Method handleConnect

modules/proxy/server.go:92–134

handleConnect handles HTTPS CONNECT tunneling with MITM.

(ctx context.Context, conn net.Conn, connectReq *http.Request)

// handleConnect handles HTTPS CONNECT tunneling with MITM.
func (s *proxyServer) handleConnect(ctx context.Context, conn net.Conn, connectReq *http.Request) {
	host := connectReq.Host
	if !strings.Contains(host, ":") {
		host += ":443"
	}
	hostname, _, _ := net.SplitHostPort(host)

	// Respond 200 to establish the tunnel.
	conn.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n"))

	// Get or create a TLS certificate for this host.
	cert, err := s.certForHost(hostname)
	if err != nil {
		slog.Error("proxy: cert generation failed", "host", hostname, "err", err)
		return
	}

	// TLS handshake with the client.
	tlsConn := tls.Server(conn, &tls.Config{
		Certificates: []tls.Certificate{*cert},
	})
	if err := tlsConn.Handshake(); err != nil {
		slog.Debug("proxy: client TLS handshake failed", "host", hostname, "err", err)
		return
	}
	defer tlsConn.Close()

	clientReader := bufio.NewReader(tlsConn)

	// Handle multiple requests over the same connection (HTTP/1.1 keep-alive).
	for {
		req, err := http.ReadRequest(clientReader)
		if err != nil {
			return
		}

		req.URL.Scheme = "https"
		req.URL.Host = host
		req.RequestURI = ""

		s.proxyAndRecord(ctx, tlsConn, req, "https")
	}
}

// handleHTTP handles plain HTTP proxy requests.
func (s *proxyServer) handleHTTP(ctx context.Context, conn net.Conn, req *http.Request) {