From 077b647ec4e59724cae2f71a2d8f329372b7342f Mon Sep 17 00:00:00 2001 From: Ryan Baxter Date: Tue, 18 Dec 2018 15:51:19 -0500 Subject: [PATCH 1/3] Allow isSecure property of LoadBalancer ServiceInstance to determine the scheme of the URL. Fixes #641 --- .../main/asciidoc/spring-cloud-gateway.adoc | 7 ++ .../filter/LoadBalancerClientFilter.java | 2 +- .../filter/LoadBalancerClientFilterTests.java | 64 +++++++++++++++++-- .../resources/application-multi-cert-ssl.yml | 2 +- .../resources/application-single-cert-ssl.yml | 2 +- 5 files changed, 70 insertions(+), 7 deletions(-) diff --git a/docs/src/main/asciidoc/spring-cloud-gateway.adoc b/docs/src/main/asciidoc/spring-cloud-gateway.adoc index 5897035c..83387096 100644 --- a/docs/src/main/asciidoc/spring-cloud-gateway.adoc +++ b/docs/src/main/asciidoc/spring-cloud-gateway.adoc @@ -876,6 +876,13 @@ spring: - Path=/service/** ---- +NOTE: The `isSecure` value of the `ServiceInstance` returned from the `LoadBalancer` will override +the scheme specified in the request made to the Gateway. For example, if the request comes into the Gateway over `HTTPS` +but the `ServiceInstance` indicates it is not secure, then the downstream request will be made over +`HTTP`. The opposite situation can also apply. However if `GATEWAY_SCHEME_PREFIX_ATTR` is specified for the +route in the Gateway configuration, the prefix will be stripped and the resulting scheme from the +route URL will override the `ServiceInstance` configuration. + === Netty Routing Filter The Netty Routing Filter runs if the url located in the `ServerWebExchangeUtils.GATEWAY_REQUEST_URL_ATTR` exchange attribute has a `http` or `https` scheme. It uses the Netty `HttpClient` to make the downstream proxy request. The response is put in the `ServerWebExchangeUtils.CLIENT_RESPONSE_ATTR` exchange attribute for use in a later filter. (There is an experimental `WebClientHttpRoutingFilter` that performs the same function, but does not require netty) diff --git a/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/filter/LoadBalancerClientFilter.java b/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/filter/LoadBalancerClientFilter.java index ff12c753..13254c6c 100644 --- a/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/filter/LoadBalancerClientFilter.java +++ b/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/filter/LoadBalancerClientFilter.java @@ -76,7 +76,7 @@ public class LoadBalancerClientFilter implements GlobalFilter, Ordered { // if the `lb:` mechanism was used, use `` as the default, // if the loadbalancer doesn't provide one. - String overrideScheme = null; + String overrideScheme = instance.isSecure() ? "https" : "http"; if (schemePrefix != null) { overrideScheme = url.getScheme(); } diff --git a/spring-cloud-gateway-core/src/test/java/org/springframework/cloud/gateway/filter/LoadBalancerClientFilterTests.java b/spring-cloud-gateway-core/src/test/java/org/springframework/cloud/gateway/filter/LoadBalancerClientFilterTests.java index d3f45095..7df919a1 100644 --- a/spring-cloud-gateway-core/src/test/java/org/springframework/cloud/gateway/filter/LoadBalancerClientFilterTests.java +++ b/spring-cloud-gateway-core/src/test/java/org/springframework/cloud/gateway/filter/LoadBalancerClientFilterTests.java @@ -123,6 +123,58 @@ public class LoadBalancerClientFilterTests { verifyNoMoreInteractions(chain); } + @Test + public void instanceOverrideNonSecureScheme() { + MockServerHttpRequest request = MockServerHttpRequest + .get("https://localhost") + .build(); + + URI lbUri = URI.create("lb://service1"); + ServerWebExchange webExchange = testFilter(request, lbUri); + URI uri = webExchange.getRequiredAttribute(GATEWAY_REQUEST_URL_ATTR); + assertThat(uri).hasScheme("http").hasHost("service1-host1"); + } + + @Test + public void instanceOverrideSecureScheme() { + MockServerHttpRequest request = MockServerHttpRequest + .get("http://localhost") + .build(); + + URI lbUri = URI.create("lb://service1"); + ServerWebExchange webExchange = testFilter(request, lbUri, 443); + URI uri = webExchange.getRequiredAttribute(GATEWAY_REQUEST_URL_ATTR); + assertThat(uri).hasScheme("https").hasHost("service1-host1"); + } + + @Test + public void instanceOverrideSecureSchemePrefix() { + MockServerHttpRequest request = MockServerHttpRequest + .get("https://localhost") + .build(); + + URI lbUri = URI.create("http://service1"); + ServerWebExchange exchange = MockServerWebExchange.from(request); + exchange.getAttributes().put(GATEWAY_SCHEME_PREFIX_ATTR, "lb"); + ServerWebExchange webExchange = testFilter(exchange, lbUri, 443); + URI uri = webExchange.getRequiredAttribute(GATEWAY_REQUEST_URL_ATTR); + assertThat(uri).hasScheme("http").hasHost("service1-host1"); + } + + @Test + public void instanceOverrideNonSecureSchemePrefix() { + MockServerHttpRequest request = MockServerHttpRequest + .get("http://localhost") + .build(); + + URI lbUri = URI.create("https://service1"); + ServerWebExchange exchange = MockServerWebExchange.from(request); + exchange.getAttributes().put(GATEWAY_SCHEME_PREFIX_ATTR, "lb"); + ServerWebExchange webExchange = testFilter(exchange, lbUri, 8081); + URI uri = webExchange.getRequiredAttribute(GATEWAY_REQUEST_URL_ATTR); + assertThat(uri).hasScheme("https").hasHost("service1-host1"); + } + @Test public void happyPath() { @@ -208,7 +260,7 @@ public class LoadBalancerClientFilterTests { exchange = MockServerWebExchange.from(request); exchange.getAttributes().put(GATEWAY_SCHEME_PREFIX_ATTR, "lb"); - ServerWebExchange webExchange = testFilter(exchange, lbUri); + ServerWebExchange webExchange = testFilter(exchange, lbUri, 8081); URI uri = webExchange.getRequiredAttribute(GATEWAY_REQUEST_URL_ATTR); assertThat(uri).hasScheme("ws").hasHost("service1-host1") .hasParameter("a", "b"); @@ -274,10 +326,14 @@ public class LoadBalancerClientFilterTests { } private ServerWebExchange testFilter(MockServerHttpRequest request, URI uri) { - return testFilter(MockServerWebExchange.from(request), uri); + return testFilter(MockServerWebExchange.from(request), uri, 8081); } - private ServerWebExchange testFilter(ServerWebExchange exchange, URI uri) { + private ServerWebExchange testFilter(MockServerHttpRequest request, URI uri, int port) { + return testFilter(MockServerWebExchange.from(request), uri, port); + } + + private ServerWebExchange testFilter(ServerWebExchange exchange, URI uri, int port) { exchange.getAttributes().put(GATEWAY_REQUEST_URL_ATTR, uri); ArgumentCaptor captor = ArgumentCaptor.forClass(ServerWebExchange.class); @@ -288,7 +344,7 @@ public class LoadBalancerClientFilterTests { when(clientFactory.getLoadBalancerContext("service1")).thenReturn(new RibbonLoadBalancerContext(loadBalancer)); when(clientFactory.getLoadBalancer("service1")).thenReturn(loadBalancer); - when(loadBalancer.chooseServer(any())).thenReturn(new Server("service1-host1", 8081)); + when(loadBalancer.chooseServer(any())).thenReturn(new Server("service1-host1", port)); RibbonLoadBalancerClient client = new RibbonLoadBalancerClient(clientFactory); diff --git a/spring-cloud-gateway-core/src/test/resources/application-multi-cert-ssl.yml b/spring-cloud-gateway-core/src/test/resources/application-multi-cert-ssl.yml index 52e21ea8..60c3d363 100644 --- a/spring-cloud-gateway-core/src/test/resources/application-multi-cert-ssl.yml +++ b/spring-cloud-gateway-core/src/test/resources/application-multi-cert-ssl.yml @@ -1,6 +1,6 @@ test: hostport: httpbin.org:80 - uri: lb://testservice + uri: lb:https://testservice server: ssl: diff --git a/spring-cloud-gateway-core/src/test/resources/application-single-cert-ssl.yml b/spring-cloud-gateway-core/src/test/resources/application-single-cert-ssl.yml index a1da9aa1..7c184e4f 100644 --- a/spring-cloud-gateway-core/src/test/resources/application-single-cert-ssl.yml +++ b/spring-cloud-gateway-core/src/test/resources/application-single-cert-ssl.yml @@ -1,6 +1,6 @@ test: hostport: httpbin.org:80 - uri: lb://testservice + uri: lb:https://testservice server: ssl: From b4a9bff6554ce528a6f9a795b0ebf72bdafa17d1 Mon Sep 17 00:00:00 2001 From: Spencer Gibb Date: Fri, 21 Dec 2018 11:33:03 -0500 Subject: [PATCH 2/3] Disables TimeoutException.fillInStackTrace() --- .../cloud/gateway/support/TimeoutException.java | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/support/TimeoutException.java b/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/support/TimeoutException.java index 2a8e518c..92834c39 100644 --- a/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/support/TimeoutException.java +++ b/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/support/TimeoutException.java @@ -30,4 +30,13 @@ public class TimeoutException extends Exception { public TimeoutException(String message) { super(message); } + + /** + * Disables fillInStackTrace for performance reasons. + * @return + */ + @Override + public synchronized Throwable fillInStackTrace() { + return this; + } } From 78e82c4ea64a0c5a6f8c3892144f51fe88a98d9b Mon Sep 17 00:00:00 2001 From: Spencer Gibb Date: Tue, 8 Jan 2019 10:44:45 -0500 Subject: [PATCH 3/3] Run http headers filters for response after status code is set. This makes the status code available to the filters. fixes gh-757 --- .../gateway/filter/NettyRoutingFilter.java | 10 ++- ...ttpStatusInResponseHeadersFilterTests.java | 77 +++++++++++++++++++ 2 files changed, 83 insertions(+), 4 deletions(-) create mode 100644 spring-cloud-gateway-core/src/test/java/org/springframework/cloud/gateway/filter/headers/HttpStatusInResponseHeadersFilterTests.java diff --git a/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/filter/NettyRoutingFilter.java b/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/filter/NettyRoutingFilter.java index ec75e525..d83ce4c5 100644 --- a/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/filter/NettyRoutingFilter.java +++ b/spring-cloud-gateway-core/src/main/java/org/springframework/cloud/gateway/filter/NettyRoutingFilter.java @@ -137,10 +137,6 @@ public class NettyRoutingFilter implements GlobalFilter, Ordered { exchange.getAttributes().put(ORIGINAL_RESPONSE_CONTENT_TYPE_ATTR, contentTypeValue); } - HttpHeaders filteredResponseHeaders = HttpHeadersFilter.filter( - this.headersFilters.getIfAvailable(), headers, exchange, Type.RESPONSE); - - response.getHeaders().putAll(filteredResponseHeaders); HttpStatus status = HttpStatus.resolve(res.status().code()); if (status != null) { response.setStatusCode(status); @@ -151,6 +147,12 @@ public class NettyRoutingFilter implements GlobalFilter, Ordered { throw new IllegalStateException("Unable to set status code on response: " +res.status().code()+", "+response.getClass()); } + // make sure headers filters run after setting status so it is available in response + HttpHeaders filteredResponseHeaders = HttpHeadersFilter.filter( + this.headersFilters.getIfAvailable(), headers, exchange, Type.RESPONSE); + + response.getHeaders().putAll(filteredResponseHeaders); + // Defer committing the response until all route filters have run // Put client response as ServerWebExchange attribute and write response later NettyWriteResponseFilter exchange.getAttributes().put(CLIENT_RESPONSE_ATTR, res); diff --git a/spring-cloud-gateway-core/src/test/java/org/springframework/cloud/gateway/filter/headers/HttpStatusInResponseHeadersFilterTests.java b/spring-cloud-gateway-core/src/test/java/org/springframework/cloud/gateway/filter/headers/HttpStatusInResponseHeadersFilterTests.java new file mode 100644 index 00000000..bfa28ea2 --- /dev/null +++ b/spring-cloud-gateway-core/src/test/java/org/springframework/cloud/gateway/filter/headers/HttpStatusInResponseHeadersFilterTests.java @@ -0,0 +1,77 @@ +/* + * Copyright 2013-2019 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + */ + +package org.springframework.cloud.gateway.filter.headers; + +import org.junit.Test; + +import org.junit.runner.RunWith; +import org.springframework.boot.SpringBootConfiguration; +import org.springframework.boot.autoconfigure.EnableAutoConfiguration; +import org.springframework.boot.test.context.SpringBootTest; +import org.springframework.cloud.gateway.test.BaseWebClientTests; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Import; +import org.springframework.http.HttpHeaders; +import org.springframework.http.HttpStatus; +import org.springframework.test.annotation.DirtiesContext; +import org.springframework.test.context.junit4.SpringRunner; +import org.springframework.web.server.ServerWebExchange; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.springframework.boot.test.context.SpringBootTest.WebEnvironment.RANDOM_PORT; + +/** + * @author Spencer Gibb + */ +@RunWith(SpringRunner.class) +@SpringBootTest(webEnvironment = RANDOM_PORT) +@DirtiesContext +public class HttpStatusInResponseHeadersFilterTests extends BaseWebClientTests { + + @Test + public void statusCodeAvailableInResponseHttpHeadersFilter() { + testClient.get() + .uri("/get") + .exchange() + .expectStatus().isOk(); + } + + @EnableAutoConfiguration + @SpringBootConfiguration + @Import(DefaultTestConfig.class) + public static class TestConfig { + + @Bean + public HttpHeadersFilter checkStatusFilter() { + return new HttpHeadersFilter() { + @Override + public HttpHeaders filter(HttpHeaders input, ServerWebExchange exchange) { + HttpStatus statusCode = exchange.getResponse().getStatusCode(); + assertThat(statusCode).isEqualTo(HttpStatus.OK); + return input; + } + + @Override + public boolean supports(Type type) { + return type == Type.RESPONSE; + } + }; + } + + } +}