[Question] Hook to rewrite requests and responses

[Shine-neko]

Context
I'm building a proxy based on sozu (called Sozune) and would like to intercept HTTP requests and responses to modify them before they are sent or received.

Need
I'm looking for a simple way to add a hook or extension point to:

rewrite or modify requests (path, headers, etc.) before routing;

rewrite or modify responses (headers, status, etc.) before sending them back to the client.

Ideally, this would just allow plugging a function or callback at those two stages in the pipeline.

any idea?

[Wonshtrum]

Hi! Thanks for your interest in Sozu.
Unfortunately, Sozu currently doesn't have hooks to customize its behavior.

rewrite or modify requests (path, headers, etc.) before routing;
rewrite or modify responses (headers, status, etc.) before sending them back to the client.

The closest thing to what you describe is what's developed in #1162 (see #1161), which includes URL rewriting and header editing on requests/responses on every frontend. But there is no logic, you can only add constant headers and rewrite URL using regex captures and templating.

Ideally, this would just allow plugging a function or callback at those two stages in the pipeline.

Sozu technically has explicitely those hooks internally:

sozu/lib/src/protocol/kawa_h1/editor.rs

Line 80 in 85bc468

fn on_request_headers(&mut self, request: &mut GenericHttpStream) {

sozu/lib/src/protocol/kawa_h1/editor.rs

Line 278 in 85bc468

fn on_response_headers(&mut self, response: &mut GenericHttpStream) {

That's where it processes and generates the forwarding headers and add the Sozu-id. However, requests goes through this before they are linked to a cluster/frontend, so if you want to add custom logic per frontend or per cluster, it would be hard here. You can look how it is done in #1162:

sozu/lib/src/protocol/kawa_h1/mod.rs

Lines 1262 to 1403 in 448ece3

	let RouteResult {
	cluster_id,
	required_auth,
	redirect,
	redirect_scheme,
	redirect_template,
	rewritten_host,
	rewritten_path,
	rewritten_port,
	headers_request,
	headers_response,
	tags,
	} = match route_result {
	Ok(route) => route,
	Err(frontend_error) => {
	self.set_answer(DefaultAnswer::Answer404 {});
	return Err(RetrieveClusterError::RetrieveFrontend(frontend_error));
	}
	};
	self.context.cluster_id = cluster_id;
	self.context.headers_response = headers_response;
	self.context.tags = tags;
	let cluster_id = &self.context.cluster_id;
	if let Some(cluster_id) = cluster_id {
	time!(
	"frontend_matching_time",
	cluster_id,
	start.elapsed().as_millis()
	);
	}
	let body = if let Some(position) = self.context.last_header {
	self.request_stream.blocks.split_off(position)
	} else {
	unreachable!();
	};
	match &mut self.request_stream.detached.status_line {
	kawa::StatusLine::Request { authority, uri, .. } => {
	let buf = self.request_stream.storage.mut_buffer();
	if let Some(new) = &rewritten_host {
	authority.modify(buf, new.as_bytes());
	self.request_stream
	.blocks
	.push_back(kawa::Block::Header(kawa::Pair {
	key: kawa::Store::Static(b"X-Forwarded-Host"),
	val: kawa::Store::from_slice(host.as_bytes()),
	}));
	}
	if let Some(new) = &rewritten_path {
	uri.modify(buf, new.as_bytes());
	}
	}
	_ => unreachable!(),
	}
	let host = rewritten_host.as_deref().unwrap_or(host);
	let path = rewritten_path.as_deref().unwrap_or(path);
	let is_https = matches!(proxy.borrow().kind(), ListenerType::Https);
	let proto = match (redirect_scheme, is_https) {
	(RedirectScheme::UseHttp, _) | (RedirectScheme::UseSame, false) => "http",
	(RedirectScheme::UseHttps, _) | (RedirectScheme::UseSame, true) => "https",
	};
	let (authorized, www_authenticate, https_redirect, https_redirect_port) =
	match (&cluster_id, redirect, &redirect_template, required_auth) {
	// unauthorized frontends
	(_, RedirectPolicy::Unauthorized, _, _) => (false, None, false, None),
	// forward frontends with no target (no cluster nor template)
	(None, RedirectPolicy::Forward, None, _) => (false, None, false, None),
	// clusterless frontend with auth (unsupported)
	(None, _, _, true) => (false, None, false, None),
	// clusterless frontends
	(None, _, _, false) => (true, None, false, None),
	// "attached" frontends
	(Some(cluster_id), _, _, _) => {
	proxy.borrow().clusters().get(cluster_id).map_or(
	(true, None, false, None), // cluster not found, consider authorized?
	|cluster| {
	let authorized =
	match (required_auth, &self.context.authorization_found) {
	// auth not required
	(false, _) => true,
	// no auth found
	(true, None) => false,
	// validation
	(true, Some(hash)) => {
	println!("{hash:?}");
	cluster.authorized_hashes.contains(hash)
	}
	};
	(
	authorized,
	cluster.www_authenticate.clone(),
	cluster.https_redirect,
	cluster.https_redirect_port,
	)
	},
	)
	}
	};
	let port = match (
	port,
	rewritten_port,
	https_redirect_port,
	!is_https && https_redirect,
	) {
	(_, Some(port), _, _) => format!(":{port}"),
	(_, _, Some(port), true) => format!(":{port}"),
	(Some(port), _, _, _) => format!(":{}", unsafe { from_utf8_unchecked(port) }),
	_ => String::new(),
	};
	match (cluster_id, redirect, redirect_template, authorized) {
	(_, RedirectPolicy::Permanent, _, true) => {
	let location = format!("{proto}://{host}{port}{path}");
	self.set_answer(DefaultAnswer::Answer301 { location });
	Err(RetrieveClusterError::Redirected)
	}
	(_, RedirectPolicy::Forward, Some(name), true) => {
	let location = format!("{proto}://{host}{port}{path}");
	self.set_answer(DefaultAnswer::AnswerCustom { name, location });
	Err(RetrieveClusterError::Redirected)
	}
	(Some(cluster_id), RedirectPolicy::Forward, None, true) => {
	if !is_https && https_redirect {
	let location = format!("https://{host}{port}{path}");
	self.set_answer(DefaultAnswer::Answer301 { location });
	return Err(RetrieveClusterError::Redirected);
	}
	apply_header_edits(&mut self.request_stream, headers_request);
	self.request_stream.blocks.extend(body);
	Ok(cluster_id.clone())
	}
	_ => {
	self.set_answer(DefaultAnswer::Answer401 { www_authenticate });
	Err(RetrieveClusterError::UnauthorizedRoute)
	}
	}
	}

Responses are necessarily handled after the cluster/frontend was selected, so, if the context was populated with the relevant information, you can use this directly, like here for example:

sozu/lib/src/protocol/kawa_h1/editor.rs

Line 384 in 448ece3

apply_header_edits(response, self.headers_response.clone());

I really want Sozu to expose this kind of customisable hooks in the future, your feedback on how you would like it to be done, and what you think of the current code paths would be greatly appreciated.