home: add middlewares

internal/home/middlewares.go

@@ -0,0 +1,50 @@
+package home
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/AdguardTeam/AdGuardHome/internal/aghio"
+)
+
+// middlerware is a wrapper function signature.
+type middleware func(http.Handler) http.Handler
+
+// withMiddlewares consequently wraps h with all the middlewares.
+func withMiddlewares(h http.Handler, middlewares ...middleware) (wrapped http.Handler) {
+	wrapped = h
+
+	for _, mw := range middlewares {
+		wrapped = mw(wrapped)
+	}
+
+	return wrapped
+}
+
+// RequestBodySizeLimit is maximum request body length in bytes.
+const RequestBodySizeLimit = 64 * 1024
+
+// LimitRequestBody substitutes body of the request with LimitedReadCloser.
+func limitRequestBody(h http.Handler) (limited http.Handler) {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		r.Body = aghio.LimitReadCloser(r.Body, RequestBodySizeLimit)
+
+		h.ServeHTTP(w, r)
+	})
+}
+
+// TODO(a.garipov): We currently have to use this, because everything registers
+// its HTTP handlers in http.DefaultServeMux.  In the future, refactor our HTTP
+// API initialization process and stop using the gosh darn http.DefaultServeMux
+// for anything at all.  Gosh darn global variables.
+func filterPProf(h http.Handler) (filtered http.Handler) {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasPrefix(r.URL.Path, "/debug/pprof") {
+			http.NotFound(w, r)
+
+			return
+		}
+
+		h.ServeHTTP(w, r)
+	})
+}

internal/home/web.go

@@ -7,7 +7,6 @@ import (
 	"net"
 	"net/http"
 	"strconv"
-	"strings"
 	"sync"
 
 	"github.com/AdguardTeam/AdGuardHome/internal/util"
@@ -142,7 +141,7 @@ func (web *Web) Start() {
 		web.httpServer = &http.Server{
 			ErrorLog: web.errLogger,
 			Addr:     address,
-			Handler:  filterPPROF(http.DefaultServeMux),
+			Handler:  withMiddlewares(http.DefaultServeMux, filterPProf, limitRequestBody),
 		}
 		err := web.httpServer.ListenAndServe()
 		if err != http.ErrServerClosed {
@@ -153,22 +152,6 @@ func (web *Web) Start() {
 	}
 }
 
-// TODO(a.garipov): We currently have to use this, because everything registers
-// its HTTP handlers in http.DefaultServeMux.  In the future, refactor our HTTP
-// API initialization process and stop using the gosh darn http.DefaultServeMux
-// for anything at all.  Gosh darn global variables.
-func filterPPROF(h http.Handler) (filtered http.Handler) {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if strings.HasPrefix(r.URL.Path, "/debug/pprof") {
-			http.NotFound(w, r)
-
-			return
-		}
-
-		h.ServeHTTP(w, r)
-	})
-}
-
 // Close - stop HTTP server, possibly waiting for all active connections to be closed
 func (web *Web) Close() {
 	log.Info("Stopping HTTP server...")