proksi 0.7.0

A batteries-included reverse proxy with automatic HTTPS using Cloudflare Pingora and Let's Encrypt.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

//! The HTTP and HTTPS services, listening on the addresses the hosts need

use std::{collections::BTreeSet, net::SocketAddr, sync::Arc};

use async_trait::async_trait;
use pingora::{
    apps::ServerApp,
    listeners::tls::TlsSettings,
    protocols::Stream,
    proxy::{http_proxy, http_proxy_service, HttpProxy},
    server::{configuration::ServerConf, ShutdownWatch},
    services::listening::Service,
};

use crate::tcp::{
    alpn::{select_protocols, AlpnProtocols},
    on_address,
    proxy::TcpProxy,
    TcpTarget,
};

use super::{cert_store::CertStore, https_proxy::Router, listener::Listener};

pub type ProxyService = Service<HttpProxy<Router>>;

/// HTTPS, and the `tcp` blocks of hosts sharing its addresses: once TLS is terminated, the
/// connections of those hosts (by SNI) are forwarded, the rest are HTTPS
pub struct HttpsApp {
    http: Arc<HttpProxy<Router>>,
    tcp: Option<TcpProxy>,
}

#[async_trait]
impl ServerApp for HttpsApp {
    async fn process_new(
        self: &Arc<Self>,
        stream: Stream,
        shutdown: &ShutdownWatch,
    ) -> Option<Stream> {
        if let Some(tcp) = &self.tcp {
            if let Some(target) = tcp.target(&stream) {
                tcp.forward(stream, target).await;
                return None;
            }
        }
        self.http.process_new(stream, shutdown).await
    }

    async fn cleanup(&self) {
        self.http.cleanup().await;
    }
}

/// Plain HTTP: hosts without TLS, ACME challenges and redirects to HTTPS
pub fn http_service(
    configuration: &Arc<ServerConf>,
    addresses: &BTreeSet<String>,
    default_address: SocketAddr,
    worker_threads: Option<usize>,
) -> ProxyService {
    let router = Router {
        listener: Listener::Http,
        default_address,
    };
    let mut service = http_proxy_service(configuration, router);
    service.threads = worker_threads;
    for address in addresses {
        service.add_tcp(address);
    }
    service
}

/// HTTPS: certificates by SNI, HTTP/2, hosts with TLS, and the `tcp` blocks on its addresses
pub fn https_service(
    configuration: &Arc<ServerConf>,
    addresses: &BTreeSet<String>,
    default_address: SocketAddr,
    tcp_targets: &Arc<Vec<TcpTarget>>,
    worker_threads: Option<usize>,
) -> Result<Service<HttpsApp>, anyhow::Error> {
    // `tcp` blocks of hosts sharing these addresses (chosen by SNI, and ALPN)
    let tcp = addresses
        .iter()
        .any(|address| on_address(tcp_targets, address).next().is_some())
        .then(|| TcpProxy::new(tcp_targets.clone()));

    let router = Router {
        listener: Listener::Https,
        default_address,
    };
    let app = HttpsApp {
        http: Arc::new(http_proxy(configuration, router)),
        tcp,
    };
    let mut service = Service::new("Pingora HTTP Proxy Service".to_string(), app);
    service.threads = worker_threads;
    for address in addresses {
        let mut settings = tls_settings()?;
        let protocols = AlpnProtocols::new(on_address(tcp_targets, address));
        select_protocols(&mut settings, protocols, true);
        service.add_tls_with_settings(address, None, settings);
    }
    Ok(service)
}

fn tls_settings() -> Result<TlsSettings, anyhow::Error> {
    let mut tls_settings = TlsSettings::with_callbacks(Box::new(CertStore::new()))?;
    tls_settings.enable_h2();

    // tls_settings.set_session_cache_mode(SslSessionCacheMode::SERVER);
    tls_settings.set_servername_callback(move |ssl_ref, _| CertStore::sni_callback(ssl_ref));

    // For now this is a hardcoded recommendation based on
    // https://developers.cloudflare.com/ssl/reference/protocols/
    // but will be made configurable in the future
    tls_settings.set_min_proto_version(Some(pingora::tls::ssl::SslVersion::TLS1_2))?;
    tls_settings.set_max_proto_version(Some(pingora::tls::ssl::SslVersion::TLS1_3))?;
    Ok(tls_settings)
}