Niko/forwardproxy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update dependencies, add support for Github Actions. Formatting and lint fixes

Browse source
This commit is contained in:
Juan Calderon-Perez 2023-06-24 23:55:53 -04:00
parent 8b5d75a979
commit df7dc9533d
15 changed files with 445 additions and 877 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
.github/dependabot.yml vendored Normal file
View file

@ -0,0 +1,14 @@
version: 2
updates:
- package-ecosystem: "gomod"
directory: "/"
schedule:
interval: "daily"
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "daily"
- package-ecosystem: "docker"
directory: "/"
schedule:
interval: "daily"

25
.github/workflows/golangci-lint.yml vendored Normal file
View file

@ -0,0 +1,25 @@
name: Golangci Lint Check
on:
push:
branches:
- "master"
- "main"
paths-ignore:
- "**.md"
pull_request:
branches:
- "*"
paths-ignore:
- "**.md"
jobs:
golangci-lint:
runs-on: ubuntu-latest
steps:
- name: Fetch Repository
uses: actions/checkout@v3
- name: Run golangci-lint
uses: reviewdog/action-golangci-lint@v2
with:
golangci_lint_flags: "--tests=false"

34
.github/workflows/gosec.yml vendored Normal file
View file

@ -0,0 +1,34 @@
name: Gosec Security Scan
on:
push:
branches:
- "master"
- "main"
paths-ignore:
- "**.md"
pull_request:
branches:
- "*"
paths-ignore:
- "**.md"
jobs:
gosec-scan:
runs-on: ubuntu-latest
env:
GO111MODULE: on
steps:
- name: Fetch Repository
uses: actions/checkout@v3
- name: Install Go
uses: actions/setup-go@v4
with:
go-version: 'stable'
check-latest: true
cache: false
- name: Install Gosec
run: go install github.com/securego/gosec/v2/cmd/gosec@latest
- name: Run Gosec (root)
working-directory: .
run: go sec ./...

33
.github/workflows/govulncheck.yml vendored Normal file
View file

@ -0,0 +1,33 @@
name: Govulncheck Security Scan
on:
push:
branches:
- "master"
- "main"
paths-ignore:
- "**.md"
pull_request:
branches:
- "*"
paths-ignore:
- "**.md"
jobs:
govulncheck-check:
runs-on: ubuntu-latest
env:
GO111MODULE: on
steps:
- name: Fetch Repository
uses: actions/checkout@v3
- name: Install Go
uses: actions/setup-go@v4
with:
go-version: 'stable'
check-latest: true
cache: false
- name: Install Govulncheck
run: go install golang.org/x/vuln/cmd/govulncheck@latest
- name: Run Govulncheck
run: govulncheck ./...

40
.github/workflows/tests.yml vendored Normal file
View file

@ -0,0 +1,40 @@
name: "Tests"
on:
push:
branches:
- "master"
- "main"
paths-ignore:
- "**.md"
pull_request:
branches:
- "*"
paths-ignore:
- "**.md"
jobs:
Tests:
strategy:
matrix:
go-version:
- oldstable
- stable
platform:
- ubuntu-latest
- windows-latest
- macos-latest
runs-on: ${{ matrix.platform }}
steps:
- name: Fetch Repository
uses: actions/checkout@v3
- name: Install Go
uses: actions/setup-go@v4
with:
go-version: '${{ matrix.go-version }}'
- name: Run go vet
run: go vet ./...
- name: Run test
run: go test -v ./...
- name: Run test -race
run: go test -v -race ./...

4
.golangci.yml
View file

@ -1,4 +0,0 @@
# golangci linter currently requires a config file to
# disable checking of the test files
run:
tests: false

16
.travis.yml
View file

@ -1,16 +0,0 @@
language: go
go:
- 1.15.x
env:
- GO111MODULE=on
dist: trusty
install:
- go get -v -t -d ./...
- go get -v github.com/golangci/golangci-lint/cmd/golangci-lint
script:
- go test -race -v .
- golangci-lint run -E gofmt -E goimports -E misspell -E ineffassign -E staticcheck -E gosimple -D errcheck

6
acl.go
View file

@ -37,7 +37,6 @@ func (a *aclIPRule) tryMatch(ip net.IP, domain string) aclDecision {
return aclDecisionAllow
}
return aclDecisionDeny
}
type aclDomainRule struct {
@ -47,9 +46,8 @@ type aclDomainRule struct {
}
func (a *aclDomainRule) tryMatch(ip net.IP, domain string) aclDecision {
if strings.HasSuffix(domain, ".") {
domain = domain[:len(domain)-1]
}
domain = strings.TrimPrefix(domain, ".")
if domain == a.domain ||
a.subdomainsAllowed && strings.HasSuffix(domain, "."+a.domain) {
if a.allow {

40
common_test.go
View file

@ -7,7 +7,6 @@ import (
"encoding/json"
"fmt"
"io"
"io/ioutil"
"net"
"net/http"
"net/http/httputil"
@ -24,11 +23,12 @@ import (
"github.com/caddyserver/caddy/v2/modules/caddytls"
)
var credentialsEmpty = ""
var credentialsCorrectPlain = "test:pass"
var credentialsCorrect = "Basic dGVzdDpwYXNz" // test:pass
var credentialsUpstreamCorrect = "basic dXBzdHJlYW10ZXN0OnVwc3RyZWFtcGFzcw==" // upstreamtest:upstreampass
var credentialsWrong = []string{
var (
credentialsEmpty = ""
credentialsCorrectPlain = "test:pass"
credentialsCorrect = "Basic dGVzdDpwYXNz" // test:pass
credentialsUpstreamCorrect = "basic dXBzdHJlYW10ZXN0OnVwc3RyZWFtcGFzcw==" // upstreamtest:upstreampass
credentialsWrong = []string{
"",
"\"\"",
"Basic dzp3",
@ -36,7 +36,8 @@ var credentialsWrong = []string{
"Foo bar",
"Tssssssss",
"Basic dpz3 asp",
}
}
)
/*
Test naming: Test{httpVer}Proxy{Method}{Auth}{Credentials}{httpVer}
@ -44,17 +45,21 @@ GET/CONNECT -- get gets, connect connects and gets
Auth/NoAuth
Empty/Correct/Wrong -- tries different credentials
*/
var testResources = []string{"/", "/pic.png"}
var testHTTPProxyVersions = []string{"HTTP/2.0", "HTTP/1.1"}
var testHTTPTargetVersions = []string{"HTTP/1.1"}
var httpVersionToALPN = map[string]string{
var (
testResources = []string{"/", "/pic.png"}
testHTTPProxyVersions = []string{"HTTP/2.0", "HTTP/1.1"}
testHTTPTargetVersions = []string{"HTTP/1.1"}
httpVersionToALPN = map[string]string{
"HTTP/1.1": "http/1.1",
"HTTP/2.0": "h2",
}
}
)
var blacklistedDomain = "google-public-dns-a.google.com" // supposed to ever resolve to one of 2 IP addresses below
var blacklistedIPv4 = "8.8.8.8"
var blacklistedIPv6 = "2001:4860:4860::8888"
var (
blacklistedDomain = "google-public-dns-a.google.com" // supposed to ever resolve to one of 2 IP addresses below
blacklistedIPv4 = "8.8.8.8"
blacklistedIPv6 = "2001:4860:4860::8888"
)
type caddyTestServer struct {
addr string
@ -143,14 +148,14 @@ func (c *caddyTestServer) server() *caddyhttp.Server {
if c.contents == nil {
c.contents = make(map[string][]byte)
}
index, err := ioutil.ReadFile(c.root + "/index.html")
index, err := os.ReadFile(c.root + "/index.html")
if err != nil {
panic(err)
}
c.contents[""] = index
c.contents["/"] = index
c.contents["/index.html"] = index
c.contents["/pic.png"], err = ioutil.ReadFile(c.root + "/pic.png")
c.contents["/pic.png"], err = os.ReadFile(c.root + "/pic.png")
if err != nil {
panic(err)
}
@ -159,6 +164,7 @@ func (c *caddyTestServer) server() *caddyhttp.Server {
}
// For simulating/mimicing Caddy's built-in auto-HTTPS redirects. Super hacky but w/e.
func (c *caddyTestServer) redirServer() *caddyhttp.Server {
return &caddyhttp.Server{
Listen: []string{":" + c.httpRedirPort},

2
docker-build/Dockerfile
View file

@ -1,4 +1,4 @@
FROM alpine:3.6
FROM alpine:3.18.2
LABEL description="Docker image for caddy+forwardproxy plugin."
LABEL maintainer="SergeyFrolov@colorado.edu"

14
forwardproxy.go
View file

@ -26,7 +26,6 @@ import (
"errors"
"fmt"
"io"
"io/ioutil"
"net"
"net/http"
"net/url"
@ -60,7 +59,7 @@ type Handler struct {
// If true, the Forwarded header will not be augmented with your IP address.
HideIP bool `json:"hide_ip,omitempty"`
// If true, the Via heaeder will not be added.
// If true, the Via header will not be added.
HideVia bool `json:"hide_via,omitempty"`
// Host(s) (and ports) of the proxy. When you configure a client,
@ -355,13 +354,13 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyht
// make sure request is idempotent and could be retried by saving the Body
// None of those methods are supposed to have body,
// but we still need to copy the r.Body, even if it's empty
rBodyBuf, err := ioutil.ReadAll(r.Body)
rBodyBuf, err := io.ReadAll(r.Body)
if err != nil {
return caddyhttp.Error(http.StatusBadRequest,
fmt.Errorf("failed to read request body: %v", err))
}
r.GetBody = func() (io.ReadCloser, error) {
return ioutil.NopCloser(bytes.NewReader(rBodyBuf)), nil
return io.NopCloser(bytes.NewReader(rBodyBuf)), nil
}
r.Body, _ = r.GetBody()
}
@ -416,7 +415,7 @@ func (h Handler) checkCredentials(r *http.Request) error {
return errors.New("Proxy-Authorization is required! Expected format: <type> <credentials>")
}
if strings.ToLower(pa[0]) != "basic" {
return errors.New("Auth type is not supported")
return errors.New("auth type is not supported")
}
for _, creds := range h.authCredentials {
if subtle.ConstantTimeCompare(creds, []byte(pa[1])) == 1 {
@ -426,7 +425,7 @@ func (h Handler) checkCredentials(r *http.Request) error {
return nil
}
}
return errors.New("Invalid credentials")
return errors.New("invalid credentials")
}
func (h Handler) shouldServePACFile(r *http.Request) bool {
@ -582,7 +581,8 @@ func serveHijack(w http.ResponseWriter, targetConn net.Conn) error {
}
// Since we hijacked the connection, we lost the ability to write and flush headers via w.
// Let's handcraft the response and send it manually.
res := &http.Response{StatusCode: http.StatusOK,
res := &http.Response{
StatusCode: http.StatusOK,
Proto: "HTTP/1.1",
ProtoMajor: 1,
ProtoMinor: 1,

3
forwardproxy_test.go
View file

@ -19,7 +19,6 @@ import (
"crypto/tls"
"fmt"
"io"
"io/ioutil"
"net"
"net/http"
"net/url"
@ -75,7 +74,7 @@ func connectAndGetViaProxy(targetHost, resource, proxyAddr, httpTargetVer, proxy
req.ProtoMajor = 2
req.ProtoMinor = 0
pr, pw := io.Pipe()
req.Body = ioutil.NopCloser(pr)
req.Body = io.NopCloser(pr)
t := http2.Transport{}
clientConn, err := t.NewClientConn(proxyConn)
if err != nil {

137
go.mod
View file

@ -5,111 +5,112 @@ go 1.20
require (
github.com/caddyserver/caddy/v2 v2.6.4
go.uber.org/zap v1.24.0
golang.org/x/net v0.9.0
golang.org/x/net v0.11.0
)
require (
filippo.io/edwards25519 v1.0.0 // indirect
github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 // indirect
github.com/BurntSushi/toml v1.2.1 // indirect
github.com/BurntSushi/toml v1.3.2 // indirect
github.com/Masterminds/goutils v1.1.1 // indirect
github.com/Masterminds/semver/v3 v3.2.0 // indirect
github.com/Masterminds/semver/v3 v3.2.1 // indirect
github.com/Masterminds/sprig/v3 v3.2.3 // indirect
github.com/Microsoft/go-winio v0.6.0 // indirect
github.com/alecthomas/chroma/v2 v2.5.0 // indirect
github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 // indirect
github.com/Microsoft/go-winio v0.6.1 // indirect
github.com/alecthomas/chroma/v2 v2.7.0 // indirect
github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df // indirect
github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/caddyserver/certmagic v0.17.2 // indirect
github.com/caddyserver/certmagic v0.18.2 // indirect
github.com/cespare/xxhash v1.1.0 // indirect
github.com/cespare/xxhash/v2 v2.1.2 // indirect
github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/chzyer/readline v1.5.1 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
github.com/dgraph-io/badger v1.6.2 // indirect
github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
github.com/dgraph-io/ristretto v0.1.0 // indirect
github.com/dgraph-io/ristretto v0.1.1 // indirect
github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
github.com/dlclark/regexp2 v1.7.0 // indirect
github.com/dlclark/regexp2 v1.10.0 // indirect
github.com/dustin/go-humanize v1.0.1 // indirect
github.com/go-kit/kit v0.10.0 // indirect
github.com/go-logfmt/logfmt v0.5.1 // indirect
github.com/go-sql-driver/mysql v1.6.0 // indirect
github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
github.com/golang/glog v1.0.0 // indirect
github.com/go-kit/kit v0.12.0 // indirect
github.com/go-kit/log v0.2.1 // indirect
github.com/go-logfmt/logfmt v0.6.0 // indirect
github.com/go-sql-driver/mysql v1.7.1 // indirect
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
github.com/golang/glog v1.1.1 // indirect
github.com/golang/mock v1.6.0 // indirect
github.com/golang/protobuf v1.5.2 // indirect
github.com/golang/protobuf v1.5.3 // indirect
github.com/golang/snappy v0.0.4 // indirect
github.com/google/cel-go v0.13.0 // indirect
github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect
github.com/google/cel-go v0.16.0 // indirect
github.com/google/pprof v0.0.0-20230602150820-91b7bce49751 // indirect
github.com/google/uuid v1.3.0 // indirect
github.com/huandu/xstrings v1.3.3 // indirect
github.com/imdario/mergo v0.3.12 // indirect
github.com/inconshreveable/mousetrap v1.0.1 // indirect
github.com/huandu/xstrings v1.4.0 // indirect
github.com/imdario/mergo v0.3.16 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jackc/chunkreader/v2 v2.0.1 // indirect
github.com/jackc/pgconn v1.13.0 // indirect
github.com/jackc/pgconn v1.14.0 // indirect
github.com/jackc/pgio v1.0.0 // indirect
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgproto3/v2 v2.3.1 // indirect
github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
github.com/jackc/pgtype v1.12.0 // indirect
github.com/jackc/pgx/v4 v4.17.2 // indirect
github.com/klauspost/compress v1.15.15 // indirect
github.com/klauspost/cpuid/v2 v2.2.3 // indirect
github.com/jackc/pgproto3/v2 v2.3.2 // indirect
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
github.com/jackc/pgtype v1.14.0 // indirect
github.com/jackc/pgx/v4 v4.18.1 // indirect
github.com/klauspost/compress v1.16.6 // indirect
github.com/klauspost/cpuid/v2 v2.2.5 // indirect
github.com/libdns/libdns v0.2.1 // indirect
github.com/manifoldco/promptui v0.9.0 // indirect
github.com/mattn/go-colorable v0.1.8 // indirect
github.com/mattn/go-isatty v0.0.13 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
github.com/mattn/go-colorable v0.1.13 // indirect
github.com/mattn/go-isatty v0.0.19 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
github.com/mholt/acmez v1.1.0 // indirect
github.com/mholt/acmez v1.2.0 // indirect
github.com/micromdm/scep/v2 v2.1.0 // indirect
github.com/miekg/dns v1.1.50 // indirect
github.com/miekg/dns v1.1.55 // indirect
github.com/mitchellh/copystructure v1.2.0 // indirect
github.com/mitchellh/go-ps v1.0.0 // indirect
github.com/mitchellh/reflectwalk v1.0.2 // indirect
github.com/onsi/ginkgo/v2 v2.2.0 // indirect
github.com/onsi/ginkgo/v2 v2.11.0 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/prometheus/client_golang v1.14.0 // indirect
github.com/prometheus/client_model v0.3.0 // indirect
github.com/prometheus/common v0.37.0 // indirect
github.com/prometheus/procfs v0.8.0 // indirect
github.com/prometheus/client_golang v1.16.0 // indirect
github.com/prometheus/client_model v0.4.0 // indirect
github.com/prometheus/common v0.44.0 // indirect
github.com/prometheus/procfs v0.11.0 // indirect
github.com/quic-go/qpack v0.4.0 // indirect
github.com/quic-go/qtls-go1-18 v0.2.0 // indirect
github.com/quic-go/qtls-go1-19 v0.2.0 // indirect
github.com/quic-go/qtls-go1-20 v0.1.0 // indirect
github.com/quic-go/quic-go v0.32.0 // indirect
github.com/quic-go/qtls-go1-19 v0.3.2 // indirect
github.com/quic-go/qtls-go1-20 v0.3.0 // indirect
github.com/quic-go/quic-go v0.36.0 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/shopspring/decimal v1.2.0 // indirect
github.com/shopspring/decimal v1.3.1 // indirect
github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
github.com/slackhq/nebula v1.6.1 // indirect
github.com/smallstep/certificates v0.23.2 // indirect
github.com/smallstep/nosql v0.5.0 // indirect
github.com/slackhq/nebula v1.7.2 // indirect
github.com/smallstep/certificates v0.24.2 // indirect
github.com/smallstep/nosql v0.6.0 // indirect
github.com/smallstep/truststore v0.12.1 // indirect
github.com/spf13/cast v1.4.1 // indirect
github.com/spf13/cobra v1.6.1 // indirect
github.com/spf13/cast v1.5.1 // indirect
github.com/spf13/cobra v1.7.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/stoewer/go-strcase v1.2.0 // indirect
github.com/tailscale/tscert v0.0.0-20230124224810-c6dc1f4049b2 // indirect
github.com/urfave/cli v1.22.12 // indirect
github.com/stoewer/go-strcase v1.3.0 // indirect
github.com/tailscale/tscert v0.0.0-20230509043813-4e9cb4f2b4ad // indirect
github.com/urfave/cli v1.22.14 // indirect
github.com/yuin/goldmark v1.5.4 // indirect
github.com/yuin/goldmark-highlighting/v2 v2.0.0-20220924101305-151362477c87 // indirect
go.etcd.io/bbolt v1.3.6 // indirect
go.etcd.io/bbolt v1.3.7 // indirect
go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 // indirect
go.step.sm/cli-utils v0.7.5 // indirect
go.step.sm/crypto v0.23.2 // indirect
go.step.sm/linkedca v0.19.0 // indirect
go.uber.org/atomic v1.9.0 // indirect
go.uber.org/multierr v1.6.0 // indirect
golang.org/x/crypto v0.5.0 // indirect
golang.org/x/exp v0.0.0-20221205204356-47842c84f3db // indirect
golang.org/x/mod v0.8.0 // indirect
golang.org/x/sys v0.7.0 // indirect
golang.org/x/term v0.7.0 // indirect
golang.org/x/text v0.9.0 // indirect
golang.org/x/tools v0.6.0 // indirect
google.golang.org/genproto v0.0.0-20230202175211-008b39050e57 // indirect
google.golang.org/grpc v1.52.3 // indirect
google.golang.org/protobuf v1.28.1 // indirect
go.step.sm/cli-utils v0.7.6 // indirect
go.step.sm/crypto v0.32.1 // indirect
go.step.sm/linkedca v0.19.1 // indirect
go.uber.org/atomic v1.11.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
golang.org/x/crypto v0.10.0 // indirect
golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1 // indirect
golang.org/x/mod v0.11.0 // indirect
golang.org/x/sys v0.9.0 // indirect
golang.org/x/term v0.9.0 // indirect
golang.org/x/text v0.10.0 // indirect
golang.org/x/tools v0.10.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect
google.golang.org/grpc v1.56.1 // indirect
google.golang.org/protobuf v1.30.0 // indirect
gopkg.in/square/go-jose.v2 v2.6.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
howett.net/plist v1.0.0 // indirect

927
go.sum
View file

File diff suppressed because it is too large Load diff

9
probe_resist_test.go
View file

@ -4,7 +4,7 @@ import (
"bytes"
"errors"
"fmt"
"io/ioutil"
"io"
"net"
"net/http"
"strings"
@ -44,6 +44,7 @@ func TestGETAuthWrongProbeResist(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if responseProbeResist.StatusCode != responseReference.StatusCode {
t.Fatalf("Expected response: %d, Got: %d\n",
responseReference.StatusCode, responseProbeResist.StatusCode)
@ -314,6 +315,7 @@ func responsesAreEqual(res1, res2 *http.Response) error {
if len(s1) != len(s2) {
return fmt.Sprintf("different length: %d vs %d", len(s1), len(s2))
}
for i := range s1 {
if s1[i] != s2[i] {
return fmt.Sprintf("different string at position %d: %s vs %s", i, s1[i], s2[i])
@ -330,6 +332,7 @@ func responsesAreEqual(res1, res2 *http.Response) error {
if len(res1.Header) != len(res2.Header) {
return errors.New("Headers have different length")
}
for k1, v1 := range res1.Header {
k1Lower := strings.ToLower(k1)
if k1Lower == "date" {
@ -352,8 +355,8 @@ func responsesAreEqual(res1, res2 *http.Response) error {
}
}
// Compare bodies
buf1, err1 := ioutil.ReadAll(res1.Body)
buf2, err2 := ioutil.ReadAll(res2.Body)
buf1, err1 := io.ReadAll(res1.Body)
buf2, err2 := io.ReadAll(res2.Body)
n1 := len(buf1)
n2 := len(buf2)
makeBodyError := func(s string) error {