Method ServeHTTP

proxy/serverhttps.go:198–252

ServeHTTP is the http.Handler implementation that handles DoH queries. Here is what it returns: - http.StatusNotFound if the request is not encrypted and proxy is not configured to accept unencrypted requests, - http.StatusBadRequest if there is no DNS request data, - http.StatusUnsupportedMediaTy

(w http.ResponseWriter, r *http.Request)

//     "application/dns-message",
//   - http.StatusMethodNotAllowed if request method is not GET or POST.
func (p *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()
	ctx, cancel := p.reqCtx.New(ctx)
	defer cancel()

	p.logger.DebugContext(ctx, "incoming https request", "url", r.URL)

	if !p.HTTPConfig.InsecureEnabled && r.TLS == nil {
		statusCode := http.StatusNotFound
		http.Error(w, http.StatusText(statusCode), statusCode)

		return
	}

	raddr, prx, err := remoteAddr(r, p.logger)
	if err != nil {
		p.logger.DebugContext(ctx, "getting real ip", slogutil.KeyError, err)
	}

	if !p.checkBasicAuth(w, r, raddr) {
		return
	}

	req, statusCode := newDoHReq(ctx, r, p.logger)
	if req == nil {
		http.Error(w, http.StatusText(statusCode), statusCode)

		return
	}

	if prx.IsValid() {
		l := p.logger.With("addr", prx)

		l.DebugContext(ctx, "request came from proxy server")

		if !p.TrustedProxies.Contains(prx.Addr()) {
			l.DebugContext(ctx, "proxy is not trusted, using original remote addr")

			// So the address of the proxy itself is used, as the remote address
			// parsed from headers cannot be trusted.
			//
			// TODO(e.burkov): Do not parse headers in this case.
			raddr = prx
		}
	}

	d := p.newDNSContext(ProtoHTTPS, req, raddr)
	d.HTTPRequest = r
	d.HTTPResponseWriter = w

	err = p.handleDNSRequest(ctx, d)
	if err != nil {
		p.logger.DebugContext(ctx, "handling dns request", "proto", d.Proto, slogutil.KeyError, err)
	}
}

// checkBasicAuth checks the basic authorization data, if necessary, and if the
// data isn't valid, it writes an error.  shouldHandle is false if the request