cloudflare / cloudflare/pingora
Pingora In Front Of HTTP/HTTPS Proxies
- Dominant language
- Rust
- Stars
- 27.4k
- Forks
- 1.7k
- Avg merge
- 6h 22m
- Merged PRs (30d)
- 3
Description
Trying to setup a Pingora-based logic in front of an HTTP/HTTPS proxy (Squid etc) without luck.
When creating an HTTP request over cURL, the logic works as expected.
When creating an HTTPS request, the following error is shown:
cURL
```log
curl: (56) CONNECT tunnel failed, response 502
```
Pingora
```log
[ERROR pingora_proxy] Fail to proxy: Upstream ConnectError context: Fail to establish CONNECT proxy: addr: 127.0.0.1:3128, scheme: HTTP,proxy: next_hop: 127.0.0.1:3128, host: 127.0.0.1, port: 3128, cause: context: CONNECT proxy connect() error to "127.0.0.1:3128" cause: context: Fail to connect to 127.0.0.1:3128 cause: No such file or directory (os error 2), status: 502, tries: 1, retry: false, CONNECT google.com:443, Host: google.com:443
```
I know it related to the fact the HTTPS proxy are working over tunnels and the CONNECT method, and I'm not trying to create an SSL MITM proxy to read the content of the request. Just to be able to use the **request_filter** method of the **ProxyHttp** trait of Pingora.
Pingora
```rust
use async_trait::async_trait;
use pingora::proxy::{http_proxy_service, ProxyHttp, Session};
use pingora::server::Server;
use pingora::upstreams::peer::HttpPeer;
use pingora::Result;
pub struct Gateway {}
#[async_trait]
impl ProxyHttp for Gateway {
type CTX = ();
fn new_ctx(&self) -> Self::CTX {}
async fn upstream_peer(
&self,
_session: &mut Session,
_ctx: &mut Self::CTX,
) -> Result> {
Ok(Box::new(HttpPeer::new(
("127.0.0.1", 3128),
false,
"".to_string(),
)))
}
}
fn main() {
env_logger::init();
let mut server = Server::new(None).unwrap();
server.bootstrap();
let mut service = http_proxy_service(&server.configuration, Gateway {});
service.add_tcp("0.0.0.0:8080");
server.add_service(service);
server.run_forever();
}
```
Squid
```conf
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 443
acl CONNECT method CONNECT
http_access allow localhost manager
http_access allow localhost
http_access allow localnet
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny all
cache deny all
coredump_dir /var/spool/squid
logfile_rotate 10
```
cURL
```bash
curl -x http://localhost:8080 https://google.com
curl: (56) CONNECT tunnel failed, response 502
```
Would really appropriate a push in the right direction.
Contributor guide
Assessment
This issue has not been assessed yet.