Method handleProxy

tunnelproxy/proxy.go:172–225

handleProxy is the client side of the Tunnel (on public network).

(session sockjs.Session, req *http.Request)

// handleProxy is the client side of the Tunnel (on public network).
func (p *Proxy) handleProxy(session sockjs.Session, req *http.Request) {
	const ttl = time.Duration(1 * time.Hour)
	const leeway = time.Duration(1 * time.Minute)

	kiteID := req.URL.Query().Get("kiteID")

	client, ok := p.kites[kiteID]
	if !ok {
		p.Kite.Log.Error("Remote kite is not found: %s", req.URL.String())
		return
	}

	// TODO(rjeczalik): keep *rsa.PrivateKey in Proxy struct
	rsaPrivate, err := jwt.ParseRSAPrivateKeyFromPEM([]byte(p.privKey))
	if err != nil {
		p.Kite.Log.Error("key pair encrypt error: %s", err)
		return
	}

	tunnel := client.newTunnel(session)
	defer tunnel.Close()

	claims := jwt.MapClaims{
		"sub": client.ID,                                    // kite ID
		"seq": tunnel.id,                                    // tunnel number
		"iat": time.Now().UTC().Unix(),                      // Issued At
		"exp": time.Now().UTC().Add(ttl).Add(leeway).Unix(), // Expiration Time
		"nbf": time.Now().UTC().Add(-leeway).Unix(),         // Not Before
	}

	signed, err := jwt.NewWithClaims(jwt.GetSigningMethod("RS256"), claims).SignedString(rsaPrivate)
	if err != nil {
		p.Kite.Log.Error("Cannot sign token: %s", err.Error())
		return
	}

	tunnelURL := *p.url
	tunnelURL.Path = "/tunnel" + strings.TrimPrefix(req.URL.Path, "/proxy")
	tunnelURL.RawQuery = "token=" + signed

	_, err = client.TellWithTimeout("kite.tunnel",
		4*time.Second, map[string]string{"url": tunnelURL.String()})
	if err != nil {
		p.Kite.Log.Error("Cannot open tunnel to the kite: %s err: %s", client.Kite, err.Error())
		return
	}

	select {
	case <-tunnel.StartNotify():
		<-tunnel.CloseNotify()
	case <-time.After(1 * time.Minute):
		p.Kite.Log.Error("timeout")
	}
}

// handleTunnel is the PrivateKite side of the Tunnel (on private network).
func (p *Proxy) handleTunnel(session sockjs.Session, req *http.Request) {