proxy

package
v1.0.0-rc2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 19, 2026 License: AGPL-3.0 Imports: 31 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var InfraKey = deps.NewKey[*Infra]("proxy.infra")

InfraKey carries the long-lived proxy infrastructure from the assembly layer into the proxy command factory through the Deps bag.

Functions

This section is empty.

Types

type Command 

type Command struct {
	// contains filtered or unexported fields
}

func New 

func New(state *State) *Command

func (*Command) Name 

func (c *Command) Name() string

func (*Command) Run 

func (c *Command) Run(ctx context.Context, execution *commands.Execution) (_ any, err error)

func (*Command) SetCommandExecutor 

func (c *Command) SetCommandExecutor(fn CommandExecutor)

func (*Command) SetHub 

func (c *Command) SetHub(hub *ProxyHub)

func (*Command) Usage 

func (c *Command) Usage() string

type CommandExecutor 

type CommandExecutor func(ctx context.Context, tokens []string, execution *commands.Execution) (any, error)

type Flow 

type Flow struct {
	ID               int
	ToolID           string
	Timestamp        time.Time
	Method           string
	URL              string
	Host             string
	StatusCode       int
	ContentType      string
	Duration         time.Duration
	RequestHeaders   http.Header
	RequestBodySnip  []byte
	ResponseHeaders  http.Header
	ResponseBodySnip []byte
	TLS              bool
	Error            string
}

type FlowStore 

type FlowStore struct {
	// contains filtered or unexported fields
}

func NewFlowStore 

func NewFlowStore(cap int) *FlowStore

func (*FlowStore) Add 

func (s *FlowStore) Add(f Flow) Flow

Add stores f, assigns it a monotonic ID, and returns the stored copy so the caller can fan the ID-bearing flow out to subscribers.

func (*FlowStore) Clear 

func (s *FlowStore) Clear()

func (*FlowStore) Count 

func (s *FlowStore) Count() int

func (*FlowStore) Get 

func (s *FlowStore) Get(id int) *Flow

func (*FlowStore) Query 

func (s *FlowStore) Query(opts QueryOpts) []Flow

type Infra 

type Infra struct {
	State *State
	Store *FlowStore
	Hub   *ProxyHub
}

Infra bundles the runner-level proxy infrastructure that must exist BEFORE tool factories run: the egress State (source of truth), the shared capture FlowStore, and the long-lived MITM ProxyHub. Creating it up front lets the assembly set Deps.ScannerProxy to the stable hub address, so bash and every scanner engine route through the hub uniformly with no factory-order coupling.

func InstallInfra 

func InstallInfra(d *commands.Deps, capture bool) (*Infra, error)

InstallInfra creates and starts the proxy infrastructure, points Deps at the hub (ScannerProxy + ScannerProxyCA), and stores the Infra in the bag for the proxy factory. The originating Deps.ScannerProxy becomes the hub's default upstream, so tool → hub → configured-proxy holds. On hub start failure it leaves Deps unchanged (tools fall back to the original proxy / direct) and still returns the Infra so the factory can register verbs against the State.

capture selects the hub mode (see NewProxyHub): true records traffic (mitm on), false is a pure routing relay (mitm off). Routing works in both, so `proxy` keeps managing egress either way; only capture is gated.

type MitmCommand 

type MitmCommand struct {
	// contains filtered or unexported fields
}

func NewMitmCommand 

func NewMitmCommand(reg *commands.CommandRegistry, store *FlowStore, hub *ProxyHub) *MitmCommand

NewMitmCommand wires the mitm verbs to the long-lived hub's shared FlowStore so `mitm flows/analyze/flow` query traffic captured from every tool, not just a per-invocation proxy.

func (*MitmCommand) Name 

func (c *MitmCommand) Name() string

func (*MitmCommand) Run 

func (c *MitmCommand) Run(ctx context.Context, execution *commands.Execution) (_ any, err error)

func (*MitmCommand) SetCommandExecutor 

func (c *MitmCommand) SetCommandExecutor(fn CommandExecutor)

func (*MitmCommand) Usage 

func (c *MitmCommand) Usage() string

type ProxyHub 

type ProxyHub struct {
	// contains filtered or unexported fields
}

ProxyHub is the runner-level, long-lived MITM proxy that every tool routes through. It is the STABLE front hop: its local address is injected once into child process env and in-process HTTP clients and never changes. The DYNAMIC back hop — the actual egress proxy chain — lives in State and is swapped live via State.CurrentDial(), which hub.dial reads on every connection. Switching proxy nodes therefore takes effect immediately without re-injecting anything into already-running children.

hub.dial is installed as mitmproxy Options.Dialer so it covers plain HTTP as well as HTTPS/CONNECT (see the local mitmproxy fork patch adding that field).

func NewProxyHub 

func NewProxyHub(state *State, store *FlowStore, caRootPath string, capture bool) *ProxyHub

NewProxyHub builds the hub around an existing State (egress source of truth) and FlowStore (capture sink). Both are owned by the caller so the mitm query verbs and the hub share one store.

capture selects the mode. The hub is ALWAYS the routing substrate — tools route through it and `proxy switch` swaps its upstream live in either mode.

  • capture=true (mitm on): intercept + record HTTPS (MITM) and HTTP flows.
  • capture=false (mitm off): pure relay — no interception, no recording, no CA needed. Routing still works; nothing is decrypted or stored.

Start must be called before use.

func (*ProxyHub) CAPath 

func (h *ProxyHub) CAPath() string

CAPath is the exported CA PEM path to advertise to children, or "" when the hub is not currently MITM-decrypting HTTPS. It returns a path only while capture and decrypt are both on: a child must trust the hub's CA exactly when the hub forges certificates for it, and must not when HTTPS is tunneled (a CA-only bundle would then fail to validate the real server certificate).

func (*ProxyHub) Capturing 

func (h *ProxyHub) Capturing() bool

Capturing reports whether the hub currently records traffic (mitm on) or only relays.

func (*ProxyHub) ProxyURL 

func (h *ProxyHub) ProxyURL() string

ProxyURL is the stable http:// address injected into children and in-process clients. Empty until Start succeeds.

func (*ProxyHub) SetCapture 

func (h *ProxyHub) SetCapture(record, decryptHTTPS bool)

SetCapture toggles capture at runtime without restarting the listener. record gates storing/streaming; decryptHTTPS gates HTTPS MITM interception, which only affects connections opened after the change because a child's CA trust is fixed at spawn time.

func (*ProxyHub) Shutdown 

func (h *ProxyHub) Shutdown(ctx context.Context)

Shutdown stops the listener. Safe to call on a never-started hub.

func (*ProxyHub) Start 

func (h *ProxyHub) Start(caRootPath string) error

Start brings up the MITM listener on an ephemeral loopback port and exports the CA certificate so external processes can trust intercepted HTTPS. It is idempotent: repeated calls return the first outcome.

func (*ProxyHub) Store 

func (h *ProxyHub) Store() *FlowStore

func (*ProxyHub) Subscribe 

func (h *ProxyHub) Subscribe(buffer int) (<-chan *traffic.Flow, func())

type QueryOpts 

type QueryOpts struct {
	Host   string
	Status string
	CType  string
	Last   int
}

type State 

type State struct {
	// contains filtered or unexported fields
}

func NewState 

func NewState(originalProxy string) *State

func (*State) ActiveNodeName 

func (s *State) ActiveNodeName() string

func (*State) ActiveProxy 

func (s *State) ActiveProxy() string

func (*State) Clear 

func (s *State) Clear()

func (*State) CurrentDial 

func (s *State) CurrentDial() proxyclient.Dial

func (*State) IsAutoMode 

func (s *State) IsAutoMode() bool

func (*State) LoadSubscription 

func (s *State) LoadSubscription(sub *clash.Subscription, subscribeURL string)

func (*State) Nodes 

func (s *State) Nodes() []clash.ProxyNode

func (*State) OriginalProxy 

func (s *State) OriginalProxy() string

func (*State) SetAutoDial 

func (s *State) SetAutoDial(clashURL string, dial proxyclient.Dial)

func (*State) SetProxyURL 

func (s *State) SetProxyURL(rawURL string) error

SetProxyURL routes egress through a single persistent proxy URL (socks5://, trojan://, …). Unlike WithOverrideDial it is not scoped to one command; it stays the active egress until changed or cleared.

func (*State) Switch 

func (s *State) Switch(nameOrIndex string) error

func (*State) TestNode 

func (s *State) TestNode(ctx context.Context, node *clash.ProxyNode) (time.Duration, error)

func (*State) WithOverrideDial 

func (s *State) WithOverrideDial(proxyURL string) (func(), error)

type TrafficHandler 

type TrafficHandler struct {
	// contains filtered or unexported fields
}

TrafficHandler bridges the AOP traffic namespace to the runner's traffic infrastructure: it applies Configure (routing + capture) against State/Hub, answers Query with a State snapshot or recorded flows, and streams captured flows back while a stream is requested. One handler is created per connection so its stream lifecycle is tied to that connection.

func NewTrafficHandler 

func NewTrafficHandler(infra *Infra) *TrafficHandler

NewTrafficHandler returns a handler backed by infra. infra must be non-nil and fully started (hub listening).

func (*TrafficHandler) Close 

func (h *TrafficHandler) Close()

Close tears down any active stream. Call when the connection ends.

func (*TrafficHandler) Register 

func (h *TrafficHandler) Register(mux *aop.NamespaceMux) error

Register installs the traffic namespace on mux. The returned mux routes traffic.ProtocolMessage envelopes to this handler.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.