diff --git a/.gitmodules b/.gitmodules index 0d6a404..7ff65fe 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,3 +1,6 @@ [submodule "submodules/rusty-http-cache-semantics"] path = submodules/rusty-http-cache-semantics url = git@github.com:junkurihara/rusty-http-cache-semantics.git +[submodule "submodules/rustls-acme"] + path = submodules/rustls-acme + url = git@github.com:junkurihara/rustls-acme.git diff --git a/CHANGELOG.md b/CHANGELOG.md index 53a74b1..30a9254 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,17 @@ # CHANGELOG -## 0.9.0 (Unreleased) +## 0.10.0 (Unreleased) + +## 0.9.0 + +### Important Changes + +- Breaking: Experimental ACME support is added. Check the new configuration options and README.md for ACME support. Note that it is still under development and may have some issues. + +### Improvement + +- Refactor: lots of minor improvements +- Deps ## 0.8.1 diff --git a/Cargo.toml b/Cargo.toml index 355e5b1..e990fdf 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,5 +1,5 @@ [workspace.package] -version = "0.8.1" +version = "0.9.0-alpha.1" authors = ["Jun Kurihara"] homepage = "https://github.com/junkurihara/rust-rpxy" repository = "https://github.com/junkurihara/rust-rpxy" @@ -9,7 +9,7 @@ edition = "2021" publish = false [workspace] -members = ["rpxy-bin", "rpxy-lib", "rpxy-certs"] +members = ["rpxy-bin", "rpxy-lib", "rpxy-certs", "rpxy-acme"] exclude = ["submodules"] resolver = "2" diff --git a/README.md b/README.md index 20d7891..0b29149 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# rpxy: A simple and ultrafast reverse-proxy serving multiple domain names with TLS termination, written in pure Rust +# rpxy: A simple and ultrafast reverse-proxy serving multiple domain names with TLS termination, written in Rust [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE) ![Unit Test](https://github.com/junkurihara/rust-rpxy/actions/workflows/ci.yml/badge.svg) @@ -10,9 +10,11 @@ ## Introduction -`rpxy` [ahr-pik-see] is an implementation of simple and lightweight reverse-proxy with some additional features. The implementation is based on [`hyper`](https://github.com/hyperium/hyper), [`rustls`](https://github.com/rustls/rustls) and [`tokio`](https://github.com/tokio-rs/tokio), i.e., written in pure Rust. Our `rpxy` routes multiple host names to appropriate backend application servers while serving TLS connections. +`rpxy` [ahr-pik-see] is an implementation of simple and lightweight reverse-proxy with some additional features. The implementation is based on [`hyper`](https://github.com/hyperium/hyper), [`rustls`](https://github.com/rustls/rustls) and [`tokio`](https://github.com/tokio-rs/tokio), i.e., written in Rust [^pure_rust]. Our `rpxy` routes multiple host names to appropriate backend application servers while serving TLS connections. - As default, `rpxy` provides the *TLS connection sanitization* by correctly binding a certificate used to establish a secure channel with the backend application. Specifically, it always keeps the consistency between the given SNI (server name indication) in `ClientHello` of the underlying TLS and the domain name given by the overlaid HTTP HOST header (or URL in Request line) [^1]. Additionally, as a somewhat unstable feature, our `rpxy` can handle the brand-new HTTP/3 connection thanks to [`quinn`](https://github.com/quinn-rs/quinn), [`s2n-quic`](https://github.com/aws/s2n-quic) and [`hyperium/h3`](https://github.com/hyperium/h3).[^h3lib] +[^pure_rust]: Doubtfully can be claimed to be written in pure Rust since current `rpxy` is based on `aws-lc-rs` for cryptographic operations. + +By default, `rpxy` provides the *TLS connection sanitization* by correctly binding a certificate used to establish a secure channel with the backend application. Specifically, it always keeps the consistency between the given SNI (server name indication) in `ClientHello` of the underlying TLS and the domain name given by the overlaid HTTP HOST header (or URL in Request line) [^1]. Additionally, as a somewhat unstable feature, our `rpxy` can handle the brand-new HTTP/3 connection thanks to [`quinn`](https://github.com/quinn-rs/quinn), [`s2n-quic`](https://github.com/aws/s2n-quic) and [`hyperium/h3`](https://github.com/hyperium/h3).[^h3lib] Furthermore, `rpxy` supports the automatic issuance and renewal of certificates via [TLS-ALPN-01 (RFC8737)](https://www.rfc-editor.org/rfc/rfc8737) of [ACME protocol (RFC8555)](https://www.rfc-editor.org/rfc/rfc8555) thanks to [`rustls-acme`](https://github.com/FlorianUekermann/rustls-acme). [^h3lib]: HTTP/3 libraries are mutually exclusive. You need to explicitly specify `s2n-quic` with `--no-default-features` flag. Also note that if you build `rpxy` with `s2n-quic`, then it requires `openssl` just for building the package. @@ -298,6 +300,32 @@ max_cache_each_size_on_memory = 4096 # optional. default is 4k if 0, it is alway A *storable* (in the context of an HTTP message) response is stored if its size is less than or equal to `max_cache_each_size` in bytes. If it is also less than or equal to `max_cache_each_size_on_memory`, it is stored as an on-memory object. Otherwise, it is stored as a temporary file. Note that `max_cache_each_size` must be larger or equal to `max_cache_each_size_on_memory`. Also note that once `rpxy` restarts or the config is updated, the cache is totally eliminated not only from the on-memory table but also from the file system. +### Automated Certificate Issuance and Renewal via TLS-ALPN-01 ACME protocol + +This is a brand-new feature and maybe still unstable. Thanks to the [`rustls-acme`](https://github.com/FlorianUekermann/rustls-acme), the automatic issuance and renewal of certificates are finally available in `rpxy`. To enable this feature, you need to specify the following entries in `config.toml`. + +```toml +# ACME enabled domain name. +# ACME will be used to get a certificate for the server_name with ACME tls-alpn-01 protocol. +# Note that acme option must be specified in the experimental section. +[apps.localhost_with_acme] +server_name = 'example.org' +reverse_proxy = [{ upstream = [{ location = 'example.com', tls = true }] }] +tls = { https_redirection = true, acme = true } # do not specify tls_cert_path and/or tls_cert_key_path +``` + +For the ACME enabled domain, the following settings are referred to acquire a certificate. + +```toml +# Global ACME settings. Unless specified, ACME is disabled. +[experimental.acme] +dir_url = "https://localhost:14000/dir" # optional. default is "https://acme-v02.api.letsencrypt.org/directory" +email = "test@example.com" +registry_path = "./acme_registry" # optional. default is "./acme_registry" relative to the current working directory +``` + +The above configuration is common to all ACME enabled domains. Note that the https port must be open to the public to verify the domain ownership. + ## TIPS ### Using Private Key Issued by Let's Encrypt diff --git a/config-example.toml b/config-example.toml index c3d1e47..d279e50 100644 --- a/config-example.toml +++ b/config-example.toml @@ -89,6 +89,14 @@ server_name = 'localhost.localdomain' reverse_proxy = [{ upstream = [{ location = 'www.google.com', tls = true }] }] ###################################################################### +###################################################################### +# ACME enabled example. ACME will be used to get a certificate for the server_name with ACME tls-alpn-01 protocol. +# Note that acme option must be specified in the experimental section. +[apps.localhost_with_acme] +server_name = 'kubernetes.docker.internal' +reverse_proxy = [{ upstream = [{ location = 'example.com', tls = true }] }] +tls = { https_redirection = true, acme = true } + ################################### # Experimantal settings # ################################### @@ -119,3 +127,9 @@ cache_dir = './cache' # optional. default is "./cache" relative t max_cache_entry = 1000 # optional. default is 1k max_cache_each_size = 65535 # optional. default is 64k max_cache_each_size_on_memory = 4096 # optional. default is 4k if 0, it is always file cache. + +# ACME settings. Unless specified, ACME is disabled. +[experimental.acme] +dir_url = "https://localhost:14000/dir" # optional. default is "https://acme-v02.api.letsencrypt.org/directory" +email = "test@example.com" +registry_path = "./acme_registry" # optional. default is "./acme_registry" relative to the current working directory diff --git a/docker/docker-compose-slim.yml b/docker/docker-compose-slim.yml index e02c20b..0337d20 100644 --- a/docker/docker-compose-slim.yml +++ b/docker/docker-compose-slim.yml @@ -31,6 +31,7 @@ services: volumes: - ./log:/rpxy/log:rw - ./cache:/rpxy/cache:rw + - ./acme_registry:/rpxy/acme_registry:rw - ../example-certs/server.crt:/certs/server.crt:ro - ../example-certs/server.key:/certs/server.key:ro - ../config-example.toml:/etc/rpxy.toml:ro diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml index 435dcb3..a8ad4af 100644 --- a/docker/docker-compose.yml +++ b/docker/docker-compose.yml @@ -31,6 +31,7 @@ services: volumes: - ./log:/rpxy/log:rw - ./cache:/rpxy/cache:rw + - ./acme_registry:/rpxy/acme_registry:rw - ../example-certs/server.crt:/certs/server.crt:ro - ../example-certs/server.key:/certs/server.key:ro - ../config-example.toml:/etc/rpxy.toml:ro diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml new file mode 100644 index 0000000..9775749 --- /dev/null +++ b/rpxy-acme/Cargo.toml @@ -0,0 +1,33 @@ +[package] +name = "rpxy-acme" +description = "ACME manager library for `rpxy`" +version.workspace = true +authors.workspace = true +homepage.workspace = true +repository.workspace = true +license.workspace = true +readme.workspace = true +edition.workspace = true +publish.workspace = true + +[dependencies] +url = { version = "2.5.2" } +rustc-hash = "2.0.0" +thiserror = "1.0.63" +tracing = "0.1.40" +async-trait = "0.1.81" +base64 = "0.22.1" +aws-lc-rs = { version = "1.8.1", default-features = false, features = [ + "aws-lc-sys", +] } +blocking = "1.6.1" +rustls = { version = "0.23.12", default-features = false, features = [ + "std", + "aws_lc_rs", +] } +rustls-platform-verifier = { version = "0.3.2" } +rustls-acme = { path = "../submodules/rustls-acme/", default-features = false, features = [ + "aws-lc-rs", +] } +tokio = { version = "1.39.0", default-features = false } +tokio-stream = { version = "0.1.15", default-features = false } diff --git a/rpxy-acme/src/constants.rs b/rpxy-acme/src/constants.rs new file mode 100644 index 0000000..7b544b0 --- /dev/null +++ b/rpxy-acme/src/constants.rs @@ -0,0 +1,8 @@ +/// ACME directory url +pub const ACME_DIR_URL: &str = "https://acme-v02.api.letsencrypt.org/directory"; + +/// ACME registry path that stores account key and certificate +pub const ACME_REGISTRY_PATH: &str = "./acme_registry"; + +/// ACME accounts directory, subdirectory of ACME_REGISTRY_PATH +pub(crate) const ACME_ACCOUNT_SUBDIR: &str = "accounts"; diff --git a/rpxy-acme/src/dir_cache.rs b/rpxy-acme/src/dir_cache.rs new file mode 100644 index 0000000..5170ad6 --- /dev/null +++ b/rpxy-acme/src/dir_cache.rs @@ -0,0 +1,107 @@ +use crate::constants::ACME_ACCOUNT_SUBDIR; +use async_trait::async_trait; +use aws_lc_rs as crypto; +use base64::prelude::*; +use blocking::unblock; +use crypto::digest::{Context, SHA256}; +use rustls_acme::{AccountCache, CertCache}; +use std::{ + io::ErrorKind, + path::{Path, PathBuf}, +}; + +enum FileType { + Account, + Cert, +} + +#[derive(Debug, PartialEq, Eq, Clone)] +pub struct DirCache { + pub(super) account_dir: PathBuf, + pub(super) cert_dir: PathBuf, +} + +impl DirCache { + pub fn new

(dir: P, server_name: &str) -> Self + where + P: AsRef, + { + Self { + account_dir: dir.as_ref().join(ACME_ACCOUNT_SUBDIR), + cert_dir: dir.as_ref().join(server_name), + } + } + async fn read_if_exist(&self, file: impl AsRef, file_type: FileType) -> Result>, std::io::Error> { + let subdir = match file_type { + FileType::Account => &self.account_dir, + FileType::Cert => &self.cert_dir, + }; + let file_path = subdir.join(file); + match unblock(move || std::fs::read(file_path)).await { + Ok(content) => Ok(Some(content)), + Err(err) => match err.kind() { + ErrorKind::NotFound => Ok(None), + _ => Err(err), + }, + } + } + async fn write(&self, file: impl AsRef, contents: impl AsRef<[u8]>, file_type: FileType) -> Result<(), std::io::Error> { + let subdir = match file_type { + FileType::Account => &self.account_dir, + FileType::Cert => &self.cert_dir, + } + .clone(); + let subdir_clone = subdir.clone(); + unblock(move || std::fs::create_dir_all(subdir_clone)).await?; + let file_path = subdir.join(file); + let contents = contents.as_ref().to_owned(); + unblock(move || std::fs::write(file_path, contents)).await + } + pub fn cached_account_file_name(contact: &[String], directory_url: impl AsRef) -> String { + let mut ctx = Context::new(&SHA256); + for el in contact { + ctx.update(el.as_ref()); + ctx.update(&[0]) + } + ctx.update(directory_url.as_ref().as_bytes()); + let hash = BASE64_URL_SAFE_NO_PAD.encode(ctx.finish()); + format!("cached_account_{}", hash) + } + pub fn cached_cert_file_name(domains: &[String], directory_url: impl AsRef) -> String { + let mut ctx = Context::new(&SHA256); + for domain in domains { + ctx.update(domain.as_ref()); + ctx.update(&[0]) + } + ctx.update(directory_url.as_ref().as_bytes()); + let hash = BASE64_URL_SAFE_NO_PAD.encode(ctx.finish()); + format!("cached_cert_{}", hash) + } +} + +#[async_trait] +impl CertCache for DirCache { + type EC = std::io::Error; + async fn load_cert(&self, domains: &[String], directory_url: &str) -> Result>, Self::EC> { + let file_name = Self::cached_cert_file_name(domains, directory_url); + self.read_if_exist(file_name, FileType::Cert).await + } + async fn store_cert(&self, domains: &[String], directory_url: &str, cert: &[u8]) -> Result<(), Self::EC> { + let file_name = Self::cached_cert_file_name(domains, directory_url); + self.write(file_name, cert, FileType::Cert).await + } +} + +#[async_trait] +impl AccountCache for DirCache { + type EA = std::io::Error; + async fn load_account(&self, contact: &[String], directory_url: &str) -> Result>, Self::EA> { + let file_name = Self::cached_account_file_name(contact, directory_url); + self.read_if_exist(file_name, FileType::Account).await + } + + async fn store_account(&self, contact: &[String], directory_url: &str, account: &[u8]) -> Result<(), Self::EA> { + let file_name = Self::cached_account_file_name(contact, directory_url); + self.write(file_name, account, FileType::Account).await + } +} diff --git a/rpxy-acme/src/error.rs b/rpxy-acme/src/error.rs new file mode 100644 index 0000000..08133c5 --- /dev/null +++ b/rpxy-acme/src/error.rs @@ -0,0 +1,15 @@ +use thiserror::Error; + +#[derive(Error, Debug)] +/// Error type for rpxy-acme +pub enum RpxyAcmeError { + /// Invalid acme registry path + #[error("Invalid acme registry path")] + InvalidAcmeRegistryPath, + /// Invalid url + #[error("Invalid url: {0}")] + InvalidUrl(#[from] url::ParseError), + /// IO error + #[error("IO error: {0}")] + Io(#[from] std::io::Error), +} diff --git a/rpxy-acme/src/lib.rs b/rpxy-acme/src/lib.rs new file mode 100644 index 0000000..6254a86 --- /dev/null +++ b/rpxy-acme/src/lib.rs @@ -0,0 +1,18 @@ +mod constants; +mod dir_cache; +mod error; +mod manager; + +#[allow(unused_imports)] +mod log { + pub(super) use tracing::{debug, error, info, warn}; +} + +pub use constants::{ACME_DIR_URL, ACME_REGISTRY_PATH}; +pub use dir_cache::DirCache; +pub use error::RpxyAcmeError; +pub use manager::AcmeManager; + +pub mod reexports { + pub use rustls_acme::is_tls_alpn_challenge; +} diff --git a/rpxy-acme/src/manager.rs b/rpxy-acme/src/manager.rs new file mode 100644 index 0000000..e54731c --- /dev/null +++ b/rpxy-acme/src/manager.rs @@ -0,0 +1,171 @@ +use crate::{ + constants::{ACME_DIR_URL, ACME_REGISTRY_PATH}, + dir_cache::DirCache, + error::RpxyAcmeError, + log::*, +}; +use rustc_hash::FxHashMap as HashMap; +use rustls::ServerConfig; +use rustls_acme::AcmeConfig; +use std::{path::PathBuf, sync::Arc}; +use tokio::runtime::Handle; +use tokio_stream::StreamExt; +use url::Url; + +#[derive(Debug, Clone)] +/// ACME settings +pub struct AcmeManager { + /// ACME directory url + acme_dir_url: Url, + // /// ACME registry directory + // acme_registry_dir: PathBuf, + /// ACME contacts + contacts: Vec, + /// ACME directly cache information + inner: HashMap, + /// Tokio runtime handle + runtime_handle: Handle, +} + +impl AcmeManager { + /// Create a new instance. Note that for each domain, a new AcmeConfig is created. + /// This means that for each domain, a distinct operation will be dispatched and separated certificates will be generated. + pub fn try_new( + acme_dir_url: Option<&str>, + acme_registry_dir: Option<&str>, + contacts: &[String], + domains: &[String], + runtime_handle: Handle, + ) -> Result { + // Install aws_lc_rs as default crypto provider for rustls + let _ = rustls::crypto::CryptoProvider::install_default(rustls::crypto::aws_lc_rs::default_provider()); + + let acme_registry_dir = acme_registry_dir + .map(|v| v.to_ascii_lowercase()) + .map_or_else(|| PathBuf::from(ACME_REGISTRY_PATH), PathBuf::from); + if acme_registry_dir.exists() && !acme_registry_dir.is_dir() { + return Err(RpxyAcmeError::InvalidAcmeRegistryPath); + } + let acme_dir_url = acme_dir_url + .map(|v| v.to_ascii_lowercase()) + .as_deref() + .map_or_else(|| Url::parse(ACME_DIR_URL), Url::parse)?; + let contacts = contacts.iter().map(|email| format!("mailto:{email}")).collect::>(); + + let inner = domains + .iter() + .map(|domain| { + let domain = domain.to_ascii_lowercase(); + let dir_cache = DirCache::new(&acme_registry_dir, &domain); + (domain, dir_cache) + }) + .collect::>(); + + Ok(Self { + acme_dir_url, + // acme_registry_dir, + contacts, + inner, + runtime_handle, + }) + } + + /// Start ACME manager to manage certificates for each domain. + /// Returns a Vec> as a tasks handles and a map of domain to ServerConfig for challenge. + pub fn spawn_manager_tasks( + &self, + term_notify: Option>, + ) -> (Vec>, HashMap>) { + let rustls_client_config = rustls::ClientConfig::builder() + .dangerous() // The `Verifier` we're using is actually safe + .with_custom_certificate_verifier(Arc::new(rustls_platform_verifier::Verifier::new())) + .with_no_client_auth(); + let rustls_client_config = Arc::new(rustls_client_config); + + let mut server_configs_for_challenge: HashMap> = HashMap::default(); + let join_handles = self + .inner + .clone() + .into_iter() + .map(|(domain, dir_cache)| { + let config = AcmeConfig::new([&domain]) + .contact(&self.contacts) + .cache(dir_cache.to_owned()) + .directory(self.acme_dir_url.as_str()) + .client_tls_config(rustls_client_config.clone()); + let mut state = config.state(); + server_configs_for_challenge.insert(domain.to_ascii_lowercase(), state.challenge_rustls_config()); + self.runtime_handle.spawn({ + let term_notify = term_notify.clone(); + async move { + info!("rpxy ACME manager task for {domain} started"); + // infinite loop unless the return value is None + let task = async { + loop { + let Some(res) = state.next().await else { + error!("rpxy ACME manager task for {domain} exited"); + break; + }; + match res { + Ok(ok) => info!("rpxy ACME event: {ok:?}"), + Err(err) => error!("rpxy ACME error: {err:?}"), + } + } + }; + if let Some(notify) = term_notify.as_ref() { + tokio::select! { + _ = task => {}, + _ = notify.notified() => { info!("rpxy ACME manager task for {domain} terminated") } + } + } else { + task.await; + } + } + }) + }) + .collect::>(); + + (join_handles, server_configs_for_challenge) + } +} + +#[cfg(test)] +mod tests { + use crate::constants::ACME_ACCOUNT_SUBDIR; + + use super::*; + + #[tokio::test] + async fn test_try_new() { + let acme_dir_url = "https://acme.example.com/directory"; + let acme_registry_dir = "/tmp/acme"; + let contacts = vec!["test@example.com".to_string()]; + let handle = Handle::current(); + let acme_contexts: AcmeManager = AcmeManager::try_new( + Some(acme_dir_url), + Some(acme_registry_dir), + &contacts, + &["example.com".to_string(), "example.org".to_string()], + handle, + ) + .unwrap(); + assert_eq!(acme_contexts.inner.len(), 2); + assert_eq!(acme_contexts.contacts, vec!["mailto:test@example.com".to_string()]); + assert_eq!(acme_contexts.acme_dir_url.as_str(), acme_dir_url); + // assert_eq!(acme_contexts.acme_registry_dir, PathBuf::from(acme_registry_dir)); + assert_eq!( + acme_contexts.inner["example.com"], + DirCache { + account_dir: PathBuf::from(acme_registry_dir).join(ACME_ACCOUNT_SUBDIR), + cert_dir: PathBuf::from(acme_registry_dir).join("example.com"), + } + ); + assert_eq!( + acme_contexts.inner["example.org"], + DirCache { + account_dir: PathBuf::from(acme_registry_dir).join(ACME_ACCOUNT_SUBDIR), + cert_dir: PathBuf::from(acme_registry_dir).join("example.org"), + } + ); + } +} diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml index d571d1e..3a03f8e 100644 --- a/rpxy-bin/Cargo.toml +++ b/rpxy-bin/Cargo.toml @@ -13,14 +13,15 @@ publish.workspace = true # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html [features] -default = ["http3-quinn", "cache", "rustls-backend"] -# default = ["http3-s2n", "cache", "rustls-backend"] +default = ["http3-quinn", "cache", "rustls-backend", "acme"] +# default = ["http3-s2n", "cache", "rustls-backend", "acme"] http3-quinn = ["rpxy-lib/http3-quinn"] http3-s2n = ["rpxy-lib/http3-s2n"] native-tls-backend = ["rpxy-lib/native-tls-backend"] rustls-backend = ["rpxy-lib/rustls-backend"] webpki-roots = ["rpxy-lib/webpki-roots"] cache = ["rpxy-lib/cache"] +acme = ["rpxy-lib/acme", "rpxy-acme"] [dependencies] rpxy-lib = { path = "../rpxy-lib/", default-features = false, features = [ @@ -31,7 +32,7 @@ mimalloc = { version = "*", default-features = false } anyhow = "1.0.86" rustc-hash = "2.0.0" serde = { version = "1.0.204", default-features = false, features = ["derive"] } -tokio = { version = "1.38.0", default-features = false, features = [ +tokio = { version = "1.39.0", default-features = false, features = [ "net", "rt-multi-thread", "time", @@ -39,12 +40,12 @@ tokio = { version = "1.38.0", default-features = false, features = [ "macros", ] } async-trait = "0.1.81" - +futures-util = { version = "0.3.30", default-features = false } # config -clap = { version = "4.5.9", features = ["std", "cargo", "wrap_help"] } -toml = { version = "0.8.14", default-features = false, features = ["parse"] } -hot_reload = "0.1.5" +clap = { version = "4.5.10", features = ["std", "cargo", "wrap_help"] } +toml = { version = "0.8.15", default-features = false, features = ["parse"] } +hot_reload = "0.1.6" # logging tracing = { version = "0.1.40" } @@ -56,4 +57,6 @@ rpxy-certs = { path = "../rpxy-certs/", default-features = false, features = [ "http3", ] } +rpxy-acme = { path = "../rpxy-acme/", default-features = false, optional = true } + [dev-dependencies] diff --git a/rpxy-bin/src/config/mod.rs b/rpxy-bin/src/config/mod.rs index adc4ff2..079e477 100644 --- a/rpxy-bin/src/config/mod.rs +++ b/rpxy-bin/src/config/mod.rs @@ -3,7 +3,10 @@ mod service; mod toml; pub use { - self::toml::ConfigToml, parse::{build_cert_manager, build_settings, parse_opts}, service::ConfigTomlReloader, + toml::ConfigToml, }; + +#[cfg(feature = "acme")] +pub use parse::build_acme_manager; diff --git a/rpxy-bin/src/config/parse.rs b/rpxy-bin/src/config/parse.rs index f45ca17..a591c40 100644 --- a/rpxy-bin/src/config/parse.rs +++ b/rpxy-bin/src/config/parse.rs @@ -6,6 +6,9 @@ use rpxy_certs::{build_cert_reloader, CryptoFileSourceBuilder, CryptoReloader, S use rpxy_lib::{AppConfig, AppConfigList, ProxyConfig}; use rustc_hash::FxHashMap as HashMap; +#[cfg(feature = "acme")] +use rpxy_acme::{AcmeManager, ACME_DIR_URL, ACME_REGISTRY_PATH}; + /// Parsed options pub struct Opts { pub config_file_path: String, @@ -103,11 +106,43 @@ pub async fn build_cert_manager( if config.listen_port_tls.is_none() { return Ok(None); } + + #[cfg(feature = "acme")] + let acme_option = config.experimental.as_ref().and_then(|v| v.acme.clone()); + #[cfg(feature = "acme")] + let acme_dir_url = acme_option + .as_ref() + .and_then(|v| v.dir_url.as_deref()) + .unwrap_or(ACME_DIR_URL); + #[cfg(feature = "acme")] + let acme_registry_path = acme_option + .as_ref() + .and_then(|v| v.registry_path.as_deref()) + .unwrap_or(ACME_REGISTRY_PATH); + let mut crypto_source_map = HashMap::default(); for app in apps.0.values() { if let Some(tls) = app.tls.as_ref() { - ensure!(tls.tls_cert_key_path.is_some() && tls.tls_cert_path.is_some()); let server_name = app.server_name.as_ref().ok_or(anyhow!("No server name"))?; + + #[cfg(not(feature = "acme"))] + ensure!(tls.tls_cert_key_path.is_some() && tls.tls_cert_path.is_some()); + + #[cfg(feature = "acme")] + let tls = { + let mut tls = tls.clone(); + if let Some(true) = tls.acme { + ensure!(acme_option.is_some() && tls.tls_cert_key_path.is_none() && tls.tls_cert_path.is_none()); + // Both of tls_cert_key_path and tls_cert_path must be the same for ACME since it's a single file + let subdir = format!("{}/{}", acme_registry_path, server_name.to_ascii_lowercase()); + let file_name = + rpxy_acme::DirCache::cached_cert_file_name(&[server_name.to_ascii_lowercase()], acme_dir_url.to_ascii_lowercase()); + tls.tls_cert_key_path = Some(format!("{}/{}", subdir, file_name)); + tls.tls_cert_path = Some(format!("{}/{}", subdir, file_name)); + } + tls + }; + let crypto_file_source = CryptoFileSourceBuilder::default() .tls_cert_path(tls.tls_cert_path.as_ref().unwrap()) .tls_cert_key_path(tls.tls_cert_key_path.as_ref().unwrap()) @@ -119,3 +154,48 @@ pub async fn build_cert_manager( let res = build_cert_reloader(&crypto_source_map, None).await?; Ok(Some(res)) } + +/* ----------------------- */ +#[cfg(feature = "acme")] +/// Build acme manager +pub async fn build_acme_manager( + config: &ConfigToml, + runtime_handle: tokio::runtime::Handle, +) -> Result, anyhow::Error> { + let acme_option = config.experimental.as_ref().and_then(|v| v.acme.clone()); + if acme_option.is_none() { + return Ok(None); + } + let acme_option = acme_option.unwrap(); + + let domains = config + .apps + .as_ref() + .unwrap() + .0 + .values() + .filter_map(|app| { + // + if let Some(tls) = app.tls.as_ref() { + if let Some(true) = tls.acme { + return Some(app.server_name.as_ref().unwrap().to_owned()); + } + } + None + }) + .collect::>(); + + if domains.is_empty() { + return Ok(None); + } + + let acme_manager = AcmeManager::try_new( + acme_option.dir_url.as_deref(), + acme_option.registry_path.as_deref(), + &[acme_option.email], + domains.as_slice(), + runtime_handle, + )?; + + Ok(Some(acme_manager)) +} diff --git a/rpxy-bin/src/config/toml.rs b/rpxy-bin/src/config/toml.rs index 957296c..b2a70bb 100644 --- a/rpxy-bin/src/config/toml.rs +++ b/rpxy-bin/src/config/toml.rs @@ -41,12 +41,25 @@ pub struct CacheOption { pub max_cache_each_size_on_memory: Option, } +#[cfg(feature = "acme")] +#[derive(Deserialize, Debug, Default, PartialEq, Eq, Clone)] +pub struct AcmeOption { + pub dir_url: Option, + pub email: String, + pub registry_path: Option, +} + #[derive(Deserialize, Debug, Default, PartialEq, Eq, Clone)] pub struct Experimental { #[cfg(any(feature = "http3-quinn", feature = "http3-s2n"))] pub h3: Option, + #[cfg(feature = "cache")] pub cache: Option, + + #[cfg(feature = "acme")] + pub acme: Option, + pub ignore_sni_consistency: Option, pub connection_handling_timeout: Option, } @@ -67,6 +80,8 @@ pub struct TlsOption { pub tls_cert_key_path: Option, pub https_redirection: Option, pub client_ca_cert_path: Option, + #[cfg(feature = "acme")] + pub acme: Option, } #[derive(Deserialize, Debug, Default, PartialEq, Eq, Clone)] @@ -222,8 +237,19 @@ impl Application { // tls settings let tls_config = if self.tls.is_some() { let tls = self.tls.as_ref().unwrap(); + + #[cfg(not(feature = "acme"))] ensure!(tls.tls_cert_key_path.is_some() && tls.tls_cert_path.is_some()); + #[cfg(feature = "acme")] + { + if tls.acme.unwrap_or(false) { + ensure!(tls.tls_cert_key_path.is_none() && tls.tls_cert_path.is_none()); + } else { + ensure!(tls.tls_cert_key_path.is_some() && tls.tls_cert_path.is_some()); + } + } + let https_redirection = if tls.https_redirection.is_none() { true // Default true } else { @@ -233,6 +259,8 @@ impl Application { Some(TlsConfig { mutual_tls: tls.client_ca_cert_path.is_some(), https_redirection, + #[cfg(feature = "acme")] + acme: tls.acme.unwrap_or(false), }) } else { None diff --git a/rpxy-bin/src/main.rs b/rpxy-bin/src/main.rs index d3988e3..eff2648 100644 --- a/rpxy-bin/src/main.rs +++ b/rpxy-bin/src/main.rs @@ -6,6 +6,8 @@ mod constants; mod error; mod log; +#[cfg(feature = "acme")] +use crate::config::build_acme_manager; use crate::{ config::{build_cert_manager, build_settings, parse_opts, ConfigToml, ConfigTomlReloader}, constants::CONFIG_WATCH_DELAY_SECS, @@ -13,7 +15,7 @@ use crate::{ log::*, }; use hot_reload::{ReloaderReceiver, ReloaderService}; -use rpxy_lib::entrypoint; +use rpxy_lib::{entrypoint, RpxyOptions, RpxyOptionsBuilder}; fn main() { init_logger(); @@ -66,13 +68,43 @@ async fn rpxy_service_without_watcher( let config_toml = ConfigToml::new(config_file_path).map_err(|e| anyhow!("Invalid toml file: {e}"))?; let (proxy_conf, app_conf) = build_settings(&config_toml).map_err(|e| anyhow!("Invalid configuration: {e}"))?; - let cert_service_and_rx = build_cert_manager(&config_toml) + let (cert_service, cert_rx) = build_cert_manager(&config_toml) .await - .map_err(|e| anyhow!("Invalid cert configuration: {e}"))?; + .map_err(|e| anyhow!("Invalid cert configuration: {e}"))? + .map(|(s, r)| (Some(s), Some(r))) + .unwrap_or((None, None)); - rpxy_entrypoint(&proxy_conf, &app_conf, cert_service_and_rx.as_ref(), &runtime_handle, None) - .await - .map_err(|e| anyhow!(e)) + #[cfg(feature = "acme")] + { + let acme_manager = build_acme_manager(&config_toml, runtime_handle.clone()).await?; + let (acme_join_handles, server_config_acme_challenge) = acme_manager + .as_ref() + .map(|m| m.spawn_manager_tasks(None)) + .unwrap_or((vec![], Default::default())); + let rpxy_opts = RpxyOptionsBuilder::default() + .proxy_config(proxy_conf) + .app_config_list(app_conf) + .cert_rx(cert_rx) + .runtime_handle(runtime_handle.clone()) + .server_configs_acme_challenge(std::sync::Arc::new(server_config_acme_challenge)) + .build()?; + rpxy_entrypoint(&rpxy_opts, cert_service.as_ref(), acme_join_handles) //, &runtime_handle) + .await + .map_err(|e| anyhow!(e)) + } + + #[cfg(not(feature = "acme"))] + { + let rpxy_opts = RpxyOptionsBuilder::default() + .proxy_config(proxy_conf.clone()) + .app_config_list(app_conf.clone()) + .cert_rx(cert_rx.clone()) + .runtime_handle(runtime_handle.clone()) + .build()?; + rpxy_entrypoint(&rpxy_opts, cert_service.as_ref()) //, &runtime_handle) + .await + .map_err(|e| anyhow!(e)) + } } async fn rpxy_service_with_watcher( @@ -88,6 +120,9 @@ async fn rpxy_service_with_watcher( .ok_or(anyhow!("Something wrong in config reloader receiver"))?; let (mut proxy_conf, mut app_conf) = build_settings(&config_toml).map_err(|e| anyhow!("Invalid configuration: {e}"))?; + #[cfg(feature = "acme")] + let mut acme_manager = build_acme_manager(&config_toml, runtime_handle.clone()).await?; + let mut cert_service_and_rx = build_cert_manager(&config_toml) .await .map_err(|e| anyhow!("Invalid cert configuration: {e}"))?; @@ -97,8 +132,50 @@ async fn rpxy_service_with_watcher( // Continuous monitoring loop { + let (cert_service, cert_rx) = cert_service_and_rx + .as_ref() + .map(|(s, r)| (Some(s), Some(r))) + .unwrap_or((None, None)); + + #[cfg(feature = "acme")] + let (acme_join_handles, server_config_acme_challenge) = acme_manager + .as_ref() + .map(|m| m.spawn_manager_tasks(Some(term_notify.clone()))) + .unwrap_or((vec![], Default::default())); + + let rpxy_opts = { + #[cfg(feature = "acme")] + let res = RpxyOptionsBuilder::default() + .proxy_config(proxy_conf.clone()) + .app_config_list(app_conf.clone()) + .cert_rx(cert_rx.cloned()) + .runtime_handle(runtime_handle.clone()) + .term_notify(Some(term_notify.clone())) + .server_configs_acme_challenge(std::sync::Arc::new(server_config_acme_challenge)) + .build(); + + #[cfg(not(feature = "acme"))] + let res = RpxyOptionsBuilder::default() + .proxy_config(proxy_conf.clone()) + .app_config_list(app_conf.clone()) + .cert_rx(cert_rx.cloned()) + .runtime_handle(runtime_handle.clone()) + .term_notify(Some(term_notify.clone())) + .build(); + res + }?; + tokio::select! { - rpxy_res = rpxy_entrypoint(&proxy_conf, &app_conf, cert_service_and_rx.as_ref(), &runtime_handle, Some(term_notify.clone())) => { + rpxy_res = { + #[cfg(feature = "acme")] + { + rpxy_entrypoint(&rpxy_opts, cert_service, acme_join_handles)//, &runtime_handle) + } + #[cfg(not(feature = "acme"))] + { + rpxy_entrypoint(&rpxy_opts, cert_service)//, &runtime_handle) + } + } => { error!("rpxy entrypoint or cert service exited"); return rpxy_res.map_err(|e| anyhow!(e)); } @@ -125,8 +202,20 @@ async fn rpxy_service_with_watcher( continue; } }; + #[cfg(feature = "acme")] + { + match build_acme_manager(&config_toml, runtime_handle.clone()).await { + Ok(m) => { + acme_manager = m; + }, + Err(e) => { + error!("Invalid acme configuration. Configuration does not updated: {e}"); + continue; + } + } + } - info!("Configuration updated. Terminate all spawned proxy services and force to re-bind TCP/UDP sockets"); + info!("Configuration updated. Terminate all spawned services and force to re-bind TCP/UDP sockets"); term_notify.notify_waiters(); // tokio::time::sleep(tokio::time::Duration::from_secs(1)).await; } @@ -137,20 +226,17 @@ async fn rpxy_service_with_watcher( Ok(()) } +#[cfg(not(feature = "acme"))] /// Wrapper of entry point for rpxy service with certificate management service async fn rpxy_entrypoint( - proxy_config: &rpxy_lib::ProxyConfig, - app_config_list: &rpxy_lib::AppConfigList, - cert_service_and_rx: Option<&( - ReloaderService, - ReloaderReceiver, - )>, // TODO: - runtime_handle: &tokio::runtime::Handle, - term_notify: Option>, + rpxy_opts: &RpxyOptions, + cert_service: Option<&ReloaderService>, + // runtime_handle: &tokio::runtime::Handle, ) -> Result<(), anyhow::Error> { - if let Some((cert_service, cert_rx)) = cert_service_and_rx { + // TODO: refactor: update routine + if let Some(cert_service) = cert_service { tokio::select! { - rpxy_res = entrypoint(proxy_config, app_config_list, Some(cert_rx), runtime_handle, term_notify) => { + rpxy_res = entrypoint(rpxy_opts) => { error!("rpxy entrypoint exited"); rpxy_res.map_err(|e| anyhow!(e)) } @@ -160,8 +246,49 @@ async fn rpxy_entrypoint( } } } else { - entrypoint(proxy_config, app_config_list, None, runtime_handle, term_notify) - .await - .map_err(|e| anyhow!(e)) + entrypoint(rpxy_opts).await.map_err(|e| anyhow!(e)) + } +} + +#[cfg(feature = "acme")] +/// Wrapper of entry point for rpxy service with certificate management service +async fn rpxy_entrypoint( + rpxy_opts: &RpxyOptions, + cert_service: Option<&ReloaderService>, + acme_task_handles: Vec>, + // runtime_handle: &tokio::runtime::Handle, +) -> Result<(), anyhow::Error> { + // TODO: refactor: update routine + if let Some(cert_service) = cert_service { + if acme_task_handles.is_empty() { + tokio::select! { + rpxy_res = entrypoint(rpxy_opts) => { + error!("rpxy entrypoint exited"); + rpxy_res.map_err(|e| anyhow!(e)) + } + cert_res = cert_service.start() => { + error!("cert reloader service exited"); + cert_res.map_err(|e| anyhow!(e)) + } + } + } else { + let select_all = futures_util::future::select_all(acme_task_handles); + tokio::select! { + rpxy_res = entrypoint(rpxy_opts) => { + error!("rpxy entrypoint exited"); + rpxy_res.map_err(|e| anyhow!(e)) + } + (acme_res, _, _) = select_all => { + error!("acme manager exited"); + acme_res.map_err(|e| anyhow!(e)) + } + cert_res = cert_service.start() => { + error!("cert reloader service exited"); + cert_res.map_err(|e| anyhow!(e)) + } + } + } + } else { + entrypoint(rpxy_opts).await.map_err(|e| anyhow!(e)) } } diff --git a/rpxy-certs/Cargo.toml b/rpxy-certs/Cargo.toml index cd30815..08e1ebf 100644 --- a/rpxy-certs/Cargo.toml +++ b/rpxy-certs/Cargo.toml @@ -18,22 +18,22 @@ http3 = [] rustc-hash = { version = "2.0.0" } tracing = { version = "0.1.40" } derive_builder = { version = "0.20.0" } -thiserror = { version = "1.0.62" } -hot_reload = { version = "0.1.5" } +thiserror = { version = "1.0.63" } +hot_reload = { version = "0.1.6" } async-trait = { version = "0.1.81" } -rustls = { version = "0.23.11", default-features = false, features = [ +rustls = { version = "0.23.12", default-features = false, features = [ "std", "aws_lc_rs", ] } rustls-pemfile = { version = "2.1.2" } -rustls-webpki = { version = "0.102.5", default-features = false, features = [ +rustls-webpki = { version = "0.102.6", default-features = false, features = [ "std", "aws_lc_rs", ] } x509-parser = { version = "0.16.0" } [dev-dependencies] -tokio = { version = "1.38.0", default-features = false, features = [ +tokio = { version = "1.39.0", default-features = false, features = [ "rt-multi-thread", "macros", ] } diff --git a/rpxy-certs/src/reloader_service.rs b/rpxy-certs/src/reloader_service.rs index c3d1fcd..4d10fa1 100644 --- a/rpxy-certs/src/reloader_service.rs +++ b/rpxy-certs/src/reloader_service.rs @@ -46,10 +46,13 @@ impl Reload for CryptoReloader { let mut server_crypto_base = ServerCryptoBase::default(); for (server_name_bytes, crypto_source) in self.inner.iter() { - let certs_keys = crypto_source.read().await.map_err(|e| { - error!("Failed to reload cert, key or ca cert: {e}"); - ReloaderError::::Reload("Failed to reload cert, key or ca cert") - })?; + let certs_keys = match crypto_source.read().await { + Ok(certs_keys) => certs_keys, + Err(e) => { + error!("Failed to read certs and keys, skip at this time: {}", e); + continue; + } + }; server_crypto_base.inner.insert(server_name_bytes.clone(), certs_keys); } diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml index e9a4666..6aeb624 100644 --- a/rpxy-lib/Cargo.toml +++ b/rpxy-lib/Cargo.toml @@ -13,8 +13,8 @@ publish.workspace = true # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html [features] -# default = ["http3-s2n", "sticky-cookie", "cache", "rustls-backend"] -default = ["http3-quinn", "sticky-cookie", "cache", "rustls-backend"] +# default = ["http3-s2n", "sticky-cookie", "cache", "rustls-backend", "acme"] +# default = ["http3-quinn", "sticky-cookie", "cache", "rustls-backend", "acme"] http3-quinn = ["socket2", "quinn", "h3", "h3-quinn", "rpxy-certs/http3"] http3-s2n = [ "s2n-quic", @@ -29,14 +29,15 @@ sticky-cookie = ["base64", "sha2", "chrono"] native-tls-backend = ["hyper-tls"] rustls-backend = ["hyper-rustls"] webpki-roots = ["rustls-backend", "hyper-rustls/webpki-tokio"] +acme = ["dep:rpxy-acme"] [dependencies] rand = "0.8.5" rustc-hash = "2.0.0" -bytes = "1.6.0" +bytes = "1.6.1" derive_builder = "0.20.0" futures = { version = "0.3.30", features = ["alloc", "async-await"] } -tokio = { version = "1.38.0", default-features = false, features = [ +tokio = { version = "1.39.0", default-features = false, features = [ "net", "rt-multi-thread", "time", @@ -49,7 +50,7 @@ async-trait = "0.1.81" # Error handling anyhow = "1.0.86" -thiserror = "1.0.62" +thiserror = "1.0.63" # http for both server and client http = "1.1.0" @@ -75,10 +76,13 @@ hyper-rustls = { git = "https://github.com/junkurihara/hyper-rustls", branch = " # tls and cert management for server rpxy-certs = { path = "../rpxy-certs/", default-features = false } -hot_reload = "0.1.5" -rustls = { version = "0.23.11", default-features = false } +hot_reload = "0.1.6" +rustls = { version = "0.23.12", default-features = false } tokio-rustls = { version = "0.26.0", features = ["early-data"] } +# acme +rpxy-acme = { path = "../rpxy-acme/", default-features = false, optional = true } + # logging tracing = { version = "0.1.40" } @@ -89,11 +93,11 @@ h3-quinn = { version = "0.0.7", optional = true } s2n-quic-h3 = { path = "../submodules/s2n-quic-h3/", features = [ "tracing", ], optional = true } -s2n-quic = { version = "1.42.0", default-features = false, features = [ +s2n-quic = { version = "1.43.0", default-features = false, features = [ "provider-tls-rustls", ], optional = true } -s2n-quic-core = { version = "0.42.0", default-features = false, optional = true } -s2n-quic-rustls = { version = "0.42.0", optional = true } +s2n-quic-core = { version = "0.43.0", default-features = false, optional = true } +s2n-quic-rustls = { version = "0.43.0", optional = true } ########## # for UDP socket wit SO_REUSEADDR when h3 with quinn socket2 = { version = "0.5.7", features = ["all"], optional = true } diff --git a/rpxy-lib/src/error.rs b/rpxy-lib/src/error.rs index 98ebf03..20470ed 100644 --- a/rpxy-lib/src/error.rs +++ b/rpxy-lib/src/error.rs @@ -105,4 +105,9 @@ pub enum RpxyError { // Others #[error("Infallible")] Infallible(#[from] std::convert::Infallible), + + /// No Acme server config for Acme challenge + #[cfg(feature = "acme")] + #[error("No Acme server config")] + NoAcmeServerConfig, } diff --git a/rpxy-lib/src/globals.rs b/rpxy-lib/src/globals.rs index 3582cdb..8c5e093 100644 --- a/rpxy-lib/src/globals.rs +++ b/rpxy-lib/src/globals.rs @@ -16,6 +16,10 @@ pub struct Globals { pub term_notify: Option>, /// Shared context - Certificate reloader service receiver // TODO: newer one pub cert_reloader_rx: Option>, + + #[cfg(feature = "acme")] + /// ServerConfig used for only ACME challenge for ACME domains + pub server_configs_acme_challenge: Arc>>, } /// Configuration parameters for proxy transport and request handlers @@ -159,4 +163,6 @@ pub struct UpstreamUri { pub struct TlsConfig { pub mutual_tls: bool, pub https_redirection: bool, + #[cfg(feature = "acme")] + pub acme: bool, } diff --git a/rpxy-lib/src/lib.rs b/rpxy-lib/src/lib.rs index ccb647e..9dd78da 100644 --- a/rpxy-lib/src/lib.rs +++ b/rpxy-lib/src/lib.rs @@ -30,13 +30,36 @@ pub mod reexports { pub use hyper::Uri; } +#[derive(derive_builder::Builder)] +/// rpxy entrypoint args +pub struct RpxyOptions { + /// Configuration parameters for proxy transport and request handlers + pub proxy_config: ProxyConfig, + /// List of application configurations + pub app_config_list: AppConfigList, + /// Certificate reloader service receiver + pub cert_rx: Option>, // TODO: + /// Async task runtime handler + pub runtime_handle: tokio::runtime::Handle, + /// Notify object to stop async tasks + pub term_notify: Option>, + + #[cfg(feature = "acme")] + /// ServerConfig used for only ACME challenge for ACME domains + pub server_configs_acme_challenge: Arc>>, +} + /// Entrypoint that creates and spawns tasks of reverse proxy services pub async fn entrypoint( - proxy_config: &ProxyConfig, - app_config_list: &AppConfigList, - cert_rx: Option<&ReloaderReceiver>, // TODO: - runtime_handle: &tokio::runtime::Handle, - term_notify: Option>, + RpxyOptions { + proxy_config, + app_config_list, + cert_rx, // TODO: + runtime_handle, + term_notify, + #[cfg(feature = "acme")] + server_configs_acme_challenge, + }: &RpxyOptions, ) -> RpxyResult<()> { #[cfg(all(feature = "http3-quinn", feature = "http3-s2n"))] warn!("Both \"http3-quinn\" and \"http3-s2n\" features are enabled. \"http3-quinn\" will be used"); @@ -85,7 +108,10 @@ pub async fn entrypoint( request_count: Default::default(), runtime_handle: runtime_handle.clone(), term_notify: term_notify.clone(), - cert_reloader_rx: cert_rx.cloned(), + cert_reloader_rx: cert_rx.clone(), + + #[cfg(feature = "acme")] + server_configs_acme_challenge: server_configs_acme_challenge.clone(), }); // 3. build message handler containing Arc-ed http_client and backends, and make it contained in Arc as well diff --git a/rpxy-lib/src/proxy/proxy_main.rs b/rpxy-lib/src/proxy/proxy_main.rs index 21b2c6b..3690d35 100644 --- a/rpxy-lib/src/proxy/proxy_main.rs +++ b/rpxy-lib/src/proxy/proxy_main.rs @@ -167,6 +167,9 @@ where let mut server_crypto_map: Option> = None; loop { + #[cfg(feature = "acme")] + let server_configs_acme_challenge = self.globals.server_configs_acme_challenge.clone(); + select! { tcp_cnx = tcp_listener.accept().fuse() => { if tcp_cnx.is_err() || server_crypto_map.is_none() { @@ -190,17 +193,51 @@ where if server_name.is_none(){ return Err(RpxyError::NoServerNameInClientHello); } - let server_crypto = sc_map_inner.as_ref().unwrap().get(server_name.as_ref().unwrap()); - if server_crypto.is_none() { - return Err(RpxyError::NoTlsServingApp(server_name.as_ref().unwrap().try_into().unwrap_or_default())); - } - let stream = match start.into_stream(server_crypto.unwrap().clone()).await { + #[cfg(feature = "acme")] + let mut is_handshake_acme = false; // for shutdown just after TLS handshake + /* ------------------ */ + // Check for ACME TLS ALPN challenge + #[cfg(feature = "acme")] + let server_crypto = { + if rpxy_acme::reexports::is_tls_alpn_challenge(&client_hello) { + info!("ACME TLS ALPN challenge received"); + let Some(server_crypto_acme) = server_configs_acme_challenge.get(&sni.unwrap().to_ascii_lowercase()) else { + return Err(RpxyError::NoAcmeServerConfig); + }; + is_handshake_acme = true; + server_crypto_acme + } else { + let server_crypto = sc_map_inner.as_ref().unwrap().get(server_name.as_ref().unwrap()); + let Some(server_crypto) = server_crypto else { + return Err(RpxyError::NoTlsServingApp(server_name.as_ref().unwrap().try_into().unwrap_or_default())); + }; + server_crypto + } + }; + /* ------------------ */ + #[cfg(not(feature = "acme"))] + let server_crypto = { + let server_crypto = sc_map_inner.as_ref().unwrap().get(server_name.as_ref().unwrap()); + let Some(server_crypto) = server_crypto else { + return Err(RpxyError::NoTlsServingApp(server_name.as_ref().unwrap().try_into().unwrap_or_default())); + }; + server_crypto + }; + /* ------------------ */ + let stream = match start.into_stream(server_crypto.clone()).await { Ok(s) => TokioIo::new(s), Err(e) => { return Err(RpxyError::FailedToTlsHandshake(e.to_string())); } }; - Ok((stream, client_addr, server_name)) + #[cfg(feature = "acme")] + { + Ok((stream, client_addr, server_name, is_handshake_acme)) + } + #[cfg(not(feature="acme"))] + { + Ok((stream, client_addr, server_name)) + } }; self.globals.runtime_handle.spawn( async move { @@ -212,14 +249,36 @@ where error!("Timeout to handshake TLS"); return; }; - match v { - Ok((stream, client_addr, server_name)) => { - self_inner.serve_connection(stream, client_addr, server_name); - } - Err(e) => { - error!("{}", e); + /* ------------------ */ + #[cfg(feature = "acme")] + { + match v { + Ok((mut stream, client_addr, server_name, is_handshake_acme)) => { + if is_handshake_acme { + debug!("Shutdown TLS connection after ACME TLS ALPN challenge"); + use tokio::io::AsyncWriteExt; + stream.inner_mut().shutdown().await.ok(); + } + self_inner.serve_connection(stream, client_addr, server_name); + } + Err(e) => { + error!("{}", e); + } } } + /* ------------------ */ + #[cfg(not(feature = "acme"))] + { + match v { + Ok((stream, client_addr, server_name)) => { + self_inner.serve_connection(stream, client_addr, server_name); + } + Err(e) => { + error!("{}", e); + } + } + } + /* ------------------ */ }); } _ = server_crypto_rx.changed().fuse() => { diff --git a/submodules/rustls-acme b/submodules/rustls-acme new file mode 160000 index 0000000..43719fb --- /dev/null +++ b/submodules/rustls-acme @@ -0,0 +1 @@ +Subproject commit 43719fb04cc522c039c9e7420567a38416f9fec7 diff --git a/submodules/s2n-quic-h3/Cargo.toml b/submodules/s2n-quic-h3/Cargo.toml index 4a0c725..b445924 100644 --- a/submodules/s2n-quic-h3/Cargo.toml +++ b/submodules/s2n-quic-h3/Cargo.toml @@ -15,8 +15,8 @@ futures = { version = "0.3", default-features = false } h3 = { version = "0.0.6", features = ["tracing"] } # s2n-quic = { path = "../s2n-quic" } # s2n-quic-core = { path = "../s2n-quic-core" } -s2n-quic = { version = "1.42.0" } -s2n-quic-core = { version = "0.42.0" } +s2n-quic = { version = "1.43.0" } +s2n-quic-core = { version = "0.43.0" } tracing = { version = "0.1.40", optional = true } [features]