c/ooni-probe-cli
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(filtering): implement HTTP filtering proxy (#565)

Browse Source 
Needed to finish the design at https://github.com/ooni/probe/issues/1803#issuecomment-957323297
This commit is contained in:
Simone Basso 2021-11-02 14:13:54 +01:00 committed by GitHub
parent a6f5388bac
commit 374577f5a8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 289 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
internal/netxlite/filtering/dns_test.go
View File

@ -29,7 +29,7 @@ func TestDNSProxy(t *testing.T) {
return r return r
} }
t.Run("DNSActionProxy with default proxy", func(t *testing.T) { t.Run("DNSActionPass", func(t *testing.T) {
ctx := context.Background() ctx := context.Background()
listener, done, err := newproxy(DNSActionPass) listener, done, err := newproxy(DNSActionPass)
if err != nil { if err != nil {

116
internal/netxlite/filtering/http.go Normal file
View File

@ -0,0 +1,116 @@
package filtering
import (
"net"
"net/http"
"net/http/httputil"
"net/url"
"github.com/ooni/probe-cli/v3/internal/runtimex"
)
// HTTPAction is an HTTP filtering action that this proxy should take.
type HTTPAction string
const (
// HTTPActionPass passes the traffic to the destination.
HTTPActionPass = HTTPAction("pass")
// HTTPActionReset resets the connection.
HTTPActionReset = HTTPAction("reset")
// HTTPActionTimeout causes the connection to timeout.
HTTPActionTimeout = HTTPAction("timeout")
// HTTPActionEOF causes the connection to EOF.
HTTPActionEOF = HTTPAction("eof")
// HTTPAction451 causes the proxy to return a 451 error.
HTTPAction451 = HTTPAction("451")
)
// HTTPProxy is a proxy that routes traffic depending on the
// host header and may implement filtering policies.
type HTTPProxy struct {
// OnIncomingHost is the MANDATORY hook called whenever we have
// successfully received an HTTP request.
OnIncomingHost func(host string) HTTPAction
}
// Start starts the proxy.
func (p *HTTPProxy) Start(address string) (net.Listener, error) {
listener, err := net.Listen("tcp", address)
if err != nil {
return nil, err
}
server := &http.Server{Handler: p}
go server.Serve(listener)
return listener, nil
}
var httpBlockpage451 = []byte(`<html><head>
<title>451 Unavailable For Legal Reasons</title>
</head><body>
<center><h1>451 Unavailable For Legal Reasons</h1></center>
<p>This content is not available in your jurisdiction.</p>
</body></html>
`)
const httpProxyProduct = "jafar/0.1.0"
// ServeHTTP serves HTTP requests
func (p *HTTPProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
// Implementation note: use Via header to detect in a loose way
// requests originated by us and directed to us.
if r.Header.Get("Via") == httpProxyProduct || r.Host == "" {
w.WriteHeader(http.StatusBadRequest)
return
}
p.handle(w, r)
}
func (p *HTTPProxy) handle(w http.ResponseWriter, r *http.Request) {
switch policy := p.OnIncomingHost(r.Host); policy {
case HTTPActionPass:
p.proxy(w, r)
case HTTPActionReset, HTTPActionTimeout, HTTPActionEOF:
p.hijack(w, r, policy)
case HTTPAction451:
w.WriteHeader(http.StatusUnavailableForLegalReasons)
w.Write(httpBlockpage451)
default:
w.WriteHeader(http.StatusInternalServerError)
}
}
func (p *HTTPProxy) hijack(w http.ResponseWriter, r *http.Request, policy HTTPAction) {
// Note:
//
// 1. we assume we can hihack the connection
//
// 2. Hijack won't fail the first time it's invoked
hijacker := w.(http.Hijacker)
conn, _, err := hijacker.Hijack()
runtimex.PanicOnError(err, "hijacker.Hijack failed")
defer conn.Close()
switch policy {
case HTTPActionReset:
if tc, ok := conn.(*net.TCPConn); ok {
tc.SetLinger(0)
}
case HTTPActionTimeout:
<-r.Context().Done()
case HTTPActionEOF:
// nothing
}
}
func (p *HTTPProxy) proxy(w http.ResponseWriter, r *http.Request) {
r.Header.Add("Via", httpProxyProduct) // see ServeHTTP
proxy := httputil.NewSingleHostReverseProxy(&url.URL{
Host: r.Host,
Scheme: "http",
})
proxy.Transport = http.DefaultTransport
proxy.ServeHTTP(w, r)
}

169
internal/netxlite/filtering/http_test.go Normal file
View File

@ -0,0 +1,169 @@
package filtering
import (
"context"
"net"
"net/http"
"net/url"
"strings"
"testing"
"time"
"github.com/apex/log"
"github.com/ooni/probe-cli/v3/internal/netxlite"
"github.com/ooni/probe-cli/v3/internal/runtimex"
)
func TestHTTPProxy(t *testing.T) {
newproxy := func(action HTTPAction) (net.Listener, error) {
p := &HTTPProxy{
OnIncomingHost: func(host string) HTTPAction {
return action
},
}
return p.Start("127.0.0.1:0")
}
httpGET := func(ctx context.Context, addr net.Addr, host string) (*http.Response, error) {
txp := netxlite.NewHTTPTransportStdlib(log.Log)
clnt := &http.Client{Transport: txp}
URL := &url.URL{
Scheme: "http",
Host: addr.String(),
Path: "/",
}
req, err := http.NewRequestWithContext(ctx, "GET", URL.String(), nil)
runtimex.PanicOnError(err, "http.NewRequest failed")
req.Host = host
return clnt.Do(req)
}
t.Run("HTTPActionPass", func(t *testing.T) {
ctx := context.Background()
listener, err := newproxy(HTTPActionPass)
if err != nil {
t.Fatal(err)
}
resp, err := httpGET(ctx, listener.Addr(), "nexa.polito.it")
if err != nil {
t.Fatal(err)
}
if resp.StatusCode != 200 {
t.Fatal("unexpected status code", resp.StatusCode)
}
resp.Body.Close()
listener.Close()
})
t.Run("HTTPActionPass with self connect", func(t *testing.T) {
ctx := context.Background()
listener, err := newproxy(HTTPActionPass)
if err != nil {
t.Fatal(err)
}
resp, err := httpGET(ctx, listener.Addr(), listener.Addr().String())
if err != nil {
t.Fatal(err)
}
if resp.StatusCode != 400 {
t.Fatal("unexpected status code", resp.StatusCode)
}
resp.Body.Close()
listener.Close()
})
t.Run("HTTPActionReset", func(t *testing.T) {
ctx := context.Background()
listener, err := newproxy(HTTPActionReset)
if err != nil {
t.Fatal(err)
}
resp, err := httpGET(ctx, listener.Addr(), "nexa.polito.it")
if err == nil || !strings.HasSuffix(err.Error(), netxlite.FailureConnectionReset) {
t.Fatal("unexpected err", err)
}
if resp != nil {
t.Fatal("expected nil resp")
}
listener.Close()
})
t.Run("HTTPActionTimeout", func(t *testing.T) {
ctx := context.Background()
ctx, cancel := context.WithTimeout(ctx, 1*time.Second)
defer cancel()
listener, err := newproxy(HTTPActionTimeout)
if err != nil {
t.Fatal(err)
}
resp, err := httpGET(ctx, listener.Addr(), "nexa.polito.it")
if err == nil || !strings.HasSuffix(err.Error(), "context deadline exceeded") {
t.Fatal("unexpected err", err)
}
if resp != nil {
t.Fatal("expected nil resp")
}
listener.Close()
})
t.Run("HTTPActionEOF", func(t *testing.T) {
ctx := context.Background()
listener, err := newproxy(HTTPActionEOF)
if err != nil {
t.Fatal(err)
}
resp, err := httpGET(ctx, listener.Addr(), "nexa.polito.it")
if err == nil || !strings.HasSuffix(err.Error(), netxlite.FailureEOFError) {
t.Fatal("unexpected err", err)
}
if resp != nil {
t.Fatal("expected nil resp")
}
listener.Close()
})
t.Run("HTTPAction451", func(t *testing.T) {
ctx := context.Background()
listener, err := newproxy(HTTPAction451)
if err != nil {
t.Fatal(err)
}
resp, err := httpGET(ctx, listener.Addr(), "nexa.polito.it")
if err != nil {
t.Fatal(err)
}
if resp.StatusCode != 451 {
t.Fatal("unexpected status code", resp.StatusCode)
}
resp.Body.Close()
listener.Close()
})
t.Run("unknown action", func(t *testing.T) {
ctx := context.Background()
listener, err := newproxy("")
if err != nil {
t.Fatal(err)
}
resp, err := httpGET(ctx, listener.Addr(), "nexa.polito.it")
if err != nil {
t.Fatal(err)
}
if resp.StatusCode != 500 {
t.Fatal("unexpected status code", resp.StatusCode)
}
resp.Body.Close()
listener.Close()
})
t.Run("Start fails on an invalid address", func(t *testing.T) {
p := &HTTPProxy{}
listener, err := p.Start("127.0.0.1")
if err == nil {
t.Fatal("expected an error")
}
if listener != nil {
t.Fatal("expected nil listener")
}
})
}

1
internal/netxlite/filtering/tls.go
View File

@ -48,7 +48,6 @@ func (p *TLSProxy) Start(address string) (net.Listener, error) {
return listener, err return listener, err
} }
// Start starts the proxy.
func (p *TLSProxy) start(address string) (net.Listener, <-chan interface{}, error) { func (p *TLSProxy) start(address string) (net.Listener, <-chan interface{}, error) {
listener, err := net.Listen("tcp", address) listener, err := net.Listen("tcp", address)
if err != nil { if err != nil {

6
internal/netxlite/filtering/tls_test.go
View File

@ -34,7 +34,7 @@ func TestTLSProxy(t *testing.T) {
return tdx.DialTLSContext(ctx, "tcp", endpoint) return tdx.DialTLSContext(ctx, "tcp", endpoint)
} }
t.Run("TLSActionProxy with default proxy", func(t *testing.T) { t.Run("TLSActionPass", func(t *testing.T) {
ctx := context.Background() ctx := context.Background()
listener, done, err := newproxy(TLSActionPass) listener, done, err := newproxy(TLSActionPass)
if err != nil { if err != nil {
@ -159,7 +159,7 @@ func TestTLSProxy(t *testing.T) {
<-done // wait for background goroutine to exit <-done // wait for background goroutine to exit
}) })
t.Run("TLSActionProxy fails because we don't have SNI", func(t *testing.T) { t.Run("TLSActionPass fails because we don't have SNI", func(t *testing.T) {
ctx := context.Background() ctx := context.Background()
listener, done, err := newproxy(TLSActionPass) listener, done, err := newproxy(TLSActionPass)
if err != nil { if err != nil {
@ -176,7 +176,7 @@ func TestTLSProxy(t *testing.T) {
<-done // wait for background goroutine to exit <-done // wait for background goroutine to exit
}) })
t.Run("TLSActionProxy fails because we can't dial", func(t *testing.T) { t.Run("TLSActionPass fails because we can't dial", func(t *testing.T) {
ctx := context.Background() ctx := context.Background()
listener, done, err := newproxy(TLSActionPass) listener, done, err := newproxy(TLSActionPass)
if err != nil { if err != nil {