| 	me := "http://localhost:5555" | |||
| 	// TODO: Make max size configurable
 | |||
| 	maxSize := int64(512 << 20) | |||
| 	poolMu.Lock() | |||
| 	if pool == nil { | |||
| 		pool = groupcache.NewHTTPPool(me) | |||
| 		c.group = groupcache.NewGroup(groupName, maxSize, groupcache.GetterFunc(c.getter)) | |||
| 	} else { | |||
| 		c.group = groupcache.GetGroup(groupName) | |||
| 	} | |||
| 	pool.Set(me) | |||
| 	poolMu.Unlock() | |||
| 
 | |||
| 	return nil | |||
| } | |||
| 
 | |||
| // Validate validates c.
 | |||
| func (c *Cache) Validate() error { | |||
| 	// TODO: implement
 | |||
| 	return nil | |||
| } | |||
| 
 | |||
| func (c *Cache) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error { | |||
| 	// TODO: proper RFC implementation of cache control headers...
 | |||
| 	if r.Header.Get("Cache-Control") == "no-cache" || r.Method != "GET" { | |||
| 		return next.ServeHTTP(w, r) | |||
| 	} | |||
| 
 | |||
| 	ctx := getterContext{w, r, next} | |||
| 
 | |||
| 	// TODO: rigorous performance testing
 | |||
| 
 | |||
| 	// TODO: pretty much everything else to handle the nuances of HTTP caching...
 | |||
| 
 | |||
| 	// TODO: groupcache has no explicit cache eviction, so we need to embed
 | |||
| 	// all information related to expiring cache entries into the key; right
 | |||
| 	// now we just use the request URI as a proof-of-concept
 | |||
| 	key := r.RequestURI | |||
| 
 | |||
| 	var cachedBytes []byte | |||
| 	err := c.group.Get(ctx, key, groupcache.AllocatingByteSliceSink(&cachedBytes)) | |||
| 	if err == errUncacheable { | |||
| 		return nil | |||
| 	} | |||
| 	if err != nil { | |||
| 		return err | |||
| 	} | |||
| 
 | |||
| 	// the cached bytes consists of two parts: first a
 | |||
| 	// gob encoding of the status and header, immediately
 | |||
| 	// followed by the raw bytes of the response body
 | |||
| 	rdr := bytes.NewReader(cachedBytes) | |||
| 
 | |||
| 	// read the header and status first
 | |||
| 	var hs headerAndStatus | |||
| 	err = gob.NewDecoder(rdr).Decode(&hs) | |||
| 	if err != nil { | |||
| 		return err | |||
| 	} | |||
| 
 | |||
| 	// set and write the cached headers
 | |||
| 	for k, v := range hs.Header { | |||
| 		w.Header()[k] = v | |||
| 	} | |||
| 	w.WriteHeader(hs.Status) | |||
| 
 | |||
| 	// write the cached response body
 | |||
| 	io.Copy(w, rdr) | |||
| 
 | |||
| 	return nil | |||
| } | |||
| 
 | |||
| func (c *Cache) getter(ctx groupcache.Context, key string, dest groupcache.Sink) error { | |||
| 	combo := ctx.(getterContext) | |||
| 
 | |||
| 	// the buffer will store the gob-encoded header, then the body
 | |||
| 	buf := bufPool.Get().(*bytes.Buffer) | |||
| 	buf.Reset() | |||
| 	defer bufPool.Put(buf) | |||
| 
 | |||
| 	// we need to record the response if we are to cache it; only cache if
 | |||
| 	// request is successful (TODO: there's probably much more nuance needed here)
 | |||
| 	var rr caddyhttp.ResponseRecorder | |||
| 	rr = caddyhttp.NewResponseRecorder(combo.rw, buf, func(status int) bool { | |||
| 		shouldBuf := status < 300 | |||
| 
 | |||
| 		if shouldBuf { | |||
| 			// store the header before the body, so we can efficiently
 | |||
| 			// and conveniently use a single buffer for both; gob
 | |||
| 			// decoder will only read up to end of gob message, and
 | |||
| 			// the rest will be the body, which will be written
 | |||
| 			// implicitly for us by the recorder
 | |||
| 			err := gob.NewEncoder(buf).Encode(headerAndStatus{ | |||
| 				Header: rr.Header(), | |||
| 				Status: status, | |||
| 			}) | |||
| 			if err != nil { | |||
| 				log.Printf("[ERROR] Encoding headers for cache entry: %v; not caching this request", err) | |||
| 				return false | |||
| 			} | |||
| 		} | |||
| 
 | |||
| 		return shouldBuf | |||
| 	}) | |||
| 
 | |||
| 	// execute next handlers in chain
 | |||
| 	err := combo.next.ServeHTTP(rr, combo.req) | |||
| 	if err != nil { | |||
| 		return err | |||
| 	} | |||
| 
 | |||
| 	// if response body was not buffered, response was
 | |||
| 	// already written and we are unable to cache
 | |||
| 	if !rr.Buffered() { | |||
| 		return errUncacheable | |||
| 	} | |||
| 
 | |||
| 	// add to cache
 | |||
| 	dest.SetBytes(buf.Bytes()) | |||
| 
 | |||
| 	return nil | |||
| } | |||
| 
 | |||
| type headerAndStatus struct { | |||
| 	Header http.Header | |||
| 	Status int | |||
| } | |||
| 
 | |||
| type getterContext struct { | |||
| 	rw   http.ResponseWriter | |||
| 	req  *http.Request | |||
| 	next caddyhttp.Handler | |||
| } | |||
| 
 | |||
| var bufPool = sync.Pool{ | |||
| 	New: func() interface{} { | |||
| 		return new(bytes.Buffer) | |||
| 	}, | |||
| } | |||
| 
 | |||
| var ( | |||
| 	pool   *groupcache.HTTPPool | |||
| 	poolMu sync.Mutex | |||
| ) | |||
| 
 | |||
| var errUncacheable = fmt.Errorf("uncacheable") | |||
| 
 | |||
| const groupName = "http_requests" | |||
| 
 | |||
| // Interface guards
 | |||
| var ( | |||
| 	_ caddy.Provisioner           = (*Cache)(nil) | |||
| 	_ caddy.Validator             = (*Cache)(nil) | |||
| 	_ caddyhttp.MiddlewareHandler = (*Cache)(nil) | |||
| ) | |||
| @ -0,0 +1,152 @@ | |||
| // Copyright 2015 Matthew Holt and The Caddy Authors
 | |||
| //
 | |||
| // Licensed under the Apache License, Version 2.0 (the "License");
 | |||
| // you may not use this file except in compliance with the License.
 | |||
| // You may obtain a copy of the License at
 | |||
| //
 | |||
| //     http://www.apache.org/licenses/LICENSE-2.0
 | |||
| //
 | |||
| // Unless required by applicable law or agreed to in writing, software
 | |||
| // distributed under the License is distributed on an "AS IS" BASIS,
 | |||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 | |||
| // See the License for the specific language governing permissions and
 | |||
| // limitations under the License.
 | |||
| 
 | |||
| package reverseproxy | |||
| 
 | |||
| import ( | |||
| 	"fmt" | |||
| 	"sync/atomic" | |||
| 	"time" | |||
| 
 | |||
| 	"github.com/caddyserver/caddy/v2" | |||
| 	"github.com/vulcand/oxy/memmetrics" | |||
| ) | |||
| 
 | |||
| func init() { | |||
| 	caddy.RegisterModule(localCircuitBreaker{}) | |||
| } | |||
| 
 | |||
| // localCircuitBreaker implements circuit breaking functionality
 | |||
| // for requests within this process over a sliding time window.
 | |||
| type localCircuitBreaker struct { | |||
| 	tripped   int32 | |||
| 	cbType    int32 | |||
| 	threshold float64 | |||
| 	metrics   *memmetrics.RTMetrics | |||
| 	tripTime  time.Duration | |||
| 	Config | |||
| } | |||
| 
 | |||
| // CaddyModule returns the Caddy module information.
 | |||
| func (localCircuitBreaker) CaddyModule() caddy.ModuleInfo { | |||
| 	return caddy.ModuleInfo{ | |||
| 		Name: "http.handlers.reverse_proxy.circuit_breakers.local", | |||
| 		New:  func() caddy.Module { return new(localCircuitBreaker) }, | |||
| 	} | |||
| } | |||
| 
 | |||
| // Provision sets up a configured circuit breaker.
 | |||
| func (c *localCircuitBreaker) Provision(ctx caddy.Context) error { | |||
| 	t, ok := typeCB[c.Type] | |||
| 	if !ok { | |||
| 		return fmt.Errorf("type is not defined") | |||
| 	} | |||
| 
 | |||
| 	if c.TripTime == "" { | |||
| 		c.TripTime = defaultTripTime | |||
| 	} | |||
| 
 | |||
| 	tw, err := time.ParseDuration(c.TripTime) | |||
| 	if err != nil { | |||
| 		return fmt.Errorf("cannot parse trip_time duration, %v", err.Error()) | |||
| 	} | |||
| 
 | |||
| 	mt, err := memmetrics.NewRTMetrics() | |||
| 	if err != nil { | |||
| 		return fmt.Errorf("cannot create new metrics: %v", err.Error()) | |||
| 	} | |||
| 
 | |||
| 	c.cbType = t | |||
| 	c.tripTime = tw | |||
| 	c.threshold = c.Threshold | |||
| 	c.metrics = mt | |||
| 	c.tripped = 0 | |||
| 
 | |||
| 	return nil | |||
| } | |||
| 
 | |||
| // Ok returns whether the circuit breaker is tripped or not.
 | |||
| func (c *localCircuitBreaker) Ok() bool { | |||
| 	tripped := atomic.LoadInt32(&c.tripped) | |||
| 	return tripped == 0 | |||
| } | |||
| 
 | |||
| // RecordMetric records a response status code and execution time of a request. This function should be run in a separate goroutine.
 | |||
| func (c *localCircuitBreaker) RecordMetric(statusCode int, latency time.Duration) { | |||
| 	c.metrics.Record(statusCode, latency) | |||
| 	c.checkAndSet() | |||
| } | |||
| 
 | |||
| // Ok checks our metrics to see if we should trip our circuit breaker, or if the fallback duration has completed.
 | |||
| func (c *localCircuitBreaker) checkAndSet() { | |||
| 	var isTripped bool | |||
| 
 | |||
| 	switch c.cbType { | |||
| 	case typeErrorRatio: | |||
| 		// check if amount of network errors exceed threshold over sliding window, threshold for comparison should be < 1.0 i.e. .5 = 50th percentile
 | |||
| 		if c.metrics.NetworkErrorRatio() > c.threshold { | |||
| 			isTripped = true | |||
| 		} | |||
| 	case typeLatency: | |||
| 		// check if threshold in milliseconds is reached and trip
 | |||
| 		hist, err := c.metrics.LatencyHistogram() | |||
| 		if err != nil { | |||
| 			return | |||
| 		} | |||
| 
 | |||
| 		l := hist.LatencyAtQuantile(c.threshold) | |||
| 		if l.Nanoseconds()/int64(time.Millisecond) > int64(c.threshold) { | |||
| 			isTripped = true | |||
| 		} | |||
| 	case typeStatusCodeRatio: | |||
| 		// check ratio of error status codes of sliding window, threshold for comparison should be < 1.0 i.e. .5 = 50th percentile
 | |||
| 		if c.metrics.ResponseCodeRatio(500, 600, 0, 600) > c.threshold { | |||
| 			isTripped = true | |||
| 		} | |||
| 	} | |||
| 
 | |||
| 	if isTripped { | |||
| 		c.metrics.Reset() | |||
| 		atomic.AddInt32(&c.tripped, 1) | |||
| 
 | |||
| 		// wait tripTime amount before allowing operations to resume.
 | |||
| 		t := time.NewTimer(c.tripTime) | |||
| 		<-t.C | |||
| 
 | |||
| 		atomic.AddInt32(&c.tripped, -1) | |||
| 	} | |||
| } | |||
| 
 | |||
| // Config represents the configuration of a circuit breaker.
 | |||
| type Config struct { | |||
| 	Threshold float64 `json:"threshold"` | |||
| 	Type      string  `json:"type"` | |||
| 	TripTime  string  `json:"trip_time"` | |||
| } | |||
| 
 | |||
| const ( | |||
| 	typeLatency = iota + 1 | |||
| 	typeErrorRatio | |||
| 	typeStatusCodeRatio | |||
| 	defaultTripTime = "5s" | |||
| ) | |||
| 
 | |||
| var ( | |||
| 	// typeCB handles converting a Config Type value to the internal circuit breaker types.
 | |||
| 	typeCB = map[string]int32{ | |||
| 		"latency":      typeLatency, | |||
| 		"error_ratio":  typeErrorRatio, | |||
| 		"status_ratio": typeStatusCodeRatio, | |||
| 	} | |||
| ) | |||
| @ -0,0 +1,19 @@ | |||
| { | |||
| 	"apps": { | |||
| 		"http": { | |||
| 			"servers": { | |||
| 				"MY_SERVER": { | |||
| 					"listen": [":3001"], | |||
| 					"routes": [ | |||
| 						{ | |||
| 							"handle": { | |||
| 								"handler": "starlark", | |||
| 								"script": "def setup(r):\n\t# create some middlewares specific to this request\n\ttemplates = loadModule('http.handlers.templates', {'include_root': './includes'})\n\tmidChain = execute([templates])\n\ndef serveHTTP (rw, r):\n\trw.Write('Hello world, from Starlark!')\n" | |||
| 							} | |||
| 						} | |||
| 					] | |||
| 				} | |||
| 			} | |||
| 		} | |||
| 	} | |||
| } | |||
| @ -0,0 +1,165 @@ | |||
| package lib | |||
| 
 | |||
| import ( | |||
| 	"encoding/json" | |||
| 	"fmt" | |||
| 	"strings" | |||
| 
 | |||
| 	"github.com/caddyserver/caddy/v2/modules/caddyhttp" | |||
| 
 | |||
| 	"github.com/caddyserver/caddy/v2" | |||
| 	"go.starlark.net/starlark" | |||
| ) | |||
| 
 | |||
| // ResponderModule represents a module that satisfies the caddyhttp handler.
 | |||
| type ResponderModule struct { | |||
| 	Name     string | |||
| 	Cfg      json.RawMessage | |||
| 	Instance caddyhttp.Handler | |||
| } | |||
| 
 | |||
| func (r ResponderModule) Freeze()               {} | |||
| func (r ResponderModule) Hash() (uint32, error) { return 0, fmt.Errorf("unhashable: responder module") } | |||
| func (r ResponderModule) String() string        { return "responder module" } | |||
| func (r ResponderModule) Type() string          { return "responder module" } | |||
| func (r ResponderModule) Truth() starlark.Bool  { return true } | |||
| 
 | |||
| // Middleware represents a module that satisfies the starlark Value interface.
 | |||
| type Middleware struct { | |||
| 	Name     string | |||
| 	Cfg      json.RawMessage | |||
| 	Instance caddyhttp.MiddlewareHandler | |||
| } | |||
| 
 | |||
| func (r Middleware) Freeze()               {} | |||
| func (r Middleware) Hash() (uint32, error) { return 0, fmt.Errorf("unhashable: middleware") } | |||
| func (r Middleware) String() string        { return "middleware" } | |||
| func (r Middleware) Type() string          { return "middleware" } | |||
| func (r Middleware) Truth() starlark.Bool  { return true } | |||
| 
 | |||
| // LoadMiddleware represents the method exposed to starlark to load a Caddy module.
 | |||
| type LoadMiddleware struct { | |||
| 	Middleware Middleware | |||
| 	Ctx        caddy.Context | |||
| } | |||
| 
 | |||
| func (r LoadMiddleware) Freeze()               {} | |||
| func (r LoadMiddleware) Hash() (uint32, error) { return 0, fmt.Errorf("unhashable: loadMiddleware") } | |||
| func (r LoadMiddleware) String() string        { return "loadMiddleware" } | |||
| func (r LoadMiddleware) Type() string          { return "function: loadMiddleware" } | |||
| func (r LoadMiddleware) Truth() starlark.Bool  { return true } | |||
| 
 | |||
| // Run is the method bound to the starlark loadMiddleware function.
 | |||
| func (r *LoadMiddleware) Run(thread *starlark.Thread, fn *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) { | |||
| 	var name string | |||
| 	var cfg *starlark.Dict | |||
| 	err := starlark.UnpackPositionalArgs(fn.Name(), args, kwargs, 2, &name, &cfg) | |||
| 	if err != nil { | |||
| 		return starlark.None, fmt.Errorf("unpacking arguments: %v", err.Error()) | |||
| 	} | |||
| 
 | |||
| 	js := json.RawMessage(cfg.String()) | |||
| 
 | |||
| 	if strings.Index(name, "http.handlers.") == -1 { | |||
| 		name = fmt.Sprintf("http.handlers.%s", name) | |||
| 	} | |||
| 
 | |||
| 	inst, err := r.Ctx.LoadModule(name, js) | |||
| 	if err != nil { | |||
| 		return starlark.None, err | |||
| 	} | |||
| 
 | |||
| 	mid, ok := inst.(caddyhttp.MiddlewareHandler) | |||
| 	if !ok { | |||
| 		return starlark.None, fmt.Errorf("could not assert as middleware handler") | |||
| 	} | |||
| 
 | |||
| 	m := Middleware{ | |||
| 		Name:     name, | |||
| 		Cfg:      js, | |||
| 		Instance: mid, | |||
| 	} | |||
| 
 | |||
| 	r.Middleware = m | |||
| 
 | |||
| 	return m, nil | |||
| } | |||
| 
 | |||
| // LoadResponder represents the method exposed to starlark to load a Caddy middleware responder.
 | |||
| type LoadResponder struct { | |||
| 	Module ResponderModule | |||
| 	Ctx    caddy.Context | |||
| } | |||
| 
 | |||
| func (r LoadResponder) Freeze()               {} | |||
| func (r LoadResponder) Hash() (uint32, error) { return 0, fmt.Errorf("unhashable: loadModule") } | |||
| func (r LoadResponder) String() string        { return "loadModule" } | |||
| func (r LoadResponder) Type() string          { return "function: loadModule" } | |||
| func (r LoadResponder) Truth() starlark.Bool  { return true } | |||
| 
 | |||
| // Run is the method bound to the starlark loadResponder function.
 | |||
| func (r *LoadResponder) Run(thread *starlark.Thread, fn *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) { | |||
| 	var name string | |||
| 	var cfg *starlark.Dict | |||
| 	err := starlark.UnpackPositionalArgs(fn.Name(), args, kwargs, 2, &name, &cfg) | |||
| 	if err != nil { | |||
| 		return starlark.None, fmt.Errorf("unpacking arguments: %v", err.Error()) | |||
| 	} | |||
| 
 | |||
| 	js := json.RawMessage(cfg.String()) | |||
| 
 | |||
| 	if strings.Index(name, "http.handlers.") == -1 { | |||
| 		name = fmt.Sprintf("http.handlers.%s", name) | |||
| 	} | |||
| 
 | |||
| 	inst, err := r.Ctx.LoadModule(name, js) | |||
| 	if err != nil { | |||
| 		return starlark.None, err | |||
| 	} | |||
| 
 | |||
| 	res, ok := inst.(caddyhttp.Handler) | |||
| 	if !ok { | |||
| 		return starlark.None, fmt.Errorf("could not assert as responder") | |||
| 	} | |||
| 
 | |||
| 	m := ResponderModule{ | |||
| 		Name:     name, | |||
| 		Cfg:      js, | |||
| 		Instance: res, | |||
| 	} | |||
| 
 | |||
| 	r.Module = m | |||
| 
 | |||
| 	return m, nil | |||
| } | |||
| 
 | |||
| // Execute represents the method exposed to starlark to build a middleware chain.
 | |||
| type Execute struct { | |||
| 	Modules []Middleware | |||
| } | |||
| 
 | |||
| func (r Execute) Freeze()               {} | |||
| func (r Execute) Hash() (uint32, error) { return 0, fmt.Errorf("unhashable: execute") } | |||
| func (r Execute) String() string        { return "execute" } | |||
| func (r Execute) Type() string          { return "function: execute" } | |||
| func (r Execute) Truth() starlark.Bool  { return true } | |||
| 
 | |||
| // Run is the method bound to the starlark execute function.
 | |||
| func (r *Execute) Run(thread *starlark.Thread, fn *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) { | |||
| 	var mids *starlark.List | |||
| 	err := starlark.UnpackPositionalArgs(fn.Name(), args, kwargs, 1, &mids) | |||
| 	if err != nil { | |||
| 		return starlark.None, fmt.Errorf("unpacking arguments: %v", err.Error()) | |||
| 	} | |||
| 
 | |||
| 	for i := 0; i < mids.Len(); i++ { | |||
| 		val, ok := mids.Index(i).(Middleware) | |||
| 		if !ok { | |||
| 			return starlark.None, fmt.Errorf("cannot get module from execute") | |||
| 		} | |||
| 
 | |||
| 		r.Modules = append(r.Modules, val) | |||
| 	} | |||
| 
 | |||
| 	return starlark.None, nil | |||
| } | |||
| @ -0,0 +1,172 @@ | |||
| package starlarkmw | |||
| 
 | |||
| import ( | |||
| 	"context" | |||
| 	"fmt" | |||
| 	"net/http" | |||
| 
 | |||
| 	"github.com/caddyserver/caddy/v2" | |||
| 	"github.com/caddyserver/caddy/v2/modules/caddyhttp" | |||
| 	caddyscript "github.com/caddyserver/caddy/v2/pkg/caddyscript/lib" | |||
| 	"github.com/caddyserver/caddy/v2/modules/caddyhttp/starlarkmw/internal/lib" | |||
| 	"github.com/starlight-go/starlight/convert" | |||
| 	"go.starlark.net/starlark" | |||
| ) | |||
| 
 | |||
| func init() { | |||
| 	caddy.RegisterModule(StarlarkMW{}) | |||
| } | |||
| 
 | |||
| // StarlarkMW represents a middleware responder written in starlark
 | |||
| type StarlarkMW struct { | |||
| 	Script         string `json:"script"` | |||
| 	serveHTTP      *starlark.Function | |||
| 	setup          *starlark.Function | |||
| 	thread         *starlark.Thread | |||
| 	loadMiddleware *lib.LoadMiddleware | |||
| 	execute        *lib.Execute | |||
| 	globals        *starlark.StringDict | |||
| 	gctx           caddy.Context | |||
| 	rctx           caddy.Context | |||
| 	rcancel        context.CancelFunc | |||
| } | |||
| 
 | |||
| // CaddyModule returns the Caddy module information.
 | |||
| func (StarlarkMW) CaddyModule() caddy.ModuleInfo { | |||
| 	return caddy.ModuleInfo{ | |||
| 		Name: "http.handlers.starlark", | |||
| 		New:  func() caddy.Module { return new(StarlarkMW) }, | |||
| 	} | |||
| } | |||
| 
 | |||
| // ServeHTTP responds to an http request with starlark.
 | |||
| func (s *StarlarkMW) ServeHTTP(w http.ResponseWriter, r *http.Request) error { | |||
| 	var mwcancel context.CancelFunc | |||
| 	var mwctx caddy.Context | |||
| 
 | |||
| 	// call setup() to prepare the middleware chain if it is defined
 | |||
| 	if s.setup != nil { | |||
| 		mwctx, mwcancel = caddy.NewContext(s.gctx) | |||
| 		defer mwcancel() | |||
| 
 | |||
| 		s.loadMiddleware.Ctx = mwctx | |||
| 		args := starlark.Tuple{caddyscript.HTTPRequest{Req: r}} | |||
| 
 | |||
| 		_, err := starlark.Call(new(starlark.Thread), s.setup, args, nil) | |||
| 		if err != nil { | |||
| 			return fmt.Errorf("starlark setup(), %v", err) | |||
| 		} | |||
| 	} | |||
| 
 | |||
| 	// dynamically build middleware chain for each request
 | |||
| 	stack := caddyhttp.HandlerFunc(func(w http.ResponseWriter, r *http.Request) error { | |||
| 		wr, err := convert.ToValue(w) | |||
| 		if err != nil { | |||
| 			return fmt.Errorf("cannot convert response writer to starlark value") | |||
| 		} | |||
| 
 | |||
| 		args := starlark.Tuple{wr, caddyscript.HTTPRequest{Req: r}} | |||
| 		v, err := starlark.Call(new(starlark.Thread), s.serveHTTP, args, nil) | |||
| 		if err != nil { | |||
| 			return fmt.Errorf("starlark serveHTTP(), %v", err) | |||
| 		} | |||
| 
 | |||
| 		// if a responder type was returned from starlark we should run it otherwise it
 | |||
| 		// is expected to handle the request
 | |||
| 		if resp, ok := v.(lib.ResponderModule); ok { | |||
| 			return resp.Instance.ServeHTTP(w, r) | |||
| 		} | |||
| 
 | |||
| 		return nil | |||
| 	}) | |||
| 
 | |||
| 	// TODO :- make middlewareResponseWriter exported and wrap w with that
 | |||
| 	var mid []caddyhttp.Middleware | |||
| 	for _, m := range s.execute.Modules { | |||
| 		mid = append(mid, func(next caddyhttp.HandlerFunc) caddyhttp.HandlerFunc { | |||
| 			return func(w http.ResponseWriter, r *http.Request) error { | |||
| 				return m.Instance.ServeHTTP(w, r, next) | |||
| 			} | |||
| 		}) | |||
| 	} | |||
| 
 | |||
| 	for i := len(mid) - 1; i >= 0; i-- { | |||
| 		stack = mid[i](stack) | |||
| 	} | |||
| 
 | |||
| 	s.execute.Modules = nil | |||
| 
 | |||
| 	return stack(w, r) | |||
| } | |||
| 
 | |||
| // Cleanup cleans up any modules loaded during the creation of a starlark route.
 | |||
| func (s *StarlarkMW) Cleanup() error { | |||
| 	s.rcancel() | |||
| 	return nil | |||
| } | |||
| 
 | |||
| // Provision sets up the starlark env.
 | |||
| func (s *StarlarkMW) Provision(ctx caddy.Context) error { | |||
| 	// store global context
 | |||
| 	s.gctx = ctx | |||
| 
 | |||
| 	// setup context for cleaning up any modules loaded during starlark script parsing phase
 | |||
| 	rctx, cancel := caddy.NewContext(ctx) | |||
| 	s.rcancel = cancel | |||
| 
 | |||
| 	// setup starlark global env
 | |||
| 	env := make(starlark.StringDict) | |||
| 	loadMiddleware := lib.LoadMiddleware{} | |||
| 	loadResponder := lib.LoadResponder{ | |||
| 		Ctx: rctx, | |||
| 	} | |||
| 	execute := lib.Execute{} | |||
| 
 | |||
| 	lr := starlark.NewBuiltin("loadResponder", loadResponder.Run) | |||
| 	lr = lr.BindReceiver(&loadResponder) | |||
| 	env["loadResponder"] = lr | |||
| 
 | |||
| 	lm := starlark.NewBuiltin("loadMiddleware", loadMiddleware.Run) | |||
| 	lm = lm.BindReceiver(&loadMiddleware) | |||
| 	env["loadMiddleware"] = lm | |||
| 
 | |||
| 	ex := starlark.NewBuiltin("execute", execute.Run) | |||
| 	ex = ex.BindReceiver(&execute) | |||
| 	env["execute"] = ex | |||
| 
 | |||
| 	// import caddyscript lib
 | |||
| 	env["time"] = caddyscript.Time{} | |||
| 	env["regexp"] = caddyscript.Regexp{} | |||
| 
 | |||
| 	// configure starlark
 | |||
| 	thread := new(starlark.Thread) | |||
| 	s.thread = thread | |||
| 
 | |||
| 	// run starlark script
 | |||
| 	globals, err := starlark.ExecFile(thread, "", s.Script, env) | |||
| 	if err != nil { | |||
| 		return fmt.Errorf("starlark exec file: %v", err.Error()) | |||
| 	} | |||
| 
 | |||
| 	// extract defined methods to setup middleware chain and responder, setup is not required
 | |||
| 	var setup *starlark.Function | |||
| 	if _, ok := globals["setup"]; ok { | |||
| 		setup, ok = globals["setup"].(*starlark.Function) | |||
| 		if !ok { | |||
| 			return fmt.Errorf("setup function not defined in starlark script") | |||
| 		} | |||
| 	} | |||
| 
 | |||
| 	serveHTTP, ok := globals["serveHTTP"].(*starlark.Function) | |||
| 	if !ok { | |||
| 		return fmt.Errorf("serveHTTP function not defined in starlark script") | |||
| 	} | |||
| 
 | |||
| 	s.setup = setup | |||
| 	s.serveHTTP = serveHTTP | |||
| 	s.loadMiddleware = &loadMiddleware | |||
| 	s.execute = &execute | |||
| 	s.globals = &globals | |||
| 
 | |||
| 	return nil | |||
| } | |||
| @ -0,0 +1,40 @@ | |||
| # any module that provisions resources | |||
| proxyConfig = { | |||
| 	'load_balance_type': 'round_robin', | |||
| 	'upstreams': [ | |||
| 		{ | |||
| 			'host': 'http://localhost:8080', | |||
| 			'circuit_breaker': { | |||
| 				'type': 'status_ratio', | |||
| 				'threshold': 0.5 | |||
| 			} | |||
| 		}, | |||
| 		{ | |||
| 			'host': 'http://localhost:8081' | |||
| 		} | |||
| 	] | |||
| } | |||
| 
 | |||
| sfConfig = { | |||
| 	'root': '/Users/dev/Desktop', | |||
| 	'browse': {}, | |||
| } | |||
| 
 | |||
| proxy = loadResponder('reverse_proxy', proxyConfig) | |||
| static_files = loadResponder('file_server', sfConfig) | |||
| 
 | |||
| def setup(r): | |||
| 	# create some middlewares specific to this request | |||
| 	mid = [] | |||
| 
 | |||
| 	if r.query.get('log') == 'true': | |||
| 		logMid = loadMiddleware('log', {'file': 'access.log'}) | |||
| 		mid.append(logMid) | |||
| 
 | |||
| 	execute(mid) | |||
| 
 | |||
| def serveHTTP(w, r): | |||
| 	if r.url.find('static') > 0: | |||
| 		return static_files | |||
| 
 | |||
| 	return proxy | |||
| @ -0,0 +1,71 @@ | |||
| package caddytls | |||
| 
 | |||
| import ( | |||
| 	"crypto/tls" | |||
| 	"crypto/x509" | |||
| 	"fmt" | |||
| 	"math/big" | |||
| 
 | |||
| 	"github.com/caddyserver/caddy/v2" | |||
| 	"github.com/mholt/certmagic" | |||
| ) | |||
| 
 | |||
| func init() { | |||
| 	caddy.RegisterModule(Policy{}) | |||
| } | |||
| 
 | |||
| // Policy represents a policy for selecting the certificate used to
 | |||
| // complete a handshake when there may be multiple options. All fields
 | |||
| // specified must match the candidate certificate for it to be chosen.
 | |||
| // This was needed to solve https://github.com/caddyserver/caddy/issues/2588.
 | |||
| type Policy struct { | |||
| 	SerialNumber        *big.Int           `json:"serial_number,omitempty"` | |||
| 	SubjectOrganization string             `json:"subject_organization,omitempty"` | |||
| 	PublicKeyAlgorithm  PublicKeyAlgorithm `json:"public_key_algorithm,omitempty"` | |||
| 	Tag                 string             `json:"tag,omitempty"` | |||
| } | |||
| 
 | |||
| // CaddyModule returns the Caddy module information.
 | |||
| func (Policy) CaddyModule() caddy.ModuleInfo { | |||
| 	return caddy.ModuleInfo{ | |||
| 		Name: "tls.certificate_selection.custom", | |||
| 		New:  func() caddy.Module { return new(Policy) }, | |||
| 	} | |||
| } | |||
| 
 | |||
| // SelectCertificate implements certmagic.CertificateSelector.
 | |||
| func (p Policy) SelectCertificate(_ *tls.ClientHelloInfo, choices []certmagic.Certificate) (certmagic.Certificate, error) { | |||
| 	for _, cert := range choices { | |||
| 		if p.SerialNumber != nil && cert.SerialNumber.Cmp(p.SerialNumber) != 0 { | |||
| 			continue | |||
| 		} | |||
| 
 | |||
| 		if p.PublicKeyAlgorithm != PublicKeyAlgorithm(x509.UnknownPublicKeyAlgorithm) && | |||
| 			PublicKeyAlgorithm(cert.PublicKeyAlgorithm) != p.PublicKeyAlgorithm { | |||
| 			continue | |||
| 		} | |||
| 
 | |||
| 		if p.SubjectOrganization != "" { | |||
| 			var matchOrg bool | |||
| 			for _, org := range cert.Subject.Organization { | |||
| 				if p.SubjectOrganization == org { | |||
| 					matchOrg = true | |||
| 					break | |||
| 				} | |||
| 			} | |||
| 			if !matchOrg { | |||
| 				continue | |||
| 			} | |||
| 		} | |||
| 
 | |||
| 		if p.Tag != "" && !cert.HasTag(p.Tag) { | |||
| 			continue | |||
| 		} | |||
| 
 | |||
| 		return cert, nil | |||
| 	} | |||
| 	return certmagic.Certificate{}, fmt.Errorf("no certificates matched custom selection policy") | |||
| } | |||
| 
 | |||
| // Interface guard
 | |||
| var _ certmagic.CertificateSelector = (*Policy)(nil) | |||
| @ -0,0 +1,228 @@ | |||
| // Copyright 2015 Matthew Holt and The Caddy Authors
 | |||
| //
 | |||
| // Licensed under the Apache License, Version 2.0 (the "License");
 | |||
| // you may not use this file except in compliance with the License.
 | |||
| // You may obtain a copy of the License at
 | |||
| //
 | |||
| //     http://www.apache.org/licenses/LICENSE-2.0
 | |||
| //
 | |||
| // Unless required by applicable law or agreed to in writing, software
 | |||
| // distributed under the License is distributed on an "AS IS" BASIS,
 | |||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 | |||
| // See the License for the specific language governing permissions and
 | |||
| // limitations under the License.
 | |||
| 
 | |||
| // Package distributedstek provides TLS session ticket ephemeral
 | |||
| // keys (STEKs) in a distributed fashion by utilizing configured
 | |||
| // storage for locking and key sharing. This allows a cluster of
 | |||
| // machines to optimally resume TLS sessions in a load-balanced
 | |||
| // environment without any hassle. This is similar to what
 | |||
| // Twitter does, but without needing to rely on SSH, as it is
 | |||
| // built into the web server this way:
 | |||
| // https://blog.twitter.com/engineering/en_us/a/2013/forward-secrecy-at-twitter.html
 | |||
| package distributedstek | |||
| 
 | |||
| import ( | |||
| 	"bytes" | |||
| 	"encoding/gob" | |||
| 	"encoding/json" | |||
| 	"fmt" | |||
| 	"log" | |||
| 	"time" | |||
| 
 | |||
| 	"github.com/caddyserver/caddy/v2" | |||
| 	"github.com/caddyserver/caddy/v2/modules/caddytls" | |||
| 	"github.com/mholt/certmagic" | |||
| ) | |||
| 
 | |||
| func init() { | |||
| 	caddy.RegisterModule(Provider{}) | |||
| } | |||
| 
 | |||
| // Provider implements a distributed STEK provider.
 | |||
| type Provider struct { | |||
| 	Storage json.RawMessage `json:"storage,omitempty"` | |||
| 
 | |||
| 	storage    certmagic.Storage | |||
| 	stekConfig *caddytls.SessionTicketService | |||
| 	timer      *time.Timer | |||
| } | |||
| 
 | |||
| // CaddyModule returns the Caddy module information.
 | |||
| func (Provider) CaddyModule() caddy.ModuleInfo { | |||
| 	return caddy.ModuleInfo{ | |||
| 		Name: "tls.stek.distributed", | |||
| 		New:  func() caddy.Module { return new(Provider) }, | |||
| 	} | |||
| } | |||
| 
 | |||
| // Provision provisions s.
 | |||
| func (s *Provider) Provision(ctx caddy.Context) error { | |||
| 	// unpack the storage module to use, if different from the default
 | |||
| 	if s.Storage != nil { | |||
| 		val, err := ctx.LoadModuleInline("module", "caddy.storage", s.Storage) | |||
| 		if err != nil { | |||
| 			return fmt.Errorf("loading TLS storage module: %s", err) | |||
| 		} | |||
| 		cmStorage, err := val.(caddy.StorageConverter).CertMagicStorage() | |||
| 		if err != nil { | |||
| 			return fmt.Errorf("creating TLS storage configuration: %v", err) | |||
| 		} | |||
| 		s.storage = cmStorage | |||
| 		s.Storage = nil // allow GC to deallocate
 | |||
| 	} | |||
| 
 | |||
| 	// otherwise, use default storage
 | |||
| 	if s.storage == nil { | |||
| 		s.storage = ctx.Storage() | |||
| 	} | |||
| 
 | |||
| 	return nil | |||
| } | |||
| 
 | |||
| // Initialize sets the configuration for s and returns the starting keys.
 | |||
| func (s *Provider) Initialize(config *caddytls.SessionTicketService) ([][32]byte, error) { | |||
| 	// keep a reference to the config; we'll need it when rotating keys
 | |||
| 	s.stekConfig = config | |||
| 
 | |||
| 	dstek, err := s.getSTEK() | |||
| 	if err != nil { | |||
| 		return nil, err | |||
| 	} | |||
| 
 | |||
| 	// create timer for the remaining time on the interval;
 | |||
| 	// this timer is cleaned up only when rotate() returns
 | |||
| 	s.timer = time.NewTimer(time.Until(dstek.NextRotation)) | |||
| 
 | |||
| 	return dstek.Keys, nil | |||
| } | |||
| 
 | |||
| // Next returns a channel which transmits the latest session ticket keys.
 | |||
| func (s *Provider) Next(doneChan <-chan struct{}) <-chan [][32]byte { | |||
| 	keysChan := make(chan [][32]byte) | |||
| 	go s.rotate(doneChan, keysChan) | |||
| 	return keysChan | |||
| } | |||
| 
 | |||
| func (s *Provider) loadSTEK() (distributedSTEK, error) { | |||
| 	var sg distributedSTEK | |||
| 	gobBytes, err := s.storage.Load(stekFileName) | |||
| 	if err != nil { | |||
| 		return sg, err // don't wrap, in case error is certmagic.ErrNotExist
 | |||
| 	} | |||
| 	dec := gob.NewDecoder(bytes.NewReader(gobBytes)) | |||
| 	err = dec.Decode(&sg) | |||
| 	if err != nil { | |||
| 		return sg, fmt.Errorf("STEK gob corrupted: %v", err) | |||
| 	} | |||
| 	return sg, nil | |||
| } | |||
| 
 | |||
| func (s *Provider) storeSTEK(dstek distributedSTEK) error { | |||
| 	var buf bytes.Buffer | |||
| 	err := gob.NewEncoder(&buf).Encode(dstek) | |||
| 	if err != nil { | |||
| 		return fmt.Errorf("encoding STEK gob: %v", err) | |||
| 	} | |||
| 	err = s.storage.Store(stekFileName, buf.Bytes()) | |||
| 	if err != nil { | |||
| 		return fmt.Errorf("storing STEK gob: %v", err) | |||
| 	} | |||
| 	return nil | |||
| } | |||
| 
 | |||
| // getSTEK locks and loads the current STEK from storage. If none
 | |||
| // currently exists, a new STEK is created and persisted. If the
 | |||
| // current STEK is outdated (NextRotation time is in the past),
 | |||
| // then it is rotated and persisted. The resulting STEK is returned.
 | |||
| func (s *Provider) getSTEK() (distributedSTEK, error) { | |||
| 	s.storage.Lock(stekLockName) | |||
| 	defer s.storage.Unlock(stekLockName) | |||
| 
 | |||
| 	// load the current STEKs from storage
 | |||
| 	dstek, err := s.loadSTEK() | |||
| 	if _, isNotExist := err.(certmagic.ErrNotExist); isNotExist { | |||
| 		// if there is none, then make some right away
 | |||
| 		dstek, err = s.rotateKeys(dstek) | |||
| 		if err != nil { | |||
| 			return dstek, fmt.Errorf("creating new STEK: %v", err) | |||
| 		} | |||
| 	} else if err != nil { | |||
| 		// some other error, that's a problem
 | |||
| 		return dstek, fmt.Errorf("loading STEK: %v", err) | |||
| 	} else if time.Now().After(dstek.NextRotation) { | |||
| 		// if current STEKs are outdated, rotate them
 | |||
| 		dstek, err = s.rotateKeys(dstek) | |||
| 		if err != nil { | |||
| 			return dstek, fmt.Errorf("rotating keys: %v", err) | |||
| 		} | |||
| 	} | |||
| 
 | |||
| 	return dstek, nil | |||
| } | |||
| 
 | |||
| // rotateKeys rotates the keys of oldSTEK and returns the new distributedSTEK
 | |||
| // with updated keys and timestamps. It stores the returned STEK in storage,
 | |||
| // so this function must only be called in a storage-provided lock.
 | |||
| func (s *Provider) rotateKeys(oldSTEK distributedSTEK) (distributedSTEK, error) { | |||
| 	var newSTEK distributedSTEK | |||
| 	var err error | |||
| 
 | |||
| 	newSTEK.Keys, err = s.stekConfig.RotateSTEKs(oldSTEK.Keys) | |||
| 	if err != nil { | |||
| 		return newSTEK, err | |||
| 	} | |||
| 
 | |||
| 	now := time.Now() | |||
| 	newSTEK.LastRotation = now | |||
| 	newSTEK.NextRotation = now.Add(time.Duration(s.stekConfig.RotationInterval)) | |||
| 
 | |||
| 	err = s.storeSTEK(newSTEK) | |||
| 	if err != nil { | |||
| 		return newSTEK, err | |||
| 	} | |||
| 
 | |||
| 	return newSTEK, nil | |||
| } | |||
| 
 | |||
| // rotate rotates keys on a regular basis, sending each updated set of
 | |||
| // keys down keysChan, until doneChan is closed.
 | |||
| func (s *Provider) rotate(doneChan <-chan struct{}, keysChan chan<- [][32]byte) { | |||
| 	for { | |||
| 		select { | |||
| 		case <-s.timer.C: | |||
| 			dstek, err := s.getSTEK() | |||
| 			if err != nil { | |||
| 				// TODO: improve this handling
 | |||
| 				log.Printf("[ERROR] Loading STEK: %v", err) | |||
| 				continue | |||
| 			} | |||
| 
 | |||
| 			// send the updated keys to the service
 | |||
| 			keysChan <- dstek.Keys | |||
| 
 | |||
| 			// timer channel is already drained, so reset directly (see godoc)
 | |||
| 			s.timer.Reset(time.Until(dstek.NextRotation)) | |||
| 
 | |||
| 		case <-doneChan: | |||
| 			// again, see godocs for why timer is stopped this way
 | |||
| 			if !s.timer.Stop() { | |||
| 				<-s.timer.C | |||
| 			} | |||
| 			return | |||
| 		} | |||
| 	} | |||
| } | |||
| 
 | |||
| type distributedSTEK struct { | |||
| 	Keys                       [][32]byte | |||
| 	LastRotation, NextRotation time.Time | |||
| } | |||
| 
 | |||
| const ( | |||
| 	stekLockName = "stek_check" | |||
| 	stekFileName = "stek/stek.bin" | |||
| ) | |||
| 
 | |||
| // Interface guard
 | |||
| var _ caddytls.STEKProvider = (*Provider)(nil) | |||
| @ -0,0 +1,65 @@ | |||
| // Copyright 2015 Matthew Holt and The Caddy Authors
 | |||
| //
 | |||
| // Licensed under the Apache License, Version 2.0 (the "License");
 | |||
| // you may not use this file except in compliance with the License.
 | |||
| // You may obtain a copy of the License at
 | |||
| //
 | |||
| //     http://www.apache.org/licenses/LICENSE-2.0
 | |||
| //
 | |||
| // Unless required by applicable law or agreed to in writing, software
 | |||
| // distributed under the License is distributed on an "AS IS" BASIS,
 | |||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 | |||
| // See the License for the specific language governing permissions and
 | |||
| // limitations under the License.
 | |||
| 
 | |||
| package caddytls | |||
| 
 | |||
| import ( | |||
| 	"crypto/tls" | |||
| 	"fmt" | |||
| 
 | |||
| 	"github.com/caddyserver/caddy/v2" | |||
| ) | |||
| 
 | |||
| func init() { | |||
| 	caddy.RegisterModule(PEMLoader{}) | |||
| } | |||
| 
 | |||
| // PEMLoader loads certificates and their associated keys by
 | |||
| // decoding their PEM blocks directly. This has the advantage
 | |||
| // of not needing to store them on disk at all.
 | |||
| type PEMLoader []CertKeyPEMPair | |||
| 
 | |||
| // CaddyModule returns the Caddy module information.
 | |||
| func (PEMLoader) CaddyModule() caddy.ModuleInfo { | |||
| 	return caddy.ModuleInfo{ | |||
| 		Name: "tls.certificates.load_pem", | |||
| 		New:  func() caddy.Module { return PEMLoader{} }, | |||
| 	} | |||
| } | |||
| 
 | |||
| // CertKeyPEMPair pairs certificate and key PEM blocks.
 | |||
| type CertKeyPEMPair struct { | |||
| 	CertificatePEM string   `json:"certificate"` | |||
| 	KeyPEM         string   `json:"key"` | |||
| 	Tags           []string `json:"tags,omitempty"` | |||
| } | |||
| 
 | |||
| // LoadCertificates returns the certificates contained in pl.
 | |||
| func (pl PEMLoader) LoadCertificates() ([]Certificate, error) { | |||
| 	var certs []Certificate | |||
| 	for i, pair := range pl { | |||
| 		cert, err := tls.X509KeyPair([]byte(pair.CertificatePEM), []byte(pair.KeyPEM)) | |||
| 		if err != nil { | |||
| 			return nil, fmt.Errorf("PEM pair %d: %v", i, err) | |||
| 		} | |||
| 		certs = append(certs, Certificate{ | |||
| 			Certificate: cert, | |||
| 			Tags:        pair.Tags, | |||
| 		}) | |||
| 	} | |||
| 	return certs, nil | |||
| } | |||
| 
 | |||
| // Interface guard
 | |||
| var _ CertificateLoader = (PEMLoader)(nil) | |||
					Loading…
					
					
				
		Reference in new issue