Webhook support custom proxy (#8760)

* Webhook support custom proxy

* Add glob support on webhook proxy host rules

* fix app.ini.sample

* improve code and app.ini.sample

* update cheetsheet about added webhook options

diff --git a/custom/conf/app.ini.sample b/custom/conf/app.ini.sample
index 33cd0506ed4690f76725a671efb7de0b1235541c..17fcc0de23fea941beaf03550df0fabd79e803d5 100644 (file)
--- a/custom/conf/app.ini.sample
+++ b/custom/conf/app.ini.sample
@@ -511,6 +511,10 @@ DELIVER_TIMEOUT = 5
 SKIP_TLS_VERIFY = false
 ; Number of history information in each page
 PAGING_NUM = 10
+; Proxy server URL, support http://, https//, socks://, blank will follow environment http_proxy/https_proxy
+PROXY_URL = 
+; Comma separated list of host names requiring proxy. Glob patterns (*) are accepted; use ** to match all hosts.
+PROXY_HOSTS = 
 
 [mailer]
 ENABLED = false

diff --git a/docs/content/doc/advanced/config-cheat-sheet.en-us.md b/docs/content/doc/advanced/config-cheat-sheet.en-us.md
index 1e24255d8d78675f5fa2435b45d7f42c89cfc06e..96b529c0bc1588dd0389adafce18d52b836de241 100644 (file)
--- a/docs/content/doc/advanced/config-cheat-sheet.en-us.md
+++ b/docs/content/doc/advanced/config-cheat-sheet.en-us.md
@@ -312,6 +312,8 @@ relation to port exhaustion.
 - `DELIVER_TIMEOUT`: **5**: Delivery timeout (sec) for shooting webhooks.
 - `SKIP_TLS_VERIFY`: **false**: Allow insecure certification.
 - `PAGING_NUM`: **10**: Number of webhook history events that are shown in one page.
+- `PROXY_URL`: ****: Proxy server URL, support http://, https//, socks://, blank will follow environment http_proxy/https_proxy
+- `PROXY_HOSTS`: ****: Comma separated list of host names requiring proxy. Glob patterns (*) are accepted; use ** to match all hosts.
 
 ## Mailer (`mailer`)
 

diff --git a/docs/content/doc/advanced/config-cheat-sheet.zh-cn.md b/docs/content/doc/advanced/config-cheat-sheet.zh-cn.md
index 53426ed9834d97b338342e4c4434c8d045ec7ea6..b545d9a99d1f3129eefac6b7d448b755e5b215da 100644 (file)
--- a/docs/content/doc/advanced/config-cheat-sheet.zh-cn.md
+++ b/docs/content/doc/advanced/config-cheat-sheet.zh-cn.md
@@ -129,6 +129,8 @@ menu:
 - `DELIVER_TIMEOUT`: 请求webhooks的超时时间，单位秒。
 - `SKIP_TLS_VERIFY`: 是否允许不安全的证书。
 - `PAGING_NUM`: 每页显示的Webhook 历史数量。
+- `PROXY_URL`: ****: 代理服务器网址，支持 http://, https//, socks://, 为空将使用环境变量中的 http_proxy/https_proxy 设置。
+- `PROXY_HOSTS`: ****: 逗号分隔的需要代理的域名或IP地址。支持 * 号匹配符，使用 ** 匹配所有域名和IP地址。
 
 ## Mailer (`mailer`)
 

diff --git a/modules/setting/webhook.go b/modules/setting/webhook.go
index b0e7d66ad280463c078a7377d067b45d1d7d764a..4a953616f152428360979a716ef942da94023146 100644 (file)
--- a/modules/setting/webhook.go
+++ b/modules/setting/webhook.go
@@ -4,6 +4,12 @@
 
 package setting
 
+import (
+       "net/url"
+
+       "code.gitea.io/gitea/modules/log"
+)
+
 var (
        // Webhook settings
        Webhook = struct {
@@ -12,11 +18,16 @@ var (
                SkipTLSVerify  bool
                Types          []string
                PagingNum      int
+               ProxyURL       string
+               ProxyURLFixed  *url.URL
+               ProxyHosts     []string
        }{
                QueueLength:    1000,
                DeliverTimeout: 5,
                SkipTLSVerify:  false,
                PagingNum:      10,
+               ProxyURL:       "",
+               ProxyHosts:     []string{},
        }
 )
 
@@ -27,4 +38,14 @@ func newWebhookService() {
        Webhook.SkipTLSVerify = sec.Key("SKIP_TLS_VERIFY").MustBool()
        Webhook.Types = []string{"gitea", "gogs", "slack", "discord", "dingtalk", "telegram", "msteams"}
        Webhook.PagingNum = sec.Key("PAGING_NUM").MustInt(10)
+       Webhook.ProxyURL = sec.Key("PROXY_URL").MustString("")
+       if Webhook.ProxyURL != "" {
+               var err error
+               Webhook.ProxyURLFixed, err = url.Parse(Webhook.ProxyURL)
+               if err != nil {
+                       log.Error("Webhook PROXY_URL is not valid")
+                       Webhook.ProxyURL = ""
+               }
+       }
+       Webhook.ProxyHosts = sec.Key("PROXY_HOSTS").Strings(",")
 }

diff --git a/modules/webhook/deliver.go b/modules/webhook/deliver.go
index 54f20171fad60250addd59080b1f4eb57dc5b8db..b262505cead15b8f4357556dd25f0bf3def94aaa 100644 (file)
--- a/modules/webhook/deliver.go
+++ b/modules/webhook/deliver.go
@@ -12,11 +12,13 @@ import (
        "net/http"
        "net/url"
        "strings"
+       "sync"
        "time"
 
        "code.gitea.io/gitea/models"
        "code.gitea.io/gitea/modules/log"
        "code.gitea.io/gitea/modules/setting"
+       "github.com/gobwas/glob"
        "github.com/unknwon/com"
 )
 
@@ -182,7 +184,36 @@ func DeliverHooks() {
        }
 }
 
-var webhookHTTPClient *http.Client
+var (
+       webhookHTTPClient *http.Client
+       once              sync.Once
+       hostMatchers      []glob.Glob
+)
+
+func webhookProxy() func(req *http.Request) (*url.URL, error) {
+       if setting.Webhook.ProxyURL == "" {
+               return http.ProxyFromEnvironment
+       }
+
+       once.Do(func() {
+               for _, h := range setting.Webhook.ProxyHosts {
+                       if g, err := glob.Compile(h); err == nil {
+                               hostMatchers = append(hostMatchers, g)
+                       } else {
+                               log.Error("glob.Compile %s failed: %v", h, err)
+                       }
+               }
+       })
+
+       return func(req *http.Request) (*url.URL, error) {
+               for _, v := range hostMatchers {
+                       if v.Match(req.URL.Host) {
+                               return http.ProxyURL(setting.Webhook.ProxyURLFixed)(req)
+                       }
+               }
+               return http.ProxyFromEnvironment(req)
+       }
+}
 
 // InitDeliverHooks starts the hooks delivery thread
 func InitDeliverHooks() {
@@ -191,7 +222,7 @@ func InitDeliverHooks() {
        webhookHTTPClient = &http.Client{
                Transport: &http.Transport{
                        TLSClientConfig: &tls.Config{InsecureSkipVerify: setting.Webhook.SkipTLSVerify},
-                       Proxy:           http.ProxyFromEnvironment,
+                       Proxy:           webhookProxy(),
                        Dial: func(netw, addr string) (net.Conn, error) {
                                conn, err := net.DialTimeout(netw, addr, timeout)
                                if err != nil {
@@ -199,7 +230,6 @@ func InitDeliverHooks() {
                                }
 
                                return conn, conn.SetDeadline(time.Now().Add(timeout))
-
                        },
                },
        }

diff --git a/modules/webhook/deliver_test.go b/modules/webhook/deliver_test.go
new file mode 100644 (file)
index 0000000..cfc99d7
--- /dev/null
+++ b/modules/webhook/deliver_test.go
@@ -0,0 +1,39 @@
+// Copyright 2019 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package webhook
+
+import (
+       "net/http"
+       "net/url"
+       "testing"
+
+       "code.gitea.io/gitea/modules/setting"
+       "github.com/stretchr/testify/assert"
+)
+
+func TestWebhookProxy(t *testing.T) {
+       setting.Webhook.ProxyURL = "http://localhost:8080"
+       setting.Webhook.ProxyURLFixed, _ = url.Parse(setting.Webhook.ProxyURL)
+       setting.Webhook.ProxyHosts = []string{"*.discordapp.com", "discordapp.com"}
+
+       var kases = map[string]string{
+               "https://discordapp.com/api/webhooks/xxxxxxxxx/xxxxxxxxxxxxxxxxxxx": "http://localhost:8080",
+               "http://s.discordapp.com/assets/xxxxxx":                             "http://localhost:8080",
+               "http://github.com/a/b":                                             "",
+       }
+
+       for reqURL, proxyURL := range kases {
+               req, err := http.NewRequest("POST", reqURL, nil)
+               assert.NoError(t, err)
+
+               u, err := webhookProxy()(req)
+               assert.NoError(t, err)
+               if proxyURL == "" {
+                       assert.Nil(t, u)
+               } else {
+                       assert.EqualValues(t, proxyURL, u.String())
+               }
+       }
+}