Documentation
¶
Overview ¶
Package proxy is an HTTP proxy that re-originates every request with a browser's TLS fingerprint.
It intercepts rather than tunnels, and that is the whole point. A proxy that answers CONNECT by piping bytes leaves the client's own TLS to reach the destination, so the destination sees the client's handshake — Go's, Python's, curl's — and the fingerprint has not changed at all. To replace it, the proxy has to terminate TLS itself, which means presenting a certificate for the requested host, which means signing with an authority the client trusts.
That is the cost, and it is not hidden: `tls-forge proxy` writes its authority to a file and prints where. Trusting it is a real decision, because anything holding that key can impersonate every site to anyone who trusts it.
Index ¶
Constants ¶
const DefaultMaxRequestBody int64 = 16 << 20
DefaultMaxRequestBody is large enough for ordinary browser traffic while preventing an exposed proxy from buffering an unbounded upload in memory.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CA ¶
type CA struct {
// contains filtered or unexported fields
}
CA is a certificate authority and the leaf certificates it has minted.
func LoadOrCreateCA ¶
LoadOrCreateCA reads the authority from certFile and keyFile, generating a new one only when both are missing. An incomplete pair is an error: silently replacing the surviving half would invalidate a certificate somebody may already trust.
type Client ¶
type Client interface {
Do(*tlsforge.Request) (*tlsforge.Response, error)
Headers() tlsforge.Header
}
Client is the part of *tlsforge.Client the proxy needs, named so tests can answer without opening a socket.
type Options ¶
type Options struct {
// Addr to listen on. Defaults to 127.0.0.1:0.
Addr string
// CA signs the per-host certificates. Required.
CA *CA
// Client performs the outbound requests. Required.
Client Client
// MaxRequestBody bounds the body buffered before it is re-issued. Zero uses
// DefaultMaxRequestBody.
MaxRequestBody int64
// OnError receives per-connection failures. A proxy that printed them to
// stdout would corrupt nothing, but a caller that wants them quiet should
// not have to redirect a stream.
OnError func(error)
}
Options configure a Server.
Source Files