summaryrefslogtreecommitdiff
path: root/modules/caddyhttp/reverseproxy
AgeCommit message (Collapse)Author
2022-09-02fastcgi: allow users to log stderr output (#4967) (#5004)fleandro
Co-authored-by: flga <flga@users.noreply.github.com>
2022-08-31events: Implement event system (#4912)Francis Lavoie
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2022-08-29Minor cleanup, resolve a couple lint warningsMatthew Holt
2022-08-27Remove duplicate words in comments (#4986)Abirdcfly
2022-08-27reverseproxy: Add upstreams healthy metrics (#4935)Dávid Szabó
2022-08-25reverseproxy: Multiple dynamic upstreamsMatthew Holt
This allows users to, for example, get upstreams from multiple SRV endpoints in order (such as primary and secondary clusters). Also, gofmt went to town on the comments, sigh
2022-08-17core: Change net.IP to netip.Addr; use netip.Prefix (#4966)WilczyńskiT
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2022-08-12reverseproxy: Add `unix+h2c` Caddyfile network shortcut (#4953)Francis Lavoie
2022-08-12reverseproxy: Ignore context cancel in stream mode (#4952)Matt Holt
2022-08-12reverseproxy: Fix H2C dialer using new stdlib `DialTLSContext` (#4951)Francis Lavoie
2022-08-09reverseproxy: Support 1xx status codes (HTTP early hints) (#4882)Kévin Dunglas
2022-08-06Replace strings.Index with strings.Cut (#4932)Chirag Maheshwari
2022-08-04Replace strings.Index usages with strings.Cut (#4930)WilczyńskiT
2022-08-04cmd: Use newly-available version information (#4931)Matt Holt
2022-08-02chore: Bump up to Go 1.19, minimum 1.18 (#4925)Francis Lavoie
2022-08-01caddyhttp: Implement `caddy respond` command (#4870)Matt Holt
2022-07-28Ignore linter warningsMatthew Holt
Use of non-cryptographic random numbers in the load balancing is intentional.
2022-07-23reverseproxy: Implement read & write timeouts for HTTP transport (#4905)Matt Holt
2022-07-13reverseproxy: Implement retry count, alternative to try_duration (#4756)Francis Lavoie
* reverseproxy: Implement retry count, alternative to try_duration * Add Caddyfile support for `retry_match` * Refactor to deduplicate matcher parsing logic * Fix lint
2022-07-13reverseproxy: Export SetScheme() againMatthew Holt
Turns out the NTLM transport uses it. Oops.
2022-07-08reverseproxy: Err 503 if all upstreams unavailableMatthew Holt
2022-07-08reverseproxy: Adjust new TLS Caddyfile directive names (#4872)Francis Lavoie
2022-06-28forwardauth: Fix case when `copy_headers` is omitted (#4856)Francis Lavoie
See https://caddy.community/t/using-forward-auth-and-writing-my-own-authenticator-in-php/16410, apparently it didn't work when `copy_headers` wasn't used. This is because we were skipping adding a handler to the routes in the "good response handler", but this causes the logic in `reverseproxy.go` to ignore the response handler since it's empty. Instead, we can just always put in the `header` handler, even with an empty `Set` operation, it's just a no-op, but it fixes that condition in the proxy code.
2022-06-22reverseproxy: Fix double headers in response handlers (#4847)Francis Lavoie
2022-06-22reverseproxy: Fix panic when TLS is not configured (#4848)Francis Lavoie
* reverseproxy: Fix panic when TLS is not configured * Refactor and simplify setScheme Co-authored-by: Matthew Holt <mholt@users.noreply.github.com>
2022-06-20reverseproxy: Skip TLS for certain configured ports (#4843)Kiss Károly Pál
* Make reverse proxy TLS server name replaceable for SNI upstreams. * Reverted previous TLS server name replacement, and implemented thread safe version. * Move TLS servername replacement into it's own function * Moved SNI servername replacement into httptransport. * Solve issue when dynamic upstreams use wrong protocol upstream. * Revert previous commit. Old commit was: Solve issue when dynamic upstreams use wrong protocol upstream. Id: 3c9806ccb63e66bdcac8e1ed4520c9d135cb011d * Added SkipTLSPorts option to http transport. * Fix typo in test config file. * Rename config option as suggested by Matt Co-authored-by: Matt Holt <mholt@users.noreply.github.com> * Update code to match renamed config option. * Fix typo in config option name. * Fix another typo that I missed. * Tests not completing because of apparent wrong ordering of options. Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2022-06-16forwardauth: Support renaming copied headers, block support (#4783)Francis Lavoie
2022-06-14reverseproxy: Dynamic ServerName for TLS upstreams (#4836)Kiss Károly Pál
* Make reverse proxy TLS server name replaceable for SNI upstreams. * Reverted previous TLS server name replacement, and implemented thread safe version. * Move TLS servername replacement into it's own function * Moved SNI servername replacement into httptransport. * Solve issue when dynamic upstreams use wrong protocol upstream. * Revert previous commit. Old commit was: Solve issue when dynamic upstreams use wrong protocol upstream. Id: 3c9806ccb63e66bdcac8e1ed4520c9d135cb011d Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2022-06-14reverseproxy: Make TLS renegotiation optionalMatthew Holt
2022-06-10reverseproxy: Add renegotiation param in TLS client (#4784)Yaacov Akiba Slama
* Add renegotiation option in reverseproxy tls client * Update modules/caddyhttp/reverseproxy/httptransport.go Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2022-06-06reverseproxy: Correct the `tls_server_name` docs (#4827)Francis Lavoie
* reverseproxy: Correct the `tls_server_name` docs * Update modules/caddyhttp/reverseproxy/httptransport.go Co-authored-by: Matt Holt <mholt@users.noreply.github.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2022-06-03reverseproxy: HTTP 504 for upstream timeouts (#4824)Matt Holt
Closes #4823
2022-06-02reverseproxy: api: Remove misleading 'healthy' valueMatthew Holt
In v2.5.0, upstream health was fixed such that whether an upstream is considered healthy or not is mostly up to each individual handler's config. Since "healthy" is an opinion, it is not a global value. I unintentionally left in the "healthy" field in the API endpoint for checking upstreams, and it is now misleading (see #4792). However, num_requests and fails remains, so health can be determined by the API client, rather than having it be opaquely (and unhelpfully) determined for the client. If we do restore this value later on, it'd need to be replicated once per reverse_proxy handler according to their individual configs.
2022-05-29reverseproxy: Add --internal-certs CLI flag #3589 (#4817)Alexander M
added flag --internal-certs when set, for non-local domains the internal CA will be used for cert generation
2022-05-10reverseproxy: Support http1.1>h2c (close #4777) (#4778)Matt Holt
2022-05-06reverseproxy: Support performing pre-check requests (#4739)Francis Lavoie
2022-05-04reverseproxy: Permit resolver addresses to not specify a port (#4760)Francis Lavoie
Context: https://caddy.community/t/caddy-2-5-dynamic-upstreams-and-consul-srv-dns/15839 I realized it probably makes sense to allow `:53` to be omitted, since it's the default port for DNS.
2022-05-02reverseproxy: Fix Caddyfile support for `replace_status` (#4754)Francis Lavoie
2022-04-27reverseproxy: Improve hashing LB policies with HRW (#4724)Matt Holt
* reverseproxy: Improve hashing LB policies with HRW Previously, if a list of upstreams changed, hash-based LB policies would be greatly affected because the hash relied on the position of upstreams in the pool. Highest Random Weight or "rendezvous" hashing is apparently robust to pool changes. It runs in O(n) instead of O(log n), but n is very small usually. * Fix bug and update tests
2022-04-25httpcaddyfile: Deprecate paths in site addresses; use zap logs (#4728)Francis Lavoie
2022-04-11reverseproxy: Add `_ms` placeholders for proxy durations (#4666)Francis Lavoie
* reverseproxy: Add `_ms` placeholders for proxy durations * Add http.request.duration_ms Also add comments, and change duration_sec to duration_ms * Add response.duration_ms for consistency * Add missing godoc comment Co-authored-by: Matthew Holt <mholt@users.noreply.github.com>
2022-04-11reverseproxy: Sync up `handleUpgradeResponse` with stdlib (#4664)Francis Lavoie
* reverseproxy: Sync up `handleUpgradeResponse` with stdlib I had left this as a TODO for when we bump to minimum 1.17, but I should've realized it was under `internal` so it couldn't be used directly. Copied the functions we needed for parity. Hopefully this is ok! * Add tests and fix godoc comments Co-authored-by: Matthew Holt <mholt@users.noreply.github.com>
2022-03-24reverseproxy: Include port in A upstreams cacheMatthew Holt
Should fix #4659
2022-03-21reverseproxy: Don't clear name in SRV upstreamsMatthew Holt
Fix for dc4d147388547515f77447d594024386b732e7d4
2022-03-18reverseproxy: Expand SRV/A addrs for cache keyMatthew Holt
Hopefully fix #4645
2022-03-13chore: Comment fixes (#4634)Francis Lavoie
2022-03-09reverseproxy: copy_response and copy_response_headers for handle_response ↵Francis Lavoie
routes (#4391) * reverseproxy: New `copy_response` handler for `handle_response` routes Followup to #4298 and #4388. This adds a new `copy_response` handler which may only be used in `reverse_proxy`'s `handle_response` routes, which can be used to actually copy the proxy response downstream. Previously, if `handle_response` was used (with routes, not the status code mode), it was impossible to use the upstream's response body at all, because we would always close the body, expecting the routes to write a new body from scratch. To implement this, I had to refactor `h.reverseProxy()` to move all the code that came after the `HandleResponse` loop into a new function. This new function `h.finalizeResponse()` takes care of preparing the response by removing extra headers, dealing with trailers, then copying the headers and body downstream. Since basically what we want `copy_response` to do is invoke `h.finalizeResponse()` at a configurable point in time, we need to pass down the proxy handler, the response, and some other state via a new `req.WithContext(ctx)`. Wrapping a new context is pretty much the only way we have to jump a few layers in the HTTP middleware chain and let a handler pick up this information. Feels a bit dirty, but it works. Also fixed a bug with the `http.reverse_proxy.upstream.duration` placeholder, it always had the same duration as `http.reverse_proxy.upstream.latency`, but the former was meant to be the time taken for the roundtrip _plus_ copying/writing the response. * Delete the "Content-Length" header if we aren't copying Fixes a bug where the Content-Length will mismatch the actual bytes written if we skipped copying the response, so we get a message like this when using curl: ``` curl: (18) transfer closed with 18 bytes remaining to read ``` To replicate: ``` { admin off debug } :8881 { reverse_proxy 127.0.0.1:8882 { @200 status 200 handle_response @200 { header Foo bar } } } :8882 { header Content-Type application/json respond `{"hello": "world"}` 200 } ``` * Implement `copy_response_headers`, with include/exclude list support * Apply suggestions from code review Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2022-03-07fastcgi: Protect against requests with null bytes in the path (#4614)Francis Lavoie
2022-03-06reverseproxy: Dynamic upstreams (with SRV and A/AAAA support) (#4470)Matt Holt
* reverseproxy: Begin refactor to enable dynamic upstreams Streamed here: https://www.youtube.com/watch?v=hj7yzXb11jU * Implement SRV and A/AAA upstream sources Also get upstreams at every retry loop iteration instead of just once before the loop. See #4442. * Minor tweaks from review * Limit size of upstreams caches * Add doc notes deprecating LookupSRV * Provision dynamic upstreams Still WIP, preparing to preserve health checker functionality * Rejigger health checks Move active health check results into handler-specific Upstreams. Improve documentation regarding health checks and upstreams. * Deprecation notice * Add Caddyfile support, use `caddy.Duration` * Interface guards * Implement custom resolvers, add resolvers to http transport Caddyfile * SRV: fix Caddyfile `name` inline arg, remove proto condition * Use pointer receiver * Add debug logs Co-authored-by: Francis Lavoie <lavofr@gmail.com>
2022-03-06reverseproxy: Implement trusted proxies for `X-Forwarded-*` headers (#4507)Francis Lavoie