Documentation
¶
Index ¶
- type EarlyAdapter
- type EarlyClaimCtx
- type Registry
- func (r *Registry) ClaimUpgrade(c *UpgradeClaimCtx) (UpgradeAdapter, bool)
- func (r *Registry) DispatchEarly(ctx context.Context, c *EarlyClaimCtx)
- func (r *Registry) InsertEarly(a EarlyAdapter)
- func (r *Registry) InsertUpgrade(a UpgradeAdapter)
- func (r *Registry) MatchTLS(sni, host string, port int) (TLSEarlyAdapter, bool)
- func (r *Registry) RemoveEarly(name string)
- func (r *Registry) RemoveUpgrade(name string)
- type TLSEarlyAdapter
- type UpgradeAdapter
- type UpgradeClaimCtx
- type UpgradeConns
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type EarlyAdapter ¶
type EarlyAdapter interface {
Name() string
// ClaimEarly reports whether this adapter takes the connection.
ClaimEarly(c *EarlyClaimCtx) bool
// ServeEarly drives the connection; called only when ClaimEarly returned true.
ServeEarly(ctx context.Context, c *EarlyClaimCtx)
}
EarlyAdapter claims and serves a freshly accepted byte stream.
type EarlyClaimCtx ¶
type EarlyClaimCtx struct {
// Peek holds the opening bytes from ClientReader; nil for a post-CONNECT stream.
Peek []byte
// TLSTerminated is true for a decrypted post-CONNECT stream.
TLSTerminated bool
// ALPN is the negotiated protocol ("h2"/"http/1.1"/""); empty at raw accept.
ALPN string
// Target is the fixed upstream for a post-CONNECT stream; nil at raw accept.
Target *types.Target
ClientConn net.Conn
ClientReader *bufio.Reader
// UpstreamConn and UpstreamReader are pre-dialed for a post-CONNECT stream; nil at raw accept.
UpstreamConn net.Conn
UpstreamReader *bufio.Reader
}
EarlyClaimCtx is the byte stream offered to early adapters at accept time: a raw TCP connection, or a TLS-decrypted post-CONNECT stream when TLSTerminated.
type Registry ¶
type Registry struct {
Early []EarlyAdapter
Upgrade []UpgradeAdapter
// contains filtered or unexported fields
}
Registry holds the ordered claim seams for the native proxy backend; first claim wins. The fallthrough early adapter (ClaimEarly always true) must be last. Sidecar bridges are inserted and removed at runtime, so access is guarded.
func (*Registry) ClaimUpgrade ¶
func (r *Registry) ClaimUpgrade(c *UpgradeClaimCtx) (UpgradeAdapter, bool)
ClaimUpgrade returns the first upgrade adapter that claims the parsed request.
func (*Registry) DispatchEarly ¶
func (r *Registry) DispatchEarly(ctx context.Context, c *EarlyClaimCtx)
DispatchEarly serves the connection with the first early adapter that claims it.
func (*Registry) InsertEarly ¶
func (r *Registry) InsertEarly(a EarlyAdapter)
InsertEarly adds an early adapter ahead of the trailing fallthrough so it is evaluated before the built-in HTTP adapters. A nil or empty list appends.
func (*Registry) InsertUpgrade ¶
func (r *Registry) InsertUpgrade(a UpgradeAdapter)
InsertUpgrade adds an upgrade adapter at the front so sidecar claims are evaluated before the built-in WebSocket adapter. Callers insert in most-specific-first order.
func (*Registry) MatchTLS ¶
func (r *Registry) MatchTLS(sni, host string, port int) (TLSEarlyAdapter, bool)
MatchTLS returns the first TLS early adapter that claims a connection by its ClientHello SNI and CONNECT target, before TLS termination.
func (*Registry) RemoveEarly ¶
RemoveEarly drops the early adapter with the given name.
func (*Registry) RemoveUpgrade ¶
RemoveUpgrade drops the upgrade adapter with the given name.
type TLSEarlyAdapter ¶
type TLSEarlyAdapter interface {
EarlyAdapter
ClaimTLS(sni, host string, port int) bool
}
TLSEarlyAdapter gates a TLS connection before termination, by the ClientHello SNI and the CONNECT target. Implemented by sidecar bridges whose early claim sets tls.terminate; the connect handler MITMs a matched connection with the fake CA and re-offers the decrypted stream through ServeEarly.
type UpgradeAdapter ¶
type UpgradeAdapter interface {
Name() string
// ClaimUpgrade reports whether this adapter takes the upgraded connection.
ClaimUpgrade(c *UpgradeClaimCtx) bool
// ServeUpgrade drives the connection; called only when ClaimUpgrade returned true.
ServeUpgrade(ctx context.Context, c *UpgradeClaimCtx, conns UpgradeConns)
}
UpgradeAdapter claims and serves a connection after an HTTP/1.x upgrade signal.
type UpgradeClaimCtx ¶
type UpgradeClaimCtx struct {
Req *types.RawHTTP1Request
Target *types.Target
// Signal is the upgrade signal driving this claim: "http_101" after a parsed
// upgrade request, or "connect" after a CONNECT tunnel is established.
Signal string
}
UpgradeClaimCtx is the parsed HTTP/1.x request offered to upgrade adapters.
type UpgradeConns ¶
type UpgradeConns struct {
ClientConn net.Conn
ClientReader *bufio.Reader
// UpstreamConn and UpstreamReader are non-nil on the TLS path (reusing the
// existing upstream) and nil on the plain path (the adapter dials its own).
UpstreamConn net.Conn
UpstreamReader *bufio.Reader
}
UpgradeConns are the connections handed to an upgrade adapter when it serves.