cloudflare / cloudflare/pingora

Pingora In Front Of HTTP/HTTPS Proxies

Open
#200 8 comments 1 reaction 1 assignee Claimed by @andrewhavck View on GitHub
enhancement
Dominant language
Rust
Stars
27.4k
Forks
1.7k
Avg merge
6h 22m
Merged PRs (30d)
3

Description

Trying to setup a Pingora-based logic in front of an HTTP/HTTPS proxy (Squid etc) without luck.
When creating an HTTP request over cURL, the logic works as expected.
When creating an HTTPS request, the following error is shown:

cURL
```log
curl: (56) CONNECT tunnel failed, response 502
```

Pingora
```log
[ERROR pingora_proxy] Fail to proxy: Upstream ConnectError context: Fail to establish CONNECT proxy: addr: 127.0.0.1:3128, scheme: HTTP,proxy: next_hop: 127.0.0.1:3128, host: 127.0.0.1, port: 3128, cause: context: CONNECT proxy connect() error to "127.0.0.1:3128" cause: context: Fail to connect to 127.0.0.1:3128 cause: No such file or directory (os error 2), status: 502, tries: 1, retry: false, CONNECT google.com:443, Host: google.com:443
```

I know it related to the fact the HTTPS proxy are working over tunnels and the CONNECT method, and I'm not trying to create an SSL MITM proxy to read the content of the request. Just to be able to use the **request_filter** method of the **ProxyHttp** trait of Pingora.

Pingora

```rust
use async_trait::async_trait;

use pingora::proxy::{http_proxy_service, ProxyHttp, Session};
use pingora::server::Server;
use pingora::upstreams::peer::HttpPeer;
use pingora::Result;

pub struct Gateway {}

#[async_trait]
impl ProxyHttp for Gateway {
type CTX = ();
fn new_ctx(&self) -> Self::CTX {}

async fn upstream_peer(
&self,
_session: &mut Session,
_ctx: &mut Self::CTX,
) -> Result> {
Ok(Box::new(HttpPeer::new(
("127.0.0.1", 3128),
false,
"".to_string(),
)))
}
}

fn main() {
env_logger::init();
let mut server = Server::new(None).unwrap();
server.bootstrap();
let mut service = http_proxy_service(&server.configuration, Gateway {});
service.add_tcp("0.0.0.0:8080");
server.add_service(service);
server.run_forever();
}
```

Squid

```conf
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 443
acl CONNECT method CONNECT

http_access allow localhost manager
http_access allow localhost
http_access allow localnet
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny all

cache deny all

coredump_dir /var/spool/squid

logfile_rotate 10
```

cURL
```bash
curl -x http://localhost:8080 https://google.com
curl: (56) CONNECT tunnel failed, response 502
```

Would really appropriate a push in the right direction.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.