I've spent some time this week playing with Canvas. I've setup an example that uses OAuth to authenticate and authorise the app; it then retrieves a record, and makes an update to the record from the app. This is done with the REST API.
Initially, I checked the links
property of the context, but it only lists the standard REST API endpoints. I then started to look for ways of calling custom web services. For ease, I started with a custom REST web service; it was not possible to call this even when using a c.instance.visual.force.com address, as that redirects to the standard instance.visual.force.com, and there's a access-control-allow-origin policy issue.
I thought for a moment about using events - creating an event in the app that's picked up in the page, which can then call logic in a controller. However, Canvas events seem to be geared at allowing cross-app communication, rather than app-to-host communication.
Am I missing something, or is Canvas currently just aimed at providing an easier entry point to the standard API options?
EDIT: Thanks to Andy for his quick response! He's correct in that you can craft a URL to point to the instance URL rather than a relative URL that's on the force.com domain. This would work from a server making a callout, and it does answer the original question; however, I'd be interested in other answers around making this work from within the app page (i.e. Javascript). Currently, the code in the accepted answer won't work as it does not allow calls to instance.salesforce.com from c.instance.visual.force.com.