go语言实现一个端口同时支持HTTP和HTTPS REST API
go语言的http.Server模块能够提供HTTP服务和HTTPS服务，但是对同一个端口只能要么提供HTTP服务，要么提供HTTPS服务，不能同时提供服务。
我们提供的办法是使用一个公共的端口作为监听，然后让HTTP和HTTPS服务分别监听在各自的端口上，在公共端口服务区分这是HTTP请求还是HTTPS请求，各自转发到所服务的监听。
proxy.jpg
完整代码如下
package main
import (
"os"
"fmt"
"log"
"net"
"flag"
"bytes"
"net/http"
"io/ioutil"
"crypto/tls"
"crypto/x509"
"encoding/json"
"github.com/gorilla/mux"
)
var (
port int
caroots string
keyfile string
signcert string
)
func init() {
flag.IntVar(&port, "port", 8080, "The host port on which the REST server will listen")
flag.StringVar(&caroots, "caroot", "", "Path to file containing PEM-encoded trusted certificate(s) for clients")
flag.StringVar(&keyfile, "key", "", "Path to file containing PEM-encoded key file for service")
flag.StringVar(&signcert, "signcert", "", "Path to file containing PEM-encoded sign certificate for service")
}
// Start a proxy server listen on listenport
// This proxy will forward all HTTP request to httpport, and all HTTPS request to httpsport
func proxyStart(listenport, httpport, httpsport int) {
proxylistener, err := net.Listen("tcp", fmt.Sprintf(":%d", listenport))
if err != nil {
fmt.Println("Unable to listen on: %d, error: %s\n", listenport, err.Error())
os.Exit(1)
}
defer proxylistener.Close()
for {
proxyconn, err := proxylistener.Accept()
if err != nil {
fmt.Printf("Unable to accept a request, error: %s\n", err.Error())
continue
}
// Read a header firstly in case you could have opportunity to check request
// whether to decline or proceed the request
buffer := make([]byte, 1024)
n, err := proxyconn.Read(buffer)
if err != nil {
//fmt.Printf("Unable to read from input, error: %s\n", err.Error())
continue
}
var targetport int
if isHTTPRequest(buffer) {
targetport = httpport
} else {
targetport = httpsport
}
targetconn, err := net.Dial("tcp", fmt.Sprintf("localhost:%d", targetport))
if err != nil {
fmt.Println("Unable to connect to: %d, error: %s\n", targetport, err.Error())
proxyconn.Close()
continue
}
n, err = targetconn.Write(buffer[:n])
if err != nil {
fmt.Printf("Unable to write to output, error: %s\n", err.Error())
proxyconn.Close()
targetconn.Close()
continue
}
go proxyRequest(proxyconn, targetconn)
go proxyRequest(targetconn, proxyconn)
}
}
// Forward all requests from r to w
func proxyRequest(r net.Conn, w net.Conn) {
defer r.Close()
defer w.Close()
var buffer = make([]byte, 4096000)
for {
n, err := r.Read(buffer)
if err != nil {
//fmt.Printf("Unable to read from input, error: %s\n", err.Error())
break
}
n, err = w.Write(buffer[:n])
if err != nil {
fmt.Printf("Unable to write to output, error: %s\n", err.Error())
break
}
}
}
func isHTTPRequest(buffer []byte) bool {
httpMethod := []string{"GET", "PUT", "HEAD", "POST", "DELETE", "PATCH", "OPTIONS"}
for cnt := 0; cnt < len(httpMethod); cnt++ {
if bytes.HasPrefix(buffer, []byte(httpMethod[cnt])) {
return true
}
}
return false
}
func startHTTPSServer(address string, router *mux.Router, caroots string, keyfile string, signcert string) {
pool := x509.NewCertPool()
caCrt, err := ioutil.ReadFile(caroots)
if err != nil {
log.Fatalln("ReadFile err:", err)
}
pool.AppendCertsFromPEM(caCrt)
s := &http.Server{
Addr: address,
Handler: router,
TLSConfig: &tls.Config{
MinVersion: tls.VersionTLS12,
ClientCAs: pool,
ClientAuth: tls.RequireAndVerifyClientCert,
},
}
err = s.ListenAndServeTLS(signcert, keyfile)
if err != nil {
log.Fatalln("ListenAndServeTLS err:", err)
}
}
func startHTTPServer(address string, router *mux.Router) {
err := http.ListenAndServe(address, router)
if err != nil {
log.Fatalln("ListenAndServe err:", err)
}
}
func SayHello(w http.ResponseWriter, r *http.Request) {
log.Println("Entry SayHello")
res := map[string]string {"hello": "world"}
b, err := json.Marshal(res)
if err == nil {
w.WriteHeader(http.StatusOK)
w.Header().Set("Content-Type", "application/json")
w.Write(b)
}
log.Println("Exit SayHello")
}
func main() {
flag.Parse()
fmt.Println("Server listen on", port)
router := mux.NewRouter().StrictSlash(true)
router.HandleFunc("/service/hello", SayHello).Methods("GET")
listenport, httpport, httpsport := port, port + 10, port + 20
go startHTTPServer (fmt.Sprintf("localhost:%d", httpport), router)
go startHTTPSServer(fmt.Sprintf("localhost:%d", httpsport), router, caroots, keyfile, signcert)
proxyStart(listenport, httpport, httpsport)
fmt.Println("Exit main")
}
上述例子中，服务端口监听在8080，然后我们为HTTP服务监听在8090，HTTPS监听在8100端口，这样所有的外部访问都只需要访问8080端口即可，proxy服务端口会转发请求到8090或者8100。
server端：
$ ./main -caroot ./ca.cer -key ./server.key -signcert ./server.cer
Server listen on 8080
2017/12/19 22:13:03 Entry SayHello
2017/12/19 22:13:03 Exit SayHello
2017/12/19 22:13:10 Entry SayHello
2017/12/19 22:13:10 Exit SayHello
client端：
$ # send HTTP request
$ curl http://localhost:8080/service/hello
{"hello":"world"}
$
$ # send HTTPS request
$ curl --cacert ./ca.cer --key ./client.key --cert ./client.cer https://localhost:8080/service/hello
{"hello":"world"}