tuxmain/rust-rpxy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

reconsider handling sni in http1.1 and 2 tls

Browse source
This commit is contained in:
Jun Kurihara 2022-07-21 11:59:46 +09:00
commit 548fb77c31
No known key found for this signature in database
GPG key ID: 48ADFD173ED22B03
2 changed files with 24 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/proxy/proxy_main.rs
View file

@ -1,5 +1,7 @@
// use super::proxy_handler::handle_request;
use crate::{error::*, globals::Globals, log::*, msg_handler::HttpMessageHandler};
use crate::{
backend::ServerNameLC, error::*, globals::Globals, log::*, msg_handler::HttpMessageHandler,
};
use hyper::{client::connect::Connect, server::conn::Http, service::service_fn, Body, Request};
use std::{net::SocketAddr, sync::Arc};
use tokio::{
@ -50,7 +52,7 @@ where
stream: I,
server: Http<LocalExecutor>,
peer_addr: SocketAddr,
tls_server_name: Option<&[u8]>,
tls_server_name: Option<ServerNameLC>,
) where
I: AsyncRead + AsyncWrite + Send + Unpin + 'static,
{
@ -60,7 +62,7 @@ where
return;
}
let inner = tls_server_name.map_or_else(|| None, |v| Some(v.to_vec()));
// let inner = tls_server_name.map_or_else(|| None, |v| Some(v.as_bytes().to_ascii_lowercase()));
self.globals.runtime_handle.clone().spawn(async move {
timeout(
self.globals.proxy_timeout + Duration::from_secs(1),
@ -73,7 +75,7 @@ where
peer_addr,
self.listening_on,
self.tls_enabled,
inner.clone(),
tls_server_name.clone(),
)
}),
)

40
src/proxy/proxy_tls.rs
View file

@ -7,6 +7,7 @@ use hyper::{client::connect::Connect, server::conn::Http};
use rustls::ServerConfig;
use std::sync::Arc;
use tokio::{net::TcpListener, sync::watch, time::Duration};
use tokio_rustls::TlsAcceptor;
impl<T> Proxy<T>
where
@ -41,40 +42,35 @@ where
let tcp_listener = TcpListener::bind(&self.listening_on).await?;
info!("Start TCP proxy serving with HTTPS request for configured host names");
let mut server_crypto: Option<Arc<ServerConfig>> = None;
// let mut server_crypto: Option<Arc<ServerConfig>> = None;
let mut tls_acceptor: Option<TlsAcceptor> = None;
loop {
select! {
tcp_cnx = tcp_listener.accept().fuse() => {
// First check SNI
let rustls_acceptor = rustls::server::Acceptor::new();
if server_crypto.is_none() || tcp_cnx.is_err() || rustls_acceptor.is_err() {
if tls_acceptor.is_none() || tcp_cnx.is_err() {
continue;
}
let (raw_stream, _client_addr) = tcp_cnx.unwrap();
let acceptor = tokio_rustls::LazyConfigAcceptor::new(rustls_acceptor.unwrap(), raw_stream).await;
if acceptor.is_err() {
continue;
}
let start = acceptor.unwrap();
let client_hello = start.client_hello();
// Find server config for given SNI
if client_hello.server_name().is_none(){
info!("No SNI in ClientHello");
continue;
}
let server_name = client_hello.server_name().unwrap().to_ascii_lowercase();
debug!("SNI in ClientHello: {:?}", server_name);
// Finally serve the TLS connection
if let Ok(stream) = start.into_stream(server_crypto.clone().unwrap()).await {
self.clone().client_serve(stream, server.clone(), _client_addr, Some(server_name.as_bytes()))
let (raw_stream, _client_addr) = tcp_cnx.unwrap();
if let Ok(stream) = tls_acceptor.as_ref().unwrap().accept(raw_stream).await {
// Retrieve SNI
let (_, conn) = stream.get_ref();
let server_name = conn.sni_hostname();
debug!("HTTP/2 or 1.1: SNI in ClientHello: {:?}", server_name);
let server_name = server_name.map_or_else(|| None, |v| Some(v.as_bytes().to_ascii_lowercase()));
if server_name.is_none(){
continue;
}
self.clone().client_serve(stream, server.clone(), _client_addr, server_name); // TODO: don't want to pass copied value...
}
}
_ = server_crypto_rx.changed().fuse() => {
if server_crypto_rx.borrow().is_none() {
break;
}
server_crypto = server_crypto_rx.borrow().clone();
let server_crypto = server_crypto_rx.borrow().clone().unwrap();
tls_acceptor = Some(TlsAcceptor::from(server_crypto));
}
complete => break
}