Niko/forwardproxy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix some of the gosec/golangci-lint issues

Browse source
This commit is contained in:
Juan Calderon-Perez 2023-06-25 00:50:44 -04:00
parent 5b23d1a2af
commit da96a33f48
3 changed files with 29 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
caddyfile.go
View file

@ -5,7 +5,7 @@ import (
"strconv"
"strings"
"github.com/caddyserver/caddy/v2"
caddy "github.com/caddyserver/caddy/v2"
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
"github.com/caddyserver/caddy/v2/caddyconfig/httpcaddyfile"
"github.com/caddyserver/caddy/v2/modules/caddyhttp"

20
forwardproxy.go
View file

@ -30,12 +30,13 @@ import (
"net/http"
"net/url"
"os"
"path/filepath"
"strconv"
"strings"
"sync"
"time"
"github.com/caddyserver/caddy/v2"
caddy "github.com/caddyserver/caddy/v2"
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
"github.com/caddyserver/caddy/v2/modules/caddyhttp"
"github.com/caddyserver/forwardproxy/httpclient"
@ -197,7 +198,7 @@ func (h *Handler) Provision(ctx caddy.Context) error {
// either way, it's impossible to have a legit TLS certificate for "127.0.0.1" - TODO: not true anymore
h.logger.Info("Localhost upstream detected, disabling verification of TLS certificate")
d.DialTLS = func(network string, address string) (net.Conn, string, error) {
conn, err := tls.Dial(network, address, &tls.Config{InsecureSkipVerify: true})
conn, err := tls.Dial(network, address, &tls.Config{InsecureSkipVerify: true}) // #nosec G402
if err != nil {
return nil, "", err
}
@ -393,7 +394,7 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyht
fmt.Errorf("failed to read upstream response: %v", err))
}
}
r.Body.Close()
err = r.Body.Close()
if response != nil {
defer response.Body.Close()
@ -547,10 +548,10 @@ func serveHiddenPage(w http.ResponseWriter, authErr error) error {
if authErr != nil {
w.Header().Set("Proxy-Authenticate", "Basic realm=\"Caddy Secure Web Proxy\"")
w.WriteHeader(http.StatusProxyAuthRequired)
w.Write([]byte(fmt.Sprintf(hiddenPage, AuthFail)))
_, _ = w.Write([]byte(fmt.Sprintf(hiddenPage, AuthFail)))
return authErr
}
w.Write([]byte(fmt.Sprintf(hiddenPage, AuthOk)))
_, _ = w.Write([]byte(fmt.Sprintf(hiddenPage, AuthOk)))
return nil
}
@ -576,7 +577,8 @@ func serveHijack(w http.ResponseWriter, targetConn net.Conn) error {
if err != nil {
return caddyhttp.Error(http.StatusBadGateway, err)
}
targetConn.Write(rbuf)
_, _ = targetConn.Write(rbuf)
}
}
// Since we hijacked the connection, we lost the ability to write and flush headers via w.
@ -615,8 +617,9 @@ func dualStream(target net.Conn, clientReader io.ReadCloser, clientWriter io.Wri
buf = buf[0:cap(buf)]
_, _err := flushingIoCopy(w, r, buf)
bufferPool.Put(buf)
if cw, ok := w.(closeWriter); ok {
cw.CloseWrite()
_ = cw.CloseWrite()
}
return _err
}
@ -736,7 +739,8 @@ type ProbeResistance struct {
}
func readLinesFromFile(filename string) ([]string, error) {
file, err := os.Open(filename)
cleanFilename := filepath.Clean(filename)
file, err := os.Open(cleanFilename)
if err != nil {
return nil, err
}

26
httpclient/httpclient.go
View file

@ -132,12 +132,12 @@ func (c *HTTPConnectDialer) DialContext(ctx context.Context, network, address st
resp, err := h2clientConn.RoundTrip(req)
if err != nil {
rawConn.Close()
err = rawConn.Close()
return nil, err
}
if resp.StatusCode != http.StatusOK {
rawConn.Close()
_ = rawConn.Close()
return nil, errors.New("Proxy responded with non 200 code: " + resp.Status)
}
return NewHttp2Conn(rawConn, pw, resp.Body), nil
@ -150,18 +150,18 @@ func (c *HTTPConnectDialer) DialContext(ctx context.Context, network, address st
err := req.Write(rawConn)
if err != nil {
rawConn.Close()
err = rawConn.Close()
return nil, err
}
resp, err := http.ReadResponse(bufio.NewReader(rawConn), req)
if err != nil {
rawConn.Close()
err = rawConn.Close()
return nil, err
}
if resp.StatusCode != http.StatusOK {
rawConn.Close()
_ = rawConn.Close()
return nil, errors.New("Proxy responded with non 200 code: " + resp.Status)
}
return rawConn, nil
@ -207,6 +207,7 @@ func (c *HTTPConnectDialer) DialContext(ctx context.Context, network, address st
tlsConf := tls.Config{
NextProtos: []string{"h2", "http/1.1"},
ServerName: c.ProxyURL.Hostname(),
MinVersion: tls.VersionTLS12,
}
tlsConn, err := tls.Dial(network, c.ProxyURL.Host, &tlsConf)
if err != nil {
@ -232,13 +233,13 @@ func (c *HTTPConnectDialer) DialContext(ctx context.Context, network, address st
t := http2.Transport{}
h2clientConn, err := t.NewClientConn(rawConn)
if err != nil {
rawConn.Close()
err = rawConn.Close()
return nil, err
}
proxyConn, err := connectHttp2(rawConn, h2clientConn)
if err != nil {
rawConn.Close()
err = rawConn.Close()
return nil, err
}
if c.EnableH2ConnReuse {
@ -249,7 +250,7 @@ func (c *HTTPConnectDialer) DialContext(ctx context.Context, network, address st
}
return proxyConn, err
default:
rawConn.Close()
_ = rawConn.Close()
return nil, errors.New("negotiated unsupported application layer protocol: " +
negotiatedProtocol)
}
@ -274,8 +275,13 @@ func (h *http2Conn) Write(p []byte) (n int, err error) {
}
func (h *http2Conn) Close() error {
h.in.Close()
return h.out.Close()
inErr := h.in.Close()
outErr := h.out.Close()
if inErr != nil {
return inErr
}
return outErr
}
func (h *http2Conn) CloseConn() error {