//! Proxied connections for the collaboration WebSocket.//!//! Proxy URLs come from settings or the environment (see//! `ProxySettings::proxy_url`); this module dials the proxy, wraps the//! connection in TLS when an `https://` proxy asks for it, and tunnels//! through it with `proxy_handshake`. use anyhow::{Context as _, Result};use http_client::Url;use proxy_handshake::{ProxyScheme, ProxySpec, Target};use tokio::net::TcpStream; pub(crate) trait AsyncReadWrite:    tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + 'static{}impl<T: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + 'static> AsyncReadWrite    for T{} /// Whether `NO_PROXY` in the environment excludes `host` from proxying,/// matching the exclusions the HTTP client already applies to its own/// requests.pub(crate) fn excluded_from_proxy(host: &str) -> bool {    http_client::read_no_proxy_from_env()        .is_some_and(|no_proxy| proxy_handshake::no_proxy_matches(&no_proxy, host))} pub(crate) async fn connect_proxy_stream(    proxy: &Url,    rpc_host: (&str, u16),) -> Result<Box<dyn AsyncReadWrite>> {    // If parsing the proxy URL fails, we must avoid falling back to an    // insecure connection. Proxies are often used in contexts where security    // and privacy are critical, so any fallback could expose users to    // significant risks.    let spec = ProxySpec::parse(proxy).context("parsing proxy URL")?;     let target = if spec.remote_dns() {        Target::Domain(rpc_host.0.to_string(), rpc_host.1)    } else {        // SOCKS4 requests carry a raw IPv4 address, so the target must        // resolve to one.        let requires_ipv4 = matches!(spec.scheme, ProxyScheme::Socks4 { .. });        let address = tokio::net::lookup_host(rpc_host)            .await            .with_context(|| format!("failed to lookup domain {}", rpc_host.0))?            .find(|address| !requires_ipv4 || address.is_ipv4())            .with_context(|| format!("failed to lookup domain {}", rpc_host.0))?;        Target::Address(address)    };     let stream = TcpStream::connect((spec.host.as_str(), spec.port))        .await        .context("Failed to connect to proxy")?;     let stream: Box<dyn AsyncReadWrite> = if spec.tls() {        Box::new(connect_tls_to_proxy(stream, &spec.host).await?)    } else {        Box::new(stream)    };     let stream = proxy_handshake::tokio::establish(stream, &spec, &target)        .await        .context("error connecting through proxy")?;    Ok(Box::new(stream))} #[cfg(any(target_os = "windows", target_os = "macos"))]async fn connect_tls_to_proxy(    stream: TcpStream,    proxy_domain: &str,) -> Result<tokio_native_tls::TlsStream<TcpStream>> {    use tokio_native_tls::{TlsConnector, native_tls};     let tls_connector = TlsConnector::from(native_tls::TlsConnector::new()?);    Ok(tls_connector.connect(proxy_domain, stream).await?)} #[cfg(not(any(target_os = "windows", target_os = "macos")))]async fn connect_tls_to_proxy(    stream: TcpStream,    proxy_domain: &str,) -> Result<tokio_rustls::client::TlsStream<TcpStream>> {    let proxy_domain = rustls_pki_types::ServerName::try_from(proxy_domain)        .context("invalid DNS name for proxy TLS")?        .to_owned();    let tls_connector =        tokio_rustls::TlsConnector::from(std::sync::Arc::new(http_client_tls::tls_config()));    Ok(tls_connector.connect(proxy_domain, stream).await?)}