cloudflared-mirror/cmd/cloudflared/tunnel/ingress.go

package tunnel

import (
	"fmt"
	"io/ioutil"
	"net/url"
	"regexp"
	"strings"

	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
	"github.com/cloudflare/cloudflared/logger"

	"github.com/pkg/errors"
	"github.com/urfave/cli/v2"
	"gopkg.in/yaml.v2"
)

var (
	errNoIngressRules      = errors.New("No ingress rules were specified in the config file")
	errLastRuleNotCatchAll = errors.New("The last ingress rule must match all hostnames (i.e. it must be missing, or must be \"*\")")
	errBadWildcard         = errors.New("Hostname patterns can have at most one wildcard character (\"*\") and it can only be used for subdomains, e.g. \"*.example.com\"")
	errNoIngressRulesMatch = errors.New("The URL didn't match any ingress rules")
)

// Each rule route traffic from a hostname/path on the public
// internet to the service running on the given URL.
type rule struct {
	// Requests for this hostname will be proxied to this rule's service.
	Hostname string

	// Path is an optional regex that can specify path-driven ingress rules.
	Path *regexp.Regexp

	// A (probably local) address. Requests for a hostname which matches this
	// rule's hostname pattern will be proxied to the service running on this
	// address.
	Service *url.URL
}

func (r rule) String() string {
	var out strings.Builder
	if r.Hostname != "" {
		out.WriteString("\thostname: ")
		out.WriteString(r.Hostname)
		out.WriteRune('\n')
	}
	if r.Path != nil {
		out.WriteString("\tpath: ")
		out.WriteString(r.Path.String())
		out.WriteRune('\n')
	}
	out.WriteString("\tservice: ")
	out.WriteString(r.Service.String())
	return out.String()
}

func (r rule) matches(requestURL *url.URL) bool {
	hostMatch := r.Hostname == "" || r.Hostname == "*" || matchHost(r.Hostname, requestURL.Hostname())
	pathMatch := r.Path == nil || r.Path.MatchString(requestURL.Path)
	return hostMatch && pathMatch
}

func matchHost(ruleHost, reqHost string) bool {
	if ruleHost == reqHost {
		return true
	}

	// Validate hostnames that use wildcards at the start
	if strings.HasPrefix(ruleHost, "*.") {
		toMatch := strings.TrimPrefix(ruleHost, "*.")
		return strings.HasSuffix(reqHost, toMatch)
	}
	return false
}

type unvalidatedRule struct {
	Hostname string
	Path     string
	Service  string
}

type ingress struct {
	Ingress []unvalidatedRule
}

func (ing ingress) validate() ([]rule, error) {
	rules := make([]rule, len(ing.Ingress))
	for i, r := range ing.Ingress {
		service, err := url.Parse(r.Service)
		if err != nil {
			return nil, err
		}

		// Ensure that there are no wildcards anywhere except the first character
		// of the hostname.
		if strings.LastIndex(r.Hostname, "*") > 0 {
			return nil, errBadWildcard
		}

		// The last rule should catch all hostnames.
		isCatchAllRule := (r.Hostname == "" || r.Hostname == "*") && r.Path == ""
		isLastRule := i == len(ing.Ingress)-1
		if isLastRule && !isCatchAllRule {
			return nil, errLastRuleNotCatchAll
		}
		// ONLY the last rule should catch all hostnames.
		if !isLastRule && isCatchAllRule {
			return nil, errRuleShouldNotBeCatchAll{i: i, hostname: r.Hostname}
		}

		var pathRegex *regexp.Regexp
		if r.Path != "" {
			pathRegex, err = regexp.Compile(r.Path)
			if err != nil {
				return nil, errors.Wrapf(err, "Rule #%d has an invalid regex", i+1)
			}
		}

		rules[i] = rule{
			Hostname: r.Hostname,
			Service:  service,
			Path:     pathRegex,
		}
	}
	return rules, nil
}

type errRuleShouldNotBeCatchAll struct {
	i        int
	hostname string
}

func (e errRuleShouldNotBeCatchAll) Error() string {
	return fmt.Sprintf("Rule #%d is matching the hostname '%s', but "+
		"this will match every hostname, meaning the rules which follow it "+
		"will never be triggered.", e.i+1, e.hostname)
}

func parseIngress(rawYAML []byte) ([]rule, error) {
	var ing ingress
	if err := yaml.Unmarshal(rawYAML, &ing); err != nil {
		return nil, err
	}
	if len(ing.Ingress) == 0 {
		return nil, errNoIngressRules
	}
	return ing.validate()
}

func ingressContext(c *cli.Context) ([]rule, *logger.OutputWriter, error) {
	log, err := createLogger(c, false, false)
	if err != nil {
		return nil, nil, err
	}
	configFilePath := c.String("config")
	if configFilePath == "" {
		return nil, nil, config.ErrNoConfigFile
	}
	log.Infof("Validating %s", configFilePath)
	configBytes, err := ioutil.ReadFile(configFilePath)
	if err != nil {
		return nil, nil, err
	}
	rules, err := parseIngress(configBytes)
	return rules, log, err
}

// Validates the ingress rules in the cloudflared config file
func validateCommand(c *cli.Context) error {
	_, log, err := ingressContext(c)
	if err != nil {
		log.Error(err.Error())
		return errors.New("Validation failed")
	}
	log.Infof("OK")
	return nil
}

func buildValidateCommand() *cli.Command {
	return &cli.Command{
		Name:        "validate",
		Action:      cliutil.ErrorHandler(validateCommand),
		Usage:       "Validate the ingress configuration ",
		UsageText:   "cloudflared tunnel [--config FILEPATH] ingress validate",
		Description: "Validates the configuration file, ensuring your ingress rules are OK.",
	}
}

// Checks which ingress rule matches the given URL.
func ruleCommand(c *cli.Context) error {
	rules, log, err := ingressContext(c)
	if err != nil {
		return err
	}
	requestArg := c.Args().First()
	if requestArg == "" {
		return errors.New("cloudflared tunnel rule expects a single argument, the URL to test")
	}
	requestURL, err := url.Parse(requestArg)
	if err != nil {
		return fmt.Errorf("%s is not a valid URL", requestArg)
	}
	if requestURL.Hostname() == "" {
		return fmt.Errorf("%s is malformed and doesn't have a hostname", requestArg)
	}
	for i, r := range rules {
		if r.matches(requestURL) {
			log.Infof("Matched rule #%d", i+1)
			fmt.Println(r.String())
			return nil
		}
	}
	return errNoIngressRulesMatch
}

func buildRuleCommand() *cli.Command {
	return &cli.Command{
		Name:      "rule",
		Action:    cliutil.ErrorHandler(ruleCommand),
		Usage:     "Check which ingress rule matches a given request URL",
		UsageText: "cloudflared [--config CONFIGFILE] tunnel ingress rule URL",
		ArgsUsage: "URL",
		Description: "Check which ingress rule matches a given request URL. " +
			"Ingress rules match a request's hostname and path. Hostname is " +
			"optional and is either a full hostname like `www.example.com` or a " +
			"hostname with a `*` for its subdomains, e.g. `*.example.com`. Path " +
			"is optional and matches a regular expression, like `/[a-zA-Z0-9_]+.html`",
	}
}