Documentation
¶
Overview ¶
Package proxy implements HTTP CONNECT method for tunneling HTTPS traffic through a proxy.
HTTP CONNECT Method Overview ¶
The HTTP CONNECT method is used to establish a tunnel through a proxy server. This is essential for HTTPS proxying because HTTPS requires end-to-end encryption that cannot be inspected or modified by intermediaries.
How HTTP_PROXY Works
When a client is configured to use an HTTP proxy (via HTTP_PROXY environment variable or proxy settings), it behaves differently for HTTP vs HTTPS requests:
HTTP requests: The client sends the full request to the proxy, including the complete URL. The proxy forwards it to the destination server.
HTTPS requests: The client cannot send the encrypted request directly because the proxy needs to know where to connect. Instead, the client uses CONNECT to establish a tunnel, then performs the TLS handshake and sends HTTPS requests through that tunnel.
Non-Transparent Proxy ¶
This proxy is "non-transparent" because:
- Clients must be explicitly configured to use it (via HTTP_PROXY)
- Clients send CONNECT requests for HTTPS traffic
- The proxy terminates TLS, inspects requests, and re-encrypts to the destination
- Each HTTP request inside the tunnel is processed separately with rule evaluation
CONNECT Request Flow ¶
The following diagram illustrates how CONNECT works:
Client Proxy (HTTP/1.1 Server) Real Server | | | |-- CONNECT example.com:443 -->| | | | | |<-- 200 Connection Established| | | | | |-- TLS Handshake ------------->| | | | | |<-- TLS Handshake -------------| | | | | |-- Request #1: GET /page1 --->| (decrypts) | | |-- GET /page1 --------------------->| | |<-- Response #1 --------------------| |<-- Response #1 --------------| (encrypts) | | | | |-- Request #2: GET /page2 --->| (decrypts) | | |-- GET /page2 --------------------->| | |<-- Response #2 --------------------| |<-- Response #2 --------------| (encrypts) | | | | |-- Request #3: GET /api ----->| (decrypts) | | |-- GET /api ----------------------->| | |<-- Response #3 --------------------| |<-- Response #3 --------------| (encrypts) | | | | | (connection stays open...) | | | | | |-- [closes connection] ------->| |
Key Points:
- CONNECT establishes the tunnel endpoint (e.g., "example.com:443")
- The actual destination for each request is determined by the Host header in the HTTP request inside the tunnel, not the CONNECT target
- The proxy acts as a TLS server to decrypt traffic from the client
- Each HTTP request inside the tunnel is evaluated against rules separately
- The connection remains open for multiple requests (HTTP/1.1 keep-alive)
Implementation Details:
- handleCONNECT: Receives the CONNECT request, sends "200 Connection Established"
- handleCONNECTTunnel: Wraps the connection with TLS, processes requests in a loop
- Each request uses req.Host to determine the actual destination, not the CONNECT target
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
HTTPPort int
RuleEngine rulesengine.Engine
Auditor audit.Auditor
Logger *slog.Logger
TLSConfig *tls.Config
PprofEnabled bool
PprofPort int
}
Config holds configuration for the proxy server
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server handles HTTP and HTTPS requests with rule-based filtering
func NewProxyServer ¶
NewProxyServer creates a new proxy server instance
Source Files