proxy

Documentation

Overview

Package proxy implements the core HTTP/HTTPS proxy server with TLS interception and SNI modification capabilities. It handles CONNECT tunneling, direct forwarding, and certificate management for MITM decryption.

Index

• func MatchHostname(cert *x509.Certificate, hostname string, policy rules.CertPolicy) bool
• func ParseSNI(data []byte) (string, error)
• func TryModifySNI(data []byte, old, new string) []byte
• func VerifyCert(conn TLSConnection, host, targetSNI string, policy rules.CertPolicy, ...) bool
• type CertificateManager
• type ProxyServer
  • func NewProxyServer(cfg *config.Config, rules *rules.Rules, ca CertificateManager, ...) *ProxyServer
  • func (s *ProxyServer) Listen() error
  • func (s *ProxyServer) Serve() error
  • func (s *ProxyServer) ServeHTTP(w http.ResponseWriter, r *http.Request)
  • func (s *ProxyServer) SetOutboundDialer(d *net.Dialer)
  • func (s *ProxyServer) Shutdown(ctx context.Context) error
• type Resolver
• type TLSConnection

Functions

func MatchHostname

func MatchHostname(cert *x509.Certificate, hostname string, policy rules.CertPolicy) bool

MatchHostname verifies that the certificate matches the given hostname.

func ParseSNI

func ParseSNI(data []byte) (string, error)

ParseSNI extracts the Server Name Indication (SNI) from a TLS Client Hello packet.

func TryModifySNI

func TryModifySNI(data []byte, old, new string) []byte

TryModifySNI attempts to replace the SNI in a Client Hello packet. This only works if the new SNI has the same length as the old one.

func VerifyCert

func VerifyCert(conn TLSConnection, host, targetSNI string, policy rules.CertPolicy, sec config.SecurityConfig, ignoreExpiry bool) bool

VerifyCert verifies a TLS connection's certificate against the given host, policy, and security config. This is the shared verification logic used by both proxy and upstream client. ignoreExpiry skips certificate time validity checks when true.

Types

type CertificateManager

type CertificateManager interface {
	GetCertificate(*tls.ClientHelloInfo) (*tls.Certificate, error)
	GetRootCACertPEM() []byte
	Close() error
}

CertificateManager manages root CA and signs leaf certificates.

type ProxyServer

type ProxyServer struct {
	Config   *config.Config
	Rules    *rules.Rules
	CA       CertificateManager
	Resolver Resolver
	// contains filtered or unexported fields
}

ProxyServer handles HTTP and HTTPS proxying.

func NewProxyServer

func NewProxyServer(cfg *config.Config, rules *rules.Rules, ca CertificateManager, resolver Resolver) *ProxyServer

NewProxyServer creates a new ProxyServer instance.

func (*ProxyServer) Listen

func (s *ProxyServer) Listen() error

Listen binds the configured address/port, records the actual port (which matters when Config.Server.Port == 0 asks for an auto-picked one), and prepares the http.Server. It returns once the listener is ready, so callers know the real port before serving begins. It does not block.

func (*ProxyServer) Serve

func (s *ProxyServer) Serve() error

Serve accepts connections until Shutdown or an error. It blocks. Must be called after Listen.

func (*ProxyServer) ServeHTTP

func (s *ProxyServer) ServeHTTP(w http.ResponseWriter, r *http.Request)

ServeHTTP handles HTTP requests by routing CONNECT to the proxy handler and other requests to the HTTP handler for PAC/cert/redirect.

func (*ProxyServer) SetOutboundDialer

func (s *ProxyServer) SetOutboundDialer(d *net.Dialer)

SetOutboundDialer injects the dialer used for upstream TCP connections. It is optional: desktop callers leave it nil and get a default net.Dialer; mobile callers pass a protect()-wrapped dialer so upstreams bypass the VPN TUN. Must be called before Listen/Serve.

func (*ProxyServer) Shutdown

func (s *ProxyServer) Shutdown(ctx context.Context) error

Shutdown gracefully shuts down the proxy server, waiting for active connections to complete.

type Resolver

type Resolver interface {
	Resolve(ctx context.Context, host string, clientIP net.IP) (string, error)
	Invalidate(host string)
	Close() error
}

Resolver resolves hostnames to IP addresses with caching.

type TLSConnection

type TLSConnection interface {
	ConnectionState() tls.ConnectionState
}

TLSConnection is the minimal interface needed for certificate verification.