Add Http2Origin option to force HTTP/2 origin connections

If `http2Origin` is set, it will set `ForceAttemptHTTP2` in the transport config of the `OriginService`.
This commit is contained in:
Niklas Rehfeld 2022-06-01 12:51:59 +12:00
parent 4b6437cc60
commit 7d4afd4ae0
5 changed files with 22 additions and 1 deletions

View File

@ -821,6 +821,13 @@ func configureProxyFlags(shouldHide bool) []cli.Flag {
EnvVars: []string{"TUNNEL_NO_CHUNKED_ENCODING"}, EnvVars: []string{"TUNNEL_NO_CHUNKED_ENCODING"},
Hidden: shouldHide, Hidden: shouldHide,
}), }),
altsrc.NewBoolFlag(&cli.BoolFlag{
Name: ingress.Http2OriginFlag,
Usage: "Enables HTTP/2 origin servers.",
EnvVars: []string{"TUNNEL_ORIGIN_ENABLE_HTTP2"},
Hidden: shouldHide,
Value: false,
}),
} }
return append(flags, sshFlags(shouldHide)...) return append(flags, sshFlags(shouldHide)...)
} }

View File

@ -227,6 +227,8 @@ type OriginRequestConfig struct {
ProxyType *string `yaml:"proxyType" json:"proxyType,omitempty"` ProxyType *string `yaml:"proxyType" json:"proxyType,omitempty"`
// IP rules for the proxy service // IP rules for the proxy service
IPRules []IngressIPRule `yaml:"ipRules" json:"ipRules,omitempty"` IPRules []IngressIPRule `yaml:"ipRules" json:"ipRules,omitempty"`
// Attempt to connect to origin with HTTP/2
Http2Origin *bool `yaml:"http2Origin" json:"http2Origin,omitempty"`
} }
type IngressIPRule struct { type IngressIPRule struct {

View File

@ -139,7 +139,8 @@ var rawConfig = []byte(`
"ports": [443, 4443], "ports": [443, 4443],
"allow": true "allow": true
} }
] ],
"http2Origin": true
} }
`) `)
@ -188,6 +189,7 @@ func assertConfig(
assert.Equal(t, true, *config.NoTLSVerify) assert.Equal(t, true, *config.NoTLSVerify)
assert.Equal(t, uint(9000), *config.ProxyPort) assert.Equal(t, uint(9000), *config.ProxyPort)
assert.Equal(t, "socks", *config.ProxyType) assert.Equal(t, "socks", *config.ProxyType)
assert.Equal(t, true, *config.Http2Origin)
privateV4 := "10.0.0.0/8" privateV4 := "10.0.0.0/8"
privateV6 := "fc00::/7" privateV6 := "fc00::/7"

View File

@ -35,6 +35,7 @@ const (
NoChunkedEncodingFlag = "no-chunked-encoding" NoChunkedEncodingFlag = "no-chunked-encoding"
ProxyAddressFlag = "proxy-address" ProxyAddressFlag = "proxy-address"
ProxyPortFlag = "proxy-port" ProxyPortFlag = "proxy-port"
Http2OriginFlag = "http2-origin"
) )
const ( const (
@ -93,6 +94,7 @@ func originRequestFromSingeRule(c *cli.Context) OriginRequestConfig {
var proxyAddress = defaultProxyAddress var proxyAddress = defaultProxyAddress
var proxyPort uint var proxyPort uint
var proxyType string var proxyType string
var http2Origin bool
if flag := ProxyConnectTimeoutFlag; c.IsSet(flag) { if flag := ProxyConnectTimeoutFlag; c.IsSet(flag) {
connectTimeout = config.CustomDuration{Duration: c.Duration(flag)} connectTimeout = config.CustomDuration{Duration: c.Duration(flag)}
} }
@ -136,9 +138,13 @@ func originRequestFromSingeRule(c *cli.Context) OriginRequestConfig {
// Note TUN-3758 , we use Int because UInt is not supported with altsrc // Note TUN-3758 , we use Int because UInt is not supported with altsrc
proxyPort = uint(c.Int(flag)) proxyPort = uint(c.Int(flag))
} }
if flag := Http2OriginFlag; c.IsSet(flag) {
http2Origin = c.Bool(flag)
}
if c.IsSet(Socks5Flag) { if c.IsSet(Socks5Flag) {
proxyType = socksProxy proxyType = socksProxy
} }
return OriginRequestConfig{ return OriginRequestConfig{
ConnectTimeout: connectTimeout, ConnectTimeout: connectTimeout,
TLSTimeout: tlsTimeout, TLSTimeout: tlsTimeout,
@ -155,6 +161,7 @@ func originRequestFromSingeRule(c *cli.Context) OriginRequestConfig {
ProxyAddress: proxyAddress, ProxyAddress: proxyAddress,
ProxyPort: proxyPort, ProxyPort: proxyPort,
ProxyType: proxyType, ProxyType: proxyType,
Http2Origin: http2Origin,
} }
} }
@ -263,6 +270,8 @@ type OriginRequestConfig struct {
ProxyType string `yaml:"proxyType" json:"proxyType"` ProxyType string `yaml:"proxyType" json:"proxyType"`
// IP rules for the proxy service // IP rules for the proxy service
IPRules []ipaccess.Rule `yaml:"ipRules" json:"ipRules"` IPRules []ipaccess.Rule `yaml:"ipRules" json:"ipRules"`
// Attempt to connect to origin with HTTP/2
Http2Origin bool `yaml:"http2Origin" json:"http2Origin"`
} }
func (defaults *OriginRequestConfig) setConnectTimeout(overrides config.OriginRequestConfig) { func (defaults *OriginRequestConfig) setConnectTimeout(overrides config.OriginRequestConfig) {

View File

@ -291,6 +291,7 @@ func newHTTPTransport(service OriginService, cfg OriginRequestConfig, log *zerol
TLSHandshakeTimeout: cfg.TLSTimeout.Duration, TLSHandshakeTimeout: cfg.TLSTimeout.Duration,
ExpectContinueTimeout: 1 * time.Second, ExpectContinueTimeout: 1 * time.Second,
TLSClientConfig: &tls.Config{RootCAs: originCertPool, InsecureSkipVerify: cfg.NoTLSVerify}, TLSClientConfig: &tls.Config{RootCAs: originCertPool, InsecureSkipVerify: cfg.NoTLSVerify},
ForceAttemptHTTP2: cfg.Http2Origin,
} }
if _, isHelloWorld := service.(*helloWorld); !isHelloWorld && cfg.OriginServerName != "" { if _, isHelloWorld := service.(*helloWorld); !isHelloWorld && cfg.OriginServerName != "" {
httpTransport.TLSClientConfig.ServerName = cfg.OriginServerName httpTransport.TLSClientConfig.ServerName = cfg.OriginServerName