mirror of
https://github.com/lightninglabs/lightning-terminal.git
synced 2026-08-13 12:33:36 +02:00
setup initial backend grpc proxy server
This commit is contained in:
jamaljsr
parent
16a8b27391
commit
f6334154a6
6 changed files with 642 additions and 0 deletions
3
.gitignore
vendored
Normal file
3
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
# generated proxy commands
|
||||
proxy.cert
|
||||
proxy.key
|
||||
130
backend.go
Normal file
130
backend.go
Normal file
|
|
@ -0,0 +1,130 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"io/ioutil"
|
||||
|
||||
"github.com/mwitkow/grpc-proxy/proxy"
|
||||
"github.com/sirupsen/logrus"
|
||||
"github.com/spf13/pflag"
|
||||
"google.golang.org/grpc"
|
||||
"google.golang.org/grpc/credentials"
|
||||
)
|
||||
|
||||
var (
|
||||
flagBackendHostPort = pflag.String(
|
||||
"backend_addr",
|
||||
"",
|
||||
"A host:port (IP or hostname) of the gRPC server to forward it to.")
|
||||
|
||||
flagBackendIsUsingTls = pflag.Bool(
|
||||
"backend_tls",
|
||||
false,
|
||||
"Whether the gRPC server of the backend is serving in plaintext (false) or over TLS (true).",
|
||||
)
|
||||
|
||||
flagBackendTlsNoVerify = pflag.Bool(
|
||||
"backend_tls_noverify",
|
||||
false,
|
||||
"Whether to ignore TLS verification checks (cert validity, hostname). *DO NOT USE IN PRODUCTION*.",
|
||||
)
|
||||
|
||||
flagBackendTlsClientCert = pflag.String(
|
||||
"backend_client_tls_cert_file",
|
||||
"",
|
||||
"Path to the PEM certificate used when the backend requires client certificates for TLS.")
|
||||
|
||||
flagBackendTlsClientKey = pflag.String(
|
||||
"backend_client_tls_key_file",
|
||||
"",
|
||||
"Path to the PEM key used when the backend requires client certificates for TLS.")
|
||||
|
||||
flagMaxCallRecvMsgSize = pflag.Int(
|
||||
"backend_max_call_recv_msg_size",
|
||||
1024*1024*4, // The current maximum receive msg size per https://github.com/grpc/grpc-go/blob/v1.8.2/server.go#L54
|
||||
"Maximum receive message size limit. If not specified, the default of 4MB will be used.",
|
||||
)
|
||||
|
||||
flagBackendTlsCa = pflag.StringSlice(
|
||||
"backend_tls_ca_files",
|
||||
[]string{},
|
||||
"Paths (comma separated) to PEM certificate chains used for verification of backend certificates. If empty, host CA chain will be used.",
|
||||
)
|
||||
|
||||
flagBackendDefaultAuthority = pflag.String(
|
||||
"backend_default_authority",
|
||||
"",
|
||||
"Default value to use for the HTTP/2 :authority header commonly used for routing gRPC calls through a backend gateway.",
|
||||
)
|
||||
|
||||
flagBackendBackoffMaxDelay = pflag.Duration(
|
||||
"backend_backoff_max_delay",
|
||||
grpc.DefaultBackoffConfig.MaxDelay,
|
||||
"Maximum delay when backing off after failed connection attempts to the backend.",
|
||||
)
|
||||
)
|
||||
|
||||
func dialBackendOrFail() *grpc.ClientConn {
|
||||
if *flagBackendHostPort == "" {
|
||||
logrus.Fatalf("flag 'backend_addr' must be set")
|
||||
}
|
||||
opt := []grpc.DialOption{}
|
||||
opt = append(opt, grpc.WithCodec(proxy.Codec()))
|
||||
|
||||
if *flagBackendDefaultAuthority != "" {
|
||||
opt = append(opt, grpc.WithAuthority(*flagBackendDefaultAuthority))
|
||||
}
|
||||
|
||||
if *flagBackendIsUsingTls {
|
||||
opt = append(opt, grpc.WithTransportCredentials(credentials.NewTLS(buildBackendTlsOrFail())))
|
||||
} else {
|
||||
opt = append(opt, grpc.WithInsecure())
|
||||
}
|
||||
|
||||
opt = append(opt,
|
||||
grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(*flagMaxCallRecvMsgSize)),
|
||||
grpc.WithBackoffMaxDelay(*flagBackendBackoffMaxDelay),
|
||||
)
|
||||
|
||||
cc, err := grpc.Dial(*flagBackendHostPort, opt...)
|
||||
if err != nil {
|
||||
logrus.Fatalf("failed dialing backend: %v", err)
|
||||
}
|
||||
return cc
|
||||
}
|
||||
|
||||
func buildBackendTlsOrFail() *tls.Config {
|
||||
tlsConfig := &tls.Config{}
|
||||
tlsConfig.MinVersion = tls.VersionTLS12
|
||||
if *flagBackendTlsNoVerify {
|
||||
tlsConfig.InsecureSkipVerify = true
|
||||
} else {
|
||||
if len(*flagBackendTlsCa) > 0 {
|
||||
tlsConfig.RootCAs = x509.NewCertPool()
|
||||
for _, path := range *flagBackendTlsCa {
|
||||
data, err := ioutil.ReadFile(path)
|
||||
if err != nil {
|
||||
logrus.Fatalf("failed reading backend CA file %v: %v", path, err)
|
||||
}
|
||||
if ok := tlsConfig.RootCAs.AppendCertsFromPEM(data); !ok {
|
||||
logrus.Fatalf("failed processing backend CA file %v", path)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if *flagBackendTlsClientCert != "" || *flagBackendTlsClientKey != "" {
|
||||
if *flagBackendTlsClientCert == "" {
|
||||
logrus.Fatal("flag 'backend_client_tls_cert_file' must be set when 'backend_client_tls_key_file' is set")
|
||||
}
|
||||
if *flagBackendTlsClientKey == "" {
|
||||
logrus.Fatal("flag 'backend_client_tls_key_file' must be set when 'backend_client_tls_cert_file' is set")
|
||||
}
|
||||
cert, err := tls.LoadX509KeyPair(*flagBackendTlsClientCert, *flagBackendTlsClientKey)
|
||||
if err != nil {
|
||||
logrus.Fatalf("failed reading TLS client keys: %v", err)
|
||||
}
|
||||
tlsConfig.Certificates = append(tlsConfig.Certificates, cert)
|
||||
}
|
||||
return tlsConfig
|
||||
}
|
||||
20
go.mod
Normal file
20
go.mod
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
module github.com/lightninglabs/shushtar
|
||||
|
||||
go 1.14
|
||||
|
||||
require (
|
||||
github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f // indirect
|
||||
github.com/gorilla/websocket v1.4.2 // indirect
|
||||
github.com/grpc-ecosystem/go-grpc-middleware v1.2.0
|
||||
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
|
||||
github.com/improbable-eng/grpc-web v0.12.0
|
||||
github.com/jpillora/backoff v1.0.0 // indirect
|
||||
github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f
|
||||
github.com/mwitkow/grpc-proxy v0.0.0-20181017164139-0f1106ef9c76
|
||||
github.com/prometheus/client_golang v1.5.1
|
||||
github.com/rs/cors v1.7.0 // indirect
|
||||
github.com/sirupsen/logrus v1.5.0
|
||||
github.com/spf13/pflag v1.0.5
|
||||
golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e
|
||||
google.golang.org/grpc v1.28.0
|
||||
)
|
||||
162
go.sum
Normal file
162
go.sum
Normal file
|
|
@ -0,0 +1,162 @@
|
|||
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
|
||||
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
|
||||
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
|
||||
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
|
||||
github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
|
||||
github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
|
||||
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
|
||||
github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
|
||||
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
|
||||
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
|
||||
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
|
||||
github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
|
||||
github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
|
||||
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
|
||||
github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f h1:U5y3Y5UE0w7amNe7Z5G/twsBW0KEalRQXZzf8ufSh9I=
|
||||
github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f/go.mod h1:xH/i4TFMt8koVQZ6WFms69WAsDWr2XsYL3Hkl7jkoLE=
|
||||
github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
|
||||
github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
|
||||
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
|
||||
github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
|
||||
github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
|
||||
github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
|
||||
github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
|
||||
github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
|
||||
github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
|
||||
github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
|
||||
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
|
||||
github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
|
||||
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||
github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||
github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
|
||||
github.com/golang/protobuf v1.3.3 h1:gyjaxf+svBWX08ZjK86iN9geUJF0H6gp2IRKX6Nf6/I=
|
||||
github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
|
||||
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
|
||||
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
|
||||
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||
github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
|
||||
github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
|
||||
github.com/grpc-ecosystem/go-grpc-middleware v1.2.0 h1:0IKlLyQ3Hs9nDaiK5cSHAGmcQEIC8l2Ts1u6x5Dfrqg=
|
||||
github.com/grpc-ecosystem/go-grpc-middleware v1.2.0/go.mod h1:mJzapYve32yjrKlk9GbyCZHuPgZsrbyIbyKhSzOpg6s=
|
||||
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
|
||||
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
|
||||
github.com/improbable-eng/grpc-web v0.12.0 h1:GlCS+lMZzIkfouf7CNqY+qqpowdKuJLSLLcKVfM1oLc=
|
||||
github.com/improbable-eng/grpc-web v0.12.0/go.mod h1:6hRR09jOEG81ADP5wCQju1z71g6OL4eEvELdran/3cs=
|
||||
github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
|
||||
github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
|
||||
github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
|
||||
github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
|
||||
github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
|
||||
github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
|
||||
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
|
||||
github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
|
||||
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
|
||||
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
|
||||
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
|
||||
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||
github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
|
||||
github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
|
||||
github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
|
||||
github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f h1:KUppIJq7/+SVif2QVs3tOP0zanoHgBEVAwHxUSIzRqU=
|
||||
github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
|
||||
github.com/mwitkow/grpc-proxy v0.0.0-20181017164139-0f1106ef9c76 h1:0xuRacu/Zr+jX+KyLLPPktbwXqyOvnOPUQmMLzX1jxU=
|
||||
github.com/mwitkow/grpc-proxy v0.0.0-20181017164139-0f1106ef9c76/go.mod h1:x5OoJHDHqxHS801UIuhqGl6QdSAEJvtausosHSdazIo=
|
||||
github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
|
||||
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
|
||||
github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
|
||||
github.com/prometheus/client_golang v1.5.1 h1:bdHYieyGlH+6OLEk2YQha8THib30KP0/yD0YH9m6xcA=
|
||||
github.com/prometheus/client_golang v1.5.1/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
|
||||
github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
|
||||
github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
||||
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
||||
github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M=
|
||||
github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
||||
github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
|
||||
github.com/prometheus/common v0.9.1 h1:KOMtN28tlbam3/7ZKEYKHhKoJZYYj3gMH4uc62x7X7U=
|
||||
github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
|
||||
github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
|
||||
github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
|
||||
github.com/prometheus/procfs v0.0.8 h1:+fpWZdT24pJBiqJdAwYBjPSk+5YmQzYNPYzQsdzLkt8=
|
||||
github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
|
||||
github.com/rs/cors v1.7.0 h1:+88SsELBHx5r+hZ8TCkggzSstaWNbDvThkVK8H6f9ik=
|
||||
github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
|
||||
github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
|
||||
github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
|
||||
github.com/sirupsen/logrus v1.5.0 h1:1N5EYkVAPEywqZRJd7cwnRtCb6xJx7NH3T3WUTF980Q=
|
||||
github.com/sirupsen/logrus v1.5.0/go.mod h1:+F7Ogzej0PZc/94MaYx/nvG9jOFMD2osvC3s+Squfpo=
|
||||
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
|
||||
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
|
||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
|
||||
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
|
||||
go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
|
||||
go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
|
||||
go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
|
||||
golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
|
||||
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
|
||||
golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
|
||||
golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
|
||||
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e h1:3G+cUijn7XD+S4eJFddp53Pv7+slrESplyjG25HgL+k=
|
||||
golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
|
||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd h1:xhmwyvizuTgC2qz7ZlMluP20uW+C3Rm0FD/WLDX8884=
|
||||
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
|
||||
golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
|
||||
golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
|
||||
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
|
||||
google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
|
||||
google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55 h1:gSJIx1SDwno+2ElGhA4+qG2zF97qiUzTM+rQ0klBOcE=
|
||||
google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
|
||||
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
|
||||
google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
|
||||
google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
|
||||
google.golang.org/grpc v1.28.0 h1:bO/TA4OxCOummhSf10siHuG7vJOiwh7SpRpFZDkOgl4=
|
||||
google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
|
||||
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
|
||||
245
main.go
Normal file
245
main.go
Normal file
|
|
@ -0,0 +1,245 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"log"
|
||||
"net"
|
||||
"net/http"
|
||||
_ "net/http/pprof" // register in DefaultServerMux
|
||||
"os"
|
||||
"time"
|
||||
|
||||
"crypto/tls"
|
||||
|
||||
grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
|
||||
grpc_logrus "github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus"
|
||||
grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
|
||||
"github.com/improbable-eng/grpc-web/go/grpcweb"
|
||||
"github.com/mwitkow/go-conntrack"
|
||||
"github.com/mwitkow/grpc-proxy/proxy"
|
||||
"github.com/prometheus/client_golang/prometheus/promhttp"
|
||||
"github.com/sirupsen/logrus"
|
||||
"github.com/spf13/pflag"
|
||||
"golang.org/x/net/context"
|
||||
_ "golang.org/x/net/trace" // register in DefaultServerMux
|
||||
"google.golang.org/grpc"
|
||||
"google.golang.org/grpc/grpclog"
|
||||
"google.golang.org/grpc/metadata"
|
||||
)
|
||||
|
||||
var (
|
||||
flagBindAddr = pflag.String("server_bind_address", "0.0.0.0", "address to bind the server to")
|
||||
flagHttpPort = pflag.Int("server_http_debug_port", 8080, "TCP port to listen on for HTTP1.1 debug calls.")
|
||||
flagHttpTlsPort = pflag.Int("server_http_tls_port", 8443, "TCP port to listen on for HTTPS (gRPC, gRPC-Web).")
|
||||
|
||||
flagAllowAllOrigins = pflag.Bool("allow_all_origins", false, "allow requests from any origin.")
|
||||
flagAllowedOrigins = pflag.StringSlice("allowed_origins", nil, "comma-separated list of origin URLs which are allowed to make cross-origin requests.")
|
||||
flagAllowedHeaders = pflag.StringSlice("allowed_headers", []string{}, "comma-separated list of headers which are allowed to propagate to the gRPC backend.")
|
||||
|
||||
runHttpServer = pflag.Bool("run_http_server", true, "whether to run HTTP server")
|
||||
runTlsServer = pflag.Bool("run_tls_server", true, "whether to run TLS server")
|
||||
|
||||
useWebsockets = pflag.Bool("use_websockets", false, "whether to use beta websocket transport layer")
|
||||
websocketPingInterval = pflag.Duration("websocket_ping_interval", 0, "whether to use websocket keepalive pinging. Only used when using websockets. Configured interval must be >= 1s.")
|
||||
|
||||
flagHttpMaxWriteTimeout = pflag.Duration("server_http_max_write_timeout", 10*time.Second, "HTTP server config, max write duration.")
|
||||
flagHttpMaxReadTimeout = pflag.Duration("server_http_max_read_timeout", 10*time.Second, "HTTP server config, max read duration.")
|
||||
)
|
||||
|
||||
func main() {
|
||||
pflag.Parse()
|
||||
for _, flag := range pflag.Args() {
|
||||
if flag == "true" || flag == "false" {
|
||||
logrus.Fatal("Boolean flags should be set using --flag=false, --flag=true or --flag (which is short for --flag=true). You cannot use --flag true or --flag false.")
|
||||
}
|
||||
logrus.Fatal("Unknown argument: " + flag)
|
||||
}
|
||||
|
||||
logrus.SetOutput(os.Stdout)
|
||||
logEntry := logrus.NewEntry(logrus.StandardLogger())
|
||||
|
||||
if *flagAllowAllOrigins && len(*flagAllowedOrigins) != 0 {
|
||||
logrus.Fatal("Ambiguous --allow_all_origins and --allow_origins configuration. Either set --allow_all_origins=true OR specify one or more origins to whitelist with --allow_origins, not both.")
|
||||
}
|
||||
|
||||
grpcServer := buildGrpcProxyServer(logEntry)
|
||||
errChan := make(chan error)
|
||||
|
||||
allowedOrigins := makeAllowedOrigins(*flagAllowedOrigins)
|
||||
|
||||
options := []grpcweb.Option{
|
||||
grpcweb.WithCorsForRegisteredEndpointsOnly(false),
|
||||
grpcweb.WithOriginFunc(makeHttpOriginFunc(allowedOrigins)),
|
||||
}
|
||||
|
||||
if *useWebsockets {
|
||||
logrus.Println("using websockets")
|
||||
options = append(
|
||||
options,
|
||||
grpcweb.WithWebsockets(true),
|
||||
grpcweb.WithWebsocketOriginFunc(makeWebsocketOriginFunc(allowedOrigins)),
|
||||
)
|
||||
if *websocketPingInterval >= time.Second {
|
||||
logrus.Infof("websocket keepalive pinging enabled, the timeout interval is %s", websocketPingInterval.String())
|
||||
}
|
||||
options = append(
|
||||
options,
|
||||
grpcweb.WithWebsocketPingInterval(*websocketPingInterval),
|
||||
)
|
||||
}
|
||||
|
||||
if len(*flagAllowedHeaders) > 0 {
|
||||
options = append(
|
||||
options,
|
||||
grpcweb.WithAllowedRequestHeaders(*flagAllowedHeaders),
|
||||
)
|
||||
}
|
||||
|
||||
wrappedGrpc := grpcweb.WrapServer(grpcServer, options...)
|
||||
fs := http.FileServer(http.Dir("./app/build"))
|
||||
|
||||
if !*runHttpServer && !*runTlsServer {
|
||||
logrus.Fatalf("Both run_http_server and run_tls_server are set to false. At least one must be enabled for grpcweb proxy to function correctly.")
|
||||
}
|
||||
|
||||
if *runHttpServer {
|
||||
// Debug server.
|
||||
debugServer := buildServer(wrappedGrpc, fs)
|
||||
http.Handle("/metrics", promhttp.Handler())
|
||||
debugListener := buildListenerOrFail("http", *flagHttpPort)
|
||||
serveServer(debugServer, debugListener, "http", errChan)
|
||||
}
|
||||
|
||||
if *runTlsServer {
|
||||
// Debug server.
|
||||
servingServer := buildServer(wrappedGrpc, fs)
|
||||
servingListener := buildListenerOrFail("http", *flagHttpTlsPort)
|
||||
servingListener = tls.NewListener(servingListener, buildServerTlsOrFail())
|
||||
serveServer(servingServer, servingListener, "http_tls", errChan)
|
||||
}
|
||||
|
||||
<-errChan
|
||||
}
|
||||
|
||||
func buildServer(wrappedGrpc *grpcweb.WrappedGrpcServer, fs http.Handler) *http.Server {
|
||||
return &http.Server{
|
||||
WriteTimeout: *flagHttpMaxWriteTimeout,
|
||||
ReadTimeout: *flagHttpMaxReadTimeout,
|
||||
Handler: http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
|
||||
if wrappedGrpc.IsGrpcWebRequest(req) {
|
||||
logrus.Info("Handle GRPC request: ", req.URL.Path)
|
||||
wrappedGrpc.ServeHTTP(resp, req)
|
||||
} else {
|
||||
// fallback to static file hosting
|
||||
logrus.Info("Handle static file request: ", req.URL.Path)
|
||||
fs.ServeHTTP(resp, req)
|
||||
}
|
||||
}),
|
||||
}
|
||||
}
|
||||
|
||||
func serveServer(server *http.Server, listener net.Listener, name string, errChan chan error) {
|
||||
go func() {
|
||||
logrus.Infof("listening for %s on: %v", name, listener.Addr().String())
|
||||
if err := server.Serve(listener); err != nil {
|
||||
errChan <- fmt.Errorf("%s server error: %v", name, err)
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
func buildGrpcProxyServer(logger *logrus.Entry) *grpc.Server {
|
||||
// gRPC-wide changes.
|
||||
grpc.EnableTracing = true
|
||||
grpc_logrus.ReplaceGrpcLogger(logger)
|
||||
|
||||
// gRPC proxy logic.
|
||||
backendConn := dialBackendOrFail()
|
||||
director := func(ctx context.Context, fullMethodName string) (context.Context, *grpc.ClientConn, error) {
|
||||
md, _ := metadata.FromIncomingContext(ctx)
|
||||
outCtx, _ := context.WithCancel(ctx)
|
||||
mdCopy := md.Copy()
|
||||
|
||||
// hard-code admin macaroon in hex
|
||||
mdCopy.Append("macaroon", "0201036c6e6402eb01030a108b5956a714ec090a3d13136dc060dff91201301a160a0761646472657373120472656164120577726974651a130a04696e666f120472656164120577726974651a170a08696e766f69636573120472656164120577726974651a140a086d616361726f6f6e120867656e65726174651a160a076d657373616765120472656164120577726974651a170a086f6666636861696e120472656164120577726974651a160a076f6e636861696e120472656164120577726974651a140a057065657273120472656164120577726974651a180a067369676e6572120867656e65726174651204726561640000062018194042dcb6d97ce7a3f24939b0516a3708a4d6d7cae711c894d78ce0b6bc00")
|
||||
|
||||
delete(mdCopy, "user-agent")
|
||||
// If this header is present in the request from the web client,
|
||||
// the actual connection to the backend will not be established.
|
||||
// https://github.com/improbable-eng/grpc-web/issues/568
|
||||
delete(mdCopy, "connection")
|
||||
outCtx = metadata.NewOutgoingContext(outCtx, mdCopy)
|
||||
return outCtx, backendConn, nil
|
||||
}
|
||||
// Server with logging and monitoring enabled.
|
||||
return grpc.NewServer(
|
||||
grpc.CustomCodec(proxy.Codec()), // needed for proxy to function.
|
||||
grpc.UnknownServiceHandler(proxy.TransparentHandler(director)),
|
||||
grpc.MaxRecvMsgSize(*flagMaxCallRecvMsgSize),
|
||||
grpc_middleware.WithUnaryServerChain(
|
||||
grpc_logrus.UnaryServerInterceptor(logger),
|
||||
grpc_prometheus.UnaryServerInterceptor,
|
||||
),
|
||||
grpc_middleware.WithStreamServerChain(
|
||||
grpc_logrus.StreamServerInterceptor(logger),
|
||||
grpc_prometheus.StreamServerInterceptor,
|
||||
),
|
||||
)
|
||||
}
|
||||
|
||||
func buildListenerOrFail(name string, port int) net.Listener {
|
||||
addr := fmt.Sprintf("%s:%d", *flagBindAddr, port)
|
||||
listener, err := net.Listen("tcp", addr)
|
||||
if err != nil {
|
||||
log.Fatalf("failed listening for '%v' on %v: %v", name, port, err)
|
||||
}
|
||||
return conntrack.NewListener(listener,
|
||||
conntrack.TrackWithName(name),
|
||||
conntrack.TrackWithTcpKeepAlive(20*time.Second),
|
||||
conntrack.TrackWithTracing(),
|
||||
)
|
||||
}
|
||||
|
||||
func makeHttpOriginFunc(allowedOrigins *allowedOrigins) func(origin string) bool {
|
||||
if *flagAllowAllOrigins {
|
||||
return func(origin string) bool {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return allowedOrigins.IsAllowed
|
||||
}
|
||||
|
||||
func makeWebsocketOriginFunc(allowedOrigins *allowedOrigins) func(req *http.Request) bool {
|
||||
if *flagAllowAllOrigins {
|
||||
return func(req *http.Request) bool {
|
||||
return true
|
||||
}
|
||||
} else {
|
||||
return func(req *http.Request) bool {
|
||||
origin, err := grpcweb.WebsocketRequestOrigin(req)
|
||||
if err != nil {
|
||||
grpclog.Warning(err)
|
||||
return false
|
||||
}
|
||||
return allowedOrigins.IsAllowed(origin)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func makeAllowedOrigins(origins []string) *allowedOrigins {
|
||||
o := map[string]struct{}{}
|
||||
for _, allowedOrigin := range origins {
|
||||
o[allowedOrigin] = struct{}{}
|
||||
}
|
||||
return &allowedOrigins{
|
||||
origins: o,
|
||||
}
|
||||
}
|
||||
|
||||
type allowedOrigins struct {
|
||||
origins map[string]struct{}
|
||||
}
|
||||
|
||||
func (a *allowedOrigins) IsAllowed(origin string) bool {
|
||||
_, ok := a.origins[origin]
|
||||
return ok
|
||||
}
|
||||
82
server_tls.go
Normal file
82
server_tls.go
Normal file
|
|
@ -0,0 +1,82 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
|
||||
"github.com/mwitkow/go-conntrack/connhelpers"
|
||||
logrus "github.com/sirupsen/logrus"
|
||||
"github.com/spf13/pflag"
|
||||
|
||||
"crypto/x509"
|
||||
"io/ioutil"
|
||||
)
|
||||
|
||||
var (
|
||||
flagTlsServerCert = pflag.String(
|
||||
"server_tls_cert_file",
|
||||
"",
|
||||
"Path to the PEM certificate for server use.")
|
||||
|
||||
flagTlsServerKey = pflag.String(
|
||||
"server_tls_key_file",
|
||||
"../misc/localhost.key",
|
||||
"Path to the PEM key for the certificate for the server use.")
|
||||
|
||||
flagTlsServerClientCertVerification = pflag.String(
|
||||
"server_tls_client_cert_verification",
|
||||
"none",
|
||||
"Controls whether a client certificate is on. Values: none, verify_if_given, require.")
|
||||
|
||||
flagTlsServerClientCAFiles = pflag.StringSlice(
|
||||
"server_tls_client_ca_files",
|
||||
[]string{},
|
||||
"Paths (comma separated) to PEM certificate chains used for client-side verification. If empty, host CA chain will be used.",
|
||||
)
|
||||
)
|
||||
|
||||
func buildServerTlsOrFail() *tls.Config {
|
||||
if *flagTlsServerCert == "" || *flagTlsServerKey == "" {
|
||||
logrus.Fatalf("flags server_tls_cert_file and server_tls_key_file must be set")
|
||||
}
|
||||
tlsConfig, err := connhelpers.TlsConfigForServerCerts(*flagTlsServerCert, *flagTlsServerKey)
|
||||
if err != nil {
|
||||
logrus.Fatalf("failed reading TLS server keys: %v", err)
|
||||
}
|
||||
tlsConfig.MinVersion = tls.VersionTLS12
|
||||
switch *flagTlsServerClientCertVerification {
|
||||
case "none":
|
||||
tlsConfig.ClientAuth = tls.NoClientCert
|
||||
case "verify_if_given":
|
||||
tlsConfig.ClientAuth = tls.VerifyClientCertIfGiven
|
||||
case "require":
|
||||
tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
|
||||
default:
|
||||
logrus.Fatalf("Uknown value '%v' for server_tls_client_cert_verification", *flagTlsServerClientCertVerification)
|
||||
}
|
||||
if tlsConfig.ClientAuth != tls.NoClientCert {
|
||||
if len(*flagTlsServerClientCAFiles) > 0 {
|
||||
tlsConfig.ClientCAs = x509.NewCertPool()
|
||||
for _, path := range *flagTlsServerClientCAFiles {
|
||||
data, err := ioutil.ReadFile(path)
|
||||
if err != nil {
|
||||
logrus.Fatalf("failed reading client CA file %v: %v", path, err)
|
||||
}
|
||||
if ok := tlsConfig.ClientCAs.AppendCertsFromPEM(data); !ok {
|
||||
logrus.Fatalf("failed processing client CA file %v", path)
|
||||
}
|
||||
}
|
||||
} else {
|
||||
var err error
|
||||
tlsConfig.ClientCAs, err = x509.SystemCertPool()
|
||||
if err != nil {
|
||||
logrus.Fatalf("no client CA files specified, fallback to system CA chain failed: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
tlsConfig, err = connhelpers.TlsConfigWithHttp2Enabled(tlsConfig)
|
||||
if err != nil {
|
||||
logrus.Fatalf("can't configure h2 handling: %v", err)
|
||||
}
|
||||
return tlsConfig
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue