From 887e6b64b0f1984fcfdf3691c8b76ef74f002d27 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Fri, 12 Jul 2024 23:50:37 +0900 Subject: [PATCH 01/16] feat: wip - configuration design --- Cargo.toml | 2 +- rpxy-acme/Cargo.toml | 17 +++++++++ rpxy-acme/src/constants.rs | 14 ++++++++ rpxy-acme/src/error.rs | 15 ++++++++ rpxy-acme/src/lib.rs | 12 +++++++ rpxy-bin/Cargo.toml | 7 ++-- rpxy-bin/src/config/mod.rs | 5 ++- rpxy-bin/src/config/parse.rs | 58 +++++++++++++++++++++++++++++- rpxy-bin/src/config/toml.rs | 28 +++++++++++++++ rpxy-bin/src/main.rs | 8 +++++ rpxy-certs/src/reloader_service.rs | 11 +++--- rpxy-lib/Cargo.toml | 5 +-- rpxy-lib/src/globals.rs | 2 ++ 13 files changed, 173 insertions(+), 11 deletions(-) create mode 100644 rpxy-acme/Cargo.toml create mode 100644 rpxy-acme/src/constants.rs create mode 100644 rpxy-acme/src/error.rs create mode 100644 rpxy-acme/src/lib.rs diff --git a/Cargo.toml b/Cargo.toml index 355e5b1..68be1fe 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -9,7 +9,7 @@ edition = "2021" publish = false [workspace] -members = ["rpxy-bin", "rpxy-lib", "rpxy-certs"] +members = ["rpxy-bin", "rpxy-lib", "rpxy-certs", "rpxy-acme"] exclude = ["submodules"] resolver = "2" diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml new file mode 100644 index 0000000..4ceeaf3 --- /dev/null +++ b/rpxy-acme/Cargo.toml @@ -0,0 +1,17 @@ +[package] +name = "rpxy-acme" +description = "ACME manager library for `rpxy`" +version.workspace = true +authors.workspace = true +homepage.workspace = true +repository.workspace = true +license.workspace = true +readme.workspace = true +edition.workspace = true +publish.workspace = true + +[dependencies] +url = { version = "2.5.2" } +rustc-hash = "2.0.0" +thiserror = "1.0.62" +tracing = "0.1.40" diff --git a/rpxy-acme/src/constants.rs b/rpxy-acme/src/constants.rs new file mode 100644 index 0000000..edb657b --- /dev/null +++ b/rpxy-acme/src/constants.rs @@ -0,0 +1,14 @@ +/// ACME directory url +pub const ACME_DIR_URL: &str = "https://acme-v02.api.letsencrypt.org/directory"; + +/// ACME registry path that stores account key and certificate +pub const ACME_REGISTRY_PATH: &str = "./acme_registry"; + +/// ACME accounts directory, subdirectory of ACME_REGISTRY_PATH +pub(crate) const ACME_ACCOUNT_SUBDIR: &str = "account"; + +/// ACME private key file name +pub const ACME_PRIVATE_KEY_FILE_NAME: &str = "private_key.pem"; + +/// ACME certificate file name +pub const ACME_CERTIFICATE_FILE_NAME: &str = "certificate.pem"; diff --git a/rpxy-acme/src/error.rs b/rpxy-acme/src/error.rs new file mode 100644 index 0000000..08133c5 --- /dev/null +++ b/rpxy-acme/src/error.rs @@ -0,0 +1,15 @@ +use thiserror::Error; + +#[derive(Error, Debug)] +/// Error type for rpxy-acme +pub enum RpxyAcmeError { + /// Invalid acme registry path + #[error("Invalid acme registry path")] + InvalidAcmeRegistryPath, + /// Invalid url + #[error("Invalid url: {0}")] + InvalidUrl(#[from] url::ParseError), + /// IO error + #[error("IO error: {0}")] + Io(#[from] std::io::Error), +} diff --git a/rpxy-acme/src/lib.rs b/rpxy-acme/src/lib.rs new file mode 100644 index 0000000..1fec84c --- /dev/null +++ b/rpxy-acme/src/lib.rs @@ -0,0 +1,12 @@ +mod constants; +mod error; +mod targets; + +#[allow(unused_imports)] +mod log { + pub(super) use tracing::{debug, error, info, warn}; +} + +pub use constants::{ACME_CERTIFICATE_FILE_NAME, ACME_DIR_URL, ACME_PRIVATE_KEY_FILE_NAME, ACME_REGISTRY_PATH}; +pub use error::RpxyAcmeError; +pub use targets::AcmeTargets; diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml index d571d1e..358ee43 100644 --- a/rpxy-bin/Cargo.toml +++ b/rpxy-bin/Cargo.toml @@ -13,14 +13,15 @@ publish.workspace = true # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html [features] -default = ["http3-quinn", "cache", "rustls-backend"] -# default = ["http3-s2n", "cache", "rustls-backend"] +default = ["http3-quinn", "cache", "rustls-backend", "acme"] +# default = ["http3-s2n", "cache", "rustls-backend", "acme"] http3-quinn = ["rpxy-lib/http3-quinn"] http3-s2n = ["rpxy-lib/http3-s2n"] native-tls-backend = ["rpxy-lib/native-tls-backend"] rustls-backend = ["rpxy-lib/rustls-backend"] webpki-roots = ["rpxy-lib/webpki-roots"] cache = ["rpxy-lib/cache"] +acme = ["rpxy-lib/acme", "rpxy-acme"] [dependencies] rpxy-lib = { path = "../rpxy-lib/", default-features = false, features = [ @@ -56,4 +57,6 @@ rpxy-certs = { path = "../rpxy-certs/", default-features = false, features = [ "http3", ] } +rpxy-acme = { path = "../rpxy-acme/", default-features = false, optional = true } + [dev-dependencies] diff --git a/rpxy-bin/src/config/mod.rs b/rpxy-bin/src/config/mod.rs index adc4ff2..079e477 100644 --- a/rpxy-bin/src/config/mod.rs +++ b/rpxy-bin/src/config/mod.rs @@ -3,7 +3,10 @@ mod service; mod toml; pub use { - self::toml::ConfigToml, parse::{build_cert_manager, build_settings, parse_opts}, service::ConfigTomlReloader, + toml::ConfigToml, }; + +#[cfg(feature = "acme")] +pub use parse::build_acme_manager; diff --git a/rpxy-bin/src/config/parse.rs b/rpxy-bin/src/config/parse.rs index f45ca17..4a28bed 100644 --- a/rpxy-bin/src/config/parse.rs +++ b/rpxy-bin/src/config/parse.rs @@ -6,6 +6,9 @@ use rpxy_certs::{build_cert_reloader, CryptoFileSourceBuilder, CryptoReloader, S use rpxy_lib::{AppConfig, AppConfigList, ProxyConfig}; use rustc_hash::FxHashMap as HashMap; +#[cfg(feature = "acme")] +use rpxy_acme::{AcmeTargets, ACME_CERTIFICATE_FILE_NAME, ACME_PRIVATE_KEY_FILE_NAME, ACME_REGISTRY_PATH}; + /// Parsed options pub struct Opts { pub config_file_path: String, @@ -103,11 +106,34 @@ pub async fn build_cert_manager( if config.listen_port_tls.is_none() { return Ok(None); } + + #[cfg(feature = "acme")] + let acme_option = config.experimental.as_ref().and_then(|v| v.acme.clone()); + #[cfg(feature = "acme")] + let registry_path = acme_option + .as_ref() + .and_then(|v| v.registry_path.as_deref()) + .unwrap_or(ACME_REGISTRY_PATH); + let mut crypto_source_map = HashMap::default(); for app in apps.0.values() { if let Some(tls) = app.tls.as_ref() { - ensure!(tls.tls_cert_key_path.is_some() && tls.tls_cert_path.is_some()); let server_name = app.server_name.as_ref().ok_or(anyhow!("No server name"))?; + + #[cfg(not(feature = "acme"))] + ensure!(tls.tls_cert_key_path.is_some() && tls.tls_cert_path.is_some()); + + #[cfg(feature = "acme")] + let tls = { + let mut tls = tls.clone(); + if let Some(true) = tls.acme { + ensure!(acme_option.is_some() && tls.tls_cert_key_path.is_none() && tls.tls_cert_path.is_none()); + tls.tls_cert_key_path = Some(format!("{registry_path}/{server_name}/{ACME_CERTIFICATE_FILE_NAME}")); + tls.tls_cert_path = Some(format!("{registry_path}/{server_name}/{ACME_PRIVATE_KEY_FILE_NAME}")); + } + tls + }; + let crypto_file_source = CryptoFileSourceBuilder::default() .tls_cert_path(tls.tls_cert_path.as_ref().unwrap()) .tls_cert_key_path(tls.tls_cert_key_path.as_ref().unwrap()) @@ -119,3 +145,33 @@ pub async fn build_cert_manager( let res = build_cert_reloader(&crypto_source_map, None).await?; Ok(Some(res)) } + +/* ----------------------- */ +#[cfg(feature = "acme")] +/// Build acme manager and dummy cert and key as initial states if not exists +/// TODO: CURRENTLY NOT IMPLEMENTED, UNDER DESIGNING +pub async fn build_acme_manager(config: &ConfigToml) -> Result<(), anyhow::Error> { + let acme_option = config.experimental.as_ref().and_then(|v| v.acme.clone()); + if acme_option.is_none() { + return Ok(()); + } + let acme_option = acme_option.unwrap(); + let mut acme_targets = AcmeTargets::try_new( + acme_option.email.as_ref(), + acme_option.dir_url.as_deref(), + acme_option.registry_path.as_deref(), + ) + .map_err(|e| anyhow!("Invalid acme configuration: {e}"))?; + + let apps = config.apps.as_ref().unwrap(); + for app in apps.0.values() { + if let Some(tls) = app.tls.as_ref() { + if tls.acme.unwrap_or(false) { + acme_targets.add_target(app.server_name.as_ref().unwrap())?; + } + } + } + // TODO: remove later + println!("ACME targets: {:#?}", acme_targets); + Ok(()) +} diff --git a/rpxy-bin/src/config/toml.rs b/rpxy-bin/src/config/toml.rs index 957296c..b2a70bb 100644 --- a/rpxy-bin/src/config/toml.rs +++ b/rpxy-bin/src/config/toml.rs @@ -41,12 +41,25 @@ pub struct CacheOption { pub max_cache_each_size_on_memory: Option, } +#[cfg(feature = "acme")] +#[derive(Deserialize, Debug, Default, PartialEq, Eq, Clone)] +pub struct AcmeOption { + pub dir_url: Option, + pub email: String, + pub registry_path: Option, +} + #[derive(Deserialize, Debug, Default, PartialEq, Eq, Clone)] pub struct Experimental { #[cfg(any(feature = "http3-quinn", feature = "http3-s2n"))] pub h3: Option, + #[cfg(feature = "cache")] pub cache: Option, + + #[cfg(feature = "acme")] + pub acme: Option, + pub ignore_sni_consistency: Option, pub connection_handling_timeout: Option, } @@ -67,6 +80,8 @@ pub struct TlsOption { pub tls_cert_key_path: Option, pub https_redirection: Option, pub client_ca_cert_path: Option, + #[cfg(feature = "acme")] + pub acme: Option, } #[derive(Deserialize, Debug, Default, PartialEq, Eq, Clone)] @@ -222,8 +237,19 @@ impl Application { // tls settings let tls_config = if self.tls.is_some() { let tls = self.tls.as_ref().unwrap(); + + #[cfg(not(feature = "acme"))] ensure!(tls.tls_cert_key_path.is_some() && tls.tls_cert_path.is_some()); + #[cfg(feature = "acme")] + { + if tls.acme.unwrap_or(false) { + ensure!(tls.tls_cert_key_path.is_none() && tls.tls_cert_path.is_none()); + } else { + ensure!(tls.tls_cert_key_path.is_some() && tls.tls_cert_path.is_some()); + } + } + let https_redirection = if tls.https_redirection.is_none() { true // Default true } else { @@ -233,6 +259,8 @@ impl Application { Some(TlsConfig { mutual_tls: tls.client_ca_cert_path.is_some(), https_redirection, + #[cfg(feature = "acme")] + acme: tls.acme.unwrap_or(false), }) } else { None diff --git a/rpxy-bin/src/main.rs b/rpxy-bin/src/main.rs index d3988e3..9847a5f 100644 --- a/rpxy-bin/src/main.rs +++ b/rpxy-bin/src/main.rs @@ -6,6 +6,8 @@ mod constants; mod error; mod log; +#[cfg(feature = "acme")] +use crate::config::build_acme_manager; use crate::{ config::{build_cert_manager, build_settings, parse_opts, ConfigToml, ConfigTomlReloader}, constants::CONFIG_WATCH_DELAY_SECS, @@ -66,6 +68,9 @@ async fn rpxy_service_without_watcher( let config_toml = ConfigToml::new(config_file_path).map_err(|e| anyhow!("Invalid toml file: {e}"))?; let (proxy_conf, app_conf) = build_settings(&config_toml).map_err(|e| anyhow!("Invalid configuration: {e}"))?; + #[cfg(feature = "acme")] // TODO: CURRENTLY NOT IMPLEMENTED, UNDER DESIGNING + let acme_manager = build_acme_manager(&config_toml).await; + let cert_service_and_rx = build_cert_manager(&config_toml) .await .map_err(|e| anyhow!("Invalid cert configuration: {e}"))?; @@ -88,6 +93,9 @@ async fn rpxy_service_with_watcher( .ok_or(anyhow!("Something wrong in config reloader receiver"))?; let (mut proxy_conf, mut app_conf) = build_settings(&config_toml).map_err(|e| anyhow!("Invalid configuration: {e}"))?; + #[cfg(feature = "acme")] // TODO: CURRENTLY NOT IMPLEMENTED, UNDER DESIGNING + let acme_manager = build_acme_manager(&config_toml).await; + let mut cert_service_and_rx = build_cert_manager(&config_toml) .await .map_err(|e| anyhow!("Invalid cert configuration: {e}"))?; diff --git a/rpxy-certs/src/reloader_service.rs b/rpxy-certs/src/reloader_service.rs index c3d1fcd..4d10fa1 100644 --- a/rpxy-certs/src/reloader_service.rs +++ b/rpxy-certs/src/reloader_service.rs @@ -46,10 +46,13 @@ impl Reload for CryptoReloader { let mut server_crypto_base = ServerCryptoBase::default(); for (server_name_bytes, crypto_source) in self.inner.iter() { - let certs_keys = crypto_source.read().await.map_err(|e| { - error!("Failed to reload cert, key or ca cert: {e}"); - ReloaderError::::Reload("Failed to reload cert, key or ca cert") - })?; + let certs_keys = match crypto_source.read().await { + Ok(certs_keys) => certs_keys, + Err(e) => { + error!("Failed to read certs and keys, skip at this time: {}", e); + continue; + } + }; server_crypto_base.inner.insert(server_name_bytes.clone(), certs_keys); } diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml index e9a4666..1fbeb11 100644 --- a/rpxy-lib/Cargo.toml +++ b/rpxy-lib/Cargo.toml @@ -13,8 +13,8 @@ publish.workspace = true # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html [features] -# default = ["http3-s2n", "sticky-cookie", "cache", "rustls-backend"] -default = ["http3-quinn", "sticky-cookie", "cache", "rustls-backend"] +# default = ["http3-s2n", "sticky-cookie", "cache", "rustls-backend", "acme"] +# default = ["http3-quinn", "sticky-cookie", "cache", "rustls-backend", "acme"] http3-quinn = ["socket2", "quinn", "h3", "h3-quinn", "rpxy-certs/http3"] http3-s2n = [ "s2n-quic", @@ -29,6 +29,7 @@ sticky-cookie = ["base64", "sha2", "chrono"] native-tls-backend = ["hyper-tls"] rustls-backend = ["hyper-rustls"] webpki-roots = ["rustls-backend", "hyper-rustls/webpki-tokio"] +acme = [] [dependencies] rand = "0.8.5" diff --git a/rpxy-lib/src/globals.rs b/rpxy-lib/src/globals.rs index 3582cdb..fa19f78 100644 --- a/rpxy-lib/src/globals.rs +++ b/rpxy-lib/src/globals.rs @@ -159,4 +159,6 @@ pub struct UpstreamUri { pub struct TlsConfig { pub mutual_tls: bool, pub https_redirection: bool, + #[cfg(feature = "acme")] + pub acme: bool, } From 1c1fdc1f93ea76ae4336436e7dcffc0c3806c0c7 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Fri, 12 Jul 2024 23:50:58 +0900 Subject: [PATCH 02/16] feat: wip - configuration design --- rpxy-acme/src/targets.rs | 83 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 rpxy-acme/src/targets.rs diff --git a/rpxy-acme/src/targets.rs b/rpxy-acme/src/targets.rs new file mode 100644 index 0000000..0cc6f99 --- /dev/null +++ b/rpxy-acme/src/targets.rs @@ -0,0 +1,83 @@ +use rustc_hash::FxHashMap as HashMap; +use std::path::PathBuf; +use url::Url; + +use crate::{ + constants::{ACME_ACCOUNT_SUBDIR, ACME_CERTIFICATE_FILE_NAME, ACME_DIR_URL, ACME_PRIVATE_KEY_FILE_NAME, ACME_REGISTRY_PATH}, + error::RpxyAcmeError, + log::*, +}; + +#[derive(Debug)] +/// ACME settings +pub struct AcmeTargets { + /// ACME account email + pub email: String, + /// ACME directory url + pub acme_dir_url: Url, + /// ACME registry path that stores account key and certificate + pub acme_registry_path: PathBuf, + /// ACME accounts directory, subdirectory of ACME_REGISTRY_PATH + pub acme_accounts_dir: PathBuf, + /// ACME target info map + pub acme_targets: HashMap, +} + +#[derive(Debug)] +/// ACME settings for each server name +pub struct AcmeTargetInfo { + /// Server name + pub server_name: String, + /// private key path + pub private_key_path: PathBuf, + /// certificate path + pub certificate_path: PathBuf, +} + +impl AcmeTargets { + /// Create a new instance + pub fn try_new(email: &str, acme_dir_url: Option<&str>, acme_registry_path: Option<&str>) -> Result { + let acme_dir_url = Url::parse(acme_dir_url.unwrap_or(ACME_DIR_URL))?; + let acme_registry_path = acme_registry_path.map_or_else(|| PathBuf::from(ACME_REGISTRY_PATH), PathBuf::from); + if acme_registry_path.exists() && !acme_registry_path.is_dir() { + return Err(RpxyAcmeError::InvalidAcmeRegistryPath); + } + let acme_account_dir = acme_registry_path.join(ACME_ACCOUNT_SUBDIR); + if acme_account_dir.exists() && !acme_account_dir.is_dir() { + return Err(RpxyAcmeError::InvalidAcmeRegistryPath); + } + std::fs::create_dir_all(&acme_account_dir)?; + + Ok(Self { + email: email.to_owned(), + acme_dir_url, + acme_registry_path, + acme_accounts_dir: acme_account_dir, + acme_targets: HashMap::default(), + }) + } + + /// Add a new target + /// Write dummy cert and key files if not exists + pub fn add_target(&mut self, server_name: &str) -> Result<(), RpxyAcmeError> { + info!("Adding ACME target: {}", server_name); + let parent_dir = self.acme_registry_path.join(server_name); + let private_key_path = parent_dir.join(ACME_PRIVATE_KEY_FILE_NAME); + let certificate_path = parent_dir.join(ACME_CERTIFICATE_FILE_NAME); + + if !parent_dir.exists() { + warn!("Creating ACME target directory: {}", parent_dir.display()); + std::fs::create_dir_all(parent_dir)?; + } + + self.acme_targets.insert( + server_name.to_owned(), + AcmeTargetInfo { + server_name: server_name.to_owned(), + private_key_path, + certificate_path, + }, + ); + Ok(()) + } +} From 9b9622edc51ae77f551c6bc92fed1fa69026fdda Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Sat, 13 Jul 2024 04:29:53 +0900 Subject: [PATCH 03/16] wip: designing acme --- rpxy-acme/Cargo.toml | 14 ++++ rpxy-acme/src/constants.rs | 8 +- rpxy-acme/src/dir_cache.rs | 107 +++++++++++++++++++++++++++ rpxy-acme/src/lib.rs | 6 +- rpxy-acme/src/targets.rs | 139 +++++++++++++++++++---------------- rpxy-bin/src/config/parse.rs | 57 ++++++++------ 6 files changed, 235 insertions(+), 96 deletions(-) create mode 100644 rpxy-acme/src/dir_cache.rs diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml index 4ceeaf3..57dd514 100644 --- a/rpxy-acme/Cargo.toml +++ b/rpxy-acme/Cargo.toml @@ -15,3 +15,17 @@ url = { version = "2.5.2" } rustc-hash = "2.0.0" thiserror = "1.0.62" tracing = "0.1.40" +async-trait = "0.1.81" +base64 = "0.22.1" +aws-lc-rs = { version = "1.8.0", default-features = false, features = [ + "aws-lc-sys", +] } +blocking = "1.6.1" +rustls = { version = "0.23.11", default-features = false, features = [ + "std", + "aws_lc_rs", +] } +rustls-platform-verifier = { version = "0.3.2" } +rustls-acme = { path = "../../rustls-acme/", default-features = false, features = [ + "aws-lc-rs", +] } diff --git a/rpxy-acme/src/constants.rs b/rpxy-acme/src/constants.rs index edb657b..7b544b0 100644 --- a/rpxy-acme/src/constants.rs +++ b/rpxy-acme/src/constants.rs @@ -5,10 +5,4 @@ pub const ACME_DIR_URL: &str = "https://acme-v02.api.letsencrypt.org/directory"; pub const ACME_REGISTRY_PATH: &str = "./acme_registry"; /// ACME accounts directory, subdirectory of ACME_REGISTRY_PATH -pub(crate) const ACME_ACCOUNT_SUBDIR: &str = "account"; - -/// ACME private key file name -pub const ACME_PRIVATE_KEY_FILE_NAME: &str = "private_key.pem"; - -/// ACME certificate file name -pub const ACME_CERTIFICATE_FILE_NAME: &str = "certificate.pem"; +pub(crate) const ACME_ACCOUNT_SUBDIR: &str = "accounts"; diff --git a/rpxy-acme/src/dir_cache.rs b/rpxy-acme/src/dir_cache.rs new file mode 100644 index 0000000..2f613d8 --- /dev/null +++ b/rpxy-acme/src/dir_cache.rs @@ -0,0 +1,107 @@ +use crate::constants::ACME_ACCOUNT_SUBDIR; +use async_trait::async_trait; +use aws_lc_rs as crypto; +use base64::prelude::*; +use blocking::unblock; +use crypto::digest::{Context, SHA256}; +use rustls_acme::{AccountCache, CertCache}; +use std::{ + io::ErrorKind, + path::{Path, PathBuf}, +}; + +enum FileType { + Account, + Cert, +} + +#[derive(Debug)] +pub struct DirCache { + account_dir: PathBuf, + cert_dir: PathBuf, +} + +impl DirCache { + pub fn new

(dir: P, server_name: impl AsRef) -> Self + where + P: AsRef, + { + Self { + account_dir: dir.as_ref().join(ACME_ACCOUNT_SUBDIR), + cert_dir: dir.as_ref().join(server_name), + } + } + async fn read_if_exist(&self, file: impl AsRef, file_type: FileType) -> Result>, std::io::Error> { + let subdir = match file_type { + FileType::Account => &self.account_dir, + FileType::Cert => &self.cert_dir, + }; + let file_path = subdir.join(file); + match unblock(move || std::fs::read(file_path)).await { + Ok(content) => Ok(Some(content)), + Err(err) => match err.kind() { + ErrorKind::NotFound => Ok(None), + _ => Err(err), + }, + } + } + async fn write(&self, file: impl AsRef, contents: impl AsRef<[u8]>, file_type: FileType) -> Result<(), std::io::Error> { + let subdir = match file_type { + FileType::Account => &self.account_dir, + FileType::Cert => &self.cert_dir, + } + .clone(); + let subdir_clone = subdir.clone(); + unblock(move || std::fs::create_dir_all(subdir_clone)).await?; + let file_path = subdir.join(file); + let contents = contents.as_ref().to_owned(); + unblock(move || std::fs::write(file_path, contents)).await + } + pub fn cached_account_file_name(contact: &[String], directory_url: impl AsRef) -> String { + let mut ctx = Context::new(&SHA256); + for el in contact { + ctx.update(el.as_ref()); + ctx.update(&[0]) + } + ctx.update(directory_url.as_ref().as_bytes()); + let hash = BASE64_URL_SAFE_NO_PAD.encode(ctx.finish()); + format!("cached_account_{}", hash) + } + pub fn cached_cert_file_name(domains: &[String], directory_url: impl AsRef) -> String { + let mut ctx = Context::new(&SHA256); + for domain in domains { + ctx.update(domain.as_ref()); + ctx.update(&[0]) + } + ctx.update(directory_url.as_ref().as_bytes()); + let hash = BASE64_URL_SAFE_NO_PAD.encode(ctx.finish()); + format!("cached_cert_{}", hash) + } +} + +#[async_trait] +impl CertCache for DirCache { + type EC = std::io::Error; + async fn load_cert(&self, domains: &[String], directory_url: &str) -> Result>, Self::EC> { + let file_name = Self::cached_cert_file_name(domains, directory_url); + self.read_if_exist(file_name, FileType::Cert).await + } + async fn store_cert(&self, domains: &[String], directory_url: &str, cert: &[u8]) -> Result<(), Self::EC> { + let file_name = Self::cached_cert_file_name(domains, directory_url); + self.write(file_name, cert, FileType::Cert).await + } +} + +#[async_trait] +impl AccountCache for DirCache { + type EA = std::io::Error; + async fn load_account(&self, contact: &[String], directory_url: &str) -> Result>, Self::EA> { + let file_name = Self::cached_account_file_name(contact, directory_url); + self.read_if_exist(file_name, FileType::Account).await + } + + async fn store_account(&self, contact: &[String], directory_url: &str, account: &[u8]) -> Result<(), Self::EA> { + let file_name = Self::cached_account_file_name(contact, directory_url); + self.write(file_name, account, FileType::Account).await + } +} diff --git a/rpxy-acme/src/lib.rs b/rpxy-acme/src/lib.rs index 1fec84c..813b388 100644 --- a/rpxy-acme/src/lib.rs +++ b/rpxy-acme/src/lib.rs @@ -1,4 +1,5 @@ mod constants; +mod dir_cache; mod error; mod targets; @@ -7,6 +8,7 @@ mod log { pub(super) use tracing::{debug, error, info, warn}; } -pub use constants::{ACME_CERTIFICATE_FILE_NAME, ACME_DIR_URL, ACME_PRIVATE_KEY_FILE_NAME, ACME_REGISTRY_PATH}; +pub use constants::{ACME_DIR_URL, ACME_REGISTRY_PATH}; +pub use dir_cache::DirCache; pub use error::RpxyAcmeError; -pub use targets::AcmeTargets; +pub use targets::AcmeContexts; diff --git a/rpxy-acme/src/targets.rs b/rpxy-acme/src/targets.rs index 0cc6f99..08c4685 100644 --- a/rpxy-acme/src/targets.rs +++ b/rpxy-acme/src/targets.rs @@ -1,83 +1,96 @@ -use rustc_hash::FxHashMap as HashMap; -use std::path::PathBuf; -use url::Url; - +use crate::dir_cache::DirCache; use crate::{ - constants::{ACME_ACCOUNT_SUBDIR, ACME_CERTIFICATE_FILE_NAME, ACME_DIR_URL, ACME_PRIVATE_KEY_FILE_NAME, ACME_REGISTRY_PATH}, + constants::{ACME_DIR_URL, ACME_REGISTRY_PATH}, error::RpxyAcmeError, log::*, }; +use rustc_hash::FxHashMap as HashMap; +use rustls_acme::AcmeConfig; +use std::{fmt::Debug, path::PathBuf, sync::Arc}; +use url::Url; #[derive(Debug)] /// ACME settings -pub struct AcmeTargets { - /// ACME account email - pub email: String, +pub struct AcmeContexts +where + EC: Debug + 'static, + EA: Debug + 'static, +{ /// ACME directory url - pub acme_dir_url: Url, - /// ACME registry path that stores account key and certificate - pub acme_registry_path: PathBuf, - /// ACME accounts directory, subdirectory of ACME_REGISTRY_PATH - pub acme_accounts_dir: PathBuf, - /// ACME target info map - pub acme_targets: HashMap, + acme_dir_url: Url, + /// ACME registry directory + acme_registry_dir: PathBuf, + /// ACME contacts + contacts: Vec, + /// ACME config + inner: HashMap>>, } -#[derive(Debug)] -/// ACME settings for each server name -pub struct AcmeTargetInfo { - /// Server name - pub server_name: String, - /// private key path - pub private_key_path: PathBuf, - /// certificate path - pub certificate_path: PathBuf, -} +impl AcmeContexts { + /// Create a new instance. Note that for each domain, a new AcmeConfig is created. + /// This means that for each domain, a distinct operation will be dispatched and separated certificates will be generated. + pub fn try_new( + acme_dir_url: Option<&str>, + acme_registry_dir: Option<&str>, + contacts: &[String], + domains: &[String], + ) -> Result { + let acme_registry_dir = acme_registry_dir + .map(|v| v.to_ascii_lowercase()) + .map_or_else(|| PathBuf::from(ACME_REGISTRY_PATH), PathBuf::from); + if acme_registry_dir.exists() && !acme_registry_dir.is_dir() { + return Err(RpxyAcmeError::InvalidAcmeRegistryPath); + } + let acme_dir_url = acme_dir_url + .map(|v| v.to_ascii_lowercase()) + .as_deref() + .map_or_else(|| Url::parse(ACME_DIR_URL), Url::parse)?; + let contacts = contacts.iter().map(|email| format!("mailto:{email}")).collect::>(); + let rustls_client_config = rustls::ClientConfig::builder() + .dangerous() // The `Verifier` we're using is actually safe + .with_custom_certificate_verifier(std::sync::Arc::new(rustls_platform_verifier::Verifier::new())) + .with_no_client_auth(); + let rustls_client_config = Arc::new(rustls_client_config); -impl AcmeTargets { - /// Create a new instance - pub fn try_new(email: &str, acme_dir_url: Option<&str>, acme_registry_path: Option<&str>) -> Result { - let acme_dir_url = Url::parse(acme_dir_url.unwrap_or(ACME_DIR_URL))?; - let acme_registry_path = acme_registry_path.map_or_else(|| PathBuf::from(ACME_REGISTRY_PATH), PathBuf::from); - if acme_registry_path.exists() && !acme_registry_path.is_dir() { - return Err(RpxyAcmeError::InvalidAcmeRegistryPath); - } - let acme_account_dir = acme_registry_path.join(ACME_ACCOUNT_SUBDIR); - if acme_account_dir.exists() && !acme_account_dir.is_dir() { - return Err(RpxyAcmeError::InvalidAcmeRegistryPath); - } - std::fs::create_dir_all(&acme_account_dir)?; + let inner = domains + .iter() + .map(|domain| { + let dir_cache = DirCache::new(&acme_registry_dir, domain); + let config = AcmeConfig::new([domain]) + .contact(&contacts) + .cache(dir_cache) + .directory(acme_dir_url.as_str()) + .client_tls_config(rustls_client_config.clone()); + let config = Box::new(config); + (domain.to_ascii_lowercase(), config) + }) + .collect::>(); Ok(Self { - email: email.to_owned(), acme_dir_url, - acme_registry_path, - acme_accounts_dir: acme_account_dir, - acme_targets: HashMap::default(), + acme_registry_dir, + contacts, + inner, }) } +} - /// Add a new target - /// Write dummy cert and key files if not exists - pub fn add_target(&mut self, server_name: &str) -> Result<(), RpxyAcmeError> { - info!("Adding ACME target: {}", server_name); - let parent_dir = self.acme_registry_path.join(server_name); - let private_key_path = parent_dir.join(ACME_PRIVATE_KEY_FILE_NAME); - let certificate_path = parent_dir.join(ACME_CERTIFICATE_FILE_NAME); +#[cfg(test)] +mod tests { + use super::*; - if !parent_dir.exists() { - warn!("Creating ACME target directory: {}", parent_dir.display()); - std::fs::create_dir_all(parent_dir)?; - } - - self.acme_targets.insert( - server_name.to_owned(), - AcmeTargetInfo { - server_name: server_name.to_owned(), - private_key_path, - certificate_path, - }, - ); - Ok(()) + #[test] + fn test_try_new() { + let acme_dir_url = "https://acme.example.com/directory"; + let acme_registry_dir = "/tmp/acme"; + let contacts = vec!["test@example.com".to_string()]; + let acme_contexts: AcmeContexts = AcmeContexts::try_new( + Some(acme_dir_url), + Some(acme_registry_dir), + &contacts, + &["example.com".to_string(), "example.org".to_string()], + ) + .unwrap(); + println!("{:#?}", acme_contexts); } } diff --git a/rpxy-bin/src/config/parse.rs b/rpxy-bin/src/config/parse.rs index 4a28bed..741cc7a 100644 --- a/rpxy-bin/src/config/parse.rs +++ b/rpxy-bin/src/config/parse.rs @@ -7,7 +7,7 @@ use rpxy_lib::{AppConfig, AppConfigList, ProxyConfig}; use rustc_hash::FxHashMap as HashMap; #[cfg(feature = "acme")] -use rpxy_acme::{AcmeTargets, ACME_CERTIFICATE_FILE_NAME, ACME_PRIVATE_KEY_FILE_NAME, ACME_REGISTRY_PATH}; +use rpxy_acme::{ACME_DIR_URL, ACME_REGISTRY_PATH}; /// Parsed options pub struct Opts { @@ -110,7 +110,12 @@ pub async fn build_cert_manager( #[cfg(feature = "acme")] let acme_option = config.experimental.as_ref().and_then(|v| v.acme.clone()); #[cfg(feature = "acme")] - let registry_path = acme_option + let acme_dir_url = acme_option + .as_ref() + .and_then(|v| v.dir_url.as_deref()) + .unwrap_or(ACME_DIR_URL); + #[cfg(feature = "acme")] + let acme_registry_path = acme_option .as_ref() .and_then(|v| v.registry_path.as_deref()) .unwrap_or(ACME_REGISTRY_PATH); @@ -128,8 +133,12 @@ pub async fn build_cert_manager( let mut tls = tls.clone(); if let Some(true) = tls.acme { ensure!(acme_option.is_some() && tls.tls_cert_key_path.is_none() && tls.tls_cert_path.is_none()); - tls.tls_cert_key_path = Some(format!("{registry_path}/{server_name}/{ACME_CERTIFICATE_FILE_NAME}")); - tls.tls_cert_path = Some(format!("{registry_path}/{server_name}/{ACME_PRIVATE_KEY_FILE_NAME}")); + // Both of tls_cert_key_path and tls_cert_path must be the same for ACME since it's a single file + let subdir = format!("{}/{}", acme_registry_path, server_name.to_ascii_lowercase()); + let file_name = + rpxy_acme::DirCache::cached_cert_file_name(&[server_name.to_ascii_lowercase()], acme_dir_url.to_ascii_lowercase()); + tls.tls_cert_key_path = Some(format!("{}/{}", subdir, file_name)); + tls.tls_cert_path = Some(format!("{}/{}", subdir, file_name)); } tls }; @@ -151,27 +160,27 @@ pub async fn build_cert_manager( /// Build acme manager and dummy cert and key as initial states if not exists /// TODO: CURRENTLY NOT IMPLEMENTED, UNDER DESIGNING pub async fn build_acme_manager(config: &ConfigToml) -> Result<(), anyhow::Error> { - let acme_option = config.experimental.as_ref().and_then(|v| v.acme.clone()); - if acme_option.is_none() { - return Ok(()); - } - let acme_option = acme_option.unwrap(); - let mut acme_targets = AcmeTargets::try_new( - acme_option.email.as_ref(), - acme_option.dir_url.as_deref(), - acme_option.registry_path.as_deref(), - ) - .map_err(|e| anyhow!("Invalid acme configuration: {e}"))?; + // let acme_option = config.experimental.as_ref().and_then(|v| v.acme.clone()); + // if acme_option.is_none() { + // return Ok(()); + // } + // let acme_option = acme_option.unwrap(); + // let mut acme_targets = AcmeTargets::try_new( + // acme_option.email.as_ref(), + // acme_option.dir_url.as_deref(), + // acme_option.registry_path.as_deref(), + // ) + // .map_err(|e| anyhow!("Invalid acme configuration: {e}"))?; - let apps = config.apps.as_ref().unwrap(); - for app in apps.0.values() { - if let Some(tls) = app.tls.as_ref() { - if tls.acme.unwrap_or(false) { - acme_targets.add_target(app.server_name.as_ref().unwrap())?; - } - } - } + // let apps = config.apps.as_ref().unwrap(); + // for app in apps.0.values() { + // if let Some(tls) = app.tls.as_ref() { + // if tls.acme.unwrap_or(false) { + // acme_targets.add_target(app.server_name.as_ref().unwrap())?; + // } + // } + // } // TODO: remove later - println!("ACME targets: {:#?}", acme_targets); + // println!("ACME targets: {:#?}", acme_targets); Ok(()) } From 63f9d1dabc0b63fb7c7764768c968fd4c92132e1 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Sat, 13 Jul 2024 05:07:57 +0900 Subject: [PATCH 04/16] wip: designing acme --- rpxy-acme/src/dir_cache.rs | 8 ++-- rpxy-acme/src/targets.rs | 78 ++++++++++++++++++++++++------------ rpxy-bin/src/config/parse.rs | 52 ++++++++++++++---------- 3 files changed, 87 insertions(+), 51 deletions(-) diff --git a/rpxy-acme/src/dir_cache.rs b/rpxy-acme/src/dir_cache.rs index 2f613d8..33504fa 100644 --- a/rpxy-acme/src/dir_cache.rs +++ b/rpxy-acme/src/dir_cache.rs @@ -15,14 +15,14 @@ enum FileType { Cert, } -#[derive(Debug)] +#[derive(Debug, PartialEq, Eq)] pub struct DirCache { - account_dir: PathBuf, - cert_dir: PathBuf, + pub(super) account_dir: PathBuf, + pub(super) cert_dir: PathBuf, } impl DirCache { - pub fn new

(dir: P, server_name: impl AsRef) -> Self + pub fn new

(dir: P, server_name: &str) -> Self where P: AsRef, { diff --git a/rpxy-acme/src/targets.rs b/rpxy-acme/src/targets.rs index 08c4685..74e6262 100644 --- a/rpxy-acme/src/targets.rs +++ b/rpxy-acme/src/targets.rs @@ -1,32 +1,28 @@ -use crate::dir_cache::DirCache; use crate::{ constants::{ACME_DIR_URL, ACME_REGISTRY_PATH}, + dir_cache::DirCache, error::RpxyAcmeError, log::*, }; use rustc_hash::FxHashMap as HashMap; -use rustls_acme::AcmeConfig; -use std::{fmt::Debug, path::PathBuf, sync::Arc}; +// use rustls_acme::AcmeConfig; +use std::path::PathBuf; use url::Url; #[derive(Debug)] /// ACME settings -pub struct AcmeContexts -where - EC: Debug + 'static, - EA: Debug + 'static, -{ +pub struct AcmeContexts { /// ACME directory url acme_dir_url: Url, /// ACME registry directory acme_registry_dir: PathBuf, /// ACME contacts contacts: Vec, - /// ACME config - inner: HashMap>>, + /// ACME directly cache information + inner: HashMap, } -impl AcmeContexts { +impl AcmeContexts { /// Create a new instance. Note that for each domain, a new AcmeConfig is created. /// This means that for each domain, a distinct operation will be dispatched and separated certificates will be generated. pub fn try_new( @@ -35,6 +31,9 @@ impl AcmeContexts { contacts: &[String], domains: &[String], ) -> Result { + // Install aws_lc_rs as default crypto provider for rustls + let _ = rustls::crypto::CryptoProvider::install_default(rustls::crypto::aws_lc_rs::default_provider()); + let acme_registry_dir = acme_registry_dir .map(|v| v.to_ascii_lowercase()) .map_or_else(|| PathBuf::from(ACME_REGISTRY_PATH), PathBuf::from); @@ -46,25 +45,33 @@ impl AcmeContexts { .as_deref() .map_or_else(|| Url::parse(ACME_DIR_URL), Url::parse)?; let contacts = contacts.iter().map(|email| format!("mailto:{email}")).collect::>(); - let rustls_client_config = rustls::ClientConfig::builder() - .dangerous() // The `Verifier` we're using is actually safe - .with_custom_certificate_verifier(std::sync::Arc::new(rustls_platform_verifier::Verifier::new())) - .with_no_client_auth(); - let rustls_client_config = Arc::new(rustls_client_config); + // let rustls_client_config = rustls::ClientConfig::builder() + // .dangerous() // The `Verifier` we're using is actually safe + // .with_custom_certificate_verifier(std::sync::Arc::new(rustls_platform_verifier::Verifier::new())) + // .with_no_client_auth(); + // let rustls_client_config = Arc::new(rustls_client_config); let inner = domains .iter() .map(|domain| { - let dir_cache = DirCache::new(&acme_registry_dir, domain); - let config = AcmeConfig::new([domain]) - .contact(&contacts) - .cache(dir_cache) - .directory(acme_dir_url.as_str()) - .client_tls_config(rustls_client_config.clone()); - let config = Box::new(config); - (domain.to_ascii_lowercase(), config) + let domain = domain.to_ascii_lowercase(); + let dir_cache = DirCache::new(&acme_registry_dir, &domain); + (domain, dir_cache) }) .collect::>(); + // let inner = domains + // .iter() + // .map(|domain| { + // let dir_cache = DirCache::new(&acme_registry_dir, domain); + // let config = AcmeConfig::new([domain]) + // .contact(&contacts) + // .cache(dir_cache) + // .directory(acme_dir_url.as_str()) + // .client_tls_config(rustls_client_config.clone()); + // let config = Box::new(config); + // (domain.to_ascii_lowercase(), config) + // }) + // .collect::>(); Ok(Self { acme_dir_url, @@ -77,6 +84,8 @@ impl AcmeContexts { #[cfg(test)] mod tests { + use crate::constants::ACME_ACCOUNT_SUBDIR; + use super::*; #[test] @@ -84,13 +93,30 @@ mod tests { let acme_dir_url = "https://acme.example.com/directory"; let acme_registry_dir = "/tmp/acme"; let contacts = vec!["test@example.com".to_string()]; - let acme_contexts: AcmeContexts = AcmeContexts::try_new( + let acme_contexts: AcmeContexts = AcmeContexts::try_new( Some(acme_dir_url), Some(acme_registry_dir), &contacts, &["example.com".to_string(), "example.org".to_string()], ) .unwrap(); - println!("{:#?}", acme_contexts); + assert_eq!(acme_contexts.inner.len(), 2); + assert_eq!(acme_contexts.contacts, vec!["mailto:test@example.com".to_string()]); + assert_eq!(acme_contexts.acme_dir_url.as_str(), acme_dir_url); + assert_eq!(acme_contexts.acme_registry_dir, PathBuf::from(acme_registry_dir)); + assert_eq!( + acme_contexts.inner["example.com"], + DirCache { + account_dir: PathBuf::from(acme_registry_dir).join(ACME_ACCOUNT_SUBDIR), + cert_dir: PathBuf::from(acme_registry_dir).join("example.com"), + } + ); + assert_eq!( + acme_contexts.inner["example.org"], + DirCache { + account_dir: PathBuf::from(acme_registry_dir).join(ACME_ACCOUNT_SUBDIR), + cert_dir: PathBuf::from(acme_registry_dir).join("example.org"), + } + ); } } diff --git a/rpxy-bin/src/config/parse.rs b/rpxy-bin/src/config/parse.rs index 741cc7a..3dd6599 100644 --- a/rpxy-bin/src/config/parse.rs +++ b/rpxy-bin/src/config/parse.rs @@ -7,7 +7,7 @@ use rpxy_lib::{AppConfig, AppConfigList, ProxyConfig}; use rustc_hash::FxHashMap as HashMap; #[cfg(feature = "acme")] -use rpxy_acme::{ACME_DIR_URL, ACME_REGISTRY_PATH}; +use rpxy_acme::{AcmeContexts, ACME_DIR_URL, ACME_REGISTRY_PATH}; /// Parsed options pub struct Opts { @@ -160,27 +160,37 @@ pub async fn build_cert_manager( /// Build acme manager and dummy cert and key as initial states if not exists /// TODO: CURRENTLY NOT IMPLEMENTED, UNDER DESIGNING pub async fn build_acme_manager(config: &ConfigToml) -> Result<(), anyhow::Error> { - // let acme_option = config.experimental.as_ref().and_then(|v| v.acme.clone()); - // if acme_option.is_none() { - // return Ok(()); - // } - // let acme_option = acme_option.unwrap(); - // let mut acme_targets = AcmeTargets::try_new( - // acme_option.email.as_ref(), - // acme_option.dir_url.as_deref(), - // acme_option.registry_path.as_deref(), - // ) - // .map_err(|e| anyhow!("Invalid acme configuration: {e}"))?; + let acme_option = config.experimental.as_ref().and_then(|v| v.acme.clone()); + if acme_option.is_none() { + return Ok(()); + } + let acme_option = acme_option.unwrap(); + + let domains = config + .apps + .as_ref() + .unwrap() + .0 + .values() + .filter_map(|app| { + // + if let Some(tls) = app.tls.as_ref() { + if let Some(true) = tls.acme { + return Some(app.server_name.as_ref().unwrap().to_owned()); + } + } + None + }) + .collect::>(); + + let acme_contexts = AcmeContexts::try_new( + acme_option.dir_url.as_deref(), + acme_option.registry_path.as_deref(), + &[acme_option.email], + domains.as_slice(), + )?; - // let apps = config.apps.as_ref().unwrap(); - // for app in apps.0.values() { - // if let Some(tls) = app.tls.as_ref() { - // if tls.acme.unwrap_or(false) { - // acme_targets.add_target(app.server_name.as_ref().unwrap())?; - // } - // } - // } // TODO: remove later - // println!("ACME targets: {:#?}", acme_targets); + println!("ACME contexts: {:#?}", acme_contexts); Ok(()) } From 3a88d3ce90abe91916d5d9899e85046a47ca5509 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Sat, 13 Jul 2024 05:13:32 +0900 Subject: [PATCH 05/16] fix: submodule --- .gitmodules | 3 +++ rpxy-acme/Cargo.toml | 2 +- submodules/rustls-acme | 1 + 3 files changed, 5 insertions(+), 1 deletion(-) create mode 160000 submodules/rustls-acme diff --git a/.gitmodules b/.gitmodules index 0d6a404..7ff65fe 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,3 +1,6 @@ [submodule "submodules/rusty-http-cache-semantics"] path = submodules/rusty-http-cache-semantics url = git@github.com:junkurihara/rusty-http-cache-semantics.git +[submodule "submodules/rustls-acme"] + path = submodules/rustls-acme + url = git@github.com:junkurihara/rustls-acme.git diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml index 57dd514..9473429 100644 --- a/rpxy-acme/Cargo.toml +++ b/rpxy-acme/Cargo.toml @@ -26,6 +26,6 @@ rustls = { version = "0.23.11", default-features = false, features = [ "aws_lc_rs", ] } rustls-platform-verifier = { version = "0.3.2" } -rustls-acme = { path = "../../rustls-acme/", default-features = false, features = [ +rustls-acme = { path = "../submodules/rustls-acme/", default-features = false, features = [ "aws-lc-rs", ] } diff --git a/submodules/rustls-acme b/submodules/rustls-acme new file mode 160000 index 0000000..43719fb --- /dev/null +++ b/submodules/rustls-acme @@ -0,0 +1 @@ +Subproject commit 43719fb04cc522c039c9e7420567a38416f9fec7 From 4d889e6a056fdc9ca96c992802d601eabdc42de3 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Wed, 17 Jul 2024 12:58:39 +0900 Subject: [PATCH 06/16] chore: deps --- rpxy-bin/Cargo.toml | 4 ++-- rpxy-certs/Cargo.toml | 4 ++-- rpxy-lib/Cargo.toml | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml index 358ee43..6126346 100644 --- a/rpxy-bin/Cargo.toml +++ b/rpxy-bin/Cargo.toml @@ -32,7 +32,7 @@ mimalloc = { version = "*", default-features = false } anyhow = "1.0.86" rustc-hash = "2.0.0" serde = { version = "1.0.204", default-features = false, features = ["derive"] } -tokio = { version = "1.38.0", default-features = false, features = [ +tokio = { version = "1.38.1", default-features = false, features = [ "net", "rt-multi-thread", "time", @@ -45,7 +45,7 @@ async-trait = "0.1.81" # config clap = { version = "4.5.9", features = ["std", "cargo", "wrap_help"] } toml = { version = "0.8.14", default-features = false, features = ["parse"] } -hot_reload = "0.1.5" +hot_reload = "0.1.6" # logging tracing = { version = "0.1.40" } diff --git a/rpxy-certs/Cargo.toml b/rpxy-certs/Cargo.toml index cd30815..238c909 100644 --- a/rpxy-certs/Cargo.toml +++ b/rpxy-certs/Cargo.toml @@ -19,7 +19,7 @@ rustc-hash = { version = "2.0.0" } tracing = { version = "0.1.40" } derive_builder = { version = "0.20.0" } thiserror = { version = "1.0.62" } -hot_reload = { version = "0.1.5" } +hot_reload = { version = "0.1.6" } async-trait = { version = "0.1.81" } rustls = { version = "0.23.11", default-features = false, features = [ "std", @@ -33,7 +33,7 @@ rustls-webpki = { version = "0.102.5", default-features = false, features = [ x509-parser = { version = "0.16.0" } [dev-dependencies] -tokio = { version = "1.38.0", default-features = false, features = [ +tokio = { version = "1.38.1", default-features = false, features = [ "rt-multi-thread", "macros", ] } diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml index 1fbeb11..67f5a8d 100644 --- a/rpxy-lib/Cargo.toml +++ b/rpxy-lib/Cargo.toml @@ -34,10 +34,10 @@ acme = [] [dependencies] rand = "0.8.5" rustc-hash = "2.0.0" -bytes = "1.6.0" +bytes = "1.6.1" derive_builder = "0.20.0" futures = { version = "0.3.30", features = ["alloc", "async-await"] } -tokio = { version = "1.38.0", default-features = false, features = [ +tokio = { version = "1.38.1", default-features = false, features = [ "net", "rt-multi-thread", "time", @@ -76,7 +76,7 @@ hyper-rustls = { git = "https://github.com/junkurihara/hyper-rustls", branch = " # tls and cert management for server rpxy-certs = { path = "../rpxy-certs/", default-features = false } -hot_reload = "0.1.5" +hot_reload = "0.1.6" rustls = { version = "0.23.11", default-features = false } tokio-rustls = { version = "0.26.0", features = ["early-data"] } From 9e79a481c6ebf4ae892c124509efc41934e1feb2 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Wed, 17 Jul 2024 17:06:37 +0900 Subject: [PATCH 07/16] wip: implementing api --- rpxy-acme/Cargo.toml | 2 + rpxy-acme/src/dir_cache.rs | 2 +- rpxy-acme/src/lib.rs | 4 +- rpxy-acme/src/{targets.rs => manager.rs} | 91 ++++++++++++++++-------- rpxy-bin/Cargo.toml | 2 +- rpxy-bin/src/config/parse.rs | 23 +++--- rpxy-bin/src/main.rs | 79 ++++++++++++++++++-- 7 files changed, 155 insertions(+), 48 deletions(-) rename rpxy-acme/src/{targets.rs => manager.rs} (54%) diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml index 9473429..7adc8fd 100644 --- a/rpxy-acme/Cargo.toml +++ b/rpxy-acme/Cargo.toml @@ -29,3 +29,5 @@ rustls-platform-verifier = { version = "0.3.2" } rustls-acme = { path = "../submodules/rustls-acme/", default-features = false, features = [ "aws-lc-rs", ] } +tokio = { version = "1.38.1", default-features = false } +tokio-stream = { version = "0.1.15", default-features = false } diff --git a/rpxy-acme/src/dir_cache.rs b/rpxy-acme/src/dir_cache.rs index 33504fa..5170ad6 100644 --- a/rpxy-acme/src/dir_cache.rs +++ b/rpxy-acme/src/dir_cache.rs @@ -15,7 +15,7 @@ enum FileType { Cert, } -#[derive(Debug, PartialEq, Eq)] +#[derive(Debug, PartialEq, Eq, Clone)] pub struct DirCache { pub(super) account_dir: PathBuf, pub(super) cert_dir: PathBuf, diff --git a/rpxy-acme/src/lib.rs b/rpxy-acme/src/lib.rs index 813b388..246b900 100644 --- a/rpxy-acme/src/lib.rs +++ b/rpxy-acme/src/lib.rs @@ -1,7 +1,7 @@ mod constants; mod dir_cache; mod error; -mod targets; +mod manager; #[allow(unused_imports)] mod log { @@ -11,4 +11,4 @@ mod log { pub use constants::{ACME_DIR_URL, ACME_REGISTRY_PATH}; pub use dir_cache::DirCache; pub use error::RpxyAcmeError; -pub use targets::AcmeContexts; +pub use manager::AcmeManager; diff --git a/rpxy-acme/src/targets.rs b/rpxy-acme/src/manager.rs similarity index 54% rename from rpxy-acme/src/targets.rs rename to rpxy-acme/src/manager.rs index 74e6262..112c449 100644 --- a/rpxy-acme/src/targets.rs +++ b/rpxy-acme/src/manager.rs @@ -5,24 +5,29 @@ use crate::{ log::*, }; use rustc_hash::FxHashMap as HashMap; -// use rustls_acme::AcmeConfig; -use std::path::PathBuf; +use rustls::ServerConfig; +use rustls_acme::AcmeConfig; +use std::{path::PathBuf, sync::Arc}; +use tokio::runtime::Handle; +use tokio_stream::StreamExt; use url::Url; -#[derive(Debug)] +#[derive(Debug, Clone)] /// ACME settings -pub struct AcmeContexts { +pub struct AcmeManager { /// ACME directory url acme_dir_url: Url, - /// ACME registry directory - acme_registry_dir: PathBuf, + // /// ACME registry directory + // acme_registry_dir: PathBuf, /// ACME contacts contacts: Vec, /// ACME directly cache information inner: HashMap, + /// Tokio runtime handle + runtime_handle: Handle, } -impl AcmeContexts { +impl AcmeManager { /// Create a new instance. Note that for each domain, a new AcmeConfig is created. /// This means that for each domain, a distinct operation will be dispatched and separated certificates will be generated. pub fn try_new( @@ -30,6 +35,7 @@ impl AcmeContexts { acme_registry_dir: Option<&str>, contacts: &[String], domains: &[String], + runtime_handle: Handle, ) -> Result { // Install aws_lc_rs as default crypto provider for rustls let _ = rustls::crypto::CryptoProvider::install_default(rustls::crypto::aws_lc_rs::default_provider()); @@ -45,11 +51,6 @@ impl AcmeContexts { .as_deref() .map_or_else(|| Url::parse(ACME_DIR_URL), Url::parse)?; let contacts = contacts.iter().map(|email| format!("mailto:{email}")).collect::>(); - // let rustls_client_config = rustls::ClientConfig::builder() - // .dangerous() // The `Verifier` we're using is actually safe - // .with_custom_certificate_verifier(std::sync::Arc::new(rustls_platform_verifier::Verifier::new())) - // .with_no_client_auth(); - // let rustls_client_config = Arc::new(rustls_client_config); let inner = domains .iter() @@ -59,27 +60,59 @@ impl AcmeContexts { (domain, dir_cache) }) .collect::>(); - // let inner = domains - // .iter() - // .map(|domain| { - // let dir_cache = DirCache::new(&acme_registry_dir, domain); - // let config = AcmeConfig::new([domain]) - // .contact(&contacts) - // .cache(dir_cache) - // .directory(acme_dir_url.as_str()) - // .client_tls_config(rustls_client_config.clone()); - // let config = Box::new(config); - // (domain.to_ascii_lowercase(), config) - // }) - // .collect::>(); Ok(Self { acme_dir_url, - acme_registry_dir, + // acme_registry_dir, contacts, inner, + runtime_handle, }) } + + /// Start ACME manager to manage certificates for each domain. + /// Returns a Vec> as a tasks handles and a map of domain to ServerConfig for challenge. + pub fn spawn_manager_tasks(&self) -> (Vec>, HashMap>) { + info!("rpxy ACME manager started"); + + let rustls_client_config = rustls::ClientConfig::builder() + .dangerous() // The `Verifier` we're using is actually safe + .with_custom_certificate_verifier(Arc::new(rustls_platform_verifier::Verifier::new())) + .with_no_client_auth(); + let rustls_client_config = Arc::new(rustls_client_config); + + let mut server_configs_for_challenge: HashMap> = HashMap::default(); + let join_handles = self + .inner + .clone() + .into_iter() + .map(|(domain, dir_cache)| { + let config = AcmeConfig::new([&domain]) + .contact(&self.contacts) + .cache(dir_cache.to_owned()) + .directory(self.acme_dir_url.as_str()) + .client_tls_config(rustls_client_config.clone()); + let mut state = config.state(); + server_configs_for_challenge.insert(domain.to_ascii_lowercase(), state.challenge_rustls_config()); + self.runtime_handle.spawn(async move { + info!("rpxy ACME manager task for {domain} started"); + // infinite loop unless the return value is None + loop { + let Some(res) = state.next().await else { + error!("rpxy ACME manager task for {domain} exited"); + break; + }; + match res { + Ok(ok) => info!("rpxy ACME event: {ok:?}"), + Err(err) => error!("rpxy ACME error: {err:?}"), + } + } + }) + }) + .collect::>(); + + (join_handles, server_configs_for_challenge) + } } #[cfg(test)] @@ -93,17 +126,19 @@ mod tests { let acme_dir_url = "https://acme.example.com/directory"; let acme_registry_dir = "/tmp/acme"; let contacts = vec!["test@example.com".to_string()]; - let acme_contexts: AcmeContexts = AcmeContexts::try_new( + let handle = Handle::current(); + let acme_contexts: AcmeManager = AcmeManager::try_new( Some(acme_dir_url), Some(acme_registry_dir), &contacts, &["example.com".to_string(), "example.org".to_string()], + handle, ) .unwrap(); assert_eq!(acme_contexts.inner.len(), 2); assert_eq!(acme_contexts.contacts, vec!["mailto:test@example.com".to_string()]); assert_eq!(acme_contexts.acme_dir_url.as_str(), acme_dir_url); - assert_eq!(acme_contexts.acme_registry_dir, PathBuf::from(acme_registry_dir)); + // assert_eq!(acme_contexts.acme_registry_dir, PathBuf::from(acme_registry_dir)); assert_eq!( acme_contexts.inner["example.com"], DirCache { diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml index 6126346..f330d9d 100644 --- a/rpxy-bin/Cargo.toml +++ b/rpxy-bin/Cargo.toml @@ -40,7 +40,7 @@ tokio = { version = "1.38.1", default-features = false, features = [ "macros", ] } async-trait = "0.1.81" - +futures-util = { version = "0.3.30", default-features = false } # config clap = { version = "4.5.9", features = ["std", "cargo", "wrap_help"] } diff --git a/rpxy-bin/src/config/parse.rs b/rpxy-bin/src/config/parse.rs index 3dd6599..a591c40 100644 --- a/rpxy-bin/src/config/parse.rs +++ b/rpxy-bin/src/config/parse.rs @@ -7,7 +7,7 @@ use rpxy_lib::{AppConfig, AppConfigList, ProxyConfig}; use rustc_hash::FxHashMap as HashMap; #[cfg(feature = "acme")] -use rpxy_acme::{AcmeContexts, ACME_DIR_URL, ACME_REGISTRY_PATH}; +use rpxy_acme::{AcmeManager, ACME_DIR_URL, ACME_REGISTRY_PATH}; /// Parsed options pub struct Opts { @@ -157,12 +157,14 @@ pub async fn build_cert_manager( /* ----------------------- */ #[cfg(feature = "acme")] -/// Build acme manager and dummy cert and key as initial states if not exists -/// TODO: CURRENTLY NOT IMPLEMENTED, UNDER DESIGNING -pub async fn build_acme_manager(config: &ConfigToml) -> Result<(), anyhow::Error> { +/// Build acme manager +pub async fn build_acme_manager( + config: &ConfigToml, + runtime_handle: tokio::runtime::Handle, +) -> Result, anyhow::Error> { let acme_option = config.experimental.as_ref().and_then(|v| v.acme.clone()); if acme_option.is_none() { - return Ok(()); + return Ok(None); } let acme_option = acme_option.unwrap(); @@ -183,14 +185,17 @@ pub async fn build_acme_manager(config: &ConfigToml) -> Result<(), anyhow::Error }) .collect::>(); - let acme_contexts = AcmeContexts::try_new( + if domains.is_empty() { + return Ok(None); + } + + let acme_manager = AcmeManager::try_new( acme_option.dir_url.as_deref(), acme_option.registry_path.as_deref(), &[acme_option.email], domains.as_slice(), + runtime_handle, )?; - // TODO: remove later - println!("ACME contexts: {:#?}", acme_contexts); - Ok(()) + Ok(Some(acme_manager)) } diff --git a/rpxy-bin/src/main.rs b/rpxy-bin/src/main.rs index 9847a5f..f07212e 100644 --- a/rpxy-bin/src/main.rs +++ b/rpxy-bin/src/main.rs @@ -68,16 +68,33 @@ async fn rpxy_service_without_watcher( let config_toml = ConfigToml::new(config_file_path).map_err(|e| anyhow!("Invalid toml file: {e}"))?; let (proxy_conf, app_conf) = build_settings(&config_toml).map_err(|e| anyhow!("Invalid configuration: {e}"))?; - #[cfg(feature = "acme")] // TODO: CURRENTLY NOT IMPLEMENTED, UNDER DESIGNING - let acme_manager = build_acme_manager(&config_toml).await; + #[cfg(feature = "acme")] + let acme_manager = build_acme_manager(&config_toml, runtime_handle.clone()).await?; let cert_service_and_rx = build_cert_manager(&config_toml) .await .map_err(|e| anyhow!("Invalid cert configuration: {e}"))?; - rpxy_entrypoint(&proxy_conf, &app_conf, cert_service_and_rx.as_ref(), &runtime_handle, None) + #[cfg(feature = "acme")] + { + rpxy_entrypoint( + &proxy_conf, + &app_conf, + cert_service_and_rx.as_ref(), + acme_manager.as_ref(), + &runtime_handle, + None, + ) .await .map_err(|e| anyhow!(e)) + } + + #[cfg(not(feature = "acme"))] + { + rpxy_entrypoint(&proxy_conf, &app_conf, cert_service_and_rx.as_ref(), &runtime_handle, None) + .await + .map_err(|e| anyhow!(e)) + } } async fn rpxy_service_with_watcher( @@ -93,8 +110,8 @@ async fn rpxy_service_with_watcher( .ok_or(anyhow!("Something wrong in config reloader receiver"))?; let (mut proxy_conf, mut app_conf) = build_settings(&config_toml).map_err(|e| anyhow!("Invalid configuration: {e}"))?; - #[cfg(feature = "acme")] // TODO: CURRENTLY NOT IMPLEMENTED, UNDER DESIGNING - let acme_manager = build_acme_manager(&config_toml).await; + #[cfg(feature = "acme")] + let acme_manager = build_acme_manager(&config_toml, runtime_handle.clone()).await?; let mut cert_service_and_rx = build_cert_manager(&config_toml) .await @@ -106,7 +123,16 @@ async fn rpxy_service_with_watcher( // Continuous monitoring loop { tokio::select! { - rpxy_res = rpxy_entrypoint(&proxy_conf, &app_conf, cert_service_and_rx.as_ref(), &runtime_handle, Some(term_notify.clone())) => { + rpxy_res = { + #[cfg(feature = "acme")] + { + rpxy_entrypoint(&proxy_conf, &app_conf, cert_service_and_rx.as_ref(), acme_manager.as_ref(), &runtime_handle, Some(term_notify.clone())) + } + #[cfg(not(feature = "acme"))] + { + rpxy_entrypoint(&proxy_conf, &app_conf, cert_service_and_rx.as_ref(), &runtime_handle, Some(term_notify.clone())) + } + } => { error!("rpxy entrypoint or cert service exited"); return rpxy_res.map_err(|e| anyhow!(e)); } @@ -145,6 +171,7 @@ async fn rpxy_service_with_watcher( Ok(()) } +#[cfg(not(feature = "acme"))] /// Wrapper of entry point for rpxy service with certificate management service async fn rpxy_entrypoint( proxy_config: &rpxy_lib::ProxyConfig, @@ -152,7 +179,7 @@ async fn rpxy_entrypoint( cert_service_and_rx: Option<&( ReloaderService, ReloaderReceiver, - )>, // TODO: + )>, runtime_handle: &tokio::runtime::Handle, term_notify: Option>, ) -> Result<(), anyhow::Error> { @@ -173,3 +200,41 @@ async fn rpxy_entrypoint( .map_err(|e| anyhow!(e)) } } + +#[cfg(feature = "acme")] +/// Wrapper of entry point for rpxy service with certificate management service +async fn rpxy_entrypoint( + proxy_config: &rpxy_lib::ProxyConfig, + app_config_list: &rpxy_lib::AppConfigList, + cert_service_and_rx: Option<&( + ReloaderService, + ReloaderReceiver, + )>, + acme_manager: Option<&rpxy_acme::AcmeManager>, + runtime_handle: &tokio::runtime::Handle, + term_notify: Option>, +) -> Result<(), anyhow::Error> { + // TODO: remove later, reconsider routine + println!("ACME manager:\n{:#?}", acme_manager); + let x = acme_manager.unwrap().clone(); + let (handle, confs) = x.spawn_manager_tasks(); + tokio::spawn(async move { futures_util::future::select_all(handle).await }); + // TODO: + + if let Some((cert_service, cert_rx)) = cert_service_and_rx { + tokio::select! { + rpxy_res = entrypoint(proxy_config, app_config_list, Some(cert_rx), runtime_handle, term_notify) => { + error!("rpxy entrypoint exited"); + rpxy_res.map_err(|e| anyhow!(e)) + } + cert_res = cert_service.start() => { + error!("cert reloader service exited"); + cert_res.map_err(|e| anyhow!(e)) + } + } + } else { + entrypoint(proxy_config, app_config_list, None, runtime_handle, term_notify) + .await + .map_err(|e| anyhow!(e)) + } +} From d6136f9ffaf3e348401839b3104c7a185fb19302 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Wed, 17 Jul 2024 17:10:36 +0900 Subject: [PATCH 08/16] fix test --- rpxy-acme/src/manager.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rpxy-acme/src/manager.rs b/rpxy-acme/src/manager.rs index 112c449..54b1ece 100644 --- a/rpxy-acme/src/manager.rs +++ b/rpxy-acme/src/manager.rs @@ -121,8 +121,8 @@ mod tests { use super::*; - #[test] - fn test_try_new() { + #[tokio::test] + async fn test_try_new() { let acme_dir_url = "https://acme.example.com/directory"; let acme_registry_dir = "/tmp/acme"; let contacts = vec!["test@example.com".to_string()]; From 7b0ca08e1e434bd4605fc238db403d3b45a3bba5 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Wed, 17 Jul 2024 20:48:37 +0900 Subject: [PATCH 09/16] feat: add initial acme support (ugly!) --- CHANGELOG.md | 9 ++ README.md | 34 +++++- config-example.toml | 14 +++ rpxy-acme/src/lib.rs | 4 + rpxy-acme/src/manager.rs | 40 ++++--- rpxy-bin/src/main.rs | 176 ++++++++++++++++++++----------- rpxy-lib/Cargo.toml | 5 +- rpxy-lib/src/error.rs | 5 + rpxy-lib/src/globals.rs | 4 + rpxy-lib/src/lib.rs | 38 +++++-- rpxy-lib/src/proxy/proxy_main.rs | 37 ++++++- 11 files changed, 277 insertions(+), 89 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 53a74b1..4302a58 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,15 @@ ## 0.9.0 (Unreleased) +### Important Changes + +- Breaking: Experimental ACME support is added. Check the new configuration options and README.md for ACME support. Note that it is still under development and may have some issues. + +### Improvement + +- Refactor: lots of minor improvements +- Deps + ## 0.8.1 ### Improvement diff --git a/README.md b/README.md index 20d7891..b825cd1 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# rpxy: A simple and ultrafast reverse-proxy serving multiple domain names with TLS termination, written in pure Rust +# rpxy: A simple and ultrafast reverse-proxy serving multiple domain names with TLS termination, written in Rust [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE) ![Unit Test](https://github.com/junkurihara/rust-rpxy/actions/workflows/ci.yml/badge.svg) @@ -10,9 +10,11 @@ ## Introduction -`rpxy` [ahr-pik-see] is an implementation of simple and lightweight reverse-proxy with some additional features. The implementation is based on [`hyper`](https://github.com/hyperium/hyper), [`rustls`](https://github.com/rustls/rustls) and [`tokio`](https://github.com/tokio-rs/tokio), i.e., written in pure Rust. Our `rpxy` routes multiple host names to appropriate backend application servers while serving TLS connections. +`rpxy` [ahr-pik-see] is an implementation of simple and lightweight reverse-proxy with some additional features. The implementation is based on [`hyper`](https://github.com/hyperium/hyper), [`rustls`](https://github.com/rustls/rustls) and [`tokio`](https://github.com/tokio-rs/tokio), i.e., written in Rust^[^pure_rust]. Our `rpxy` routes multiple host names to appropriate backend application servers while serving TLS connections. - As default, `rpxy` provides the *TLS connection sanitization* by correctly binding a certificate used to establish a secure channel with the backend application. Specifically, it always keeps the consistency between the given SNI (server name indication) in `ClientHello` of the underlying TLS and the domain name given by the overlaid HTTP HOST header (or URL in Request line) [^1]. Additionally, as a somewhat unstable feature, our `rpxy` can handle the brand-new HTTP/3 connection thanks to [`quinn`](https://github.com/quinn-rs/quinn), [`s2n-quic`](https://github.com/aws/s2n-quic) and [`hyperium/h3`](https://github.com/hyperium/h3).[^h3lib] +[^pure_rust]: Doubtfully can be claimed to be written in pure Rust since current `rpxy` is based on `aws-lc-rs` for cryptographic operations. + + As default, `rpxy` provides the *TLS connection sanitization* by correctly binding a certificate used to establish a secure channel with the backend application. Specifically, it always keeps the consistency between the given SNI (server name indication) in `ClientHello` of the underlying TLS and the domain name given by the overlaid HTTP HOST header (or URL in Request line) [^1]. Additionally, as a somewhat unstable feature, our `rpxy` can handle the brand-new HTTP/3 connection thanks to [`quinn`](https://github.com/quinn-rs/quinn), [`s2n-quic`](https://github.com/aws/s2n-quic) and [`hyperium/h3`](https://github.com/hyperium/h3).[^h3lib] Furthermore, `rpxy` supports the automatic issuance and renewal of certificates via [TLS-ALPN-01 (RFC8737)](https://www.rfc-editor.org/rfc/rfc8737) of [ACME protocol (RFC8555)](https://www.rfc-editor.org/rfc/rfc8555) thanks to [`rustls-acme`](https://github.com/FlorianUekermann/rustls-acme). [^h3lib]: HTTP/3 libraries are mutually exclusive. You need to explicitly specify `s2n-quic` with `--no-default-features` flag. Also note that if you build `rpxy` with `s2n-quic`, then it requires `openssl` just for building the package. @@ -298,6 +300,32 @@ max_cache_each_size_on_memory = 4096 # optional. default is 4k if 0, it is alway A *storable* (in the context of an HTTP message) response is stored if its size is less than or equal to `max_cache_each_size` in bytes. If it is also less than or equal to `max_cache_each_size_on_memory`, it is stored as an on-memory object. Otherwise, it is stored as a temporary file. Note that `max_cache_each_size` must be larger or equal to `max_cache_each_size_on_memory`. Also note that once `rpxy` restarts or the config is updated, the cache is totally eliminated not only from the on-memory table but also from the file system. +### Automated Certificate Issuance and Renewal via TLS-ALPN-01 ACME protocol + +This is a brand-new feature and maybe still unstable. Thanks to the [`rustls-acme`](https://github.com/FlorianUekermann/rustls-acme), the automatic issuance and renewal of certificates are finally available in `rpxy`. To enable this feature, you need to specify the following entries in `config.toml`. + +```toml +# ACME enabled domain name. +# ACME will be used to get a certificate for the server_name with ACME tls-alpn-01 protocol. +# Note that acme option must be specified in the experimental section. +[apps.localhost_with_acme] +server_name = 'example.org' +reverse_proxy = [{ upstream = [{ location = 'example.com', tls = true }] }] +tls = { https_redirection = true, acme = true } # do not specify tls_cert_path and/or tls_cert_key_path +``` + +For the ACME enabled domain, the following settings are referred to acquire a certificate. + +```toml +# Global ACME settings. Unless specified, ACME is disabled. +[experimental.acme] +dir_url = "https://localhost:14000/dir" # optional. default is "https://acme-v02.api.letsencrypt.org/directory" +email = "test@example.com" +registry_path = "./acme_registry" # optional. default is "./acme_registry" relative to the current working directory +``` + +The above configuration is common to all ACME enabled domains. Note that the https port must be open to the public to verify the domain ownership. + ## TIPS ### Using Private Key Issued by Let's Encrypt diff --git a/config-example.toml b/config-example.toml index c3d1e47..d279e50 100644 --- a/config-example.toml +++ b/config-example.toml @@ -89,6 +89,14 @@ server_name = 'localhost.localdomain' reverse_proxy = [{ upstream = [{ location = 'www.google.com', tls = true }] }] ###################################################################### +###################################################################### +# ACME enabled example. ACME will be used to get a certificate for the server_name with ACME tls-alpn-01 protocol. +# Note that acme option must be specified in the experimental section. +[apps.localhost_with_acme] +server_name = 'kubernetes.docker.internal' +reverse_proxy = [{ upstream = [{ location = 'example.com', tls = true }] }] +tls = { https_redirection = true, acme = true } + ################################### # Experimantal settings # ################################### @@ -119,3 +127,9 @@ cache_dir = './cache' # optional. default is "./cache" relative t max_cache_entry = 1000 # optional. default is 1k max_cache_each_size = 65535 # optional. default is 64k max_cache_each_size_on_memory = 4096 # optional. default is 4k if 0, it is always file cache. + +# ACME settings. Unless specified, ACME is disabled. +[experimental.acme] +dir_url = "https://localhost:14000/dir" # optional. default is "https://acme-v02.api.letsencrypt.org/directory" +email = "test@example.com" +registry_path = "./acme_registry" # optional. default is "./acme_registry" relative to the current working directory diff --git a/rpxy-acme/src/lib.rs b/rpxy-acme/src/lib.rs index 246b900..6254a86 100644 --- a/rpxy-acme/src/lib.rs +++ b/rpxy-acme/src/lib.rs @@ -12,3 +12,7 @@ pub use constants::{ACME_DIR_URL, ACME_REGISTRY_PATH}; pub use dir_cache::DirCache; pub use error::RpxyAcmeError; pub use manager::AcmeManager; + +pub mod reexports { + pub use rustls_acme::is_tls_alpn_challenge; +} diff --git a/rpxy-acme/src/manager.rs b/rpxy-acme/src/manager.rs index 54b1ece..e54731c 100644 --- a/rpxy-acme/src/manager.rs +++ b/rpxy-acme/src/manager.rs @@ -72,9 +72,10 @@ impl AcmeManager { /// Start ACME manager to manage certificates for each domain. /// Returns a Vec> as a tasks handles and a map of domain to ServerConfig for challenge. - pub fn spawn_manager_tasks(&self) -> (Vec>, HashMap>) { - info!("rpxy ACME manager started"); - + pub fn spawn_manager_tasks( + &self, + term_notify: Option>, + ) -> (Vec>, HashMap>) { let rustls_client_config = rustls::ClientConfig::builder() .dangerous() // The `Verifier` we're using is actually safe .with_custom_certificate_verifier(Arc::new(rustls_platform_verifier::Verifier::new())) @@ -94,17 +95,30 @@ impl AcmeManager { .client_tls_config(rustls_client_config.clone()); let mut state = config.state(); server_configs_for_challenge.insert(domain.to_ascii_lowercase(), state.challenge_rustls_config()); - self.runtime_handle.spawn(async move { - info!("rpxy ACME manager task for {domain} started"); - // infinite loop unless the return value is None - loop { - let Some(res) = state.next().await else { - error!("rpxy ACME manager task for {domain} exited"); - break; + self.runtime_handle.spawn({ + let term_notify = term_notify.clone(); + async move { + info!("rpxy ACME manager task for {domain} started"); + // infinite loop unless the return value is None + let task = async { + loop { + let Some(res) = state.next().await else { + error!("rpxy ACME manager task for {domain} exited"); + break; + }; + match res { + Ok(ok) => info!("rpxy ACME event: {ok:?}"), + Err(err) => error!("rpxy ACME error: {err:?}"), + } + } }; - match res { - Ok(ok) => info!("rpxy ACME event: {ok:?}"), - Err(err) => error!("rpxy ACME error: {err:?}"), + if let Some(notify) = term_notify.as_ref() { + tokio::select! { + _ = task => {}, + _ = notify.notified() => { info!("rpxy ACME manager task for {domain} terminated") } + } + } else { + task.await; } } }) diff --git a/rpxy-bin/src/main.rs b/rpxy-bin/src/main.rs index f07212e..eff2648 100644 --- a/rpxy-bin/src/main.rs +++ b/rpxy-bin/src/main.rs @@ -15,7 +15,7 @@ use crate::{ log::*, }; use hot_reload::{ReloaderReceiver, ReloaderService}; -use rpxy_lib::entrypoint; +use rpxy_lib::{entrypoint, RpxyOptions, RpxyOptionsBuilder}; fn main() { init_logger(); @@ -68,30 +68,40 @@ async fn rpxy_service_without_watcher( let config_toml = ConfigToml::new(config_file_path).map_err(|e| anyhow!("Invalid toml file: {e}"))?; let (proxy_conf, app_conf) = build_settings(&config_toml).map_err(|e| anyhow!("Invalid configuration: {e}"))?; - #[cfg(feature = "acme")] - let acme_manager = build_acme_manager(&config_toml, runtime_handle.clone()).await?; - - let cert_service_and_rx = build_cert_manager(&config_toml) + let (cert_service, cert_rx) = build_cert_manager(&config_toml) .await - .map_err(|e| anyhow!("Invalid cert configuration: {e}"))?; + .map_err(|e| anyhow!("Invalid cert configuration: {e}"))? + .map(|(s, r)| (Some(s), Some(r))) + .unwrap_or((None, None)); #[cfg(feature = "acme")] { - rpxy_entrypoint( - &proxy_conf, - &app_conf, - cert_service_and_rx.as_ref(), - acme_manager.as_ref(), - &runtime_handle, - None, - ) - .await - .map_err(|e| anyhow!(e)) + let acme_manager = build_acme_manager(&config_toml, runtime_handle.clone()).await?; + let (acme_join_handles, server_config_acme_challenge) = acme_manager + .as_ref() + .map(|m| m.spawn_manager_tasks(None)) + .unwrap_or((vec![], Default::default())); + let rpxy_opts = RpxyOptionsBuilder::default() + .proxy_config(proxy_conf) + .app_config_list(app_conf) + .cert_rx(cert_rx) + .runtime_handle(runtime_handle.clone()) + .server_configs_acme_challenge(std::sync::Arc::new(server_config_acme_challenge)) + .build()?; + rpxy_entrypoint(&rpxy_opts, cert_service.as_ref(), acme_join_handles) //, &runtime_handle) + .await + .map_err(|e| anyhow!(e)) } #[cfg(not(feature = "acme"))] { - rpxy_entrypoint(&proxy_conf, &app_conf, cert_service_and_rx.as_ref(), &runtime_handle, None) + let rpxy_opts = RpxyOptionsBuilder::default() + .proxy_config(proxy_conf.clone()) + .app_config_list(app_conf.clone()) + .cert_rx(cert_rx.clone()) + .runtime_handle(runtime_handle.clone()) + .build()?; + rpxy_entrypoint(&rpxy_opts, cert_service.as_ref()) //, &runtime_handle) .await .map_err(|e| anyhow!(e)) } @@ -111,7 +121,7 @@ async fn rpxy_service_with_watcher( let (mut proxy_conf, mut app_conf) = build_settings(&config_toml).map_err(|e| anyhow!("Invalid configuration: {e}"))?; #[cfg(feature = "acme")] - let acme_manager = build_acme_manager(&config_toml, runtime_handle.clone()).await?; + let mut acme_manager = build_acme_manager(&config_toml, runtime_handle.clone()).await?; let mut cert_service_and_rx = build_cert_manager(&config_toml) .await @@ -122,15 +132,48 @@ async fn rpxy_service_with_watcher( // Continuous monitoring loop { + let (cert_service, cert_rx) = cert_service_and_rx + .as_ref() + .map(|(s, r)| (Some(s), Some(r))) + .unwrap_or((None, None)); + + #[cfg(feature = "acme")] + let (acme_join_handles, server_config_acme_challenge) = acme_manager + .as_ref() + .map(|m| m.spawn_manager_tasks(Some(term_notify.clone()))) + .unwrap_or((vec![], Default::default())); + + let rpxy_opts = { + #[cfg(feature = "acme")] + let res = RpxyOptionsBuilder::default() + .proxy_config(proxy_conf.clone()) + .app_config_list(app_conf.clone()) + .cert_rx(cert_rx.cloned()) + .runtime_handle(runtime_handle.clone()) + .term_notify(Some(term_notify.clone())) + .server_configs_acme_challenge(std::sync::Arc::new(server_config_acme_challenge)) + .build(); + + #[cfg(not(feature = "acme"))] + let res = RpxyOptionsBuilder::default() + .proxy_config(proxy_conf.clone()) + .app_config_list(app_conf.clone()) + .cert_rx(cert_rx.cloned()) + .runtime_handle(runtime_handle.clone()) + .term_notify(Some(term_notify.clone())) + .build(); + res + }?; + tokio::select! { rpxy_res = { #[cfg(feature = "acme")] { - rpxy_entrypoint(&proxy_conf, &app_conf, cert_service_and_rx.as_ref(), acme_manager.as_ref(), &runtime_handle, Some(term_notify.clone())) + rpxy_entrypoint(&rpxy_opts, cert_service, acme_join_handles)//, &runtime_handle) } #[cfg(not(feature = "acme"))] { - rpxy_entrypoint(&proxy_conf, &app_conf, cert_service_and_rx.as_ref(), &runtime_handle, Some(term_notify.clone())) + rpxy_entrypoint(&rpxy_opts, cert_service)//, &runtime_handle) } } => { error!("rpxy entrypoint or cert service exited"); @@ -159,8 +202,20 @@ async fn rpxy_service_with_watcher( continue; } }; + #[cfg(feature = "acme")] + { + match build_acme_manager(&config_toml, runtime_handle.clone()).await { + Ok(m) => { + acme_manager = m; + }, + Err(e) => { + error!("Invalid acme configuration. Configuration does not updated: {e}"); + continue; + } + } + } - info!("Configuration updated. Terminate all spawned proxy services and force to re-bind TCP/UDP sockets"); + info!("Configuration updated. Terminate all spawned services and force to re-bind TCP/UDP sockets"); term_notify.notify_waiters(); // tokio::time::sleep(tokio::time::Duration::from_secs(1)).await; } @@ -174,18 +229,14 @@ async fn rpxy_service_with_watcher( #[cfg(not(feature = "acme"))] /// Wrapper of entry point for rpxy service with certificate management service async fn rpxy_entrypoint( - proxy_config: &rpxy_lib::ProxyConfig, - app_config_list: &rpxy_lib::AppConfigList, - cert_service_and_rx: Option<&( - ReloaderService, - ReloaderReceiver, - )>, - runtime_handle: &tokio::runtime::Handle, - term_notify: Option>, + rpxy_opts: &RpxyOptions, + cert_service: Option<&ReloaderService>, + // runtime_handle: &tokio::runtime::Handle, ) -> Result<(), anyhow::Error> { - if let Some((cert_service, cert_rx)) = cert_service_and_rx { + // TODO: refactor: update routine + if let Some(cert_service) = cert_service { tokio::select! { - rpxy_res = entrypoint(proxy_config, app_config_list, Some(cert_rx), runtime_handle, term_notify) => { + rpxy_res = entrypoint(rpxy_opts) => { error!("rpxy entrypoint exited"); rpxy_res.map_err(|e| anyhow!(e)) } @@ -195,46 +246,49 @@ async fn rpxy_entrypoint( } } } else { - entrypoint(proxy_config, app_config_list, None, runtime_handle, term_notify) - .await - .map_err(|e| anyhow!(e)) + entrypoint(rpxy_opts).await.map_err(|e| anyhow!(e)) } } #[cfg(feature = "acme")] /// Wrapper of entry point for rpxy service with certificate management service async fn rpxy_entrypoint( - proxy_config: &rpxy_lib::ProxyConfig, - app_config_list: &rpxy_lib::AppConfigList, - cert_service_and_rx: Option<&( - ReloaderService, - ReloaderReceiver, - )>, - acme_manager: Option<&rpxy_acme::AcmeManager>, - runtime_handle: &tokio::runtime::Handle, - term_notify: Option>, + rpxy_opts: &RpxyOptions, + cert_service: Option<&ReloaderService>, + acme_task_handles: Vec>, + // runtime_handle: &tokio::runtime::Handle, ) -> Result<(), anyhow::Error> { - // TODO: remove later, reconsider routine - println!("ACME manager:\n{:#?}", acme_manager); - let x = acme_manager.unwrap().clone(); - let (handle, confs) = x.spawn_manager_tasks(); - tokio::spawn(async move { futures_util::future::select_all(handle).await }); - // TODO: - - if let Some((cert_service, cert_rx)) = cert_service_and_rx { - tokio::select! { - rpxy_res = entrypoint(proxy_config, app_config_list, Some(cert_rx), runtime_handle, term_notify) => { - error!("rpxy entrypoint exited"); - rpxy_res.map_err(|e| anyhow!(e)) + // TODO: refactor: update routine + if let Some(cert_service) = cert_service { + if acme_task_handles.is_empty() { + tokio::select! { + rpxy_res = entrypoint(rpxy_opts) => { + error!("rpxy entrypoint exited"); + rpxy_res.map_err(|e| anyhow!(e)) + } + cert_res = cert_service.start() => { + error!("cert reloader service exited"); + cert_res.map_err(|e| anyhow!(e)) + } } - cert_res = cert_service.start() => { - error!("cert reloader service exited"); - cert_res.map_err(|e| anyhow!(e)) + } else { + let select_all = futures_util::future::select_all(acme_task_handles); + tokio::select! { + rpxy_res = entrypoint(rpxy_opts) => { + error!("rpxy entrypoint exited"); + rpxy_res.map_err(|e| anyhow!(e)) + } + (acme_res, _, _) = select_all => { + error!("acme manager exited"); + acme_res.map_err(|e| anyhow!(e)) + } + cert_res = cert_service.start() => { + error!("cert reloader service exited"); + cert_res.map_err(|e| anyhow!(e)) + } } } } else { - entrypoint(proxy_config, app_config_list, None, runtime_handle, term_notify) - .await - .map_err(|e| anyhow!(e)) + entrypoint(rpxy_opts).await.map_err(|e| anyhow!(e)) } } diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml index 67f5a8d..a23e192 100644 --- a/rpxy-lib/Cargo.toml +++ b/rpxy-lib/Cargo.toml @@ -29,7 +29,7 @@ sticky-cookie = ["base64", "sha2", "chrono"] native-tls-backend = ["hyper-tls"] rustls-backend = ["hyper-rustls"] webpki-roots = ["rustls-backend", "hyper-rustls/webpki-tokio"] -acme = [] +acme = ["dep:rpxy-acme"] [dependencies] rand = "0.8.5" @@ -80,6 +80,9 @@ hot_reload = "0.1.6" rustls = { version = "0.23.11", default-features = false } tokio-rustls = { version = "0.26.0", features = ["early-data"] } +# acme +rpxy-acme = { path = "../rpxy-acme/", default-features = false, optional = true } + # logging tracing = { version = "0.1.40" } diff --git a/rpxy-lib/src/error.rs b/rpxy-lib/src/error.rs index 98ebf03..20470ed 100644 --- a/rpxy-lib/src/error.rs +++ b/rpxy-lib/src/error.rs @@ -105,4 +105,9 @@ pub enum RpxyError { // Others #[error("Infallible")] Infallible(#[from] std::convert::Infallible), + + /// No Acme server config for Acme challenge + #[cfg(feature = "acme")] + #[error("No Acme server config")] + NoAcmeServerConfig, } diff --git a/rpxy-lib/src/globals.rs b/rpxy-lib/src/globals.rs index fa19f78..8c5e093 100644 --- a/rpxy-lib/src/globals.rs +++ b/rpxy-lib/src/globals.rs @@ -16,6 +16,10 @@ pub struct Globals { pub term_notify: Option>, /// Shared context - Certificate reloader service receiver // TODO: newer one pub cert_reloader_rx: Option>, + + #[cfg(feature = "acme")] + /// ServerConfig used for only ACME challenge for ACME domains + pub server_configs_acme_challenge: Arc>>, } /// Configuration parameters for proxy transport and request handlers diff --git a/rpxy-lib/src/lib.rs b/rpxy-lib/src/lib.rs index ccb647e..9dd78da 100644 --- a/rpxy-lib/src/lib.rs +++ b/rpxy-lib/src/lib.rs @@ -30,13 +30,36 @@ pub mod reexports { pub use hyper::Uri; } +#[derive(derive_builder::Builder)] +/// rpxy entrypoint args +pub struct RpxyOptions { + /// Configuration parameters for proxy transport and request handlers + pub proxy_config: ProxyConfig, + /// List of application configurations + pub app_config_list: AppConfigList, + /// Certificate reloader service receiver + pub cert_rx: Option>, // TODO: + /// Async task runtime handler + pub runtime_handle: tokio::runtime::Handle, + /// Notify object to stop async tasks + pub term_notify: Option>, + + #[cfg(feature = "acme")] + /// ServerConfig used for only ACME challenge for ACME domains + pub server_configs_acme_challenge: Arc>>, +} + /// Entrypoint that creates and spawns tasks of reverse proxy services pub async fn entrypoint( - proxy_config: &ProxyConfig, - app_config_list: &AppConfigList, - cert_rx: Option<&ReloaderReceiver>, // TODO: - runtime_handle: &tokio::runtime::Handle, - term_notify: Option>, + RpxyOptions { + proxy_config, + app_config_list, + cert_rx, // TODO: + runtime_handle, + term_notify, + #[cfg(feature = "acme")] + server_configs_acme_challenge, + }: &RpxyOptions, ) -> RpxyResult<()> { #[cfg(all(feature = "http3-quinn", feature = "http3-s2n"))] warn!("Both \"http3-quinn\" and \"http3-s2n\" features are enabled. \"http3-quinn\" will be used"); @@ -85,7 +108,10 @@ pub async fn entrypoint( request_count: Default::default(), runtime_handle: runtime_handle.clone(), term_notify: term_notify.clone(), - cert_reloader_rx: cert_rx.cloned(), + cert_reloader_rx: cert_rx.clone(), + + #[cfg(feature = "acme")] + server_configs_acme_challenge: server_configs_acme_challenge.clone(), }); // 3. build message handler containing Arc-ed http_client and backends, and make it contained in Arc as well diff --git a/rpxy-lib/src/proxy/proxy_main.rs b/rpxy-lib/src/proxy/proxy_main.rs index 21b2c6b..e57a16f 100644 --- a/rpxy-lib/src/proxy/proxy_main.rs +++ b/rpxy-lib/src/proxy/proxy_main.rs @@ -167,6 +167,9 @@ where let mut server_crypto_map: Option> = None; loop { + #[cfg(feature = "acme")] + let server_configs_acme_challenge = self.globals.server_configs_acme_challenge.clone(); + select! { tcp_cnx = tcp_listener.accept().fuse() => { if tcp_cnx.is_err() || server_crypto_map.is_none() { @@ -190,11 +193,35 @@ where if server_name.is_none(){ return Err(RpxyError::NoServerNameInClientHello); } - let server_crypto = sc_map_inner.as_ref().unwrap().get(server_name.as_ref().unwrap()); - if server_crypto.is_none() { - return Err(RpxyError::NoTlsServingApp(server_name.as_ref().unwrap().try_into().unwrap_or_default())); - } - let stream = match start.into_stream(server_crypto.unwrap().clone()).await { + /* ------------------ */ + // Check for ACME TLS ALPN challenge + #[cfg(feature = "acme")] + let server_crypto = { + if rpxy_acme::reexports::is_tls_alpn_challenge(&client_hello) { + info!("ACME TLS ALPN challenge received"); + let Some(server_crypto_acme) = server_configs_acme_challenge.get(&sni.unwrap().to_ascii_lowercase()) else { + return Err(RpxyError::NoAcmeServerConfig); + }; + server_crypto_acme + } else { + let server_crypto = sc_map_inner.as_ref().unwrap().get(server_name.as_ref().unwrap()); + let Some(server_crypto) = server_crypto else { + return Err(RpxyError::NoTlsServingApp(server_name.as_ref().unwrap().try_into().unwrap_or_default())); + }; + server_crypto + } + }; + /* ------------------ */ + #[cfg(not(feature = "acme"))] + let server_crypto = { + let server_crypto = sc_map_inner.as_ref().unwrap().get(server_name.as_ref().unwrap()); + let Some(server_crypto) = server_crypto else { + return Err(RpxyError::NoTlsServingApp(server_name.as_ref().unwrap().try_into().unwrap_or_default())); + }; + server_crypto + }; + /* ------------------ */ + let stream = match start.into_stream(server_crypto.clone()).await { Ok(s) => TokioIo::new(s), Err(e) => { return Err(RpxyError::FailedToTlsHandshake(e.to_string())); From 23bc33bd6e37546534994e67fd5bbd42796ee59f Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Wed, 17 Jul 2024 20:55:31 +0900 Subject: [PATCH 10/16] bump --- Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Cargo.toml b/Cargo.toml index 68be1fe..01c0263 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,5 +1,5 @@ [workspace.package] -version = "0.8.1" +version = "0.9.0" authors = ["Jun Kurihara"] homepage = "https://github.com/junkurihara/rust-rpxy" repository = "https://github.com/junkurihara/rust-rpxy" From 597f3afd76db3cedecef14e0a8cdf7bba5556bb8 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Wed, 17 Jul 2024 21:07:19 +0900 Subject: [PATCH 11/16] update docker-compose --- docker/docker-compose-slim.yml | 1 + docker/docker-compose.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/docker/docker-compose-slim.yml b/docker/docker-compose-slim.yml index e02c20b..0337d20 100644 --- a/docker/docker-compose-slim.yml +++ b/docker/docker-compose-slim.yml @@ -31,6 +31,7 @@ services: volumes: - ./log:/rpxy/log:rw - ./cache:/rpxy/cache:rw + - ./acme_registry:/rpxy/acme_registry:rw - ../example-certs/server.crt:/certs/server.crt:ro - ../example-certs/server.key:/certs/server.key:ro - ../config-example.toml:/etc/rpxy.toml:ro diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml index 435dcb3..a8ad4af 100644 --- a/docker/docker-compose.yml +++ b/docker/docker-compose.yml @@ -31,6 +31,7 @@ services: volumes: - ./log:/rpxy/log:rw - ./cache:/rpxy/cache:rw + - ./acme_registry:/rpxy/acme_registry:rw - ../example-certs/server.crt:/certs/server.crt:ro - ../example-certs/server.key:/certs/server.key:ro - ../config-example.toml:/etc/rpxy.toml:ro From 28a6da9505b77ad20acfdc0c08327441eff66501 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Wed, 17 Jul 2024 21:41:23 +0900 Subject: [PATCH 12/16] feat: force TLS shutdown after TLS ALPN 01 challenge --- rpxy-lib/src/proxy/proxy_main.rs | 46 +++++++++++++++++++++++++++----- 1 file changed, 39 insertions(+), 7 deletions(-) diff --git a/rpxy-lib/src/proxy/proxy_main.rs b/rpxy-lib/src/proxy/proxy_main.rs index e57a16f..3690d35 100644 --- a/rpxy-lib/src/proxy/proxy_main.rs +++ b/rpxy-lib/src/proxy/proxy_main.rs @@ -193,6 +193,8 @@ where if server_name.is_none(){ return Err(RpxyError::NoServerNameInClientHello); } + #[cfg(feature = "acme")] + let mut is_handshake_acme = false; // for shutdown just after TLS handshake /* ------------------ */ // Check for ACME TLS ALPN challenge #[cfg(feature = "acme")] @@ -202,6 +204,7 @@ where let Some(server_crypto_acme) = server_configs_acme_challenge.get(&sni.unwrap().to_ascii_lowercase()) else { return Err(RpxyError::NoAcmeServerConfig); }; + is_handshake_acme = true; server_crypto_acme } else { let server_crypto = sc_map_inner.as_ref().unwrap().get(server_name.as_ref().unwrap()); @@ -227,7 +230,14 @@ where return Err(RpxyError::FailedToTlsHandshake(e.to_string())); } }; - Ok((stream, client_addr, server_name)) + #[cfg(feature = "acme")] + { + Ok((stream, client_addr, server_name, is_handshake_acme)) + } + #[cfg(not(feature="acme"))] + { + Ok((stream, client_addr, server_name)) + } }; self.globals.runtime_handle.spawn( async move { @@ -239,14 +249,36 @@ where error!("Timeout to handshake TLS"); return; }; - match v { - Ok((stream, client_addr, server_name)) => { - self_inner.serve_connection(stream, client_addr, server_name); - } - Err(e) => { - error!("{}", e); + /* ------------------ */ + #[cfg(feature = "acme")] + { + match v { + Ok((mut stream, client_addr, server_name, is_handshake_acme)) => { + if is_handshake_acme { + debug!("Shutdown TLS connection after ACME TLS ALPN challenge"); + use tokio::io::AsyncWriteExt; + stream.inner_mut().shutdown().await.ok(); + } + self_inner.serve_connection(stream, client_addr, server_name); + } + Err(e) => { + error!("{}", e); + } } } + /* ------------------ */ + #[cfg(not(feature = "acme"))] + { + match v { + Ok((stream, client_addr, server_name)) => { + self_inner.serve_connection(stream, client_addr, server_name); + } + Err(e) => { + error!("{}", e); + } + } + } + /* ------------------ */ }); } _ = server_crypto_rx.changed().fuse() => { From 9114c77a14c95d69493fb14b661a27bd37500558 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Thu, 18 Jul 2024 16:11:59 +0900 Subject: [PATCH 13/16] docs: typo --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index b825cd1..0b29149 100644 --- a/README.md +++ b/README.md @@ -10,11 +10,11 @@ ## Introduction -`rpxy` [ahr-pik-see] is an implementation of simple and lightweight reverse-proxy with some additional features. The implementation is based on [`hyper`](https://github.com/hyperium/hyper), [`rustls`](https://github.com/rustls/rustls) and [`tokio`](https://github.com/tokio-rs/tokio), i.e., written in Rust^[^pure_rust]. Our `rpxy` routes multiple host names to appropriate backend application servers while serving TLS connections. +`rpxy` [ahr-pik-see] is an implementation of simple and lightweight reverse-proxy with some additional features. The implementation is based on [`hyper`](https://github.com/hyperium/hyper), [`rustls`](https://github.com/rustls/rustls) and [`tokio`](https://github.com/tokio-rs/tokio), i.e., written in Rust [^pure_rust]. Our `rpxy` routes multiple host names to appropriate backend application servers while serving TLS connections. [^pure_rust]: Doubtfully can be claimed to be written in pure Rust since current `rpxy` is based on `aws-lc-rs` for cryptographic operations. - As default, `rpxy` provides the *TLS connection sanitization* by correctly binding a certificate used to establish a secure channel with the backend application. Specifically, it always keeps the consistency between the given SNI (server name indication) in `ClientHello` of the underlying TLS and the domain name given by the overlaid HTTP HOST header (or URL in Request line) [^1]. Additionally, as a somewhat unstable feature, our `rpxy` can handle the brand-new HTTP/3 connection thanks to [`quinn`](https://github.com/quinn-rs/quinn), [`s2n-quic`](https://github.com/aws/s2n-quic) and [`hyperium/h3`](https://github.com/hyperium/h3).[^h3lib] Furthermore, `rpxy` supports the automatic issuance and renewal of certificates via [TLS-ALPN-01 (RFC8737)](https://www.rfc-editor.org/rfc/rfc8737) of [ACME protocol (RFC8555)](https://www.rfc-editor.org/rfc/rfc8555) thanks to [`rustls-acme`](https://github.com/FlorianUekermann/rustls-acme). +By default, `rpxy` provides the *TLS connection sanitization* by correctly binding a certificate used to establish a secure channel with the backend application. Specifically, it always keeps the consistency between the given SNI (server name indication) in `ClientHello` of the underlying TLS and the domain name given by the overlaid HTTP HOST header (or URL in Request line) [^1]. Additionally, as a somewhat unstable feature, our `rpxy` can handle the brand-new HTTP/3 connection thanks to [`quinn`](https://github.com/quinn-rs/quinn), [`s2n-quic`](https://github.com/aws/s2n-quic) and [`hyperium/h3`](https://github.com/hyperium/h3).[^h3lib] Furthermore, `rpxy` supports the automatic issuance and renewal of certificates via [TLS-ALPN-01 (RFC8737)](https://www.rfc-editor.org/rfc/rfc8737) of [ACME protocol (RFC8555)](https://www.rfc-editor.org/rfc/rfc8555) thanks to [`rustls-acme`](https://github.com/FlorianUekermann/rustls-acme). [^h3lib]: HTTP/3 libraries are mutually exclusive. You need to explicitly specify `s2n-quic` with `--no-default-features` flag. Also note that if you build `rpxy` with `s2n-quic`, then it requires `openssl` just for building the package. From 3657a96955c113386cd2a7e60ef98f48153d6ce8 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Tue, 23 Jul 2024 13:55:35 +0900 Subject: [PATCH 14/16] deps: s2n-quic --- rpxy-acme/Cargo.toml | 4 ++-- rpxy-bin/Cargo.toml | 2 +- rpxy-certs/Cargo.toml | 4 ++-- rpxy-lib/Cargo.toml | 8 ++++---- submodules/s2n-quic-h3/Cargo.toml | 4 ++-- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml index 7adc8fd..331bbe2 100644 --- a/rpxy-acme/Cargo.toml +++ b/rpxy-acme/Cargo.toml @@ -13,11 +13,11 @@ publish.workspace = true [dependencies] url = { version = "2.5.2" } rustc-hash = "2.0.0" -thiserror = "1.0.62" +thiserror = "1.0.63" tracing = "0.1.40" async-trait = "0.1.81" base64 = "0.22.1" -aws-lc-rs = { version = "1.8.0", default-features = false, features = [ +aws-lc-rs = { version = "1.8.1", default-features = false, features = [ "aws-lc-sys", ] } blocking = "1.6.1" diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml index f330d9d..14db7b7 100644 --- a/rpxy-bin/Cargo.toml +++ b/rpxy-bin/Cargo.toml @@ -44,7 +44,7 @@ futures-util = { version = "0.3.30", default-features = false } # config clap = { version = "4.5.9", features = ["std", "cargo", "wrap_help"] } -toml = { version = "0.8.14", default-features = false, features = ["parse"] } +toml = { version = "0.8.15", default-features = false, features = ["parse"] } hot_reload = "0.1.6" # logging diff --git a/rpxy-certs/Cargo.toml b/rpxy-certs/Cargo.toml index 238c909..9f64b7c 100644 --- a/rpxy-certs/Cargo.toml +++ b/rpxy-certs/Cargo.toml @@ -18,7 +18,7 @@ http3 = [] rustc-hash = { version = "2.0.0" } tracing = { version = "0.1.40" } derive_builder = { version = "0.20.0" } -thiserror = { version = "1.0.62" } +thiserror = { version = "1.0.63" } hot_reload = { version = "0.1.6" } async-trait = { version = "0.1.81" } rustls = { version = "0.23.11", default-features = false, features = [ @@ -26,7 +26,7 @@ rustls = { version = "0.23.11", default-features = false, features = [ "aws_lc_rs", ] } rustls-pemfile = { version = "2.1.2" } -rustls-webpki = { version = "0.102.5", default-features = false, features = [ +rustls-webpki = { version = "0.102.6", default-features = false, features = [ "std", "aws_lc_rs", ] } diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml index a23e192..f996ab7 100644 --- a/rpxy-lib/Cargo.toml +++ b/rpxy-lib/Cargo.toml @@ -50,7 +50,7 @@ async-trait = "0.1.81" # Error handling anyhow = "1.0.86" -thiserror = "1.0.62" +thiserror = "1.0.63" # http for both server and client http = "1.1.0" @@ -93,11 +93,11 @@ h3-quinn = { version = "0.0.7", optional = true } s2n-quic-h3 = { path = "../submodules/s2n-quic-h3/", features = [ "tracing", ], optional = true } -s2n-quic = { version = "1.42.0", default-features = false, features = [ +s2n-quic = { version = "1.43.0", default-features = false, features = [ "provider-tls-rustls", ], optional = true } -s2n-quic-core = { version = "0.42.0", default-features = false, optional = true } -s2n-quic-rustls = { version = "0.42.0", optional = true } +s2n-quic-core = { version = "0.43.0", default-features = false, optional = true } +s2n-quic-rustls = { version = "0.43.0", optional = true } ########## # for UDP socket wit SO_REUSEADDR when h3 with quinn socket2 = { version = "0.5.7", features = ["all"], optional = true } diff --git a/submodules/s2n-quic-h3/Cargo.toml b/submodules/s2n-quic-h3/Cargo.toml index 4a0c725..b445924 100644 --- a/submodules/s2n-quic-h3/Cargo.toml +++ b/submodules/s2n-quic-h3/Cargo.toml @@ -15,8 +15,8 @@ futures = { version = "0.3", default-features = false } h3 = { version = "0.0.6", features = ["tracing"] } # s2n-quic = { path = "../s2n-quic" } # s2n-quic-core = { path = "../s2n-quic-core" } -s2n-quic = { version = "1.42.0" } -s2n-quic-core = { version = "0.42.0" } +s2n-quic = { version = "1.43.0" } +s2n-quic-core = { version = "0.43.0" } tracing = { version = "0.1.40", optional = true } [features] From 2dd2d41edd792a202d4fad448d3b6dde9ba1184b Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Wed, 24 Jul 2024 00:46:49 +0900 Subject: [PATCH 15/16] deps: rustls --- rpxy-acme/Cargo.toml | 4 ++-- rpxy-bin/Cargo.toml | 4 ++-- rpxy-certs/Cargo.toml | 4 ++-- rpxy-lib/Cargo.toml | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/rpxy-acme/Cargo.toml b/rpxy-acme/Cargo.toml index 331bbe2..9775749 100644 --- a/rpxy-acme/Cargo.toml +++ b/rpxy-acme/Cargo.toml @@ -21,7 +21,7 @@ aws-lc-rs = { version = "1.8.1", default-features = false, features = [ "aws-lc-sys", ] } blocking = "1.6.1" -rustls = { version = "0.23.11", default-features = false, features = [ +rustls = { version = "0.23.12", default-features = false, features = [ "std", "aws_lc_rs", ] } @@ -29,5 +29,5 @@ rustls-platform-verifier = { version = "0.3.2" } rustls-acme = { path = "../submodules/rustls-acme/", default-features = false, features = [ "aws-lc-rs", ] } -tokio = { version = "1.38.1", default-features = false } +tokio = { version = "1.39.0", default-features = false } tokio-stream = { version = "0.1.15", default-features = false } diff --git a/rpxy-bin/Cargo.toml b/rpxy-bin/Cargo.toml index 14db7b7..3a03f8e 100644 --- a/rpxy-bin/Cargo.toml +++ b/rpxy-bin/Cargo.toml @@ -32,7 +32,7 @@ mimalloc = { version = "*", default-features = false } anyhow = "1.0.86" rustc-hash = "2.0.0" serde = { version = "1.0.204", default-features = false, features = ["derive"] } -tokio = { version = "1.38.1", default-features = false, features = [ +tokio = { version = "1.39.0", default-features = false, features = [ "net", "rt-multi-thread", "time", @@ -43,7 +43,7 @@ async-trait = "0.1.81" futures-util = { version = "0.3.30", default-features = false } # config -clap = { version = "4.5.9", features = ["std", "cargo", "wrap_help"] } +clap = { version = "4.5.10", features = ["std", "cargo", "wrap_help"] } toml = { version = "0.8.15", default-features = false, features = ["parse"] } hot_reload = "0.1.6" diff --git a/rpxy-certs/Cargo.toml b/rpxy-certs/Cargo.toml index 9f64b7c..08e1ebf 100644 --- a/rpxy-certs/Cargo.toml +++ b/rpxy-certs/Cargo.toml @@ -21,7 +21,7 @@ derive_builder = { version = "0.20.0" } thiserror = { version = "1.0.63" } hot_reload = { version = "0.1.6" } async-trait = { version = "0.1.81" } -rustls = { version = "0.23.11", default-features = false, features = [ +rustls = { version = "0.23.12", default-features = false, features = [ "std", "aws_lc_rs", ] } @@ -33,7 +33,7 @@ rustls-webpki = { version = "0.102.6", default-features = false, features = [ x509-parser = { version = "0.16.0" } [dev-dependencies] -tokio = { version = "1.38.1", default-features = false, features = [ +tokio = { version = "1.39.0", default-features = false, features = [ "rt-multi-thread", "macros", ] } diff --git a/rpxy-lib/Cargo.toml b/rpxy-lib/Cargo.toml index f996ab7..6aeb624 100644 --- a/rpxy-lib/Cargo.toml +++ b/rpxy-lib/Cargo.toml @@ -37,7 +37,7 @@ rustc-hash = "2.0.0" bytes = "1.6.1" derive_builder = "0.20.0" futures = { version = "0.3.30", features = ["alloc", "async-await"] } -tokio = { version = "1.38.1", default-features = false, features = [ +tokio = { version = "1.39.0", default-features = false, features = [ "net", "rt-multi-thread", "time", @@ -77,7 +77,7 @@ hyper-rustls = { git = "https://github.com/junkurihara/hyper-rustls", branch = " # tls and cert management for server rpxy-certs = { path = "../rpxy-certs/", default-features = false } hot_reload = "0.1.6" -rustls = { version = "0.23.11", default-features = false } +rustls = { version = "0.23.12", default-features = false } tokio-rustls = { version = "0.26.0", features = ["early-data"] } # acme From 52abed973f4ffb8acace2dc57975d98754b003c2 Mon Sep 17 00:00:00 2001 From: Jun Kurihara Date: Wed, 24 Jul 2024 01:18:35 +0900 Subject: [PATCH 16/16] 0.9.0-alpha.1 --- CHANGELOG.md | 4 +++- Cargo.toml | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4302a58..30a9254 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,8 @@ # CHANGELOG -## 0.9.0 (Unreleased) +## 0.10.0 (Unreleased) + +## 0.9.0 ### Important Changes diff --git a/Cargo.toml b/Cargo.toml index 01c0263..e990fdf 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,5 +1,5 @@ [workspace.package] -version = "0.9.0" +version = "0.9.0-alpha.1" authors = ["Jun Kurihara"] homepage = "https://github.com/junkurihara/rust-rpxy" repository = "https://github.com/junkurihara/rust-rpxy"