extern/zrok
1
1
Fork 0
mirror of https://github.com/openziti/zrok.git synced 2024-11-26 01:54:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

host match control in http frontend (#48)

Browse Source
This commit is contained in:
Michael Quigley 2022-09-06 15:23:36 -04:00
parent 8095128c91
commit 2004469d5f
No known key found for this signature in database
GPG Key ID: 9B60314A9DD20A62
2 changed files with 68 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
endpoints/frontend/config.go
View File

@ -8,6 +8,7 @@ import (
type Config struct { type Config struct {
Identity string Identity string
Address string Address string
HostMatch string
} }
func DefaultConfig() *Config { func DefaultConfig() *Config {

26
endpoints/frontend/http.go
View File

@ -39,13 +39,13 @@ func NewHTTP(cfg *Config) (*httpListen, error) {
zTransport := http.DefaultTransport.(*http.Transport).Clone() zTransport := http.DefaultTransport.(*http.Transport).Clone()
zTransport.DialContext = zDialCtx.Dial zTransport.DialContext = zDialCtx.Dial
proxy, err := NewServiceProxy(zCtx) proxy, err := newServiceProxy(cfg, zCtx)
if err != nil { if err != nil {
return nil, err return nil, err
} }
proxy.Transport = zTransport proxy.Transport = zTransport
handler := basicAuth(util.NewProxyHandler(proxy), "zrok", zCtx) handler := basicAuth(util.NewProxyHandler(proxy), "zrok", cfg, zCtx)
return &httpListen{ return &httpListen{
cfg: cfg, cfg: cfg,
zCtx: zCtx, zCtx: zCtx,
@ -66,8 +66,8 @@ func (self *zitiDialContext) Dial(_ context.Context, _ string, addr string) (net
return self.ctx.Dial(svcName) return self.ctx.Dial(svcName)
} }
func NewServiceProxy(ctx ziti.Context) (*httputil.ReverseProxy, error) { func newServiceProxy(cfg *Config, ctx ziti.Context) (*httputil.ReverseProxy, error) {
proxy := hostTargetReverseProxy(ctx) proxy := hostTargetReverseProxy(cfg, ctx)
director := proxy.Director director := proxy.Director
proxy.Director = func(req *http.Request) { proxy.Director = func(req *http.Request) {
director(req) director(req)
@ -83,9 +83,9 @@ func NewServiceProxy(ctx ziti.Context) (*httputil.ReverseProxy, error) {
return proxy, nil return proxy, nil
} }
func hostTargetReverseProxy(ctx ziti.Context) *httputil.ReverseProxy { func hostTargetReverseProxy(cfg *Config, ctx ziti.Context) *httputil.ReverseProxy {
director := func(req *http.Request) { director := func(req *http.Request) {
targetSvc := resolveService(req.Host) targetSvc := resolveService(cfg.HostMatch, req.Host)
if svc, found := getRefreshedService(targetSvc, ctx); found { if svc, found := getRefreshedService(targetSvc, ctx); found {
if cfg, found := svc.Configs[model.ZrokProxyConfig]; found { if cfg, found := svc.Configs[model.ZrokProxyConfig]; found {
logrus.Debugf("auth model: %v", cfg) logrus.Debugf("auth model: %v", cfg)
@ -149,9 +149,10 @@ func singleJoiningSlash(a, b string) string {
return a + b return a + b
} }
func basicAuth(handler http.Handler, realm string, ctx ziti.Context) http.HandlerFunc { func basicAuth(handler http.Handler, realm string, cfg *Config, ctx ziti.Context) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) { return func(w http.ResponseWriter, r *http.Request) {
svcName := resolveService(r.Host) svcName := resolveService(cfg.HostMatch, r.Host)
if svcName != "" {
if svc, found := getRefreshedService(svcName, ctx); found { if svc, found := getRefreshedService(svcName, ctx); found {
if cfg, found := svc.Configs[model.ZrokProxyConfig]; found { if cfg, found := svc.Configs[model.ZrokProxyConfig]; found {
if scheme, found := cfg["auth_scheme"]; found { if scheme, found := cfg["auth_scheme"]; found {
@ -218,6 +219,9 @@ func basicAuth(handler http.Handler, realm string, ctx ziti.Context) http.Handle
} else { } else {
logrus.Infof("%v -> service '%v' not found", r.RemoteAddr, svcName) logrus.Infof("%v -> service '%v' not found", r.RemoteAddr, svcName)
} }
} else {
logrus.Warnf("host '%v' did not match host match", r.Host)
}
} }
} }
@ -227,13 +231,15 @@ func writeUnauthorizedResponse(w http.ResponseWriter, realm string) {
w.Write([]byte("No Authorization\n")) w.Write([]byte("No Authorization\n"))
} }
func resolveService(host string) string { func resolveService(hostMatch string, host string) string {
logrus.Debugf("host = '%v'", host) logrus.Debugf("host = '%v'", host)
if hostMatch == "" || strings.Contains(hostMatch, host) {
tokens := strings.Split(host, ".") tokens := strings.Split(host, ".")
if len(tokens) > 0 { if len(tokens) > 0 {
return tokens[0] return tokens[0]
} }
return "zrok" }
return ""
} }
func getRefreshedService(name string, ctx ziti.Context) (*edge.Service, bool) { func getRefreshedService(name string, ctx ziti.Context) (*edge.Service, bool) {