Kyle Isom
97909b7fbc
New internal/l7 package implements TLS termination and HTTP/2 reverse proxying for L7 routes. The proxy terminates the client TLS connection using per-route certificates, then forwards HTTP/2 traffic to backends over h2c (plaintext HTTP/2) or h2 (re-encrypted TLS). PrefixConn replays the peeked ClientHello bytes into crypto/tls.Server so the TLS handshake sees the complete ClientHello despite SNI extraction having already read it. Serve() is the L7 entry point: TLS handshake with route certificate, ALPN negotiation (h2 preferred, HTTP/1.1 fallback), then HTTP reverse proxy via httputil.ReverseProxy. Backend transport uses h2c by default (AllowHTTP + plain TCP dial) or h2-over-TLS when backend_tls is set. Forwarding headers (X-Forwarded-For, X-Forwarded-Proto, X-Real-IP) are injected from the real client IP in the Rewrite function. PROXY protocol v2 is sent to backends when send_proxy_protocol is enabled, using the request context to carry the client address through the HTTP/2 transport's dial function. Server integration: handleConn dispatches to handleL7 when route.Mode is "l7". The L7 handler converts RouteInfo to l7.RouteConfig and delegates to l7.Serve. L7 package tests: PrefixConn (4 tests), h2c backend round-trip, forwarding header injection, backend unreachable (502), multiple HTTP/2 requests over one connection. Server integration tests: L7 route through full server pipeline with TLS client, mixed L4+L7 routes on the same listener verifying both paths work independently. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
67 lines
2.9 KiB
Markdown
67 lines
2.9 KiB
Markdown
# PROGRESS.md
|
|
|
|
Tracks implementation status against PROJECT_PLAN.md. Updated as work
|
|
proceeds. Each item is marked:
|
|
|
|
- `[ ]` not started
|
|
- `[~]` in progress
|
|
- `[x]` complete
|
|
- `[—]` skipped (with reason)
|
|
|
|
---
|
|
|
|
## Phase 1: Database & Config Foundation
|
|
|
|
- [x] 1.1 Config struct updates (`Listener.ProxyProtocol`, `Route.Mode/TLSCert/TLSKey/BackendTLS/SendProxyProtocol`)
|
|
- [x] 1.2 Config validation updates (L7 requires cert/key, mode enum, cert/key pair loading)
|
|
- [x] 1.3 Database migration v2 (new columns on `listeners` and `routes`)
|
|
- [x] 1.4 DB struct and CRUD updates (new fields in `Listener`, `Route`, all queries)
|
|
- [x] 1.5 Server data loading (`RouteInfo` struct replaces bare backend string in route lookup)
|
|
- [x] 1.6 Tests (config, DB migration, CRUD, server unchanged)
|
|
|
|
## Phase 2: PROXY Protocol
|
|
|
|
- [x] 2.1 `internal/proxyproto/` package (v1/v2 parser, v2 writer)
|
|
- [x] 2.2 Server integration — receive (parse PROXY header before firewall on enabled listeners)
|
|
- [x] 2.3 Server integration — send on L4 (write PROXY v2 header before ClientHello on enabled routes)
|
|
- [x] 2.4 Tests (receive, send, firewall uses real IP, malformed header rejection)
|
|
|
|
## Phase 3: L7 Proxying
|
|
|
|
- [x] 3.1 `internal/l7/` package (`PrefixConn`, HTTP/2 reverse proxy with h2c, `Serve` entry point)
|
|
- [x] 3.2 Server integration (dispatch to L4 or L7 based on `route.Mode` in `handleConn`)
|
|
- [x] 3.3 PROXY protocol sending in L7 path
|
|
- [x] 3.4 Tests (TLS termination, h2c backend, re-encrypt, mixed L4/L7 listener, gRPC through L7)
|
|
|
|
## Phase 4: gRPC API & CLI Updates
|
|
|
|
- [ ] 4.1 Proto updates (new fields on `Route`, `AddRouteRequest`, `ListenerStatus`)
|
|
- [ ] 4.2 gRPC server updates (accept/validate/persist new route fields)
|
|
- [ ] 4.3 Client package updates (new fields on `Route`, `ListenerStatus`)
|
|
- [ ] 4.4 mcproxyctl updates (flags for `routes add`, display in `routes list`)
|
|
- [ ] 4.5 Tests (gRPC round-trip with new fields, backward compatibility)
|
|
|
|
## Phase 5: Integration & Polish
|
|
|
|
- [ ] 5.1 Dev config update (`srv/mc-proxy.toml` with L7 routes, test certs)
|
|
- [ ] 5.2 Multi-hop integration test (edge→origin via PROXY protocol)
|
|
- [ ] 5.3 gRPC-through-L7 validation (unary, streaming, trailers, deadlines)
|
|
- [ ] 5.4 Web UI through L7 validation (HTTP/1.1, HTTP/2, static assets)
|
|
- [ ] 5.5 Documentation (verify ARCHITECTURE.md, CLAUDE.md, Makefile)
|
|
|
|
---
|
|
|
|
## Current State
|
|
|
|
The codebase is L4-only. All existing functionality is working and tested:
|
|
|
|
- SNI extraction and raw TCP relay
|
|
- Global firewall (IP, CIDR, GeoIP country blocking, per-IP rate limiting)
|
|
- SQLite persistence with write-through pattern
|
|
- gRPC admin API (Unix socket) for route and firewall CRUD
|
|
- CLI tools (`mc-proxy server/status/snapshot`, `mcproxyctl`)
|
|
- `make all` passes (vet, lint, test, build)
|
|
|
|
ARCHITECTURE.md and CLAUDE.md have been updated to describe the target state.
|
|
PROJECT_PLAN.md describes the implementation path. This file tracks progress.
|