Dynamic Configuration Refactoring

old/middlewares/accesslog/capture_request_reader.go

@@ -0,0 +1,18 @@
+package accesslog
+
+import "io"
+
+type captureRequestReader struct {
+	source io.ReadCloser
+	count  int64
+}
+
+func (r *captureRequestReader) Read(p []byte) (int, error) {
+	n, err := r.source.Read(p)
+	r.count += int64(n)
+	return n, err
+}
+
+func (r *captureRequestReader) Close() error {
+	return r.source.Close()
+}

old/middlewares/accesslog/capture_response_writer.go

@@ -0,0 +1,68 @@
+package accesslog
+
+import (
+	"bufio"
+	"fmt"
+	"net"
+	"net/http"
+
+	"github.com/containous/traefik/old/middlewares"
+)
+
+var (
+	_ middlewares.Stateful = &captureResponseWriter{}
+)
+
+// captureResponseWriter is a wrapper of type http.ResponseWriter
+// that tracks request status and size
+type captureResponseWriter struct {
+	rw     http.ResponseWriter
+	status int
+	size   int64
+}
+
+func (crw *captureResponseWriter) Header() http.Header {
+	return crw.rw.Header()
+}
+
+func (crw *captureResponseWriter) Write(b []byte) (int, error) {
+	if crw.status == 0 {
+		crw.status = http.StatusOK
+	}
+	size, err := crw.rw.Write(b)
+	crw.size += int64(size)
+	return size, err
+}
+
+func (crw *captureResponseWriter) WriteHeader(s int) {
+	crw.rw.WriteHeader(s)
+	crw.status = s
+}
+
+func (crw *captureResponseWriter) Flush() {
+	if f, ok := crw.rw.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
+func (crw *captureResponseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	if h, ok := crw.rw.(http.Hijacker); ok {
+		return h.Hijack()
+	}
+	return nil, nil, fmt.Errorf("not a hijacker: %T", crw.rw)
+}
+
+func (crw *captureResponseWriter) CloseNotify() <-chan bool {
+	if c, ok := crw.rw.(http.CloseNotifier); ok {
+		return c.CloseNotify()
+	}
+	return nil
+}
+
+func (crw *captureResponseWriter) Status() int {
+	return crw.status
+}
+
+func (crw *captureResponseWriter) Size() int64 {
+	return crw.size
+}

old/middlewares/accesslog/logdata.go

@@ -0,0 +1,120 @@
+package accesslog
+
+import (
+	"net/http"
+)
+
+const (
+	// StartUTC is the map key used for the time at which request processing started.
+	StartUTC = "StartUTC"
+	// StartLocal is the map key used for the local time at which request processing started.
+	StartLocal = "StartLocal"
+	// Duration is the map key used for the total time taken by processing the response, including the origin server's time but
+	// not the log writing time.
+	Duration = "Duration"
+	// FrontendName is the map key used for the name of the Traefik frontend.
+	FrontendName = "FrontendName"
+	// BackendName is the map key used for the name of the Traefik backend.
+	BackendName = "BackendName"
+	// BackendURL is the map key used for the URL of the Traefik backend.
+	BackendURL = "BackendURL"
+	// BackendAddr is the map key used for the IP:port of the Traefik backend (extracted from BackendURL)
+	BackendAddr = "BackendAddr"
+	// ClientAddr is the map key used for the remote address in its original form (usually IP:port).
+	ClientAddr = "ClientAddr"
+	// ClientHost is the map key used for the remote IP address from which the client request was received.
+	ClientHost = "ClientHost"
+	// ClientPort is the map key used for the remote TCP port from which the client request was received.
+	ClientPort = "ClientPort"
+	// ClientUsername is the map key used for the username provided in the URL, if present.
+	ClientUsername = "ClientUsername"
+	// RequestAddr is the map key used for the HTTP Host header (usually IP:port). This is treated as not a header by the Go API.
+	RequestAddr = "RequestAddr"
+	// RequestHost is the map key used for the HTTP Host server name (not including port).
+	RequestHost = "RequestHost"
+	// RequestPort is the map key used for the TCP port from the HTTP Host.
+	RequestPort = "RequestPort"
+	// RequestMethod is the map key used for the HTTP method.
+	RequestMethod = "RequestMethod"
+	// RequestPath is the map key used for the HTTP request URI, not including the scheme, host or port.
+	RequestPath = "RequestPath"
+	// RequestProtocol is the map key used for the version of HTTP requested.
+	RequestProtocol = "RequestProtocol"
+	// RequestContentSize is the map key used for the number of bytes in the request entity (a.k.a. body) sent by the client.
+	RequestContentSize = "RequestContentSize"
+	// RequestRefererHeader is the Referer header in the request
+	RequestRefererHeader = "request_Referer"
+	// RequestUserAgentHeader is the User-Agent header in the request
+	RequestUserAgentHeader = "request_User-Agent"
+	// OriginDuration is the map key used for the time taken by the origin server ('upstream') to return its response.
+	OriginDuration = "OriginDuration"
+	// OriginContentSize is the map key used for the content length specified by the origin server, or 0 if unspecified.
+	OriginContentSize = "OriginContentSize"
+	// OriginStatus is the map key used for the HTTP status code returned by the origin server.
+	// If the request was handled by this Traefik instance (e.g. with a redirect), then this value will be absent.
+	OriginStatus = "OriginStatus"
+	// DownstreamStatus is the map key used for the HTTP status code returned to the client.
+	DownstreamStatus = "DownstreamStatus"
+	// DownstreamContentSize is the map key used for the number of bytes in the response entity returned to the client.
+	// This is in addition to the "Content-Length" header, which may be present in the origin response.
+	DownstreamContentSize = "DownstreamContentSize"
+	// RequestCount is the map key used for the number of requests received since the Traefik instance started.
+	RequestCount = "RequestCount"
+	// GzipRatio is the map key used for the response body compression ratio achieved.
+	GzipRatio = "GzipRatio"
+	// Overhead is the map key used for the processing time overhead caused by Traefik.
+	Overhead = "Overhead"
+	// RetryAttempts is the map key used for the amount of attempts the request was retried.
+	RetryAttempts = "RetryAttempts"
+)
+
+// These are written out in the default case when no config is provided to specify keys of interest.
+var defaultCoreKeys = [...]string{
+	StartUTC,
+	Duration,
+	FrontendName,
+	BackendName,
+	BackendURL,
+	ClientHost,
+	ClientPort,
+	ClientUsername,
+	RequestHost,
+	RequestPort,
+	RequestMethod,
+	RequestPath,
+	RequestProtocol,
+	RequestContentSize,
+	OriginDuration,
+	OriginContentSize,
+	OriginStatus,
+	DownstreamStatus,
+	DownstreamContentSize,
+	RequestCount,
+}
+
+// This contains the set of all keys, i.e. all the default keys plus all non-default keys.
+var allCoreKeys = make(map[string]struct{})
+
+func init() {
+	for _, k := range defaultCoreKeys {
+		allCoreKeys[k] = struct{}{}
+	}
+	allCoreKeys[BackendAddr] = struct{}{}
+	allCoreKeys[ClientAddr] = struct{}{}
+	allCoreKeys[RequestAddr] = struct{}{}
+	allCoreKeys[GzipRatio] = struct{}{}
+	allCoreKeys[StartLocal] = struct{}{}
+	allCoreKeys[Overhead] = struct{}{}
+	allCoreKeys[RetryAttempts] = struct{}{}
+}
+
+// CoreLogData holds the fields computed from the request/response.
+type CoreLogData map[string]interface{}
+
+// LogData is the data captured by the middleware so that it can be logged.
+type LogData struct {
+	Core               CoreLogData
+	Request            http.Header
+	OriginResponse     http.Header
+	DownstreamResponse http.Header
+}

old/middlewares/accesslog/logger.go

@@ -0,0 +1,334 @@
+package accesslog
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/containous/flaeg/parse"
+	"github.com/containous/traefik/old/log"
+	"github.com/containous/traefik/old/types"
+	"github.com/sirupsen/logrus"
+)
+
+type key string
+
+const (
+	// DataTableKey is the key within the request context used to
+	// store the Log Data Table
+	DataTableKey key = "LogDataTable"
+
+	// CommonFormat is the common logging format (CLF)
+	CommonFormat string = "common"
+
+	// JSONFormat is the JSON logging format
+	JSONFormat string = "json"
+)
+
+type logHandlerParams struct {
+	logDataTable *LogData
+	crr          *captureRequestReader
+	crw          *captureResponseWriter
+}
+
+// LogHandler will write each request and its response to the access log.
+type LogHandler struct {
+	config         *types.AccessLog
+	logger         *logrus.Logger
+	file           *os.File
+	mu             sync.Mutex
+	httpCodeRanges types.HTTPCodeRanges
+	logHandlerChan chan logHandlerParams
+	wg             sync.WaitGroup
+}
+
+// NewLogHandler creates a new LogHandler
+func NewLogHandler(config *types.AccessLog) (*LogHandler, error) {
+	file := os.Stdout
+	if len(config.FilePath) > 0 {
+		f, err := openAccessLogFile(config.FilePath)
+		if err != nil {
+			return nil, fmt.Errorf("error opening access log file: %s", err)
+		}
+		file = f
+	}
+	logHandlerChan := make(chan logHandlerParams, config.BufferingSize)
+
+	var formatter logrus.Formatter
+
+	switch config.Format {
+	case CommonFormat:
+		formatter = new(CommonLogFormatter)
+	case JSONFormat:
+		formatter = new(logrus.JSONFormatter)
+	default:
+		return nil, fmt.Errorf("unsupported access log format: %s", config.Format)
+	}
+
+	logger := &logrus.Logger{
+		Out:       file,
+		Formatter: formatter,
+		Hooks:     make(logrus.LevelHooks),
+		Level:     logrus.InfoLevel,
+	}
+
+	logHandler := &LogHandler{
+		config:         config,
+		logger:         logger,
+		file:           file,
+		logHandlerChan: logHandlerChan,
+	}
+
+	if config.Filters != nil {
+		if httpCodeRanges, err := types.NewHTTPCodeRanges(config.Filters.StatusCodes); err != nil {
+			log.Errorf("Failed to create new HTTP code ranges: %s", err)
+		} else {
+			logHandler.httpCodeRanges = httpCodeRanges
+		}
+	}
+
+	if config.BufferingSize > 0 {
+		logHandler.wg.Add(1)
+		go func() {
+			defer logHandler.wg.Done()
+			for handlerParams := range logHandler.logHandlerChan {
+				logHandler.logTheRoundTrip(handlerParams.logDataTable, handlerParams.crr, handlerParams.crw)
+			}
+		}()
+	}
+
+	return logHandler, nil
+}
+
+func openAccessLogFile(filePath string) (*os.File, error) {
+	dir := filepath.Dir(filePath)
+
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create log path %s: %s", dir, err)
+	}
+
+	file, err := os.OpenFile(filePath, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0664)
+	if err != nil {
+		return nil, fmt.Errorf("error opening file %s: %s", filePath, err)
+	}
+
+	return file, nil
+}
+
+// GetLogDataTable gets the request context object that contains logging data.
+// This creates data as the request passes through the middleware chain.
+func GetLogDataTable(req *http.Request) *LogData {
+	if ld, ok := req.Context().Value(DataTableKey).(*LogData); ok {
+		return ld
+	}
+	log.Errorf("%s is nil", DataTableKey)
+	return &LogData{Core: make(CoreLogData)}
+}
+
+func (l *LogHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request, next http.HandlerFunc) {
+	now := time.Now().UTC()
+
+	core := CoreLogData{
+		StartUTC:   now,
+		StartLocal: now.Local(),
+	}
+
+	logDataTable := &LogData{Core: core, Request: req.Header}
+
+	reqWithDataTable := req.WithContext(context.WithValue(req.Context(), DataTableKey, logDataTable))
+
+	var crr *captureRequestReader
+	if req.Body != nil {
+		crr = &captureRequestReader{source: req.Body, count: 0}
+		reqWithDataTable.Body = crr
+	}
+
+	core[RequestCount] = nextRequestCount()
+	if req.Host != "" {
+		core[RequestAddr] = req.Host
+		core[RequestHost], core[RequestPort] = silentSplitHostPort(req.Host)
+	}
+	// copy the URL without the scheme, hostname etc
+	urlCopy := &url.URL{
+		Path:       req.URL.Path,
+		RawPath:    req.URL.RawPath,
+		RawQuery:   req.URL.RawQuery,
+		ForceQuery: req.URL.ForceQuery,
+		Fragment:   req.URL.Fragment,
+	}
+	urlCopyString := urlCopy.String()
+	core[RequestMethod] = req.Method
+	core[RequestPath] = urlCopyString
+	core[RequestProtocol] = req.Proto
+
+	core[ClientAddr] = req.RemoteAddr
+	core[ClientHost], core[ClientPort] = silentSplitHostPort(req.RemoteAddr)
+
+	if forwardedFor := req.Header.Get("X-Forwarded-For"); forwardedFor != "" {
+		core[ClientHost] = forwardedFor
+	}
+
+	crw := &captureResponseWriter{rw: rw}
+
+	next.ServeHTTP(crw, reqWithDataTable)
+
+	core[ClientUsername] = formatUsernameForLog(core[ClientUsername])
+
+	logDataTable.DownstreamResponse = crw.Header()
+
+	if l.config.BufferingSize > 0 {
+		l.logHandlerChan <- logHandlerParams{
+			logDataTable: logDataTable,
+			crr:          crr,
+			crw:          crw,
+		}
+	} else {
+		l.logTheRoundTrip(logDataTable, crr, crw)
+	}
+}
+
+// Close closes the Logger (i.e. the file, drain logHandlerChan, etc).
+func (l *LogHandler) Close() error {
+	close(l.logHandlerChan)
+	l.wg.Wait()
+	return l.file.Close()
+}
+
+// Rotate closes and reopens the log file to allow for rotation
+// by an external source.
+func (l *LogHandler) Rotate() error {
+	var err error
+
+	if l.file != nil {
+		defer func(f *os.File) {
+			f.Close()
+		}(l.file)
+	}
+
+	l.file, err = os.OpenFile(l.config.FilePath, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0664)
+	if err != nil {
+		return err
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.logger.Out = l.file
+	return nil
+}
+
+func silentSplitHostPort(value string) (host string, port string) {
+	host, port, err := net.SplitHostPort(value)
+	if err != nil {
+		return value, "-"
+	}
+	return host, port
+}
+
+func formatUsernameForLog(usernameField interface{}) string {
+	username, ok := usernameField.(string)
+	if ok && len(username) != 0 {
+		return username
+	}
+	return "-"
+}
+
+// Logging handler to log frontend name, backend name, and elapsed time
+func (l *LogHandler) logTheRoundTrip(logDataTable *LogData, crr *captureRequestReader, crw *captureResponseWriter) {
+	core := logDataTable.Core
+
+	retryAttempts, ok := core[RetryAttempts].(int)
+	if !ok {
+		retryAttempts = 0
+	}
+	core[RetryAttempts] = retryAttempts
+
+	if crr != nil {
+		core[RequestContentSize] = crr.count
+	}
+
+	core[DownstreamStatus] = crw.Status()
+
+	// n.b. take care to perform time arithmetic using UTC to avoid errors at DST boundaries
+	totalDuration := time.Now().UTC().Sub(core[StartUTC].(time.Time))
+	core[Duration] = totalDuration
+
+	if l.keepAccessLog(crw.Status(), retryAttempts, totalDuration) {
+		core[DownstreamContentSize] = crw.Size()
+		if original, ok := core[OriginContentSize]; ok {
+			o64 := original.(int64)
+			if o64 != crw.Size() && 0 != crw.Size() {
+				core[GzipRatio] = float64(o64) / float64(crw.Size())
+			}
+		}
+
+		core[Overhead] = totalDuration
+		if origin, ok := core[OriginDuration]; ok {
+			core[Overhead] = totalDuration - origin.(time.Duration)
+		}
+
+		fields := logrus.Fields{}
+
+		for k, v := range logDataTable.Core {
+			if l.config.Fields.Keep(k) {
+				fields[k] = v
+			}
+		}
+
+		l.redactHeaders(logDataTable.Request, fields, "request_")
+		l.redactHeaders(logDataTable.OriginResponse, fields, "origin_")
+		l.redactHeaders(logDataTable.DownstreamResponse, fields, "downstream_")
+
+		l.mu.Lock()
+		defer l.mu.Unlock()
+		l.logger.WithFields(fields).Println()
+	}
+}
+
+func (l *LogHandler) redactHeaders(headers http.Header, fields logrus.Fields, prefix string) {
+	for k := range headers {
+		v := l.config.Fields.KeepHeader(k)
+		if v == types.AccessLogKeep {
+			fields[prefix+k] = headers.Get(k)
+		} else if v == types.AccessLogRedact {
+			fields[prefix+k] = "REDACTED"
+		}
+	}
+}
+
+func (l *LogHandler) keepAccessLog(statusCode, retryAttempts int, duration time.Duration) bool {
+	if l.config.Filters == nil {
+		// no filters were specified
+		return true
+	}
+
+	if len(l.httpCodeRanges) == 0 && !l.config.Filters.RetryAttempts && l.config.Filters.MinDuration == 0 {
+		// empty filters were specified, e.g. by passing --accessLog.filters only (without other filter options)
+		return true
+	}
+
+	if l.httpCodeRanges.Contains(statusCode) {
+		return true
+	}
+
+	if l.config.Filters.RetryAttempts && retryAttempts > 0 {
+		return true
+	}
+
+	if l.config.Filters.MinDuration > 0 && (parse.Duration(duration) > l.config.Filters.MinDuration) {
+		return true
+	}
+
+	return false
+}
+
+var requestCounter uint64 // Request ID
+
+func nextRequestCount() uint64 {
+	return atomic.AddUint64(&requestCounter, 1)
+}

old/middlewares/accesslog/logger_formatters.go

@@ -0,0 +1,82 @@
+package accesslog
+
+import (
+	"bytes"
+	"fmt"
+	"time"
+
+	"github.com/sirupsen/logrus"
+)
+
+// default format for time presentation
+const (
+	commonLogTimeFormat = "02/Jan/2006:15:04:05 -0700"
+	defaultValue        = "-"
+)
+
+// CommonLogFormatter provides formatting in the Traefik common log format
+type CommonLogFormatter struct{}
+
+// Format formats the log entry in the Traefik common log format
+func (f *CommonLogFormatter) Format(entry *logrus.Entry) ([]byte, error) {
+	b := &bytes.Buffer{}
+
+	var timestamp = defaultValue
+	if v, ok := entry.Data[StartUTC]; ok {
+		timestamp = v.(time.Time).Format(commonLogTimeFormat)
+	}
+
+	var elapsedMillis int64
+	if v, ok := entry.Data[Duration]; ok {
+		elapsedMillis = v.(time.Duration).Nanoseconds() / 1000000
+	}
+
+	_, err := fmt.Fprintf(b, "%s - %s [%s] \"%s %s %s\" %v %v %s %s %v %s %s %dms\n",
+		toLog(entry.Data, ClientHost, defaultValue, false),
+		toLog(entry.Data, ClientUsername, defaultValue, false),
+		timestamp,
+		toLog(entry.Data, RequestMethod, defaultValue, false),
+		toLog(entry.Data, RequestPath, defaultValue, false),
+		toLog(entry.Data, RequestProtocol, defaultValue, false),
+		toLog(entry.Data, OriginStatus, defaultValue, true),
+		toLog(entry.Data, OriginContentSize, defaultValue, true),
+		toLog(entry.Data, "request_Referer", `"-"`, true),
+		toLog(entry.Data, "request_User-Agent", `"-"`, true),
+		toLog(entry.Data, RequestCount, defaultValue, true),
+		toLog(entry.Data, FrontendName, defaultValue, true),
+		toLog(entry.Data, BackendURL, defaultValue, true),
+		elapsedMillis)
+
+	return b.Bytes(), err
+}
+
+func toLog(fields logrus.Fields, key string, defaultValue string, quoted bool) interface{} {
+	if v, ok := fields[key]; ok {
+		if v == nil {
+			return defaultValue
+		}
+
+		switch s := v.(type) {
+		case string:
+			return toLogEntry(s, defaultValue, quoted)
+
+		case fmt.Stringer:
+			return toLogEntry(s.String(), defaultValue, quoted)
+
+		default:
+			return v
+		}
+	}
+	return defaultValue
+
+}
+func toLogEntry(s string, defaultValue string, quote bool) string {
+	if len(s) == 0 {
+		return defaultValue
+	}
+
+	if quote {
+		return `"` + s + `"`
+	}
+	return s
+}

old/middlewares/accesslog/logger_formatters_test.go

@@ -0,0 +1,140 @@
+package accesslog
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCommonLogFormatter_Format(t *testing.T) {
+	clf := CommonLogFormatter{}
+
+	testCases := []struct {
+		name        string
+		data        map[string]interface{}
+		expectedLog string
+	}{
+		{
+			name: "OriginStatus & OriginContentSize are nil",
+			data: map[string]interface{}{
+				StartUTC:               time.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC),
+				Duration:               123 * time.Second,
+				ClientHost:             "10.0.0.1",
+				ClientUsername:         "Client",
+				RequestMethod:          http.MethodGet,
+				RequestPath:            "/foo",
+				RequestProtocol:        "http",
+				OriginStatus:           nil,
+				OriginContentSize:      nil,
+				RequestRefererHeader:   "",
+				RequestUserAgentHeader: "",
+				RequestCount:           0,
+				FrontendName:           "",
+				BackendURL:             "",
+			},
+			expectedLog: `10.0.0.1 - Client [10/Nov/2009:23:00:00 +0000] "GET /foo http" - - "-" "-" 0 - - 123000ms
+`,
+		},
+		{
+			name: "all data",
+			data: map[string]interface{}{
+				StartUTC:               time.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC),
+				Duration:               123 * time.Second,
+				ClientHost:             "10.0.0.1",
+				ClientUsername:         "Client",
+				RequestMethod:          http.MethodGet,
+				RequestPath:            "/foo",
+				RequestProtocol:        "http",
+				OriginStatus:           123,
+				OriginContentSize:      132,
+				RequestRefererHeader:   "referer",
+				RequestUserAgentHeader: "agent",
+				RequestCount:           nil,
+				FrontendName:           "foo",
+				BackendURL:             "http://10.0.0.2/toto",
+			},
+			expectedLog: `10.0.0.1 - Client [10/Nov/2009:23:00:00 +0000] "GET /foo http" 123 132 "referer" "agent" - "foo" "http://10.0.0.2/toto" 123000ms
+`,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			entry := &logrus.Entry{Data: test.data}
+
+			raw, err := clf.Format(entry)
+			assert.NoError(t, err)
+
+			assert.Equal(t, test.expectedLog, string(raw))
+		})
+	}
+
+}
+
+func Test_toLog(t *testing.T) {
+
+	testCases := []struct {
+		desc         string
+		fields       logrus.Fields
+		fieldName    string
+		defaultValue string
+		quoted       bool
+		expectedLog  interface{}
+	}{
+		{
+			desc: "Should return int 1",
+			fields: logrus.Fields{
+				"Powpow": 1,
+			},
+			fieldName:    "Powpow",
+			defaultValue: defaultValue,
+			quoted:       false,
+			expectedLog:  1,
+		},
+		{
+			desc: "Should return string foo",
+			fields: logrus.Fields{
+				"Powpow": "foo",
+			},
+			fieldName:    "Powpow",
+			defaultValue: defaultValue,
+			quoted:       true,
+			expectedLog:  `"foo"`,
+		},
+		{
+			desc: "Should return defaultValue if fieldName does not exist",
+			fields: logrus.Fields{
+				"Powpow": "foo",
+			},
+			fieldName:    "",
+			defaultValue: defaultValue,
+			quoted:       false,
+			expectedLog:  "-",
+		},
+		{
+			desc:         "Should return defaultValue if fields is nil",
+			fields:       nil,
+			fieldName:    "",
+			defaultValue: defaultValue,
+			quoted:       false,
+			expectedLog:  "-",
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			lg := toLog(test.fields, test.fieldName, defaultValue, test.quoted)
+
+			assert.Equal(t, test.expectedLog, lg)
+		})
+	}
+}

old/middlewares/accesslog/logger_test.go

@@ -0,0 +1,644 @@
+package accesslog
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/containous/flaeg/parse"
+	"github.com/containous/traefik/old/log"
+	"github.com/containous/traefik/old/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	logFileNameSuffix       = "/traefik/logger/test.log"
+	testContent             = "Hello, World"
+	testBackendName         = "http://127.0.0.1/testBackend"
+	testFrontendName        = "testFrontend"
+	testStatus              = 123
+	testContentSize   int64 = 12
+	testHostname            = "TestHost"
+	testUsername            = "TestUser"
+	testPath                = "testpath"
+	testPort                = 8181
+	testProto               = "HTTP/0.0"
+	testMethod              = http.MethodPost
+	testReferer             = "testReferer"
+	testUserAgent           = "testUserAgent"
+	testRetryAttempts       = 2
+	testStart               = time.Now()
+)
+
+func TestLogRotation(t *testing.T) {
+	tempDir, err := ioutil.TempDir("", "traefik_")
+	if err != nil {
+		t.Fatalf("Error setting up temporary directory: %s", err)
+	}
+
+	fileName := tempDir + "traefik.log"
+	rotatedFileName := fileName + ".rotated"
+
+	config := &types.AccessLog{FilePath: fileName, Format: CommonFormat}
+	logHandler, err := NewLogHandler(config)
+	if err != nil {
+		t.Fatalf("Error creating new log handler: %s", err)
+	}
+	defer logHandler.Close()
+
+	recorder := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "http://localhost", nil)
+	next := func(rw http.ResponseWriter, req *http.Request) {
+		rw.WriteHeader(http.StatusOK)
+	}
+
+	iterations := 20
+	halfDone := make(chan bool)
+	writeDone := make(chan bool)
+	go func() {
+		for i := 0; i < iterations; i++ {
+			logHandler.ServeHTTP(recorder, req, next)
+			if i == iterations/2 {
+				halfDone <- true
+			}
+		}
+		writeDone <- true
+	}()
+
+	<-halfDone
+	err = os.Rename(fileName, rotatedFileName)
+	if err != nil {
+		t.Fatalf("Error renaming file: %s", err)
+	}
+
+	err = logHandler.Rotate()
+	if err != nil {
+		t.Fatalf("Error rotating file: %s", err)
+	}
+
+	select {
+	case <-writeDone:
+		gotLineCount := lineCount(t, fileName) + lineCount(t, rotatedFileName)
+		if iterations != gotLineCount {
+			t.Errorf("Wanted %d written log lines, got %d", iterations, gotLineCount)
+		}
+	case <-time.After(500 * time.Millisecond):
+		t.Fatalf("test timed out")
+	}
+
+	close(halfDone)
+	close(writeDone)
+}
+
+func lineCount(t *testing.T, fileName string) int {
+	t.Helper()
+	fileContents, err := ioutil.ReadFile(fileName)
+	if err != nil {
+		t.Fatalf("Error reading from file %s: %s", fileName, err)
+	}
+
+	count := 0
+	for _, line := range strings.Split(string(fileContents), "\n") {
+		if strings.TrimSpace(line) == "" {
+			continue
+		}
+		count++
+	}
+
+	return count
+}
+
+func TestLoggerCLF(t *testing.T) {
+	tmpDir := createTempDir(t, CommonFormat)
+	defer os.RemoveAll(tmpDir)
+
+	logFilePath := filepath.Join(tmpDir, logFileNameSuffix)
+	config := &types.AccessLog{FilePath: logFilePath, Format: CommonFormat}
+	doLogging(t, config)
+
+	logData, err := ioutil.ReadFile(logFilePath)
+	require.NoError(t, err)
+
+	expectedLog := ` TestHost - TestUser [13/Apr/2016:07:14:19 -0700] "POST testpath HTTP/0.0" 123 12 "testReferer" "testUserAgent" 1 "testFrontend" "http://127.0.0.1/testBackend" 1ms`
+	assertValidLogData(t, expectedLog, logData)
+}
+
+func TestAsyncLoggerCLF(t *testing.T) {
+	tmpDir := createTempDir(t, CommonFormat)
+	defer os.RemoveAll(tmpDir)
+
+	logFilePath := filepath.Join(tmpDir, logFileNameSuffix)
+	config := &types.AccessLog{FilePath: logFilePath, Format: CommonFormat, BufferingSize: 1024}
+	doLogging(t, config)
+
+	logData, err := ioutil.ReadFile(logFilePath)
+	require.NoError(t, err)
+
+	expectedLog := ` TestHost - TestUser [13/Apr/2016:07:14:19 -0700] "POST testpath HTTP/0.0" 123 12 "testReferer" "testUserAgent" 1 "testFrontend" "http://127.0.0.1/testBackend" 1ms`
+	assertValidLogData(t, expectedLog, logData)
+}
+
+func assertString(exp string) func(t *testing.T, actual interface{}) {
+	return func(t *testing.T, actual interface{}) {
+		t.Helper()
+
+		assert.Equal(t, exp, actual)
+	}
+}
+
+func assertNotEqual(exp string) func(t *testing.T, actual interface{}) {
+	return func(t *testing.T, actual interface{}) {
+		t.Helper()
+
+		assert.NotEqual(t, exp, actual)
+	}
+}
+
+func assertFloat64(exp float64) func(t *testing.T, actual interface{}) {
+	return func(t *testing.T, actual interface{}) {
+		t.Helper()
+
+		assert.Equal(t, exp, actual)
+	}
+}
+
+func assertFloat64NotZero() func(t *testing.T, actual interface{}) {
+	return func(t *testing.T, actual interface{}) {
+		t.Helper()
+
+		assert.NotZero(t, actual)
+	}
+}
+
+func TestLoggerJSON(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		config   *types.AccessLog
+		expected map[string]func(t *testing.T, value interface{})
+	}{
+		{
+			desc: "default config",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   JSONFormat,
+			},
+			expected: map[string]func(t *testing.T, value interface{}){
+				RequestHost:               assertString(testHostname),
+				RequestAddr:               assertString(testHostname),
+				RequestMethod:             assertString(testMethod),
+				RequestPath:               assertString(testPath),
+				RequestProtocol:           assertString(testProto),
+				RequestPort:               assertString("-"),
+				DownstreamStatus:          assertFloat64(float64(testStatus)),
+				DownstreamContentSize:     assertFloat64(float64(len(testContent))),
+				OriginContentSize:         assertFloat64(float64(len(testContent))),
+				OriginStatus:              assertFloat64(float64(testStatus)),
+				RequestRefererHeader:      assertString(testReferer),
+				RequestUserAgentHeader:    assertString(testUserAgent),
+				FrontendName:              assertString(testFrontendName),
+				BackendURL:                assertString(testBackendName),
+				ClientUsername:            assertString(testUsername),
+				ClientHost:                assertString(testHostname),
+				ClientPort:                assertString(fmt.Sprintf("%d", testPort)),
+				ClientAddr:                assertString(fmt.Sprintf("%s:%d", testHostname, testPort)),
+				"level":                   assertString("info"),
+				"msg":                     assertString(""),
+				"downstream_Content-Type": assertString("text/plain; charset=utf-8"),
+				RequestCount:              assertFloat64NotZero(),
+				Duration:                  assertFloat64NotZero(),
+				Overhead:                  assertFloat64NotZero(),
+				RetryAttempts:             assertFloat64(float64(testRetryAttempts)),
+				"time":                    assertNotEqual(""),
+				"StartLocal":              assertNotEqual(""),
+				"StartUTC":                assertNotEqual(""),
+			},
+		},
+		{
+			desc: "default config drop all fields",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   JSONFormat,
+				Fields: &types.AccessLogFields{
+					DefaultMode: "drop",
+				},
+			},
+			expected: map[string]func(t *testing.T, value interface{}){
+				"level":                   assertString("info"),
+				"msg":                     assertString(""),
+				"time":                    assertNotEqual(""),
+				"downstream_Content-Type": assertString("text/plain; charset=utf-8"),
+				RequestRefererHeader:      assertString(testReferer),
+				RequestUserAgentHeader:    assertString(testUserAgent),
+			},
+		},
+		{
+			desc: "default config drop all fields and headers",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   JSONFormat,
+				Fields: &types.AccessLogFields{
+					DefaultMode: "drop",
+					Headers: &types.FieldHeaders{
+						DefaultMode: "drop",
+					},
+				},
+			},
+			expected: map[string]func(t *testing.T, value interface{}){
+				"level": assertString("info"),
+				"msg":   assertString(""),
+				"time":  assertNotEqual(""),
+			},
+		},
+		{
+			desc: "default config drop all fields and redact headers",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   JSONFormat,
+				Fields: &types.AccessLogFields{
+					DefaultMode: "drop",
+					Headers: &types.FieldHeaders{
+						DefaultMode: "redact",
+					},
+				},
+			},
+			expected: map[string]func(t *testing.T, value interface{}){
+				"level":                   assertString("info"),
+				"msg":                     assertString(""),
+				"time":                    assertNotEqual(""),
+				"downstream_Content-Type": assertString("REDACTED"),
+				RequestRefererHeader:      assertString("REDACTED"),
+				RequestUserAgentHeader:    assertString("REDACTED"),
+			},
+		},
+		{
+			desc: "default config drop all fields and headers but kept someone",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   JSONFormat,
+				Fields: &types.AccessLogFields{
+					DefaultMode: "drop",
+					Names: types.FieldNames{
+						RequestHost: "keep",
+					},
+					Headers: &types.FieldHeaders{
+						DefaultMode: "drop",
+						Names: types.FieldHeaderNames{
+							"Referer": "keep",
+						},
+					},
+				},
+			},
+			expected: map[string]func(t *testing.T, value interface{}){
+				RequestHost:          assertString(testHostname),
+				"level":              assertString("info"),
+				"msg":                assertString(""),
+				"time":               assertNotEqual(""),
+				RequestRefererHeader: assertString(testReferer),
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			tmpDir := createTempDir(t, JSONFormat)
+			defer os.RemoveAll(tmpDir)
+
+			logFilePath := filepath.Join(tmpDir, logFileNameSuffix)
+
+			test.config.FilePath = logFilePath
+			doLogging(t, test.config)
+
+			logData, err := ioutil.ReadFile(logFilePath)
+			require.NoError(t, err)
+
+			jsonData := make(map[string]interface{})
+			err = json.Unmarshal(logData, &jsonData)
+			require.NoError(t, err)
+
+			assert.Equal(t, len(test.expected), len(jsonData))
+
+			for field, assertion := range test.expected {
+				assertion(t, jsonData[field])
+			}
+		})
+	}
+}
+
+func TestNewLogHandlerOutputStdout(t *testing.T) {
+	testCases := []struct {
+		desc        string
+		config      *types.AccessLog
+		expectedLog string
+	}{
+		{
+			desc: "default config",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+			},
+			expectedLog: `TestHost - TestUser [13/Apr/2016:07:14:19 -0700] "POST testpath HTTP/0.0" 123 12 "testReferer" "testUserAgent" 23 "testFrontend" "http://127.0.0.1/testBackend" 1ms`,
+		},
+		{
+			desc: "default config with empty filters",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Filters:  &types.AccessLogFilters{},
+			},
+			expectedLog: `TestHost - TestUser [13/Apr/2016:07:14:19 -0700] "POST testpath HTTP/0.0" 123 12 "testReferer" "testUserAgent" 23 "testFrontend" "http://127.0.0.1/testBackend" 1ms`,
+		},
+		{
+			desc: "Status code filter not matching",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Filters: &types.AccessLogFilters{
+					StatusCodes: []string{"200"},
+				},
+			},
+			expectedLog: ``,
+		},
+		{
+			desc: "Status code filter matching",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Filters: &types.AccessLogFilters{
+					StatusCodes: []string{"123"},
+				},
+			},
+			expectedLog: `TestHost - TestUser [13/Apr/2016:07:14:19 -0700] "POST testpath HTTP/0.0" 123 12 "testReferer" "testUserAgent" 23 "testFrontend" "http://127.0.0.1/testBackend" 1ms`,
+		},
+		{
+			desc: "Duration filter not matching",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Filters: &types.AccessLogFilters{
+					MinDuration: parse.Duration(1 * time.Hour),
+				},
+			},
+			expectedLog: ``,
+		},
+		{
+			desc: "Duration filter matching",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Filters: &types.AccessLogFilters{
+					MinDuration: parse.Duration(1 * time.Millisecond),
+				},
+			},
+			expectedLog: `TestHost - TestUser [13/Apr/2016:07:14:19 -0700] "POST testpath HTTP/0.0" 123 12 "testReferer" "testUserAgent" 23 "testFrontend" "http://127.0.0.1/testBackend" 1ms`,
+		},
+		{
+			desc: "Retry attempts filter matching",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Filters: &types.AccessLogFilters{
+					RetryAttempts: true,
+				},
+			},
+			expectedLog: `TestHost - TestUser [13/Apr/2016:07:14:19 -0700] "POST testpath HTTP/0.0" 123 12 "testReferer" "testUserAgent" 23 "testFrontend" "http://127.0.0.1/testBackend" 1ms`,
+		},
+		{
+			desc: "Default mode keep",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Fields: &types.AccessLogFields{
+					DefaultMode: "keep",
+				},
+			},
+			expectedLog: `TestHost - TestUser [13/Apr/2016:07:14:19 -0700] "POST testpath HTTP/0.0" 123 12 "testReferer" "testUserAgent" 23 "testFrontend" "http://127.0.0.1/testBackend" 1ms`,
+		},
+		{
+			desc: "Default mode keep with override",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Fields: &types.AccessLogFields{
+					DefaultMode: "keep",
+					Names: types.FieldNames{
+						ClientHost: "drop",
+					},
+				},
+			},
+			expectedLog: `- - TestUser [13/Apr/2016:07:14:19 -0700] "POST testpath HTTP/0.0" 123 12 "testReferer" "testUserAgent" 23 "testFrontend" "http://127.0.0.1/testBackend" 1ms`,
+		},
+		{
+			desc: "Default mode drop",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Fields: &types.AccessLogFields{
+					DefaultMode: "drop",
+				},
+			},
+			expectedLog: `- - - [-] "- - -" - - "testReferer" "testUserAgent" - - - 0ms`,
+		},
+		{
+			desc: "Default mode drop with override",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Fields: &types.AccessLogFields{
+					DefaultMode: "drop",
+					Names: types.FieldNames{
+						ClientHost:     "drop",
+						ClientUsername: "keep",
+					},
+				},
+			},
+			expectedLog: `- - TestUser [-] "- - -" - - "testReferer" "testUserAgent" - - - 0ms`,
+		},
+		{
+			desc: "Default mode drop with header dropped",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Fields: &types.AccessLogFields{
+					DefaultMode: "drop",
+					Names: types.FieldNames{
+						ClientHost:     "drop",
+						ClientUsername: "keep",
+					},
+					Headers: &types.FieldHeaders{
+						DefaultMode: "drop",
+					},
+				},
+			},
+			expectedLog: `- - TestUser [-] "- - -" - - "-" "-" - - - 0ms`,
+		},
+		{
+			desc: "Default mode drop with header redacted",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Fields: &types.AccessLogFields{
+					DefaultMode: "drop",
+					Names: types.FieldNames{
+						ClientHost:     "drop",
+						ClientUsername: "keep",
+					},
+					Headers: &types.FieldHeaders{
+						DefaultMode: "redact",
+					},
+				},
+			},
+			expectedLog: `- - TestUser [-] "- - -" - - "REDACTED" "REDACTED" - - - 0ms`,
+		},
+		{
+			desc: "Default mode drop with header redacted",
+			config: &types.AccessLog{
+				FilePath: "",
+				Format:   CommonFormat,
+				Fields: &types.AccessLogFields{
+					DefaultMode: "drop",
+					Names: types.FieldNames{
+						ClientHost:     "drop",
+						ClientUsername: "keep",
+					},
+					Headers: &types.FieldHeaders{
+						DefaultMode: "keep",
+						Names: types.FieldHeaderNames{
+							"Referer": "redact",
+						},
+					},
+				},
+			},
+			expectedLog: `- - TestUser [-] "- - -" - - "REDACTED" "testUserAgent" - - - 0ms`,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+
+			// NOTE: It is not possible to run these cases in parallel because we capture Stdout
+
+			file, restoreStdout := captureStdout(t)
+			defer restoreStdout()
+
+			doLogging(t, test.config)
+
+			written, err := ioutil.ReadFile(file.Name())
+			require.NoError(t, err, "unable to read captured stdout from file")
+			assertValidLogData(t, test.expectedLog, written)
+		})
+	}
+}
+
+func assertValidLogData(t *testing.T, expected string, logData []byte) {
+
+	if len(expected) == 0 {
+		assert.Zero(t, len(logData))
+		t.Log(string(logData))
+		return
+	}
+
+	result, err := ParseAccessLog(string(logData))
+	require.NoError(t, err)
+
+	resultExpected, err := ParseAccessLog(expected)
+	require.NoError(t, err)
+
+	formatErrMessage := fmt.Sprintf(`
+	Expected: %s
+	Actual:   %s`, expected, string(logData))
+
+	require.Equal(t, len(resultExpected), len(result), formatErrMessage)
+	assert.Equal(t, resultExpected[ClientHost], result[ClientHost], formatErrMessage)
+	assert.Equal(t, resultExpected[ClientUsername], result[ClientUsername], formatErrMessage)
+	assert.Equal(t, resultExpected[RequestMethod], result[RequestMethod], formatErrMessage)
+	assert.Equal(t, resultExpected[RequestPath], result[RequestPath], formatErrMessage)
+	assert.Equal(t, resultExpected[RequestProtocol], result[RequestProtocol], formatErrMessage)
+	assert.Equal(t, resultExpected[OriginStatus], result[OriginStatus], formatErrMessage)
+	assert.Equal(t, resultExpected[OriginContentSize], result[OriginContentSize], formatErrMessage)
+	assert.Equal(t, resultExpected[RequestRefererHeader], result[RequestRefererHeader], formatErrMessage)
+	assert.Equal(t, resultExpected[RequestUserAgentHeader], result[RequestUserAgentHeader], formatErrMessage)
+	assert.Regexp(t, regexp.MustCompile("[0-9]*"), result[RequestCount], formatErrMessage)
+	assert.Equal(t, resultExpected[FrontendName], result[FrontendName], formatErrMessage)
+	assert.Equal(t, resultExpected[BackendURL], result[BackendURL], formatErrMessage)
+	assert.Regexp(t, regexp.MustCompile("[0-9]*ms"), result[Duration], formatErrMessage)
+}
+
+func captureStdout(t *testing.T) (out *os.File, restoreStdout func()) {
+	file, err := ioutil.TempFile("", "testlogger")
+	require.NoError(t, err, "failed to create temp file")
+
+	original := os.Stdout
+	os.Stdout = file
+
+	restoreStdout = func() {
+		os.Stdout = original
+	}
+
+	return file, restoreStdout
+}
+
+func createTempDir(t *testing.T, prefix string) string {
+	tmpDir, err := ioutil.TempDir("", prefix)
+	require.NoError(t, err, "failed to create temp dir")
+
+	return tmpDir
+}
+
+func doLogging(t *testing.T, config *types.AccessLog) {
+	logger, err := NewLogHandler(config)
+	require.NoError(t, err)
+	defer logger.Close()
+
+	if config.FilePath != "" {
+		_, err = os.Stat(config.FilePath)
+		require.NoError(t, err, fmt.Sprintf("logger should create %s", config.FilePath))
+	}
+
+	req := &http.Request{
+		Header: map[string][]string{
+			"User-Agent": {testUserAgent},
+			"Referer":    {testReferer},
+		},
+		Proto:      testProto,
+		Host:       testHostname,
+		Method:     testMethod,
+		RemoteAddr: fmt.Sprintf("%s:%d", testHostname, testPort),
+		URL: &url.URL{
+			Path: testPath,
+		},
+	}
+
+	logger.ServeHTTP(httptest.NewRecorder(), req, logWriterTestHandlerFunc)
+}
+
+func logWriterTestHandlerFunc(rw http.ResponseWriter, r *http.Request) {
+	if _, err := rw.Write([]byte(testContent)); err != nil {
+		log.Error(err)
+	}
+
+	rw.WriteHeader(testStatus)
+
+	logDataTable := GetLogDataTable(r)
+	logDataTable.Core[FrontendName] = testFrontendName
+	logDataTable.Core[BackendURL] = testBackendName
+	logDataTable.Core[OriginStatus] = testStatus
+	logDataTable.Core[OriginContentSize] = testContentSize
+	logDataTable.Core[RetryAttempts] = testRetryAttempts
+	logDataTable.Core[StartUTC] = testStart.UTC()
+	logDataTable.Core[StartLocal] = testStart.Local()
+	logDataTable.Core[ClientUsername] = testUsername
+}

old/middlewares/accesslog/parser.go

@@ -0,0 +1,54 @@
+package accesslog
+
+import (
+	"bytes"
+	"regexp"
+)
+
+// ParseAccessLog parse line of access log and return a map with each fields
+func ParseAccessLog(data string) (map[string]string, error) {
+	var buffer bytes.Buffer
+	buffer.WriteString(`(\S+)`)                  // 1 - ClientHost
+	buffer.WriteString(`\s-\s`)                  // - - Spaces
+	buffer.WriteString(`(\S+)\s`)                // 2 - ClientUsername
+	buffer.WriteString(`\[([^]]+)\]\s`)          // 3 - StartUTC
+	buffer.WriteString(`"(\S*)\s?`)              // 4 - RequestMethod
+	buffer.WriteString(`((?:[^"]*(?:\\")?)*)\s`) // 5 - RequestPath
+	buffer.WriteString(`([^"]*)"\s`)             // 6 - RequestProtocol
+	buffer.WriteString(`(\S+)\s`)                // 7 - OriginStatus
+	buffer.WriteString(`(\S+)\s`)                // 8 - OriginContentSize
+	buffer.WriteString(`("?\S+"?)\s`)            // 9 - Referrer
+	buffer.WriteString(`("\S+")\s`)              // 10 - User-Agent
+	buffer.WriteString(`(\S+)\s`)                // 11 - RequestCount
+	buffer.WriteString(`("[^"]*"|-)\s`)          // 12 - FrontendName
+	buffer.WriteString(`("[^"]*"|-)\s`)          // 13 - BackendURL
+	buffer.WriteString(`(\S+)`)                  // 14 - Duration
+
+	regex, err := regexp.Compile(buffer.String())
+	if err != nil {
+		return nil, err
+	}
+
+	submatch := regex.FindStringSubmatch(data)
+	result := make(map[string]string)
+
+	// Need to be > 13 to match CLF format
+	if len(submatch) > 13 {
+		result[ClientHost] = submatch[1]
+		result[ClientUsername] = submatch[2]
+		result[StartUTC] = submatch[3]
+		result[RequestMethod] = submatch[4]
+		result[RequestPath] = submatch[5]
+		result[RequestProtocol] = submatch[6]
+		result[OriginStatus] = submatch[7]
+		result[OriginContentSize] = submatch[8]
+		result[RequestRefererHeader] = submatch[9]
+		result[RequestUserAgentHeader] = submatch[10]
+		result[RequestCount] = submatch[11]
+		result[FrontendName] = submatch[12]
+		result[BackendURL] = submatch[13]
+		result[Duration] = submatch[14]
+	}
+
+	return result, nil
+}

old/middlewares/accesslog/parser_test.go

@@ -0,0 +1,75 @@
+package accesslog
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseAccessLog(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		value    string
+		expected map[string]string
+	}{
+		{
+			desc:  "full log",
+			value: `TestHost - TestUser [13/Apr/2016:07:14:19 -0700] "POST testpath HTTP/0.0" 123 12 "testReferer" "testUserAgent" 1 "testFrontend" "http://127.0.0.1/testBackend" 1ms`,
+			expected: map[string]string{
+				ClientHost:             "TestHost",
+				ClientUsername:         "TestUser",
+				StartUTC:               "13/Apr/2016:07:14:19 -0700",
+				RequestMethod:          "POST",
+				RequestPath:            "testpath",
+				RequestProtocol:        "HTTP/0.0",
+				OriginStatus:           "123",
+				OriginContentSize:      "12",
+				RequestRefererHeader:   `"testReferer"`,
+				RequestUserAgentHeader: `"testUserAgent"`,
+				RequestCount:           "1",
+				FrontendName:           `"testFrontend"`,
+				BackendURL:             `"http://127.0.0.1/testBackend"`,
+				Duration:               "1ms",
+			},
+		},
+		{
+			desc:  "log with space",
+			value: `127.0.0.1 - - [09/Mar/2018:10:51:32 +0000] "GET / HTTP/1.1" 401 17 "-" "Go-http-client/1.1" 1 "testFrontend with space" - 0ms`,
+			expected: map[string]string{
+				ClientHost:             "127.0.0.1",
+				ClientUsername:         "-",
+				StartUTC:               "09/Mar/2018:10:51:32 +0000",
+				RequestMethod:          "GET",
+				RequestPath:            "/",
+				RequestProtocol:        "HTTP/1.1",
+				OriginStatus:           "401",
+				OriginContentSize:      "17",
+				RequestRefererHeader:   `"-"`,
+				RequestUserAgentHeader: `"Go-http-client/1.1"`,
+				RequestCount:           "1",
+				FrontendName:           `"testFrontend with space"`,
+				BackendURL:             `-`,
+				Duration:               "0ms",
+			},
+		},
+		{
+			desc:     "bad log",
+			value:    `bad`,
+			expected: map[string]string{},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			result, err := ParseAccessLog(test.value)
+			assert.NoError(t, err)
+			assert.Equal(t, len(test.expected), len(result))
+			for key, value := range test.expected {
+				assert.Equal(t, value, result[key])
+			}
+		})
+	}
+}

old/middlewares/accesslog/save_backend.go

@@ -0,0 +1,64 @@
+package accesslog
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/urfave/negroni"
+	"github.com/vulcand/oxy/utils"
+)
+
+// SaveBackend sends the backend name to the logger.
+// These are always used with a corresponding SaveFrontend handler.
+type SaveBackend struct {
+	next        http.Handler
+	backendName string
+}
+
+// NewSaveBackend creates a SaveBackend handler.
+func NewSaveBackend(next http.Handler, backendName string) http.Handler {
+	return &SaveBackend{next, backendName}
+}
+
+func (sb *SaveBackend) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	serveSaveBackend(rw, r, sb.backendName, func(crw *captureResponseWriter) {
+		sb.next.ServeHTTP(crw, r)
+	})
+}
+
+// SaveNegroniBackend sends the backend name to the logger.
+type SaveNegroniBackend struct {
+	next        negroni.Handler
+	backendName string
+}
+
+// NewSaveNegroniBackend creates a SaveBackend handler.
+func NewSaveNegroniBackend(next negroni.Handler, backendName string) negroni.Handler {
+	return &SaveNegroniBackend{next, backendName}
+}
+
+func (sb *SaveNegroniBackend) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	serveSaveBackend(rw, r, sb.backendName, func(crw *captureResponseWriter) {
+		sb.next.ServeHTTP(crw, r, next)
+	})
+}
+
+func serveSaveBackend(rw http.ResponseWriter, r *http.Request, backendName string, apply func(*captureResponseWriter)) {
+	table := GetLogDataTable(r)
+	table.Core[BackendName] = backendName
+	table.Core[BackendURL] = r.URL // note that this is *not* the original incoming URL
+	table.Core[BackendAddr] = r.URL.Host
+
+	crw := &captureResponseWriter{rw: rw}
+	start := time.Now().UTC()
+
+	apply(crw)
+
+	// use UTC to handle switchover of daylight saving correctly
+	table.Core[OriginDuration] = time.Now().UTC().Sub(start)
+	table.Core[OriginStatus] = crw.Status()
+	// make copy of headers so we can ensure there is no subsequent mutation during response processing
+	table.OriginResponse = make(http.Header)
+	utils.CopyHeaders(table.OriginResponse, crw.Header())
+	table.Core[OriginContentSize] = crw.Size()
+}

old/middlewares/accesslog/save_frontend.go

@@ -0,0 +1,51 @@
+package accesslog
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/urfave/negroni"
+)
+
+// SaveFrontend sends the frontend name to the logger.
+// These are sometimes used with a corresponding SaveBackend handler, but not always.
+// For example, redirected requests don't reach a backend.
+type SaveFrontend struct {
+	next         http.Handler
+	frontendName string
+}
+
+// NewSaveFrontend creates a SaveFrontend handler.
+func NewSaveFrontend(next http.Handler, frontendName string) http.Handler {
+	return &SaveFrontend{next, frontendName}
+}
+
+func (sf *SaveFrontend) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	serveSaveFrontend(r, sf.frontendName, func() {
+		sf.next.ServeHTTP(rw, r)
+	})
+}
+
+// SaveNegroniFrontend sends the frontend name to the logger.
+type SaveNegroniFrontend struct {
+	next         negroni.Handler
+	frontendName string
+}
+
+// NewSaveNegroniFrontend creates a SaveNegroniFrontend handler.
+func NewSaveNegroniFrontend(next negroni.Handler, frontendName string) negroni.Handler {
+	return &SaveNegroniFrontend{next, frontendName}
+}
+
+func (sf *SaveNegroniFrontend) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	serveSaveFrontend(r, sf.frontendName, func() {
+		sf.next.ServeHTTP(rw, r, next)
+	})
+}
+
+func serveSaveFrontend(r *http.Request, frontendName string, apply func()) {
+	table := GetLogDataTable(r)
+	table.Core[FrontendName] = strings.TrimPrefix(frontendName, "frontend-")
+
+	apply()
+}

old/middlewares/accesslog/save_retries.go

@@ -0,0 +1,19 @@
+package accesslog
+
+import (
+	"net/http"
+)
+
+// SaveRetries is an implementation of RetryListener that stores RetryAttempts in the LogDataTable.
+type SaveRetries struct{}
+
+// Retried implements the RetryListener interface and will be called for each retry that happens.
+func (s *SaveRetries) Retried(req *http.Request, attempt int) {
+	// it is the request attempt x, but the retry attempt is x-1
+	if attempt > 0 {
+		attempt--
+	}
+
+	table := GetLogDataTable(req)
+	table.Core[RetryAttempts] = attempt
+}

old/middlewares/accesslog/save_retries_test.go

@@ -0,0 +1,48 @@
+package accesslog
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestSaveRetries(t *testing.T) {
+	tests := []struct {
+		requestAttempt         int
+		wantRetryAttemptsInLog int
+	}{
+		{
+			requestAttempt:         0,
+			wantRetryAttemptsInLog: 0,
+		},
+		{
+			requestAttempt:         1,
+			wantRetryAttemptsInLog: 0,
+		},
+		{
+			requestAttempt:         3,
+			wantRetryAttemptsInLog: 2,
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+
+		t.Run(fmt.Sprintf("%d retries", test.requestAttempt), func(t *testing.T) {
+			t.Parallel()
+			saveRetries := &SaveRetries{}
+
+			logDataTable := &LogData{Core: make(CoreLogData)}
+			req := httptest.NewRequest(http.MethodGet, "/some/path", nil)
+			reqWithDataTable := req.WithContext(context.WithValue(req.Context(), DataTableKey, logDataTable))
+
+			saveRetries.Retried(reqWithDataTable, test.requestAttempt)
+
+			if logDataTable.Core[RetryAttempts] != test.wantRetryAttemptsInLog {
+				t.Errorf("got %v in logDataTable, want %v", logDataTable.Core[RetryAttempts], test.wantRetryAttemptsInLog)
+			}
+		})
+	}
+}

old/middlewares/accesslog/save_username.go

@@ -0,0 +1,60 @@
+package accesslog
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/urfave/negroni"
+)
+
+const (
+	clientUsernameKey key = "ClientUsername"
+)
+
+// SaveUsername sends the Username name to the access logger.
+type SaveUsername struct {
+	next http.Handler
+}
+
+// NewSaveUsername creates a SaveUsername handler.
+func NewSaveUsername(next http.Handler) http.Handler {
+	return &SaveUsername{next}
+}
+
+func (sf *SaveUsername) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	serveSaveUsername(r, func() {
+		sf.next.ServeHTTP(rw, r)
+	})
+}
+
+// SaveNegroniUsername adds the Username to the access logger data table.
+type SaveNegroniUsername struct {
+	next negroni.Handler
+}
+
+// NewSaveNegroniUsername creates a SaveNegroniUsername handler.
+func NewSaveNegroniUsername(next negroni.Handler) negroni.Handler {
+	return &SaveNegroniUsername{next}
+}
+
+func (sf *SaveNegroniUsername) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	serveSaveUsername(r, func() {
+		sf.next.ServeHTTP(rw, r, next)
+	})
+}
+
+func serveSaveUsername(r *http.Request, apply func()) {
+	table := GetLogDataTable(r)
+
+	username, ok := r.Context().Value(clientUsernameKey).(string)
+	if ok {
+		table.Core[ClientUsername] = username
+	}
+
+	apply()
+}
+
+// WithUserName adds a username to a requests' context
+func WithUserName(req *http.Request, username string) *http.Request {
+	return req.WithContext(context.WithValue(req.Context(), clientUsernameKey, username))
+}

old/middlewares/addPrefix.go

@@ -0,0 +1,35 @@
+package middlewares
+
+import (
+	"context"
+	"net/http"
+)
+
+// AddPrefix is a middleware used to add prefix to an URL request
+type AddPrefix struct {
+	Handler http.Handler
+	Prefix  string
+}
+
+type key string
+
+const (
+	// AddPrefixKey is the key within the request context used to
+	// store the added prefix
+	AddPrefixKey key = "AddPrefix"
+)
+
+func (s *AddPrefix) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	r.URL.Path = s.Prefix + r.URL.Path
+	if r.URL.RawPath != "" {
+		r.URL.RawPath = s.Prefix + r.URL.RawPath
+	}
+	r.RequestURI = r.URL.RequestURI()
+	r = r.WithContext(context.WithValue(r.Context(), AddPrefixKey, s.Prefix))
+	s.Handler.ServeHTTP(w, r)
+}
+
+// SetHandler sets handler
+func (s *AddPrefix) SetHandler(Handler http.Handler) {
+	s.Handler = Handler
+}

old/middlewares/addPrefix_test.go

@@ -0,0 +1,66 @@
+package middlewares
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/containous/traefik/testhelpers"
+	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAddPrefix(t *testing.T) {
+	logrus.SetLevel(logrus.DebugLevel)
+	tests := []struct {
+		desc            string
+		prefix          string
+		path            string
+		expectedPath    string
+		expectedRawPath string
+	}{
+		{
+			desc:         "regular path",
+			prefix:       "/a",
+			path:         "/b",
+			expectedPath: "/a/b",
+		},
+		{
+			desc:            "raw path is supported",
+			prefix:          "/a",
+			path:            "/b%2Fc",
+			expectedPath:    "/a/b/c",
+			expectedRawPath: "/a/b%2Fc",
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			var actualPath, actualRawPath, requestURI string
+			handler := &AddPrefix{
+				Prefix: test.prefix,
+				Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					actualPath = r.URL.Path
+					actualRawPath = r.URL.RawPath
+					requestURI = r.RequestURI
+				}),
+			}
+
+			req := testhelpers.MustNewRequest(http.MethodGet, "http://localhost"+test.path, nil)
+
+			handler.ServeHTTP(nil, req)
+
+			assert.Equal(t, test.expectedPath, actualPath, "Unexpected path.")
+			assert.Equal(t, test.expectedRawPath, actualRawPath, "Unexpected raw path.")
+
+			expectedURI := test.expectedPath
+			if test.expectedRawPath != "" {
+				// go HTTP uses the raw path when existent in the RequestURI
+				expectedURI = test.expectedRawPath
+			}
+			assert.Equal(t, expectedURI, requestURI, "Unexpected request URI.")
+		})
+	}
+}

old/middlewares/auth/authenticator.go

@@ -0,0 +1,167 @@
+package auth
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"strings"
+
+	goauth "github.com/abbot/go-http-auth"
+	"github.com/containous/traefik/old/log"
+	"github.com/containous/traefik/old/middlewares/accesslog"
+	"github.com/containous/traefik/old/middlewares/tracing"
+	"github.com/containous/traefik/old/types"
+	"github.com/urfave/negroni"
+)
+
+// Authenticator is a middleware that provides HTTP basic and digest authentication
+type Authenticator struct {
+	handler negroni.Handler
+	users   map[string]string
+}
+
+type tracingAuthenticator struct {
+	name           string
+	handler        negroni.Handler
+	clientSpanKind bool
+}
+
+const (
+	authorizationHeader = "Authorization"
+)
+
+// NewAuthenticator builds a new Authenticator given a config
+func NewAuthenticator(authConfig *types.Auth, tracingMiddleware *tracing.Tracing) (*Authenticator, error) {
+	if authConfig == nil {
+		return nil, fmt.Errorf("error creating Authenticator: auth is nil")
+	}
+
+	var err error
+	authenticator := &Authenticator{}
+	tracingAuth := tracingAuthenticator{}
+
+	if authConfig.Basic != nil {
+		authenticator.users, err = parserBasicUsers(authConfig.Basic)
+		if err != nil {
+			return nil, err
+		}
+		realm := "traefik"
+		if authConfig.Basic.Realm != "" {
+			realm = authConfig.Basic.Realm
+		}
+		basicAuth := goauth.NewBasicAuthenticator(realm, authenticator.secretBasic)
+		tracingAuth.handler = createAuthBasicHandler(basicAuth, authConfig)
+		tracingAuth.name = "Auth Basic"
+		tracingAuth.clientSpanKind = false
+	} else if authConfig.Digest != nil {
+		authenticator.users, err = parserDigestUsers(authConfig.Digest)
+		if err != nil {
+			return nil, err
+		}
+
+		digestAuth := goauth.NewDigestAuthenticator("traefik", authenticator.secretDigest)
+		tracingAuth.handler = createAuthDigestHandler(digestAuth, authConfig)
+		tracingAuth.name = "Auth Digest"
+		tracingAuth.clientSpanKind = false
+	} else if authConfig.Forward != nil {
+		tracingAuth.handler = createAuthForwardHandler(authConfig)
+		tracingAuth.name = "Auth Forward"
+		tracingAuth.clientSpanKind = true
+	}
+
+	if tracingMiddleware != nil {
+		authenticator.handler = tracingMiddleware.NewNegroniHandlerWrapper(tracingAuth.name, tracingAuth.handler, tracingAuth.clientSpanKind)
+	} else {
+		authenticator.handler = tracingAuth.handler
+	}
+	return authenticator, nil
+}
+
+func createAuthForwardHandler(authConfig *types.Auth) negroni.HandlerFunc {
+	return negroni.HandlerFunc(func(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+		Forward(authConfig.Forward, w, r, next)
+	})
+}
+
+func createAuthDigestHandler(digestAuth *goauth.DigestAuth, authConfig *types.Auth) negroni.HandlerFunc {
+	return negroni.HandlerFunc(func(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+		if username, _ := digestAuth.CheckAuth(r); username == "" {
+			log.Debugf("Digest auth failed")
+			digestAuth.RequireAuth(w, r)
+		} else {
+			log.Debugf("Digest auth succeeded")
+
+			// set username in request context
+			r = accesslog.WithUserName(r, username)
+
+			if authConfig.HeaderField != "" {
+				r.Header[authConfig.HeaderField] = []string{username}
+			}
+			if authConfig.Digest.RemoveHeader {
+				log.Debugf("Remove the Authorization header from the Digest auth")
+				r.Header.Del(authorizationHeader)
+			}
+			next.ServeHTTP(w, r)
+		}
+	})
+}
+
+func createAuthBasicHandler(basicAuth *goauth.BasicAuth, authConfig *types.Auth) negroni.HandlerFunc {
+	return negroni.HandlerFunc(func(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+		if username := basicAuth.CheckAuth(r); username == "" {
+			log.Debugf("Basic auth failed")
+			basicAuth.RequireAuth(w, r)
+		} else {
+			log.Debugf("Basic auth succeeded")
+
+			// set username in request context
+			r = accesslog.WithUserName(r, username)
+
+			if authConfig.HeaderField != "" {
+				r.Header[authConfig.HeaderField] = []string{username}
+			}
+			if authConfig.Basic.RemoveHeader {
+				log.Debugf("Remove the Authorization header from the Basic auth")
+				r.Header.Del(authorizationHeader)
+			}
+			next.ServeHTTP(w, r)
+		}
+	})
+}
+
+func getLinesFromFile(filename string) ([]string, error) {
+	dat, err := ioutil.ReadFile(filename)
+	if err != nil {
+		return nil, err
+	}
+	// Trim lines and filter out blanks
+	rawLines := strings.Split(string(dat), "\n")
+	var filteredLines []string
+	for _, rawLine := range rawLines {
+		line := strings.TrimSpace(rawLine)
+		if line != "" {
+			filteredLines = append(filteredLines, line)
+		}
+	}
+	return filteredLines, nil
+}
+
+func (a *Authenticator) secretBasic(user, realm string) string {
+	if secret, ok := a.users[user]; ok {
+		return secret
+	}
+	log.Debugf("User not found: %s", user)
+	return ""
+}
+
+func (a *Authenticator) secretDigest(user, realm string) string {
+	if secret, ok := a.users[user+":"+realm]; ok {
+		return secret
+	}
+	log.Debugf("User not found: %s:%s", user, realm)
+	return ""
+}
+
+func (a *Authenticator) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	a.handler.ServeHTTP(rw, r, next)
+}

old/middlewares/auth/authenticator_test.go

@@ -0,0 +1,297 @@
+package auth
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"github.com/containous/traefik/old/middlewares/tracing"
+	"github.com/containous/traefik/old/types"
+	"github.com/containous/traefik/testhelpers"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/urfave/negroni"
+)
+
+func TestAuthUsersFromFile(t *testing.T) {
+	tests := []struct {
+		authType   string
+		usersStr   string
+		userKeys   []string
+		parserFunc func(fileName string) (map[string]string, error)
+	}{
+		{
+			authType: "basic",
+			usersStr: "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/\ntest2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0\n",
+			userKeys: []string{"test", "test2"},
+			parserFunc: func(fileName string) (map[string]string, error) {
+				basic := &types.Basic{
+					UsersFile: fileName,
+				}
+				return parserBasicUsers(basic)
+			},
+		},
+		{
+			authType: "digest",
+			usersStr: "test:traefik:a2688e031edb4be6a3797f3882655c05 \ntest2:traefik:518845800f9e2bfb1f1f740ec24f074e\n",
+			userKeys: []string{"test:traefik", "test2:traefik"},
+			parserFunc: func(fileName string) (map[string]string, error) {
+				digest := &types.Digest{
+					UsersFile: fileName,
+				}
+				return parserDigestUsers(digest)
+			},
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.authType, func(t *testing.T) {
+			t.Parallel()
+			usersFile, err := ioutil.TempFile("", "auth-users")
+			require.NoError(t, err)
+			defer os.Remove(usersFile.Name())
+
+			_, err = usersFile.Write([]byte(test.usersStr))
+			require.NoError(t, err)
+
+			users, err := test.parserFunc(usersFile.Name())
+			require.NoError(t, err)
+			assert.Equal(t, 2, len(users), "they should be equal")
+
+			_, ok := users[test.userKeys[0]]
+			assert.True(t, ok, "user test should be found")
+			_, ok = users[test.userKeys[1]]
+			assert.True(t, ok, "user test2 should be found")
+		})
+	}
+}
+
+func TestBasicAuthFail(t *testing.T) {
+	_, err := NewAuthenticator(&types.Auth{
+		Basic: &types.Basic{
+			Users: []string{"test"},
+		},
+	}, &tracing.Tracing{})
+	assert.Contains(t, err.Error(), "error parsing Authenticator user", "should contains")
+
+	authMiddleware, err := NewAuthenticator(&types.Auth{
+		Basic: &types.Basic{
+			Users: []string{"test:test"},
+		},
+	}, &tracing.Tracing{})
+	require.NoError(t, err)
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(authMiddleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	client := &http.Client{}
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	req.SetBasicAuth("test", "test")
+	res, err := client.Do(req)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusUnauthorized, res.StatusCode, "they should be equal")
+}
+
+func TestBasicAuthSuccess(t *testing.T) {
+	authMiddleware, err := NewAuthenticator(&types.Auth{
+		Basic: &types.Basic{
+			Users: []string{"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"},
+		},
+	}, &tracing.Tracing{})
+	require.NoError(t, err)
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(authMiddleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	client := &http.Client{}
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	req.SetBasicAuth("test", "test")
+	res, err := client.Do(req)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusOK, res.StatusCode, "they should be equal")
+
+	body, err := ioutil.ReadAll(res.Body)
+	require.NoError(t, err)
+	assert.Equal(t, "traefik\n", string(body), "they should be equal")
+}
+
+func TestBasicRealm(t *testing.T) {
+	authMiddlewareDefaultRealm, errdefault := NewAuthenticator(&types.Auth{
+		Basic: &types.Basic{
+			Users: []string{"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"},
+		},
+	}, &tracing.Tracing{})
+	require.NoError(t, errdefault)
+
+	authMiddlewareCustomRealm, errcustom := NewAuthenticator(&types.Auth{
+		Basic: &types.Basic{
+			Realm: "foobar",
+			Users: []string{"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"},
+		},
+	}, &tracing.Tracing{})
+	require.NoError(t, errcustom)
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "traefik")
+	})
+
+	n := negroni.New(authMiddlewareDefaultRealm)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	client := &http.Client{}
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	res, err := client.Do(req)
+	require.NoError(t, err)
+	assert.Equal(t, "Basic realm=\"traefik\"", res.Header.Get("Www-Authenticate"), "they should be equal")
+
+	n = negroni.New(authMiddlewareCustomRealm)
+	n.UseHandler(handler)
+	ts = httptest.NewServer(n)
+	defer ts.Close()
+
+	client = &http.Client{}
+	req = testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	res, err = client.Do(req)
+	require.NoError(t, err)
+	assert.Equal(t, "Basic realm=\"foobar\"", res.Header.Get("Www-Authenticate"), "they should be equal")
+}
+
+func TestDigestAuthFail(t *testing.T) {
+	_, err := NewAuthenticator(&types.Auth{
+		Digest: &types.Digest{
+			Users: []string{"test"},
+		},
+	}, &tracing.Tracing{})
+	assert.Contains(t, err.Error(), "error parsing Authenticator user", "should contains")
+
+	authMiddleware, err := NewAuthenticator(&types.Auth{
+		Digest: &types.Digest{
+			Users: []string{"test:traefik:test"},
+		},
+	}, &tracing.Tracing{})
+	require.NoError(t, err)
+	assert.NotNil(t, authMiddleware, "this should not be nil")
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(authMiddleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	client := &http.Client{}
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	req.SetBasicAuth("test", "test")
+	res, err := client.Do(req)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusUnauthorized, res.StatusCode, "they should be equal")
+}
+
+func TestBasicAuthUserHeader(t *testing.T) {
+	middleware, err := NewAuthenticator(&types.Auth{
+		Basic: &types.Basic{
+			Users: []string{"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"},
+		},
+		HeaderField: "X-Webauth-User",
+	}, &tracing.Tracing{})
+	require.NoError(t, err)
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "test", r.Header["X-Webauth-User"][0], "auth user should be set")
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(middleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	client := &http.Client{}
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	req.SetBasicAuth("test", "test")
+	res, err := client.Do(req)
+	require.NoError(t, err)
+
+	assert.Equal(t, http.StatusOK, res.StatusCode, "they should be equal")
+
+	body, err := ioutil.ReadAll(res.Body)
+	require.NoError(t, err)
+	assert.Equal(t, "traefik\n", string(body), "they should be equal")
+}
+
+func TestBasicAuthHeaderRemoved(t *testing.T) {
+	middleware, err := NewAuthenticator(&types.Auth{
+		Basic: &types.Basic{
+			RemoveHeader: true,
+			Users:        []string{"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"},
+		},
+	}, &tracing.Tracing{})
+	require.NoError(t, err)
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Empty(t, r.Header.Get(authorizationHeader))
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(middleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	client := &http.Client{}
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	req.SetBasicAuth("test", "test")
+	res, err := client.Do(req)
+	require.NoError(t, err)
+
+	assert.Equal(t, http.StatusOK, res.StatusCode, "they should be equal")
+
+	body, err := ioutil.ReadAll(res.Body)
+	require.NoError(t, err)
+	assert.Equal(t, "traefik\n", string(body), "they should be equal")
+}
+
+func TestBasicAuthHeaderPresent(t *testing.T) {
+	middleware, err := NewAuthenticator(&types.Auth{
+		Basic: &types.Basic{
+			Users: []string{"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"},
+		},
+	}, &tracing.Tracing{})
+	require.NoError(t, err)
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.NotEmpty(t, r.Header.Get(authorizationHeader))
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(middleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	client := &http.Client{}
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	req.SetBasicAuth("test", "test")
+	res, err := client.Do(req)
+	require.NoError(t, err)
+
+	assert.Equal(t, http.StatusOK, res.StatusCode, "they should be equal")
+
+	body, err := ioutil.ReadAll(res.Body)
+	require.NoError(t, err)
+	assert.Equal(t, "traefik\n", string(body), "they should be equal")
+}

old/middlewares/auth/forward.go

@@ -0,0 +1,157 @@
+package auth
+
+import (
+	"io/ioutil"
+	"net"
+	"net/http"
+	"strings"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/containous/traefik/old/middlewares/tracing"
+	"github.com/containous/traefik/old/types"
+	"github.com/vulcand/oxy/forward"
+	"github.com/vulcand/oxy/utils"
+)
+
+const (
+	xForwardedURI    = "X-Forwarded-Uri"
+	xForwardedMethod = "X-Forwarded-Method"
+)
+
+// Forward the authentication to a external server
+func Forward(config *types.Forward, w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	// Ensure our request client does not follow redirects
+	httpClient := http.Client{
+		CheckRedirect: func(r *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+
+	if config.TLS != nil {
+		tlsConfig, err := config.TLS.CreateTLSConfig()
+		if err != nil {
+			tracing.SetErrorAndDebugLog(r, "Unable to configure TLS to call %s. Cause %s", config.Address, err)
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+
+		httpClient.Transport = &http.Transport{
+			TLSClientConfig: tlsConfig,
+		}
+	}
+
+	forwardReq, err := http.NewRequest(http.MethodGet, config.Address, http.NoBody)
+	tracing.LogRequest(tracing.GetSpan(r), forwardReq)
+	if err != nil {
+		tracing.SetErrorAndDebugLog(r, "Error calling %s. Cause %s", config.Address, err)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	writeHeader(r, forwardReq, config.TrustForwardHeader)
+
+	tracing.InjectRequestHeaders(forwardReq)
+
+	forwardResponse, forwardErr := httpClient.Do(forwardReq)
+	if forwardErr != nil {
+		tracing.SetErrorAndDebugLog(r, "Error calling %s. Cause: %s", config.Address, forwardErr)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	body, readError := ioutil.ReadAll(forwardResponse.Body)
+	if readError != nil {
+		tracing.SetErrorAndDebugLog(r, "Error reading body %s. Cause: %s", config.Address, readError)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	defer forwardResponse.Body.Close()
+
+	// Pass the forward response's body and selected headers if it
+	// didn't return a response within the range of [200, 300).
+	if forwardResponse.StatusCode < http.StatusOK || forwardResponse.StatusCode >= http.StatusMultipleChoices {
+		log.Debugf("Remote error %s. StatusCode: %d", config.Address, forwardResponse.StatusCode)
+
+		utils.CopyHeaders(w.Header(), forwardResponse.Header)
+		utils.RemoveHeaders(w.Header(), forward.HopHeaders...)
+
+		// Grab the location header, if any.
+		redirectURL, err := forwardResponse.Location()
+
+		if err != nil {
+			if err != http.ErrNoLocation {
+				tracing.SetErrorAndDebugLog(r, "Error reading response location header %s. Cause: %s", config.Address, err)
+				w.WriteHeader(http.StatusInternalServerError)
+				return
+			}
+		} else if redirectURL.String() != "" {
+			// Set the location in our response if one was sent back.
+			w.Header().Set("Location", redirectURL.String())
+		}
+
+		tracing.LogResponseCode(tracing.GetSpan(r), forwardResponse.StatusCode)
+		w.WriteHeader(forwardResponse.StatusCode)
+
+		if _, err = w.Write(body); err != nil {
+			log.Error(err)
+		}
+		return
+	}
+
+	for _, headerName := range config.AuthResponseHeaders {
+		r.Header.Set(headerName, forwardResponse.Header.Get(headerName))
+	}
+
+	r.RequestURI = r.URL.RequestURI()
+	next(w, r)
+}
+
+func writeHeader(req *http.Request, forwardReq *http.Request, trustForwardHeader bool) {
+	utils.CopyHeaders(forwardReq.Header, req.Header)
+	utils.RemoveHeaders(forwardReq.Header, forward.HopHeaders...)
+
+	if clientIP, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
+		if trustForwardHeader {
+			if prior, ok := req.Header[forward.XForwardedFor]; ok {
+				clientIP = strings.Join(prior, ", ") + ", " + clientIP
+			}
+		}
+		forwardReq.Header.Set(forward.XForwardedFor, clientIP)
+	}
+
+	if xMethod := req.Header.Get(xForwardedMethod); xMethod != "" && trustForwardHeader {
+		forwardReq.Header.Set(xForwardedMethod, xMethod)
+	} else if req.Method != "" {
+		forwardReq.Header.Set(xForwardedMethod, req.Method)
+	} else {
+		forwardReq.Header.Del(xForwardedMethod)
+	}
+
+	if xfp := req.Header.Get(forward.XForwardedProto); xfp != "" && trustForwardHeader {
+		forwardReq.Header.Set(forward.XForwardedProto, xfp)
+	} else if req.TLS != nil {
+		forwardReq.Header.Set(forward.XForwardedProto, "https")
+	} else {
+		forwardReq.Header.Set(forward.XForwardedProto, "http")
+	}
+
+	if xfp := req.Header.Get(forward.XForwardedPort); xfp != "" && trustForwardHeader {
+		forwardReq.Header.Set(forward.XForwardedPort, xfp)
+	}
+
+	if xfh := req.Header.Get(forward.XForwardedHost); xfh != "" && trustForwardHeader {
+		forwardReq.Header.Set(forward.XForwardedHost, xfh)
+	} else if req.Host != "" {
+		forwardReq.Header.Set(forward.XForwardedHost, req.Host)
+	} else {
+		forwardReq.Header.Del(forward.XForwardedHost)
+	}
+
+	if xfURI := req.Header.Get(xForwardedURI); xfURI != "" && trustForwardHeader {
+		forwardReq.Header.Set(xForwardedURI, xfURI)
+	} else if req.URL.RequestURI() != "" {
+		forwardReq.Header.Set(xForwardedURI, req.URL.RequestURI())
+	} else {
+		forwardReq.Header.Del(xForwardedURI)
+	}
+}

old/middlewares/auth/forward_test.go

@@ -0,0 +1,392 @@
+package auth
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/containous/traefik/old/middlewares/tracing"
+	"github.com/containous/traefik/old/types"
+	"github.com/containous/traefik/testhelpers"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/urfave/negroni"
+	"github.com/vulcand/oxy/forward"
+)
+
+func TestForwardAuthFail(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "Forbidden", http.StatusForbidden)
+	}))
+	defer server.Close()
+
+	middleware, err := NewAuthenticator(&types.Auth{
+		Forward: &types.Forward{
+			Address: server.URL,
+		},
+	}, &tracing.Tracing{})
+	assert.NoError(t, err, "there should be no error")
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(middleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	res, err := http.DefaultClient.Do(req)
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, http.StatusForbidden, res.StatusCode, "they should be equal")
+
+	body, err := ioutil.ReadAll(res.Body)
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, "Forbidden\n", string(body), "they should be equal")
+}
+
+func TestForwardAuthSuccess(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Auth-User", "user@example.com")
+		w.Header().Set("X-Auth-Secret", "secret")
+		fmt.Fprintln(w, "Success")
+	}))
+	defer server.Close()
+
+	middleware, err := NewAuthenticator(&types.Auth{
+		Forward: &types.Forward{
+			Address:             server.URL,
+			AuthResponseHeaders: []string{"X-Auth-User"},
+		},
+	}, &tracing.Tracing{})
+	assert.NoError(t, err, "there should be no error")
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "user@example.com", r.Header.Get("X-Auth-User"))
+		assert.Empty(t, r.Header.Get("X-Auth-Secret"))
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(middleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	res, err := http.DefaultClient.Do(req)
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, http.StatusOK, res.StatusCode, "they should be equal")
+
+	body, err := ioutil.ReadAll(res.Body)
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, "traefik\n", string(body), "they should be equal")
+}
+
+func TestForwardAuthRedirect(t *testing.T) {
+	authTs := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, "http://example.com/redirect-test", http.StatusFound)
+	}))
+	defer authTs.Close()
+
+	authMiddleware, err := NewAuthenticator(&types.Auth{
+		Forward: &types.Forward{
+			Address: authTs.URL,
+		},
+	}, &tracing.Tracing{})
+	assert.NoError(t, err, "there should be no error")
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(authMiddleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	client := &http.Client{
+		CheckRedirect: func(r *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	res, err := client.Do(req)
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, http.StatusFound, res.StatusCode, "they should be equal")
+
+	location, err := res.Location()
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, "http://example.com/redirect-test", location.String(), "they should be equal")
+
+	body, err := ioutil.ReadAll(res.Body)
+	assert.NoError(t, err, "there should be no error")
+	assert.NotEmpty(t, string(body), "there should be something in the body")
+}
+
+func TestForwardAuthRemoveHopByHopHeaders(t *testing.T) {
+	authTs := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		headers := w.Header()
+		for _, header := range forward.HopHeaders {
+			if header == forward.TransferEncoding {
+				headers.Add(header, "identity")
+			} else {
+				headers.Add(header, "test")
+			}
+		}
+
+		http.Redirect(w, r, "http://example.com/redirect-test", http.StatusFound)
+	}))
+	defer authTs.Close()
+
+	authMiddleware, err := NewAuthenticator(&types.Auth{
+		Forward: &types.Forward{
+			Address: authTs.URL,
+		},
+	}, &tracing.Tracing{})
+	assert.NoError(t, err, "there should be no error")
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(authMiddleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	client := &http.Client{
+		CheckRedirect: func(r *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+	}
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	res, err := client.Do(req)
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, http.StatusFound, res.StatusCode, "they should be equal")
+
+	for _, header := range forward.HopHeaders {
+		assert.Equal(t, "", res.Header.Get(header), "hop-by-hop header '%s' mustn't be set", header)
+	}
+
+	location, err := res.Location()
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, "http://example.com/redirect-test", location.String(), "they should be equal")
+
+	body, err := ioutil.ReadAll(res.Body)
+	assert.NoError(t, err, "there should be no error")
+	assert.NotEmpty(t, string(body), "there should be something in the body")
+}
+
+func TestForwardAuthFailResponseHeaders(t *testing.T) {
+	authTs := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		cookie := &http.Cookie{Name: "example", Value: "testing", Path: "/"}
+		http.SetCookie(w, cookie)
+		w.Header().Add("X-Foo", "bar")
+		http.Error(w, "Forbidden", http.StatusForbidden)
+	}))
+	defer authTs.Close()
+
+	authMiddleware, err := NewAuthenticator(&types.Auth{
+		Forward: &types.Forward{
+			Address: authTs.URL,
+		},
+	}, &tracing.Tracing{})
+	assert.NoError(t, err, "there should be no error")
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(authMiddleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	client := &http.Client{}
+	res, err := client.Do(req)
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, http.StatusForbidden, res.StatusCode, "they should be equal")
+
+	require.Len(t, res.Cookies(), 1)
+	for _, cookie := range res.Cookies() {
+		assert.Equal(t, "testing", cookie.Value, "they should be equal")
+	}
+
+	expectedHeaders := http.Header{
+		"Content-Length":         []string{"10"},
+		"Content-Type":           []string{"text/plain; charset=utf-8"},
+		"X-Foo":                  []string{"bar"},
+		"Set-Cookie":             []string{"example=testing; Path=/"},
+		"X-Content-Type-Options": []string{"nosniff"},
+	}
+
+	assert.Len(t, res.Header, 6)
+	for key, value := range expectedHeaders {
+		assert.Equal(t, value, res.Header[key])
+	}
+
+	body, err := ioutil.ReadAll(res.Body)
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, "Forbidden\n", string(body), "they should be equal")
+}
+
+func Test_writeHeader(t *testing.T) {
+	testCases := []struct {
+		name                      string
+		headers                   map[string]string
+		trustForwardHeader        bool
+		emptyHost                 bool
+		expectedHeaders           map[string]string
+		checkForUnexpectedHeaders bool
+	}{
+		{
+			name: "trust Forward Header",
+			headers: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+			},
+			trustForwardHeader: true,
+			expectedHeaders: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+			},
+		},
+		{
+			name: "not trust Forward Header",
+			headers: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+			},
+			trustForwardHeader: false,
+			expectedHeaders: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "foo.bar",
+			},
+		},
+		{
+			name: "trust Forward Header with empty Host",
+			headers: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+			},
+			trustForwardHeader: true,
+			emptyHost:          true,
+			expectedHeaders: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+			},
+		},
+		{
+			name: "not trust Forward Header with empty Host",
+			headers: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+			},
+			trustForwardHeader: false,
+			emptyHost:          true,
+			expectedHeaders: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "",
+			},
+		},
+		{
+			name: "trust Forward Header with forwarded URI",
+			headers: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+				"X-Forwarded-Uri":  "/forward?q=1",
+			},
+			trustForwardHeader: true,
+			expectedHeaders: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+				"X-Forwarded-Uri":  "/forward?q=1",
+			},
+		},
+		{
+			name: "not trust Forward Header with forward requested URI",
+			headers: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+				"X-Forwarded-Uri":  "/forward?q=1",
+			},
+			trustForwardHeader: false,
+			expectedHeaders: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "foo.bar",
+				"X-Forwarded-Uri":  "/path?q=1",
+			},
+		}, {
+			name: "trust Forward Header with forwarded request Method",
+			headers: map[string]string{
+				"X-Forwarded-Method": "OPTIONS",
+			},
+			trustForwardHeader: true,
+			expectedHeaders: map[string]string{
+				"X-Forwarded-Method": "OPTIONS",
+			},
+		},
+		{
+			name: "not trust Forward Header with forward request Method",
+			headers: map[string]string{
+				"X-Forwarded-Method": "OPTIONS",
+			},
+			trustForwardHeader: false,
+			expectedHeaders: map[string]string{
+				"X-Forwarded-Method": "GET",
+			},
+		},
+		{
+			name: "remove hop-by-hop headers",
+			headers: map[string]string{
+				forward.Connection:         "Connection",
+				forward.KeepAlive:          "KeepAlive",
+				forward.ProxyAuthenticate:  "ProxyAuthenticate",
+				forward.ProxyAuthorization: "ProxyAuthorization",
+				forward.Te:                 "Te",
+				forward.Trailers:           "Trailers",
+				forward.TransferEncoding:   "TransferEncoding",
+				forward.Upgrade:            "Upgrade",
+				"X-CustomHeader":           "CustomHeader",
+			},
+			trustForwardHeader: false,
+			expectedHeaders: map[string]string{
+				"X-CustomHeader":     "CustomHeader",
+				"X-Forwarded-Proto":  "http",
+				"X-Forwarded-Host":   "foo.bar",
+				"X-Forwarded-Uri":    "/path?q=1",
+				"X-Forwarded-Method": "GET",
+			},
+			checkForUnexpectedHeaders: true,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.name, func(t *testing.T) {
+
+			req := testhelpers.MustNewRequest(http.MethodGet, "http://foo.bar/path?q=1", nil)
+			for key, value := range test.headers {
+				req.Header.Set(key, value)
+			}
+
+			if test.emptyHost {
+				req.Host = ""
+			}
+
+			forwardReq := testhelpers.MustNewRequest(http.MethodGet, "http://foo.bar/path?q=1", nil)
+
+			writeHeader(req, forwardReq, test.trustForwardHeader)
+
+			actualHeaders := forwardReq.Header
+			expectedHeaders := test.expectedHeaders
+			for key, value := range expectedHeaders {
+				assert.Equal(t, value, actualHeaders.Get(key))
+				actualHeaders.Del(key)
+			}
+			if test.checkForUnexpectedHeaders {
+				for key := range actualHeaders {
+					assert.Fail(t, "Unexpected header found", key)
+				}
+			}
+		})
+	}
+}

old/middlewares/auth/parser.go

@@ -0,0 +1,48 @@
+package auth
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/containous/traefik/old/types"
+)
+
+func parserBasicUsers(basic *types.Basic) (map[string]string, error) {
+	var userStrs []string
+	if basic.UsersFile != "" {
+		var err error
+		if userStrs, err = getLinesFromFile(basic.UsersFile); err != nil {
+			return nil, err
+		}
+	}
+	userStrs = append(basic.Users, userStrs...)
+	userMap := make(map[string]string)
+	for _, user := range userStrs {
+		split := strings.Split(user, ":")
+		if len(split) != 2 {
+			return nil, fmt.Errorf("error parsing Authenticator user: %v", user)
+		}
+		userMap[split[0]] = split[1]
+	}
+	return userMap, nil
+}
+
+func parserDigestUsers(digest *types.Digest) (map[string]string, error) {
+	var userStrs []string
+	if digest.UsersFile != "" {
+		var err error
+		if userStrs, err = getLinesFromFile(digest.UsersFile); err != nil {
+			return nil, err
+		}
+	}
+	userStrs = append(digest.Users, userStrs...)
+	userMap := make(map[string]string)
+	for _, user := range userStrs {
+		split := strings.Split(user, ":")
+		if len(split) != 3 {
+			return nil, fmt.Errorf("error parsing Authenticator user: %v", user)
+		}
+		userMap[split[0]+":"+split[1]] = split[2]
+	}
+	return userMap, nil
+}

old/middlewares/cbreaker.go

@@ -0,0 +1,40 @@
+package middlewares
+
+import (
+	"net/http"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/containous/traefik/old/middlewares/tracing"
+	"github.com/vulcand/oxy/cbreaker"
+)
+
+// CircuitBreaker holds the oxy circuit breaker.
+type CircuitBreaker struct {
+	circuitBreaker *cbreaker.CircuitBreaker
+}
+
+// NewCircuitBreaker returns a new CircuitBreaker.
+func NewCircuitBreaker(next http.Handler, expression string, options ...cbreaker.CircuitBreakerOption) (*CircuitBreaker, error) {
+	circuitBreaker, err := cbreaker.New(next, expression, options...)
+	if err != nil {
+		return nil, err
+	}
+	return &CircuitBreaker{circuitBreaker}, nil
+}
+
+// NewCircuitBreakerOptions returns a new CircuitBreakerOption
+func NewCircuitBreakerOptions(expression string) cbreaker.CircuitBreakerOption {
+	return cbreaker.Fallback(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tracing.LogEventf(r, "blocked by circuit-breaker (%q)", expression)
+
+		w.WriteHeader(http.StatusServiceUnavailable)
+
+		if _, err := w.Write([]byte(http.StatusText(http.StatusServiceUnavailable))); err != nil {
+			log.Error(err)
+		}
+	}))
+}
+
+func (cb *CircuitBreaker) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	cb.circuitBreaker.ServeHTTP(rw, r)
+}

old/middlewares/compress.go

@@ -0,0 +1,33 @@
+package middlewares
+
+import (
+	"compress/gzip"
+	"net/http"
+	"strings"
+
+	"github.com/NYTimes/gziphandler"
+	"github.com/containous/traefik/old/log"
+)
+
+// Compress is a middleware that allows to compress the response
+type Compress struct{}
+
+// ServeHTTP is a function used by Negroni
+func (c *Compress) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	contentType := r.Header.Get("Content-Type")
+	if strings.HasPrefix(contentType, "application/grpc") {
+		next.ServeHTTP(rw, r)
+	} else {
+		gzipHandler(next).ServeHTTP(rw, r)
+	}
+}
+
+func gzipHandler(h http.Handler) http.Handler {
+	wrapper, err := gziphandler.GzipHandlerWithOpts(
+		gziphandler.CompressionLevel(gzip.DefaultCompression),
+		gziphandler.MinSize(gziphandler.DefaultMinSize))
+	if err != nil {
+		log.Error(err)
+	}
+	return wrapper(h)
+}

old/middlewares/compress_test.go

@@ -0,0 +1,248 @@
+package middlewares
+
+import (
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/NYTimes/gziphandler"
+	"github.com/containous/traefik/testhelpers"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/urfave/negroni"
+)
+
+const (
+	acceptEncodingHeader  = "Accept-Encoding"
+	contentEncodingHeader = "Content-Encoding"
+	contentTypeHeader     = "Content-Type"
+	varyHeader            = "Vary"
+	gzipValue             = "gzip"
+)
+
+func TestShouldCompressWhenNoContentEncodingHeader(t *testing.T) {
+	handler := &Compress{}
+
+	req := testhelpers.MustNewRequest(http.MethodGet, "http://localhost", nil)
+	req.Header.Add(acceptEncodingHeader, gzipValue)
+
+	baseBody := generateBytes(gziphandler.DefaultMinSize)
+	next := func(rw http.ResponseWriter, r *http.Request) {
+		_, err := rw.Write(baseBody)
+		assert.NoError(t, err)
+	}
+
+	rw := httptest.NewRecorder()
+	handler.ServeHTTP(rw, req, next)
+
+	assert.Equal(t, gzipValue, rw.Header().Get(contentEncodingHeader))
+	assert.Equal(t, acceptEncodingHeader, rw.Header().Get(varyHeader))
+
+	if assert.ObjectsAreEqualValues(rw.Body.Bytes(), baseBody) {
+		assert.Fail(t, "expected a compressed body", "got %v", rw.Body.Bytes())
+	}
+}
+
+func TestShouldNotCompressWhenContentEncodingHeader(t *testing.T) {
+	handler := &Compress{}
+
+	req := testhelpers.MustNewRequest(http.MethodGet, "http://localhost", nil)
+	req.Header.Add(acceptEncodingHeader, gzipValue)
+
+	fakeCompressedBody := generateBytes(gziphandler.DefaultMinSize)
+	next := func(rw http.ResponseWriter, r *http.Request) {
+		rw.Header().Add(contentEncodingHeader, gzipValue)
+		rw.Header().Add(varyHeader, acceptEncodingHeader)
+		rw.Write(fakeCompressedBody)
+	}
+
+	rw := httptest.NewRecorder()
+	handler.ServeHTTP(rw, req, next)
+
+	assert.Equal(t, gzipValue, rw.Header().Get(contentEncodingHeader))
+	assert.Equal(t, acceptEncodingHeader, rw.Header().Get(varyHeader))
+
+	assert.EqualValues(t, rw.Body.Bytes(), fakeCompressedBody)
+}
+
+func TestShouldNotCompressWhenNoAcceptEncodingHeader(t *testing.T) {
+	handler := &Compress{}
+
+	req := testhelpers.MustNewRequest(http.MethodGet, "http://localhost", nil)
+
+	fakeBody := generateBytes(gziphandler.DefaultMinSize)
+	next := func(rw http.ResponseWriter, r *http.Request) {
+		rw.Write(fakeBody)
+	}
+
+	rw := httptest.NewRecorder()
+	handler.ServeHTTP(rw, req, next)
+
+	assert.Empty(t, rw.Header().Get(contentEncodingHeader))
+	assert.EqualValues(t, rw.Body.Bytes(), fakeBody)
+}
+
+func TestShouldNotCompressWhenGRPC(t *testing.T) {
+	handler := &Compress{}
+
+	req := testhelpers.MustNewRequest(http.MethodGet, "http://localhost", nil)
+	req.Header.Add(acceptEncodingHeader, gzipValue)
+	req.Header.Add(contentTypeHeader, "application/grpc")
+
+	baseBody := generateBytes(gziphandler.DefaultMinSize)
+	next := func(rw http.ResponseWriter, r *http.Request) {
+		rw.Write(baseBody)
+	}
+
+	rw := httptest.NewRecorder()
+	handler.ServeHTTP(rw, req, next)
+
+	assert.Empty(t, rw.Header().Get(acceptEncodingHeader))
+	assert.Empty(t, rw.Header().Get(contentEncodingHeader))
+	assert.EqualValues(t, rw.Body.Bytes(), baseBody)
+}
+
+func TestIntegrationShouldNotCompress(t *testing.T) {
+	fakeCompressedBody := generateBytes(100000)
+	comp := &Compress{}
+
+	testCases := []struct {
+		name               string
+		handler            func(rw http.ResponseWriter, r *http.Request)
+		expectedStatusCode int
+	}{
+		{
+			name: "when content already compressed",
+			handler: func(rw http.ResponseWriter, r *http.Request) {
+				rw.Header().Add(contentEncodingHeader, gzipValue)
+				rw.Header().Add(varyHeader, acceptEncodingHeader)
+				rw.Write(fakeCompressedBody)
+			},
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name: "when content already compressed and status code Created",
+			handler: func(rw http.ResponseWriter, r *http.Request) {
+				rw.Header().Add(contentEncodingHeader, gzipValue)
+				rw.Header().Add(varyHeader, acceptEncodingHeader)
+				rw.WriteHeader(http.StatusCreated)
+				rw.Write(fakeCompressedBody)
+			},
+			expectedStatusCode: http.StatusCreated,
+		},
+	}
+
+	for _, test := range testCases {
+
+		t.Run(test.name, func(t *testing.T) {
+			negro := negroni.New(comp)
+			negro.UseHandlerFunc(test.handler)
+			ts := httptest.NewServer(negro)
+			defer ts.Close()
+
+			req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+			req.Header.Add(acceptEncodingHeader, gzipValue)
+
+			resp, err := http.DefaultClient.Do(req)
+			require.NoError(t, err)
+
+			assert.Equal(t, test.expectedStatusCode, resp.StatusCode)
+
+			assert.Equal(t, gzipValue, resp.Header.Get(contentEncodingHeader))
+			assert.Equal(t, acceptEncodingHeader, resp.Header.Get(varyHeader))
+
+			body, err := ioutil.ReadAll(resp.Body)
+			require.NoError(t, err)
+			assert.EqualValues(t, fakeCompressedBody, body)
+		})
+	}
+}
+
+func TestShouldWriteHeaderWhenFlush(t *testing.T) {
+	comp := &Compress{}
+	negro := negroni.New(comp)
+	negro.UseHandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		rw.Header().Add(contentEncodingHeader, gzipValue)
+		rw.Header().Add(varyHeader, acceptEncodingHeader)
+		rw.WriteHeader(http.StatusUnauthorized)
+		rw.(http.Flusher).Flush()
+		rw.Write([]byte("short"))
+	})
+	ts := httptest.NewServer(negro)
+	defer ts.Close()
+
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	req.Header.Add(acceptEncodingHeader, gzipValue)
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+
+	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+
+	assert.Equal(t, gzipValue, resp.Header.Get(contentEncodingHeader))
+	assert.Equal(t, acceptEncodingHeader, resp.Header.Get(varyHeader))
+}
+
+func TestIntegrationShouldCompress(t *testing.T) {
+	fakeBody := generateBytes(100000)
+
+	testCases := []struct {
+		name               string
+		handler            func(rw http.ResponseWriter, r *http.Request)
+		expectedStatusCode int
+	}{
+		{
+			name: "when AcceptEncoding header is present",
+			handler: func(rw http.ResponseWriter, r *http.Request) {
+				rw.Write(fakeBody)
+			},
+			expectedStatusCode: http.StatusOK,
+		},
+		{
+			name: "when AcceptEncoding header is present and status code Created",
+			handler: func(rw http.ResponseWriter, r *http.Request) {
+				rw.WriteHeader(http.StatusCreated)
+				rw.Write(fakeBody)
+			},
+			expectedStatusCode: http.StatusCreated,
+		},
+	}
+
+	for _, test := range testCases {
+
+		t.Run(test.name, func(t *testing.T) {
+			comp := &Compress{}
+
+			negro := negroni.New(comp)
+			negro.UseHandlerFunc(test.handler)
+			ts := httptest.NewServer(negro)
+			defer ts.Close()
+
+			req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+			req.Header.Add(acceptEncodingHeader, gzipValue)
+
+			resp, err := http.DefaultClient.Do(req)
+			require.NoError(t, err)
+
+			assert.Equal(t, test.expectedStatusCode, resp.StatusCode)
+
+			assert.Equal(t, gzipValue, resp.Header.Get(contentEncodingHeader))
+			assert.Equal(t, acceptEncodingHeader, resp.Header.Get(varyHeader))
+
+			body, err := ioutil.ReadAll(resp.Body)
+			require.NoError(t, err)
+			if assert.ObjectsAreEqualValues(body, fakeBody) {
+				assert.Fail(t, "expected a compressed body", "got %v", body)
+			}
+		})
+	}
+}
+
+func generateBytes(len int) []byte {
+	var value []byte
+	for i := 0; i < len; i++ {
+		value = append(value, 0x61+byte(i))
+	}
+	return value
+}

old/middlewares/empty_backend_handler.go

@@ -0,0 +1,30 @@
+package middlewares
+
+import (
+	"net/http"
+
+	"github.com/containous/traefik/healthcheck"
+)
+
+// EmptyBackendHandler is a middlware that checks whether the current Backend
+// has at least one active Server in respect to the healthchecks and if this
+// is not the case, it will stop the middleware chain and respond with 503.
+type EmptyBackendHandler struct {
+	next healthcheck.BalancerHandler
+}
+
+// NewEmptyBackendHandler creates a new EmptyBackendHandler instance.
+func NewEmptyBackendHandler(lb healthcheck.BalancerHandler) *EmptyBackendHandler {
+	return &EmptyBackendHandler{next: lb}
+}
+
+// ServeHTTP responds with 503 when there is no active Server and otherwise
+// invokes the next handler in the middleware chain.
+func (h *EmptyBackendHandler) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	if len(h.next.Servers()) == 0 {
+		rw.WriteHeader(http.StatusServiceUnavailable)
+		rw.Write([]byte(http.StatusText(http.StatusServiceUnavailable)))
+	} else {
+		h.next.ServeHTTP(rw, r)
+	}
+}

old/middlewares/empty_backend_handler_test.go

@@ -0,0 +1,83 @@
+package middlewares
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/containous/traefik/testhelpers"
+	"github.com/vulcand/oxy/roundrobin"
+)
+
+func TestEmptyBackendHandler(t *testing.T) {
+	tests := []struct {
+		amountServer   int
+		wantStatusCode int
+	}{
+		{
+			amountServer:   0,
+			wantStatusCode: http.StatusServiceUnavailable,
+		},
+		{
+			amountServer:   1,
+			wantStatusCode: http.StatusOK,
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+
+		t.Run(fmt.Sprintf("amount servers %d", test.amountServer), func(t *testing.T) {
+			t.Parallel()
+
+			handler := NewEmptyBackendHandler(&healthCheckLoadBalancer{test.amountServer})
+
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(http.MethodGet, "http://localhost", nil)
+
+			handler.ServeHTTP(recorder, req)
+
+			if recorder.Result().StatusCode != test.wantStatusCode {
+				t.Errorf("Received status code %d, wanted %d", recorder.Result().StatusCode, test.wantStatusCode)
+			}
+		})
+	}
+}
+
+type healthCheckLoadBalancer struct {
+	amountServer int
+}
+
+func (lb *healthCheckLoadBalancer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusOK)
+}
+
+func (lb *healthCheckLoadBalancer) Servers() []*url.URL {
+	servers := make([]*url.URL, lb.amountServer)
+	for i := 0; i < lb.amountServer; i++ {
+		servers = append(servers, testhelpers.MustParseURL("http://localhost"))
+	}
+	return servers
+}
+
+func (lb *healthCheckLoadBalancer) RemoveServer(u *url.URL) error {
+	return nil
+}
+
+func (lb *healthCheckLoadBalancer) UpsertServer(u *url.URL, options ...roundrobin.ServerOption) error {
+	return nil
+}
+
+func (lb *healthCheckLoadBalancer) ServerWeight(u *url.URL) (int, bool) {
+	return 0, false
+}
+
+func (lb *healthCheckLoadBalancer) NextServer() (*url.URL, error) {
+	return nil, nil
+}
+
+func (lb *healthCheckLoadBalancer) Next() http.Handler {
+	return nil
+}

old/middlewares/errorpages/error_pages.go

@@ -0,0 +1,236 @@
+package errorpages
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/containous/traefik/old/middlewares"
+	"github.com/containous/traefik/old/types"
+	"github.com/vulcand/oxy/forward"
+	"github.com/vulcand/oxy/utils"
+)
+
+// Compile time validation that the response recorder implements http interfaces correctly.
+var _ middlewares.Stateful = &responseRecorderWithCloseNotify{}
+
+// Handler is a middleware that provides the custom error pages
+type Handler struct {
+	BackendName    string
+	backendHandler http.Handler
+	httpCodeRanges types.HTTPCodeRanges
+	backendURL     string
+	backendQuery   string
+	FallbackURL    string // Deprecated
+}
+
+// NewHandler initializes the utils.ErrorHandler for the custom error pages
+func NewHandler(errorPage *types.ErrorPage, backendName string) (*Handler, error) {
+	if len(backendName) == 0 {
+		return nil, errors.New("error pages: backend name is mandatory ")
+	}
+
+	httpCodeRanges, err := types.NewHTTPCodeRanges(errorPage.Status)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Handler{
+		BackendName:    backendName,
+		httpCodeRanges: httpCodeRanges,
+		backendQuery:   errorPage.Query,
+		backendURL:     "http://0.0.0.0",
+	}, nil
+}
+
+// PostLoad adds backend handler if available
+func (h *Handler) PostLoad(backendHandler http.Handler) error {
+	if backendHandler == nil {
+		fwd, err := forward.New()
+		if err != nil {
+			return err
+		}
+
+		h.backendHandler = fwd
+		h.backendURL = h.FallbackURL
+	} else {
+		h.backendHandler = backendHandler
+	}
+
+	return nil
+}
+
+func (h *Handler) ServeHTTP(w http.ResponseWriter, req *http.Request, next http.HandlerFunc) {
+	if h.backendHandler == nil {
+		log.Error("Error pages: no backend handler.")
+		next.ServeHTTP(w, req)
+		return
+	}
+
+	recorder := newResponseRecorder(w)
+	next.ServeHTTP(recorder, req)
+
+	// check the recorder code against the configured http status code ranges
+	for _, block := range h.httpCodeRanges {
+		if recorder.GetCode() >= block[0] && recorder.GetCode() <= block[1] {
+			log.Errorf("Caught HTTP Status Code %d, returning error page", recorder.GetCode())
+
+			var query string
+			if len(h.backendQuery) > 0 {
+				query = "/" + strings.TrimPrefix(h.backendQuery, "/")
+				query = strings.Replace(query, "{status}", strconv.Itoa(recorder.GetCode()), -1)
+			}
+
+			pageReq, err := newRequest(h.backendURL + query)
+			if err != nil {
+				log.Error(err)
+				w.WriteHeader(recorder.GetCode())
+				fmt.Fprint(w, http.StatusText(recorder.GetCode()))
+				return
+			}
+
+			recorderErrorPage := newResponseRecorder(w)
+			utils.CopyHeaders(pageReq.Header, req.Header)
+
+			h.backendHandler.ServeHTTP(recorderErrorPage, pageReq.WithContext(req.Context()))
+
+			utils.CopyHeaders(w.Header(), recorderErrorPage.Header())
+			w.WriteHeader(recorder.GetCode())
+
+			if _, err = w.Write(recorderErrorPage.GetBody().Bytes()); err != nil {
+				log.Error(err)
+			}
+			return
+		}
+	}
+
+	// did not catch a configured status code so proceed with the request
+	utils.CopyHeaders(w.Header(), recorder.Header())
+	w.WriteHeader(recorder.GetCode())
+	w.Write(recorder.GetBody().Bytes())
+}
+
+func newRequest(baseURL string) (*http.Request, error) {
+	u, err := url.Parse(baseURL)
+	if err != nil {
+		return nil, fmt.Errorf("error pages: error when parse URL: %v", err)
+	}
+
+	req, err := http.NewRequest(http.MethodGet, u.String(), http.NoBody)
+	if err != nil {
+		return nil, fmt.Errorf("error pages: error when create query: %v", err)
+	}
+
+	req.RequestURI = u.RequestURI()
+	return req, nil
+}
+
+type responseRecorder interface {
+	http.ResponseWriter
+	http.Flusher
+	GetCode() int
+	GetBody() *bytes.Buffer
+	IsStreamingResponseStarted() bool
+}
+
+// newResponseRecorder returns an initialized responseRecorder.
+func newResponseRecorder(rw http.ResponseWriter) responseRecorder {
+	recorder := &responseRecorderWithoutCloseNotify{
+		HeaderMap:      make(http.Header),
+		Body:           new(bytes.Buffer),
+		Code:           http.StatusOK,
+		responseWriter: rw,
+	}
+	if _, ok := rw.(http.CloseNotifier); ok {
+		return &responseRecorderWithCloseNotify{recorder}
+	}
+	return recorder
+}
+
+// responseRecorderWithoutCloseNotify is an implementation of http.ResponseWriter that
+// records its mutations for later inspection.
+type responseRecorderWithoutCloseNotify struct {
+	Code      int           // the HTTP response code from WriteHeader
+	HeaderMap http.Header   // the HTTP response headers
+	Body      *bytes.Buffer // if non-nil, the bytes.Buffer to append written data to
+
+	responseWriter           http.ResponseWriter
+	err                      error
+	streamingResponseStarted bool
+}
+
+type responseRecorderWithCloseNotify struct {
+	*responseRecorderWithoutCloseNotify
+}
+
+// CloseNotify returns a channel that receives at most a
+// single value (true) when the client connection has gone away.
+func (r *responseRecorderWithCloseNotify) CloseNotify() <-chan bool {
+	return r.responseWriter.(http.CloseNotifier).CloseNotify()
+}
+
+// Header returns the response headers.
+func (r *responseRecorderWithoutCloseNotify) Header() http.Header {
+	if r.HeaderMap == nil {
+		r.HeaderMap = make(http.Header)
+	}
+
+	return r.HeaderMap
+}
+
+func (r *responseRecorderWithoutCloseNotify) GetCode() int {
+	return r.Code
+}
+
+func (r *responseRecorderWithoutCloseNotify) GetBody() *bytes.Buffer {
+	return r.Body
+}
+
+func (r *responseRecorderWithoutCloseNotify) IsStreamingResponseStarted() bool {
+	return r.streamingResponseStarted
+}
+
+// Write always succeeds and writes to rw.Body, if not nil.
+func (r *responseRecorderWithoutCloseNotify) Write(buf []byte) (int, error) {
+	if r.err != nil {
+		return 0, r.err
+	}
+	return r.Body.Write(buf)
+}
+
+// WriteHeader sets rw.Code.
+func (r *responseRecorderWithoutCloseNotify) WriteHeader(code int) {
+	r.Code = code
+}
+
+// Hijack hijacks the connection
+func (r *responseRecorderWithoutCloseNotify) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	return r.responseWriter.(http.Hijacker).Hijack()
+}
+
+// Flush sends any buffered data to the client.
+func (r *responseRecorderWithoutCloseNotify) Flush() {
+	if !r.streamingResponseStarted {
+		utils.CopyHeaders(r.responseWriter.Header(), r.Header())
+		r.responseWriter.WriteHeader(r.Code)
+		r.streamingResponseStarted = true
+	}
+
+	_, err := r.responseWriter.Write(r.Body.Bytes())
+	if err != nil {
+		log.Errorf("Error writing response in responseRecorder: %v", err)
+		r.err = err
+	}
+	r.Body.Reset()
+
+	if flusher, ok := r.responseWriter.(http.Flusher); ok {
+		flusher.Flush()
+	}
+}

old/middlewares/errorpages/error_pages_test.go

@@ -0,0 +1,384 @@
+package errorpages
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	"github.com/containous/traefik/old/types"
+	"github.com/containous/traefik/testhelpers"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/urfave/negroni"
+)
+
+func TestHandler(t *testing.T) {
+	testCases := []struct {
+		desc                string
+		errorPage           *types.ErrorPage
+		backendCode         int
+		backendErrorHandler http.HandlerFunc
+		validate            func(t *testing.T, recorder *httptest.ResponseRecorder)
+	}{
+		{
+			desc:        "no error",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/test", Status: []string{"500-501", "503-599"}},
+			backendCode: http.StatusOK,
+			backendErrorHandler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				fmt.Fprintln(w, "My error page.")
+			}),
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusOK, recorder.Code, "HTTP status")
+				assert.Contains(t, recorder.Body.String(), http.StatusText(http.StatusOK))
+			},
+		},
+		{
+			desc:        "in the range",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/test", Status: []string{"500-501", "503-599"}},
+			backendCode: http.StatusInternalServerError,
+			backendErrorHandler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				fmt.Fprintln(w, "My error page.")
+			}),
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusInternalServerError, recorder.Code, "HTTP status")
+				assert.Contains(t, recorder.Body.String(), "My error page.")
+				assert.NotContains(t, recorder.Body.String(), "oops", "Should not return the oops page")
+			},
+		},
+		{
+			desc:        "not in the range",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/test", Status: []string{"500-501", "503-599"}},
+			backendCode: http.StatusBadGateway,
+			backendErrorHandler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				fmt.Fprintln(w, "My error page.")
+			}),
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusBadGateway, recorder.Code, "HTTP status")
+				assert.Contains(t, recorder.Body.String(), http.StatusText(http.StatusBadGateway))
+				assert.NotContains(t, recorder.Body.String(), "Test Server", "Should return the oops page since we have not configured the 502 code")
+			},
+		},
+		{
+			desc:        "query replacement",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/{status}", Status: []string{"503-503"}},
+			backendCode: http.StatusServiceUnavailable,
+			backendErrorHandler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.RequestURI == "/503" {
+					fmt.Fprintln(w, "My 503 page.")
+				} else {
+					fmt.Fprintln(w, "Failed")
+				}
+			}),
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusServiceUnavailable, recorder.Code, "HTTP status")
+				assert.Contains(t, recorder.Body.String(), "My 503 page.")
+				assert.NotContains(t, recorder.Body.String(), "oops", "Should not return the oops page")
+			},
+		},
+		{
+			desc:        "Single code",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/{status}", Status: []string{"503"}},
+			backendCode: http.StatusServiceUnavailable,
+			backendErrorHandler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.RequestURI == "/503" {
+					fmt.Fprintln(w, "My 503 page.")
+				} else {
+					fmt.Fprintln(w, "Failed")
+				}
+			}),
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusServiceUnavailable, recorder.Code, "HTTP status")
+				assert.Contains(t, recorder.Body.String(), "My 503 page.")
+				assert.NotContains(t, recorder.Body.String(), "oops", "Should not return the oops page")
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			errorPageHandler, err := NewHandler(test.errorPage, "test")
+			require.NoError(t, err)
+
+			errorPageHandler.backendHandler = test.backendErrorHandler
+
+			handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(test.backendCode)
+				fmt.Fprintln(w, http.StatusText(test.backendCode))
+			})
+
+			req := testhelpers.MustNewRequest(http.MethodGet, "http://localhost/test", nil)
+
+			n := negroni.New()
+			n.Use(errorPageHandler)
+			n.UseHandler(handler)
+
+			recorder := httptest.NewRecorder()
+			n.ServeHTTP(recorder, req)
+
+			test.validate(t, recorder)
+		})
+	}
+}
+
+func TestHandlerOldWay(t *testing.T) {
+	testCases := []struct {
+		desc               string
+		errorPage          *types.ErrorPage
+		backendCode        int
+		errorPageForwarder http.HandlerFunc
+		validate           func(t *testing.T, recorder *httptest.ResponseRecorder)
+	}{
+		{
+			desc:        "no error",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/test", Status: []string{"500-501", "503-599"}},
+			backendCode: http.StatusOK,
+			errorPageForwarder: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				fmt.Fprintln(w, "My error page.")
+			}),
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusOK, recorder.Code, "HTTP status")
+				assert.Contains(t, recorder.Body.String(), "OK")
+			},
+		},
+		{
+			desc:        "in the range",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/test", Status: []string{"500-501", "503-599"}},
+			backendCode: http.StatusInternalServerError,
+			errorPageForwarder: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				fmt.Fprintln(w, "My error page.")
+			}),
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusInternalServerError, recorder.Code)
+				assert.Contains(t, recorder.Body.String(), "My error page.")
+				assert.NotContains(t, recorder.Body.String(), http.StatusText(http.StatusInternalServerError), "Should not return the oops page")
+			},
+		},
+		{
+			desc:        "not in the range",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/test", Status: []string{"500-501", "503-599"}},
+			backendCode: http.StatusBadGateway,
+			errorPageForwarder: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				fmt.Fprintln(w, "My error page.")
+			}),
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusBadGateway, recorder.Code)
+				assert.Contains(t, recorder.Body.String(), http.StatusText(http.StatusBadGateway))
+				assert.NotContains(t, recorder.Body.String(), "My error page.", "Should return the oops page since we have not configured the 502 code")
+			},
+		},
+		{
+			desc:        "query replacement",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/{status}", Status: []string{"503-503"}},
+			backendCode: http.StatusServiceUnavailable,
+			errorPageForwarder: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.RequestURI() == "/"+strconv.Itoa(503) {
+					fmt.Fprintln(w, "My 503 page.")
+				} else {
+					fmt.Fprintln(w, "Failed")
+				}
+			}),
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusServiceUnavailable, recorder.Code, "HTTP status")
+				assert.Contains(t, recorder.Body.String(), "My 503 page.")
+				assert.NotContains(t, recorder.Body.String(), "oops", "Should not return the oops page")
+			},
+		},
+		{
+			desc:        "Single code",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/{status}", Status: []string{"503"}},
+			backendCode: http.StatusServiceUnavailable,
+			errorPageForwarder: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.RequestURI() == "/"+strconv.Itoa(503) {
+					fmt.Fprintln(w, "My 503 page.")
+				} else {
+					fmt.Fprintln(w, "Failed")
+				}
+			}),
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusServiceUnavailable, recorder.Code, "HTTP status")
+				assert.Contains(t, recorder.Body.String(), "My 503 page.")
+				assert.NotContains(t, recorder.Body.String(), "oops", "Should not return the oops page")
+			},
+		},
+	}
+
+	req := testhelpers.MustNewRequest(http.MethodGet, "http://localhost/test", nil)
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			errorPageHandler, err := NewHandler(test.errorPage, "test")
+			require.NoError(t, err)
+			errorPageHandler.FallbackURL = "http://localhost"
+
+			err = errorPageHandler.PostLoad(test.errorPageForwarder)
+			require.NoError(t, err)
+
+			handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(test.backendCode)
+				fmt.Fprintln(w, http.StatusText(test.backendCode))
+			})
+
+			n := negroni.New()
+			n.Use(errorPageHandler)
+			n.UseHandler(handler)
+
+			recorder := httptest.NewRecorder()
+			n.ServeHTTP(recorder, req)
+
+			test.validate(t, recorder)
+		})
+	}
+}
+
+func TestHandlerOldWayIntegration(t *testing.T) {
+	errorPagesServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.RequestURI() == "/503" {
+			fmt.Fprintln(w, "My 503 page.")
+		} else {
+			fmt.Fprintln(w, "Test Server")
+		}
+	}))
+	defer errorPagesServer.Close()
+
+	testCases := []struct {
+		desc        string
+		errorPage   *types.ErrorPage
+		backendCode int
+		validate    func(t *testing.T, recorder *httptest.ResponseRecorder)
+	}{
+		{
+			desc:        "no error",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/test", Status: []string{"500-501", "503-599"}},
+			backendCode: http.StatusOK,
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusOK, recorder.Code, "HTTP status")
+				assert.Contains(t, recorder.Body.String(), "OK")
+			},
+		},
+		{
+			desc:        "in the range",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/test", Status: []string{"500-501", "503-599"}},
+			backendCode: http.StatusInternalServerError,
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusInternalServerError, recorder.Code)
+				assert.Contains(t, recorder.Body.String(), "Test Server")
+				assert.NotContains(t, recorder.Body.String(), http.StatusText(http.StatusInternalServerError), "Should not return the oops page")
+			},
+		},
+		{
+			desc:        "not in the range",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/test", Status: []string{"500-501", "503-599"}},
+			backendCode: http.StatusBadGateway,
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusBadGateway, recorder.Code)
+				assert.Contains(t, recorder.Body.String(), http.StatusText(http.StatusBadGateway))
+				assert.NotContains(t, recorder.Body.String(), "Test Server", "Should return the oops page since we have not configured the 502 code")
+			},
+		},
+		{
+			desc:        "query replacement",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/{status}", Status: []string{"503-503"}},
+			backendCode: http.StatusServiceUnavailable,
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusServiceUnavailable, recorder.Code, "HTTP status")
+				assert.Contains(t, recorder.Body.String(), "My 503 page.")
+				assert.NotContains(t, recorder.Body.String(), "oops", "Should not return the oops page")
+			},
+		},
+		{
+			desc:        "Single code",
+			errorPage:   &types.ErrorPage{Backend: "error", Query: "/{status}", Status: []string{"503"}},
+			backendCode: http.StatusServiceUnavailable,
+			validate: func(t *testing.T, recorder *httptest.ResponseRecorder) {
+				assert.Equal(t, http.StatusServiceUnavailable, recorder.Code, "HTTP status")
+				assert.Contains(t, recorder.Body.String(), "My 503 page.")
+				assert.NotContains(t, recorder.Body.String(), "oops", "Should not return the oops page")
+			},
+		},
+	}
+
+	req := testhelpers.MustNewRequest(http.MethodGet, errorPagesServer.URL+"/test", nil)
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+
+			errorPageHandler, err := NewHandler(test.errorPage, "test")
+			require.NoError(t, err)
+			errorPageHandler.FallbackURL = errorPagesServer.URL
+
+			err = errorPageHandler.PostLoad(nil)
+			require.NoError(t, err)
+
+			handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(test.backendCode)
+				fmt.Fprintln(w, http.StatusText(test.backendCode))
+			})
+
+			n := negroni.New()
+			n.Use(errorPageHandler)
+			n.UseHandler(handler)
+
+			recorder := httptest.NewRecorder()
+			n.ServeHTTP(recorder, req)
+
+			test.validate(t, recorder)
+		})
+	}
+}
+
+func TestNewResponseRecorder(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		rw       http.ResponseWriter
+		expected http.ResponseWriter
+	}{
+		{
+			desc:     "Without Close Notify",
+			rw:       httptest.NewRecorder(),
+			expected: &responseRecorderWithoutCloseNotify{},
+		},
+		{
+			desc:     "With Close Notify",
+			rw:       &mockRWCloseNotify{},
+			expected: &responseRecorderWithCloseNotify{},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			rec := newResponseRecorder(test.rw)
+
+			assert.IsType(t, rec, test.expected)
+		})
+	}
+}
+
+type mockRWCloseNotify struct{}
+
+func (m *mockRWCloseNotify) CloseNotify() <-chan bool {
+	panic("implement me")
+}
+
+func (m *mockRWCloseNotify) Header() http.Header {
+	panic("implement me")
+}
+
+func (m *mockRWCloseNotify) Write([]byte) (int, error) {
+	panic("implement me")
+}
+
+func (m *mockRWCloseNotify) WriteHeader(int) {
+	panic("implement me")
+}

old/middlewares/forwardedheaders/forwarded_header.go

@@ -0,0 +1,52 @@
+package forwardedheaders
+
+import (
+	"net/http"
+
+	"github.com/containous/traefik/ip"
+	"github.com/vulcand/oxy/forward"
+	"github.com/vulcand/oxy/utils"
+)
+
+// XForwarded filter for XForwarded headers
+type XForwarded struct {
+	insecure   bool
+	trustedIps []string
+	ipChecker  *ip.Checker
+}
+
+// NewXforwarded creates a new XForwarded
+func NewXforwarded(insecure bool, trustedIps []string) (*XForwarded, error) {
+	var ipChecker *ip.Checker
+	if len(trustedIps) > 0 {
+		var err error
+		ipChecker, err = ip.NewChecker(trustedIps)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return &XForwarded{
+		insecure:   insecure,
+		trustedIps: trustedIps,
+		ipChecker:  ipChecker,
+	}, nil
+}
+
+func (x *XForwarded) isTrustedIP(ip string) bool {
+	if x.ipChecker == nil {
+		return false
+	}
+	return x.ipChecker.IsAuthorized(ip) == nil
+}
+
+func (x *XForwarded) ServeHTTP(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	if !x.insecure && !x.isTrustedIP(r.RemoteAddr) {
+		utils.RemoveHeaders(r.Header, forward.XHeaders...)
+	}
+
+	// If there is a next, call it.
+	if next != nil {
+		next(w, r)
+	}
+}

old/middlewares/forwardedheaders/forwarded_header_test.go

@@ -0,0 +1,128 @@
+package forwardedheaders
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestServeHTTP(t *testing.T) {
+	testCases := []struct {
+		desc            string
+		insecure        bool
+		trustedIps      []string
+		incomingHeaders map[string]string
+		remoteAddr      string
+		expectedHeaders map[string]string
+	}{
+		{
+			desc:            "all Empty",
+			insecure:        true,
+			trustedIps:      nil,
+			remoteAddr:      "",
+			incomingHeaders: map[string]string{},
+			expectedHeaders: map[string]string{
+				"X-Forwarded-for": "",
+			},
+		},
+		{
+			desc:       "insecure true with incoming X-Forwarded-For",
+			insecure:   true,
+			trustedIps: nil,
+			remoteAddr: "",
+			incomingHeaders: map[string]string{
+				"X-Forwarded-for": "10.0.1.0, 10.0.1.12",
+			},
+			expectedHeaders: map[string]string{
+				"X-Forwarded-for": "10.0.1.0, 10.0.1.12",
+			},
+		},
+		{
+			desc:       "insecure false with incoming X-Forwarded-For",
+			insecure:   false,
+			trustedIps: nil,
+			remoteAddr: "",
+			incomingHeaders: map[string]string{
+				"X-Forwarded-for": "10.0.1.0, 10.0.1.12",
+			},
+			expectedHeaders: map[string]string{
+				"X-Forwarded-for": "",
+			},
+		},
+		{
+			desc:       "insecure false with incoming X-Forwarded-For and valid Trusted Ips",
+			insecure:   false,
+			trustedIps: []string{"10.0.1.100"},
+			remoteAddr: "10.0.1.100:80",
+			incomingHeaders: map[string]string{
+				"X-Forwarded-for": "10.0.1.0, 10.0.1.12",
+			},
+			expectedHeaders: map[string]string{
+				"X-Forwarded-for": "10.0.1.0, 10.0.1.12",
+			},
+		},
+		{
+			desc:       "insecure false with incoming X-Forwarded-For and invalid Trusted Ips",
+			insecure:   false,
+			trustedIps: []string{"10.0.1.100"},
+			remoteAddr: "10.0.1.101:80",
+			incomingHeaders: map[string]string{
+				"X-Forwarded-for": "10.0.1.0, 10.0.1.12",
+			},
+			expectedHeaders: map[string]string{
+				"X-Forwarded-for": "",
+			},
+		},
+		{
+			desc:       "insecure false with incoming X-Forwarded-For and valid Trusted Ips CIDR",
+			insecure:   false,
+			trustedIps: []string{"1.2.3.4/24"},
+			remoteAddr: "1.2.3.156:80",
+			incomingHeaders: map[string]string{
+				"X-Forwarded-for": "10.0.1.0, 10.0.1.12",
+			},
+			expectedHeaders: map[string]string{
+				"X-Forwarded-for": "10.0.1.0, 10.0.1.12",
+			},
+		},
+		{
+			desc:       "insecure false with incoming X-Forwarded-For and invalid Trusted Ips CIDR",
+			insecure:   false,
+			trustedIps: []string{"1.2.3.4/24"},
+			remoteAddr: "10.0.1.101:80",
+			incomingHeaders: map[string]string{
+				"X-Forwarded-for": "10.0.1.0, 10.0.1.12",
+			},
+			expectedHeaders: map[string]string{
+				"X-Forwarded-for": "",
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			req, err := http.NewRequest(http.MethodGet, "", nil)
+			require.NoError(t, err)
+
+			req.RemoteAddr = test.remoteAddr
+
+			for k, v := range test.incomingHeaders {
+				req.Header.Set(k, v)
+			}
+
+			m, err := NewXforwarded(test.insecure, test.trustedIps)
+			require.NoError(t, err)
+
+			m.ServeHTTP(nil, req, nil)
+
+			for k, v := range test.expectedHeaders {
+				assert.Equal(t, v, req.Header.Get(k))
+			}
+		})
+	}
+}

old/middlewares/handlerSwitcher.go

@@ -0,0 +1,36 @@
+package middlewares
+
+import (
+	"net/http"
+
+	"github.com/containous/mux"
+	"github.com/containous/traefik/safe"
+)
+
+// HandlerSwitcher allows hot switching of http.ServeMux
+type HandlerSwitcher struct {
+	handler *safe.Safe
+}
+
+// NewHandlerSwitcher builds a new instance of HandlerSwitcher
+func NewHandlerSwitcher(newHandler *mux.Router) (hs *HandlerSwitcher) {
+	return &HandlerSwitcher{
+		handler: safe.New(newHandler),
+	}
+}
+
+func (hs *HandlerSwitcher) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	handlerBackup := hs.handler.Get().(*mux.Router)
+	handlerBackup.ServeHTTP(rw, r)
+}
+
+// GetHandler returns the current http.ServeMux
+func (hs *HandlerSwitcher) GetHandler() (newHandler *mux.Router) {
+	handler := hs.handler.Get().(*mux.Router)
+	return handler
+}
+
+// UpdateHandler safely updates the current http.ServeMux with a new one
+func (hs *HandlerSwitcher) UpdateHandler(newHandler *mux.Router) {
+	hs.handler.Set(newHandler)
+}

old/middlewares/headers.go

@@ -0,0 +1,71 @@
+package middlewares
+
+// Middleware based on https://github.com/unrolled/secure
+
+import (
+	"net/http"
+
+	"github.com/containous/traefik/old/types"
+)
+
+// HeaderOptions is a struct for specifying configuration options for the headers middleware.
+type HeaderOptions struct {
+	// If Custom request headers are set, these will be added to the request
+	CustomRequestHeaders map[string]string
+	// If Custom response headers are set, these will be added to the ResponseWriter
+	CustomResponseHeaders map[string]string
+}
+
+// HeaderStruct is a middleware that helps setup a few basic security features. A single headerOptions struct can be
+// provided to configure which features should be enabled, and the ability to override a few of the default values.
+type HeaderStruct struct {
+	// Customize headers with a headerOptions struct.
+	opt HeaderOptions
+}
+
+// NewHeaderFromStruct constructs a new header instance from supplied frontend header struct.
+func NewHeaderFromStruct(headers *types.Headers) *HeaderStruct {
+	if headers == nil || !headers.HasCustomHeadersDefined() {
+		return nil
+	}
+
+	return &HeaderStruct{
+		opt: HeaderOptions{
+			CustomRequestHeaders:  headers.CustomRequestHeaders,
+			CustomResponseHeaders: headers.CustomResponseHeaders,
+		},
+	}
+}
+
+func (s *HeaderStruct) ServeHTTP(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	s.ModifyRequestHeaders(r)
+	// If there is a next, call it.
+	if next != nil {
+		next(w, r)
+	}
+}
+
+// ModifyRequestHeaders set or delete request headers
+func (s *HeaderStruct) ModifyRequestHeaders(r *http.Request) {
+	// Loop through Custom request headers
+	for header, value := range s.opt.CustomRequestHeaders {
+		if value == "" {
+			r.Header.Del(header)
+		} else {
+			r.Header.Set(header, value)
+		}
+	}
+}
+
+// ModifyResponseHeaders set or delete response headers
+func (s *HeaderStruct) ModifyResponseHeaders(res *http.Response) error {
+	// Loop through Custom response headers
+	for header, value := range s.opt.CustomResponseHeaders {
+		if value == "" {
+			res.Header.Del(header)
+		} else {
+			res.Header.Set(header, value)
+		}
+	}
+	return nil
+}

old/middlewares/headers_test.go

@@ -0,0 +1,118 @@
+package middlewares
+
+// Middleware tests based on https://github.com/unrolled/secure
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/containous/traefik/testhelpers"
+	"github.com/stretchr/testify/assert"
+)
+
+var myHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	w.Write([]byte("bar"))
+})
+
+// newHeader constructs a new header instance with supplied options.
+func newHeader(options ...HeaderOptions) *HeaderStruct {
+	var opt HeaderOptions
+	if len(options) == 0 {
+		opt = HeaderOptions{}
+	} else {
+		opt = options[0]
+	}
+
+	return &HeaderStruct{opt: opt}
+}
+
+func TestNoConfig(t *testing.T) {
+	header := newHeader()
+
+	res := httptest.NewRecorder()
+	req := testhelpers.MustNewRequest(http.MethodGet, "http://example.com/foo", nil)
+
+	header.ServeHTTP(res, req, myHandler)
+
+	assert.Equal(t, http.StatusOK, res.Code, "Status not OK")
+	assert.Equal(t, "bar", res.Body.String(), "Body not the expected")
+}
+
+func TestModifyResponseHeaders(t *testing.T) {
+	header := newHeader(HeaderOptions{
+		CustomResponseHeaders: map[string]string{
+			"X-Custom-Response-Header": "test_response",
+		},
+	})
+
+	res := httptest.NewRecorder()
+	res.HeaderMap.Add("X-Custom-Response-Header", "test_response")
+
+	err := header.ModifyResponseHeaders(res.Result())
+	assert.NoError(t, err)
+
+	assert.Equal(t, http.StatusOK, res.Code, "Status not OK")
+	assert.Equal(t, "test_response", res.Header().Get("X-Custom-Response-Header"), "Did not get expected header")
+
+	res = httptest.NewRecorder()
+	res.HeaderMap.Add("X-Custom-Response-Header", "")
+
+	err = header.ModifyResponseHeaders(res.Result())
+	assert.NoError(t, err)
+
+	assert.Equal(t, http.StatusOK, res.Code, "Status not OK")
+	assert.Equal(t, "", res.Header().Get("X-Custom-Response-Header"), "Did not get expected header")
+
+	res = httptest.NewRecorder()
+	res.HeaderMap.Add("X-Custom-Response-Header", "test_override")
+
+	err = header.ModifyResponseHeaders(res.Result())
+	assert.NoError(t, err)
+
+	assert.Equal(t, http.StatusOK, res.Code, "Status not OK")
+	assert.Equal(t, "test_override", res.Header().Get("X-Custom-Response-Header"), "Did not get expected header")
+}
+
+func TestCustomRequestHeader(t *testing.T) {
+	header := newHeader(HeaderOptions{
+		CustomRequestHeaders: map[string]string{
+			"X-Custom-Request-Header": "test_request",
+		},
+	})
+
+	res := httptest.NewRecorder()
+	req := testhelpers.MustNewRequest(http.MethodGet, "/foo", nil)
+
+	header.ServeHTTP(res, req, nil)
+
+	assert.Equal(t, http.StatusOK, res.Code, "Status not OK")
+	assert.Equal(t, "test_request", req.Header.Get("X-Custom-Request-Header"), "Did not get expected header")
+}
+
+func TestCustomRequestHeaderEmptyValue(t *testing.T) {
+	header := newHeader(HeaderOptions{
+		CustomRequestHeaders: map[string]string{
+			"X-Custom-Request-Header": "test_request",
+		},
+	})
+
+	res := httptest.NewRecorder()
+	req := testhelpers.MustNewRequest(http.MethodGet, "/foo", nil)
+
+	header.ServeHTTP(res, req, nil)
+
+	assert.Equal(t, http.StatusOK, res.Code, "Status not OK")
+	assert.Equal(t, "test_request", req.Header.Get("X-Custom-Request-Header"), "Did not get expected header")
+
+	header = newHeader(HeaderOptions{
+		CustomRequestHeaders: map[string]string{
+			"X-Custom-Request-Header": "",
+		},
+	})
+
+	header.ServeHTTP(res, req, nil)
+
+	assert.Equal(t, http.StatusOK, res.Code, "Status not OK")
+	assert.Equal(t, "", req.Header.Get("X-Custom-Request-Header"), "This header is not expected")
+}

old/middlewares/ip_whitelister.go

@@ -0,0 +1,67 @@
+package middlewares
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/containous/traefik/ip"
+	"github.com/containous/traefik/old/log"
+	"github.com/containous/traefik/old/middlewares/tracing"
+	"github.com/pkg/errors"
+	"github.com/urfave/negroni"
+)
+
+// IPWhiteLister is a middleware that provides Checks of the Requesting IP against a set of Whitelists
+type IPWhiteLister struct {
+	handler     negroni.Handler
+	whiteLister *ip.Checker
+	strategy    ip.Strategy
+}
+
+// NewIPWhiteLister builds a new IPWhiteLister given a list of CIDR-Strings to whitelist
+func NewIPWhiteLister(whiteList []string, strategy ip.Strategy) (*IPWhiteLister, error) {
+	if len(whiteList) == 0 {
+		return nil, errors.New("no white list provided")
+	}
+
+	checker, err := ip.NewChecker(whiteList)
+	if err != nil {
+		return nil, fmt.Errorf("parsing CIDR whitelist %s: %v", whiteList, err)
+	}
+
+	whiteLister := IPWhiteLister{
+		strategy:    strategy,
+		whiteLister: checker,
+	}
+
+	whiteLister.handler = negroni.HandlerFunc(whiteLister.handle)
+	log.Debugf("configured IP white list: %s", whiteList)
+
+	return &whiteLister, nil
+}
+
+func (wl *IPWhiteLister) handle(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	err := wl.whiteLister.IsAuthorized(wl.strategy.GetIP(r))
+	if err != nil {
+		tracing.SetErrorAndDebugLog(r, "request %+v - rejecting: %v", r, err)
+		reject(w)
+		return
+	}
+	log.Debugf("Accept %s: %+v", wl.strategy.GetIP(r), r)
+	tracing.SetErrorAndDebugLog(r, "request %+v matched white list %v - passing", r, wl.whiteLister)
+	next.ServeHTTP(w, r)
+}
+
+func (wl *IPWhiteLister) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	wl.handler.ServeHTTP(rw, r, next)
+}
+
+func reject(w http.ResponseWriter) {
+	statusCode := http.StatusForbidden
+
+	w.WriteHeader(statusCode)
+	_, err := w.Write([]byte(http.StatusText(statusCode)))
+	if err != nil {
+		log.Error(err)
+	}
+}

old/middlewares/ip_whitelister_test.go

@@ -0,0 +1,92 @@
+package middlewares
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/containous/traefik/ip"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewIPWhiteLister(t *testing.T) {
+	testCases := []struct {
+		desc          string
+		whiteList     []string
+		expectedError string
+	}{
+		{
+			desc:          "invalid IP",
+			whiteList:     []string{"foo"},
+			expectedError: "parsing CIDR whitelist [foo]: parsing CIDR trusted IPs <nil>: invalid CIDR address: foo",
+		},
+		{
+			desc:          "valid IP",
+			whiteList:     []string{"10.10.10.10"},
+			expectedError: "",
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			whiteLister, err := NewIPWhiteLister(test.whiteList, &ip.RemoteAddrStrategy{})
+
+			if len(test.expectedError) > 0 {
+				assert.EqualError(t, err, test.expectedError)
+			} else {
+				require.NoError(t, err)
+				assert.NotNil(t, whiteLister)
+			}
+		})
+	}
+}
+
+func TestIPWhiteLister_ServeHTTP(t *testing.T) {
+	testCases := []struct {
+		desc       string
+		whiteList  []string
+		remoteAddr string
+		expected   int
+	}{
+		{
+			desc:       "authorized with remote address",
+			whiteList:  []string{"20.20.20.20"},
+			remoteAddr: "20.20.20.20:1234",
+			expected:   200,
+		},
+		{
+			desc:       "non authorized with remote address",
+			whiteList:  []string{"20.20.20.20"},
+			remoteAddr: "20.20.20.21:1234",
+			expected:   403,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			whiteLister, err := NewIPWhiteLister(test.whiteList, &ip.RemoteAddrStrategy{})
+			require.NoError(t, err)
+
+			recorder := httptest.NewRecorder()
+
+			req := httptest.NewRequest(http.MethodGet, "http://10.10.10.10", nil)
+
+			if len(test.remoteAddr) > 0 {
+				req.RemoteAddr = test.remoteAddr
+			}
+
+			next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
+
+			whiteLister.ServeHTTP(recorder, req, next)
+
+			assert.Equal(t, test.expected, recorder.Code)
+		})
+	}
+}

old/middlewares/pipelining/pipelining.go

@@ -0,0 +1,62 @@
+package pipelining
+
+import (
+	"bufio"
+	"net"
+	"net/http"
+)
+
+// Pipelining returns a middleware
+type Pipelining struct {
+	next http.Handler
+}
+
+// NewPipelining returns a new Pipelining instance
+func NewPipelining(next http.Handler) *Pipelining {
+	return &Pipelining{
+		next: next,
+	}
+}
+
+func (p *Pipelining) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	// https://github.com/golang/go/blob/3d59583836630cf13ec4bfbed977d27b1b7adbdc/src/net/http/server.go#L201-L218
+	if r.Method == http.MethodPut || r.Method == http.MethodPost {
+		p.next.ServeHTTP(rw, r)
+	} else {
+		p.next.ServeHTTP(&writerWithoutCloseNotify{rw}, r)
+	}
+
+}
+
+// writerWithoutCloseNotify helps to disable closeNotify
+type writerWithoutCloseNotify struct {
+	W http.ResponseWriter
+}
+
+// Header returns the response headers.
+func (w *writerWithoutCloseNotify) Header() http.Header {
+	return w.W.Header()
+}
+
+// Write writes the data to the connection as part of an HTTP reply.
+func (w *writerWithoutCloseNotify) Write(buf []byte) (int, error) {
+	return w.W.Write(buf)
+}
+
+// WriteHeader sends an HTTP response header with the provided
+// status code.
+func (w *writerWithoutCloseNotify) WriteHeader(code int) {
+	w.W.WriteHeader(code)
+}
+
+// Flush sends any buffered data to the client.
+func (w *writerWithoutCloseNotify) Flush() {
+	if f, ok := w.W.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
+// Hijack hijacks the connection.
+func (w *writerWithoutCloseNotify) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	return w.W.(http.Hijacker).Hijack()
+}

old/middlewares/pipelining/pipelining_test.go

@@ -0,0 +1,69 @@
+package pipelining
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type recorderWithCloseNotify struct {
+	*httptest.ResponseRecorder
+}
+
+func (r *recorderWithCloseNotify) CloseNotify() <-chan bool {
+	panic("implement me")
+}
+
+func TestNewPipelining(t *testing.T) {
+	testCases := []struct {
+		desc                   string
+		HTTPMethod             string
+		implementCloseNotifier bool
+	}{
+		{
+			desc:                   "should not implement CloseNotifier with GET method",
+			HTTPMethod:             http.MethodGet,
+			implementCloseNotifier: false,
+		},
+		{
+			desc:                   "should implement CloseNotifier with PUT method",
+			HTTPMethod:             http.MethodPut,
+			implementCloseNotifier: true,
+		},
+		{
+			desc:                   "should implement CloseNotifier with POST method",
+			HTTPMethod:             http.MethodPost,
+			implementCloseNotifier: true,
+		},
+		{
+			desc:                   "should  not implement CloseNotifier with GET method",
+			HTTPMethod:             http.MethodHead,
+			implementCloseNotifier: false,
+		},
+		{
+			desc:                   "should  not implement CloseNotifier with PROPFIND method",
+			HTTPMethod:             "PROPFIND",
+			implementCloseNotifier: false,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				_, ok := w.(http.CloseNotifier)
+				assert.Equal(t, test.implementCloseNotifier, ok)
+				w.WriteHeader(http.StatusOK)
+			})
+			handler := NewPipelining(nextHandler)
+
+			req := httptest.NewRequest(test.HTTPMethod, "http://localhost", nil)
+
+			handler.ServeHTTP(&recorderWithCloseNotify{httptest.NewRecorder()}, req)
+		})
+	}
+}

old/middlewares/recover.go

@@ -0,0 +1,51 @@
+package middlewares
+
+import (
+	"net/http"
+	"runtime"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/urfave/negroni"
+)
+
+// RecoverHandler recovers from a panic in http handlers
+func RecoverHandler(next http.Handler) http.Handler {
+	fn := func(w http.ResponseWriter, r *http.Request) {
+		defer recoverFunc(w, r)
+		next.ServeHTTP(w, r)
+	}
+	return http.HandlerFunc(fn)
+}
+
+// NegroniRecoverHandler recovers from a panic in negroni handlers
+func NegroniRecoverHandler() negroni.Handler {
+	fn := func(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+		defer recoverFunc(w, r)
+		next.ServeHTTP(w, r)
+	}
+	return negroni.HandlerFunc(fn)
+}
+
+func recoverFunc(w http.ResponseWriter, r *http.Request) {
+	if err := recover(); err != nil {
+		if !shouldLogPanic(err) {
+			log.Debugf("Request has been aborted [%s - %s]: %v", r.RemoteAddr, r.URL, err)
+			return
+		}
+
+		log.Errorf("Recovered from panic in HTTP handler [%s - %s]: %+v", r.RemoteAddr, r.URL, err)
+
+		const size = 64 << 10
+		buf := make([]byte, size)
+		buf = buf[:runtime.Stack(buf, false)]
+		log.Errorf("Stack: %s", buf)
+
+		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+	}
+}
+
+// https://github.com/golang/go/blob/a0d6420d8be2ae7164797051ec74fa2a2df466a1/src/net/http/server.go#L1761-L1775
+// https://github.com/golang/go/blob/c33153f7b416c03983324b3e8f869ce1116d84bc/src/net/http/httputil/reverseproxy.go#L284
+func shouldLogPanic(panicValue interface{}) bool {
+	return panicValue != nil && panicValue != http.ErrAbortHandler
+}

old/middlewares/recover_test.go

@@ -0,0 +1,45 @@
+package middlewares
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/urfave/negroni"
+)
+
+func TestRecoverHandler(t *testing.T) {
+	fn := func(w http.ResponseWriter, r *http.Request) {
+		panic("I love panicing!")
+	}
+	recoverHandler := RecoverHandler(http.HandlerFunc(fn))
+	server := httptest.NewServer(recoverHandler)
+	defer server.Close()
+
+	resp, err := http.Get(server.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp.StatusCode != http.StatusInternalServerError {
+		t.Fatalf("Received non-%d response: %d\n", http.StatusInternalServerError, resp.StatusCode)
+	}
+}
+
+func TestNegroniRecoverHandler(t *testing.T) {
+	n := negroni.New()
+	n.Use(NegroniRecoverHandler())
+	panicHandler := func(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+		panic("I love panicing!")
+	}
+	n.UseFunc(negroni.HandlerFunc(panicHandler))
+	server := httptest.NewServer(n)
+	defer server.Close()
+
+	resp, err := http.Get(server.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp.StatusCode != http.StatusInternalServerError {
+		t.Fatalf("Received non-%d response: %d\n", http.StatusInternalServerError, resp.StatusCode)
+	}
+}

old/middlewares/redirect/redirect.go

@@ -0,0 +1,163 @@
+package redirect
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strings"
+	"text/template"
+
+	"github.com/containous/traefik/old/configuration"
+	"github.com/containous/traefik/old/middlewares"
+	"github.com/urfave/negroni"
+	"github.com/vulcand/oxy/utils"
+)
+
+const (
+	defaultRedirectRegex = `^(?:https?:\/\/)?([\w\._-]+)(?::\d+)?(.*)$`
+)
+
+// NewEntryPointHandler create a new redirection handler base on entry point
+func NewEntryPointHandler(dstEntryPoint *configuration.EntryPoint, permanent bool) (negroni.Handler, error) {
+	exp := regexp.MustCompile(`(:\d+)`)
+	match := exp.FindStringSubmatch(dstEntryPoint.Address)
+	if len(match) == 0 {
+		return nil, fmt.Errorf("bad Address format %q", dstEntryPoint.Address)
+	}
+
+	protocol := "http"
+	if dstEntryPoint.TLS != nil {
+		protocol = "https"
+	}
+
+	replacement := protocol + "://${1}" + match[0] + "${2}"
+
+	return NewRegexHandler(defaultRedirectRegex, replacement, permanent)
+}
+
+// NewRegexHandler create a new redirection handler base on regex
+func NewRegexHandler(exp string, replacement string, permanent bool) (negroni.Handler, error) {
+	re, err := regexp.Compile(exp)
+	if err != nil {
+		return nil, err
+	}
+
+	return &handler{
+		regexp:      re,
+		replacement: replacement,
+		permanent:   permanent,
+		errHandler:  utils.DefaultHandler,
+	}, nil
+}
+
+type handler struct {
+	regexp      *regexp.Regexp
+	replacement string
+	permanent   bool
+	errHandler  utils.ErrorHandler
+}
+
+func (h *handler) ServeHTTP(rw http.ResponseWriter, req *http.Request, next http.HandlerFunc) {
+	oldURL := rawURL(req)
+
+	// only continue if the Regexp param matches the URL
+	if !h.regexp.MatchString(oldURL) {
+		next.ServeHTTP(rw, req)
+		return
+	}
+
+	// apply a rewrite regexp to the URL
+	newURL := h.regexp.ReplaceAllString(oldURL, h.replacement)
+
+	// replace any variables that may be in there
+	rewrittenURL := &bytes.Buffer{}
+	if err := applyString(newURL, rewrittenURL, req); err != nil {
+		h.errHandler.ServeHTTP(rw, req, err)
+		return
+	}
+
+	// parse the rewritten URL and replace request URL with it
+	parsedURL, err := url.Parse(rewrittenURL.String())
+	if err != nil {
+		h.errHandler.ServeHTTP(rw, req, err)
+		return
+	}
+
+	if stripPrefix, stripPrefixOk := req.Context().Value(middlewares.StripPrefixKey).(string); stripPrefixOk {
+		if len(stripPrefix) > 0 {
+			parsedURL.Path = stripPrefix
+		}
+	}
+
+	if addPrefix, addPrefixOk := req.Context().Value(middlewares.AddPrefixKey).(string); addPrefixOk {
+		if len(addPrefix) > 0 {
+			parsedURL.Path = strings.Replace(parsedURL.Path, addPrefix, "", 1)
+		}
+	}
+
+	if replacePath, replacePathOk := req.Context().Value(middlewares.ReplacePathKey).(string); replacePathOk {
+		if len(replacePath) > 0 {
+			parsedURL.Path = replacePath
+		}
+	}
+
+	if newURL != oldURL {
+		handler := &moveHandler{location: parsedURL, permanent: h.permanent}
+		handler.ServeHTTP(rw, req)
+		return
+	}
+
+	req.URL = parsedURL
+
+	// make sure the request URI corresponds the rewritten URL
+	req.RequestURI = req.URL.RequestURI()
+	next.ServeHTTP(rw, req)
+}
+
+type moveHandler struct {
+	location  *url.URL
+	permanent bool
+}
+
+func (m *moveHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	rw.Header().Set("Location", m.location.String())
+	status := http.StatusFound
+	if m.permanent {
+		status = http.StatusMovedPermanently
+	}
+	rw.WriteHeader(status)
+	rw.Write([]byte(http.StatusText(status)))
+}
+
+func rawURL(request *http.Request) string {
+	scheme := "http"
+	if request.TLS != nil || isXForwardedHTTPS(request) {
+		scheme = "https"
+	}
+
+	return strings.Join([]string{scheme, "://", request.Host, request.RequestURI}, "")
+}
+
+func isXForwardedHTTPS(request *http.Request) bool {
+	xForwardedProto := request.Header.Get("X-Forwarded-Proto")
+
+	return len(xForwardedProto) > 0 && xForwardedProto == "https"
+}
+
+func applyString(in string, out io.Writer, request *http.Request) error {
+	t, err := template.New("t").Parse(in)
+	if err != nil {
+		return err
+	}
+
+	data := struct {
+		Request *http.Request
+	}{
+		Request: request,
+	}
+
+	return t.Execute(out, data)
+}

old/middlewares/redirect/redirect_test.go

@@ -0,0 +1,182 @@
+package redirect
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/containous/traefik/old/configuration"
+	"github.com/containous/traefik/testhelpers"
+	"github.com/containous/traefik/tls"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewEntryPointHandler(t *testing.T) {
+	testCases := []struct {
+		desc           string
+		entryPoint     *configuration.EntryPoint
+		permanent      bool
+		url            string
+		expectedURL    string
+		expectedStatus int
+		errorExpected  bool
+	}{
+		{
+			desc:           "HTTP to HTTPS",
+			entryPoint:     &configuration.EntryPoint{Address: ":443", TLS: &tls.TLS{}},
+			url:            "http://foo:80",
+			expectedURL:    "https://foo:443",
+			expectedStatus: http.StatusFound,
+		},
+		{
+			desc:           "HTTPS to HTTP",
+			entryPoint:     &configuration.EntryPoint{Address: ":80"},
+			url:            "https://foo:443",
+			expectedURL:    "http://foo:80",
+			expectedStatus: http.StatusFound,
+		},
+		{
+			desc:           "HTTP to HTTP",
+			entryPoint:     &configuration.EntryPoint{Address: ":88"},
+			url:            "http://foo:80",
+			expectedURL:    "http://foo:88",
+			expectedStatus: http.StatusFound,
+		},
+		{
+			desc:           "HTTP to HTTPS permanent",
+			entryPoint:     &configuration.EntryPoint{Address: ":443", TLS: &tls.TLS{}},
+			permanent:      true,
+			url:            "http://foo:80",
+			expectedURL:    "https://foo:443",
+			expectedStatus: http.StatusMovedPermanently,
+		},
+		{
+			desc:           "HTTPS to HTTP permanent",
+			entryPoint:     &configuration.EntryPoint{Address: ":80"},
+			permanent:      true,
+			url:            "https://foo:443",
+			expectedURL:    "http://foo:80",
+			expectedStatus: http.StatusMovedPermanently,
+		},
+		{
+			desc:          "invalid address",
+			entryPoint:    &configuration.EntryPoint{Address: ":foo", TLS: &tls.TLS{}},
+			url:           "http://foo:80",
+			errorExpected: true,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			handler, err := NewEntryPointHandler(test.entryPoint, test.permanent)
+
+			if test.errorExpected {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+
+				recorder := httptest.NewRecorder()
+				r := testhelpers.MustNewRequest(http.MethodGet, test.url, nil)
+				handler.ServeHTTP(recorder, r, nil)
+
+				location, err := recorder.Result().Location()
+				require.NoError(t, err)
+
+				assert.Equal(t, test.expectedURL, location.String())
+				assert.Equal(t, test.expectedStatus, recorder.Code)
+			}
+		})
+	}
+}
+
+func TestNewRegexHandler(t *testing.T) {
+	testCases := []struct {
+		desc           string
+		regex          string
+		replacement    string
+		permanent      bool
+		url            string
+		expectedURL    string
+		expectedStatus int
+		errorExpected  bool
+	}{
+		{
+			desc:           "simple redirection",
+			regex:          `^(?:http?:\/\/)(foo)(\.com)(:\d+)(.*)$`,
+			replacement:    "https://${1}bar$2:443$4",
+			url:            "http://foo.com:80",
+			expectedURL:    "https://foobar.com:443",
+			expectedStatus: http.StatusFound,
+		},
+		{
+			desc:           "use request header",
+			regex:          `^(?:http?:\/\/)(foo)(\.com)(:\d+)(.*)$`,
+			replacement:    `https://${1}{{ .Request.Header.Get "X-Foo" }}$2:443$4`,
+			url:            "http://foo.com:80",
+			expectedURL:    "https://foobar.com:443",
+			expectedStatus: http.StatusFound,
+		},
+		{
+			desc:           "URL doesn't match regex",
+			regex:          `^(?:http?:\/\/)(foo)(\.com)(:\d+)(.*)$`,
+			replacement:    "https://${1}bar$2:443$4",
+			url:            "http://bar.com:80",
+			expectedStatus: http.StatusOK,
+		},
+		{
+			desc:           "invalid rewritten URL",
+			regex:          `^(.*)$`,
+			replacement:    "http://192.168.0.%31/",
+			url:            "http://foo.com:80",
+			expectedStatus: http.StatusBadGateway,
+		},
+		{
+			desc:          "invalid regex",
+			regex:         `^(.*`,
+			replacement:   "$1",
+			url:           "http://foo.com:80",
+			errorExpected: true,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			handler, err := NewRegexHandler(test.regex, test.replacement, test.permanent)
+
+			if test.errorExpected {
+				require.Nil(t, handler)
+				require.Error(t, err)
+			} else {
+				require.NotNil(t, handler)
+				require.NoError(t, err)
+
+				recorder := httptest.NewRecorder()
+				r := testhelpers.MustNewRequest(http.MethodGet, test.url, nil)
+				r.Header.Set("X-Foo", "bar")
+				next := func(rw http.ResponseWriter, req *http.Request) {}
+				handler.ServeHTTP(recorder, r, next)
+
+				if test.expectedStatus == http.StatusMovedPermanently || test.expectedStatus == http.StatusFound {
+					assert.Equal(t, test.expectedStatus, recorder.Code)
+
+					location, err := recorder.Result().Location()
+					require.NoError(t, err)
+
+					assert.Equal(t, test.expectedURL, location.String())
+				} else {
+					assert.Equal(t, test.expectedStatus, recorder.Code)
+
+					location, err := recorder.Result().Location()
+					require.Errorf(t, err, "Location %v", location)
+				}
+			}
+		})
+	}
+}

old/middlewares/replace_path.go

@@ -0,0 +1,28 @@
+package middlewares
+
+import (
+	"context"
+	"net/http"
+)
+
+const (
+	// ReplacePathKey is the key within the request context used to
+	// store the replaced path
+	ReplacePathKey key = "ReplacePath"
+	// ReplacedPathHeader is the default header to set the old path to
+	ReplacedPathHeader = "X-Replaced-Path"
+)
+
+// ReplacePath is a middleware used to replace the path of a URL request
+type ReplacePath struct {
+	Handler http.Handler
+	Path    string
+}
+
+func (s *ReplacePath) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	r = r.WithContext(context.WithValue(r.Context(), ReplacePathKey, r.URL.Path))
+	r.Header.Add(ReplacedPathHeader, r.URL.Path)
+	r.URL.Path = s.Path
+	r.RequestURI = r.URL.RequestURI()
+	s.Handler.ServeHTTP(w, r)
+}

old/middlewares/replace_path_regex.go

@@ -0,0 +1,40 @@
+package middlewares
+
+import (
+	"context"
+	"net/http"
+	"regexp"
+	"strings"
+
+	"github.com/containous/traefik/old/log"
+)
+
+// ReplacePathRegex is a middleware used to replace the path of a URL request with a regular expression
+type ReplacePathRegex struct {
+	Handler     http.Handler
+	Regexp      *regexp.Regexp
+	Replacement string
+}
+
+// NewReplacePathRegexHandler returns a new ReplacePathRegex
+func NewReplacePathRegexHandler(regex string, replacement string, handler http.Handler) http.Handler {
+	exp, err := regexp.Compile(strings.TrimSpace(regex))
+	if err != nil {
+		log.Errorf("Error compiling regular expression %s: %s", regex, err)
+	}
+	return &ReplacePathRegex{
+		Regexp:      exp,
+		Replacement: strings.TrimSpace(replacement),
+		Handler:     handler,
+	}
+}
+
+func (s *ReplacePathRegex) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if s.Regexp != nil && len(s.Replacement) > 0 && s.Regexp.MatchString(r.URL.Path) {
+		r = r.WithContext(context.WithValue(r.Context(), ReplacePathKey, r.URL.Path))
+		r.Header.Add(ReplacedPathHeader, r.URL.Path)
+		r.URL.Path = s.Regexp.ReplaceAllString(r.URL.Path, s.Replacement)
+		r.RequestURI = r.URL.RequestURI()
+	}
+	s.Handler.ServeHTTP(w, r)
+}

old/middlewares/replace_path_regex_test.go

@@ -0,0 +1,80 @@
+package middlewares
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/containous/traefik/testhelpers"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestReplacePathRegex(t *testing.T) {
+	testCases := []struct {
+		desc           string
+		path           string
+		replacement    string
+		regex          string
+		expectedPath   string
+		expectedHeader string
+	}{
+		{
+			desc:           "simple regex",
+			path:           "/whoami/and/whoami",
+			replacement:    "/who-am-i/$1",
+			regex:          `^/whoami/(.*)`,
+			expectedPath:   "/who-am-i/and/whoami",
+			expectedHeader: "/whoami/and/whoami",
+		},
+		{
+			desc:           "simple replace (no regex)",
+			path:           "/whoami/and/whoami",
+			replacement:    "/who-am-i",
+			regex:          `/whoami`,
+			expectedPath:   "/who-am-i/and/who-am-i",
+			expectedHeader: "/whoami/and/whoami",
+		},
+		{
+			desc:           "multiple replacement",
+			path:           "/downloads/src/source.go",
+			replacement:    "/downloads/$1-$2",
+			regex:          `^(?i)/downloads/([^/]+)/([^/]+)$`,
+			expectedPath:   "/downloads/src-source.go",
+			expectedHeader: "/downloads/src/source.go",
+		},
+		{
+			desc:         "invalid regular expression",
+			path:         "/invalid/regexp/test",
+			replacement:  "/valid/regexp/$1",
+			regex:        `^(?err)/invalid/regexp/([^/]+)$`,
+			expectedPath: "/invalid/regexp/test",
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			var actualPath, actualHeader, requestURI string
+			handler := NewReplacePathRegexHandler(
+				test.regex,
+				test.replacement,
+				http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					actualPath = r.URL.Path
+					actualHeader = r.Header.Get(ReplacedPathHeader)
+					requestURI = r.RequestURI
+				}),
+			)
+
+			req := testhelpers.MustNewRequest(http.MethodGet, "http://localhost"+test.path, nil)
+
+			handler.ServeHTTP(nil, req)
+
+			assert.Equal(t, test.expectedPath, actualPath, "Unexpected path.")
+			assert.Equal(t, test.expectedHeader, actualHeader, "Unexpected '%s' header.", ReplacedPathHeader)
+			if test.expectedHeader != "" {
+				assert.Equal(t, actualPath, requestURI, "Unexpected request URI.")
+			}
+		})
+	}
+}

old/middlewares/replace_path_test.go

@@ -0,0 +1,41 @@
+package middlewares
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/containous/traefik/testhelpers"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestReplacePath(t *testing.T) {
+	const replacementPath = "/replacement-path"
+
+	paths := []string{
+		"/example",
+		"/some/really/long/path",
+	}
+
+	for _, path := range paths {
+		t.Run(path, func(t *testing.T) {
+
+			var expectedPath, actualHeader, requestURI string
+			handler := &ReplacePath{
+				Path: replacementPath,
+				Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					expectedPath = r.URL.Path
+					actualHeader = r.Header.Get(ReplacedPathHeader)
+					requestURI = r.RequestURI
+				}),
+			}
+
+			req := testhelpers.MustNewRequest(http.MethodGet, "http://localhost"+path, nil)
+
+			handler.ServeHTTP(nil, req)
+
+			assert.Equal(t, expectedPath, replacementPath, "Unexpected path.")
+			assert.Equal(t, path, actualHeader, "Unexpected '%s' header.", ReplacedPathHeader)
+			assert.Equal(t, expectedPath, requestURI, "Unexpected request URI.")
+		})
+	}
+}

old/middlewares/request_host.go

@@ -0,0 +1,45 @@
+package middlewares
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"strings"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/containous/traefik/old/types"
+)
+
+var requestHostKey struct{}
+
+// RequestHost is the struct for the middleware that adds the CanonicalDomain of the request Host into a context for later use.
+type RequestHost struct{}
+
+func (rh *RequestHost) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	if next != nil {
+		host := types.CanonicalDomain(parseHost(r.Host))
+		next.ServeHTTP(rw, r.WithContext(context.WithValue(r.Context(), requestHostKey, host)))
+	}
+}
+
+func parseHost(addr string) string {
+	if !strings.Contains(addr, ":") {
+		return addr
+	}
+
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return addr
+	}
+	return host
+}
+
+// GetCanonizedHost plucks the canonized host key from the request of a context that was put through the middleware
+func GetCanonizedHost(ctx context.Context) string {
+	if val, ok := ctx.Value(requestHostKey).(string); ok {
+		return val
+	}
+
+	log.Warn("RequestHost is missing in the middleware chain")
+	return ""
+}

old/middlewares/request_host_test.go

@@ -0,0 +1,94 @@
+package middlewares
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/containous/traefik/testhelpers"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRequestHost(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		url      string
+		expected string
+	}{
+		{
+			desc:     "host without :",
+			url:      "http://host",
+			expected: "host",
+		},
+		{
+			desc:     "host with : and without port",
+			url:      "http://host:",
+			expected: "host",
+		},
+		{
+			desc:     "IP host with : and with port",
+			url:      "http://127.0.0.1:123",
+			expected: "127.0.0.1",
+		},
+		{
+			desc:     "IP host with : and without port",
+			url:      "http://127.0.0.1:",
+			expected: "127.0.0.1",
+		},
+	}
+
+	rh := &RequestHost{}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			req := testhelpers.MustNewRequest(http.MethodGet, test.url, nil)
+
+			rh.ServeHTTP(nil, req, func(_ http.ResponseWriter, r *http.Request) {
+				host := GetCanonizedHost(r.Context())
+				assert.Equal(t, test.expected, host)
+			})
+		})
+	}
+}
+
+func TestRequestHostParseHost(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		host     string
+		expected string
+	}{
+		{
+			desc:     "host without :",
+			host:     "host",
+			expected: "host",
+		},
+		{
+			desc:     "host with : and without port",
+			host:     "host:",
+			expected: "host",
+		},
+		{
+			desc:     "IP host with : and with port",
+			host:     "127.0.0.1:123",
+			expected: "127.0.0.1",
+		},
+		{
+			desc:     "IP host with : and without port",
+			host:     "127.0.0.1:",
+			expected: "127.0.0.1",
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			actual := parseHost(test.host)
+
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}

old/middlewares/retry.go

@@ -0,0 +1,173 @@
+package middlewares
+
+import (
+	"bufio"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"net/http/httptrace"
+
+	"github.com/containous/traefik/old/log"
+)
+
+// Compile time validation that the response writer implements http interfaces correctly.
+var _ Stateful = &retryResponseWriterWithCloseNotify{}
+
+// Retry is a middleware that retries requests
+type Retry struct {
+	attempts int
+	next     http.Handler
+	listener RetryListener
+}
+
+// NewRetry returns a new Retry instance
+func NewRetry(attempts int, next http.Handler, listener RetryListener) *Retry {
+	return &Retry{
+		attempts: attempts,
+		next:     next,
+		listener: listener,
+	}
+}
+
+func (retry *Retry) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	// if we might make multiple attempts, swap the body for an ioutil.NopCloser
+	// cf https://github.com/containous/traefik/issues/1008
+	if retry.attempts > 1 {
+		body := r.Body
+		if body == nil {
+			body = http.NoBody
+		}
+		defer body.Close()
+		r.Body = ioutil.NopCloser(body)
+	}
+
+	attempts := 1
+	for {
+		attemptsExhausted := attempts >= retry.attempts
+
+		shouldRetry := !attemptsExhausted
+		retryResponseWriter := newRetryResponseWriter(rw, shouldRetry)
+
+		// Disable retries when the backend already received request data
+		trace := &httptrace.ClientTrace{
+			WroteHeaders: func() {
+				retryResponseWriter.DisableRetries()
+			},
+			WroteRequest: func(httptrace.WroteRequestInfo) {
+				retryResponseWriter.DisableRetries()
+			},
+		}
+		newCtx := httptrace.WithClientTrace(r.Context(), trace)
+
+		retry.next.ServeHTTP(retryResponseWriter, r.WithContext(newCtx))
+		if !retryResponseWriter.ShouldRetry() {
+			break
+		}
+
+		attempts++
+		log.Debugf("New attempt %d for request: %v", attempts, r.URL)
+		retry.listener.Retried(r, attempts)
+	}
+}
+
+// RetryListener is used to inform about retry attempts.
+type RetryListener interface {
+	// Retried will be called when a retry happens, with the request attempt passed to it.
+	// For the first retry this will be attempt 2.
+	Retried(req *http.Request, attempt int)
+}
+
+// RetryListeners is a convenience type to construct a list of RetryListener and notify
+// each of them about a retry attempt.
+type RetryListeners []RetryListener
+
+// Retried exists to implement the RetryListener interface. It calls Retried on each of its slice entries.
+func (l RetryListeners) Retried(req *http.Request, attempt int) {
+	for _, retryListener := range l {
+		retryListener.Retried(req, attempt)
+	}
+}
+
+type retryResponseWriter interface {
+	http.ResponseWriter
+	http.Flusher
+	ShouldRetry() bool
+	DisableRetries()
+}
+
+func newRetryResponseWriter(rw http.ResponseWriter, shouldRetry bool) retryResponseWriter {
+	responseWriter := &retryResponseWriterWithoutCloseNotify{
+		responseWriter: rw,
+		shouldRetry:    shouldRetry,
+	}
+	if _, ok := rw.(http.CloseNotifier); ok {
+		return &retryResponseWriterWithCloseNotify{responseWriter}
+	}
+	return responseWriter
+}
+
+type retryResponseWriterWithoutCloseNotify struct {
+	responseWriter http.ResponseWriter
+	shouldRetry    bool
+}
+
+func (rr *retryResponseWriterWithoutCloseNotify) ShouldRetry() bool {
+	return rr.shouldRetry
+}
+
+func (rr *retryResponseWriterWithoutCloseNotify) DisableRetries() {
+	rr.shouldRetry = false
+}
+
+func (rr *retryResponseWriterWithoutCloseNotify) Header() http.Header {
+	if rr.ShouldRetry() {
+		return make(http.Header)
+	}
+	return rr.responseWriter.Header()
+}
+
+func (rr *retryResponseWriterWithoutCloseNotify) Write(buf []byte) (int, error) {
+	if rr.ShouldRetry() {
+		return len(buf), nil
+	}
+	return rr.responseWriter.Write(buf)
+}
+
+func (rr *retryResponseWriterWithoutCloseNotify) WriteHeader(code int) {
+	if rr.ShouldRetry() && code == http.StatusServiceUnavailable {
+		// We get a 503 HTTP Status Code when there is no backend server in the pool
+		// to which the request could be sent.  Also, note that rr.ShouldRetry()
+		// will never return true in case there was a connection established to
+		// the backend server and so we can be sure that the 503 was produced
+		// inside Traefik already and we don't have to retry in this cases.
+		rr.DisableRetries()
+	}
+
+	if rr.ShouldRetry() {
+		return
+	}
+	rr.responseWriter.WriteHeader(code)
+}
+
+func (rr *retryResponseWriterWithoutCloseNotify) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	hijacker, ok := rr.responseWriter.(http.Hijacker)
+	if !ok {
+		return nil, nil, fmt.Errorf("%T is not a http.Hijacker", rr.responseWriter)
+	}
+	return hijacker.Hijack()
+}
+
+func (rr *retryResponseWriterWithoutCloseNotify) Flush() {
+	if flusher, ok := rr.responseWriter.(http.Flusher); ok {
+		flusher.Flush()
+	}
+}
+
+type retryResponseWriterWithCloseNotify struct {
+	*retryResponseWriterWithoutCloseNotify
+}
+
+func (rr *retryResponseWriterWithCloseNotify) CloseNotify() <-chan bool {
+	return rr.responseWriter.(http.CloseNotifier).CloseNotify()
+}

old/middlewares/retry_test.go

@@ -0,0 +1,260 @@
+package middlewares
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/containous/traefik/testhelpers"
+	"github.com/gorilla/websocket"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/vulcand/oxy/forward"
+	"github.com/vulcand/oxy/roundrobin"
+)
+
+func TestRetry(t *testing.T) {
+	testCases := []struct {
+		desc                  string
+		maxRequestAttempts    int
+		wantRetryAttempts     int
+		wantResponseStatus    int
+		amountFaultyEndpoints int
+	}{
+		{
+			desc:                  "no retry on success",
+			maxRequestAttempts:    1,
+			wantRetryAttempts:     0,
+			wantResponseStatus:    http.StatusOK,
+			amountFaultyEndpoints: 0,
+		},
+		{
+			desc:                  "no retry when max request attempts is one",
+			maxRequestAttempts:    1,
+			wantRetryAttempts:     0,
+			wantResponseStatus:    http.StatusInternalServerError,
+			amountFaultyEndpoints: 1,
+		},
+		{
+			desc:                  "one retry when one server is faulty",
+			maxRequestAttempts:    2,
+			wantRetryAttempts:     1,
+			wantResponseStatus:    http.StatusOK,
+			amountFaultyEndpoints: 1,
+		},
+		{
+			desc:                  "two retries when two servers are faulty",
+			maxRequestAttempts:    3,
+			wantRetryAttempts:     2,
+			wantResponseStatus:    http.StatusOK,
+			amountFaultyEndpoints: 2,
+		},
+		{
+			desc:                  "max attempts exhausted delivers the 5xx response",
+			maxRequestAttempts:    3,
+			wantRetryAttempts:     2,
+			wantResponseStatus:    http.StatusInternalServerError,
+			amountFaultyEndpoints: 3,
+		},
+	}
+
+	backendServer := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.WriteHeader(http.StatusOK)
+		rw.Write([]byte("OK"))
+	}))
+
+	forwarder, err := forward.New()
+	if err != nil {
+		t.Fatalf("Error creating forwarder: %s", err)
+	}
+
+	for _, test := range testCases {
+		test := test
+
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			loadBalancer, err := roundrobin.New(forwarder)
+			if err != nil {
+				t.Fatalf("Error creating load balancer: %s", err)
+			}
+
+			basePort := 33444
+			for i := 0; i < test.amountFaultyEndpoints; i++ {
+				// 192.0.2.0 is a non-routable IP for testing purposes.
+				// See: https://stackoverflow.com/questions/528538/non-routable-ip-address/18436928#18436928
+				// We only use the port specification here because the URL is used as identifier
+				// in the load balancer and using the exact same URL would not add a new server.
+				err = loadBalancer.UpsertServer(testhelpers.MustParseURL("http://192.0.2.0:" + string(basePort+i)))
+				assert.NoError(t, err)
+			}
+
+			// add the functioning server to the end of the load balancer list
+			err = loadBalancer.UpsertServer(testhelpers.MustParseURL(backendServer.URL))
+			assert.NoError(t, err)
+
+			retryListener := &countingRetryListener{}
+			retry := NewRetry(test.maxRequestAttempts, loadBalancer, retryListener)
+
+			recorder := httptest.NewRecorder()
+			req := httptest.NewRequest(http.MethodGet, "http://localhost:3000/ok", nil)
+
+			retry.ServeHTTP(recorder, req)
+
+			assert.Equal(t, test.wantResponseStatus, recorder.Code)
+			assert.Equal(t, test.wantRetryAttempts, retryListener.timesCalled)
+		})
+	}
+}
+
+func TestRetryWebsocket(t *testing.T) {
+	testCases := []struct {
+		desc                   string
+		maxRequestAttempts     int
+		expectedRetryAttempts  int
+		expectedResponseStatus int
+		expectedError          bool
+		amountFaultyEndpoints  int
+	}{
+		{
+			desc:                   "Switching ok after 2 retries",
+			maxRequestAttempts:     3,
+			expectedRetryAttempts:  2,
+			amountFaultyEndpoints:  2,
+			expectedResponseStatus: http.StatusSwitchingProtocols,
+		},
+		{
+			desc:                   "Switching failed",
+			maxRequestAttempts:     2,
+			expectedRetryAttempts:  1,
+			amountFaultyEndpoints:  2,
+			expectedResponseStatus: http.StatusBadGateway,
+			expectedError:          true,
+		},
+	}
+
+	forwarder, err := forward.New()
+	if err != nil {
+		t.Fatalf("Error creating forwarder: %s", err)
+	}
+
+	backendServer := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		upgrader := websocket.Upgrader{}
+		upgrader.Upgrade(rw, req, nil)
+	}))
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			loadBalancer, err := roundrobin.New(forwarder)
+			if err != nil {
+				t.Fatalf("Error creating load balancer: %s", err)
+			}
+
+			basePort := 33444
+			for i := 0; i < test.amountFaultyEndpoints; i++ {
+				// 192.0.2.0 is a non-routable IP for testing purposes.
+				// See: https://stackoverflow.com/questions/528538/non-routable-ip-address/18436928#18436928
+				// We only use the port specification here because the URL is used as identifier
+				// in the load balancer and using the exact same URL would not add a new server.
+				loadBalancer.UpsertServer(testhelpers.MustParseURL("http://192.0.2.0:" + string(basePort+i)))
+			}
+
+			// add the functioning server to the end of the load balancer list
+			loadBalancer.UpsertServer(testhelpers.MustParseURL(backendServer.URL))
+
+			retryListener := &countingRetryListener{}
+			retry := NewRetry(test.maxRequestAttempts, loadBalancer, retryListener)
+
+			retryServer := httptest.NewServer(retry)
+
+			url := strings.Replace(retryServer.URL, "http", "ws", 1)
+			_, response, err := websocket.DefaultDialer.Dial(url, nil)
+
+			if !test.expectedError {
+				require.NoError(t, err)
+			}
+
+			assert.Equal(t, test.expectedResponseStatus, response.StatusCode)
+			assert.Equal(t, test.expectedRetryAttempts, retryListener.timesCalled)
+		})
+	}
+}
+
+func TestRetryEmptyServerList(t *testing.T) {
+	forwarder, err := forward.New()
+	if err != nil {
+		t.Fatalf("Error creating forwarder: %s", err)
+	}
+
+	loadBalancer, err := roundrobin.New(forwarder)
+	if err != nil {
+		t.Fatalf("Error creating load balancer: %s", err)
+	}
+
+	// The EmptyBackendHandler middleware ensures that there is a 503
+	// response status set when there is no backend server in the pool.
+	next := NewEmptyBackendHandler(loadBalancer)
+
+	retryListener := &countingRetryListener{}
+	retry := NewRetry(3, next, retryListener)
+
+	recorder := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "http://localhost:3000/ok", nil)
+
+	retry.ServeHTTP(recorder, req)
+
+	const wantResponseStatus = http.StatusServiceUnavailable
+	if wantResponseStatus != recorder.Code {
+		t.Errorf("got status code %d, want %d", recorder.Code, wantResponseStatus)
+	}
+	const wantRetryAttempts = 0
+	if wantRetryAttempts != retryListener.timesCalled {
+		t.Errorf("retry listener called %d time(s), want %d time(s)", retryListener.timesCalled, wantRetryAttempts)
+	}
+}
+
+func TestRetryListeners(t *testing.T) {
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	retryListeners := RetryListeners{&countingRetryListener{}, &countingRetryListener{}}
+
+	retryListeners.Retried(req, 1)
+	retryListeners.Retried(req, 1)
+
+	for _, retryListener := range retryListeners {
+		listener := retryListener.(*countingRetryListener)
+		if listener.timesCalled != 2 {
+			t.Errorf("retry listener was called %d time(s), want %d time(s)", listener.timesCalled, 2)
+		}
+	}
+}
+
+// countingRetryListener is a RetryListener implementation to count the times the Retried fn is called.
+type countingRetryListener struct {
+	timesCalled int
+}
+
+func (l *countingRetryListener) Retried(req *http.Request, attempt int) {
+	l.timesCalled++
+}
+
+func TestRetryWithFlush(t *testing.T) {
+	next := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.WriteHeader(200)
+		rw.Write([]byte("FULL "))
+		rw.(http.Flusher).Flush()
+		rw.Write([]byte("DATA"))
+	})
+
+	retry := NewRetry(1, next, &countingRetryListener{})
+	responseRecorder := httptest.NewRecorder()
+
+	retry.ServeHTTP(responseRecorder, &http.Request{})
+
+	if responseRecorder.Body.String() != "FULL DATA" {
+		t.Errorf("Wrong body %q want %q", responseRecorder.Body.String(), "FULL DATA")
+	}
+}

old/middlewares/routes.go

@@ -0,0 +1,28 @@
+package middlewares
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+
+	"github.com/containous/mux"
+)
+
+// Routes holds the gorilla mux routes (for the API & co).
+type Routes struct {
+	router *mux.Router
+}
+
+// NewRoutes return a Routes based on the given router.
+func NewRoutes(router *mux.Router) *Routes {
+	return &Routes{router}
+}
+
+func (router *Routes) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	routeMatch := mux.RouteMatch{}
+	if router.router.Match(r, &routeMatch) {
+		rt, _ := json.Marshal(routeMatch.Handler)
+		log.Println("Request match route ", rt)
+	}
+	next(rw, r)
+}

old/middlewares/secure.go

@@ -0,0 +1,36 @@
+package middlewares
+
+import (
+	"github.com/containous/traefik/old/types"
+	"github.com/unrolled/secure"
+)
+
+// NewSecure constructs a new Secure instance with supplied options.
+func NewSecure(headers *types.Headers) *secure.Secure {
+	if headers == nil || !headers.HasSecureHeadersDefined() {
+		return nil
+	}
+
+	opt := secure.Options{
+		AllowedHosts:            headers.AllowedHosts,
+		HostsProxyHeaders:       headers.HostsProxyHeaders,
+		SSLRedirect:             headers.SSLRedirect,
+		SSLTemporaryRedirect:    headers.SSLTemporaryRedirect,
+		SSLHost:                 headers.SSLHost,
+		SSLProxyHeaders:         headers.SSLProxyHeaders,
+		STSSeconds:              headers.STSSeconds,
+		STSIncludeSubdomains:    headers.STSIncludeSubdomains,
+		STSPreload:              headers.STSPreload,
+		ForceSTSHeader:          headers.ForceSTSHeader,
+		FrameDeny:               headers.FrameDeny,
+		CustomFrameOptionsValue: headers.CustomFrameOptionsValue,
+		ContentTypeNosniff:      headers.ContentTypeNosniff,
+		BrowserXssFilter:        headers.BrowserXSSFilter,
+		CustomBrowserXssValue:   headers.CustomBrowserXSSValue,
+		ContentSecurityPolicy:   headers.ContentSecurityPolicy,
+		PublicKey:               headers.PublicKey,
+		ReferrerPolicy:          headers.ReferrerPolicy,
+		IsDevelopment:           headers.IsDevelopment,
+	}
+	return secure.New(opt)
+}

old/middlewares/stateful.go

@@ -0,0 +1,12 @@
+package middlewares
+
+import "net/http"
+
+// Stateful interface groups all http interfaces that must be
+// implemented by a stateful middleware (ie: recorders)
+type Stateful interface {
+	http.ResponseWriter
+	http.Hijacker
+	http.Flusher
+	http.CloseNotifier
+}

old/middlewares/stats.go

@@ -0,0 +1,115 @@
+package middlewares
+
+import (
+	"bufio"
+	"net"
+	"net/http"
+	"sync"
+	"time"
+)
+
+var (
+	_ Stateful = &responseRecorder{}
+)
+
+// StatsRecorder is an optional middleware that records more details statistics
+// about requests and how they are processed. This currently consists of recent
+// requests that have caused errors (4xx and 5xx status codes), making it easy
+// to pinpoint problems.
+type StatsRecorder struct {
+	mutex           sync.RWMutex
+	numRecentErrors int
+	recentErrors    []*statsError
+}
+
+// NewStatsRecorder returns a new StatsRecorder
+func NewStatsRecorder(numRecentErrors int) *StatsRecorder {
+	return &StatsRecorder{
+		numRecentErrors: numRecentErrors,
+	}
+}
+
+// Stats includes all of the stats gathered by the recorder.
+type Stats struct {
+	RecentErrors []*statsError `json:"recent_errors"`
+}
+
+// statsError represents an error that has occurred during request processing.
+type statsError struct {
+	StatusCode int       `json:"status_code"`
+	Status     string    `json:"status"`
+	Method     string    `json:"method"`
+	Host       string    `json:"host"`
+	Path       string    `json:"path"`
+	Time       time.Time `json:"time"`
+}
+
+// responseRecorder captures information from the response and preserves it for
+// later analysis.
+type responseRecorder struct {
+	http.ResponseWriter
+	statusCode int
+}
+
+// WriteHeader captures the status code for later retrieval.
+func (r *responseRecorder) WriteHeader(status int) {
+	r.ResponseWriter.WriteHeader(status)
+	r.statusCode = status
+}
+
+// Hijack hijacks the connection
+func (r *responseRecorder) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	return r.ResponseWriter.(http.Hijacker).Hijack()
+}
+
+// CloseNotify returns a channel that receives at most a
+// single value (true) when the client connection has gone
+// away.
+func (r *responseRecorder) CloseNotify() <-chan bool {
+	return r.ResponseWriter.(http.CloseNotifier).CloseNotify()
+}
+
+// Flush sends any buffered data to the client.
+func (r *responseRecorder) Flush() {
+	r.ResponseWriter.(http.Flusher).Flush()
+}
+
+// ServeHTTP silently extracts information from the request and response as it
+// is processed. If the response is 4xx or 5xx, add it to the list of 10 most
+// recent errors.
+func (s *StatsRecorder) ServeHTTP(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	recorder := &responseRecorder{w, http.StatusOK}
+	next(recorder, r)
+	if recorder.statusCode >= http.StatusBadRequest {
+		s.mutex.Lock()
+		defer s.mutex.Unlock()
+		s.recentErrors = append([]*statsError{
+			{
+				StatusCode: recorder.statusCode,
+				Status:     http.StatusText(recorder.statusCode),
+				Method:     r.Method,
+				Host:       r.Host,
+				Path:       r.URL.Path,
+				Time:       time.Now(),
+			},
+		}, s.recentErrors...)
+		// Limit the size of the list to numRecentErrors
+		if len(s.recentErrors) > s.numRecentErrors {
+			s.recentErrors = s.recentErrors[:s.numRecentErrors]
+		}
+	}
+}
+
+// Data returns a copy of the statistics that have been gathered.
+func (s *StatsRecorder) Data() *Stats {
+	s.mutex.RLock()
+	defer s.mutex.RUnlock()
+
+	// We can't return the slice directly or a race condition might develop
+	recentErrors := make([]*statsError, len(s.recentErrors))
+	copy(recentErrors, s.recentErrors)
+
+	return &Stats{
+		RecentErrors: recentErrors,
+	}
+}

old/middlewares/stripPrefix.go

@@ -0,0 +1,56 @@
+package middlewares
+
+import (
+	"context"
+	"net/http"
+	"strings"
+)
+
+const (
+	// StripPrefixKey is the key within the request context used to
+	// store the stripped prefix
+	StripPrefixKey key = "StripPrefix"
+	// ForwardedPrefixHeader is the default header to set prefix
+	ForwardedPrefixHeader = "X-Forwarded-Prefix"
+)
+
+// StripPrefix is a middleware used to strip prefix from an URL request
+type StripPrefix struct {
+	Handler  http.Handler
+	Prefixes []string
+}
+
+func (s *StripPrefix) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	for _, prefix := range s.Prefixes {
+		if strings.HasPrefix(r.URL.Path, prefix) {
+			rawReqPath := r.URL.Path
+			r.URL.Path = stripPrefix(r.URL.Path, prefix)
+			if r.URL.RawPath != "" {
+				r.URL.RawPath = stripPrefix(r.URL.RawPath, prefix)
+			}
+			s.serveRequest(w, r, strings.TrimSpace(prefix), rawReqPath)
+			return
+		}
+	}
+	http.NotFound(w, r)
+}
+
+func (s *StripPrefix) serveRequest(w http.ResponseWriter, r *http.Request, prefix string, rawReqPath string) {
+	r = r.WithContext(context.WithValue(r.Context(), StripPrefixKey, rawReqPath))
+	r.Header.Add(ForwardedPrefixHeader, prefix)
+	r.RequestURI = r.URL.RequestURI()
+	s.Handler.ServeHTTP(w, r)
+}
+
+// SetHandler sets handler
+func (s *StripPrefix) SetHandler(Handler http.Handler) {
+	s.Handler = Handler
+}
+
+func stripPrefix(s, prefix string) string {
+	return ensureLeadingSlash(strings.TrimPrefix(s, prefix))
+}
+
+func ensureLeadingSlash(str string) string {
+	return "/" + strings.TrimPrefix(str, "/")
+}

old/middlewares/stripPrefixRegex.go

@@ -0,0 +1,59 @@
+package middlewares
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/containous/mux"
+	"github.com/containous/traefik/old/log"
+)
+
+// StripPrefixRegex is a middleware used to strip prefix from an URL request
+type StripPrefixRegex struct {
+	Handler http.Handler
+	router  *mux.Router
+}
+
+// NewStripPrefixRegex builds a new StripPrefixRegex given a handler and prefixes
+func NewStripPrefixRegex(handler http.Handler, prefixes []string) *StripPrefixRegex {
+	stripPrefix := StripPrefixRegex{Handler: handler, router: mux.NewRouter()}
+
+	for _, prefix := range prefixes {
+		stripPrefix.router.PathPrefix(prefix)
+	}
+
+	return &stripPrefix
+}
+
+func (s *StripPrefixRegex) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	var match mux.RouteMatch
+	if s.router.Match(r, &match) {
+		params := make([]string, 0, len(match.Vars)*2)
+		for key, val := range match.Vars {
+			params = append(params, key)
+			params = append(params, val)
+		}
+
+		prefix, err := match.Route.URL(params...)
+		if err != nil || len(prefix.Path) > len(r.URL.Path) {
+			log.Error("Error in stripPrefix middleware", err)
+			return
+		}
+		rawReqPath := r.URL.Path
+		r.URL.Path = r.URL.Path[len(prefix.Path):]
+		if r.URL.RawPath != "" {
+			r.URL.RawPath = r.URL.RawPath[len(prefix.Path):]
+		}
+		r = r.WithContext(context.WithValue(r.Context(), StripPrefixKey, rawReqPath))
+		r.Header.Add(ForwardedPrefixHeader, prefix.Path)
+		r.RequestURI = ensureLeadingSlash(r.URL.RequestURI())
+		s.Handler.ServeHTTP(w, r)
+		return
+	}
+	http.NotFound(w, r)
+}
+
+// SetHandler sets handler
+func (s *StripPrefixRegex) SetHandler(Handler http.Handler) {
+	s.Handler = Handler
+}

old/middlewares/stripPrefixRegex_test.go

@@ -0,0 +1,97 @@
+package middlewares
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/containous/traefik/testhelpers"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStripPrefixRegex(t *testing.T) {
+	testPrefixRegex := []string{"/a/api/", "/b/{regex}/", "/c/{category}/{id:[0-9]+}/"}
+
+	tests := []struct {
+		path               string
+		expectedStatusCode int
+		expectedPath       string
+		expectedRawPath    string
+		expectedHeader     string
+	}{
+		{
+			path:               "/a/test",
+			expectedStatusCode: http.StatusNotFound,
+		},
+		{
+			path:               "/a/api/test",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "test",
+			expectedHeader:     "/a/api/",
+		},
+		{
+			path:               "/b/api/",
+			expectedStatusCode: http.StatusOK,
+			expectedHeader:     "/b/api/",
+		},
+		{
+			path:               "/b/api/test1",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "test1",
+			expectedHeader:     "/b/api/",
+		},
+		{
+			path:               "/b/api2/test2",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "test2",
+			expectedHeader:     "/b/api2/",
+		},
+		{
+			path:               "/c/api/123/",
+			expectedStatusCode: http.StatusOK,
+			expectedHeader:     "/c/api/123/",
+		},
+		{
+			path:               "/c/api/123/test3",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "test3",
+			expectedHeader:     "/c/api/123/",
+		},
+		{
+			path:               "/c/api/abc/test4",
+			expectedStatusCode: http.StatusNotFound,
+		},
+		{
+			path:               "/a/api/a%2Fb",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "a/b",
+			expectedRawPath:    "a%2Fb",
+			expectedHeader:     "/a/api/",
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.path, func(t *testing.T) {
+			t.Parallel()
+
+			var actualPath, actualRawPath, actualHeader string
+			handlerPath := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				actualPath = r.URL.Path
+				actualRawPath = r.URL.RawPath
+				actualHeader = r.Header.Get(ForwardedPrefixHeader)
+			})
+			handler := NewStripPrefixRegex(handlerPath, testPrefixRegex)
+
+			req := testhelpers.MustNewRequest(http.MethodGet, "http://localhost"+test.path, nil)
+			resp := &httptest.ResponseRecorder{Code: http.StatusOK}
+
+			handler.ServeHTTP(resp, req)
+
+			assert.Equal(t, test.expectedStatusCode, resp.Code, "Unexpected status code.")
+			assert.Equal(t, test.expectedPath, actualPath, "Unexpected path.")
+			assert.Equal(t, test.expectedRawPath, actualRawPath, "Unexpected raw path.")
+			assert.Equal(t, test.expectedHeader, actualHeader, "Unexpected '%s' header.", ForwardedPrefixHeader)
+		})
+	}
+}

old/middlewares/stripPrefix_test.go

@@ -0,0 +1,143 @@
+package middlewares
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/containous/traefik/testhelpers"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStripPrefix(t *testing.T) {
+	tests := []struct {
+		desc               string
+		prefixes           []string
+		path               string
+		expectedStatusCode int
+		expectedPath       string
+		expectedRawPath    string
+		expectedHeader     string
+	}{
+		{
+			desc:               "no prefixes configured",
+			prefixes:           []string{},
+			path:               "/noprefixes",
+			expectedStatusCode: http.StatusNotFound,
+		},
+		{
+			desc:               "wildcard (.*) requests",
+			prefixes:           []string{"/"},
+			path:               "/",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "/",
+			expectedHeader:     "/",
+		},
+		{
+			desc:               "prefix and path matching",
+			prefixes:           []string{"/stat"},
+			path:               "/stat",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "/",
+			expectedHeader:     "/stat",
+		},
+		{
+			desc:               "path prefix on exactly matching path",
+			prefixes:           []string{"/stat/"},
+			path:               "/stat/",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "/",
+			expectedHeader:     "/stat/",
+		},
+		{
+			desc:               "path prefix on matching longer path",
+			prefixes:           []string{"/stat/"},
+			path:               "/stat/us",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "/us",
+			expectedHeader:     "/stat/",
+		},
+		{
+			desc:               "path prefix on mismatching path",
+			prefixes:           []string{"/stat/"},
+			path:               "/status",
+			expectedStatusCode: http.StatusNotFound,
+		},
+		{
+			desc:               "general prefix on matching path",
+			prefixes:           []string{"/stat"},
+			path:               "/stat/",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "/",
+			expectedHeader:     "/stat",
+		},
+		{
+			desc:               "earlier prefix matching",
+			prefixes:           []string{"/stat", "/stat/us"},
+			path:               "/stat/us",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "/us",
+			expectedHeader:     "/stat",
+		},
+		{
+			desc:               "later prefix matching",
+			prefixes:           []string{"/mismatch", "/stat"},
+			path:               "/stat",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "/",
+			expectedHeader:     "/stat",
+		},
+		{
+			desc:               "prefix matching within slash boundaries",
+			prefixes:           []string{"/stat"},
+			path:               "/status",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "/us",
+			expectedHeader:     "/stat",
+		},
+		{
+			desc:               "raw path is also stripped",
+			prefixes:           []string{"/stat"},
+			path:               "/stat/a%2Fb",
+			expectedStatusCode: http.StatusOK,
+			expectedPath:       "/a/b",
+			expectedRawPath:    "/a%2Fb",
+			expectedHeader:     "/stat",
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			var actualPath, actualRawPath, actualHeader, requestURI string
+			handler := &StripPrefix{
+				Prefixes: test.prefixes,
+				Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					actualPath = r.URL.Path
+					actualRawPath = r.URL.RawPath
+					actualHeader = r.Header.Get(ForwardedPrefixHeader)
+					requestURI = r.RequestURI
+				}),
+			}
+
+			req := testhelpers.MustNewRequest(http.MethodGet, "http://localhost"+test.path, nil)
+			resp := &httptest.ResponseRecorder{Code: http.StatusOK}
+
+			handler.ServeHTTP(resp, req)
+
+			assert.Equal(t, test.expectedStatusCode, resp.Code, "Unexpected status code.")
+			assert.Equal(t, test.expectedPath, actualPath, "Unexpected path.")
+			assert.Equal(t, test.expectedRawPath, actualRawPath, "Unexpected raw path.")
+			assert.Equal(t, test.expectedHeader, actualHeader, "Unexpected '%s' header.", ForwardedPrefixHeader)
+
+			expectedURI := test.expectedPath
+			if test.expectedRawPath != "" {
+				// go HTTP uses the raw path when existent in the RequestURI
+				expectedURI = test.expectedRawPath
+			}
+			assert.Equal(t, expectedURI, requestURI, "Unexpected request URI.")
+		})
+	}
+}

old/middlewares/tlsClientHeaders.go

@@ -0,0 +1,251 @@
+package middlewares
+
+import (
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/containous/traefik/old/types"
+)
+
+const xForwardedTLSClientCert = "X-Forwarded-Tls-Client-Cert"
+const xForwardedTLSClientCertInfos = "X-Forwarded-Tls-Client-Cert-Infos"
+
+// TLSClientCertificateInfos is a struct for specifying the configuration for the tlsClientHeaders middleware.
+type TLSClientCertificateInfos struct {
+	NotAfter  bool
+	NotBefore bool
+	Subject   *TLSCLientCertificateSubjectInfos
+	Sans      bool
+}
+
+// TLSCLientCertificateSubjectInfos contains the configuration for the certificate subject infos.
+type TLSCLientCertificateSubjectInfos struct {
+	Country      bool
+	Province     bool
+	Locality     bool
+	Organization bool
+	CommonName   bool
+	SerialNumber bool
+}
+
+// TLSClientHeaders is a middleware that helps setup a few tls infos features.
+type TLSClientHeaders struct {
+	PEM   bool                       // pass the sanitized pem to the backend in a specific header
+	Infos *TLSClientCertificateInfos // pass selected informations from the client certificate
+}
+
+func newTLSCLientCertificateSubjectInfos(infos *types.TLSCLientCertificateSubjectInfos) *TLSCLientCertificateSubjectInfos {
+	if infos == nil {
+		return nil
+	}
+
+	return &TLSCLientCertificateSubjectInfos{
+		SerialNumber: infos.SerialNumber,
+		CommonName:   infos.CommonName,
+		Country:      infos.Country,
+		Locality:     infos.Locality,
+		Organization: infos.Organization,
+		Province:     infos.Province,
+	}
+}
+
+func newTLSClientInfos(infos *types.TLSClientCertificateInfos) *TLSClientCertificateInfos {
+	if infos == nil {
+		return nil
+	}
+
+	return &TLSClientCertificateInfos{
+		NotBefore: infos.NotBefore,
+		NotAfter:  infos.NotAfter,
+		Sans:      infos.Sans,
+		Subject:   newTLSCLientCertificateSubjectInfos(infos.Subject),
+	}
+}
+
+// NewTLSClientHeaders constructs a new TLSClientHeaders instance from supplied frontend header struct.
+func NewTLSClientHeaders(frontend *types.Frontend) *TLSClientHeaders {
+	if frontend == nil {
+		return nil
+	}
+
+	var pem bool
+	var infos *TLSClientCertificateInfos
+
+	if frontend.PassTLSClientCert != nil {
+		conf := frontend.PassTLSClientCert
+		pem = conf.PEM
+		infos = newTLSClientInfos(conf.Infos)
+	}
+
+	return &TLSClientHeaders{
+		PEM:   pem,
+		Infos: infos,
+	}
+}
+
+func (s *TLSClientHeaders) ServeHTTP(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	s.ModifyRequestHeaders(r)
+	// If there is a next, call it.
+	if next != nil {
+		next(w, r)
+	}
+}
+
+// sanitize As we pass the raw certificates, remove the useless data and make it http request compliant
+func sanitize(cert []byte) string {
+	s := string(cert)
+	r := strings.NewReplacer("-----BEGIN CERTIFICATE-----", "",
+		"-----END CERTIFICATE-----", "",
+		"\n", "")
+	cleaned := r.Replace(s)
+
+	return url.QueryEscape(cleaned)
+}
+
+// extractCertificate extract the certificate from the request
+func extractCertificate(cert *x509.Certificate) string {
+	b := pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw}
+	certPEM := pem.EncodeToMemory(&b)
+	if certPEM == nil {
+		log.Error("Cannot extract the certificate content")
+		return ""
+	}
+	return sanitize(certPEM)
+}
+
+// getXForwardedTLSClientCert Build a string with the client certificates
+func getXForwardedTLSClientCert(certs []*x509.Certificate) string {
+	var headerValues []string
+
+	for _, peerCert := range certs {
+		headerValues = append(headerValues, extractCertificate(peerCert))
+	}
+
+	return strings.Join(headerValues, ",")
+}
+
+// getSANs get the Subject Alternate Name values
+func getSANs(cert *x509.Certificate) []string {
+	var sans []string
+	if cert == nil {
+		return sans
+	}
+
+	sans = append(cert.DNSNames, cert.EmailAddresses...)
+
+	var ips []string
+	for _, ip := range cert.IPAddresses {
+		ips = append(ips, ip.String())
+	}
+	sans = append(sans, ips...)
+
+	var uris []string
+	for _, uri := range cert.URIs {
+		uris = append(uris, uri.String())
+	}
+
+	return append(sans, uris...)
+}
+
+// getSubjectInfos extract the requested informations from the certificate subject
+func (s *TLSClientHeaders) getSubjectInfos(cs *pkix.Name) string {
+	var subject string
+
+	if s.Infos != nil && s.Infos.Subject != nil {
+		options := s.Infos.Subject
+
+		var content []string
+
+		if options.Country && len(cs.Country) > 0 {
+			content = append(content, fmt.Sprintf("C=%s", cs.Country[0]))
+		}
+
+		if options.Province && len(cs.Province) > 0 {
+			content = append(content, fmt.Sprintf("ST=%s", cs.Province[0]))
+		}
+
+		if options.Locality && len(cs.Locality) > 0 {
+			content = append(content, fmt.Sprintf("L=%s", cs.Locality[0]))
+		}
+
+		if options.Organization && len(cs.Organization) > 0 {
+			content = append(content, fmt.Sprintf("O=%s", cs.Organization[0]))
+		}
+
+		if options.CommonName && len(cs.CommonName) > 0 {
+			content = append(content, fmt.Sprintf("CN=%s", cs.CommonName))
+		}
+
+		if len(content) > 0 {
+			subject = `Subject="` + strings.Join(content, ",") + `"`
+		}
+	}
+
+	return subject
+}
+
+// getXForwardedTLSClientCertInfos Build a string with the wanted client certificates informations
+// like Subject="C=%s,ST=%s,L=%s,O=%s,CN=%s",NB=%d,NA=%d,SAN=%s;
+func (s *TLSClientHeaders) getXForwardedTLSClientCertInfos(certs []*x509.Certificate) string {
+	var headerValues []string
+
+	for _, peerCert := range certs {
+		var values []string
+		var sans string
+		var nb string
+		var na string
+
+		subject := s.getSubjectInfos(&peerCert.Subject)
+		if len(subject) > 0 {
+			values = append(values, subject)
+		}
+
+		ci := s.Infos
+		if ci != nil {
+			if ci.NotBefore {
+				nb = fmt.Sprintf("NB=%d", uint64(peerCert.NotBefore.Unix()))
+				values = append(values, nb)
+			}
+			if ci.NotAfter {
+				na = fmt.Sprintf("NA=%d", uint64(peerCert.NotAfter.Unix()))
+				values = append(values, na)
+			}
+
+			if ci.Sans {
+				sans = fmt.Sprintf("SAN=%s", strings.Join(getSANs(peerCert), ","))
+				values = append(values, sans)
+			}
+		}
+
+		value := strings.Join(values, ",")
+		headerValues = append(headerValues, value)
+	}
+
+	return strings.Join(headerValues, ";")
+}
+
+// ModifyRequestHeaders set the wanted headers with the certificates informations
+func (s *TLSClientHeaders) ModifyRequestHeaders(r *http.Request) {
+	if s.PEM {
+		if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
+			r.Header.Set(xForwardedTLSClientCert, getXForwardedTLSClientCert(r.TLS.PeerCertificates))
+		} else {
+			log.Warn("Try to extract certificate on a request without TLS")
+		}
+	}
+
+	if s.Infos != nil {
+		if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
+			headerContent := s.getXForwardedTLSClientCertInfos(r.TLS.PeerCertificates)
+			r.Header.Set(xForwardedTLSClientCertInfos, url.QueryEscape(headerContent))
+		} else {
+			log.Warn("Try to extract certificate on a request without TLS")
+		}
+	}
+}

old/middlewares/tlsClientHeaders_test.go

@@ -0,0 +1,799 @@
+package middlewares
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/containous/traefik/old/types"
+	"github.com/containous/traefik/testhelpers"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	rootCrt = `-----BEGIN CERTIFICATE-----
+MIIDhjCCAm6gAwIBAgIJAIKZlW9a3VrYMA0GCSqGSIb3DQEBCwUAMFgxCzAJBgNV
+BAYTAkZSMRMwEQYDVQQIDApTb21lLVN0YXRlMREwDwYDVQQHDAhUb3Vsb3VzZTEh
+MB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMB4XDTE4MDcxNzIwMzQz
+OFoXDTE4MDgxNjIwMzQzOFowWDELMAkGA1UEBhMCRlIxEzARBgNVBAgMClNvbWUt
+U3RhdGUxETAPBgNVBAcMCFRvdWxvdXNlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRn
+aXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC1P8GJ
+H9LkIxIIqK9MyUpushnjmjwccpSMB3OecISKYLy62QDIcAw6NzGcSe8hMwciMJr+
+CdCjJlohybnaRI9hrJ3GPnI++UT/MMthf2IIcjmJxmD4k9L1fgs1V6zSTlo0+o0x
+0gkAGlWvRkgA+3nt555ee84XQZuneKKeRRIlSA1ygycewFobZ/pGYijIEko+gYkV
+sF3LnRGxNl673w+EQsvI7+z29T1nzjmM/xE7WlvnsrVd1/N61jAohLota0YTufwd
+ioJZNryzuPejHBCiQRGMbJ7uEEZLiSCN6QiZEfqhS3AulykjgFXQQHn4zoVljSBR
+UyLV0prIn5Scbks/AgMBAAGjUzBRMB0GA1UdDgQWBBTroRRnSgtkV+8dumtcftb/
+lwIkATAfBgNVHSMEGDAWgBTroRRnSgtkV+8dumtcftb/lwIkATAPBgNVHRMBAf8E
+BTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAJ67U5cLa0ZFa/7zQQT4ldkY6YOEgR
+0LNoTu51hc+ozaXSvF8YIBzkEpEnbGS3x4xodrwEBZjK2LFhNu/33gkCAuhmedgk
+KwZrQM6lqRFGHGVOlkVz+QrJ2EsKYaO4SCUIwVjijXRLA7A30G5C/CIh66PsMgBY
+6QHXVPEWm/v1d1Q/DfFfFzSOa1n1rIUw03qVJsxqSwfwYcegOF8YvS/eH4HUr2gF
+cEujh6CCnylf35ExHa45atr3+xxbOVdNjobISkYADtbhAAn4KjLS4v8W6445vxxj
+G5EIZLjOHyWg1sGaHaaAPkVpZQg8EKm21c4hrEEMfel60AMSSzad/a/V
+-----END CERTIFICATE-----`
+
+	minimalCert = `-----BEGIN CERTIFICATE-----
+MIIDGTCCAgECCQCqLd75YLi2kDANBgkqhkiG9w0BAQsFADBYMQswCQYDVQQGEwJG
+UjETMBEGA1UECAwKU29tZS1TdGF0ZTERMA8GA1UEBwwIVG91bG91c2UxITAfBgNV
+BAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODA3MTgwODI4MTZaFw0x
+ODA4MTcwODI4MTZaMEUxCzAJBgNVBAYTAkZSMRMwEQYDVQQIDApTb21lLVN0YXRl
+MSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQC/+frDMMTLQyXG34F68BPhQq0kzK4LIq9Y0/gl
+FjySZNn1C0QDWA1ubVCAcA6yY204I9cxcQDPNrhC7JlS5QA8Y5rhIBrqQlzZizAi
+Rj3NTrRjtGUtOScnHuJaWjLy03DWD+aMwb7q718xt5SEABmmUvLwQK+EjW2MeDwj
+y8/UEIpvrRDmdhGaqv7IFpIDkcIF7FowJ/hwDvx3PMc+z/JWK0ovzpvgbx69AVbw
+ZxCimeha65rOqVi+lEetD26le+WnOdYsdJ2IkmpPNTXGdfb15xuAc+gFXfMCh7Iw
+3Ynl6dZtZM/Ok2kiA7/OsmVnRKkWrtBfGYkI9HcNGb3zrk6nAgMBAAEwDQYJKoZI
+hvcNAQELBQADggEBAC/R+Yvhh1VUhcbK49olWsk/JKqfS3VIDQYZg1Eo+JCPbwgS
+I1BSYVfMcGzuJTX6ua3m/AHzGF3Tap4GhF4tX12jeIx4R4utnjj7/YKkTvuEM2f4
+xT56YqI7zalGScIB0iMeyNz1QcimRl+M/49au8ow9hNX8C2tcA2cwd/9OIj/6T8q
+SBRHc6ojvbqZSJCO0jziGDT1L3D+EDgTjED4nd77v/NRdP+egb0q3P0s4dnQ/5AV
+aQlQADUn61j3ScbGJ4NSeZFFvsl38jeRi/MEzp0bGgNBcPj6JHi7qbbauZcZfQ05
+jECvgAY7Nfd9mZ1KtyNaW31is+kag7NsvjxU/kM=
+-----END CERTIFICATE-----`
+
+	completeCert = `Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=FR, ST=Some-State, L=Toulouse, O=Internet Widgits Pty Ltd
+        Validity
+            Not Before: Jul 18 08:00:16 2018 GMT
+            Not After : Jul 18 08:00:16 2019 GMT
+        Subject: C=FR, ST=SomeState, L=Toulouse, O=Cheese, CN=*.cheese.org
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a6:1f:96:7c:c1:cc:b8:1c:b5:91:5d:b8:bf:70:
+                    bc:f7:b8:04:4f:2a:42:de:ea:c5:c3:19:0b:03:04:
+                    ec:ef:a1:24:25:de:ad:05:e7:26:ea:89:6c:59:60:
+                    10:18:0c:73:f1:bf:d3:cc:7b:ed:6b:9c:ea:1d:88:
+                    e2:ee:14:81:d7:07:ee:87:95:3d:36:df:9c:38:b7:
+                    7b:1e:2b:51:9c:4a:1f:d0:cc:5b:af:5d:6c:5c:35:
+                    49:32:e4:01:5b:f9:8c:71:cf:62:48:5a:ea:b7:31:
+                    58:e2:c6:d0:5b:1c:50:b5:5c:6d:5a:6f:da:41:5e:
+                    d5:4c:6e:1a:21:f3:40:f9:9e:52:76:50:25:3e:03:
+                    9b:87:19:48:5b:47:87:d3:67:c6:25:69:77:29:8e:
+                    56:97:45:d9:6f:64:a8:4e:ad:35:75:2e:fc:6a:2e:
+                    47:87:76:fc:4e:3e:44:e9:16:b2:c7:f0:23:98:13:
+                    a2:df:15:23:cb:0c:3d:fd:48:5e:c7:2c:86:70:63:
+                    8b:c6:c8:89:17:52:d5:a7:8e:cb:4e:11:9d:69:8e:
+                    8e:59:cc:7e:a3:bd:a1:11:88:d7:cf:7b:8c:19:46:
+                    9c:1b:7a:c9:39:81:4c:58:08:1f:c7:ce:b0:0e:79:
+                    64:d3:11:72:65:e6:dd:bd:00:7f:22:30:46:9b:66:
+                    9c:b9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Subject Alternative Name: 
+                DNS:*.cheese.org, DNS:*.cheese.net, DNS:cheese.in, IP Address:10.0.1.0, IP Address:10.0.1.2, email:test@cheese.org, email:test@cheese.net
+            X509v3 Subject Key Identifier: 
+                AB:6B:89:25:11:FC:5E:7B:D4:B0:F7:D4:B6:D9:EB:D0:30:93:E5:58
+    Signature Algorithm: sha1WithRSAEncryption
+         ad:87:84:a0:88:a3:4c:d9:0a:c0:14:e4:2d:9a:1d:bb:57:b7:
+         12:ef:3a:fb:8b:b2:ce:32:b8:04:e6:59:c8:4f:14:6a:b5:12:
+         46:e9:c9:0a:11:64:ea:a1:86:20:96:0e:a7:40:e3:aa:e5:98:
+         91:36:89:77:b6:b9:73:7e:1a:58:19:ae:d1:14:83:1e:c1:5f:
+         a5:a0:32:bb:52:68:b4:8d:a3:1d:b3:08:d7:45:6e:3b:87:64:
+         7e:ef:46:e6:6f:d5:79:d7:1d:57:68:67:d8:18:39:61:5b:8b:
+         1a:7f:88:da:0a:51:9b:3d:6c:5d:b1:cf:b7:e9:1e:06:65:8e:
+         96:d3:61:96:f8:a2:61:f9:40:5e:fa:bc:76:b9:64:0e:6f:90:
+         37:de:ac:6d:7f:36:84:35:19:88:8c:26:af:3e:c3:6a:1a:03:
+         ed:d7:90:89:ed:18:4c:9e:94:1f:d8:ae:6c:61:36:17:72:f9:
+         bb:de:0a:56:9a:79:b4:7d:4a:9d:cb:4a:7d:71:9f:38:e7:8d:
+         f0:87:24:21:0a:24:1f:82:9a:6b:67:ce:7d:af:cb:91:6b:8a:
+         de:e6:d8:6f:a1:37:b9:2d:d0:cb:e8:4e:f4:43:af:ad:90:13:
+         7d:61:7a:ce:86:48:fc:00:8c:37:fb:e0:31:6b:e2:18:ad:fd:
+         1e:df:08:db
+-----BEGIN CERTIFICATE-----
+MIIDvTCCAqWgAwIBAgIBAzANBgkqhkiG9w0BAQUFADBYMQswCQYDVQQGEwJGUjET
+MBEGA1UECAwKU29tZS1TdGF0ZTERMA8GA1UEBwwIVG91bG91c2UxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODA3MTgwODAwMTZaFw0xOTA3
+MTgwODAwMTZaMFwxCzAJBgNVBAYTAkZSMRIwEAYDVQQIDAlTb21lU3RhdGUxETAP
+BgNVBAcMCFRvdWxvdXNlMQ8wDQYDVQQKDAZDaGVlc2UxFTATBgNVBAMMDCouY2hl
+ZXNlLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKYflnzBzLgc
+tZFduL9wvPe4BE8qQt7qxcMZCwME7O+hJCXerQXnJuqJbFlgEBgMc/G/08x77Wuc
+6h2I4u4UgdcH7oeVPTbfnDi3ex4rUZxKH9DMW69dbFw1STLkAVv5jHHPYkha6rcx
+WOLG0FscULVcbVpv2kFe1UxuGiHzQPmeUnZQJT4Dm4cZSFtHh9NnxiVpdymOVpdF
+2W9kqE6tNXUu/GouR4d2/E4+ROkWssfwI5gTot8VI8sMPf1IXscshnBji8bIiRdS
+1aeOy04RnWmOjlnMfqO9oRGI1897jBlGnBt6yTmBTFgIH8fOsA55ZNMRcmXm3b0A
+fyIwRptmnLkCAwEAAaOBjTCBijAJBgNVHRMEAjAAMF4GA1UdEQRXMFWCDCouY2hl
+ZXNlLm9yZ4IMKi5jaGVlc2UubmV0ggljaGVlc2UuaW6HBAoAAQCHBAoAAQKBD3Rl
+c3RAY2hlZXNlLm9yZ4EPdGVzdEBjaGVlc2UubmV0MB0GA1UdDgQWBBSra4klEfxe
+e9Sw99S22evQMJPlWDANBgkqhkiG9w0BAQUFAAOCAQEArYeEoIijTNkKwBTkLZod
+u1e3Eu86+4uyzjK4BOZZyE8UarUSRunJChFk6qGGIJYOp0DjquWYkTaJd7a5c34a
+WBmu0RSDHsFfpaAyu1JotI2jHbMI10VuO4dkfu9G5m/VedcdV2hn2Bg5YVuLGn+I
+2gpRmz1sXbHPt+keBmWOltNhlviiYflAXvq8drlkDm+QN96sbX82hDUZiIwmrz7D
+ahoD7deQie0YTJ6UH9iubGE2F3L5u94KVpp5tH1KnctKfXGfOOeN8IckIQokH4Ka
+a2fOfa/LkWuK3ubYb6E3uS3Qy+hO9EOvrZATfWF6zoZI/ACMN/vgMWviGK39Ht8I
+2w==
+-----END CERTIFICATE-----
+`
+)
+
+func getCleanCertContents(certContents []string) string {
+	var re = regexp.MustCompile("-----BEGIN CERTIFICATE-----(?s)(.*)")
+
+	var cleanedCertContent []string
+	for _, certContent := range certContents {
+		cert := re.FindString(string(certContent))
+		cleanedCertContent = append(cleanedCertContent, sanitize([]byte(cert)))
+	}
+
+	return strings.Join(cleanedCertContent, ",")
+}
+
+func getCertificate(certContent string) *x509.Certificate {
+	roots := x509.NewCertPool()
+	ok := roots.AppendCertsFromPEM([]byte(rootCrt))
+	if !ok {
+		panic("failed to parse root certificate")
+	}
+
+	block, _ := pem.Decode([]byte(certContent))
+	if block == nil {
+		panic("failed to parse certificate PEM")
+	}
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		panic("failed to parse certificate: " + err.Error())
+	}
+
+	return cert
+}
+
+func buildTLSWith(certContents []string) *tls.ConnectionState {
+	var peerCertificates []*x509.Certificate
+
+	for _, certContent := range certContents {
+		peerCertificates = append(peerCertificates, getCertificate(certContent))
+	}
+
+	return &tls.ConnectionState{PeerCertificates: peerCertificates}
+}
+
+var myPassTLSClientCustomHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	w.Write([]byte("bar"))
+})
+
+func getExpectedSanitized(s string) string {
+	return url.QueryEscape(strings.Replace(s, "\n", "", -1))
+}
+
+func TestSanitize(t *testing.T) {
+	testCases := []struct {
+		desc       string
+		toSanitize []byte
+		expected   string
+	}{
+		{
+			desc: "Empty",
+		},
+		{
+			desc:       "With a minimal cert",
+			toSanitize: []byte(minimalCert),
+			expected: getExpectedSanitized(`MIIDGTCCAgECCQCqLd75YLi2kDANBgkqhkiG9w0BAQsFADBYMQswCQYDVQQGEwJG
+UjETMBEGA1UECAwKU29tZS1TdGF0ZTERMA8GA1UEBwwIVG91bG91c2UxITAfBgNV
+BAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODA3MTgwODI4MTZaFw0x
+ODA4MTcwODI4MTZaMEUxCzAJBgNVBAYTAkZSMRMwEQYDVQQIDApTb21lLVN0YXRl
+MSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQC/+frDMMTLQyXG34F68BPhQq0kzK4LIq9Y0/gl
+FjySZNn1C0QDWA1ubVCAcA6yY204I9cxcQDPNrhC7JlS5QA8Y5rhIBrqQlzZizAi
+Rj3NTrRjtGUtOScnHuJaWjLy03DWD+aMwb7q718xt5SEABmmUvLwQK+EjW2MeDwj
+y8/UEIpvrRDmdhGaqv7IFpIDkcIF7FowJ/hwDvx3PMc+z/JWK0ovzpvgbx69AVbw
+ZxCimeha65rOqVi+lEetD26le+WnOdYsdJ2IkmpPNTXGdfb15xuAc+gFXfMCh7Iw
+3Ynl6dZtZM/Ok2kiA7/OsmVnRKkWrtBfGYkI9HcNGb3zrk6nAgMBAAEwDQYJKoZI
+hvcNAQELBQADggEBAC/R+Yvhh1VUhcbK49olWsk/JKqfS3VIDQYZg1Eo+JCPbwgS
+I1BSYVfMcGzuJTX6ua3m/AHzGF3Tap4GhF4tX12jeIx4R4utnjj7/YKkTvuEM2f4
+xT56YqI7zalGScIB0iMeyNz1QcimRl+M/49au8ow9hNX8C2tcA2cwd/9OIj/6T8q
+SBRHc6ojvbqZSJCO0jziGDT1L3D+EDgTjED4nd77v/NRdP+egb0q3P0s4dnQ/5AV
+aQlQADUn61j3ScbGJ4NSeZFFvsl38jeRi/MEzp0bGgNBcPj6JHi7qbbauZcZfQ05
+jECvgAY7Nfd9mZ1KtyNaW31is+kag7NsvjxU/kM=`),
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			require.Equal(t, test.expected, sanitize(test.toSanitize), "The sanitized certificates should be equal")
+		})
+	}
+
+}
+
+func TestTlsClientheadersWithPEM(t *testing.T) {
+	testCases := []struct {
+		desc                 string
+		certContents         []string // set the request TLS attribute if defined
+		tlsClientCertHeaders *types.TLSClientHeaders
+		expectedHeader       string
+	}{
+		{
+			desc: "No TLS, no option",
+		},
+		{
+			desc:         "TLS, no option",
+			certContents: []string{minimalCert},
+		},
+		{
+			desc:                 "No TLS, with pem option true",
+			tlsClientCertHeaders: &types.TLSClientHeaders{PEM: true},
+		},
+		{
+			desc:                 "TLS with simple certificate, with pem option true",
+			certContents:         []string{minimalCert},
+			tlsClientCertHeaders: &types.TLSClientHeaders{PEM: true},
+			expectedHeader:       getCleanCertContents([]string{minimalCert}),
+		},
+		{
+			desc:                 "TLS with complete certificate, with pem option true",
+			certContents:         []string{completeCert},
+			tlsClientCertHeaders: &types.TLSClientHeaders{PEM: true},
+			expectedHeader:       getCleanCertContents([]string{completeCert}),
+		},
+		{
+			desc:                 "TLS with two certificate, with pem option true",
+			certContents:         []string{minimalCert, completeCert},
+			tlsClientCertHeaders: &types.TLSClientHeaders{PEM: true},
+			expectedHeader:       getCleanCertContents([]string{minimalCert, completeCert}),
+		},
+	}
+
+	for _, test := range testCases {
+		tlsClientHeaders := NewTLSClientHeaders(&types.Frontend{PassTLSClientCert: test.tlsClientCertHeaders})
+
+		res := httptest.NewRecorder()
+		req := testhelpers.MustNewRequest(http.MethodGet, "http://example.com/foo", nil)
+
+		if test.certContents != nil && len(test.certContents) > 0 {
+			req.TLS = buildTLSWith(test.certContents)
+		}
+
+		tlsClientHeaders.ServeHTTP(res, req, myPassTLSClientCustomHandler)
+
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			require.Equal(t, http.StatusOK, res.Code, "Http Status should be OK")
+			require.Equal(t, "bar", res.Body.String(), "Should be the expected body")
+
+			if test.expectedHeader != "" {
+				require.Equal(t, getCleanCertContents(test.certContents), req.Header.Get(xForwardedTLSClientCert), "The request header should contain the cleaned certificate")
+			} else {
+				require.Empty(t, req.Header.Get(xForwardedTLSClientCert))
+			}
+			require.Empty(t, res.Header().Get(xForwardedTLSClientCert), "The response header should be always empty")
+		})
+	}
+
+}
+
+func TestGetSans(t *testing.T) {
+	urlFoo, err := url.Parse("my.foo.com")
+	require.NoError(t, err)
+	urlBar, err := url.Parse("my.bar.com")
+	require.NoError(t, err)
+
+	testCases := []struct {
+		desc     string
+		cert     *x509.Certificate // set the request TLS attribute if defined
+		expected []string
+	}{
+		{
+			desc: "With nil",
+		},
+		{
+			desc: "Certificate without Sans",
+			cert: &x509.Certificate{},
+		},
+		{
+			desc: "Certificate with all Sans",
+			cert: &x509.Certificate{
+				DNSNames:       []string{"foo", "bar"},
+				EmailAddresses: []string{"test@test.com", "test2@test.com"},
+				IPAddresses:    []net.IP{net.IPv4(10, 0, 0, 1), net.IPv4(10, 0, 0, 2)},
+				URIs:           []*url.URL{urlFoo, urlBar},
+			},
+			expected: []string{"foo", "bar", "test@test.com", "test2@test.com", "10.0.0.1", "10.0.0.2", urlFoo.String(), urlBar.String()},
+		},
+	}
+
+	for _, test := range testCases {
+		sans := getSANs(test.cert)
+		test := test
+
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			if len(test.expected) > 0 {
+				for i, expected := range test.expected {
+					require.Equal(t, expected, sans[i])
+				}
+			} else {
+				require.Empty(t, sans)
+			}
+		})
+	}
+
+}
+
+func TestTlsClientheadersWithCertInfos(t *testing.T) {
+	minimalCertAllInfos := `Subject="C=FR,ST=Some-State,O=Internet Widgits Pty Ltd",NB=1531902496,NA=1534494496,SAN=`
+	completeCertAllInfos := `Subject="C=FR,ST=SomeState,L=Toulouse,O=Cheese,CN=*.cheese.org",NB=1531900816,NA=1563436816,SAN=*.cheese.org,*.cheese.net,cheese.in,test@cheese.org,test@cheese.net,10.0.1.0,10.0.1.2`
+
+	testCases := []struct {
+		desc                 string
+		certContents         []string // set the request TLS attribute if defined
+		tlsClientCertHeaders *types.TLSClientHeaders
+		expectedHeader       string
+	}{
+		{
+			desc: "No TLS, no option",
+		},
+		{
+			desc:         "TLS, no option",
+			certContents: []string{minimalCert},
+		},
+		{
+			desc: "No TLS, with pem option true",
+			tlsClientCertHeaders: &types.TLSClientHeaders{
+				Infos: &types.TLSClientCertificateInfos{
+					Subject: &types.TLSCLientCertificateSubjectInfos{
+						CommonName:   true,
+						Organization: true,
+						Locality:     true,
+						Province:     true,
+						Country:      true,
+						SerialNumber: true,
+					},
+				},
+			},
+		},
+		{
+			desc: "No TLS, with pem option true with no flag",
+			tlsClientCertHeaders: &types.TLSClientHeaders{
+				PEM: false,
+				Infos: &types.TLSClientCertificateInfos{
+					Subject: &types.TLSCLientCertificateSubjectInfos{},
+				},
+			},
+		},
+		{
+			desc:         "TLS with simple certificate, with all infos",
+			certContents: []string{minimalCert},
+			tlsClientCertHeaders: &types.TLSClientHeaders{
+				Infos: &types.TLSClientCertificateInfos{
+					NotAfter:  true,
+					NotBefore: true,
+					Subject: &types.TLSCLientCertificateSubjectInfos{
+						CommonName:   true,
+						Organization: true,
+						Locality:     true,
+						Province:     true,
+						Country:      true,
+						SerialNumber: true,
+					},
+					Sans: true,
+				},
+			},
+			expectedHeader: url.QueryEscape(minimalCertAllInfos),
+		},
+		{
+			desc:         "TLS with simple certificate, with some infos",
+			certContents: []string{minimalCert},
+			tlsClientCertHeaders: &types.TLSClientHeaders{
+				Infos: &types.TLSClientCertificateInfos{
+					NotAfter: true,
+					Subject: &types.TLSCLientCertificateSubjectInfos{
+						Organization: true,
+					},
+					Sans: true,
+				},
+			},
+			expectedHeader: url.QueryEscape(`Subject="O=Internet Widgits Pty Ltd",NA=1534494496,SAN=`),
+		},
+		{
+			desc:         "TLS with complete certificate, with all infos",
+			certContents: []string{completeCert},
+			tlsClientCertHeaders: &types.TLSClientHeaders{
+				Infos: &types.TLSClientCertificateInfos{
+					NotAfter:  true,
+					NotBefore: true,
+					Subject: &types.TLSCLientCertificateSubjectInfos{
+						CommonName:   true,
+						Organization: true,
+						Locality:     true,
+						Province:     true,
+						Country:      true,
+						SerialNumber: true,
+					},
+					Sans: true,
+				},
+			},
+			expectedHeader: url.QueryEscape(completeCertAllInfos),
+		},
+		{
+			desc:         "TLS with 2 certificates, with all infos",
+			certContents: []string{minimalCert, completeCert},
+			tlsClientCertHeaders: &types.TLSClientHeaders{
+				Infos: &types.TLSClientCertificateInfos{
+					NotAfter:  true,
+					NotBefore: true,
+					Subject: &types.TLSCLientCertificateSubjectInfos{
+						CommonName:   true,
+						Organization: true,
+						Locality:     true,
+						Province:     true,
+						Country:      true,
+						SerialNumber: true,
+					},
+					Sans: true,
+				},
+			},
+			expectedHeader: url.QueryEscape(strings.Join([]string{minimalCertAllInfos, completeCertAllInfos}, ";")),
+		},
+	}
+
+	for _, test := range testCases {
+		tlsClientHeaders := NewTLSClientHeaders(&types.Frontend{PassTLSClientCert: test.tlsClientCertHeaders})
+
+		res := httptest.NewRecorder()
+		req := testhelpers.MustNewRequest(http.MethodGet, "http://example.com/foo", nil)
+
+		if test.certContents != nil && len(test.certContents) > 0 {
+			req.TLS = buildTLSWith(test.certContents)
+		}
+
+		tlsClientHeaders.ServeHTTP(res, req, myPassTLSClientCustomHandler)
+
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			require.Equal(t, http.StatusOK, res.Code, "Http Status should be OK")
+			require.Equal(t, "bar", res.Body.String(), "Should be the expected body")
+
+			if test.expectedHeader != "" {
+				require.Equal(t, test.expectedHeader, req.Header.Get(xForwardedTLSClientCertInfos), "The request header should contain the cleaned certificate")
+			} else {
+				require.Empty(t, req.Header.Get(xForwardedTLSClientCertInfos))
+			}
+			require.Empty(t, res.Header().Get(xForwardedTLSClientCertInfos), "The response header should be always empty")
+		})
+	}
+
+}
+
+func TestNewTLSClientHeadersFromStruct(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		frontend *types.Frontend
+		expected *TLSClientHeaders
+	}{
+		{
+			desc: "Without frontend",
+		},
+		{
+			desc:     "frontend without the option",
+			frontend: &types.Frontend{},
+			expected: &TLSClientHeaders{},
+		},
+		{
+			desc: "frontend with the pem set false",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					PEM: false,
+				},
+			},
+			expected: &TLSClientHeaders{PEM: false},
+		},
+		{
+			desc: "frontend with the pem set true",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					PEM: true,
+				},
+			},
+			expected: &TLSClientHeaders{PEM: true},
+		},
+		{
+			desc: "frontend with the Infos with no flag",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						NotAfter:  false,
+						NotBefore: false,
+						Sans:      false,
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM:   false,
+				Infos: &TLSClientCertificateInfos{},
+			},
+		},
+		{
+			desc: "frontend with the Infos basic",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						NotAfter:  true,
+						NotBefore: true,
+						Sans:      true,
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					NotBefore: true,
+					NotAfter:  true,
+					Sans:      true,
+				},
+			},
+		},
+		{
+			desc: "frontend with the Infos NotAfter",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						NotAfter: true,
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					NotAfter: true,
+				},
+			},
+		},
+		{
+			desc: "frontend with the Infos NotBefore",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						NotBefore: true,
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					NotBefore: true,
+				},
+			},
+		},
+		{
+			desc: "frontend with the Infos Sans",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						Sans: true,
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					Sans: true,
+				},
+			},
+		},
+		{
+			desc: "frontend with the Infos Subject Organization",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						Subject: &types.TLSCLientCertificateSubjectInfos{
+							Organization: true,
+						},
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					Subject: &TLSCLientCertificateSubjectInfos{
+						Organization: true,
+					},
+				},
+			},
+		},
+		{
+			desc: "frontend with the Infos Subject Country",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						Subject: &types.TLSCLientCertificateSubjectInfos{
+							Country: true,
+						},
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					Subject: &TLSCLientCertificateSubjectInfos{
+						Country: true,
+					},
+				},
+			},
+		},
+		{
+			desc: "frontend with the Infos Subject SerialNumber",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						Subject: &types.TLSCLientCertificateSubjectInfos{
+							SerialNumber: true,
+						},
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					Subject: &TLSCLientCertificateSubjectInfos{
+						SerialNumber: true,
+					},
+				},
+			},
+		},
+		{
+			desc: "frontend with the Infos Subject Province",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						Subject: &types.TLSCLientCertificateSubjectInfos{
+							Province: true,
+						},
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					Subject: &TLSCLientCertificateSubjectInfos{
+						Province: true,
+					},
+				},
+			},
+		},
+		{
+			desc: "frontend with the Infos Subject Locality",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						Subject: &types.TLSCLientCertificateSubjectInfos{
+							Locality: true,
+						},
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					Subject: &TLSCLientCertificateSubjectInfos{
+						Locality: true,
+					},
+				},
+			},
+		},
+		{
+			desc: "frontend with the Infos Subject CommonName",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						Subject: &types.TLSCLientCertificateSubjectInfos{
+							CommonName: true,
+						},
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					Subject: &TLSCLientCertificateSubjectInfos{
+						CommonName: true,
+					},
+				},
+			},
+		},
+		{
+			desc: "frontend with the Infos NotBefore",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						Sans: true,
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					Sans: true,
+				},
+			},
+		},
+		{
+			desc: "frontend with the Infos all",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						NotAfter:  true,
+						NotBefore: true,
+						Subject: &types.TLSCLientCertificateSubjectInfos{
+							CommonName:   true,
+							Country:      true,
+							Locality:     true,
+							Organization: true,
+							Province:     true,
+							SerialNumber: true,
+						},
+						Sans: true,
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					NotBefore: true,
+					NotAfter:  true,
+					Sans:      true,
+					Subject: &TLSCLientCertificateSubjectInfos{
+						Province:     true,
+						Organization: true,
+						Locality:     true,
+						Country:      true,
+						CommonName:   true,
+						SerialNumber: true,
+					},
+				}},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			require.Equal(t, test.expected, NewTLSClientHeaders(test.frontend))
+		})
+	}
+
+}

old/middlewares/tracing/carrier.go

@@ -0,0 +1,25 @@
+package tracing
+
+import "net/http"
+
+// HTTPHeadersCarrier custom implementation to fix duplicated headers
+// It has been fixed in https://github.com/opentracing/opentracing-go/pull/191
+type HTTPHeadersCarrier http.Header
+
+// Set conforms to the TextMapWriter interface.
+func (c HTTPHeadersCarrier) Set(key, val string) {
+	h := http.Header(c)
+	h.Set(key, val)
+}
+
+// ForeachKey conforms to the TextMapReader interface.
+func (c HTTPHeadersCarrier) ForeachKey(handler func(key, val string) error) error {
+	for k, vals := range c {
+		for _, v := range vals {
+			if err := handler(k, v); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}

old/middlewares/tracing/datadog/datadog.go

@@ -0,0 +1,45 @@
+package datadog
+
+import (
+	"io"
+	"strings"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/opentracing/opentracing-go"
+	ddtracer "gopkg.in/DataDog/dd-trace-go.v1/ddtrace/opentracer"
+	datadog "gopkg.in/DataDog/dd-trace-go.v1/ddtrace/tracer"
+)
+
+// Name sets the name of this tracer
+const Name = "datadog"
+
+// Config provides configuration settings for a datadog tracer
+type Config struct {
+	LocalAgentHostPort string `description:"Set datadog-agent's host:port that the reporter will used. Defaults to localhost:8126" export:"false"`
+	GlobalTag          string `description:"Key:Value tag to be set on all the spans." export:"true"`
+	Debug              bool   `description:"Enable DataDog debug." export:"true"`
+}
+
+// Setup sets up the tracer
+func (c *Config) Setup(serviceName string) (opentracing.Tracer, io.Closer, error) {
+	tag := strings.SplitN(c.GlobalTag, ":", 2)
+
+	value := ""
+	if len(tag) == 2 {
+		value = tag[1]
+	}
+
+	tracer := ddtracer.New(
+		datadog.WithAgentAddr(c.LocalAgentHostPort),
+		datadog.WithServiceName(serviceName),
+		datadog.WithGlobalTag(tag[0], value),
+		datadog.WithDebugMode(c.Debug),
+	)
+
+	// Without this, child spans are getting the NOOP tracer
+	opentracing.SetGlobalTracer(tracer)
+
+	log.Debug("DataDog tracer configured")
+
+	return tracer, nil, nil
+}

old/middlewares/tracing/entrypoint.go

@@ -0,0 +1,57 @@
+package tracing
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/opentracing/opentracing-go"
+	"github.com/opentracing/opentracing-go/ext"
+	"github.com/urfave/negroni"
+)
+
+type entryPointMiddleware struct {
+	entryPoint string
+	*Tracing
+}
+
+// NewEntryPoint creates a new middleware that the incoming request
+func (t *Tracing) NewEntryPoint(name string) negroni.Handler {
+	log.Debug("Added entrypoint tracing middleware")
+	return &entryPointMiddleware{Tracing: t, entryPoint: name}
+}
+
+func (e *entryPointMiddleware) ServeHTTP(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	opNameFunc := generateEntryPointSpanName
+
+	ctx, _ := e.Extract(opentracing.HTTPHeaders, HTTPHeadersCarrier(r.Header))
+	span := e.StartSpan(opNameFunc(r, e.entryPoint, e.SpanNameLimit), ext.RPCServerOption(ctx))
+	ext.Component.Set(span, e.ServiceName)
+	LogRequest(span, r)
+	ext.SpanKindRPCServer.Set(span)
+
+	r = r.WithContext(opentracing.ContextWithSpan(r.Context(), span))
+
+	recorder := newStatusCodeRecoder(w, 200)
+	next(recorder, r)
+
+	LogResponseCode(span, recorder.Status())
+	span.Finish()
+}
+
+// generateEntryPointSpanName will return a Span name of an appropriate lenth based on the 'spanLimit' argument.  If needed, it will be truncated, but will not be less than 24 characters.
+func generateEntryPointSpanName(r *http.Request, entryPoint string, spanLimit int) string {
+	name := fmt.Sprintf("Entrypoint %s %s", entryPoint, r.Host)
+
+	if spanLimit > 0 && len(name) > spanLimit {
+		if spanLimit < EntryPointMaxLengthNumber {
+			log.Warnf("SpanNameLimit is set to be less than required static number of characters, defaulting to %d + 3", EntryPointMaxLengthNumber)
+			spanLimit = EntryPointMaxLengthNumber + 3
+		}
+		hash := computeHash(name)
+		limit := (spanLimit - EntryPointMaxLengthNumber) / 2
+		name = fmt.Sprintf("Entrypoint %s %s %s", truncateString(entryPoint, limit), truncateString(r.Host, limit), hash)
+	}
+
+	return name
+}

old/middlewares/tracing/entrypoint_test.go

@@ -0,0 +1,70 @@
+package tracing
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/opentracing/opentracing-go/ext"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEntryPointMiddlewareServeHTTP(t *testing.T) {
+	expectedTags := map[string]interface{}{
+		"span.kind":   ext.SpanKindRPCServerEnum,
+		"http.method": "GET",
+		"component":   "",
+		"http.url":    "http://www.test.com",
+		"http.host":   "www.test.com",
+	}
+
+	testCases := []struct {
+		desc         string
+		entryPoint   string
+		tracing      *Tracing
+		expectedTags map[string]interface{}
+		expectedName string
+	}{
+		{
+			desc:       "no truncation test",
+			entryPoint: "test",
+			tracing: &Tracing{
+				SpanNameLimit: 0,
+				tracer:        &MockTracer{Span: &MockSpan{Tags: make(map[string]interface{})}},
+			},
+			expectedTags: expectedTags,
+			expectedName: "Entrypoint test www.test.com",
+		}, {
+			desc:       "basic test",
+			entryPoint: "test",
+			tracing: &Tracing{
+				SpanNameLimit: 25,
+				tracer:        &MockTracer{Span: &MockSpan{Tags: make(map[string]interface{})}},
+			},
+			expectedTags: expectedTags,
+			expectedName: "Entrypoint te... ww... 39b97e58",
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			e := &entryPointMiddleware{
+				entryPoint: test.entryPoint,
+				Tracing:    test.tracing,
+			}
+
+			next := func(http.ResponseWriter, *http.Request) {
+				span := test.tracing.tracer.(*MockTracer).Span
+
+				actual := span.Tags
+				assert.Equal(t, test.expectedTags, actual)
+				assert.Equal(t, test.expectedName, span.OpName)
+			}
+
+			e.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, "http://www.test.com", nil), next)
+		})
+	}
+}

old/middlewares/tracing/forwarder.go

@@ -0,0 +1,63 @@
+package tracing
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/opentracing/opentracing-go/ext"
+	"github.com/urfave/negroni"
+)
+
+type forwarderMiddleware struct {
+	frontend string
+	backend  string
+	opName   string
+	*Tracing
+}
+
+// NewForwarderMiddleware creates a new forwarder middleware that traces the outgoing request
+func (t *Tracing) NewForwarderMiddleware(frontend, backend string) negroni.Handler {
+	log.Debugf("Added outgoing tracing middleware %s", frontend)
+	return &forwarderMiddleware{
+		Tracing:  t,
+		frontend: frontend,
+		backend:  backend,
+		opName:   generateForwardSpanName(frontend, backend, t.SpanNameLimit),
+	}
+}
+
+func (f *forwarderMiddleware) ServeHTTP(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	span, r, finish := StartSpan(r, f.opName, true)
+	defer finish()
+	span.SetTag("frontend.name", f.frontend)
+	span.SetTag("backend.name", f.backend)
+	ext.HTTPMethod.Set(span, r.Method)
+	ext.HTTPUrl.Set(span, fmt.Sprintf("%s%s", r.URL.String(), r.RequestURI))
+	span.SetTag("http.host", r.Host)
+
+	InjectRequestHeaders(r)
+
+	recorder := newStatusCodeRecoder(w, 200)
+
+	next(recorder, r)
+
+	LogResponseCode(span, recorder.Status())
+}
+
+// generateForwardSpanName will return a Span name of an appropriate lenth based on the 'spanLimit' argument.  If needed, it will be truncated, but will not be less than 21 characters
+func generateForwardSpanName(frontend, backend string, spanLimit int) string {
+	name := fmt.Sprintf("forward %s/%s", frontend, backend)
+
+	if spanLimit > 0 && len(name) > spanLimit {
+		if spanLimit < ForwardMaxLengthNumber {
+			log.Warnf("SpanNameLimit is set to be less than required static number of characters, defaulting to %d + 3", ForwardMaxLengthNumber)
+			spanLimit = ForwardMaxLengthNumber + 3
+		}
+		hash := computeHash(name)
+		limit := (spanLimit - ForwardMaxLengthNumber) / 2
+		name = fmt.Sprintf("forward %s/%s/%s", truncateString(frontend, limit), truncateString(backend, limit), hash)
+	}
+
+	return name
+}

old/middlewares/tracing/forwarder_test.go

@@ -0,0 +1,93 @@
+package tracing
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestTracingNewForwarderMiddleware(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		tracer   *Tracing
+		frontend string
+		backend  string
+		expected *forwarderMiddleware
+	}{
+		{
+			desc: "Simple Forward Tracer without truncation and hashing",
+			tracer: &Tracing{
+				SpanNameLimit: 101,
+			},
+			frontend: "some-service.domain.tld",
+			backend:  "some-service.domain.tld",
+			expected: &forwarderMiddleware{
+				Tracing: &Tracing{
+					SpanNameLimit: 101,
+				},
+				frontend: "some-service.domain.tld",
+				backend:  "some-service.domain.tld",
+				opName:   "forward some-service.domain.tld/some-service.domain.tld",
+			},
+		}, {
+			desc: "Simple Forward Tracer with truncation and hashing",
+			tracer: &Tracing{
+				SpanNameLimit: 101,
+			},
+			frontend: "some-service-100.slug.namespace.environment.domain.tld",
+			backend:  "some-service-100.slug.namespace.environment.domain.tld",
+			expected: &forwarderMiddleware{
+				Tracing: &Tracing{
+					SpanNameLimit: 101,
+				},
+				frontend: "some-service-100.slug.namespace.environment.domain.tld",
+				backend:  "some-service-100.slug.namespace.environment.domain.tld",
+				opName:   "forward some-service-100.slug.namespace.enviro.../some-service-100.slug.namespace.enviro.../bc4a0d48",
+			},
+		},
+		{
+			desc: "Exactly 101 chars",
+			tracer: &Tracing{
+				SpanNameLimit: 101,
+			},
+			frontend: "some-service1.namespace.environment.domain.tld",
+			backend:  "some-service1.namespace.environment.domain.tld",
+			expected: &forwarderMiddleware{
+				Tracing: &Tracing{
+					SpanNameLimit: 101,
+				},
+				frontend: "some-service1.namespace.environment.domain.tld",
+				backend:  "some-service1.namespace.environment.domain.tld",
+				opName:   "forward some-service1.namespace.environment.domain.tld/some-service1.namespace.environment.domain.tld",
+			},
+		},
+		{
+			desc: "More than 101 chars",
+			tracer: &Tracing{
+				SpanNameLimit: 101,
+			},
+			frontend: "some-service1.frontend.namespace.environment.domain.tld",
+			backend:  "some-service1.backend.namespace.environment.domain.tld",
+			expected: &forwarderMiddleware{
+				Tracing: &Tracing{
+					SpanNameLimit: 101,
+				},
+				frontend: "some-service1.frontend.namespace.environment.domain.tld",
+				backend:  "some-service1.backend.namespace.environment.domain.tld",
+				opName:   "forward some-service1.frontend.namespace.envir.../some-service1.backend.namespace.enviro.../fa49dd23",
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			actual := test.tracer.NewForwarderMiddleware(test.frontend, test.backend)
+
+			assert.Equal(t, test.expected, actual)
+			assert.True(t, len(test.expected.opName) <= test.tracer.SpanNameLimit)
+		})
+	}
+}

old/middlewares/tracing/jaeger/jaeger.go

@@ -0,0 +1,73 @@
+package jaeger
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/opentracing/opentracing-go"
+	jaegercfg "github.com/uber/jaeger-client-go/config"
+	"github.com/uber/jaeger-client-go/zipkin"
+	jaegermet "github.com/uber/jaeger-lib/metrics"
+)
+
+// Name sets the name of this tracer
+const Name = "jaeger"
+
+// Config provides configuration settings for a jaeger tracer
+type Config struct {
+	SamplingServerURL  string  `description:"set the sampling server url." export:"false"`
+	SamplingType       string  `description:"set the sampling type." export:"true"`
+	SamplingParam      float64 `description:"set the sampling parameter." export:"true"`
+	LocalAgentHostPort string  `description:"set jaeger-agent's host:port that the reporter will used." export:"false"`
+	Gen128Bit          bool    `description:"generate 128 bit span IDs." export:"true"`
+	Propagation        string  `description:"which propgation format to use (jaeger/b3)." export:"true"`
+}
+
+// Setup sets up the tracer
+func (c *Config) Setup(componentName string) (opentracing.Tracer, io.Closer, error) {
+	jcfg := jaegercfg.Configuration{
+		Sampler: &jaegercfg.SamplerConfig{
+			SamplingServerURL: c.SamplingServerURL,
+			Type:              c.SamplingType,
+			Param:             c.SamplingParam,
+		},
+		Reporter: &jaegercfg.ReporterConfig{
+			LogSpans:           true,
+			LocalAgentHostPort: c.LocalAgentHostPort,
+		},
+	}
+
+	jMetricsFactory := jaegermet.NullFactory
+
+	opts := []jaegercfg.Option{
+		jaegercfg.Logger(&jaegerLogger{}),
+		jaegercfg.Metrics(jMetricsFactory),
+		jaegercfg.Gen128Bit(c.Gen128Bit),
+	}
+
+	switch c.Propagation {
+	case "b3":
+		p := zipkin.NewZipkinB3HTTPHeaderPropagator()
+		opts = append(opts,
+			jaegercfg.Injector(opentracing.HTTPHeaders, p),
+			jaegercfg.Extractor(opentracing.HTTPHeaders, p),
+		)
+	case "jaeger", "":
+	default:
+		return nil, nil, fmt.Errorf("unknown propagation format: %s", c.Propagation)
+	}
+
+	// Initialize tracer with a logger and a metrics factory
+	closer, err := jcfg.InitGlobalTracer(
+		componentName,
+		opts...,
+	)
+	if err != nil {
+		log.Warnf("Could not initialize jaeger tracer: %s", err.Error())
+		return nil, nil, err
+	}
+	log.Debug("Jaeger tracer configured")
+
+	return opentracing.GlobalTracer(), closer, nil
+}

old/middlewares/tracing/jaeger/logger.go

@@ -0,0 +1,15 @@
+package jaeger
+
+import "github.com/containous/traefik/old/log"
+
+// jaegerLogger is an implementation of the Logger interface that delegates to traefik log
+type jaegerLogger struct{}
+
+func (l *jaegerLogger) Error(msg string) {
+	log.Errorf("Tracing jaeger error: %s", msg)
+}
+
+// Infof logs a message at debug priority
+func (l *jaegerLogger) Infof(msg string, args ...interface{}) {
+	log.Debugf(msg, args...)
+}

old/middlewares/tracing/status_code.go

@@ -0,0 +1,57 @@
+package tracing
+
+import (
+	"bufio"
+	"net"
+	"net/http"
+)
+
+type statusCodeRecoder interface {
+	http.ResponseWriter
+	Status() int
+}
+
+type statusCodeWithoutCloseNotify struct {
+	http.ResponseWriter
+	status int
+}
+
+// WriteHeader captures the status code for later retrieval.
+func (s *statusCodeWithoutCloseNotify) WriteHeader(status int) {
+	s.status = status
+	s.ResponseWriter.WriteHeader(status)
+}
+
+// Status get response status
+func (s *statusCodeWithoutCloseNotify) Status() int {
+	return s.status
+}
+
+// Hijack hijacks the connection
+func (s *statusCodeWithoutCloseNotify) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	return s.ResponseWriter.(http.Hijacker).Hijack()
+}
+
+// Flush sends any buffered data to the client.
+func (s *statusCodeWithoutCloseNotify) Flush() {
+	if flusher, ok := s.ResponseWriter.(http.Flusher); ok {
+		flusher.Flush()
+	}
+}
+
+type statusCodeWithCloseNotify struct {
+	*statusCodeWithoutCloseNotify
+}
+
+func (s *statusCodeWithCloseNotify) CloseNotify() <-chan bool {
+	return s.ResponseWriter.(http.CloseNotifier).CloseNotify()
+}
+
+// newStatusCodeRecoder returns an initialized statusCodeRecoder.
+func newStatusCodeRecoder(rw http.ResponseWriter, status int) statusCodeRecoder {
+	recorder := &statusCodeWithoutCloseNotify{rw, status}
+	if _, ok := rw.(http.CloseNotifier); ok {
+		return &statusCodeWithCloseNotify{recorder}
+	}
+	return recorder
+}

old/middlewares/tracing/tracing.go

@@ -0,0 +1,197 @@
+package tracing
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/containous/traefik/old/middlewares/tracing/datadog"
+	"github.com/containous/traefik/old/middlewares/tracing/jaeger"
+	"github.com/containous/traefik/old/middlewares/tracing/zipkin"
+	"github.com/opentracing/opentracing-go"
+	"github.com/opentracing/opentracing-go/ext"
+)
+
+// ForwardMaxLengthNumber defines the number of static characters in the Forwarding Span Trace name : 8 chars for 'forward ' + 8 chars for hash + 2 chars for '_'.
+const ForwardMaxLengthNumber = 18
+
+// EntryPointMaxLengthNumber defines the number of static characters in the Entrypoint Span Trace name : 11 chars for 'Entrypoint ' + 8 chars for hash + 2 chars for '_'.
+const EntryPointMaxLengthNumber = 21
+
+// TraceNameHashLength defines the number of characters to use from the head of the generated hash.
+const TraceNameHashLength = 8
+
+// Tracing middleware
+type Tracing struct {
+	Backend       string          `description:"Selects the tracking backend ('jaeger','zipkin', 'datadog')." export:"true"`
+	ServiceName   string          `description:"Set the name for this service" export:"true"`
+	SpanNameLimit int             `description:"Set the maximum character limit for Span names (default 0 = no limit)" export:"true"`
+	Jaeger        *jaeger.Config  `description:"Settings for jaeger"`
+	Zipkin        *zipkin.Config  `description:"Settings for zipkin"`
+	DataDog       *datadog.Config `description:"Settings for DataDog"`
+
+	tracer opentracing.Tracer
+	closer io.Closer
+}
+
+// StartSpan delegates to opentracing.Tracer
+func (t *Tracing) StartSpan(operationName string, opts ...opentracing.StartSpanOption) opentracing.Span {
+	return t.tracer.StartSpan(operationName, opts...)
+}
+
+// Inject delegates to opentracing.Tracer
+func (t *Tracing) Inject(sm opentracing.SpanContext, format interface{}, carrier interface{}) error {
+	return t.tracer.Inject(sm, format, carrier)
+}
+
+// Extract delegates to opentracing.Tracer
+func (t *Tracing) Extract(format interface{}, carrier interface{}) (opentracing.SpanContext, error) {
+	return t.tracer.Extract(format, carrier)
+}
+
+// Backend describes things we can use to setup tracing
+type Backend interface {
+	Setup(serviceName string) (opentracing.Tracer, io.Closer, error)
+}
+
+// Setup Tracing middleware
+func (t *Tracing) Setup() {
+	var err error
+
+	switch t.Backend {
+	case jaeger.Name:
+		t.tracer, t.closer, err = t.Jaeger.Setup(t.ServiceName)
+	case zipkin.Name:
+		t.tracer, t.closer, err = t.Zipkin.Setup(t.ServiceName)
+	case datadog.Name:
+		t.tracer, t.closer, err = t.DataDog.Setup(t.ServiceName)
+	default:
+		log.Warnf("Unknown tracer %q", t.Backend)
+		return
+	}
+
+	if err != nil {
+		log.Warnf("Could not initialize %s tracing: %v", t.Backend, err)
+	}
+}
+
+// IsEnabled determines if tracing was successfully activated
+func (t *Tracing) IsEnabled() bool {
+	if t == nil || t.tracer == nil {
+		return false
+	}
+	return true
+}
+
+// Close tracer
+func (t *Tracing) Close() {
+	if t.closer != nil {
+		err := t.closer.Close()
+		if err != nil {
+			log.Warn(err)
+		}
+	}
+}
+
+// LogRequest used to create span tags from the request
+func LogRequest(span opentracing.Span, r *http.Request) {
+	if span != nil && r != nil {
+		ext.HTTPMethod.Set(span, r.Method)
+		ext.HTTPUrl.Set(span, r.URL.String())
+		span.SetTag("http.host", r.Host)
+	}
+}
+
+// LogResponseCode used to log response code in span
+func LogResponseCode(span opentracing.Span, code int) {
+	if span != nil {
+		ext.HTTPStatusCode.Set(span, uint16(code))
+		if code >= 400 {
+			ext.Error.Set(span, true)
+		}
+	}
+}
+
+// GetSpan used to retrieve span from request context
+func GetSpan(r *http.Request) opentracing.Span {
+	return opentracing.SpanFromContext(r.Context())
+}
+
+// InjectRequestHeaders used to inject OpenTracing headers into the request
+func InjectRequestHeaders(r *http.Request) {
+	if span := GetSpan(r); span != nil {
+		err := opentracing.GlobalTracer().Inject(
+			span.Context(),
+			opentracing.HTTPHeaders,
+			HTTPHeadersCarrier(r.Header))
+		if err != nil {
+			log.Error(err)
+		}
+	}
+}
+
+// LogEventf logs an event to the span in the request context.
+func LogEventf(r *http.Request, format string, args ...interface{}) {
+	if span := GetSpan(r); span != nil {
+		span.LogKV("event", fmt.Sprintf(format, args...))
+	}
+}
+
+// StartSpan starts a new span from the one in the request context
+func StartSpan(r *http.Request, operationName string, spanKinClient bool, opts ...opentracing.StartSpanOption) (opentracing.Span, *http.Request, func()) {
+	span, ctx := opentracing.StartSpanFromContext(r.Context(), operationName, opts...)
+	if spanKinClient {
+		ext.SpanKindRPCClient.Set(span)
+	}
+	r = r.WithContext(ctx)
+	return span, r, func() {
+		span.Finish()
+	}
+}
+
+// SetError flags the span associated with this request as in error
+func SetError(r *http.Request) {
+	if span := GetSpan(r); span != nil {
+		ext.Error.Set(span, true)
+	}
+}
+
+// SetErrorAndDebugLog flags the span associated with this request as in error and create a debug log.
+func SetErrorAndDebugLog(r *http.Request, format string, args ...interface{}) {
+	SetError(r)
+	log.Debugf(format, args...)
+	LogEventf(r, format, args...)
+}
+
+// SetErrorAndWarnLog flags the span associated with this request as in error and create a debug log.
+func SetErrorAndWarnLog(r *http.Request, format string, args ...interface{}) {
+	SetError(r)
+	log.Warnf(format, args...)
+	LogEventf(r, format, args...)
+}
+
+// truncateString reduces the length of the 'str' argument to 'num' - 3 and adds a '...' suffix to the tail.
+func truncateString(str string, num int) string {
+	text := str
+	if len(str) > num {
+		if num > 3 {
+			num -= 3
+		}
+		text = str[0:num] + "..."
+	}
+	return text
+}
+
+// computeHash returns the first TraceNameHashLength character of the sha256 hash for 'name' argument.
+func computeHash(name string) string {
+	data := []byte(name)
+	hash := sha256.New()
+	if _, err := hash.Write(data); err != nil {
+		// Impossible case
+		log.Errorf("Fail to create Span name hash for %s: %v", name, err)
+	}
+
+	return fmt.Sprintf("%x", hash.Sum(nil))[:TraceNameHashLength]
+}

old/middlewares/tracing/tracing_test.go

@@ -0,0 +1,133 @@
+package tracing
+
+import (
+	"testing"
+
+	"github.com/opentracing/opentracing-go"
+	"github.com/opentracing/opentracing-go/log"
+	"github.com/stretchr/testify/assert"
+)
+
+type MockTracer struct {
+	Span *MockSpan
+}
+
+type MockSpan struct {
+	OpName string
+	Tags   map[string]interface{}
+}
+
+type MockSpanContext struct {
+}
+
+// MockSpanContext:
+func (n MockSpanContext) ForeachBaggageItem(handler func(k, v string) bool) {}
+
+// MockSpan:
+func (n MockSpan) Context() opentracing.SpanContext { return MockSpanContext{} }
+func (n MockSpan) SetBaggageItem(key, val string) opentracing.Span {
+	return MockSpan{Tags: make(map[string]interface{})}
+}
+func (n MockSpan) BaggageItem(key string) string { return "" }
+func (n MockSpan) SetTag(key string, value interface{}) opentracing.Span {
+	n.Tags[key] = value
+	return n
+}
+func (n MockSpan) LogFields(fields ...log.Field)                          {}
+func (n MockSpan) LogKV(keyVals ...interface{})                           {}
+func (n MockSpan) Finish()                                                {}
+func (n MockSpan) FinishWithOptions(opts opentracing.FinishOptions)       {}
+func (n MockSpan) SetOperationName(operationName string) opentracing.Span { return n }
+func (n MockSpan) Tracer() opentracing.Tracer                             { return MockTracer{} }
+func (n MockSpan) LogEvent(event string)                                  {}
+func (n MockSpan) LogEventWithPayload(event string, payload interface{})  {}
+func (n MockSpan) Log(data opentracing.LogData)                           {}
+func (n MockSpan) Reset() {
+	n.Tags = make(map[string]interface{})
+}
+
+// StartSpan belongs to the Tracer interface.
+func (n MockTracer) StartSpan(operationName string, opts ...opentracing.StartSpanOption) opentracing.Span {
+	n.Span.OpName = operationName
+	return n.Span
+}
+
+// Inject belongs to the Tracer interface.
+func (n MockTracer) Inject(sp opentracing.SpanContext, format interface{}, carrier interface{}) error {
+	return nil
+}
+
+// Extract belongs to the Tracer interface.
+func (n MockTracer) Extract(format interface{}, carrier interface{}) (opentracing.SpanContext, error) {
+	return nil, opentracing.ErrSpanContextNotFound
+}
+
+func TestTruncateString(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		text     string
+		limit    int
+		expected string
+	}{
+		{
+			desc:     "short text less than limit 10",
+			text:     "short",
+			limit:    10,
+			expected: "short",
+		},
+		{
+			desc:     "basic truncate with limit 10",
+			text:     "some very long pice of text",
+			limit:    10,
+			expected: "some ve...",
+		},
+		{
+			desc:     "truncate long FQDN to 39 chars",
+			text:     "some-service-100.slug.namespace.environment.domain.tld",
+			limit:    39,
+			expected: "some-service-100.slug.namespace.envi...",
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			actual := truncateString(test.text, test.limit)
+
+			assert.Equal(t, test.expected, actual)
+			assert.True(t, len(actual) <= test.limit)
+		})
+	}
+}
+
+func TestComputeHash(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		text     string
+		expected string
+	}{
+		{
+			desc:     "hashing",
+			text:     "some very long pice of text",
+			expected: "0258ea1c",
+		},
+		{
+			desc:     "short text less than limit 10",
+			text:     "short",
+			expected: "f9b0078b",
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			actual := computeHash(test.text)
+
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}

old/middlewares/tracing/wrapper.go

@@ -0,0 +1,66 @@
+package tracing
+
+import (
+	"net/http"
+
+	"github.com/urfave/negroni"
+)
+
+// NewNegroniHandlerWrapper return a negroni.Handler struct
+func (t *Tracing) NewNegroniHandlerWrapper(name string, handler negroni.Handler, clientSpanKind bool) negroni.Handler {
+	if t.IsEnabled() && handler != nil {
+		return &NegroniHandlerWrapper{
+			name:           name,
+			next:           handler,
+			clientSpanKind: clientSpanKind,
+		}
+	}
+	return handler
+}
+
+// NewHTTPHandlerWrapper return a http.Handler struct
+func (t *Tracing) NewHTTPHandlerWrapper(name string, handler http.Handler, clientSpanKind bool) http.Handler {
+	if t.IsEnabled() && handler != nil {
+		return &HTTPHandlerWrapper{
+			name:           name,
+			handler:        handler,
+			clientSpanKind: clientSpanKind,
+		}
+	}
+	return handler
+}
+
+// NegroniHandlerWrapper is used to wrap negroni handler middleware
+type NegroniHandlerWrapper struct {
+	name           string
+	next           negroni.Handler
+	clientSpanKind bool
+}
+
+func (t *NegroniHandlerWrapper) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	var finish func()
+	_, r, finish = StartSpan(r, t.name, t.clientSpanKind)
+	defer finish()
+
+	if t.next != nil {
+		t.next.ServeHTTP(rw, r, next)
+	}
+}
+
+// HTTPHandlerWrapper is used to wrap http handler middleware
+type HTTPHandlerWrapper struct {
+	name           string
+	handler        http.Handler
+	clientSpanKind bool
+}
+
+func (t *HTTPHandlerWrapper) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	var finish func()
+	_, r, finish = StartSpan(r, t.name, t.clientSpanKind)
+	defer finish()
+
+	if t.handler != nil {
+		t.handler.ServeHTTP(rw, r)
+	}
+
+}

old/middlewares/tracing/zipkin/zipkin.go

@@ -0,0 +1,49 @@
+package zipkin
+
+import (
+	"io"
+	"time"
+
+	"github.com/containous/traefik/old/log"
+	"github.com/opentracing/opentracing-go"
+	zipkin "github.com/openzipkin/zipkin-go-opentracing"
+)
+
+// Name sets the name of this tracer
+const Name = "zipkin"
+
+// Config provides configuration settings for a zipkin tracer
+type Config struct {
+	HTTPEndpoint string  `description:"HTTP Endpoint to report traces to." export:"false"`
+	SameSpan     bool    `description:"Use Zipkin SameSpan RPC style traces." export:"true"`
+	ID128Bit     bool    `description:"Use Zipkin 128 bit root span IDs." export:"true"`
+	Debug        bool    `description:"Enable Zipkin debug." export:"true"`
+	SampleRate   float64 `description:"The rate between 0.0 and 1.0 of requests to trace." export:"true"`
+}
+
+// Setup sets up the tracer
+func (c *Config) Setup(serviceName string) (opentracing.Tracer, io.Closer, error) {
+	collector, err := zipkin.NewHTTPCollector(c.HTTPEndpoint)
+	if err != nil {
+		return nil, nil, err
+	}
+	recorder := zipkin.NewRecorder(collector, c.Debug, "0.0.0.0:0", serviceName)
+	tracer, err := zipkin.NewTracer(
+		recorder,
+		zipkin.ClientServerSameSpan(c.SameSpan),
+		zipkin.TraceID128Bit(c.ID128Bit),
+		zipkin.DebugMode(c.Debug),
+		zipkin.WithSampler(zipkin.NewBoundarySampler(c.SampleRate, time.Now().Unix())),
+	)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Without this, child spans are getting the NOOP tracer
+	opentracing.SetGlobalTracer(tracer)
+
+	log.Debug("Zipkin tracer configured")
+
+	return tracer, collector, nil
+}