trip.go

   1 /*
   2 tofuproxy -- HTTP proxy with TLS certificates management
   3 Copyright (C) 2021 Sergey Matveev <stargrave@stargrave.org>
   4
   5 This program is free software: you can redistribute it and/or modify
   6 it under the terms of the GNU General Public License as published by
   7 the Free Software Foundation, version 3 of the License.
   8
   9 This program is distributed in the hope that it will be useful,
  10 but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 GNU General Public License for more details.
  13
  14 You should have received a copy of the GNU General Public License
  15 along with this program.  If not, see <http://www.gnu.org/licenses/>.
  16 */
  17
  18 package tofuproxy
  19
  20 import (
  21         "fmt"
  22         "io"
  23         "log"
  24         "net"
  25         "net/http"
  26         "strings"
  27         "time"
  28
  29         "github.com/dustin/go-humanize"
  30         "go.stargrave.org/tofuproxy/caches"
  31         "go.stargrave.org/tofuproxy/fifos"
  32         "go.stargrave.org/tofuproxy/rounds"
  33 )
  34
  35 var (
  36         transport = http.Transport{
  37                 DialContext: (&net.Dialer{
  38                         Timeout:   time.Minute,
  39                         KeepAlive: time.Minute,
  40                 }).DialContext,
  41                 MaxIdleConns:        http.DefaultTransport.(*http.Transport).MaxIdleConns,
  42                 IdleConnTimeout:     http.DefaultTransport.(*http.Transport).IdleConnTimeout * 2,
  43                 TLSHandshakeTimeout: time.Minute,
  44                 DialTLSContext:      dialTLS,
  45                 ForceAttemptHTTP2:   true,
  46         }
  47         proxyHeaders = map[string]struct{}{
  48                 "Location":       {},
  49                 "Content-Type":   {},
  50                 "Content-Length": {},
  51         }
  52 )
  53
  54 type Round func(
  55         host string,
  56         resp *http.Response,
  57         w http.ResponseWriter,
  58         req *http.Request,
  59 ) (bool, error)
  60
  61 func roundTrip(w http.ResponseWriter, req *http.Request) {
  62         fifos.LogReq <- fmt.Sprintf("%s %s", req.Method, req.URL)
  63         host := strings.TrimSuffix(req.URL.Host, ":443")
  64         for _, round := range []Round{
  65                 rounds.RoundNoHead,
  66                 rounds.RoundDenySpy,
  67                 rounds.RoundRedditOld,
  68                 rounds.RoundHabrImage,
  69         } {
  70                 if cont, _ := round(host, nil, w, req); !cont {
  71                         return
  72                 }
  73         }
  74
  75         reqFlags := []string{}
  76         unauthorized := false
  77
  78         caches.HTTPAuthCacheM.RLock()
  79         if creds, ok := caches.HTTPAuthCache[req.URL.Host]; ok {
  80                 req.SetBasicAuth(creds[0], creds[1])
  81                 unauthorized = true
  82         }
  83         caches.HTTPAuthCacheM.RUnlock()
  84
  85 Retry:
  86         resp, err := transport.RoundTrip(req)
  87         if err != nil {
  88                 fifos.LogErr <- fmt.Sprintf("%s\t%s", req.URL.Host, err.Error())
  89                 http.Error(w, err.Error(), http.StatusBadGateway)
  90                 return
  91         }
  92
  93         if resp.StatusCode == http.StatusUnauthorized {
  94                 resp.Body.Close()
  95                 caches.HTTPAuthCacheM.Lock()
  96                 if unauthorized {
  97                         delete(caches.HTTPAuthCache, req.URL.Host)
  98                 } else {
  99                         unauthorized = true
 100                 }
 101                 fifos.LogVarious <- fmt.Sprintf(
 102                         "%s %s\tHTTP authorization required", req.Method, req.URL.Host,
 103                 )
 104                 user, pass, err := authDialog(host, resp.Header.Get("WWW-Authenticate"))
 105                 if err != nil {
 106                         caches.HTTPAuthCacheM.Unlock()
 107                         fifos.LogErr <- fmt.Sprintf("%s\t%s", req.URL.Host, err.Error())
 108                         http.Error(w, err.Error(), http.StatusInternalServerError)
 109                         return
 110                 }
 111                 caches.HTTPAuthCache[req.URL.Host] = [2]string{user, pass}
 112                 caches.HTTPAuthCacheM.Unlock()
 113                 req.SetBasicAuth(user, pass)
 114                 fifos.LogHTTPAuth <- fmt.Sprintf("%s %s\t%s", req.Method, req.URL, user)
 115                 goto Retry
 116         }
 117         if unauthorized {
 118                 reqFlags = append(reqFlags, "auth")
 119         }
 120         if resp.TLS != nil && resp.TLS.NegotiatedProtocol != "" {
 121                 reqFlags = append(reqFlags, resp.TLS.NegotiatedProtocol)
 122         }
 123
 124         for k, vs := range resp.Header {
 125                 if _, ok := proxyHeaders[k]; ok {
 126                         continue
 127                 }
 128                 for _, v := range vs {
 129                         w.Header().Add(k, v)
 130                 }
 131         }
 132
 133         for _, round := range []Round{
 134                 rounds.RoundDenyFonts,
 135                 rounds.RoundTranscodeWebP,
 136                 rounds.RoundTranscodeJXL,
 137                 rounds.RoundTranscodeAVIF,
 138                 rounds.RoundRedirectHTML,
 139         } {
 140                 cont, err := round(host, resp, w, req)
 141                 if err != nil {
 142                         http.Error(w, err.Error(), http.StatusBadGateway)
 143                         return
 144                 }
 145                 if !cont {
 146                         return
 147                 }
 148         }
 149
 150         for h := range proxyHeaders {
 151                 if v := resp.Header.Get(h); v != "" {
 152                         w.Header().Add(h, v)
 153                 }
 154         }
 155         w.WriteHeader(resp.StatusCode)
 156         n, err := io.Copy(w, resp.Body)
 157         if err != nil {
 158                 log.Printf("Error during %s: %+v\n", req.URL, err)
 159         }
 160         resp.Body.Close()
 161         msg := fmt.Sprintf(
 162                 "%s %s\t%s\t%s\t%s\t%s",
 163                 req.Method, req.URL,
 164                 resp.Status,
 165                 resp.Header.Get("Content-Type"),
 166                 humanize.IBytes(uint64(n)),
 167                 strings.Join(reqFlags, ","),
 168         )
 169         if resp.StatusCode == http.StatusOK {
 170                 fifos.LogOK <- msg
 171         } else {
 172                 fifos.LogNonOK <- msg
 173         }
 174 }