handler.go

@@ -1,19 +1,14 @@
 package main
 
 import (
-	"bufio"
-	"bytes"
 	"fmt"
+	auth "github.com/fangdingjun/go-http-auth"
 	"io"
 	"log"
 	"net"
 	"net/http"
 	"strings"
 	"time"
-
-	"github.com/fangdingjun/gnutls"
-	auth "github.com/fangdingjun/go-http-auth"
-	nghttp2 "github.com/fangdingjun/nghttp2-go"
 )
 
 // handler process the proxy request first(if enabled)
@@ -32,7 +27,7 @@ var defaultTransport http.RoundTripper = &http.Transport{
 	IdleConnTimeout:       30 * time.Second,
 	MaxIdleConnsPerHost:   3,
 	DisableKeepAlives:     true,
-	ResponseHeaderTimeout: 10 * time.Second,
+	ResponseHeaderTimeout: 2 * time.Second,
 }
 
 // ServeHTTP implements the http.Handler interface
@@ -100,10 +95,7 @@ func (h *handler) handleHTTP(w http.ResponseWriter, r *http.Request) {
 			r.Body = nil
 		}
 	}
-	if r.Method == http.MethodPost && r.ContentLength == 0 {
+
-		r.Body = http.NoBody
-	}
-	//log.Println("content-length", r.Header.Get("content-length"))
 	resp, err = defaultTransport.RoundTrip(r)
 	if err != nil {
 		log.Printf("RoundTrip: %s", err)
@@ -117,15 +109,9 @@ func (h *handler) handleHTTP(w http.ResponseWriter, r *http.Request) {
 
 	hdr := w.Header()
 
+	resp.Header.Del("connection")
+
 	for k, v := range resp.Header {
-		_k := strings.ToLower(k)
-		if _k == "connection" || _k == "transfer-encoding" ||
-			_k == "keep-alive" || _k == "upgrade" || _k == "te" {
-			continue
-		}
-		if resp.StatusCode == 204 && _k == "content-length" {
-			continue
-		}
 		for _, v1 := range v {
 			hdr.Add(k, v1)
 		}
@@ -135,11 +121,21 @@ func (h *handler) handleHTTP(w http.ResponseWriter, r *http.Request) {
 	io.Copy(w, resp.Body)
 }
 
+type flushWriter struct {
+	w io.Writer
+}
+
+func (fw flushWriter) Write(buf []byte) (int, error) {
+	n, err := fw.w.Write(buf)
+	fw.w.(http.Flusher).Flush()
+	return n, err
+}
+
 func (h *handler) handleCONNECT(w http.ResponseWriter, r *http.Request) {
 	host := r.RequestURI
 
 	if r.ProtoMajor == 2 {
-		host = r.Host
+		host = r.URL.Host
 	}
 
 	if !strings.Contains(host, ":") {
@@ -160,12 +156,7 @@ func (h *handler) handleCONNECT(w http.ResponseWriter, r *http.Request) {
 
 	if r.ProtoMajor == 1 {
 		// HTTP/1.1
-		hj, ok := w.(http.Hijacker)
+		hj, _ := w.(http.Hijacker)
-		if !ok {
-			w.WriteHeader(http.StatusNotFound)
-			return
-		}
-
 		conn1, _, _ := hj.Hijack()
 
 		fmt.Fprintf(conn1, "%s 200 connection established\r\n\r\n", r.Proto)
@@ -185,7 +176,7 @@ func (h *handler) handleCONNECT(w http.ResponseWriter, r *http.Request) {
 	defer conn.Close()
 
 	w.WriteHeader(http.StatusOK)
-	//w.(http.Flusher).Flush()
+	w.(http.Flusher).Flush()
 
 	ch := make(chan int, 2)
 	go func() {
@@ -194,7 +185,7 @@ func (h *handler) handleCONNECT(w http.ResponseWriter, r *http.Request) {
 	}()
 
 	go func() {
-		io.Copy(w, conn)
+		io.Copy(flushWriter{w}, conn)
 		ch <- 1
 	}()
 
@@ -249,107 +240,3 @@ func pipeAndClose(r1, r2 io.ReadWriteCloser) {
 
 	<-ch
 }
-
-func handleHTTPClient(c net.Conn, handler http.Handler) {
-	tlsconn := c.(*gnutls.Conn)
-	if err := tlsconn.Handshake(); err != nil {
-		log.Println(err)
-		return
-	}
-	state := tlsconn.ConnectionState()
-	if state.NegotiatedProtocol == "h2" {
-		h2conn, err := nghttp2.Server(tlsconn, handler)
-		if err != nil {
-			log.Println(err)
-		}
-		h2conn.Run()
-		h2conn = nil
-		return
-	}
-
-	defer c.Close()
-	r := bufio.NewReader(tlsconn)
-	buf := new(bytes.Buffer)
-	for {
-		req, err := http.ReadRequest(r)
-		if err != nil {
-			return
-		}
-		addr := tlsconn.RemoteAddr().String()
-		req.RemoteAddr = addr
-		rh := &responseHandler{
-			c:      tlsconn,
-			header: http.Header{},
-			buf:    buf,
-		}
-		handler.ServeHTTP(rh, req)
-		rh.Write(nil)
-		rh.buf.WriteTo(rh.c)
-		if req.Body != nil {
-			req.Body.Close()
-		}
-	}
-}
-
-type responseHandler struct {
-	c            net.Conn
-	statusCode   int
-	header       http.Header
-	responseSend bool
-	w            io.Writer
-	buf          *bytes.Buffer
-}
-
-func (r *responseHandler) WriteHeader(statusCode int) {
-	if r.responseSend {
-		return
-	}
-	r.buf.Reset()
-	r.statusCode = statusCode
-	cl := r.header.Get("content-length")
-	te := r.header.Get("transfer-encoding")
-	if cl == "" || te != "" {
-		if te == "" {
-			r.header.Set("transfer-encoding", "chunked")
-		}
-		r.w = &chunkWriter{r.buf}
-	} else {
-		r.w = r.buf
-	}
-	fmt.Fprintf(r.buf, "HTTP/1.1 %d %s\r\n", statusCode,
-		http.StatusText(statusCode))
-	for k, v := range r.header {
-		fmt.Fprintf(r.buf, "%s: %s\r\n", strings.Title(k), strings.Join(v, ","))
-	}
-	fmt.Fprintf(r.buf, "\r\n")
-	r.responseSend = true
-}
-
-func (r *responseHandler) Header() http.Header {
-	return r.header
-}
-
-func (r *responseHandler) Write(buf []byte) (int, error) {
-	if !r.responseSend {
-		r.WriteHeader(http.StatusOK)
-	}
-	n, err := r.w.Write(buf)
-	if r.buf.Len() > 2048 {
-		r.buf.WriteTo(r.c)
-	}
-	return n, err
-}
-
-var _ http.ResponseWriter = &responseHandler{}
-
-type chunkWriter struct {
-	w io.Writer
-}
-
-func (cw *chunkWriter) Write(buf []byte) (int, error) {
-	n := len(buf)
-	if n == 0 {
-		return fmt.Fprintf(cw.w, "0\r\n\r\n")
-	}
-	return fmt.Fprintf(cw.w, "%x\r\n%s\r\n", n, string(buf))
-}

http2_proxy.go

@@ -15,21 +15,30 @@ usage example
 */
 
 import (
+	"crypto/tls"
 	"flag"
 	"fmt"
+	"golang.org/x/net/http2"
 	"io"
+	"io/ioutil"
 	"log"
 	"net"
 	"net/http"
-	_ "net/http/pprof"
+	"net/http/httputil"
 	"os"
 	"sync"
 	"time"
-
-	"github.com/fangdingjun/gnutls"
-	"github.com/fangdingjun/nghttp2-go"
 )
 
+type clientConn struct {
+	host      string
+	port      string
+	hostname  string
+	transport *http2.Transport
+	conn      *http2.ClientConn
+	lock      *sync.Mutex
+}
+
 type timeoutConn struct {
 	net.Conn
 	timeout time.Duration
@@ -39,91 +48,25 @@ func (tc *timeoutConn) Read(b []byte) (n int, err error) {
 	if err = tc.Conn.SetReadDeadline(time.Now().Add(tc.timeout)); err != nil {
 		return 0, err
 	}
-	n, err = tc.Conn.Read(b)
+	return tc.Conn.Read(b)
-	//log.Printf("read %d bytes from network", n)
-	return
 }
 
 func (tc *timeoutConn) Write(b []byte) (n int, err error) {
 	if err = tc.Conn.SetWriteDeadline(time.Now().Add(tc.timeout)); err != nil {
 		return 0, err
 	}
-	n, err = tc.Conn.Write(b)
+	return tc.Conn.Write(b)
-	//log.Printf("write %d bytes to network", n)
-	return
 }
 
 type handler struct {
-	h2conn   *nghttp2.Conn
+	transport *http2.Transport
-	addr     string
-	hostname string
-	insecure bool
-	lock     *sync.Mutex
-}
-
-func (h *handler) createConnection() (*nghttp2.Conn, error) {
-	log.Println("create connection to ", h.addr)
-	c, err := net.DialTimeout("tcp", h.addr, 5*time.Second)
-	if err != nil {
-		return nil, err
-	}
-	conn, err := gnutls.Client(
-		&timeoutConn{c, 20 * time.Second},
-		&gnutls.Config{
-			ServerName:         h.hostname,
-			InsecureSkipVerify: h.insecure,
-			NextProtos:         []string{"h2"},
-		})
-	if err != nil {
-		return nil, err
-	}
-	if err := conn.Handshake(); err != nil {
-		return nil, err
-	}
-	client, err := nghttp2.Client(conn)
-	if err != nil {
-		return nil, err
-	}
-	return client, nil
-}
-
-func (h *handler) getConn() (*nghttp2.Conn, error) {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-
-	if h.h2conn != nil {
-		if h.h2conn.CanTakeNewRequest() {
-			return h.h2conn, nil
-		}
-		h.h2conn.Close()
-	}
-
-	for i := 0; i < 2; i++ {
-		h2conn, err := h.createConnection()
-		if err == nil {
-			h.h2conn = h2conn
-			return h2conn, nil
-		}
-	}
-	return nil, fmt.Errorf("create conn failed")
-}
-
-func (h *handler) checkError() {
-	h.lock.Lock()
-	defer h.lock.Unlock()
-
-	if h.h2conn == nil {
-		return
-	}
-
-	if err := h.h2conn.Error(); err != nil {
-		//log.Println("connection has error ", err)
-		h.h2conn.Close()
-		h.h2conn = nil
-	}
 }
 
 func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if debug {
+		req, _ := httputil.DumpRequest(r, false)
+		log.Printf("%s", string(req))
+	}
 
 	if r.Method == http.MethodConnect {
 		h.handleConnect(w, r)
@@ -133,38 +76,33 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *handler) handleConnect(w http.ResponseWriter, r *http.Request) {
-	var err error
+	pr, pw := io.Pipe()
-	var h2conn *nghttp2.Conn
-	var code int
-	//var resp *http.Response
 
-	var cs net.Conn
+	defer pr.Close()
+	defer pw.Close()
 
-	for i := 0; i < 2; i++ {
+	r.Body = ioutil.NopCloser(pr)
-		h2conn, err = h.getConn()
+	r.URL.Scheme = "https"
+
+	r.Header.Del("proxy-connection")
+
+	resp, err := h.transport.RoundTrip(r)
 	if err != nil {
-			log.Println("connection error ", err)
+		log.Printf("roundtrip: %s", err)
-			w.WriteHeader(http.StatusBadGateway)
+		w.WriteHeader(http.StatusServiceUnavailable)
+		fmt.Fprintf(w, "%s", err)
 		return
 	}
-		cs, code, err = h2conn.Connect(r.RequestURI)
-		if cs != nil {
-			break
-		}
-		h.checkError()
-	}
 
-	if err != nil || cs == nil {
+	defer resp.Body.Close()
-		log.Println("send connect error ", err)
+
-		h.checkError()
+	if debug {
-		w.WriteHeader(http.StatusBadGateway)
+		d, _ := httputil.DumpResponse(resp, false)
-		return
+		log.Printf("%s", string(d))
 	}
 
-	defer cs.Close()
+	if resp.StatusCode != http.StatusOK {
-	if code != http.StatusOK {
+		w.WriteHeader(resp.StatusCode)
-		log.Println("code", code)
-		w.WriteHeader(code)
 		return
 	}
 
@@ -182,12 +120,12 @@ func (h *handler) handleConnect(w http.ResponseWriter, r *http.Request) {
 	ch := make(chan struct{}, 2)
 
 	go func() {
-		io.Copy(cs, c)
+		io.Copy(pw, c)
 		ch <- struct{}{}
 	}()
 
 	go func() {
-		io.Copy(c, cs)
+		io.Copy(c, resp.Body)
 		ch <- struct{}{}
 	}()
 
@@ -195,42 +133,19 @@ func (h *handler) handleConnect(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *handler) handleHTTP(w http.ResponseWriter, r *http.Request) {
-	var err error
+	resp, err := h.transport.RoundTrip(r)
-	var resp *http.Response
-	var h2conn *nghttp2.Conn
-
-	if r.RequestURI[0] == '/' {
-		http.DefaultServeMux.ServeHTTP(w, r)
-		return
-	}
-
-	for i := 0; i < 2; i++ {
-		h2conn, err = h.getConn()
 	if err != nil {
-			//log.Println("create connection ", err)
+		log.Println(err)
-			w.WriteHeader(http.StatusBadGateway)
-			return
-		}
-		resp, err = h2conn.RoundTrip(r)
-		if resp != nil {
-			break
-		}
-		h.checkError()
-	}
-
-	if err != nil || resp == nil {
-		log.Println("create request error ", err)
-		h.checkError()
 		w.WriteHeader(http.StatusServiceUnavailable)
 		fmt.Fprintf(w, "%s", err)
 		return
 	}
+	defer resp.Body.Close()
 
-	defer func() {
+	if debug {
-		if resp.Body != nil {
+		d, _ := httputil.DumpResponse(resp, false)
-			resp.Body.Close()
+		log.Printf("%s", string(d))
 	}
-	}()
 
 	hdr := w.Header()
 	for k, v := range resp.Header {
@@ -243,7 +158,73 @@ func (h *handler) handleHTTP(w http.ResponseWriter, r *http.Request) {
 	io.Copy(w, resp.Body)
 }
 
+func newClientConn(host string, port string, hostname string, t *http2.Transport) *clientConn {
+	return &clientConn{
+		host:      host,
+		port:      port,
+		hostname:  hostname,
+		transport: t,
+		lock:      new(sync.Mutex),
+	}
+}
+
+func (p *clientConn) GetClientConn(req *http.Request, addr string) (*http2.ClientConn, error) {
+	p.lock.Lock()
+	defer p.lock.Unlock()
+
+	if p.conn != nil && p.conn.CanTakeNewRequest() {
+		return p.conn, nil
+	}
+
+	if debug {
+		log.Printf("dial to %s:%s", p.host, p.port)
+	}
+
+	c, err := net.Dial("tcp", net.JoinHostPort(p.host, p.port))
+	if err != nil {
+		log.Println(err)
+		return nil, err
+	}
+
+	cc := &timeoutConn{c, time.Duration(idleTimeout) * time.Second}
+	config := &tls.Config{
+		ServerName:         p.hostname,
+		NextProtos:         []string{"h2"},
+		InsecureSkipVerify: insecure,
+	}
+
+	conn := tls.Client(cc, config)
+	if err := conn.Handshake(); err != nil {
+		log.Println(err)
+		return nil, err
+	}
+
+	http2conn, err := p.transport.NewClientConn(conn)
+	if err != nil {
+		conn.Close()
+		log.Println(err)
+		return nil, err
+	}
+
+	p.conn = http2conn
+
+	return http2conn, err
+}
+
+func (p *clientConn) MarkDead(conn *http2.ClientConn) {
+	//p.lock.Lock()
+	//defer p.lock.Unlock()
+
+	if debug {
+		log.Println("mark dead")
+	}
+
+	//p.conn = nil
+}
+
+var debug bool
 var insecure bool
+var idleTimeout int
 
 func main() {
 	var addr string
@@ -252,7 +233,9 @@ func main() {
 	flag.StringVar(&addr, "server", "", "server address")
 	flag.StringVar(&hostname, "name", "", "server 's SNI name")
 	flag.StringVar(&listen, "listen", ":8080", "listen address")
+	flag.BoolVar(&debug, "debug", false, "verbose mode")
 	flag.BoolVar(&insecure, "insecure", false, "insecure mode, not verify the server's certificate")
+	flag.IntVar(&idleTimeout, "idletime", 30, "idle timeout, close connection when no data transfer")
 	flag.Parse()
 
 	if addr == "" {
@@ -260,25 +243,31 @@ func main() {
 		os.Exit(-1)
 	}
 
-	host, _, err := net.SplitHostPort(addr)
+	host, port, err := net.SplitHostPort(addr)
 	if err != nil {
 		host = addr
-		addr = fmt.Sprintf("%s:443", addr)
+		port = "443"
 	}
 
 	if hostname == "" {
 		hostname = host
 	}
 
+	transport := &http2.Transport{
+		AllowHTTP: true,
+	}
+
+	p := newClientConn(host, port, hostname, transport)
+	transport.ConnPool = p
+
 	log.Printf("listen on %s", listen)
 
-	hdr := &handler{
+	if debug {
-		addr:     addr,
+		log.Printf("use parent proxy https://%s:%s/", host, port)
-		hostname: hostname,
+		log.Printf("server SNI name %s", hostname)
-		insecure: insecure,
-		lock:     new(sync.Mutex),
 	}
-	if err := http.ListenAndServe(listen, hdr); err != nil {
+
+	if err := http.ListenAndServe(listen, &handler{transport}); err != nil {
 		log.Fatal(err)
 	}
 }

routers.go

@@ -1,7 +1,12 @@
 package main
 
 import (
+	"crypto/tls"
 	"fmt"
+	auth "github.com/fangdingjun/go-http-auth"
+	"github.com/fangdingjun/gofast"
+	loghandler "github.com/gorilla/handlers"
+	"github.com/gorilla/mux"
 	"io"
 	"log"
 	"net"
@@ -10,14 +15,9 @@ import (
 	"net/url"
 	"os"
 	"regexp"
-	"strings"
 	"sync"
-
+	//"path/filepath"
-	"github.com/fangdingjun/gnutls"
+	"strings"
-	auth "github.com/fangdingjun/go-http-auth"
-	"github.com/fangdingjun/gofast"
-	loghandler "github.com/gorilla/handlers"
-	"github.com/gorilla/mux"
 )
 
 type logwriter struct {
@@ -34,6 +34,7 @@ func (lw *logwriter) Write(buf []byte) (int, error) {
 func initRouters(cfg conf) {
 
 	logout := os.Stdout
+
 	if logfile != "" {
 		fp, err := os.OpenFile(logfile, os.O_APPEND|os.O_WRONLY|os.O_CREATE, 0644)
 		if err != nil {
@@ -48,7 +49,7 @@ func initRouters(cfg conf) {
 	for _, l := range cfg {
 		router := mux.NewRouter()
 		domains := []string{}
-		certs := []*gnutls.Certificate{}
+		certs := []tls.Certificate{}
 
 		// initial virtual host
 		for _, h := range l.Vhost {
@@ -58,7 +59,7 @@ func initRouters(cfg conf) {
 			}
 			domains = append(domains, h2)
 			if h.Cert != "" && h.Key != "" {
-				if cert, err := gnutls.LoadX509KeyPair(h.Cert, h.Key); err == nil {
+				if cert, err := tls.LoadX509KeyPair(h.Cert, h.Key); err == nil {
 					certs = append(certs, cert)
 				} else {
 					log.Fatal(err)
@@ -127,36 +128,27 @@ func initRouters(cfg conf) {
 			}
 
 			if len(certs) > 0 {
-				tlsconfig := &gnutls.Config{
+				tlsconfig := &tls.Config{
 					Certificates: certs,
-					NextProtos:   []string{"h2", "http/1.1"},
-				}
-				listener, err := gnutls.Listen("tcp", addr, tlsconfig)
-				if err != nil {
-					log.Fatal(err)
 				}
 
-				handler := loghandler.CombinedLoggingHandler(w, hdlr)
+				tlsconfig.BuildNameToCertificate()
-				//handler := hdlr
+
-				log.Printf("listen https on %s", addr)
+				srv := http.Server{
-				go func() {
+					Addr:      addr,
-					defer listener.Close()
+					TLSConfig: tlsconfig,
-					for {
+					Handler:   loghandler.CombinedLoggingHandler(w, hdlr),
-						conn, err := listener.Accept()
-						if err != nil {
-							log.Println(err)
-							break
 				}
-						go handleHTTPClient(conn, handler)
+				log.Printf("listen https on %s", addr)
+				if err := srv.ListenAndServeTLS("", ""); err != nil {
+					log.Fatal(err)
 				}
-				}()
 
 			} else {
 				log.Printf("listen http on %s", addr)
-				handler := loghandler.CombinedLoggingHandler(w, hdlr)
-				//handler := hdlr
 				if err := http.ListenAndServe(
-					addr, handler,
+					addr,
+					loghandler.CombinedLoggingHandler(w, hdlr),
 				); err != nil {
 					log.Fatal(err)
 				}