Documentation
¶
Overview ¶
Package proxy implements the HTTP/HTTPS MITM proxy server.
This file (entry.go) contains the HTTP server entry point and request routing logic.
Overview ¶
The "entry" is the bridge between Go's standard HTTP server and the proxy's custom MITM logic. It serves as the initial request handler that routes traffic to appropriate handlers based on request type and configuration.
Architecture ¶
The entry system consists of three main components:
wrapListener: Wraps the TCP listener to intercept and prepare connections - Attaches connection context (ConnContext) to each client connection - Triggers ClientConnected addon events
entry: The HTTP server and request router - Implements http.Handler via ServeHTTP - Routes requests based on method and URL - Manages proxy lifecycle (start, shutdown, close)
Request handlers: Process different types of requests - ServeHTTP: Routes all incoming requests - handleConnect: Handles CONNECT requests for HTTPS tunneling - directTransfer: Transparent tunneling without interception - httpsDialFirstAttack: MITM with upstream-first connection - httpsDialLazyAttack: MITM with client-first connection
Request Flow ¶
HTTP Proxy Request:
Client → wrapListener → entry.ServeHTTP → attacker.Attack → Upstream
CONNECT Request (Non-Intercepted):
Client → wrapListener → entry.ServeHTTP → handleConnect → directTransfer → Upstream
CONNECT Request (Intercepted):
Client → wrapListener → entry.ServeHTTP → handleConnect → httpsDialLazyAttack → attacker → Upstream
Connection Context ¶
The entry system maintains connection-level state through ConnContext:
- Created by wrapListener.Accept() for each connection
- Attached to request context by entry.server.ConnContext
- Accessible throughout request lifecycle via proxycontext.GetConnContext()
- Contains client connection info, TLS state, interception settings, etc.
Interception Modes ¶
The proxy supports three modes for CONNECT requests:
Direct Transfer (shouldIntercept = false): - Transparent TCP tunnel without inspection - No certificate forgery - Minimal overhead
Lazy Attack (default, UpstreamCert = false): - Establishes client tunnel first - Peeks at traffic to detect protocol - Connects to upstream based on SNI
Dial-First Attack (UpstreamCert = true): - Connects to upstream first - Obtains real certificate - Creates matching fake certificate for client
Index ¶
- type Addon
- type BaseAddon
- type ClientConn
- type ClientFactory
- type Config
- type ConnContext
- type DefaultClientFactory
- type Flow
- type InstanceLogger
- type Proxy
- func (p *Proxy) AddAddon(addon Addon)
- func (p *Proxy) Close() error
- func (p *Proxy) GetCertificate() x509.Certificate
- func (p *Proxy) GetCertificateByCN(commonName string) (*tls.Certificate, error)
- func (p *Proxy) NotifyClientDisconnected(clientConn *conn.ClientConn)
- func (p *Proxy) NotifyServerDisconnected(connCtx *conn.Context)
- func (p *Proxy) SetAuthProxy(fn func(res http.ResponseWriter, req *http.Request) (bool, error))
- func (p *Proxy) SetShouldInterceptRule(rule func(req *http.Request) bool)
- func (p *Proxy) SetUpstreamProxy(fn func(req *http.Request) (*url.URL, error))
- func (p *Proxy) Shutdown(ctx context.Context) error
- func (p *Proxy) Start() error
- type Request
- type Response
- type ServerConn
- type UpstreamManager
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ClientFactory ¶
type ClientFactory = types.ClientFactory
ClientFactory is responsible for creating HTTP clients for different scenarios.
type Config ¶
type Config struct {
Addr string
StreamLargeBodies int64
InsecureSkipVerify bool
Upstream string
ClientFactory ClientFactory
}
Config holds the proxy configuration settings.
type DefaultClientFactory ¶
type DefaultClientFactory = types.DefaultClientFactory
DefaultClientFactory is the default implementation of ClientFactory.
func NewDefaultClientFactory ¶
func NewDefaultClientFactory() *DefaultClientFactory
NewDefaultClientFactory creates a new DefaultClientFactory.
type InstanceLogger ¶
type InstanceLogger struct {
InstanceID string
InstanceName string
Port string
LogFilePath string
// contains filtered or unexported fields
}
func NewInstanceLogger ¶
func NewInstanceLogger(addr, instanceName string) *InstanceLogger
NewInstanceLogger creates a logger with instance identification.
func NewInstanceLoggerWithFile ¶
func NewInstanceLoggerWithFile(addr, instanceName, logFilePath string) *InstanceLogger
NewInstanceLoggerWithFile creates a logger with instance identification and optional file output.
func (*InstanceLogger) GetLogger ¶
func (il *InstanceLogger) GetLogger() *slog.Logger
GetLogger returns the underlying slog logger.
func (*InstanceLogger) WithFields ¶
func (il *InstanceLogger) WithFields(args ...any) *slog.Logger
WithFields adds additional fields to the logger.
type Proxy ¶
type Proxy struct {
Version string
// contains filtered or unexported fields
}
func NewProxy ¶
NewProxy creates a new Proxy with the given configuration and CA. This function creates all internal dependencies with default settings.
func (*Proxy) GetCertificate ¶
func (p *Proxy) GetCertificate() x509.Certificate
func (*Proxy) GetCertificateByCN ¶
func (p *Proxy) GetCertificateByCN(commonName string) (*tls.Certificate, error)
func (*Proxy) NotifyClientDisconnected ¶
func (p *Proxy) NotifyClientDisconnected(clientConn *conn.ClientConn)
NotifyClientDisconnected implements conn.AddonNotifier interface.
func (*Proxy) NotifyServerDisconnected ¶
NotifyServerDisconnected implements conn.AddonNotifier interface.
func (*Proxy) SetAuthProxy ¶
func (*Proxy) SetShouldInterceptRule ¶
func (*Proxy) SetUpstreamProxy ¶
type UpstreamManager ¶
type UpstreamManager = types.UpstreamManager
UpstreamManager defines the interface for managing upstream proxy connections.
Source Files
Directories