Check http proxy hotfix and improvements - #449
Conversation
make all of them start with uppercase letters
dialer function was always dialing the target address/IP, it was not dialing the proxy even if it was present
…e proxy schmee is https this is due to prevent possible confusion around TLS checks in the normal usage. the TLS errors regarding the target website are ignored, certificates are only checked when --certificate mode is turned on but if the proxy is using "https" scheme, a valid TLS connection is required and checked, independently of the target website. Add logs around this, and explicitly set transport.DialTlsContext. This is separate from transport.DialContext
|
tested on windows and linux, works for my use-cases The only difference is that the monitoring-plugins check_http |
TestHTTPProxyPlain -> proxy returns immediately and increments a counter, to see if proxy is connected TestHTTPProxySSL -> target is using HTTPS, and proxy is using HTTP. Connection to proxy has nothing to check, and target using a self-signed HTTPS certificate is ignored, as in the default mode. TestHTTPProxySSLSelfSignedProxy -> target is using HTTP, and proxy is using HTTPS. TLS certificate of the proxy is verified, and it fails since it is self-signed, returnin an early CRITICAL before connecting to target.
…avior i let deepseek-v4-flash dig through the golang net code and see its supported proxy schemes
-j CONNECT was a sneaky workaround to make proxying work with the older check_http. You would connect to the proxy first, and then specify the target website in the url field. To make the connection act like a proxy, you would set the HTTP method to CONNECT. Here the proxy is handled by golang http code, which automatically uses the CONNECT method when connecting to the proxy. No need to manually set it anymore. The argument is still left as -j , since it might be used for other HTTP methods if necessary, although most use cases use the GET method, which is the default. |
2 participants
the problem was with the dialer function. it was unaware that the address passed to it differed if a proxy was set.
Transport.Dial takes type func(ctx context.Context, network, addr string). When a proxy is used, the address for the TCP connection is the proxy itself.
The code was always using (IP Address or Host) + Port as the target for TCP connection, since it was written with the assumption that this dialer is used after the proxy connection is established. Did not know the details about golang http package that well.
tests
add tests that spin up target and proxy http/https servers and check proxy behavior. ai generated.
TestHTTPProxyPlain -> proxy returns immediately and increments a counter, to see if proxy is connected
TestHTTPProxySSL -> target is using HTTPS, and proxy is using HTTP. Connection to proxy has nothing to check, and target using a self-signed HTTPS certificate is ignored, as in the default mode.
TestHTTPProxySSLSelfSignedProxy -> target is using HTTP, and proxy is using HTTPS. TLS certificate of the proxy is verified, and it fails since it is self-signed, returnin an early CRITICAL before connecting to target.
misc
make argument text begin with uppercase characters, it was mixed before
add debug log statements regarding proxy usage and what it will do regarding different proxy schemes