can someone pls provide an example of a working https / h2 with tls reverse proxy example? #3730

sprappcom · 2024-08-10T02:23:18Z

sprappcom
Aug 10, 2024

Trying 127.0.0.1:3000...
Connected to 127.0.0.1 (127.0.0.1) port 3000
ALPN: curl offers h2,http/1.1
TLSv1.3 (OUT), TLS handshake, Client hello (1):
OpenSSL/3.0.13: error:0A00010B:SSL routines::wrong version number
Closing connection
curl: (35) OpenSSL/3.0.13: error:0A00010B:SSL routines::wrong version number

/src/main.rs

use std::convert::Infallible;
use std::net::SocketAddr;
use std::sync::Arc;

use hyper::client::HttpConnector;
use hyper::server::conn::AddrIncoming;
use hyper::service::{make_service_fn, service_fn};
use hyper::{Body, Client, Request, Response, Server};
use hyper_rustls::{HttpsConnector, HttpsConnectorBuilder};
use rustls::{ServerConfig, RootCertStore};
use tokio::net::TcpListener;
use log::{debug, info, error};

type HttpsClient = Client<HttpsConnector<HttpConnector>>;

async fn handle(req: Request<Body>, client: Arc<HttpsClient>) -> Result<Response<Body>, hyper::Error> {
    debug!("Received request: {:?}", req);
    let uri = format!(
        "https://172.17.0.6:443{}",
        req.uri().path_and_query().map(|x| x.as_str()).unwrap_or("")
    );
    let (parts, body) = req.into_parts();
    let mut new_req = Request::builder()
        .method(parts.method)
        .uri(uri)
        .body(body)
        .expect("Failed to build request");

    *new_req.headers_mut() = parts.headers;

    debug!("Forwarding request to backend: {:?}", new_req);
    let response = client.request(new_req).await;
    debug!("Received response from backend: {:?}", response);
    response
}

fn create_https_connector() -> HttpsConnector<HttpConnector> {
    let mut root_store = RootCertStore::empty();
    root_store.add_trust_anchors(
        webpki_roots::TLS_SERVER_ROOTS
            .0
            .iter()
            .map(|ta| {
                rustls::OwnedTrustAnchor::from_subject_spki_name_constraints(
                    ta.subject,
                    ta.spki,
                    ta.name_constraints,
                )
            })
    );

    let config = rustls::ClientConfig::builder()
        .with_safe_defaults()
        .with_root_certificates(root_store)
        .with_no_client_auth();

    HttpsConnectorBuilder::new()
        .with_tls_config(config)
        .https_only()
        .enable_http1()
        .enable_http2()
        .build()
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    env_logger::init();

    info!("Starting HTTPS reverse proxy");

    // Load TLS keys
    let cert = rustls_pemfile::certs(&mut &include_bytes!("/usr/local/src/hyperrp/certs/cert.pem")[..])
        .unwrap()
        .into_iter()
        .map(rustls::Certificate)
        .collect::<Vec<_>>();
    let key = rustls_pemfile::pkcs8_private_keys(&mut &include_bytes!("/usr/local/src/hyperrp/certs/key.pem")[..])
        .unwrap()
        .into_iter()
        .next()
        .map(rustls::PrivateKey)
        .unwrap();

    let config = ServerConfig::builder()
    .with_safe_defaults()
    .with_no_client_auth()
    .with_single_cert(cert, key)
    .expect("Failed to create ServerConfig");


    let addr = SocketAddr::from(([0, 0, 0, 0], 3000));
    let listener = TcpListener::bind(addr).await?;
    info!("Listening on https://{}", addr);

    // Create HTTPS client with custom connector
    let https = create_https_connector();
    let client: HttpsClient = Client::builder().build(https);
    let client = Arc::new(client);

    let service = make_service_fn(move |_| {
        let client = client.clone();
        async move {
            Ok::<_, Infallible>(service_fn(move |req| {
                let client = client.clone();
                handle(req, client)
            }))
        }
    });

    let server = Server::builder(AddrIncoming::from_listener(listener)?)
        .http1_preserve_header_case(true)
        .http1_title_case_headers(true)
        .serve(service);

    info!("Server started successfully");

    if let Err(e) = server.await {
        error!("Server error: {}", e);
    }

    Ok(())
}

Cargo.toml

[package]
name = "rust-https-reverse-proxy"
version = "0.1.0"
edition = "2021"
authors = ["Your Name <[email protected]>"]
description = "A simple HTTPS reverse proxy with H2 termination"

[dependencies]
hyper = { version = "0.14", features = ["full"] }
tokio = { version = "1", features = ["full"] }
hyper-rustls = { version = "0.24", features = ["http2"] }
rustls = "0.21"
rustls-pemfile = "1.0"
webpki-roots = "0.22"
rustls-native-certs = "0.6"
log = "0.4"
env_logger = "0.10"

sprappcom · 2024-08-11T18:11:19Z

sprappcom
Aug 11, 2024
Author

@seanmonstar

i've been trying for days with chatgpt4 and sonnet and i cant get it to work. they are stuck at hyper 0.14 etc.

can u pls show how to do h2/tls reverse proxy? i have no idea why it is not working.

@seanmonstar i can buy you coffees for this. pls tell me where to do so. pls give a working example (with rustls if possible) thx!

pub async fn handle_request(&self, request: Request<h2::RecvStream>, mut respond: SendResponse<Bytes>) -> Result<(), Box<dyn Error + Send + Sync>> {
    let tcp = TcpStream::connect("127.0.0.1:8443").await?;
    let (mut client, h2) = client::handshake(tcp).await?;

    let uri = format!("https://127.0.0.1:8443{}", request.uri().path());
    let request = Request::builder()
        .method(request.method().clone())
        .uri(uri)
        .body(())
        .unwrap();

    let (response, mut stream) = client.send_request(request, false).unwrap();

    // Spawn a task to run the conn...
    tokio::spawn(async move {
        if let Err(e) = h2.await {
            println!("GOT ERR={:?}", e);
        }
    });

    let response = response.await?;
    let mut response_builder = http::Response::builder()
        .status(response.status());

    for (key, value) in response.headers() {
        response_builder = response_builder.header(key, value);
    }

    let mut body = response.into_body();
    let mut body_bytes = Vec::new();

    while let Some(chunk) = body.data().await {
        body_bytes.extend_from_slice(&chunk?);
    }

    if let Some(trailers) = body.trailers().await? {
        println!("GOT TRAILERS: {:?}", trailers);
    }

    let response = response_builder.body(()).unwrap();
    let mut send = respond.send_response(response, false)?;
    send.send_data(Bytes::from(body_bytes), true)?;

    Ok(())
}

0 replies

dswij · 2024-08-12T12:14:13Z

dswij
Aug 12, 2024
Collaborator

You can check the docs of hyper-rustls for this.

0 replies

sprappcom · 2024-08-13T05:35:39Z

sprappcom
Aug 13, 2024
Author

@dswij i'm new to rust. possible to provide how it works in code? it is that difficult? i'm coming from golang background and it's actually very easy to do with example. really easy. how to get this done in code? chatgpt4 and sonnet cant help

0 replies

astoring · 2024-08-13T07:12:04Z

astoring
Aug 13, 2024

Hyper is a low-level library and is not suitable for beginners. You can start with some more advanced web frameworks developed based on hyper. For example, axum, actix-web, salvo, etc.

For example, this is a very simple reverse proxy example of salvo:
https://github.com/salvo-rs/salvo/blob/main/examples/proxy-simple/src/main.rs

6 replies

sprappcom Aug 13, 2024
Author

why is everyone avoiding providing the solution? it's not possible to do so with hyper?

can some pls do sonnet / chatgpt4? i'm sure u guys can fix it. i can sponsor coffees in return. pls help

sprappcom Aug 13, 2024
Author

if i have the answer, i will post here for free.

astoring Aug 13, 2024

The performance of frameworks based on Hyper is similar, and salvo is not much slower than other frameworks such as Axum.

https://web-frameworks-benchmark.netlify.app/result?l=rust

astoring Aug 13, 2024

Since these frameworks are all based on Hyper, you can take a look at their source code to see how they implement it.

dswij Aug 13, 2024
Collaborator

why is everyone avoiding providing the solution?

It's not that everyone is avoiding helping you, but you're asking for something that can be done by looking at the docs.

There are already a couple of reverse proxies written on top of hyper in the wild. One such example is pingora. You can go through the source code and see how they implement it or just use what they provided.

I'm closing this discussion since there are a couple of examples pointed out here. If you have questions on hyper internals, feel free to ask on Discord.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

can someone pls provide an example of a working https / h2 with tls reverse proxy example? #3730

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 4 comments 6 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

can someone pls provide an example of a working https / h2 with tls reverse proxy example? #3730

sprappcom Aug 10, 2024

Replies: 4 comments · 6 replies

sprappcom Aug 11, 2024 Author

dswij Aug 12, 2024 Collaborator

sprappcom Aug 13, 2024 Author

astoring Aug 13, 2024

sprappcom Aug 13, 2024 Author

sprappcom Aug 13, 2024 Author

astoring Aug 13, 2024

astoring Aug 13, 2024

dswij Aug 13, 2024 Collaborator

sprappcom
Aug 10, 2024

Replies: 4 comments 6 replies

sprappcom
Aug 11, 2024
Author

dswij
Aug 12, 2024
Collaborator

sprappcom
Aug 13, 2024
Author

astoring
Aug 13, 2024

sprappcom Aug 13, 2024
Author

sprappcom Aug 13, 2024
Author

dswij Aug 13, 2024
Collaborator