Method handleConnect

cmd/cache-proxy/proxy.go:160–240

handleConnect tunnels an HTTPS CONNECT request. We don't cache — just copy bytes between client and origin. Required because SET GLOBAL http_proxy makes DuckDB tunnel all HTTPS through us, including external sources. What we CAN log: tunnel open (Info), dial / hijack errors (Warn / Error), final by

(w http.ResponseWriter, r *http.Request)

func NewCacheProxy(store *DiskCache, peers *PeerManager, cacheHostSuffixes []string) *CacheProxy {
	return &CacheProxy{
		store:                     store,
		peers:                     peers,
		client:                    &http.Client{Timeout: defaultOriginTimeout},
		connectDial:               net.DialTimeout,
		originTimeout:             defaultOriginTimeout,
		originRetryMaxAttempts:    defaultOriginRetryMaxAttempts,
		originRetryInitialBackoff: defaultOriginRetryInitialBackoff,
		originRetryMaxBackoff:     defaultOriginRetryMaxBackoff,
		cacheHostSuffixes:         cacheHostSuffixes,
	}
}

// How long a peer's /cache/get (or a local wait on a peer's in-flight fill)
// may block waiting for that peer's fill to land before giving up to origin.
// Long enough for a healthy multi-block fill, short enough that a wedged peer
// can't hold request latency hostage once the origin would have answered.
const peerFillWait = 10 * time.Second

// shouldCache returns true if the request targets a host we want to cache.
// When no suffixes are configured, all GETs are cached (legacy behavior).
func (p *CacheProxy) shouldCache(r *http.Request) bool {
	if len(p.cacheHostSuffixes) == 0 {
		return true
	}
	host := r.URL.Host
	if host == "" {
		host = r.Host
	}
	for _, s := range p.cacheHostSuffixes {
		if strings.Contains(host, s) {
			return true
		}
	}
	return false
}

// handleConnect tunnels an HTTPS CONNECT request. We don't cache — just copy
// bytes between client and origin. Required because SET GLOBAL http_proxy
// makes DuckDB tunnel all HTTPS through us, including external sources.
//
// What we CAN log: tunnel open (Info), dial / hijack errors (Warn / Error),
// final byte counts and duration on close (Info). What we CANNOT log: the
// actual HTTP request / response inside the tunnel — TLS terminates between
// the worker and the origin, so the encrypted bytes flowing past us are
// opaque. An S3 501 with an XML error envelope going through CONNECT is
// invisible to us at the body level; only "CONNECT to s3:443 → N bytes
// in / M bytes out / closed in T ms" is recoverable.
//
// We log this anyway because a black hole is worse than a partial trail —
// at least we can confirm a request was attempted, see the target host,
// and spot dial failures. For full request/response visibility on writes,
// DuckDB has to actually use plain HTTP via forwardUncached (s3_use_ssl =
// false), which httpfs has been observed ignoring for some PUT paths.
//
// The proxy binds a hostPort and is reachable cluster-wide without
// authentication, so the tunnel target is restricted (connectRefusalReason):
// port 443 only, no local IP literals, optionally a hostname suffix list.