From 9420308667f2bd1858a30a1596a2c83d9ee40a69 Mon Sep 17 00:00:00 2001 From: SALLEYRON Julien Date: Thu, 24 May 2018 10:52:04 +0200 Subject: [PATCH] Implement h2c with backend --- docs/basics.md | 14 ++++-- docs/img/grpc.svg | 5 +- docs/user-guide/grpc.md | 58 ++++++----------------- integration/fixtures/grpc/config_h2c.toml | 29 ++++++++++++ integration/grpc_test.go | 53 ++++++++++++++++++++- server/server.go | 19 ++++++++ 6 files changed, 126 insertions(+), 52 deletions(-) create mode 100644 integration/fixtures/grpc/config_h2c.toml diff --git a/docs/basics.md b/docs/basics.md index 6203a427e..35d2bbe5d 100644 --- a/docs/basics.md +++ b/docs/basics.md @@ -345,16 +345,22 @@ Here is an example of backends and servers definition: [backends.backend2] # ... [backends.backend2.servers.server1] - url = "http://172.17.0.4:80" + url = "https://172.17.0.4:443" weight = 1 [backends.backend2.servers.server2] - url = "http://172.17.0.5:80" + url = "https://172.17.0.5:443" weight = 2 + [backends.backend3] + # ... + [backends.backend3.servers.server1] + url = "h2c://172.17.0.6:80" + weight = 1 ``` - Two backends are defined: `backend1` and `backend2` -- `backend1` will forward the traffic to two servers: `http://172.17.0.2:80"` with weight `10` and `http://172.17.0.3:80` with weight `1`. -- `backend2` will forward the traffic to two servers: `http://172.17.0.4:80"` with weight `1` and `http://172.17.0.5:80` with weight `2`. +- `backend1` will forward the traffic to two servers: `172.17.0.2:80` with weight `10` and `172.17.0.3:80` with weight `1`. +- `backend2` will forward the traffic to two servers: `172.17.0.4:443` with weight `1` and `172.17.0.5:443` with weight `2` both using TLS. +- `backend3` will forward the traffic to: `172.17.0.6:80` with weight `1` using HTTP2 without TLS. #### Load-balancing diff --git a/docs/img/grpc.svg b/docs/img/grpc.svg index 3f1d53c76..038cd13e5 100644 --- a/docs/img/grpc.svg +++ b/docs/img/grpc.svg @@ -1,4 +1 @@ - - - - + \ No newline at end of file diff --git a/docs/user-guide/grpc.md b/docs/user-guide/grpc.md index 4046b9a7e..530dc5de5 100644 --- a/docs/user-guide/grpc.md +++ b/docs/user-guide/grpc.md @@ -3,26 +3,13 @@ This section explains how to use Traefik as reverse proxy for gRPC application with self-signed certificates. !!! warning - As gRPC needs HTTP2, we need HTTPS certificates on both gRPC Server and Træfik. + As gRPC needs HTTP2, we need HTTPS certificates on Træfik. + For exchanges with the backend, we will use h2c (HTTP2 on HTTP without TLS)

gRPC architecture

-## gRPC Server certificate - -In order to secure the gRPC server, we generate a self-signed certificate for backend url: - -```bash -openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./backend.key -out ./backend.cert -``` - -That will prompt for information, the important answer is: - -``` -Common Name (e.g. server FQDN or YOUR name) []: backend.local -``` - ## gRPC Client certificate Generate your self-signed certificate for frontend url: @@ -44,9 +31,6 @@ At last, we configure our Træfik instance to use both self-signed certificates. ```toml defaultEntryPoints = ["https"] -# For secure connection on backend.local -rootCAs = [ "./backend.cert" ] - [entryPoints] [entryPoints.https] address = ":4443" @@ -64,8 +48,8 @@ rootCAs = [ "./backend.cert" ] [backends] [backends.backend1] [backends.backend1.servers.server1] - # Access on backend with HTTPS - url = "https://backend.local:8080" + # Access on backend with h2c + url = "h2c://backend.local:8080" [frontends] @@ -76,40 +60,25 @@ rootCAs = [ "./backend.cert" ] ``` !!! warning - With some backends, the server URLs use the IP, so you may need to configure `insecureSkipVerify` instead of the `rootCAS` to activate HTTPS without hostname verification. + For provider with label, you will have to specify the `traefik.protocol=h2c` ## Conclusion -We don't need specific configuration to use gRPC in Træfik, we just need to be careful that all the exchanges (between client and Træfik, and between Træfik and backend) are HTTPS communications because gRPC uses HTTP2. +We don't need specific configuration to use gRPC in Træfik, we just need to be careful that exchanges between client and Træfik are HTTPS communications. +For exchanges between Træfik and backend, you need to use `h2c` protocol, or use HTTPS communications to have HTTP2. ## A gRPC example in go We will use the gRPC greeter example in [grpc-go](https://github.com/grpc/grpc-go/tree/master/examples/helloworld) -!!! warning - In order to use this gRPC example, we need to modify it to use HTTPS - -So we modify the "gRPC server example" to use our own self-signed certificate: - +We can keep the Server example as is with the h2c protocol ```go // ... - -// Read cert and key file -BackendCert, _ := ioutil.ReadFile("./backend.cert") -BackendKey, _ := ioutil.ReadFile("./backend.key") - -// Generate Certificate struct -cert, err := tls.X509KeyPair(BackendCert, BackendKey) +lis, err := net.Listen("tcp", port) if err != nil { - log.Fatalf("failed to parse certificate: %v", err) + log.Fatalf("failed to listen: %v", err) } - -// Create credentials -creds := credentials.NewServerTLSFromCert(&cert) - -// Use Credentials in gRPC server options -serverOption := grpc.Creds(creds) -var s *grpc.Server = grpc.NewServer(serverOption) +var s *grpc.Server = grpc.NewServer() defer s.Stop() pb.RegisterGreeterServer(s, &server{}) @@ -118,6 +87,10 @@ err := s.Serve(lis) // ... ``` +!!! warning + In order to use this gRPC example, we need to modify it to use HTTPS + + Next we will modify gRPC Client to use our Træfik self-signed certificate: ```go @@ -147,4 +120,3 @@ r, err := client.SayHello(context.Background(), &pb.HelloRequest{Name: name}) // ... ``` - diff --git a/integration/fixtures/grpc/config_h2c.toml b/integration/fixtures/grpc/config_h2c.toml new file mode 100644 index 000000000..f36006016 --- /dev/null +++ b/integration/fixtures/grpc/config_h2c.toml @@ -0,0 +1,29 @@ +defaultEntryPoints = ["https"] + +rootCAs = [ """{{ .CertContent }}""" ] + +[entryPoints] + [entryPoints.https] + address = ":4443" + [entryPoints.https.tls] + [[entryPoints.https.tls.certificates]] + certFile = """{{ .CertContent }}""" + keyFile = """{{ .KeyContent }}""" + + +[api] + +[file] + +[backends] + [backends.backend1] + [backends.backend1.servers.server1] + url = "h2c://127.0.0.1:{{ .GRPCServerPort }}" + weight = 1 + + +[frontends] + [frontends.frontend1] + backend = "backend1" + [frontends.frontend1.routes.test_1] + rule = "Host:127.0.0.1" diff --git a/integration/grpc_test.go b/integration/grpc_test.go index 579996a46..311fd60ec 100644 --- a/integration/grpc_test.go +++ b/integration/grpc_test.go @@ -67,6 +67,15 @@ func startGRPCServer(lis net.Listener, server *myserver) error { helloworld.RegisterGreeterServer(s, server) return s.Serve(lis) } + +func starth2cGRPCServer(lis net.Listener, server *myserver) error { + s := grpc.NewServer() + defer s.Stop() + + helloworld.RegisterGreeterServer(s, server) + return s.Serve(lis) +} + func getHelloClientGRPC() (helloworld.GreeterClient, func() error, error) { roots := x509.NewCertPool() roots.AppendCertsFromPEM(LocalhostCert) @@ -137,12 +146,54 @@ func (s *GRPCSuite) TestGRPC(c *check.C) { // wait for Traefik err = try.GetRequest("http://127.0.0.1:8080/api/providers", 1*time.Second, try.BodyContains("Host:127.0.0.1")) c.Assert(err, check.IsNil) + var response string err = try.Do(1*time.Second, func() error { response, err = callHelloClientGRPC("World") return err }) + c.Assert(err, check.IsNil) + c.Assert(response, check.Equals, "Hello World") +} +func (s *GRPCSuite) TestGRPCh2c(c *check.C) { + lis, err := net.Listen("tcp", ":0") + _, port, err := net.SplitHostPort(lis.Addr().String()) + c.Assert(err, check.IsNil) + + go func() { + err := starth2cGRPCServer(lis, &myserver{}) + c.Log(err) + c.Assert(err, check.IsNil) + }() + + file := s.adaptFile(c, "fixtures/grpc/config_h2c.toml", struct { + CertContent string + KeyContent string + GRPCServerPort string + }{ + CertContent: string(LocalhostCert), + KeyContent: string(LocalhostKey), + GRPCServerPort: port, + }) + + defer os.Remove(file) + cmd, display := s.traefikCmd(withConfigFile(file)) + defer display(c) + + err = cmd.Start() + c.Assert(err, check.IsNil) + defer cmd.Process.Kill() + + // wait for Traefik + err = try.GetRequest("http://127.0.0.1:8080/api/providers", 1*time.Second, try.BodyContains("Host:127.0.0.1")) + c.Assert(err, check.IsNil) + + var response string + err = try.Do(1*time.Second, func() error { + response, err = callHelloClientGRPC("World") + return err + }) c.Assert(err, check.IsNil) c.Assert(response, check.Equals, "Hello World") } @@ -179,12 +230,12 @@ func (s *GRPCSuite) TestGRPCInsecure(c *check.C) { // wait for Traefik err = try.GetRequest("http://127.0.0.1:8080/api/providers", 1*time.Second, try.BodyContains("Host:127.0.0.1")) c.Assert(err, check.IsNil) + var response string err = try.Do(1*time.Second, func() error { response, err = callHelloClientGRPC("World") return err }) - c.Assert(err, check.IsNil) c.Assert(response, check.Equals, "Hello World") } diff --git a/server/server.go b/server/server.go index 3361bd5f6..7e3ffdcb8 100644 --- a/server/server.go +++ b/server/server.go @@ -145,6 +145,15 @@ func NewServer(globalConfiguration configuration.GlobalConfiguration, provider p return server } +type h2cTransportWrapper struct { + *http2.Transport +} + +func (t *h2cTransportWrapper) RoundTrip(req *http.Request) (*http.Response, error) { + req.URL.Scheme = "http" + return t.Transport.RoundTrip(req) +} + // createHTTPTransport creates an http.Transport configured with the GlobalConfiguration settings. // For the settings that can't be configured in Traefik it uses the default http.Transport settings. // An exception to this is the MaxIdleConns setting as we only provide the option MaxIdleConnsPerHost @@ -168,6 +177,16 @@ func createHTTPTransport(globalConfiguration configuration.GlobalConfiguration) TLSHandshakeTimeout: 10 * time.Second, ExpectContinueTimeout: 1 * time.Second, } + + transport.RegisterProtocol("h2c", &h2cTransportWrapper{ + Transport: &http2.Transport{ + DialTLS: func(netw, addr string, cfg *tls.Config) (net.Conn, error) { + return net.Dial(netw, addr) + }, + AllowHTTP: true, + }, + }) + if globalConfiguration.ForwardingTimeouts != nil { transport.ResponseHeaderTimeout = time.Duration(globalConfiguration.ForwardingTimeouts.ResponseHeaderTimeout) }