diff --git a/blacktip.go b/blacktip.go index d6446f7..2db922c 100644 --- a/blacktip.go +++ b/blacktip.go @@ -114,6 +114,7 @@ type Blacktip struct { logq chan model.LogEntry reportMu sync.Mutex updating atomic.Bool + addrSig string // machine addresses a wildcard website was spread across, "" when none was updateMsg string // outcome of the update Hammerhead asked for, reported back updateID string // the request that updateMsg answers updStage string // progress of the running update, reported to Hammerhead @@ -247,6 +248,50 @@ func (b *Blacktip) fetchConfig(ctx context.Context) (*model.EdgeConfig, error) { return &cfg, json.NewDecoder(resp.Body).Decode(&cfg) } +// hostIPv4 lists every IPv4 address on this machine, loopback included: what a wildcard bind covers. +func hostIPv4() []string { + var ips []string + addrs, _ := net.InterfaceAddrs() + for _, a := range addrs { + if ipn, ok := a.(*net.IPNet); ok && ipn.IP.To4() != nil { + ips = append(ips, ipn.IP.String()) + } + } + sort.Strings(ips) + return ips +} + +// bindIPs says which addresses a mapping listens on. Normally that is its own BindIP. A website on +// 0.0.0.0 steps aside for websites of the same kind that name an address on the same port: it then +// listens on the machine's other addresses only, so a wildcard never takes a port from a specific IP. +func bindIPs(m model.Mapping, all []model.Mapping) []string { + if !model.Web(m.Proto) { + return []string{m.BindIP} + } + if ip := net.ParseIP(m.BindIP); ip == nil || !ip.IsUnspecified() { + return []string{m.BindIP} + } + named := map[string]bool{} + for _, o := range all { + if o.ID == m.ID || o.Proto != m.Proto || o.Port != m.Port { + continue + } + if ip := net.ParseIP(o.BindIP); ip != nil && !ip.IsUnspecified() { + named[ip.String()] = true + } + } + if len(named) == 0 { + return []string{m.BindIP} + } + var out []string + for _, ip := range hostIPv4() { + if !named[ip] { + out = append(out, ip) + } + } + return out +} + func listenKey(m model.Mapping) string { n := "tcp" if m.Proto == model.ProtoUDP { @@ -311,23 +356,27 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) { continue } // a range opens one listener per port; each shifts the target port by its offset - for p := m.Port; p <= m.LastPort(); p++ { - mm := m - mm.Port = p - k := listenKey(mm) - if want[k] == nil { - want[k] = &bindSet{off: p - m.Port} + for _, ip := range bindIPs(m, cfg.Mappings) { + for p := m.Port; p <= m.LastPort(); p++ { + mm := m + mm.BindIP, mm.Port = ip, p + k := listenKey(mm) + if want[k] == nil { + want[k] = &bindSet{off: p - m.Port} + } + want[k].ms = append(want[k].ms, b.maps[m.ID]) } - want[k].ms = append(want[k].ms, b.maps[m.ID]) } } // https ports can also answer on :80 with a redirect, unless something else owns that port redirects := map[string][]*mapState{} for _, m := range cfg.Mappings { if b.tr == nil && m.Proto == model.ProtoHTTPS && m.RedirectHTTP { - k := "tcp|" + net.JoinHostPort(m.BindIP, "80") - if _, taken := want[k]; !taken { - redirects[k] = append(redirects[k], b.maps[m.ID]) + for _, ip := range bindIPs(m, cfg.Mappings) { + k := "tcp|" + net.JoinHostPort(ip, "80") + if _, taken := want[k]; !taken { + redirects[k] = append(redirects[k], b.maps[m.ID]) + } } } } @@ -340,6 +389,13 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) { delete(b.listeners, k) } } + b.addrSig = "" + for _, m := range cfg.Mappings { + if ips := bindIPs(m, cfg.Mappings); len(ips) != 1 || ips[0] != m.BindIP { + b.addrSig = strings.Join(hostIPv4(), ",") + break + } + } b.status = map[string]string{} bring := func(k string, ms []*mapState, off int, redirect bool) { if l, ok := b.listeners[k]; ok { @@ -349,7 +405,9 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) { l.close() delete(b.listeners, k) } - l, err := b.open(ms, off, redirect) + _, addr, _ := strings.Cut(k, "|") + host, _, _ := net.SplitHostPort(addr) + l, err := b.open(host, ms, off, redirect) if err != nil { log.Printf("open %s: %v", k, err) if !redirect { @@ -376,7 +434,11 @@ func (b *Blacktip) apply(cfg *model.EdgeConfig) { bring(k, ms, 0, true) } if b.tr != nil { - b.tr.sync(b.ctx, webMaps, cfg.AcmeEmail, cfg.AcmeStages) + binds := map[string][]string{} + for _, ms := range webMaps { + binds[ms.m.ID] = bindIPs(ms.m, cfg.Mappings) + } + b.tr.sync(b.ctx, webMaps, binds, cfg.AcmeEmail, cfg.AcmeStages) if e := b.tr.err(); e != "" { for _, ms := range webMaps { b.status[ms.m.ID] = e @@ -585,10 +647,25 @@ func (b *Blacktip) reportLoop(ctx context.Context) { return case <-t.C: b.report() + b.recheckAddresses() } } } +// recheckAddresses re-applies the config when this machine gains or loses an address that a wildcard +// website is spread across, so the listeners follow the machine. +func (b *Blacktip) recheckAddresses() { + b.mu.Lock() + last, sig := b.last, b.addrSig + b.mu.Unlock() + if last == nil || sig == "" { + return + } + if strings.Join(hostIPv4(), ",") != sig { + b.apply(last) + } +} + // ---------- access logs ---------- func (b *Blacktip) logAccess(e model.LogEntry) { diff --git a/listener.go b/listener.go index 5b9042f..cb1b300 100644 --- a/listener.go +++ b/listener.go @@ -35,12 +35,12 @@ type listener struct { sessions map[string]*udpSession } -func (b *Blacktip) open(ms []*mapState, off int, redirect bool) (*listener, error) { +func (b *Blacktip) open(ip string, ms []*mapState, off int, redirect bool) (*listener, error) { m := ms[0].m - addr := net.JoinHostPort(m.BindIP, strconv.Itoa(m.Port+off)) + addr := net.JoinHostPort(ip, strconv.Itoa(m.Port+off)) l := &listener{b: b, kind: m.Proto, redirect: redirect, maps: ms, off: off, done: make(chan struct{}), sessions: map[string]*udpSession{}} if redirect { - addr = net.JoinHostPort(m.BindIP, "80") + addr = net.JoinHostPort(ip, "80") l.kind = model.ProtoHTTP } if m.Proto == model.ProtoUDP { diff --git a/traefik.go b/traefik.go index be9c05f..3e36f9f 100644 --- a/traefik.go +++ b/traefik.go @@ -49,7 +49,8 @@ type traefikMgr struct { stop context.CancelFunc // stops the current traefik process lastErr string maps map[string]*mapState - ports map[string]int // mapping ID -> relay port, kept stable across edits so Traefik's backend URL never changes + binds map[string][]string // mapping ID -> the addresses it listens on (a wildcard steps aside for named ones) + ports map[string]int // mapping ID -> relay port, kept stable across edits so Traefik's backend URL never changes dynBytes []byte } @@ -217,20 +218,23 @@ func hostRule(host string) (string, bool) { // sync rewrites Traefik's configuration for the given web mappings and // (re)starts the process if its static part changed. Called with b.mu held. -func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail string, staging bool) { +func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, binds map[string][]string, acmeEmail string, staging bool) { t.mu.Lock() defer t.mu.Unlock() + t.binds = binds t.maps = map[string]*mapState{} eps := map[string]string{} // name -> address needACME := false for _, ms := range maps { t.maps[ms.m.ID] = ms - eps[epName(ms.m.BindIP, ms.m.Port)] = net.JoinHostPort(ms.m.BindIP, strconv.Itoa(ms.m.Port)) + for _, ip := range t.bindsOf(ms.m) { + eps[epName(ip, ms.m.Port)] = net.JoinHostPort(ip, strconv.Itoa(ms.m.Port)) + if ms.m.Proto == model.ProtoHTTPS && ms.m.RedirectHTTP { + eps[epName(ip, 80)] = net.JoinHostPort(ip, "80") + } + } if ms.m.Proto == model.ProtoHTTPS { needACME = true - if ms.m.RedirectHTTP { - eps[epName(ms.m.BindIP, 80)] = net.JoinHostPort(ms.m.BindIP, "80") - } } } routers := map[string]any{} @@ -244,7 +248,11 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin continue } rule, wildcard := hostRule(m.Hostname) - ep := epName(m.BindIP, m.Port) + var mainEPs, redirEPs []string + for _, ip := range t.bindsOf(m) { + mainEPs = append(mainEPs, epName(ip, m.Port)) + redirEPs = append(redirEPs, epName(ip, 80)) + } prio := 5000 if wildcard { prio = 2000 @@ -274,7 +282,7 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin mws["host-"+m.ID] = map[string]any{"headers": map[string]any{"customRequestHeaders": map[string]string{"Host": m.RewriteHost}}} chain = append(chain, "host-"+m.ID) } - router := map[string]any{"rule": rule, "entryPoints": []string{ep}, "service": "s-" + m.ID, "middlewares": chain, "priority": prio} + router := map[string]any{"rule": rule, "entryPoints": mainEPs, "service": "s-" + m.ID, "middlewares": chain, "priority": prio} var tlsCfg map[string]any if m.Proto == model.ProtoHTTPS { tlsCfg = map[string]any{} @@ -292,7 +300,7 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin services["g-"+m.ID] = map[string]any{"loadBalancer": map[string]any{ "servers": []map[string]string{{"url": fmt.Sprintf("http://127.0.0.1:%d", t.gatePort)}}, "passHostHeader": true}} mws["gate-"+m.ID] = map[string]any{"headers": map[string]any{"customRequestHeaders": map[string]string{"X-Hammerhead-Mapping": m.ID}}} - g := map[string]any{"rule": rule + " && PathPrefix(`/.hammerhead/`)", "entryPoints": []string{ep}, "service": "g-" + m.ID, + g := map[string]any{"rule": rule + " && PathPrefix(`/.hammerhead/`)", "entryPoints": mainEPs, "service": "g-" + m.ID, "middlewares": []string{"gate-" + m.ID}, "priority": prio + 1000} if tlsCfg != nil { g["tls"] = tlsCfg @@ -305,7 +313,7 @@ func (t *traefikMgr) sync(ctx context.Context, maps []*mapState, acmeEmail strin redirPort = strconv.Itoa(m.Port) } mws["redir-"+m.ID] = map[string]any{"redirectScheme": map[string]any{"scheme": "https", "port": redirPort, "permanent": true}} - routers["r-"+m.ID] = map[string]any{"rule": rule, "entryPoints": []string{epName(m.BindIP, 80)}, "service": "noop@internal", + routers["r-"+m.ID] = map[string]any{"rule": rule, "entryPoints": redirEPs, "service": "noop@internal", "middlewares": []string{"redir-" + m.ID}, "priority": prio} } } @@ -545,10 +553,7 @@ func (t *traefikMgr) probeCerts(ctx context.Context) { t.mu.Unlock() changed := false for _, ms := range targets { - ip := ms.m.BindIP - if pip := net.ParseIP(ip); pip != nil && pip.IsUnspecified() { - ip = "127.0.0.1" - } + ip := t.probeAddr(ms.m) status := t.probeOne(net.JoinHostPort(ip, strconv.Itoa(ms.m.Port)), ms.m.Hostname) t.b.mu.Lock() if t.b.acme.certs == nil { @@ -598,3 +603,27 @@ func containsStr(list []string, s string) bool { } return false } + +// bindsOf is the addresses a web mapping listens on; t.mu is held, or the caller does not race sync. +func (t *traefikMgr) bindsOf(m model.Mapping) []string { + if ips := t.binds[m.ID]; len(ips) > 0 { + return ips + } + return []string{m.BindIP} +} + +// probeAddr picks an address on this machine to test a mapping's certificate through. +func (t *traefikMgr) probeAddr(m model.Mapping) string { + t.mu.Lock() + ips := t.bindsOf(m) + t.mu.Unlock() + for _, ip := range ips { + if ip == "127.0.0.1" { + return ip + } + } + if p := net.ParseIP(ips[0]); p != nil && p.IsUnspecified() { + return "127.0.0.1" + } + return ips[0] +} diff --git a/yield_test.go b/yield_test.go new file mode 100644 index 0000000..f335edc --- /dev/null +++ b/yield_test.go @@ -0,0 +1,37 @@ +package blacktip + +import ( + "testing" + + "git.veillax.com/Veillax/reef/model" +) + +func TestWildcardWebsitesStepAsideForNamedAddresses(t *testing.T) { + all := []model.Mapping{ + {ID: "a", Proto: model.ProtoHTTPS, BindIP: "0.0.0.0", Port: 443, Hostname: "a.test"}, + {ID: "b", Proto: model.ProtoHTTPS, BindIP: "127.0.0.1", Port: 443, Hostname: "b.test"}, + {ID: "c", Proto: model.ProtoHTTPS, BindIP: "0.0.0.0", Port: 8443, Hostname: "c.test"}, + {ID: "d", Proto: model.ProtoTCP, BindIP: "0.0.0.0", Port: 443}, + } + // the wildcard on 443 gives up the address that "b" names + for _, ip := range bindIPs(all[0], all) { + if ip == "127.0.0.1" { + t.Fatalf("wildcard still listens on 127.0.0.1: %v", bindIPs(all[0], all)) + } + } + // the named address keeps its own listener + if got := bindIPs(all[1], all); len(got) != 1 || got[0] != "127.0.0.1" { + t.Fatalf("named mapping: %v", got) + } + // a different port, or a raw TCP port, is not affected + if got := bindIPs(all[2], all); len(got) != 1 || got[0] != "0.0.0.0" { + t.Fatalf("other port: %v", got) + } + if got := bindIPs(all[3], all); len(got) != 1 || got[0] != "0.0.0.0" { + t.Fatalf("raw tcp: %v", got) + } + // with nothing named on that port the wildcard stays a single wildcard listener + if got := bindIPs(all[0], all[:1]); len(got) != 1 || got[0] != "0.0.0.0" { + t.Fatalf("alone: %v", got) + } +}