Kyle Isom
97909b7fbc
New internal/l7 package implements TLS termination and HTTP/2 reverse proxying for L7 routes. The proxy terminates the client TLS connection using per-route certificates, then forwards HTTP/2 traffic to backends over h2c (plaintext HTTP/2) or h2 (re-encrypted TLS). PrefixConn replays the peeked ClientHello bytes into crypto/tls.Server so the TLS handshake sees the complete ClientHello despite SNI extraction having already read it. Serve() is the L7 entry point: TLS handshake with route certificate, ALPN negotiation (h2 preferred, HTTP/1.1 fallback), then HTTP reverse proxy via httputil.ReverseProxy. Backend transport uses h2c by default (AllowHTTP + plain TCP dial) or h2-over-TLS when backend_tls is set. Forwarding headers (X-Forwarded-For, X-Forwarded-Proto, X-Real-IP) are injected from the real client IP in the Rewrite function. PROXY protocol v2 is sent to backends when send_proxy_protocol is enabled, using the request context to carry the client address through the HTTP/2 transport's dial function. Server integration: handleConn dispatches to handleL7 when route.Mode is "l7". The L7 handler converts RouteInfo to l7.RouteConfig and delegates to l7.Serve. L7 package tests: PrefixConn (4 tests), h2c backend round-trip, forwarding header injection, backend unreachable (502), multiple HTTP/2 requests over one connection. Server integration tests: L7 route through full server pipeline with TLS client, mixed L4+L7 routes on the same listener verifying both paths work independently. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
29 lines
802 B
Go
29 lines
802 B
Go
package l7
|
|
|
|
import "net"
|
|
|
|
// PrefixConn wraps a net.Conn, prepending buffered bytes before reading
|
|
// from the underlying connection. This is used to replay the TLS ClientHello
|
|
// bytes that were peeked during SNI extraction back into crypto/tls.Server.
|
|
type PrefixConn struct {
|
|
net.Conn
|
|
prefix []byte
|
|
off int
|
|
}
|
|
|
|
// NewPrefixConn creates a PrefixConn that returns prefix bytes first,
|
|
// then reads from the underlying conn.
|
|
func NewPrefixConn(conn net.Conn, prefix []byte) *PrefixConn {
|
|
return &PrefixConn{Conn: conn, prefix: prefix}
|
|
}
|
|
|
|
// Read returns buffered prefix bytes first, then reads from the underlying conn.
|
|
func (pc *PrefixConn) Read(b []byte) (int, error) {
|
|
if pc.off < len(pc.prefix) {
|
|
n := copy(b, pc.prefix[pc.off:])
|
|
pc.off += n
|
|
return n, nil
|
|
}
|
|
return pc.Conn.Read(b)
|
|
}
|