ginuerzh
b9d74c1b8e
Add package-level documentation and Go doc comments for all exported types, functions, and methods across the admission package, its plugin sub-packages, and connection/listener wrappers.
128 lines
3.2 KiB
Go
128 lines
3.2 KiB
Go
package admission
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
|
|
"github.com/go-gost/core/admission"
|
|
"github.com/go-gost/core/logger"
|
|
"github.com/go-gost/x/internal/plugin"
|
|
)
|
|
|
|
// httpPluginRequest is the JSON payload sent to the HTTP admission service.
|
|
type httpPluginRequest struct {
|
|
Service string `json:"service"`
|
|
Network string `json:"network"`
|
|
Addr string `json:"addr"`
|
|
}
|
|
|
|
// httpPluginResponse is the JSON response expected from the HTTP
|
|
// admission service. OK indicates whether the address is admitted.
|
|
type httpPluginResponse struct {
|
|
OK bool `json:"ok"`
|
|
}
|
|
|
|
// httpPlugin is an admission controller that delegates to an external
|
|
// HTTP admission service via JSON POST requests.
|
|
//
|
|
// The HTTP client is created via plugin.NewHTTPClient, which configures
|
|
// timeouts, TLS, and token-based authentication from plugin options.
|
|
type httpPlugin struct {
|
|
url string
|
|
client *http.Client
|
|
header http.Header
|
|
log logger.Logger
|
|
}
|
|
|
|
// NewHTTPPlugin creates an admission controller that communicates with
|
|
// an external HTTP admission service at the given URL.
|
|
//
|
|
// The name is used only for log identification. On each Admit call,
|
|
// a JSON-encoded httpPluginRequest is POSTed to the URL. A 200 response
|
|
// with {"ok": true} admits the address; any other response denies it.
|
|
//
|
|
// If the HTTP client is nil, all admission requests return false.
|
|
func NewHTTPPlugin(name string, url string, opts ...plugin.Option) admission.Admission {
|
|
var options plugin.Options
|
|
for _, opt := range opts {
|
|
opt(&options)
|
|
}
|
|
|
|
return &httpPlugin{
|
|
url: url,
|
|
client: plugin.NewHTTPClient(&options),
|
|
header: options.Header,
|
|
log: logger.Default().WithFields(map[string]any{
|
|
"kind": "admission",
|
|
"admission": name,
|
|
}),
|
|
}
|
|
}
|
|
|
|
// Admit sends a JSON POST request to the configured HTTP endpoint.
|
|
// The request includes the service name, network, and client address.
|
|
//
|
|
// The address is admitted only if ALL of the following are true:
|
|
// - The HTTP client is non-nil
|
|
// - The request is successfully sent
|
|
// - The response has status 200 OK
|
|
// - The response body decodes as JSON with "ok": true
|
|
//
|
|
// Any error, non-200 status, or decode failure results in denial.
|
|
func (p *httpPlugin) Admit(ctx context.Context, network, addr string, opts ...admission.Option) (ok bool) {
|
|
if p.client == nil {
|
|
return
|
|
}
|
|
|
|
var options admission.Options
|
|
for _, opt := range opts {
|
|
opt(&options)
|
|
}
|
|
|
|
rb := httpPluginRequest{
|
|
Service: options.Service,
|
|
Network: network,
|
|
Addr: addr,
|
|
}
|
|
v, err := json.Marshal(&rb)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, p.url, bytes.NewReader(v))
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
if p.header != nil {
|
|
req.Header = p.header.Clone()
|
|
}
|
|
req.Header.Set("Content-Type", "application/json")
|
|
resp, err := p.client.Do(req)
|
|
if err != nil {
|
|
return
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
|
return
|
|
}
|
|
|
|
res := httpPluginResponse{}
|
|
if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
|
|
return
|
|
}
|
|
return res.OK
|
|
}
|
|
|
|
// Close closes idle connections in the HTTP client's connection pool.
|
|
// It does not shut down the client itself.
|
|
func (p *httpPlugin) Close() error {
|
|
if p.client != nil {
|
|
p.client.CloseIdleConnections()
|
|
}
|
|
return nil
|
|
}
|