-
Notifications
You must be signed in to change notification settings - Fork 0
/
sni_proxy.go
80 lines (68 loc) · 1.66 KB
/
sni_proxy.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
package tcp
import (
"io"
"log"
"net"
"time"
)
// SNIProxy implements an SNI aware transparent TCP proxy which captures the
// TLS client hello, extracts the host name and uses it for finding the
// upstream server. Then it replays the ClientHello message and copies data
// transparently allowing to route a TLS connection based on the SNI header
// without decrypting it.
type SNIProxy struct {
// DialTimeout sets the timeout for establishing the outbound
// connection.
DialTimeout time.Duration
// Lookup returns a target host for the given server name.
// The proxy will panic if this value is nil.
Lookup func(host string) string
}
func (p *SNIProxy) ServeTCP(in net.Conn) error {
defer in.Close()
// capture client hello
data := make([]byte, 1024)
n, err := in.Read(data)
if err != nil {
return err
}
data = data[:n]
host, ok := readServerName(data)
if !ok {
log.Print("[DEBUG] tcp+sni: TLS handshake failed")
return nil
}
if host == "" {
log.Print("[DEBUG] tcp+sni: server_name missing")
return nil
}
addr := p.Lookup(host)
if addr == "" {
return nil
}
out, err := net.DialTimeout("tcp", addr, p.DialTimeout)
if err != nil {
log.Print("[WARN] tcp+sni: cannot connect to upstream ", addr)
return err
}
defer out.Close()
// copy client hello
_, err = out.Write(data)
if err != nil {
log.Print("[WARN] tcp+sni: copy client hello failed. ", err)
return err
}
errc := make(chan error, 2)
cp := func(dst io.Writer, src io.Reader) {
_, err := io.Copy(dst, src)
errc <- err
}
go cp(out, in)
go cp(in, out)
err = <-errc
if err != nil && err != io.EOF {
log.Print("[WARN]: tcp+sni: ", err)
return err
}
return nil
}