Add support for client identities in http requests

netstack2/http_handler.go

@@ -78,6 +78,10 @@ type HTTPHandler struct {
 	// silently dropping every connection.
 	fallbackTLSOnce sync.Once
 	fallbackTLSCfg  *tls.Config
+
+	// identities maps client tunnel IPs to the user or machine behind them,
+	// used to set Remote-* headers on proxied requests.
+	identities clientIdentityStore
 }
 
 // ---------------------------------------------------------------------------
@@ -169,6 +173,16 @@ func NewHTTPHandler(s *stack.Stack, ph *ProxyHandler) *HTTPHandler {
 	}
 }
 
+// ReplaceClientIdentities replaces the full set of known client identities.
+func (h *HTTPHandler) ReplaceClientIdentities(ids []ClientIdentity) {
+	h.identities.replace(ids)
+}
+
+// AddClientIdentities adds or overwrites the given client identities.
+func (h *HTTPHandler) AddClientIdentities(ids []ClientIdentity) {
+	h.identities.upsert(ids)
+}
+
 // SetRequestLogger attaches an HTTPRequestLogger so that every proxied request
 // is recorded and periodically shipped to the server.
 func (h *HTTPHandler) SetRequestLogger(rl *HTTPRequestLogger) {
@@ -387,6 +401,8 @@ func (h *HTTPHandler) getProxy(target HTTPTarget) *httputil.ReverseProxy {
 			if isTLS, _ := pr.In.Context().Value(connTLSKey{}).(bool); isTLS {
 				pr.Out.Header.Set("X-Forwarded-Proto", "https")
 			}
+
+			h.identities.setRemoteHeaders(pr.Out.Header, pr.In.RemoteAddr)
 		},
 		Transport: transport,
 	}