@marcel91200 / caddy Mirror · read-only / commits / c7d6c4cb
Fork 0

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

Mirrored from https://github.com/Slazee/caddy.git

Synced Nov 13, 21:45 UTC

reverseproxy: copy_response and copy_response_headers for handle_response routes (#4391)

* reverseproxy: New `copy_response` handler for `handle_response` routes Followup to #4298 and #4388. This adds a new `copy_response` handler which may only be used in `reverse_proxy`'s `handle_response` routes, which can be used to actually copy the proxy response downstream. Previously, if `handle_response` was used (with routes, not the status code mode), it was impossible to use the upstream's response body at all, because we would always close the body, expecting the routes to write a new body from scratch. To implement this, I had to refactor `h.reverseProxy()` to move all the code that came after the `HandleResponse` loop into a new function. This new function `h.finalizeResponse()` takes care of preparing the response by removing extra headers, dealing with trailers, then copying the headers and body downstream. Since basically what we want `copy_response` to do is invoke `h.finalizeResponse()` at a configurable point in time, we need to pass down the proxy handler, the response, and some other state via a new `req.WithContext(ctx)`. Wrapping a new context is pretty much the only way we have to jump a few layers in the HTTP middleware chain and let a handler pick up this information. Feels a bit dirty, but it works. Also fixed a bug with the `http.reverse_proxy.upstream.duration` placeholder, it always had the same duration as `http.reverse_proxy.upstream.latency`, but the former was meant to be the time taken for the roundtrip _plus_ copying/writing the response. * Delete the "Content-Length" header if we aren't copying Fixes a bug where the Content-Length will mismatch the actual bytes written if we skipped copying the response, so we get a message like this when using curl: ``` curl: (18) transfer closed with 18 bytes remaining to read ``` To replicate: ``` { admin off debug } :8881 { reverse_proxy 127.0.0.1:8882 { @200 status 200 handle_response @200 { header Foo bar } } } :8882 { header Content-Type application/json respond `{"hello": "world"}` 200 } ``` * Implement `copy_response_headers`, with include/exclude list support * Apply suggestions from code review Co-authored-by: Matt Holt <mholt@users.noreply.github.com>

Francis Lavoie committed Mar 9, 2022 at 13:00 UTC c7d6c4cbb951f7db87fc5aebf8382aeeca6c9f1d
5 files changed +419 -5
caddyconfig/httpcaddyfile/directives.go
+2
@@ -43,6 +43,7 @@ var directiveOrder = []string{
43 "root",
44
45 "header",
46 + "copy_response_headers",
47 "request_body",
48
49 "redir",
@@ -68,6 +69,7 @@ var directiveOrder = []string{
69 // handlers that typically respond to requests
70 "abort",
71 "error",
72 + "copy_response",
73 "respond",
74 "metrics",
75 "reverse_proxy",
caddytest/integration/caddyfile_adapt/reverse_proxy_handle_response.txt
+65
@@ -41,6 +41,20 @@ reverse_proxy 127.0.0.1:65535 {
41 handle_response @multi {
42 respond "Headers Foo, Bar AND statuses 401, 403 and 404!"
43 }
44 +
45 + @200 status 200
46 + handle_response @200 {
47 + copy_response_headers {
48 + include Foo Bar
49 + }
50 + respond "Copied headers from the response"
51 + }
52 +
53 + @201 status 201
54 + handle_response @201 {
55 + header Foo "Copying the response"
56 + copy_response 404
57 + }
58 }
59 ----------
60 {
@@ -163,6 +177,57 @@ reverse_proxy 127.0.0.1:65535 {
177 }
178 ]
179 },
180 + {
181 + "match": {
182 + "status_code": [
183 + 200
184 + ]
185 + },
186 + "routes": [
187 + {
188 + "handle": [
189 + {
190 + "handler": "copy_response_headers",
191 + "include": [
192 + "Foo",
193 + "Bar"
194 + ]
195 + },
196 + {
197 + "body": "Copied headers from the response",
198 + "handler": "static_response"
199 + }
200 + ]
201 + }
202 + ]
203 + },
204 + {
205 + "match": {
206 + "status_code": [
207 + 201
208 + ]
209 + },
210 + "routes": [
211 + {
212 + "handle": [
213 + {
214 + "handler": "headers",
215 + "response": {
216 + "set": {
217 + "Foo": [
218 + "Copying the response"
219 + ]
220 + }
221 + }
222 + },
223 + {
224 + "handler": "copy_response",
225 + "status_code": 404
226 + }
227 + ]
228 + }
229 + ]
230 + },
231 {
232 "routes": [
233 {
modules/caddyhttp/reverseproxy/caddyfile.go
+80
@@ -33,6 +33,8 @@ import (
33
34 func init() {
35 httpcaddyfile.RegisterHandlerDirective("reverse_proxy", parseCaddyfile)
36 + httpcaddyfile.RegisterHandlerDirective("copy_response", parseCopyResponseCaddyfile)
37 + httpcaddyfile.RegisterHandlerDirective("copy_response_headers", parseCopyResponseHeadersCaddyfile)
38 }
39
40 func parseCaddyfile(h httpcaddyfile.Helper) (caddyhttp.MiddlewareHandler, error) {
@@ -1019,6 +1021,84 @@ func (h *HTTPTransport) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
1021 return nil
1022 }
1023
1024 +func parseCopyResponseCaddyfile(h httpcaddyfile.Helper) (caddyhttp.MiddlewareHandler, error) {
1025 + crh := new(CopyResponseHandler)
1026 + err := crh.UnmarshalCaddyfile(h.Dispenser)
1027 + if err != nil {
1028 + return nil, err
1029 + }
1030 + return crh, nil
1031 +}
1032 +
1033 +// UnmarshalCaddyfile sets up the handler from Caddyfile tokens. Syntax:
1034 +//
1035 +// copy_response [<matcher>] [<status>] {
1036 +// status <status>
1037 +// }
1038 +//
1039 +func (h *CopyResponseHandler) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
1040 + for d.Next() {
1041 + args := d.RemainingArgs()
1042 + if len(args) == 1 {
1043 + if num, err := strconv.Atoi(args[0]); err == nil && num > 0 {
1044 + h.StatusCode = caddyhttp.WeakString(args[0])
1045 + break
1046 + }
1047 + }
1048 +
1049 + for d.NextBlock(0) {
1050 + switch d.Val() {
1051 + case "status":
1052 + if !d.NextArg() {
1053 + return d.ArgErr()
1054 + }
1055 + h.StatusCode = caddyhttp.WeakString(d.Val())
1056 + default:
1057 + return d.Errf("unrecognized subdirective '%s'", d.Val())
1058 + }
1059 + }
1060 + }
1061 + return nil
1062 +}
1063 +
1064 +func parseCopyResponseHeadersCaddyfile(h httpcaddyfile.Helper) (caddyhttp.MiddlewareHandler, error) {
1065 + crh := new(CopyResponseHeadersHandler)
1066 + err := crh.UnmarshalCaddyfile(h.Dispenser)
1067 + if err != nil {
1068 + return nil, err
1069 + }
1070 + return crh, nil
1071 +}
1072 +
1073 +// UnmarshalCaddyfile sets up the handler from Caddyfile tokens. Syntax:
1074 +//
1075 +// copy_response_headers [<matcher>] {
1076 +// exclude <fields...>
1077 +// }
1078 +//
1079 +func (h *CopyResponseHeadersHandler) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
1080 + for d.Next() {
1081 + args := d.RemainingArgs()
1082 + if len(args) > 0 {
1083 + return d.ArgErr()
1084 + }
1085 +
1086 + for d.NextBlock(0) {
1087 + switch d.Val() {
1088 + case "include":
1089 + h.Include = append(h.Include, d.RemainingArgs()...)
1090 +
1091 + case "exclude":
1092 + h.Exclude = append(h.Exclude, d.RemainingArgs()...)
1093 +
1094 + default:
1095 + return d.Errf("unrecognized subdirective '%s'", d.Val())
1096 + }
1097 + }
1098 + }
1099 + return nil
1100 +}
1101 +
1102 // UnmarshalCaddyfile deserializes Caddyfile tokens into h.
1103 //
1104 // dynamic srv [<name>] {
modules/caddyhttp/reverseproxy/copyresponse.go new
+190
@@ -0,0 +1,190 @@
1 +// Copyright 2015 Matthew Holt and The Caddy Authors
2 +//
3 +// Licensed under the Apache License, Version 2.0 (the "License");
4 +// you may not use this file except in compliance with the License.
5 +// You may obtain a copy of the License at
6 +//
7 +// http://www.apache.org/licenses/LICENSE-2.0
8 +//
9 +// Unless required by applicable law or agreed to in writing, software
10 +// distributed under the License is distributed on an "AS IS" BASIS,
11 +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 +// See the License for the specific language governing permissions and
13 +// limitations under the License.
14 +
15 +package reverseproxy
16 +
17 +import (
18 + "fmt"
19 + "net/http"
20 + "strconv"
21 +
22 + "github.com/caddyserver/caddy/v2"
23 + "github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
24 + "github.com/caddyserver/caddy/v2/modules/caddyhttp"
25 +)
26 +
27 +func init() {
28 + caddy.RegisterModule(CopyResponseHandler{})
29 + caddy.RegisterModule(CopyResponseHeadersHandler{})
30 +}
31 +
32 +// CopyResponseHandler is a special HTTP handler which may
33 +// only be used within reverse_proxy's handle_response routes,
34 +// to copy the proxy response. EXPERIMENTAL, subject to change.
35 +type CopyResponseHandler struct {
36 + // To write the upstream response's body but with a different
37 + // status code, set this field to the desired status code.
38 + StatusCode caddyhttp.WeakString `json:"status_code,omitempty"`
39 +
40 + ctx caddy.Context
41 +}
42 +
43 +// CaddyModule returns the Caddy module information.
44 +func (CopyResponseHandler) CaddyModule() caddy.ModuleInfo {
45 + return caddy.ModuleInfo{
46 + ID: "http.handlers.copy_response",
47 + New: func() caddy.Module { return new(CopyResponseHandler) },
48 + }
49 +}
50 +
51 +// Provision ensures that h is set up properly before use.
52 +func (h *CopyResponseHandler) Provision(ctx caddy.Context) error {
53 + h.ctx = ctx
54 + return nil
55 +}
56 +
57 +// ServeHTTP implements the Handler interface.
58 +func (h CopyResponseHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request, _ caddyhttp.Handler) error {
59 + repl := req.Context().Value(caddy.ReplacerCtxKey).(*caddy.Replacer)
60 + hrc, ok := req.Context().Value(proxyHandleResponseContextCtxKey).(*handleResponseContext)
61 +
62 + // don't allow this to be used outside of handle_response routes
63 + if !ok {
64 + return caddyhttp.Error(http.StatusInternalServerError,
65 + fmt.Errorf("cannot use 'copy_response' outside of reverse_proxy's handle_response routes"))
66 + }
67 +
68 + // allow a custom status code to be written; otherwise the
69 + // status code from the upstream resposne is written
70 + if codeStr := h.StatusCode.String(); codeStr != "" {
71 + intVal, err := strconv.Atoi(repl.ReplaceAll(codeStr, ""))
72 + if err != nil {
73 + return caddyhttp.Error(http.StatusInternalServerError, err)
74 + }
75 + hrc.response.StatusCode = intVal
76 + }
77 +
78 + // make sure the reverse_proxy handler doesn't try to call
79 + // finalizeResponse again after we've already done it here.
80 + hrc.isFinalized = true
81 +
82 + // write the response
83 + return hrc.handler.finalizeResponse(rw, req, hrc.response, repl, hrc.start, hrc.logger, false)
84 +}
85 +
86 +// CopyResponseHeadersHandler is a special HTTP handler which may
87 +// only be used within reverse_proxy's handle_response routes,
88 +// to copy headers from the proxy response. EXPERIMENTAL;
89 +// subject to change.
90 +type CopyResponseHeadersHandler struct {
91 + // A list of header fields to copy from the response.
92 + // Cannot be defined at the same time as Exclude.
93 + Include []string `json:"include,omitempty"`
94 +
95 + // A list of header fields to skip copying from the response.
96 + // Cannot be defined at the same time as Include.
97 + Exclude []string `json:"exclude,omitempty"`
98 +
99 + includeMap map[string]struct{}
100 + excludeMap map[string]struct{}
101 + ctx caddy.Context
102 +}
103 +
104 +// CaddyModule returns the Caddy module information.
105 +func (CopyResponseHeadersHandler) CaddyModule() caddy.ModuleInfo {
106 + return caddy.ModuleInfo{
107 + ID: "http.handlers.copy_response_headers",
108 + New: func() caddy.Module { return new(CopyResponseHeadersHandler) },
109 + }
110 +}
111 +
112 +// Validate ensures the h's configuration is valid.
113 +func (h *CopyResponseHeadersHandler) Validate() error {
114 + if len(h.Exclude) > 0 && len(h.Include) > 0 {
115 + return fmt.Errorf("cannot define both 'exclude' and 'include' lists at the same time")
116 + }
117 +
118 + return nil
119 +}
120 +
121 +// Provision ensures that h is set up properly before use.
122 +func (h *CopyResponseHeadersHandler) Provision(ctx caddy.Context) error {
123 + h.ctx = ctx
124 +
125 + // Optimize the include list by converting it to a map
126 + if len(h.Include) > 0 {
127 + h.includeMap = map[string]struct{}{}
128 + }
129 + for _, field := range h.Include {
130 + h.includeMap[http.CanonicalHeaderKey(field)] = struct{}{}
131 + }
132 +
133 + // Optimize the exclude list by converting it to a map
134 + if len(h.Exclude) > 0 {
135 + h.excludeMap = map[string]struct{}{}
136 + }
137 + for _, field := range h.Exclude {
138 + h.excludeMap[http.CanonicalHeaderKey(field)] = struct{}{}
139 + }
140 +
141 + return nil
142 +}
143 +
144 +// ServeHTTP implements the Handler interface.
145 +func (h CopyResponseHeadersHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request, next caddyhttp.Handler) error {
146 + hrc, ok := req.Context().Value(proxyHandleResponseContextCtxKey).(*handleResponseContext)
147 +
148 + // don't allow this to be used outside of handle_response routes
149 + if !ok {
150 + return caddyhttp.Error(http.StatusInternalServerError,
151 + fmt.Errorf("cannot use 'copy_response_headers' outside of reverse_proxy's handle_response routes"))
152 + }
153 +
154 + for field, values := range hrc.response.Header {
155 + // Check the include list first, skip
156 + // the header if it's _not_ in this list.
157 + if len(h.includeMap) > 0 {
158 + if _, ok := h.includeMap[field]; !ok {
159 + continue
160 + }
161 + }
162 +
163 + // Then, check the exclude list, skip
164 + // the header if it _is_ in this list.
165 + if len(h.excludeMap) > 0 {
166 + if _, ok := h.excludeMap[field]; ok {
167 + continue
168 + }
169 + }
170 +
171 + // Copy all the values for the header.
172 + for _, value := range values {
173 + rw.Header().Add(field, value)
174 + }
175 + }
176 +
177 + return next.ServeHTTP(rw, req)
178 +}
179 +
180 +// Interface guards
181 +var (
182 + _ caddyhttp.MiddlewareHandler = (*CopyResponseHandler)(nil)
183 + _ caddyfile.Unmarshaler = (*CopyResponseHandler)(nil)
184 + _ caddy.Provisioner = (*CopyResponseHandler)(nil)
185 +
186 + _ caddyhttp.MiddlewareHandler = (*CopyResponseHeadersHandler)(nil)
187 + _ caddyfile.Unmarshaler = (*CopyResponseHeadersHandler)(nil)
188 + _ caddy.Provisioner = (*CopyResponseHeadersHandler)(nil)
189 + _ caddy.Validator = (*CopyResponseHeadersHandler)(nil)
190 +)
modules/caddyhttp/reverseproxy/reverseproxy.go
+82 -5
@@ -790,12 +790,33 @@ func (h *Handler) reverseProxy(rw http.ResponseWriter, req *http.Request, repl *
790
791 h.logger.Debug("handling response", zap.Int("handler", i))
792
793 + // we make some data available via request context to child routes
794 + // so that they may inherit some options and functions from the
795 + // handler, and be able to copy the response.
796 + hrc := &handleResponseContext{
797 + handler: h,
798 + response: res,
799 + start: start,
800 + logger: logger,
801 + }
802 + ctx := req.Context()
803 + ctx = context.WithValue(ctx, proxyHandleResponseContextCtxKey, hrc)
804 +
805 // pass the request through the response handler routes
794 - routeErr := rh.Routes.Compile(next).ServeHTTP(rw, req)
806 + routeErr := rh.Routes.Compile(next).ServeHTTP(rw, req.WithContext(ctx))
807 +
808 + // if the response handler routes already finalized the response,
809 + // we can return early. It should be finalized if the routes executed
810 + // included a copy_response handler. If a fresh response was written
811 + // by the routes instead, then we still need to finalize the response
812 + // without copying the body.
813 + if routeErr == nil && hrc.isFinalized {
814 + return nil
815 + }
816
796 - // always close the response body afterwards since it's expected
817 + // always close the response body afterwards, since it's expected
818 // that the response handler routes will have written to the
798 - // response writer with a new body
819 + // response writer with a new body, if it wasn't already finalized.
820 res.Body.Close()
821 bodyClosed = true
822
@@ -804,8 +825,25 @@ func (h *Handler) reverseProxy(rw http.ResponseWriter, req *http.Request, repl *
825 // the roundtrip was successful and to not retry
826 return roundtripSucceeded{routeErr}
827 }
828 +
829 + // we've already closed the body, so there's no use allowing
830 + // another response handler to run as well
831 + break
832 }
833
834 + return h.finalizeResponse(rw, req, res, repl, start, logger, bodyClosed)
835 +}
836 +
837 +// finalizeResponse prepares and copies the response.
838 +func (h Handler) finalizeResponse(
839 + rw http.ResponseWriter,
840 + req *http.Request,
841 + res *http.Response,
842 + repl *caddy.Replacer,
843 + start time.Time,
844 + logger *zap.Logger,
845 + bodyClosed bool,
846 +) error {
847 // deal with 101 Switching Protocols responses: (WebSocket, h2c, etc)
848 if res.StatusCode == http.StatusSwitchingProtocols {
849 h.handleUpgradeResponse(logger, rw, req, res)
@@ -818,6 +856,13 @@ func (h *Handler) reverseProxy(rw http.ResponseWriter, req *http.Request, repl *
856 res.Header.Del(h)
857 }
858
859 + // remove the content length if we're not going to be copying
860 + // from the response, because otherwise there'll be a mismatch
861 + // between bytes written and the advertised length
862 + if bodyClosed {
863 + res.Header.Del("Content-Length")
864 + }
865 +
866 // apply any response header operations
867 if h.Headers != nil && h.Headers.Response != nil {
868 if h.Headers.Response.Require == nil ||
@@ -841,7 +886,7 @@ func (h *Handler) reverseProxy(rw http.ResponseWriter, req *http.Request, repl *
886
887 rw.WriteHeader(res.StatusCode)
888 if !bodyClosed {
844 - err = h.copyResponse(rw, res.Body, h.flushInterval(req, res))
889 + err := h.copyResponse(rw, res.Body, h.flushInterval(req, res))
890 res.Body.Close() // close now, instead of defer, to populate res.Trailer
891 if err != nil {
892 // we're streaming the response and we've already written headers, so
@@ -863,7 +908,7 @@ func (h *Handler) reverseProxy(rw http.ResponseWriter, req *http.Request, repl *
908 }
909
910 // total duration spent proxying, including writing response body
866 - repl.Set("http.reverse_proxy.upstream.duration", duration)
911 + repl.Set("http.reverse_proxy.upstream.duration", time.Since(start))
912
913 if len(res.Trailer) == announcedTrailers {
914 copyHeader(rw.Header(), res.Trailer)
@@ -1227,6 +1272,38 @@ var bufPool = sync.Pool{
1272 },
1273 }
1274
1275 +// handleResponseContext carries some contextual information about the
1276 +// the current proxy handling.
1277 +type handleResponseContext struct {
1278 + // handler is the active proxy handler instance, so that
1279 + // routes like copy_response may inherit some config
1280 + // options and have access to handler methods.
1281 + handler *Handler
1282 +
1283 + // response is the actual response received from the proxy
1284 + // roundtrip, to potentially be copied if a copy_response
1285 + // handler is in the handle_response routes.
1286 + response *http.Response
1287 +
1288 + // start is the time just before the proxy roundtrip was
1289 + // performed, used for logging.
1290 + start time.Time
1291 +
1292 + // logger is the prepared logger which is used to write logs
1293 + // with the request, duration, and selected upstream attached.
1294 + logger *zap.Logger
1295 +
1296 + // isFinalized is whether the response has been finalized,
1297 + // i.e. copied and closed, to make sure that it doesn't
1298 + // happen twice.
1299 + isFinalized bool
1300 +}
1301 +
1302 +// proxyHandleResponseContextCtxKey is the context key for the active proxy handler
1303 +// so that handle_response routes can inherit some config options
1304 +// from the proxy handler.
1305 +const proxyHandleResponseContextCtxKey caddy.CtxKey = "reverse_proxy_handle_response_context"
1306 +
1307 // Interface guards
1308 var (
1309 _ caddy.Provisioner = (*Handler)(nil)