go語言實(shí)現(xiàn)一個端口同時支持HTTP和HTTPS REST API

go語言的http.Server模塊能夠提供HTTP服務(wù)和HTTPS服務(wù)，但是對同一個端口只能要么提供HTTP服務(wù)，要么提供HTTPS服務(wù)倦始，不能同時提供服務(wù)。

我們提供的辦法是使用一個公共的端口作為監(jiān)聽，然后讓HTTP和HTTPS服務(wù)分別監(jiān)聽在各自的端口上闷供，在公共端口服務(wù)區(qū)分這是HTTP請求還是HTTPS請求，各自轉(zhuǎn)發(fā)到所服務(wù)的監(jiān)聽统诺。

proxy.jpg

完整代碼如下

package main

import (
    "os"
    "fmt"
    "log"
    "net"
    "flag"
    "bytes"
    "net/http"
    "io/ioutil"
    "crypto/tls"
    "crypto/x509"
    "encoding/json"
    "github.com/gorilla/mux"
)

var (
    port       int
    caroots    string
    keyfile    string
    signcert   string
)

func init() {
    flag.IntVar(&port,          "port",     8080,       "The host port on which the REST server will listen")
    flag.StringVar(&caroots,    "caroot",   "",         "Path to file containing PEM-encoded trusted certificate(s) for clients")
    flag.StringVar(&keyfile,    "key",      "",         "Path to file containing PEM-encoded key file for service")
    flag.StringVar(&signcert,   "signcert", "",         "Path to file containing PEM-encoded sign certificate for service")
}

// Start a proxy server listen on listenport
// This proxy will forward all HTTP request to httpport, and all HTTPS request to httpsport
func proxyStart(listenport, httpport, httpsport int) {
    proxylistener, err := net.Listen("tcp", fmt.Sprintf(":%d", listenport))
    if err != nil {
        fmt.Println("Unable to listen on: %d, error: %s\n", listenport, err.Error())
        os.Exit(1)
    }
    defer proxylistener.Close()

    for {
        proxyconn, err := proxylistener.Accept()
        if err != nil {
            fmt.Printf("Unable to accept a request, error: %s\n", err.Error())
            continue
        }

        // Read a header firstly in case you could have opportunity to check request
        // whether to decline or proceed the request
        buffer := make([]byte, 1024)
        n, err := proxyconn.Read(buffer)
        if err != nil {
            //fmt.Printf("Unable to read from input, error: %s\n", err.Error())
            continue
        }

        var targetport int
        if isHTTPRequest(buffer) {
            targetport = httpport
        } else {
            targetport = httpsport
        }

        targetconn, err := net.Dial("tcp", fmt.Sprintf("localhost:%d", targetport))
        if err != nil {
            fmt.Println("Unable to connect to: %d, error: %s\n", targetport, err.Error())
            proxyconn.Close()
            continue
        }

        n, err = targetconn.Write(buffer[:n])
        if err != nil {
            fmt.Printf("Unable to write to output, error: %s\n", err.Error())
            proxyconn.Close()
            targetconn.Close()
            continue 
        }

        go proxyRequest(proxyconn, targetconn)
        go proxyRequest(targetconn, proxyconn)
    }
}

// Forward all requests from r to w
func proxyRequest(r net.Conn, w net.Conn) {
    defer r.Close()
    defer w.Close()

    var buffer = make([]byte, 4096000)
    for {
        n, err := r.Read(buffer)
        if err != nil {
            //fmt.Printf("Unable to read from input, error: %s\n", err.Error())
            break
        }

        n, err = w.Write(buffer[:n])
        if err != nil {
            fmt.Printf("Unable to write to output, error: %s\n", err.Error())
            break
        }
    }
}

func isHTTPRequest(buffer []byte) bool {
    httpMethod := []string{"GET", "PUT", "HEAD", "POST", "DELETE", "PATCH", "OPTIONS"}
    for cnt := 0; cnt < len(httpMethod); cnt++ {
        if bytes.HasPrefix(buffer, []byte(httpMethod[cnt])) {
            return true
        }
    }
    return false
}

func startHTTPSServer(address string, router *mux.Router, caroots string, keyfile string, signcert string) {
    pool := x509.NewCertPool()

    caCrt, err := ioutil.ReadFile(caroots)
    if err != nil {
        log.Fatalln("ReadFile err:", err)
    }
    pool.AppendCertsFromPEM(caCrt)

    s := &http.Server{
            Addr:    address,
            Handler: router,
            TLSConfig: &tls.Config{
                MinVersion: tls.VersionTLS12,
                ClientCAs:  pool,
                ClientAuth: tls.RequireAndVerifyClientCert,
            },
    }
    err = s.ListenAndServeTLS(signcert, keyfile)
    if err != nil {
        log.Fatalln("ListenAndServeTLS err:", err)
    }
}

func startHTTPServer(address string, router *mux.Router) {
    err := http.ListenAndServe(address, router)
    if err != nil {
        log.Fatalln("ListenAndServe err:", err)
    }
}

func SayHello(w http.ResponseWriter, r *http.Request) {
    log.Println("Entry SayHello")
    res := map[string]string {"hello": "world"}

    b, err := json.Marshal(res)
    if err == nil {
        w.WriteHeader(http.StatusOK)
        w.Header().Set("Content-Type", "application/json")
        w.Write(b)
    }

    log.Println("Exit SayHello")
}

func main() {
    flag.Parse()
    fmt.Println("Server listen on", port)

    router := mux.NewRouter().StrictSlash(true)
    router.HandleFunc("/service/hello", SayHello).Methods("GET")

    listenport, httpport, httpsport := port, port + 10, port + 20
    go startHTTPServer (fmt.Sprintf("localhost:%d", httpport), router)
    go startHTTPSServer(fmt.Sprintf("localhost:%d", httpsport), router, caroots, keyfile, signcert)
    
    proxyStart(listenport, httpport, httpsport)

    fmt.Println("Exit main")
}

上述例子中歪脏，服務(wù)端口監(jiān)聽在8080，然后我們?yōu)镠TTP服務(wù)監(jiān)聽在8090粮呢，HTTPS監(jiān)聽在8100端口婿失，這樣所有的外部訪問都只需要訪問8080端口即可，proxy服務(wù)端口會轉(zhuǎn)發(fā)請求到8090或者8100啄寡。

server端：

$ ./main -caroot ./ca.cer -key ./server.key -signcert ./server.cer
Server listen on 8080
2017/12/19 22:13:03 Entry SayHello
2017/12/19 22:13:03 Exit SayHello
2017/12/19 22:13:10 Entry SayHello
2017/12/19 22:13:10 Exit SayHello

client端：

$ # send HTTP request
$ curl http://localhost:8080/service/hello
{"hello":"world"}
$
$ # send HTTPS request
$ curl --cacert ./ca.cer --key ./client.key --cert ./client.cer https://localhost:8080/service/hello
{"hello":"world"}