Luis Paterfix(proxyutil): enforce HTTP/1.1 ALPN and configure TLS dial context for HTTPS proxies8dd78042 months agoHistory
1047 lines · 30.0 KB · GoRawDownload
package proxyutil import (	"bufio"	"context"	"crypto/ecdsa"	"crypto/elliptic"	"crypto/rand"	"crypto/tls"	"crypto/x509"	"crypto/x509/pkix"	"encoding/base64"	"errors"	"fmt"	"io"	"math/big"	"net"	"net/http"	"net/http/httptest"	"net/url"	"strings"	"testing"	"time") func mustDefaultTransport(t *testing.T) *http.Transport {	t.Helper() 	transport, ok := http.DefaultTransport.(*http.Transport)	if !ok || transport == nil {		t.Fatal("http.DefaultTransport is not an *http.Transport")	}	return transport} func TestParse(t *testing.T) {	t.Parallel() 	tests := []struct {		name    string		input   string		want    Mode		wantErr bool	}{		{name: "inherit", input: "", want: ModeInherit},		{name: "direct", input: "direct", want: ModeDirect},		{name: "none", input: "none", want: ModeDirect},		{name: "http", input: "http://proxy.example.com:8080", want: ModeProxy},		{name: "https", input: "https://proxy.example.com:8443", want: ModeProxy},		{name: "socks5", input: "socks5://proxy.example.com:1080", want: ModeProxy},		{name: "socks5h", input: "socks5h://proxy.example.com:1080", want: ModeProxy},		{name: "invalid", input: "bad-value", want: ModeInvalid, wantErr: true},	} 	for _, tt := range tests {		tt := tt		t.Run(tt.name, func(t *testing.T) {			t.Parallel() 			setting, errParse := Parse(tt.input)			if tt.wantErr && errParse == nil {				t.Fatal("expected error, got nil")			}			if !tt.wantErr && errParse != nil {				t.Fatalf("unexpected error: %v", errParse)			}			if setting.Mode != tt.want {				t.Fatalf("mode = %d, want %d", setting.Mode, tt.want)			}		})	}} func TestBuildHTTPTransportDirectBypassesProxy(t *testing.T) {	t.Parallel() 	transport, mode, errBuild := BuildHTTPTransport("direct")	if errBuild != nil {		t.Fatalf("BuildHTTPTransport returned error: %v", errBuild)	}	if mode != ModeDirect {		t.Fatalf("mode = %d, want %d", mode, ModeDirect)	}	if transport == nil {		t.Fatal("expected transport, got nil")	}	if transport.Proxy != nil {		t.Fatal("expected direct transport to disable proxy function")	}} func TestBuildHTTPTransportHTTPProxy(t *testing.T) {	t.Parallel() 	transport, mode, errBuild := BuildHTTPTransport("http://proxy.example.com:8080")	if errBuild != nil {		t.Fatalf("BuildHTTPTransport returned error: %v", errBuild)	}	if mode != ModeProxy {		t.Fatalf("mode = %d, want %d", mode, ModeProxy)	}	if transport == nil {		t.Fatal("expected transport, got nil")	} 	req, errRequest := http.NewRequest(http.MethodGet, "https://example.com", nil)	if errRequest != nil {		t.Fatalf("http.NewRequest returned error: %v", errRequest)	} 	proxyURL, errProxy := transport.Proxy(req)	if errProxy != nil {		t.Fatalf("transport.Proxy returned error: %v", errProxy)	}	if proxyURL == nil || proxyURL.String() != "http://proxy.example.com:8080" {		t.Fatalf("proxy URL = %v, want http://proxy.example.com:8080", proxyURL)	} 	defaultTransport := mustDefaultTransport(t)	if transport.ForceAttemptHTTP2 != defaultTransport.ForceAttemptHTTP2 {		t.Fatalf("ForceAttemptHTTP2 = %v, want %v", transport.ForceAttemptHTTP2, defaultTransport.ForceAttemptHTTP2)	}	if transport.IdleConnTimeout != defaultTransport.IdleConnTimeout {		t.Fatalf("IdleConnTimeout = %v, want %v", transport.IdleConnTimeout, defaultTransport.IdleConnTimeout)	}	if transport.TLSHandshakeTimeout != defaultTransport.TLSHandshakeTimeout {		t.Fatalf("TLSHandshakeTimeout = %v, want %v", transport.TLSHandshakeTimeout, defaultTransport.TLSHandshakeTimeout)	}} func TestBuildHTTPTransportSOCKS5ProxyInheritsDefaultTransportSettings(t *testing.T) {	t.Parallel() 	transport, mode, errBuild := BuildHTTPTransport("socks5://proxy.example.com:1080")	if errBuild != nil {		t.Fatalf("BuildHTTPTransport returned error: %v", errBuild)	}	if mode != ModeProxy {		t.Fatalf("mode = %d, want %d", mode, ModeProxy)	}	if transport == nil {		t.Fatal("expected transport, got nil")	}	if transport.Proxy != nil {		t.Fatal("expected SOCKS5 transport to bypass http proxy function")	} 	defaultTransport := mustDefaultTransport(t)	if transport.ForceAttemptHTTP2 != defaultTransport.ForceAttemptHTTP2 {		t.Fatalf("ForceAttemptHTTP2 = %v, want %v", transport.ForceAttemptHTTP2, defaultTransport.ForceAttemptHTTP2)	}	if transport.IdleConnTimeout != defaultTransport.IdleConnTimeout {		t.Fatalf("IdleConnTimeout = %v, want %v", transport.IdleConnTimeout, defaultTransport.IdleConnTimeout)	}	if transport.TLSHandshakeTimeout != defaultTransport.TLSHandshakeTimeout {		t.Fatalf("TLSHandshakeTimeout = %v, want %v", transport.TLSHandshakeTimeout, defaultTransport.TLSHandshakeTimeout)	}} func TestBuildHTTPTransportSOCKS5HProxy(t *testing.T) {	t.Parallel() 	transport, mode, errBuild := BuildHTTPTransport("socks5h://proxy.example.com:1080")	if errBuild != nil {		t.Fatalf("BuildHTTPTransport returned error: %v", errBuild)	}	if mode != ModeProxy {		t.Fatalf("mode = %d, want %d", mode, ModeProxy)	}	if transport == nil {		t.Fatal("expected transport, got nil")	}	if transport.Proxy != nil {		t.Fatal("expected SOCKS5H transport to bypass http proxy function")	}	if transport.DialContext == nil {		t.Fatal("expected SOCKS5H transport to have custom DialContext")	}} func TestBuildHTTPTransportHTTPSProxyInheritsDefaultTransportSettings(t *testing.T) {	t.Parallel() 	transport, mode, errBuild := BuildHTTPTransport("https://proxy.example.com:8443")	if errBuild != nil {		t.Fatalf("BuildHTTPTransport returned error: %v", errBuild)	}	if mode != ModeProxy {		t.Fatalf("mode = %d, want %d", mode, ModeProxy)	}	if transport == nil {		t.Fatal("expected transport, got nil")	}	if transport.Proxy == nil {		t.Fatal("expected HTTPS proxy transport to retain Proxy function")	}	if transport.DialTLSContext == nil {		t.Fatal("expected HTTPS proxy transport to configure custom DialTLSContext")	} 	req, errRequest := http.NewRequest(http.MethodGet, "https://example.com", nil)	if errRequest != nil {		t.Fatalf("http.NewRequest returned error: %v", errRequest)	}	proxyURL, errProxy := transport.Proxy(req)	if errProxy != nil {		t.Fatalf("transport.Proxy returned error: %v", errProxy)	}	if proxyURL == nil || proxyURL.String() != "https://proxy.example.com:8443" {		t.Fatalf("proxy URL = %v, want https://proxy.example.com:8443", proxyURL)	} 	defaultTransport := mustDefaultTransport(t)	if transport.ForceAttemptHTTP2 != defaultTransport.ForceAttemptHTTP2 {		t.Fatalf("ForceAttemptHTTP2 = %v, want %v", transport.ForceAttemptHTTP2, defaultTransport.ForceAttemptHTTP2)	}	if transport.IdleConnTimeout != defaultTransport.IdleConnTimeout {		t.Fatalf("IdleConnTimeout = %v, want %v", transport.IdleConnTimeout, defaultTransport.IdleConnTimeout)	}	if transport.TLSHandshakeTimeout != defaultTransport.TLSHandshakeTimeout {		t.Fatalf("TLSHandshakeTimeout = %v, want %v", transport.TLSHandshakeTimeout, defaultTransport.TLSHandshakeTimeout)	}} func TestBuildDialerHTTPProxyCONNECT(t *testing.T) {	t.Parallel() 	listener, errListen := net.Listen("tcp", "127.0.0.1:0")	if errListen != nil {		t.Fatalf("net.Listen returned error: %v", errListen)	}	defer func() {		if errClose := listener.Close(); errClose != nil {			t.Errorf("listener.Close returned error: %v", errClose)		}	}() 	done := make(chan error, 1)	go func() {		conn, errAccept := listener.Accept()		if errAccept != nil {			done <- errAccept			return		}		defer func() { _ = conn.Close() }()		if errDeadline := conn.SetDeadline(time.Now().Add(5 * time.Second)); errDeadline != nil {			done <- errDeadline			return		} 		req, errRead := http.ReadRequest(bufio.NewReader(conn))		if errRead != nil {			done <- fmt.Errorf("read CONNECT request failed: %w", errRead)			return		}		if req.Method != http.MethodConnect {			done <- fmt.Errorf("method = %s, want CONNECT", req.Method)			return		}		if req.Host != "target.example.com:443" {			done <- fmt.Errorf("host = %s, want target.example.com:443", req.Host)			return		}		wantAuth := "Basic " + base64.StdEncoding.EncodeToString([]byte("user:pass"))		if gotAuth := req.Header.Get("Proxy-Authorization"); gotAuth != wantAuth {			done <- fmt.Errorf("Proxy-Authorization = %q, want %q", gotAuth, wantAuth)			return		} 		if _, errWrite := io.WriteString(conn, "HTTP/1.1 200 Connection Established\r\n\r\nok"); errWrite != nil {			done <- fmt.Errorf("write CONNECT response failed: %w", errWrite)			return		} 		buf := make([]byte, 4)		n, errReadTunnel := io.ReadFull(conn, buf)		if errReadTunnel != nil {			done <- fmt.Errorf("read tunneled payload failed after %d bytes: %w", n, errReadTunnel)			return		}		if string(buf) != "ping" {			done <- fmt.Errorf("tunneled payload = %q, want ping", string(buf))			return		}		done <- nil	}() 	dialer, mode, errBuild := BuildDialer("http://user:pass@" + listener.Addr().String())	if errBuild != nil {		t.Fatalf("BuildDialer returned error: %v", errBuild)	}	if mode != ModeProxy {		t.Fatalf("mode = %d, want %d", mode, ModeProxy)	}	if dialer == nil {		t.Fatal("expected dialer, got nil")	} 	conn, errDial := dialer.Dial("tcp", "target.example.com:443")	if errDial != nil {		t.Fatalf("dialer.Dial returned error: %v", errDial)	}	defer func() {		if errClose := conn.Close(); errClose != nil {			t.Errorf("conn.Close returned error: %v", errClose)		}	}() 	buf := make([]byte, 2)	n, errRead := io.ReadFull(conn, buf)	if errRead != nil {		t.Fatalf("conn.Read returned error after %d bytes: %v", n, errRead)	}	if string(buf) != "ok" {		t.Fatalf("buffered tunnel payload = %q, want ok", string(buf))	} 	if _, errWrite := conn.Write([]byte("ping")); errWrite != nil {		t.Fatalf("conn.Write returned error: %v", errWrite)	} 	if errServer := <-done; errServer != nil {		t.Fatalf("proxy server returned error: %v", errServer)	}} func TestBuildDialerHTTPProxyCONNECTCancellation(t *testing.T) {	t.Parallel() 	listener, errListen := net.Listen("tcp", "127.0.0.1:0")	if errListen != nil {		t.Fatalf("net.Listen returned error: %v", errListen)	}	defer func() { _ = listener.Close() }()	requestRead := make(chan struct{})	serverDone := make(chan error, 1)	go func() {		connection, errAccept := listener.Accept()		if errAccept != nil {			serverDone <- errAccept			return		}		defer func() { _ = connection.Close() }()		if _, errRead := http.ReadRequest(bufio.NewReader(connection)); errRead != nil {			serverDone <- errRead			return		}		close(requestRead)		if errDeadline := connection.SetReadDeadline(time.Now().Add(5 * time.Second)); errDeadline != nil {			serverDone <- errDeadline			return		}		var buffer [1]byte		_, errRead := connection.Read(buffer[:])		serverDone <- errRead	}() 	dialer, mode, errBuild := BuildDialer("http://" + listener.Addr().String())	if errBuild != nil || mode != ModeProxy {		t.Fatalf("BuildDialer mode=%d error=%v", mode, errBuild)	}	contextDialer, ok := dialer.(interface {		DialContext(context.Context, string, string) (net.Conn, error)	})	if !ok {		t.Fatal("HTTP CONNECT dialer does not support context cancellation")	}	ctx, cancel := context.WithCancel(context.Background())	dialDone := make(chan error, 1)	go func() {		connection, errDial := contextDialer.DialContext(ctx, "tcp", "20.42.0.20:443")		if connection != nil {			_ = connection.Close()		}		dialDone <- errDial	}()	select {	case <-requestRead:	case <-time.After(time.Second):		t.Fatal("proxy did not receive CONNECT request")	}	cancel()	select {	case errDial := <-dialDone:		if errDial == nil {			t.Fatal("canceled CONNECT dial returned nil error")		}	case <-time.After(time.Second):		t.Fatal("canceled CONNECT dial did not return")	}	select {	case errServer := <-serverDone:		if errServer == nil {			t.Fatal("proxy connection stayed open after cancellation")		}	case <-time.After(time.Second):		t.Fatal("proxy connection was not closed after cancellation")	}} func TestRedactProxyURL(t *testing.T) {	t.Parallel() 	tests := []struct {		name  string		input string		want  string	}{		{			name:  "with credentials",			input: "http://user:pass@proxy.example.com:8080/path?token=secret",			want:  "http://redacted@proxy.example.com:8080",		},		{			name:  "without credentials",			input: "socks5://proxy.example.com:1080",			want:  "socks5://proxy.example.com:1080",		},		{			name:  "invalid",			input: "bad-value",			want:  "<invalid proxy URL>",		},	} 	for _, tt := range tests {		tt := tt		t.Run(tt.name, func(t *testing.T) {			t.Parallel() 			if got := Redact(tt.input); got != tt.want {				t.Fatalf("Redact() = %q, want %q", got, tt.want)			}		})	}} func TestParseErrorDoesNotExposeProxyCredentials(t *testing.T) {	t.Parallel() 	input := "http://user:secret%@proxy.example.com:8080"	_, errParse := Parse(input)	if errParse == nil {		t.Fatal("expected Parse to return an error")	}	if strings.Contains(errParse.Error(), input) ||		strings.Contains(errParse.Error(), "user") ||		strings.Contains(errParse.Error(), "secret") {		t.Fatalf("parse error exposes proxy credentials: %q", errParse.Error())	}} func newTestCertificate(t *testing.T) tls.Certificate {	t.Helper() 	key, errKey := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)	if errKey != nil {		t.Fatalf("generate test key: %v", errKey)	}	template := &x509.Certificate{		SerialNumber: big.NewInt(1),		Subject:      pkix.Name{CommonName: "127.0.0.1"},		NotBefore:    time.Now().Add(-time.Hour),		NotAfter:     time.Now().Add(time.Hour),		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},		IsCA:         true,	}	der, errCreate := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)	if errCreate != nil {		t.Fatalf("create test certificate: %v", errCreate)	}	leaf, errParse := x509.ParseCertificate(der)	if errParse != nil {		t.Fatalf("parse test certificate: %v", errParse)	}	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key, Leaf: leaf}} func TestBuildHTTPTransportHTTPSProxyH2Negotiation(t *testing.T) {	t.Parallel() 	targetServer := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {		_, _ = fmt.Fprint(w, "target ok")	}))	defer targetServer.Close() 	proxyCert := newTestCertificate(t)	proxyListener, errListen := tls.Listen("tcp", "127.0.0.1:0", &tls.Config{		Certificates: []tls.Certificate{proxyCert},		NextProtos:   []string{"h2", "http/1.1"},	})	if errListen != nil {		t.Fatalf("tls.Listen returned error: %v", errListen)	}	defer func() {		if errClose := proxyListener.Close(); errClose != nil {			t.Errorf("proxyListener.Close returned error: %v", errClose)		}

Lines 1–500 of 1047.