feat(http): support https over proxy via HTTP CONNECT (#886)

Author: ithewei

docs/cn/HttpClient.md

@@ -21,23 +21,32 @@ class HttpClient {
     // 获取请求头部
     const char* getHeader(const char* key);
 
-    // 设置http代理
+    // 设置http代理(明文HTTP走绝对URI转发)
     int setHttpProxy(const char* host, int port);
-    // 设置https代理
+    // 设置https代理(HTTPS走HTTP CONNECT隧道，与目标端到端TLS)
     int setHttpsProxy(const char* host, int port);
     // 添加不走代理
     int addNoProxy(const char* host);
+    // 设置代理认证(http转发用Basic头，CONNECT隧道用Proxy-Authorization)
+    int setProxyAuth(const char* username, const char* password);
 
     // 同步发送
     int send(HttpRequest* req, HttpResponse* resp);
     // 异步发送
     int sendAsync(HttpRequestPtr req, HttpResponseCallback resp_cb = NULL);
 
+    // 按请求中的目标及代理配置建立连接；成功返回时CONNECT隧道和TLS握手均已完成
+    int connect(HttpRequest& req);
+    // 直接连接指定主机
+    int connect(const char* host, int port = DEFAULT_HTTP_PORT, int https = 0, int timeout = DEFAULT_HTTP_CONNECT_TIMEOUT);
+
     // 关闭连接 (HttpClient对象析构时会自动调用)
     int close();
 
 };
 
+当 `HttpRequest` 已通过 `SetProxy` 或 `SetTunnelProxy` 配置代理时，以请求级配置为准；否则使用 `HttpClient` 的全局代理配置。重定向后的连接目标未变化时复用当前连接，目标或代理变化时使用独立连接完成重定向，不会关闭调用方原有的 keep-alive 连接。
+
 namespace requests {
 
     // 同步请求

docs/cn/HttpMessage.md

@@ -80,6 +80,10 @@ class HttpRequest : public HttpMessage {
 
     // 设置代理
     void SetProxy(const char* host, int port);
+    // 设置HTTP正向代理Basic认证，username为空时删除Proxy-Authorization
+    void SetProxyAuth(const char* username, const char* password = NULL);
+    // 设置HTTP CONNECT隧道代理及握手认证
+    void SetTunnelProxy(const char* host, int port, const char* username = NULL, const char* password = NULL);
 
     // 设置认证
     void SetAuth(const std::string& auth);

event/hevent.c

@@ -499,8 +499,11 @@ const char* hio_get_hostname(hio_t* io) {
 
 int hio_set_proxy(hio_t* io, proxy_setting_t* setting) {
     if (io == NULL || setting == NULL) return -1;
-    // only SOCKS5 is implemented so far
-    if (setting->protocol != PROXY_PROTOCOL_SOCKS5) return -1;
+    // implemented: SOCKS5, HTTP CONNECT
+    if (setting->protocol != PROXY_PROTOCOL_SOCKS5 &&
+        setting->protocol != PROXY_PROTOCOL_HTTP_CONNECT) {
+        return -1;
+    }
     if (io->proxy == NULL) {
         HV_ALLOC_SIZEOF(io->proxy);
         if (io->proxy == NULL) return -1;

event/hloop.h

@@ -359,17 +359,19 @@ HV_EXPORT const char* hio_get_hostname(hio_t* io);
 // already the proxy connection).
 //
 // The setting is copied. Leave username empty for no auth, or set
-// username/password for auth (SOCKS5 => RFC 1929). Only PROXY_PROTOCOL_SOCKS5
-// is implemented so far.
+// username/password for auth (SOCKS5 => RFC 1929, HTTP CONNECT => Basic).
+// Implemented protocols: PROXY_PROTOCOL_SOCKS5, PROXY_PROTOCOL_HTTP_CONNECT.
 // NOTE: set before hio_connect().
 typedef enum {
-    PROXY_PROTOCOL_NONE   = 0,
-    PROXY_PROTOCOL_SOCKS5 = 1,
+    PROXY_PROTOCOL_NONE         = 0,
+    PROXY_PROTOCOL_SOCKS5       = 1,
+    PROXY_PROTOCOL_HTTP_CONNECT = 2,    // HTTP CONNECT tunnel (RFC 7231 4.3.6)
 } proxy_protocol_e;
 
 typedef struct proxy_setting_s {
     int  protocol;              // proxy_protocol_e
-    char proxy_host[256];       // proxy host (SOCKS5: unused, socket is the proxy)
+    char proxy_host[256];       // proxy host (unused by the io layer: the socket
+                                // is already the proxy connection; kept for ref)
     int  proxy_port;
     char target_host[256];      // final target the proxy should CONNECT to
     int  target_port;

event/nio.c

@@ -263,9 +263,9 @@ enum socks5_state_e {
 
 static void socks5_handshake(hio_t* io);
 
-static void socks5_fail(hio_t* io) {
+static void proxy_fail(hio_t* io) {
     if (io->error == 0) io->error = ERR_CONNECT;
-    hlogw("connfd=%d socks5 handshake error", io->fd);
+    hlogw("connfd=%d proxy handshake error", io->fd);
     hio_close(io);
 }
 
@@ -277,16 +277,18 @@ static void socks5_expect(hio_t* io, int state, int want) {
     s5->want = want;
 }
 
-// Raw handshake send. The SOCKS5 handshake runs immediately after the TCP
+// Raw handshake send. The proxy handshake runs immediately after the TCP
 // connection to the proxy is established, when the socket send buffer is empty
-// and the messages are tiny (<= 513 bytes), so a short write is not expected.
+// and the message is tiny (SOCKS5 <= 513 bytes; HTTP CONNECT < ~1.3KB), far
+// smaller than the default send buffer, so a single send() transfers it all.
 // We deliberately do NOT use hio_write() here: it would invoke the upper-layer
 // write_cb (leaking handshake bytes, including credentials, to the application
 // before onConnection), dispatch to hssl_write() with a not-yet-created SSL
 // handle for a TLS target, and enqueue on EAGAIN via hio_add() which would
-// clobber the handshake read handler. A short write or error is treated as
-// fatal and closes the connection.
-static int socks5_send(hio_t* io, const void* buf, int len) {
+// clobber the handshake read handler (io has a single cb slot). A short write
+// cannot happen here in practice; if it somehow does, it is treated as fatal
+// (return -1) rather than blocking the event loop.
+static int proxy_send(hio_t* io, const void* buf, int len) {
     int flag = 0;
 #ifdef MSG_NOSIGNAL
     flag |= MSG_NOSIGNAL;
@@ -300,15 +302,15 @@ static void socks5_send_connect(hio_t* io) {
     proxy_conn_t* s5 = io->proxy;
     unsigned char buf[300];
     int n = socks5_build_connect_request(s5, buf);
-    if (n < 0) { socks5_fail(io); return; }
-    if (socks5_send(io, buf, n) != 0) { socks5_fail(io); return; }
+    if (n < 0) { proxy_fail(io); return; }
+    if (proxy_send(io, buf, n) != 0) { proxy_fail(io); return; }
     socks5_expect(io, S5_RECV_REPLY_HEAD, 4);
 }
 
 // hand off the established proxy tunnel to the upper layer: stop the handshake
 // read handler, then run the SSL handshake / connect_cb. io->read_cb was never
 // touched, so the upper-layer Channel read callback stays intact.
-static void socks5_established(hio_t* io) {
+static void proxy_established(hio_t* io) {
     hio_del(io, HV_READ);
     nio_connect_established(io);
 }
@@ -321,29 +323,29 @@ static void socks5_dispatch(hio_t* io) {
     switch (s5->state) {
     case S5_RECV_METHOD:
         // VER METHOD
-        if (buf[0] != SOCKS5_VERSION) { socks5_fail(io); return; }
+        if (buf[0] != SOCKS5_VERSION) { proxy_fail(io); return; }
         if (buf[1] == SOCKS5_AUTH_NONE) {
             socks5_send_connect(io);
         } else if (buf[1] == SOCKS5_AUTH_USERPASS && s5->setting.username[0]) {
             unsigned char req[640];
             int n = socks5_build_auth_request(s5, req);
-            if (socks5_send(io, req, n) != 0) { socks5_fail(io); return; }
+            if (proxy_send(io, req, n) != 0) { proxy_fail(io); return; }
             socks5_expect(io, S5_RECV_AUTH, 2);
         } else {
-            socks5_fail(io);   // no acceptable method
+            proxy_fail(io);   // no acceptable method
         }
         return;
 
     case S5_RECV_AUTH:
         // VER STATUS (0 == success)
-        if (buf[1] != 0x00) { socks5_fail(io); return; }
+        if (buf[1] != 0x00) { proxy_fail(io); return; }
         socks5_send_connect(io);
         return;
 
     case S5_RECV_REPLY_HEAD: {
         // VER REP RSV ATYP
-        if (buf[0] != SOCKS5_VERSION) { socks5_fail(io); return; }
-        if (buf[1] != SOCKS5_REP_SUCCESS) { io->error = ERR_CONNECT; socks5_fail(io); return; }
+        if (buf[0] != SOCKS5_VERSION) { proxy_fail(io); return; }
+        if (buf[1] != SOCKS5_REP_SUCCESS) { io->error = ERR_CONNECT; proxy_fail(io); return; }
         unsigned char atyp = buf[3];
         if (atyp == SOCKS5_ATYP_IPV4) {
             socks5_expect(io, S5_RECV_REPLY_ADDR, 4 + 2);   // addr + port
@@ -354,14 +356,14 @@ static void socks5_dispatch(hio_t* io) {
             // first requiring the length byte.
             socks5_expect(io, S5_RECV_REPLY_DADDR, 1);
         } else {
-            socks5_fail(io);
+            proxy_fail(io);
         }
         return;
     }
 
     case S5_RECV_REPLY_ADDR:
         // bound addr+port consumed; tunnel is up
-        socks5_established(io);
+        proxy_established(io);
         return;
 
     case S5_RECV_REPLY_DADDR:
@@ -372,11 +374,11 @@ static void socks5_dispatch(hio_t* io) {
             socks5_expect(io, S5_RECV_REPLY_DADDR, dlen + 2);
             return;
         }
-        socks5_established(io);
+        proxy_established(io);
         return;
 
     default:
-        socks5_fail(io);
+        proxy_fail(io);
         return;
     }
 }
@@ -387,14 +389,14 @@ static void socks5_handshake(hio_t* io) {
     proxy_conn_t* s5 = io->proxy;
     while (s5->rlen < s5->want) {
         int need = s5->want - s5->rlen;
-        if (s5->want > (int)sizeof(s5->rbuf)) { socks5_fail(io); return; }
+        if (s5->want > (int)sizeof(s5->rbuf)) { proxy_fail(io); return; }
         int n = recv(io->fd, (char*)s5->rbuf + s5->rlen, need, 0);
-        if (n == 0) { socks5_fail(io); return; }          // peer closed
+        if (n == 0) { proxy_fail(io); return; }            // peer closed
         if (n < 0) {
             int err = socket_errno();
             if (err == EAGAIN || err == EINTR) return;    // wait for more
             io->error = err;
-            socks5_fail(io);
+            proxy_fail(io);
             return;
         }
         s5->rlen += n;
@@ -407,17 +409,100 @@ static void socks5_handshake_start(hio_t* io) {
     proxy_conn_t* s5 = io->proxy;
     unsigned char buf[8];
     int n = socks5_build_method_request(s5, buf);
-    if (socks5_send(io, buf, n) != 0) { socks5_fail(io); return; }
+    if (proxy_send(io, buf, n) != 0) { proxy_fail(io); return; }
     socks5_expect(io, S5_RECV_METHOD, 2);
     hio_add(io, socks5_handshake, HV_READ);
 }
 
-// Dispatch the proxy handshake by protocol (only SOCKS5 implemented so far).
+// HTTP CONNECT handshake (RFC 7231 4.3.6): send a CONNECT request, then read
+// response headers until the blank line "\r\n\r\n". A 2xx status establishes
+// the tunnel. Like the SOCKS5 handshake this uses a dedicated recv() via
+// hio_add (never touches io->read_cb) and is robust to fragmentation.
+//
+// CONNECT responses carry no body, but a server-first origin protocol (SMTP,
+// IMAP, FTP...) may send its greeting immediately after the tunnel opens, so
+// those bytes can arrive in the same segment as the response headers. To avoid
+// swallowing them, we MSG_PEEK to locate the header terminator, then drain
+// EXACTLY the header bytes with a real recv(); anything after "\r\n\r\n" stays
+// in the socket for the upper-layer read path.
+static void http_connect_handshake(hio_t* io) {
+    proxy_conn_t* p = io->proxy;
+    for (;;) {
+        int cap = (int)sizeof(p->rbuf) - p->rlen;
+        if (cap <= 0) { proxy_fail(io); return; }   // headers too large
+        // peek (non-destructive): inspect what is available without consuming.
+        int n = recv(io->fd, (char*)p->rbuf + p->rlen, cap, MSG_PEEK);
+        if (n == 0) { proxy_fail(io); return; }      // peer closed
+        if (n < 0) {
+            int err = socket_errno();
+            if (err == EAGAIN || err == EINTR) return;   // wait for more
+            io->error = err;
+            proxy_fail(io);
+            return;
+        }
+        int have = p->rlen + n;
+        // search for "\r\n\r\n" in the peeked window (rescan from a safe offset)
+        int start = p->rlen >= 3 ? p->rlen - 3 : 0;
+        int term = -1;
+        for (int i = start + 3; i < have; ++i) {
+            if (p->rbuf[i-3]=='\r' && p->rbuf[i-2]=='\n' &&
+                p->rbuf[i-1]=='\r' && p->rbuf[i]=='\n') { term = i; break; }
+        }
+        if (term < 0) {
+            // no full header yet: consume the peeked bytes into the accumulator
+            // (they are all header bytes) and keep reading.
+            int got = recv(io->fd, (char*)p->rbuf + p->rlen, n, 0);
+            if (got <= 0) { proxy_fail(io); return; }
+            p->rlen += got;
+            continue;
+        }
+        // full header present. Drain exactly up to and including the terminator,
+        // leaving any trailing tunnel/greeting bytes in the socket.
+        int header_len = term + 1;              // bytes from socket start
+        int to_drain = header_len - p->rlen;    // not yet consumed
+        if (to_drain > 0) {
+            int got = recv(io->fd, (char*)p->rbuf + p->rlen, to_drain, 0);
+            if (got != to_drain) { proxy_fail(io); return; }
+            p->rlen += got;
+        }
+        // parse status line: "HTTP/1.x SP CODE SP ..."
+        int code = 0;
+        char* sp = (char*)memchr(p->rbuf, ' ', p->rlen);
+        if (sp) code = atoi(sp + 1);
+        if (code >= 200 && code < 300) {
+            proxy_established(io);
+        } else {
+            hlogw("connfd=%d http proxy CONNECT failed: %d", io->fd, code);
+            io->error = ERR_CONNECT;
+            proxy_fail(io);
+        }
+        return;
+    }
+}
+
+// Kick off the HTTP CONNECT handshake once the TCP connection to the proxy is up.
+static void http_connect_start(hio_t* io) {
+    proxy_conn_t* p = io->proxy;
+    // Max request: "CONNECT " + authority(<=262) + " HTTP/1.1\r\nHost: " +
+    // authority + "\r\nProxy-Authorization: Basic " + base64(255:255)=~684 +
+    // "\r\n\r\n" ~= 1.3KB. 2048 leaves headroom.
+    char buf[2048];
+    int n = http_connect_build_request(p, buf, (int)sizeof(buf));
+    if (n < 0) { proxy_fail(io); return; }
+    if (proxy_send(io, buf, n) != 0) { proxy_fail(io); return; }
+    p->rlen = 0;
+    hio_add(io, http_connect_handshake, HV_READ);
+}
+
+// Dispatch the proxy handshake by protocol.
 static void proxy_handshake_start(hio_t* io) {
     switch (io->proxy->setting.protocol) {
     case PROXY_PROTOCOL_SOCKS5:
         socks5_handshake_start(io);
         return;
+    case PROXY_PROTOCOL_HTTP_CONNECT:
+        http_connect_start(io);
+        return;
     default:
         io->error = ERR_INVALID_PARAM;
         hio_close(io);