1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
package proxy
import (
"bufio"
"context"
"io"
"net"
"net/http"
"testing"
"time"
)
// startStubConnectProxy runs a minimal HTTP CONNECT proxy for the
// duration of the test: it accepts one CONNECT request, replies with the
// given status, and if status is 200 splices the tunnel through to a
// real dial of the requested host. Returns the proxy's address.
func startStubConnectProxy(t *testing.T, status int) string {
t.Helper()
ln, err := net.Listen("tcp", "127.0.0.1:0")
if err != nil {
t.Fatalf("listen: %v", err)
}
t.Cleanup(func() { ln.Close() })
go func() {
c, err := ln.Accept()
if err != nil {
return
}
defer c.Close()
br := bufio.NewReader(c)
req, err := http.ReadRequest(br)
if err != nil {
return
}
if req.Method != http.MethodConnect {
c.Write([]byte("HTTP/1.1 405 Method Not Allowed\r\n\r\n"))
return
}
if status != http.StatusOK {
c.Write([]byte("HTTP/1.1 403 Forbidden\r\n\r\n"))
return
}
target, err := net.Dial("tcp", req.Host)
if err != nil {
c.Write([]byte("HTTP/1.1 502 Bad Gateway\r\n\r\n"))
return
}
defer target.Close()
c.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n"))
done := make(chan struct{}, 2)
go func() { io.Copy(target, br); done <- struct{}{} }()
go func() { io.Copy(c, target); done <- struct{}{} }()
<-done
}()
return ln.Addr().String()
}
// startEchoServer runs a TCP server that echoes back whatever it reads,
// standing in for "the origin" on the far side of a CONNECT tunnel.
func startEchoServer(t *testing.T) string {
t.Helper()
ln, err := net.Listen("tcp", "127.0.0.1:0")
if err != nil {
t.Fatalf("listen: %v", err)
}
t.Cleanup(func() { ln.Close() })
go func() {
for {
c, err := ln.Accept()
if err != nil {
return
}
go func(c net.Conn) {
defer c.Close()
io.Copy(c, c)
}(c)
}
}()
return ln.Addr().String()
}
func TestDialViaProxyDirect(t *testing.T) {
echoAddr := startEchoServer(t)
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
defer cancel()
conn, err := dialViaProxy(ctx, echoAddr, "")
if err != nil {
t.Fatalf("dialViaProxy direct: %v", err)
}
defer conn.Close()
if _, err := conn.Write([]byte("hello")); err != nil {
t.Fatalf("write: %v", err)
}
buf := make([]byte, 5)
if _, err := io.ReadFull(conn, buf); err != nil {
t.Fatalf("read: %v", err)
}
if string(buf) != "hello" {
t.Errorf("got %q, want %q", buf, "hello")
}
}
func TestDialViaProxyTunneled(t *testing.T) {
echoAddr := startEchoServer(t)
proxyAddr := startStubConnectProxy(t, http.StatusOK)
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
defer cancel()
conn, err := dialViaProxy(ctx, echoAddr, proxyAddr)
if err != nil {
t.Fatalf("dialViaProxy via proxy: %v", err)
}
defer conn.Close()
if _, err := conn.Write([]byte("world")); err != nil {
t.Fatalf("write: %v", err)
}
buf := make([]byte, 5)
if _, err := io.ReadFull(conn, buf); err != nil {
t.Fatalf("read: %v", err)
}
if string(buf) != "world" {
t.Errorf("got %q, want %q", buf, "world")
}
}
func TestDialViaProxyRejected(t *testing.T) {
proxyAddr := startStubConnectProxy(t, http.StatusForbidden)
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
defer cancel()
_, err := dialViaProxy(ctx, "example.invalid:443", proxyAddr)
if err == nil {
t.Fatal("expected an error when the upstream proxy refuses CONNECT, got nil")
}
}
|