-
Notifications
You must be signed in to change notification settings - Fork 0
/
caddy_trusted_gcp_cloudcdn.go
136 lines (122 loc) · 3.17 KB
/
caddy_trusted_gcp_cloudcdn.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
package caddy_trusted_gcp_cloudcdn
import (
"net"
"net/http"
"net/netip"
"strings"
"sync"
"time"
"github.com/caddyserver/caddy/v2"
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
"github.com/caddyserver/caddy/v2/modules/caddyhttp"
)
func init() {
caddy.RegisterModule(CaddyTrustedGCPCloudCDN{})
}
// The module auto trusted_proxies `GCP CloudCDN EDGE servers` from `_cloud-eoips.googleusercontent.com` TXT record
// Doc: https://cloud.google.com/cdn/docs/set-up-external-backend-internet-neg
// Range from: _cloud-eoips.googleusercontent.com
type CaddyTrustedGCPCloudCDN struct {
// Interval to update the trusted proxies list. default: 1d
Interval caddy.Duration `json:"interval,omitempty"`
ranges []netip.Prefix
ctx caddy.Context
lock *sync.RWMutex
}
func (CaddyTrustedGCPCloudCDN) CaddyModule() caddy.ModuleInfo {
return caddy.ModuleInfo{
ID: "http.ip_sources.gcp_cloudcdn",
New: func() caddy.Module { return new(CaddyTrustedGCPCloudCDN) },
}
}
func (s *CaddyTrustedGCPCloudCDN) Provision(ctx caddy.Context) error {
s.ctx = ctx
s.lock = new(sync.RWMutex)
// update cron
go func() {
if s.Interval == 0 {
s.Interval = caddy.Duration(24 * time.Hour) // default to 24 hours
}
ticker := time.NewTicker(time.Duration(s.Interval))
s.lock.Lock()
s.ranges, _ = s.fetchPrefixes()
s.lock.Unlock()
for {
select {
case <-ticker.C:
prefixes, err := s.fetchPrefixes()
if err != nil {
break
}
s.lock.Lock()
s.ranges = prefixes
s.lock.Unlock()
case <-s.ctx.Done():
ticker.Stop()
return
}
}
}()
return nil
}
func (s *CaddyTrustedGCPCloudCDN) fetchPrefixes() ([]netip.Prefix, error) {
txtRecords, err := net.LookupTXT("_cloud-eoips.googleusercontent.com")
if err != nil {
return nil, err
}
var prefixes []netip.Prefix
// txt like "v=spf1 ip4:34.96.0.0/20 ip4:34.127.192.0/18 ~all"
for _, txt := range txtRecords {
ss := strings.Fields(txt)
for _, s := range ss {
if strings.HasPrefix(s, "ip") {
expr := s[strings.Index(s, ":")+1:]
prefix, err := caddyhttp.CIDRExpressionToPrefix(expr)
if err != nil {
return nil, err
}
prefixes = append(prefixes, prefix)
}
}
}
return prefixes, nil
}
func (s *CaddyTrustedGCPCloudCDN) GetIPRanges(_ *http.Request) []netip.Prefix {
s.lock.RLock()
defer s.lock.RUnlock()
return s.ranges
}
// UnmarshalCaddyfile implements caddyfile.Unmarshaler. Syntax:
//
// gcp_cloudcdn {
// interval <duration>
// }
func (m *CaddyTrustedGCPCloudCDN) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
d.Next() // consume directive name
if d.NextArg() {
return d.ArgErr()
}
for nesting := d.Nesting(); d.NextBlock(nesting); {
switch d.Val() {
case "interval":
if !d.NextArg() {
return d.ArgErr()
}
val, err := caddy.ParseDuration(d.Val())
if err != nil {
return err
}
m.Interval = caddy.Duration(val)
default:
return d.ArgErr()
}
}
return nil
}
// Interface guards
var (
_ caddy.Module = (*CaddyTrustedGCPCloudCDN)(nil)
_ caddy.Provisioner = (*CaddyTrustedGCPCloudCDN)(nil)
_ caddyfile.Unmarshaler = (*CaddyTrustedGCPCloudCDN)(nil)
_ caddyhttp.IPRangeSource = (*CaddyTrustedGCPCloudCDN)(nil)
)